\documentclass[11pt]{article}
\usepackage[T1]{fontenc}
\usepackage[utf8]{inputenc}
\usepackage{lmodern,microtype,amsmath,amssymb,amsthm,mathtools}
\usepackage[margin=1in]{geometry}
\usepackage{enumitem,booktabs,longtable,array}
\usepackage[colorlinks=true,linkcolor=blue,citecolor=blue,urlcolor=blue]{hyperref}
\usepackage{bookmark}
\newtheorem{theorem}{Theorem}[section]
\newtheorem{lemma}[theorem]{Lemma}
\newtheorem{proposition}[theorem]{Proposition}
\newtheorem{corollary}[theorem]{Corollary}
\theoremstyle{remark}\newtheorem{remark}[theorem]{Remark}
\newcommand{\PPA}{\mathsf{PPA}}
\newcommand{\PWPP}{\mathsf{PWPP}}
\newcommand{\FP}{\mathsf{FP}}
\title{Unconditional implications of the Quasi-Riemann Hypothesis}
\author{Written by GPT 6 Astra}
\date{9 October 2026}
\begin{document}
\maketitle
\begin{abstract}
This record identifies published conclusions formerly obtained under RH
or GRH whose proofs require only a fixed zero-free half-plane for
Dirichlet $L$-functions, with further applications of finite-order Hecke
$L$-functions over $\mathbb Q(\sqrt{-3})$. The input is the $7/8$ theorem stated in the
recent OpenAI manuscript claiming to prove the quasi-Riemann Hypothesis. We give the uniform analytic deductions
explicitly and distinguish them from previously established algebraic
and combinatorial results used in the proofs. An accompanying audit
records the source verification and rejected candidates. No theorem
about all number-field or automorphic $L$-functions is inferred from the
Dirichlet statement; the pure cubic and cubic-nonresidue applications
separately identify the precise fixed-field Hecke input.
\end{abstract}

\clearpage
\paragraph{Principal conclusions.}
The following guide distinguishes complete published conclusions from
published orders of magnitude whose sharp GRH constants are not recovered.
The proofs specify every imported algebraic and computational input.
\begingroup\small
\begin{longtable}{@{}>{\raggedright\arraybackslash}p{0.29\linewidth}
                    >{\raggedright\arraybackslash}p{0.65\linewidth}@{}}
\toprule
Source & Conclusion recovered here\\\midrule
Montgomery--Vaughan & Character sums $\ll\sqrt q\log\log(3q)$;
Theorem~\ref{thm:pv}.\\[3pt]
Granville--Soundararajan & Uniform cancellation when
$\log x/\log\log q\to\infty$; Theorem~\ref{thm:gs-short}.\\[3pt]
Klurman--Mangerel--Ter\"av\"ainen & All four published uniform
short-progression conclusions for bounded multiplicative functions,
including the hybrid short-interval theorem, with the stated
typicality conditions; and $\mathcal L_3(q)\ll_\delta q^{2+\delta}$
for every modulus; Theorem~\ref{thm:multiplicative-short-progressions}
and Corollary~\ref{cor:kmt-three-primes}.\\[3pt]
Walsh & The complete linear Fourier-cancellation conclusion for
M\"obius and Liouville in intervals with
$\log H/\log\log X\to\infty$;
Theorem~\ref{thm:walsh-fourier}.\\[3pt]
Green--Tao & The full published power-saving improvement for
M\"obius correlations with polynomial nilsequences,
$O_{m,d}(Q^{C_{m,d}}(1+\|F\|_{\rm Lip})N^{-c_{m,d}})$,
with $c_{m,d}>0$ and effective constants;
Theorem~\ref{thm:green-tao-power}.\\[3pt]
Mangerel & Quadratic Gauss-sum rigidity from approximate prime
dilations up to $N^c$, for every fixed $c>0$, with the full
published sparse-prime allowance;
Theorem~\ref{thm:gauss-rigidity}.\\[3pt]
Sofos; Montgomery & Infinitely many primes with both the first prime
nonresidue and the next gap $\gg\log p\log\log p$; the published
Paley clique lower order follows from the same argument;
Theorem~\ref{thm:large-nonresidue-gaps} and
Corollary~\ref{cor:paley-large-cliques}.\\[3pt]
Mourtada--Murty & Both quadratic Euler--Kronecker extreme-value
bounds, with leading terms $\log\log x+\log\log\log x$ and
$\gg\sqrt x$ prime conductors below $x$ for each sign;
Theorem~\ref{thm:extreme-quadratic-euler-kronecker}.\\[3pt]
Badzyan; Ford--Luca--Moree & The full all-conductor bound
$|\gamma_{\mathbb Q(\zeta_m)}|\ll\log m\log\log(3m)$ and
the published GRH error for the second coefficient in counting
$n$ with $q\nmid\varphi(n)$;
Theorem~\ref{thm:cyclotomic-euler-kronecker} and
Corollary~\ref{cor:totient-second-coefficient}.\\[3pt]
Hough & Exact maximum bias for products of two primes,
$(\log\log\log x)/\log\log x$; Theorem~\ref{thm:hough-bias}.\\[3pt]
Littlewood & Two-sided $L(1,\chi)$ bounds and the orders of magnitude
for $\zeta$, $1/\zeta$, and $\zeta'/\zeta$ on the line $1$.\\[3pt]
Darbar--David--Lal\'{i}n--Lumley & Both extreme-value distribution
formulas for cubic $L(1,\chi)$, throughout the full published GRH
ranges with endpoint constant $-37$;
Theorem~\ref{thm:cubic-l1-tails}.\\[3pt]
Granville--Soundararajan & Both quadratic $L(1,\chi_d)$ tail
asymptotics with error $O(A^{-1}+t^{-1})$, throughout the full
published larger range with endpoint constant $-20$;
Theorem~\ref{thm:quadratic-l1-tails}.\\[3pt]
Hoffstein--Lockhart & Effective bounds
$L(1,\operatorname{Ad}f)^{-1},\ |\rho_f(1)|^2\ll\log(1+\lambda N)$
for every Maass newform, including the dihedral case;
Theorem~\ref{thm:maass-first-coefficients}.\\[3pt]
Boyd--Kisilevsky & Effective growth of the imaginary quadratic
class-group exponent; Theorem~\ref{thm:class-exponent}.\\[3pt]
Ellenberg--Venkatesh & The exact GRH exponents for torsion in
every quadratic and every cubic ideal class group, with effective
constants and no exceptional fields, and the specified further
families in every fixed degree;
Theorem~\ref{thm:quadratic-cubic-torsion} and
Corollary~\ref{cor:torsion-covered-fields}.\\[3pt]
Lamzouri & The full sharper odd-class-number average
$\frac{15}{4}H^2/\log H+O(H^2(\log\log H)^3/(\log H)^2)$;
Theorem~\ref{thm:odd-class-average}.\\[3pt]
Louboutin & Effective exponent growth in the specified family of
simplest cyclic cubic fields; Theorem~\ref{thm:simplest-cubic}.\\[3pt]
Daileda & The class-number bound
$h_F\ll\sqrt{D_F}\ell(D_F)/\log D_F$ for all pure cubic fields;
Theorem~\ref{thm:pure-cubic-class}.\\[3pt]
Pollack & The exact limiting mean of the least completely split
prime in cyclic fields of every fixed odd prime degree;
Theorem~\ref{thm:mean-split-prime}.\\[3pt]
Elsenhans--Kl\"uners--Nicolae; Euler--Kani & Complete $1046$-field
classification for exponent dividing $8$, and the exact $65$ idoneal
integers; Theorems~\ref{thm:ekn} and~\ref{thm:idoneal}.\\[3pt]
Chang--Kwon; Miyada & Complete lists of $489$ imaginary abelian
fields, and $301$ multiquadratic fields, with one class per genus.\\[3pt]
Ahn--Kwon & Exactly $650$ imaginary multiquadratic fields with
class-group exponent dividing $2$, with independently verified
finite computations; Theorem~\ref{thm:ahn-kwon}.\\[3pt]
Mollin; Louboutin & Exactly $107$ real quadratic fields of extended
Richaud--Degert type with ordinary class number two, and exactly
$43$ with class number one, using the same fresh complete finite
computation; Theorem~\ref{thm:rd-class-two} and
Corollary~\ref{cor:rd-class-one}.\\[3pt]
Louboutin & The complete $19$-value exceptional-case classification
for $\omega(d+x^2)\leq2$, and hence the full $42$-value list for odd
$d$; Theorem~\ref{thm:polynomial-factor-count}.\\[3pt]
Bourdon--Pollack & CM torsion in odd degree has upper order
$(d\log\log d)^{2/3}$; Theorem~\ref{thm:cm-torsion}.\\[3pt]
Clark--Genao--Pollack--Saia & The exact typical degrees
$d_{\rm CM}(X_0(N))=(\log N)^{(\log2)/2+o(1)}$ and
$d_{\rm CM}(X_1(N))=N(\log N)^{(\log2)/2+o(1)}$;
the least nonsquare which is a square modulo $N$ has typical size
$(\log N)^{\log2+o(1)}$;
Theorem~\ref{thm:typical-cm-degrees} and
Corollary~\ref{cor:cmtyp-nonsquare}.\\[3pt]
Banwait & An unconditional algorithm bounding every prime-degree
isogeny over each eligible quadratic field;
Theorem~\ref{thm:quadratic-isogeny-bound}.\\[3pt]
Rasmussen--Tamagawa & The full uniform finiteness theorem for all
dimensions and all fixed odd degrees; Theorem~\ref{thm:rt-odd-degree}.\\[3pt]
Sch\"utt; Elkies--Sch\"utt & Finitely many rational CM newforms
per weight up to the specified twists; every rational weight-$3$
newform has a singular K3 realization over $\mathbb Q$.\\[3pt]
Kani & The exact $21$ exceptional types of non-CM elliptic products
which are not genus-$2$ Jacobians; Theorem~\ref{thm:kani-21}.\\[3pt]
Pasten; Wei & The all-Heegner-point height error of order
$\log\log d_K$ and the root-discriminant height bound for adjacent
CM types; Theorems~\ref{thm:heegner-height} and~\ref{thm:wei-height}.\\[3pt]
Binyamini--Kowalski & Fully effective Andr\'e--Oort bounds and
enumeration for arbitrary subvarieties of $Y(1)^n$;
Theorem~\ref{thm:effective-ao}; effective polynomial bounds in
Theorem~\ref{thm:ao-polynomial}.\\[3pt]
Edixhoven--Richard & The Andr\'e--Oort statement for reductions of
full CM orbits modulo any prime; Theorem~\ref{thm:modp-ao}.\\[3pt]
Habegger & Weakly bounded height on every nonspecial modular-plane
curve with unequal projection degrees;
Theorem~\ref{thm:weakly-bounded-height}.\\[3pt]
Balestrieri--Johnson--Newton & Effective computation of the
Brauer--Manin set for every singular K3 surface and every geometric
Kummer surface of a product of CM elliptic curves;
Theorem~\ref{thm:cm-k3-brauer-manin}.\\[3pt]
Khayutin & Joint equidistribution of CM packets and Galois orbits
in the published two-fixed-split-prime setting, including bounded
order conductors; Theorem~\ref{thm:joint-cm-equidistribution}.\\[3pt]
Duke--Schulze-Pillot; Duke & Effective primitive-spinor representation
thresholds, and effective $n>CD^{337}$ squarefree representation;
Theorems~\ref{thm:effective-ternary} and~\ref{thm:duke337}.\\[3pt]
Kane; Elkies--Ono--Yang & Effective CM lifting to every supersingular
class, with multiplicity bounds and the polynomial congruence;
Theorem~\ref{thm:kane-cm-lifting}.\\[3pt]
Campagna & Effective enumeration of singular $S_\ell$-units for
$S_\ell=\{p:p\equiv1\pmod3\}\cup\{\ell\}$, $\ell\geq5$;
Theorem~\ref{thm:singular-s-units}.\\[3pt]
Achter--Howe; Arul et al. & The published GRH orders for split
abelian surfaces and for pairs of $D_4$-curves with isogenous Jacobians.\\[3pt]
Je\v r\'abek; Adleman--Manders--Miller & The stated total-search
complexity memberships for factoring, and deterministic extraction of
fixed-degree roots in prime fields.\\
Miller & Deterministic polynomial-time equivalence of factoring,
$\varphi$, $\lambda$, and $\lambda'$, with one supplied value;
the period-oracle equivalence and graph-recognition conclusions;
Theorem~\ref{thm:miller-equivalence}.\\
Gao; R\'onyai & Polynomial-time balance decomposition and proper
factoring of squarefree completely split polynomials of even degree;
Theorem~\ref{thm:even-splitting}.\\
R\'onyai; Ivanyos et al. & Deterministic proper factoring when
three divides the degree of a completely split polynomial;
Theorem~\ref{thm:three-divisible-splitting}.\\
Pollack--Schorn & The exact expected bit complexity for three-square
representations without a supplied factorization;
Theorem~\ref{thm:three-square-algorithm}.\\
Balaji--Nosan--Shirmohammadi--Worrell & Square-root circuit identity
testing in $\mathrm{coRP}$; Theorem~\ref{thm:radical-identity}.\\
Balaji--Perifel--Shirmohammadi--Worrell & General cyclotomic identity
testing in $\mathrm{BPP}$ and the deterministic restricted diagonal
theorem; Theorems~\ref{thm:cyclotomic-bpp} and~\ref{thm:cyclotomic-diagonal}.\\
Castel; Kutas & A randomized polynomial-time isotropic-vector
algorithm in dimension at least five without a factorization oracle;
Theorem~\ref{thm:castel-isotropy}.\\
Wesolowski & Polynomial-time prime sampling for every primitive
positive definite integral quadratic form of rank at least two,
with the published interval and input-size dependence;
Theorem~\ref{thm:quadratic-prime-values}.\\
Herl\'edan Le Merdy--Wesolowski & The full worst-case to average-case
reduction to supersingular maximal orders for every prime $p>3$,
including the formerly conditional $p\equiv1\pmod8$ case;
Theorem~\ref{thm:average-maxorder}.\\
\bottomrule
\end{longtable}
\endgroup

\clearpage
{\footnotesize\tableofcontents}
\clearpage

\section{The analytic input and uniform consequences}\label{sec:analytic}

Throughout, $\log$ is the natural logarithm, $\Lambda$ is the von Mangoldt
function, and sums indexed by $n\leq x$ run over positive integers unless
an interval or a different index set is explicitly specified. Put
\[
 \vartheta=\frac78,\qquad \delta=1-\vartheta=\frac18,
 \qquad \ell(x)=\log\log(e^e x)\quad(x\geq1).
\]
The harmless modification in $\ell$ makes bounds meaningful also for small
arguments. All constants below are absolute and effective unless a
dependence is specified.

\begin{theorem}[Imported zero-free theorem]\label{thm:input}
For every Dirichlet character $\chi$ modulo a positive integer $q$, its
Dirichlet $L$-function has no zero in $\Re s>7/8$. The pole at $s=1$ for a
principal character is excepted.
\end{theorem}

This is the Dirichlet part of \cite[Theorem 1.1]{OAI}. We use it as a cited
unconditional theorem. We do not claim to have supplied a new proof of it.
The companion \cite{OAIshort} gives the weaker boundary $11/12$; that
boundary would suffice for all qualitative conclusions in this record,
with larger fixed logarithmic exponents in the intermediate estimates.

For a primitive nonprincipal character, the functional equation relates
$L(s,\chi)$ to $L(1-s,\overline\chi)$. Since Theorem~\ref{thm:input}
also applies to $\overline\chi$, every nontrivial zero $\rho=\beta+i\gamma$
satisfies
\begin{equation}\label{eq:strip}
 \delta\leq\beta\leq\vartheta.
\end{equation}
The same assertion holds for the nontrivial zeros of $\zeta$.
Uniformity in $q$ below is derived from this zero location and the ordinary
explicit formula. It is not inferred from uniformity of the fixed-character
estimates in the proof of \cite{OAI}.

\begin{lemma}[Uniform prime sum]\label{lem:psi}
For a primitive nonprincipal character $\chi$ modulo $q\geq3$ and $x\geq2$,
\[
 \psi(x,\chi):=\sum_{n\leq x}\Lambda(n)\chi(n)
 \ll x^{7/8}\log^2(qx).
\]
Also $\psi(x)=x+O(x^{7/8}\log^2(2x))$.
\end{lemma}
\begin{proof}
We use the classical uniform truncated explicit formula and zero count
\cite[Chapters 16 and 19]{Davenport}; these analytic identities and bounds
are unconditional. At a half-integer $x$, choose a permissible height
$T\asymp x$. For a primitive nonprincipal character the formula is
\[
 \psi(x,\chi)=-\sum_{|\gamma|\leq T}\frac{x^\rho}{\rho}
       +O(\log^2(qx)),
\]
where, after \eqref{eq:strip}, the terms from trivial zeros and the
logarithmic derivative at zero are included in the error. To justify this
last uniformity explicitly, subtract the completed logarithmic derivatives
at $1$ and $2$. The zero contribution has terms
$((1-\rho)(2-\rho))^{-1}$, whose absolute sum is $O_\delta(\log(3q))$.
The absolutely convergent Dirichlet series bounds $L'/L(2,\chi)$, and the
gamma factors and functional equation then bound the finite Laurent
coefficient at zero by $O_\delta(\log(3q))$.

The usual zero count is
\[
 N_\chi(U):=\#\{\rho:|\Im\rho|\leq U\}
       \ll (U+1)\log(q(U+2)),
\]
with multiplicities. The zeros with $|\gamma|\leq1$ contribute
$O_\delta(\log(3q))$ to $\sum1/|\rho|$; partial summation for the
remaining zeros gives
\[
 \sum_{|\gamma|\leq T}\frac1{|\rho|}
       \ll_\delta\log^2(q(T+2)).
\]
Now $|x^\rho|\leq x^{7/8}$ gives the assertion at half-integers. Moving
an arbitrary $x$ to a neighboring half-integer changes the sum by
$O(\log(2x))$, which is absorbed. The argument for $\zeta$ is the same,
with the residue $x$ of its pole included.
\end{proof}

\begin{lemma}[A short logarithmic expansion]\label{lem:logL}
For every primitive nonprincipal character modulo $q\geq3$ and $y\geq2$,
\begin{equation}\label{eq:short-log}
 \log L(1,\chi)
 =\sum_{n\leq y}\frac{\Lambda(n)\chi(n)}{n\log n}
 +O\left(\frac{y^{-1/8}\log^2(qy)}{\log y}\right).
\end{equation}
The logarithm is the branch obtained by continuation of the Euler-product
logarithm from the real interval $s>1$.
\end{lemma}
\begin{proof}
For $\Re s>1$ the Euler product gives
\[
 \log L(s,\chi)=\sum_{n\geq2}
              \frac{\Lambda(n)\chi(n)}{n^s\log n}.
\]
Lemma~\ref{lem:psi} and summation by parts give locally uniform convergence
of the series on $\Re s>7/8$. Its exponential agrees with $L$ initially
on $\Re s>1$, hence throughout this zero-free half-plane by analytic
continuation. At $s=1$, the tail is
\[
 -\frac{\psi(y,\chi)}{y\log y}
 +\int_y^\infty
    \psi(u,\chi)\frac{\log u+1}{u^2(\log u)^2}\,du.
\]
Its absolute value has the asserted bound. For example, put $u=yv$,
use $\log(qyv)\leq\log(qy)+\log v$ and $\log(yv)\geq\log y$,
and integrate $v^{-9/8}(1+\log v)^2$. This also proves the claimed
uniformity and effectivity.
\end{proof}

\begin{theorem}[Littlewood bounds in order of magnitude]\label{thm:L1}
For all primitive nonprincipal Dirichlet characters $\chi$ modulo $q$,
\[
 \frac{c}{\ell(q)}\leq |L(1,\chi)|\leq C\ell(q)
\]
for fixed effective $c,C>0$.
\end{theorem}
\begin{proof}
In Lemma~\ref{lem:logL} take $y=(\log(3q))^{24}$. The error is bounded
absolutely, since $y^{-1/8}=(\log(3q))^{-3}$ and
$\log(qy)\ll\log(3q)$. The elementary Mertens estimate gives
\[
 \sum_{n\leq y}\frac{\Lambda(n)}{n\log n}
          =\log\log y+O(1).
\]
Consequently $|\Re\log L(1,\chi)|\leq\log\log y+O(1)$.
Exponentiating gives $c/\log y\leq|L(1,\chi)|\leq C\log y$;
$\log y=24\log\log(3q)\asymp\ell(q)$ proves the result.
\end{proof}

These are the previously GRH-conditional orders of magnitude of
Littlewood's bounds; see \cite{Littlewood} and \cite[(1.1)]{FI}.
The sharper leading constants obtained under GRH are not asserted here.
For real primitive nonprincipal characters, $L(1,\chi)>0$, so the absolute
values may be omitted.
The effective imaginary-quadratic class-number consequence below is
already explicitly announced in \cite[Introduction]{OAIshort}; its
proof is included to establish the common input of the later applications.

\begin{corollary}[Quadratic class numbers]\label{cor:class}
For a negative fundamental discriminant $D$,
\[
 \frac{c\sqrt{|D|}}{\ell(|D|)}\leq h(D)
       \leq C\sqrt{|D|}\ell(|D|).
\]
For every negative quadratic-order discriminant $\Delta$,
\begin{equation}\label{eq:order-class}
 h(\Delta)\ll\sqrt{|\Delta|}\ell(|\Delta|)^2,
 \qquad H(\Delta)\ll\sqrt{|\Delta|}\ell(|\Delta|)^3,
\end{equation}
where $h(\Delta)$ is the proper ideal class number and
$H(f^2D)=\sum_{d\mid f}h(d^2D)$.
\end{corollary}
\begin{proof}
The analytic class-number formula is
$h(D)=w_D\sqrt{|D|}L(1,\chi_D)/(2\pi)$, with $w_D\in\{2,4,6\}$.
Apply Theorem~\ref{thm:L1}.
If $\Delta=f^2D$, the order class-number formula gives
\[
 h(f^2D)=\frac{f h(D)}{[\mathcal O_D^\times:\mathcal O_{f^2D}^\times]}
      \prod_{p\mid f}\left(1-\frac{\chi_D(p)}p\right)
 \leq h(D)\sigma(f).
\]
Here $\sigma(f)=\sum_{d\mid f}d\ll f\ell(f)$. Thus
$h(f^2D)\ll f\sqrt{|D|}\ell(f^2|D|)^2$.
Summing this bound over $d\mid f$ gives
\[
 H(f^2D)\ll \sqrt{|D|}\ell(f^2|D|)^2\sigma(f)
          \ll f\sqrt{|D|}\ell(f^2|D|)^3.
\]
The unit index is retained; dropping it as an equality would be incorrect
for certain nonmaximal orders in $\mathbb Q(i)$ and
$\mathbb Q(\sqrt{-3})$.
\end{proof}

The upper bounds \eqref{eq:order-class} are precisely the GRH-conditional
orders in \cite[Lemma 4.4]{AH}. Their uniformity in both $D$ and $f$ is
needed in the geometric applications below.

\begin{lemma}[Small character witnesses]\label{lem:witness}
There is an effective absolute constant $C_0$ such that, for every
nonprincipal character $\chi$ modulo $q\geq3$, there is a prime $p$ with
\[
 p\leq C_0(\log(3q))^8,\qquad p\nmid q,\qquad\chi(p)\ne1.
\]
In particular the primes up to this bound which are coprime to $q$
generate $(\mathbb Z/q\mathbb Z)^\times$.
\end{lemma}
\begin{proof}
First let $\chi$ be primitive nonprincipal, with conductor $f$. Perron's
formula with kernel $1/(s(s+1))$, followed by a contour shift, gives
\begin{equation}\label{eq:smoothed}
 \sum_{n\leq x}\Lambda(n)\chi(n)(1-n/x)
  =-\sum_\rho\frac{x^\rho}{\rho(\rho+1)}+O(\log(fx)).
\end{equation}
For completeness, the integral on the initial line $\Re s=2$ is
$-(2\pi i)^{-1}\int (L'/L)(s,\chi)x^s/(s(s+1))\,ds$.
The residues at the nontrivial zeros give the displayed sum. The poles
of the kernel at $0,-1$, and coincident trivial zeros in the relevant
parity, give $O(\log(fx))$; the uniform finite Laurent coefficients are
bounded by the logarithmic-derivative argument in the proof of
Lemma~\ref{lem:psi}. The further trivial-zero residues are absolutely
convergent and $O(1+\log x)$, and the remaining integrals tend to zero
along admissible heights. This is also the usual integrated explicit
formula of \cite[Chapter 19]{Davenport}.
By \eqref{eq:strip} and the zero count,
\[
 \sum_\rho\frac1{|\rho(\rho+1)|}\ll\log(3f).
\]
Thus the left side of \eqref{eq:smoothed} is
$O(x^{7/8}\log(3f)+\log(fx))$.

If $\chi$ modulo $q$ is induced from $\chi^*$ of conductor $f\mid q$,
the omitted prime powers contribute at most
\[
 \sum_{p\mid q}\sum_{p^a\leq x}\log p
          \leq\omega(q)\log x\ll\log(3q)\log x.
\]
Suppose now that $\chi(p)=1$ for every $p\leq x$ coprime to $q$.
The smoothed sum would equal
\[
 \sum_{n\leq x}\Lambda(n)(1-n/x)
 -\sum_{\substack{p^a\leq x\\p\mid q}}\log p(1-p^a/x).
\]
The first term is $x/2+O(x^{7/8}\log^2(2x))$ by
Lemma~\ref{lem:psi} and integration; the second is
$O(\log(3q)\log x)$. Compare this with \eqref{eq:smoothed} and take
$x=C_0(\log(3q))^8$. The ratio of the character-zero bound to $x$
is $O(C_0^{-1/8})$; the other errors are $o(x)$ uniformly as $q\to\infty$.
Choose $C_0$ sufficiently large, then enlarge it effectively for the
finitely many remaining moduli. This contradicts the main term $x/2$.

Finally, if the indicated primes generated a proper subgroup of the finite
abelian unit group, a nontrivial character of the quotient would be $1$
on every one of them. Lifting it gives a nonprincipal Dirichlet character,
contradicting the assertion just proved.
\end{proof}

The lemma strengthens the conservative logarithmic exponent used in
\cite[Corollary 1.2]{OAI}. We use it as an intermediate estimate, without
claiming that the exact GRH exponent $2$ in Ankeny's theorem has been
recovered.

\section{The Montgomery--Vaughan character-sum bound}\label{sec:pv}

The following is the classical GRH-conditional order of magnitude of
Montgomery and Vaughan \cite{MV}; see also \cite[(1.2)]{GS}.
The proof below replaces the GRH input and keeps this order of magnitude.

\begin{theorem}\label{thm:pv}
For every nonprincipal Dirichlet character $\chi$ modulo $q\geq3$ and
every real $u<v$,
\[
 \left|\sum_{u<n\leq v}\chi(n)\right|\ll\sqrt q\,\ell(q),
\]
with an effective absolute constant.
\end{theorem}
\begin{proof}
We first prove the assertion for primitive characters and sums beginning
at $1$. Write $e(t)=\exp(2\pi i t)$.

Let $\vartheta=7/8$ and $\delta=1-\vartheta=1/8$. We use the zero-free theorem for every Dirichlet $L$-function, including all products of the characters below. All constants in this argument are effective and absolute.

The uniform explicit formula and partial summation imply that, for every nonprincipal Dirichlet character $\eta$ modulo $Q$ and $t\ge2$,
\[
 \sum_{p\le t}\eta(p)\ll t^{\vartheta}\log^2(Qt).
 \tag{P}
\]
For primitive characters this follows from the zero bound $\beta\le\vartheta$; prime powers cost $O(\sqrt t\log^2t)$, which is absorbed since $\vartheta>1/2$. If $\eta$ is imprimitive, replacing it by its primitive inducing character removes at most the primes dividing $Q$, a contribution at most $\omega(Q)\ll\log(2Q)$, also absorbed in (P). The modest logarithmic exponent in (P) is sufficient; no optimized version is needed.

We first record a consequence without an additive phase. Let $\mathcal S(y)$ denote the positive integers whose prime factors are all at most $y$, including $1$. Set $P^+(1)=1$. For $2\le y\le X$, write each integer $n\le X$ outside $\mathcal S(y)$ uniquely as $n=pm$, where $p=P^+(n)$ is its largest prime factor. Then $m\le X/y$ and $p\ge P^+(m)$. Thus
\[
 \sum_{\substack{n\le X\\n\notin\mathcal S(y)}}\eta(n)
 =\sum_{m\le X/y}\eta(m)
   \sum_{\substack{y<p\le X/m\\p\ge P^+(m)}}\eta(p).
\]
The inner sum is a difference of two prime sums covered by (P), including the possible lower-endpoint prime. Consequently
\[
 \left|\sum_{\substack{n\le X\\n\notin\mathcal S(y)}}\eta(n)\right|
 \ll \log^2(QX)X^\vartheta
          \sum_{m\le X/y}m^{-\vartheta}
 \ll Xy^{-\delta}\log^2(QX).
 \tag{U}
\]
If $X<y$, the sum is zero. Partial summation therefore gives, uniformly for $1\le Z\le q$ and $Q\le q(\log q)^4$,
\[
 \sum_{\substack{n\le Z\\n\notin\mathcal S(y)}}\frac{\eta(n)}n
 \ll y^{-\delta}(\log q)^3.
 \tag{H}
\]
Here and below it suffices to take $q$ larger than an absolute effective threshold. Explicitly, if $A(t)$ denotes the sum in (U), its weighted version is
$A(Z)/Z+\int_1^Z A(t)t^{-2}\,dt$; inserting (U) and $\log(Qt)\ll\log q$ proves (H).

Put $L=\log q$ and
\[
 s=L^4,\qquad S=L^8,\qquad y=L^{64}.
\]
We may assume $q$ is large enough that $S<q$, $y<q$, and $s<q$. All smaller conductors are absorbed into the absolute constant by the classical Polya--Vinogradov inequality (or the trivial bound); this is an effective finite range.

We next show that, for every primitive nonprincipal $\chi\pmod q$, every $r\le s$, every $(b,r)=1$, and every $1\le Z\le q$,
\[
 \sum_{n\le Z}\frac{\chi(n)e(bn/r)}n\ll\log\log q.
 \tag{R}
\]
Split the sum according to $d=(n,r)$ and put $v=r/d$, $n=dm$. The condition $(n,r)=d$ is exactly $(m,v)=1$. Because every prime factor of $d$ is at most $r\le s<y$, the integer $n$ is $y$-smooth if and only if $m$ is $y$-smooth. Define $\tau(\psi)=\sum_{a\bmod v}\psi(a)e(a/v)$. On the reduced residue classes modulo $v$, finite character orthogonality gives
\[
 e(bm/v)=\frac1{\varphi(v)}
     \sum_{\psi\bmod v}\tau(\overline\psi)\psi(b)\psi(m),
 \qquad (m,v)=1.
\]
Thus the difference between the left side of (R) and its restriction to $\mathcal S(y)$ is
\[
 \sum_{d\mid r}\frac{\chi(d)}d\frac1{\varphi(v)}
 \sum_{\psi\bmod v}\tau(\overline\psi)\psi(b)
 \sum_{\substack{m\le Z/d\\m\notin\mathcal S(y)}}
       \frac{(\chi\psi)(m)}m,
 \qquad v=r/d.
\]
Every product $\chi\psi$ is nonprincipal. Indeed, if it were principal on the units modulo $\operatorname{lcm}(q,v)$, the primitive inducing characters of $\chi$ and $\overline\psi$ would coincide, forcing $q\mid v$, whereas $v\le r<q$. Its modulus may be taken to be $qv\le qL^4$, so (H) applies. The standard Gauss-sum bound $|\tau(\psi)|\le\sqrt v$, valid also for imprimitive characters, yields the error bound
\[
 \ll y^{-1/8}L^3\sum_{d\mid r}\frac{\sqrt{r/d}}d
 \le y^{-1/8}L^3\sqrt r\sum_{d\ge1}d^{-3/2}
 \ll L^{-8}L^3L^2=L^{-3}.
\]
Notice that the divisor sum actually converges; a crude harmonic divisor bound is unnecessary. The restricted sum has absolute value at most
\[
 \sum_{n\in\mathcal S(y)}\frac1n
 =\prod_{p\le y}(1-p^{-1})^{-1}
 \ll\log y\ll\log\log q
\]
by Mertens' product estimate. This proves (R).

It remains to reduce an arbitrary phase to (R). We use the following unconditional Montgomery--Vaughan bound, recorded as Lemma 4.2 in Granville--Soundararajan: if $f$ is completely multiplicative with $|f(n)|\le1$, $|\alpha-b/r|\le r^{-2}$ and $(b,r)=1$, then, for $2\le R\le r$ and $T\ge Rr$,
\[
 \left|\sum_{Rr\le n\le T}\frac{f(n)e(n\alpha)}n\right|
 \ll\log\log(3T)+\frac{(\log R)^{3/2}}{\sqrt R}\log(3T).
 \tag{MV}
\]
Its implied constant is absolute.

Choose a reduced rational approximation $b/r$ with $r\le S$ and
\[
 |\alpha-b/r|\le\frac1{rS}.
\]
Integer roundings in Dirichlet approximation can be avoided by replacing $S$ by $\lceil S\rceil$ throughout; this changes only absolute constants and none of the following estimates.

If $s<r\le S$, split the harmonic exponential sum at $r^2$. The part $n\le r^2$ is $O(\log(2r))=O(\log L)$. Apply (MV) to the remaining part with $R=r$. Since $r>L^4$ and $\log r\ll\log L$, its bound is
\[
 O\!\left(\log L+
     \frac{(\log r)^{3/2}}{\sqrt r}L\right)
 =O(\log L).
\]
If $r^2>q$, the initial segment is the entire sum and the same bound holds (for the assumed large $q$ one has $r^2<q$ anyway).

Now suppose $r\le s$, and write $\beta=\alpha-b/r$ and
\[
 N=\min\{q,(r|\beta|)^{-1}\},
\]
with the second quantity infinite when $\beta=0$. For $n\le N$,
\[
 \sum_{n\le N}\frac{|e(n\alpha)-e(bn/r)|}n
 \ll |\beta|N\le r^{-1}\le1.
 \tag{A}
\]
If $N=q$, (R) and (A) finish the proof. Otherwise $N=(r|\beta|)^{-1}\ge S$.

For completeness, a distinct second rational approximation can be chosen without a boundary ambiguity. Let $Q_1=\lceil2N\rceil$. Dirichlet's theorem gives a reduced $b_1/r_1$ with $r_1\le Q_1$ and
$|\alpha-b_1/r_1|\le1/(r_1Q_1)$. This rational differs from $b/r$, because the error of $b/r$ is exactly $1/(rN)>1/(rQ_1)$. Therefore
\[
 \frac1{rr_1}
 \le\left|\frac br-\frac{b_1}{r_1}\right|
 \le\frac1{rN}+\frac1{r_1Q_1},
\]
which implies $r_1\ge N-Nr/Q_1\ge N-r/2\ge N/2$. Also $r_1\le Q_1\le3N$, and the new approximation satisfies $|\alpha-b_1/r_1|\le r_1^{-2}$.

Put $R=L^5$. For large $q$, $R\le r_1$ because $r_1\ge S/2=L^8/2$. The interval $N<n\le\min(q,Rr_1)$ contributes at most
\[
 \sum_{N<n\le3RN}\frac1n\ll\log(3R)\ll\log L.
\]
If $q>Rr_1$, apply (MV) with the new approximation to the remaining interval. Its contribution is
\[
 \ll\log L+\frac{(\log R)^{3/2}}{\sqrt R}L
 \ll\log L.
\]
Together with (A), this proves
\[
 \sum_{n\le q}\frac{\chi(n)e(n\alpha)}n
 =\sum_{n\le N}\frac{\chi(n)e(bn/r)}n+O(\log\log q)
 \ll\log\log q,
 \tag{F}
\]
uniformly for every real $\alpha$.

Finally, P\'olya's truncated Fourier expansion for a primitive nonprincipal character gives, uniformly for $0\leq t\leq q$,
\[
 \sum_{n\le t}\chi(n)
 =\frac{\tau(\chi)}{2\pi i}
    \sum_{1\le|h|\le q}\frac{\overline\chi(h)}h
         (1-e(-ht/q))+O(\log(2q)).
\]
At jump points the choice of endpoint convention changes the formula by at most one, absorbed in the error. Separate positive and negative $h$ and use (F) for $\overline\chi$ at phases $0,t/q,-t/q$. Since $|\tau(\chi)|=\sqrt q$, we obtain
\[
 M(\chi):=\max_{1\le t\le q}\left|\sum_{n\le t}\chi(n)\right|
 \ll\sqrt q\log\log q.
\]
Replacing $\log\log q$ by $\log\log(3q)$ gives a positive uniform expression for all $q\ge3$.

It remains to treat imprimitive characters and arbitrary intervals.
Let $\chi$ modulo $q$ be induced by the primitive nonprincipal character
$\chi^*$ modulo $f$, and put $R=\prod_{p\mid q,\,p\nmid f}p$.
Inclusion--exclusion gives, for every $x\geq0$,
\[
 \sum_{n\leq x}\chi(n)
 =\sum_{d\mid R}\mu(d)\chi^*(d)\sum_{m\leq x/d}\chi^*(m).
\]
The inner sum is bounded by the primitive maximum, at every endpoint,
by periodicity and the zero sum over a complete period. Moreover
\[
 \frac{2^{\omega(R)}}{\sqrt R}
 =\prod_{p\mid R}\frac2{\sqrt p}
 \leq\frac4{\sqrt6}<2,
 \qquad fR\mid q.
\]
Indeed, only $p=2,3$ can make a factor exceed $1$.
Thus the imprimitive maximum is at most
$2C\sqrt q\,\ell(q)$. Differences of two initial sums prove the
assertion for intervals, including negative endpoints by periodicity.
\end{proof}

\paragraph{What the proof changes.}
The direct alteration of \cite[Lemma 5.1]{GS} would give an exponent
$7/8+1/3>1$, and is insufficient. Here the unconditional
Montgomery--Vaughan estimate reduces the problem to additive characters
of denominator at most $(\log q)^4$. Smooth truncation on these rational
phases then needs only prime sums without an additive phase. Neither the
sharp GRH leading constants nor the refinements for characters of small
odd order are asserted by this theorem.

\section{Cancellation in the Granville--Soundararajan range}
\label{sec:short-character-sums}

The first assertion of Granville--Soundararajan's
\cite[Corollary A]{GS2001} states, under GRH, that a nonprincipal
character sum is $o(x)$ whenever $q\to\infty$ and
$\log x/\log\log q\to\infty$. This range is much shorter than the
range in which the P\'olya--Vinogradov estimate alone gives
cancellation. We recover the whole qualitative assertion, by an
argument using Hal\'asz's theorem instead of the source's sharper
smooth-number approximation.

\begin{theorem}[Granville--Soundararajan's cancellation conclusion]
\label{thm:gs-short}
There is an effective absolute constant $C$ such that, for every
nonprincipal character $\chi$ modulo $q\geq3$ and $3\leq x\leq q$,
\[
 \left|\sum_{n\leq x}\chi(n)\right|
 \leq Cx\frac{\log(2u)}u,
 \qquad
 u=\max\left\{1,\frac{\log x}{\log\log(3q)}\right\}.
\]
In particular, uniformly over nonprincipal characters,
\[
 \sum_{n\leq x}\chi(n)=o(x)
 \quad\text{if}\quad q\to\infty,
 \qquad \frac{\log x}{\log\log q}\to\infty.
\]
The last statement permits $x>q$ as well.
\end{theorem}
\begin{proof}
We first extend the prime-sum bound to imprimitive characters. If
$\chi$ is induced by the primitive nonprincipal character $\chi^*$
of conductor $f\mid q$, then
\[
 |\psi(v,\chi)-\psi(v,\chi^*)|
 \leq\sum_{p\mid q}\sum_{p^k\leq v}\log p
 \leq\omega(q)\log v\ll\log(3q)\log(2v).
\]
Consequently Lemma~\ref{lem:psi} implies, uniformly for all these
characters and $v\geq2$,
\begin{equation}\label{eq:short-psi-all}
 \psi(v,\chi)\ll v^{7/8}\log^2(qv).
\end{equation}

Put $L=\log(3q)$ and $y=L^{32}$. For $0\leq\sigma\leq1$,
$|t|\leq L$, and $s=1+\sigma+it$, summation by parts in the
Euler-product logarithm gives
\begin{equation}\label{eq:short-complex-log}
 \log L(s,\chi)
 =\sum_{n\leq y}\frac{\Lambda(n)\chi(n)}{n^s\log n}
  +O\left((1+|t|)y^{-1/8}\log^2(qy)\right).
\end{equation}
Here the logarithm is continued from $\Re s>1$; for $\sigma=0$
the identity follows by locally uniform convergence. For precision,
the omitted tail equals
\[
 -\frac{\psi(y,\chi)}{y^s\log y}
 +\int_y^\infty\psi(v,\chi)v^{-s-1}
       \left(\frac{s}{\log v}+\frac1{(\log v)^2}\right)\,dv.
\]
Using \eqref{eq:short-psi-all}, its modulus is bounded by the error
in \eqref{eq:short-complex-log}, uniformly in the stated rectangle.
The integral estimate follows upon writing $v=yw$ and integrating
$w^{-9/8}(1+\log w)^2$. Since
$\log(qy)\ll L$ and $y^{-1/8}=L^{-4}$, that error is $O(L^{-1})$.
The elementary Mertens estimate therefore gives
\[
 \log|L(1+\sigma+it,\chi)|
 \leq\sum_{n\leq y}\frac{\Lambda(n)}{n\log n}+O(1)
 =\log\log y+O(1).
\]
Together with the absolutely convergent Euler product for
$\sigma>0$, this proves
\begin{equation}\label{eq:short-L-bound}
 |L(1+\sigma+it,\chi)|
 \ll\min\{\log y,\sigma^{-1}\}
 \quad(0<\sigma\leq1, |t|\leq L).
\end{equation}

We use the following precise unconditional form of Hal\'asz's
theorem: \cite[Theorem 1.1, $\kappa=1$]{GHH}. If a multiplicative
function $a$ has Dirichlet series $F(s)$ whose logarithmic derivative
has coefficients $\Lambda_a(n)$ satisfying
$|\Lambda_a(n)|\leq\Lambda(n)$, then, for $x$ sufficiently large,
\[
 \left|\sum_{n\leq x}a(n)\right|
 \ll\frac{x}{\log x}\int_{1/\log x}^1
 \left(\max_{|t|\leq\log x}
       \left|\frac{F(1+\sigma+it)}{1+\sigma+it}\right|\right)
       \frac{d\sigma}{\sigma}
       +\frac{x\log\log x}{\log x}.
\]
The absolute implied constant is effective. For $a(n)=\chi(n)$,
one has $F=L(\cdot,\chi)$ and
$\Lambda_a(n)=\chi(n)\Lambda(n)$, so its hypotheses hold, including
for imprimitive characters.

Suppose first that $x\geq y$, so $u=\log x/\log L\geq32$.
Set $a=\log y=32\log L$ and $v=\log x$, so $v\geq a>1$.
Since $\log x\leq\log q<L$, estimate
\eqref{eq:short-L-bound} applies throughout Hal\'asz's integral.
Moreover $|1+\sigma+it|\geq1$. Splitting at $\sigma=1/a$ yields
\[
 \int_{1/v}^1\min\{a,\sigma^{-1}\}\frac{d\sigma}{\sigma}
 =a\log(v/a)+a-1.
\]
It follows that
\[
 \frac1x\left|\sum_{n\leq x}\chi(n)\right|
 \ll\frac{32}{u}\left(1+\log\frac{u}{32}\right)
       +\frac{\log\log x}{\log x}
 \ll\frac{\log(2u)}u.
\]
For the last inequality, write
$\log\log x=\log u+\log\log L$ and use
$\log L\geq\log\log9>0$; both
$1/\log L$ and $|\log\log L|/\log L$ are bounded in this range.
When $x<y$, one has $1\leq u<32$, and the trivial bound
$|\sum_{n\leq x}\chi(n)|\leq x$ proves the claim after increasing
the absolute constant. This also absorbs the bounded values of $x$
omitted from the stated form of Hal\'asz's theorem.

The asserted limit for $x\leq q$ follows since
$\log(2u)/u\to0$. For $x\geq q$, periodicity and the vanishing of
one complete nonprincipal character sum give
$\sum_{n\leq x}\chi(n)=\sum_{n\leq r}\chi(n)$ for some
$0\leq r<q$. Theorem~\ref{thm:pv} bounds the last expression by
$O(\sqrt q\,\ell(q))=o(q)$, which is also $o(x)$.
\end{proof}

Only the cancellation conclusion of \cite[Corollary A]{GS2001}
is claimed here. The quantitative decay proved above is weaker than
the paper's GRH smooth-number estimates. Its unconditional examples
with large character sums at lengths $(\log q)^A$, for each fixed
$A$, already show why the condition $u\to\infty$ is necessary for
this uniform qualitative conclusion.

\section{Multiplicative functions in short arithmetic progressions}
\label{sec:multiplicative-short-progressions}

The following removes the GRH qualifications from Corollary~1.1
and Theorems~1.2, 1.4, and~1.5 of Klurman--Mangerel--Ter\"av\"ainen
\cite{KMT2023}. These are estimates for arbitrary bounded
multiplicative functions, with a single character correction.
The conditions concerning typical moduli are part of the published
statements and are retained.

Write $\mathbb U=\{z\in\mathbb C:|z|\leq1\}$ and set
\[
 \mathbb D_q(f,g;x)^2
 =\sum_{\substack{p\leq x\\p\nmid q}}
       \frac{1-\operatorname{Re}(f(p)\overline{g(p)})}{p}.
\]
An integer $q$ is $y$-typical if, for every real $z\geq y$,
\[
 \#\{p\leq z:p\mid q\}\leq\frac1{100}\pi(z).
\]
For a character $\chi\pmod q$ and $(a,q)=1$, put
\[
 E_f(x;q,a;\chi)
 =\sum_{\substack{n\leq x\\n\equiv a\ (q)}}f(n)
 -\frac{\chi(a)}{\varphi(q)}\sum_{n\leq x}f(n)\overline{\chi(n)}.
\]
For modulus $1$, the unique character and the unique residue
class are understood in the usual way. A star on a residue-class
sum means that only invertible classes are summed.

\begin{theorem}[The full published short-progression conclusions]
\label{thm:multiplicative-short-progressions}
Let $f:\mathbb N\to\mathbb U$ be multiplicative.
\begin{enumerate}
\item Suppose $1\leq Q\leq x/10$ and
$(\log(x/Q))^{-1/200}\leq\varepsilon\leq1$.
For every prime $p\leq Q$, choose $\chi_1\pmod p$ minimizing
\[
 \inf_{|t|\leq\log x}\mathbb D_p(f,\chi(n)n^{it};x).
\]
Then
\[
 \sum_{a\ (p)}^*|E_f(x;p,a;\chi_1)|^2
 \ll\varepsilon\frac{x^2}{p}.
\]
\item Fix $\eta>0$. Suppose $x\geq10$,
$(\log x)^{-1/200}\leq\varepsilon\leq1$, and
$Q\leq x^{1/2-100\eta}$. If $f$ vanishes outside the
$x^\eta$-smooth positive integers, then for every $q\leq Q$,
with $\chi_1$ chosen by the same minimization with modulus $q$,
\[
 \max_{(a,q)=1}|E_f(x;q,a;\chi_1)|
 \ll_\eta\varepsilon\frac{x}{q}.
\]
\item Under the parameter assumptions in part~1, for every
$(x/Q)^{\varepsilon^2}$-typical $q\leq Q$, and with $\chi_1$
again chosen by that minimization,
\[
 \sum_{a\ (q)}^*|E_f(x;q,a;\chi_1)|^2
 \ll\varepsilon\varphi(q)\left(\frac{x}{q}\right)^2.
\]
\item Suppose $X\geq h\geq10$, $1\leq Q\leq h/10$, and
$(\log(h/Q))^{-1/200}\leq\varepsilon\leq1$.
For every $(h/Q)^{\varepsilon^2}$-typical $q\leq Q$, choose
$(\chi_1,t_1)$ to minimize
$\mathbb D_q(f,\chi(n)n^{it};X)$ over characters modulo $q$
and real $|t|\leq X$. Put
\[
 B_f(x,h;q,a)=\frac{\chi_1(a)}{\varphi(q)}
 \left(\int_x^{x+h}v^{it_1}\,dv\right)
 \frac1{3X}\sum_{n\leq3X}f(n)\overline{\chi_1(n)}n^{-it_1}.
\]
Then
\[
 \int_X^{2X}\sum_{a\ (q)}^*
 \left|\sum_{\substack{x<n\leq x+h\\n\equiv a\ (q)}}f(n)
       -B_f(x,h;q,a)\right|^2\,dx
 \ll\varepsilon\varphi(q)X\left(\frac hq\right)^2.
\]
\end{enumerate}
All implied constants are uniform in the displayed parameters and
in $f$; only that in part~2 may depend on the fixed $\eta$.
Any minimizing character or minimizing pair may be used.
\end{theorem}

\begin{proof}
We state explicitly the unconditional analytic input from
\cite{KMT2023}; this distinguishes the imported mean-value
estimates from the new removal of the zero hypothesis. Section~3.2
of that paper identifies sufficient sets of good moduli by
\begin{equation}\label{eq:kmt-good-moduli}
 \mathcal G(u,\varepsilon)=
 \left\{q\leq u:
 \begin{array}{l}
 L(s,\chi)\ne0\text{ for every }\chi\pmod q
       \text{ with }\operatorname{cond}(\chi)>u^{\varepsilon^{200}},\\
 \displaystyle\operatorname{Re}s\geq
       1-\varepsilon^{-100}\frac{\log\log u}{\log u},
       \quad |\operatorname{Im}s|\leq3u
 \end{array}\right\}.
\end{equation}
The four conclusions above hold unconditionally when the modulus
is restricted to this set, with $u=x$ in parts~1--3 and $u=X$
in part~4. No zero-density estimate is required when membership
in this set is known for every modulus.

For clarity, the published proof of this input uses Lemma~8.2
to bound prime character sums in the prescribed zero-free region,
then Propositions~8.3 and~8.5 to control, respectively, the size
and the number of large twisted multiplicative sums. Proposition~9.2
and character orthogonality give the variance conclusions; the exact
identity used here is
\[
 \sum_{a\ (q)}^*|E_f(x;q,a;\chi_1)|^2
 =\frac1{\varphi(q)}
   \sum_{\substack{\chi\ (q)\\\chi\ne\chi_1}}
     \left|\sum_{n\leq x}f(n)\overline{\chi(n)}\right|^2.
\]
Proposition~9.4 and the Parseval reduction in \S9.2, equation~(50),
give the hybrid conclusion with the displayed integral main term.
Section~11, especially \S11.3.2, gives the smooth-supported
pointwise conclusion. The only character sums omitted from the
zero-free condition have small conductor; their treatment is
unconditional in Lemma~7.9 and Lemma~8.2. The large-conductor
conditions appearing in these arguments are precisely those
recorded in \eqref{eq:kmt-good-moduli}: in the variance and hybrid
proofs their width is at most
$\varepsilon^{-88}\log\log u/\log u$ after the
$\varepsilon^{1.1}$ substitution in \S9.2, while in \S11.3.2
the width is $\varepsilon^{-100}\log\log u/\log u$.
The conductor cutoffs used there are larger than
$u^{\varepsilon^{200}}$. Lemma~8.1 estimates the number of
excluded moduli by a zero-density theorem; that counting step is
the step which becomes unnecessary here.

There is a parameter detail in applying these published arguments
at the smallest permitted $\varepsilon$, which we verify rather
than suppress. In \S9.2 the substitution
$\varepsilon\mapsto\varepsilon^{1.1}$ can fall below the stated
lower range in Propositions~9.2 and~9.4. In their proofs, however,
the separation inequalities~(52) and the sieve-error estimates
use $\log R>\varepsilon^{-100}$, where $R=x/Q$ or $h/Q$.
The original assumption gives $\log R\geq\varepsilon^{-200}$,
and therefore, after substitution, still gives
$\log R\geq(\varepsilon^{1.1})^{-100}$.
All the power inequalities used in those separation estimates
have this margin. The upper-range requirement on $M$ in
Lemma~8.1 estimates the number of bad moduli only; it is not
needed for the analytic estimates on a specified good modulus.

There are also calls to Proposition~8.3 and Corollary~8.4 with
parameter $\kappa=\varepsilon^{6.6}$ in \S9 and
$\kappa=\varepsilon^{9.5}$ in \S11.3.2. These can fall below
their displayed bound $\kappa\geq(\log u)^{-1/50}$.
Under our fixed strip the versions needed here remain valid in the larger
range
\begin{equation}\label{eq:kmt-auxiliary-range}
 (\log u)^{-1/20}\leq\kappa\leq c,
\end{equation}
where $c>0$ is a fixed sufficiently small constant.
Here are the required checks. The truncated Perron formula
used in the proof of Lemma~8.2, equation~(34), can now be shifted
to $\operatorname{Re}s=15/16$. The fixed distance from all
nontrivial zeros bounds the logarithmic derivative there by
$O((\log u)^2)$ for $q\leq u$ and
$|\operatorname{Im}s|\leq3u$. With height of order
$(\log u)^{1000}$, shifted if necessary to avoid the zeta pole
on a horizontal side, this gives, uniformly for $|t|\leq2.1u$,
\begin{equation}\label{eq:kmt-twisted-primes}
 \sum_{n\leq P}\Lambda(n)\chi(n)n^{-it}
 =\mathbf1_{\chi=\chi_0}\frac{P^{1-it}}{1-it}
  +O\!\left(P^{15/16}(\log u)^3+
              \frac{P}{(\log P)^{100}}\right)
\end{equation}
for $u^{\kappa^{5.5}}\leq P\leq u$.
The Perron truncation error follows by absolute values from
$|\Lambda(n)\chi(n)n^{-it}|\leq\log n$, exactly as in that
equation. When the pole at $s=1-it$ is outside the truncated
rectangle, its displayed term is $O(P/(\log u)^{1000})$
and is absorbed by the error. Removing Euler factors at primes
dividing $q$ contributes at most $O((\log u)^2)$, also absorbed.
The same argument treats zeta after its pole is subtracted.

In \eqref{eq:kmt-auxiliary-range},
$\log P\geq(\log u)^{29/40}$; hence the error in
\eqref{eq:kmt-twisted-primes} is $o(\kappa^{10}P)$.
This proves Lemma~8.2(i) in this larger range for every
nonprincipal character, and for the principal character when
$|t|\geq\kappa^{-10}$, as required. For a nonprincipal
character, partial summation and Mertens' theorem now give
\[
 \mathbb D_q(\chi(n)n^{it},1;u)^2
 \geq5.5\log(1/\kappa)+O(1).
\]
The omission of primes dividing $q$ costs $O(1)$ here, since
the omitted primes under consideration exceed
$u^{\kappa^{5.5}}$. For the principal character,
the unconditional estimate~(35) in the source gives
$(1/3-o(1))\log\log u$ when
$(\log u)^{-1/2}\leq|t|\leq2.1u$.
This is larger than $5.5\log(1/\kappa)+O(1)$ because
$5.5/20=11/40<1/3$. Thus Lemma~8.2(ii) also extends.

The proof of Proposition~8.3 now applies: its first part uses
this distance lower bound against the upper bound
$5.48\log(1/\kappa)+O(1)$, and the remainder
$(\log u)^{-1/4}$ in the unconditional Hal\'asz estimate
of Lemma~7.4 is $o(\kappa)$.
For the second part we use only $|t|\leq u/2$ and $Z\leq u$.
Then every auxiliary $|v|\leq Z/2$ satisfies $|t+v|\leq u$,
so the minimizing property of $t_1\in[-u,u]$ is applicable;
also $|t+v-t_1|\leq2u$. This restriction avoids extending the
minimizing property outside its defining interval.
The damping of primes in $[P,Q]$ costs
at most $\frac16\log(1/\kappa)$ in squared distance.
The remaining coefficient of $\log\log u$ is at least
$1/12-1/120-o(1)=3/40-o(1)>1/15$.
The claimed $(\log u)^{-1/15}$ saving therefore survives,
including the Hal\'asz prefactor.
Integrating the weights $r^{\omega_{[P,Q]}(n)}$ over
$0\leq r\leq1$ proves Corollary~8.4 in the same enlarged
range and for this restricted $t$-range, as in its published proof.
This suffices for the hybrid application, because its relevant
upper frequency is
\[
 T=\frac Xh\left(\frac hQ\right)^{0.01\varepsilon^{1.1}}
 \leq Xh^{-0.99}<X/2.
\]
The part of the Parseval reduction with larger frequencies uses
the unconditional mean-value estimate of Lemma~6.2 instead.
In the progression-only application the twist is $t=0$;
in the logarithmic-range version of Remark~8.1 the
$\frac12\log u$ ranges for both $t$ and the auxiliary
Hal\'asz twist keep their sum inside $[-\log u,\log u]$.
The uses of Proposition~8.5 require parameters
$\varepsilon^{2.2}$ in \S9 and $\varepsilon^3$ in \S11;
these already satisfy its stated lower bound
$(\log u)^{-1/30}$ and need no enlargement.
Finally $6.6/200<1/20$ and $9.5/200<1/20$, so
\eqref{eq:kmt-auxiliary-range} covers both applications above.
These checks justify the published deductions throughout the
exact endpoint ranges in the theorem.

In every one of the four parameter ranges we have
\[
 \varepsilon\geq(\log u)^{-1/200}.
\]
Indeed $\log(x/Q)\leq\log x$ and
$\log(h/Q)\leq\log X$. Consequently
\begin{equation}\label{eq:kmt-strip-width}
 0<\varepsilon^{-100}\frac{\log\log u}{\log u}
 \leq\frac{\log\log u}{\sqrt{\log u}}.
\end{equation}
Choose an absolute effectively computable $u_0$ so large that
the right side is strictly less than $1/8$ for $u\geq u_0$.
The entire rectangle in \eqref{eq:kmt-good-moduli} then lies
in $\operatorname{Re}s>7/8$. By the imported Dirichlet QRH
theorem, all primitive nonprincipal Dirichlet $L$-functions are
nonzero there. If $\chi$ is induced by $\chi^*$, then
\[
 L(s,\chi)=L(s,\chi^*)
    \prod_{\substack{p\mid q\\p\nmid\operatorname{cond}(\chi)}}
       (1-\chi^*(p)p^{-s}).
\]
The additional factors have no zero when $\operatorname{Re}s>0$.
The cutoff in \eqref{eq:kmt-good-moduli} is greater than $1$,
so it excludes the principal character. Therefore
\[
 \mathcal G(u,\varepsilon)=[1,u]\cap\mathbb Z
       \qquad(u\geq u_0)
\]
uniformly throughout the required range of $\varepsilon$.
Applying the unconditional analytic input proves all four claims
for these $u$.

It remains to verify uniformity for the bounded range $10\leq u<u_0$.
Here $\varepsilon\geq(\log u_0)^{-1/200}$ and $q\leq u_0$.
In parts~1--3, each progression contains at most $x/q+1$ terms,
and the character main term has modulus at most $x/\varphi(q)$.
These bounds, with $q\leq u_0$ and $x/q\geq1$, imply the stated
pointwise and variance estimates after increasing an absolute
constant. In part~4, each short progression contains at most
$h/q+1$ terms and $|B_f|\leq h/\varphi(q)$. Integrating the
squared trivial bound over an interval of length $X$ similarly
gives the asserted result, with a constant depending only on
$u_0$. This completes the proof for all the stated parameters.
\end{proof}

\begin{corollary}[The published GRH bound for the least product of three primes]
\label{cor:kmt-three-primes}
For every fixed $\delta>0$ there is an effective $C_\delta$
such that every reduced residue class $a\pmod q$ contains an
integer $n=p_1p_2p_3\leq C_\delta q^{2+\delta}$ with exactly
three prime factors counted with multiplicity. Equivalently,
\[
 \mathcal L_3(q):=
 \max_{(a,q)=1}\min\{n\geq1:n\equiv a\pmod q,\ \Omega(n)=3\}
 \ll_\delta q^{2+\delta}.
\]
For $q$ sufficiently large in terms of $\delta$ the three
primes may additionally be required to be at most $q$.
\end{corollary}

\begin{proof}
The bound for $\mathcal L_3$ is explicitly recorded under GRH
in \cite[\S2]{KMT2023}. We use the positive lower-bound
consequence of its Proposition~12.2, whose proof in \S12.2
applies to all moduli despite its caption mentioning primes.
Choose a fixed sufficiently small $\alpha>0$ with
$1000\alpha<\min(\delta,1)$, and set
\[
 P_1=q^{1000\alpha},\qquad P_2=P_3=q.
\]
That proposition gives a positive weighted count of triples
\[
 P_j^{1-\alpha}\leq p_j\leq P_j\quad(1\leq j\leq3),
 \qquad p_1p_2p_3\equiv a\pmod q,
\]
provided all Dirichlet $L$-functions modulo $q$ have no zero
in
\[
 \operatorname{Re}s\geq1-\frac{M(\alpha)}{\log q},
 \qquad |\operatorname{Im}s|\leq(\log q)^3,
\]
for an effective $M(\alpha)$.
The principal character is included here: its $L$-function
has a pole at $1$, which is not a zero. For
$q>\exp(8M(\alpha))$ the zero-free requirement follows
from the fixed strip for zeta and Dirichlet $L$-functions,
and the extra imprimitive Euler factors have no zeros
in this rectangle.

To see positivity without depending on a multiplicity convention,
take the ordered triples produced by the character expansion
in the proof of Proposition~12.2. Their reciprocal-product
mass has a positive main term proportional to
\[
 \frac1{\varphi(q)}
 \prod_{j=1}^3
   \sum_{\substack{P_j^{1-\alpha}\leq p\leq P_j\\p\nmid q}}\frac1p,
\]
with relative error $O(\alpha)$ in that proof. Each prime sum
tends to $-\log(1-\alpha)>0$ by the prime number theorem.
Deleting primes dividing $q$ costs
$O(\log q/P_j^{1-\alpha})=o(1)$.
Thus the mass is positive for fixed sufficiently small
$\alpha$ and large $q$. Counting an integer once instead
of with its representation multiplicity changes this mass
by a factor between $1$ and $6$, so positivity is unchanged.
A detected product is at most
$P_1P_2P_3=q^{2+1000\alpha}\leq q^{2+\delta}$ and all its
prime factors are at most $q$.
For the finitely many smaller $q$, the unconditional theorem
on primes in arithmetic progressions supplies a product
of exactly three primes in each reduced class: fix a prime
$r\nmid q$ and take a prime $p\equiv ar^{-2}\pmod q$.
An effective bound for this finite range is absorbed into
$C_\delta$.
\end{proof}

\paragraph{Scope.}
The conclusion for typical moduli is uniform for every such
modulus, rather than outside a small exceptional set. The
character correction remains necessary for general $f$; for
example $f=\chi$ itself has a large correlation with that
character. The smooth-support assumption in part~2 is retained.
The zero-free input has been used only in a rectangle whose width
tends uniformly to zero, so the fixed strip suffices without
square-root error terms for primes.

% Bibliography:
% \bibitem{KMT2023} O. Klurman, A. P. Mangerel, and J. Ter\"av\"ainen,
% Multiplicative functions in short arithmetic progressions,
% Proc. London Math. Soc. (3) 127 (2023), 366--446.
% \href{https://doi.org/10.1112/plms.12546}{doi:10.1112/plms.12546}.

% Bibliography: WalshScaling = M. N. Walsh, Invent. Math.241(2025),325--362,
% DOI10.1007/s00222-025-01343-y. Author-endorsed full version arxiv2310.07873.
% MRTFourier = K. Matomaki, M. Radziwill, T. Tao, Invent.Math.220(2020),1--58,
% DOI10.1007/s00222-019-00926-w. Correction DOI00931-z concerns funding only.
\section{Fourier uniformity in intervals longer than every fixed logarithmic power}
\label{sec:walsh-fourier}

Walsh's published Fourier-cancellation conclusion \cite{WalshScaling}
assumes GRH and allows intervals longer than every fixed power of
$\log X$. Its analytic input is a twisted prime estimate with some
positive power saving. The value of that saving is not part of the
conclusion. We prove that estimate, including its uniformity in the real
twist, and use the published inverse argument only in the short-interval
range needed here. The remaining interval lengths are covered by a
previous unconditional theorem.
References to intermediate numbered results are to the full author
version linked from Walsh's publication page.

For a complex multiplicative function $g$ with $|g(n)|\leq1$, put
\[
 \mathcal D(g;T,Q)=\inf_{\substack{|t|\leq T\\
                    \chi\ ({\rm mod}\ q),\ q\leq Q}}
 \left(\sum_{p\leq T}\frac{1-\Re(g(p)p^{it}\chi(p))}{p}\right)^{1/2}.
\]
Characters in this definition need not be primitive. Write
$e(u)=\exp(2\pi i u)$.

\begin{theorem}[Walsh's Fourier-cancellation conclusion]\label{thm:walsh-fourier}
If $H=H(X)\leq X$ and
$\log H/\log\log X\to\infty$, then, for $g=\mu$ or $g=\lambda$,
\[
 \int_X^{2X}\sup_{\alpha\in\mathbb R/\mathbb Z}
 \left|\sum_{x\leq n\leq x+H}g(n)e(\alpha n)\right|\,dx=o(HX).
\]
Here $\mu$ and $\lambda$ are respectively the M\"obius and Liouville
functions. The frequency inside the supremum may vary with $x$.
Equivalently, for every $\eta>0$ there are $K>1$ and $X_0$ such that
the integral is less than $\eta HX$ whenever $X\geq X_0$ and
$(\log X)^K\leq H\leq X$.
\end{theorem}

\begin{lemma}[The precise twisted prime input]\label{lem:walsh-prime-input}
There are absolute constants $c>0$ and $A>1$ such that, for every
Dirichlet character $\chi$ modulo $q$, every real $t$, and
$P\gg(\log(3q(2+|t|)))^A$,
\[
 \frac1P\left|\sum_{n\leq P}\Lambda(n)\chi(n)n^{it}\right|
 \ll\frac{\delta_\chi}{1+|t|}+P^{-c},
\]
where $\delta_\chi=1$ for a principal character and is zero otherwise.
More precisely, uniformly for $P\geq2$,
\begin{equation}\label{eq:walsh-twisted-perron}
 \sum_{n\leq P}\Lambda(n)\chi(n)n^{it}
 =\delta_\chi\frac{P^{1+it}}{1+it}
  +O\left(P^{15/16}\log^2(3qP(2+|t|))\right).
\end{equation}
The same constants, after alteration, give
\begin{equation}\label{eq:walsh-prime-block}
 \left|\sum_{P\leq p\leq2P}\chi(p)p^{it}\right|
 \ll\frac P{\log P}
 \left(\frac{\delta_\chi}{1+|t|}+P^{-c}\right)
\end{equation}
in the stated logarithmic range.
\end{lemma}
\begin{proof}
We may assume $P\geq3$, since the bounded range $2\leq P<3$ is
absorbed by the error in \eqref{eq:walsh-twisted-perron}.
Let $a=15/16$ and $b=1+1/\log P\leq2$. The zero-free theorem and the
classical local partial-fraction expansion of $L'/L$ imply
\begin{equation}\label{eq:walsh-logderiv}
 -\frac{L'}{L}(s,\chi)=\frac{\delta_\chi}{s-1}
   +O(\log(3q(2+|\Im s|)))\qquad(a\leq\Re s\leq2).
\end{equation}
Indeed, there are $O(\log(3q(2+|\Im s|)))$ zeros with ordinate within
one of $\Im s$; each is horizontally separated from this strip by
at least $1/16$. The remaining terms in the local expansion obey the
same logarithmic bound. For an induced character the additional terms
are bounded by
\[
 \sum_{p\mid q}\frac{\log p}{p^a-1}\ll\log(3q).
\]
Thus the assertion includes principal and imprimitive characters.

First take $P$ to be a half-integer and put
$U=P^2(2+|t|)$. Truncated Perron's formula for
$-L'/L(s-it,\chi)$ gives
\[
 \sum_{n\leq P}\Lambda(n)\chi(n)n^{it}
 =\frac1{2\pi i}\int_{b-iU}^{b+iU}
      -\frac{L'}{L}(s-it,\chi)\frac{P^s}{s}\,ds
   +O\left(\frac{P\log^2(2P)}U+\log^2(2P)\right).
\]
The absolute values of the coefficients are at most $\Lambda(n)$, so
the truncation error has no factor depending on $t$. Shift the contour
to $\Re s=a$. The only pole crossed is $s=1+it$ when $\chi$ is
principal; it lies strictly between the horizontal sides and contributes
the displayed main term. On the left side, $|s-1-it|\geq1/16$ and
\eqref{eq:walsh-logderiv} bounds the integral by
\[
 \ll P^a\log(3q(P+U+|t|))\log(2U)
 \ll P^a\log^2(3qP(2+|t|)).
\]
Each horizontal side contributes
$O(P\log(3q(P+U+|t|))/U)$. This proves
\eqref{eq:walsh-twisted-perron} at half-integers. Changing the cutoff
by at most one changes the sum by $O(\log(2P))$ and its main term by
$O(1)$, since the derivative of $v^{1+it}/(1+it)$ has modulus one.
Thus arbitrary real $P$ is allowed.

For example, choosing $A=128$ and then a sufficiently large absolute
lower-range constant absorbs the logarithmic factor into a power of
$P$, giving the assertion with a smaller fixed $c$, such as $1/64$.
To obtain \eqref{eq:walsh-prime-block}, subtract prime powers from
\eqref{eq:walsh-twisted-perron} and apply partial summation with the
weight $1/\log v$ on $[P,2P]$. Prime powers contribute at most
$O(P^{1/2}\log^2(2P))$ before that partial summation. The principal
main term becomes
\[
 \int_P^{2P}\frac{v^{it}}{\log v}\,dv
 \ll\frac P{(1+|t|)\log P},
\]
by integration by parts using $v^{1+it}/(1+it)$. All error terms are
absorbed by a smaller fixed $c>0$.
\end{proof}

\begin{proof}[Proof of Theorem~\ref{thm:walsh-fourier}]
We shall use the following inverse implication only for
$(\log X)^K\leq H\leq X^{1/2}$: if a complex multiplicative $g$ with
$|g|\leq1$ has the displayed Fourier integral at least $\eta HX$,
then $\mathcal D(g;CX^2/H^2,C)\leq C$, for suitable constants
$C,K$ depending on $\eta$. This is the part of the proof of the
published Theorem~1.1 whose full parameter range we verify below.

First verify the complete analytic interface to that combinatorial
proof. Let $\mathcal P$ be the primes in $[P,2P]$,
let $P\leq\widetilde H\leq Y/(\log Y)^2$, and let $A_1,A_2$ be
$\widetilde H$-separated sets in $[Y/10,10Y]$. For $Q\geq1$ with
\[
 \log(3Q)\leq\log(3Y)\leq P^\varepsilon,
\]
choose a sufficiently small fixed $\varepsilon>0$, depending only on
the absolute constants in Lemma~\ref{lem:walsh-prime-input}. The lemma
applies to every character modulo $Q$ and every $|t|\ll Y$.

A labelled path of length $k$ has successive points $x_j$ in
$A_1\cup A_2$ and prime labels $p_j,q_j\in\mathcal P$ such that
$|x_j/p_j-x_{j+1}/q_j|\ll\widetilde H/P$. For
$k\leq\varepsilon_0\log(Y/\widetilde H)$, Walsh's unconditional
path estimate (Lemma~2.6) gives
\[
 \left|x_1\prod_{j=1}^k(q_j/p_j)-x_{k+1}\right|
 \ll k\widetilde H.
\]
For given endpoints and prime labels, separation gives at most
$O(1)^k$ paths. Majorize the condition above by a nonnegative Schwartz
function $\varphi$ with Fourier transform supported in $[-1,1]$ and
$\varphi\geq1$ on $[-1,1]$. Fourier inversion reduces the number of
paths from $A_1$ to $A_2$ satisfying
\[
 \prod_{j=1}^kp_j\equiv u\prod_{j=1}^kq_j\pmod Q,
 \qquad (u,Q)=1,
\]
with all labels coprime to $Q$, to at most
\[
 \frac{C^k k\widetilde H}Y
 \int_{|\xi|\leq Y/(C_1k\widetilde H)}
       |S_1(\xi)S_2(\xi)T(\xi)|\,d\xi,
 \qquad S_j(\xi)=\sum_{x\in A_j}e(\xi\log x).
\]
Character orthogonality expresses $T$ as
\[
 T(\xi)=\frac1{\phi(Q)}\sum_{\chi\ ({\rm mod}\ Q)}
       \overline{\chi(u)}
       \left|\sum_{p\in\mathcal P}\chi(p)p^{2\pi i\xi}\right|^{2k}.
\]
Hence, by \eqref{eq:walsh-prime-block} and
$|\mathcal P|\asymp P/\log P$,
\[
 |T(\xi)|\leq C^{2k}|\mathcal P|^{2k}
 \left(\frac1{\phi(Q)(1+|\xi|)^{2k}}+P^{-2ck}\right).
\]
For the first term use $|S_j|\leq|A_j|$ and integrate
$(1+|\xi|)^{-2k}$. For the second use Cauchy--Schwarz and the
continuous large sieve: since the numbers $\log x$, $x\in A_j$,
are separated by $\gg\widetilde H/Y$,
\[
 \int_{|\xi|\leq Y/(C_1k\widetilde H)}|S_j(\xi)|^2\,d\xi
 \ll (Y/\widetilde H)|A_j|.
\]
Absorbing $k$ into $C^k$ proves the path bound
\begin{equation}\label{eq:walsh-mixing}
 \ll \frac{C^k\widetilde H}{\phi(Q)Y}
       |\mathcal P|^{2k}|A_1||A_2|
   +C^k|A_1|^{1/2}|A_2|^{1/2}|\mathcal P|^{2k}P^{-ck}.
\end{equation}
This is at least as strong as the source's Lemma~2.8, whose second
term has the additional factor $\phi(Q)$. In particular its
$k=Q=1$ consequence, Corollary~2.9, follows with some fixed positive
$c_0$:
\begin{equation}\label{eq:walsh-one-step}
 \#\{(x,y,p,q)\in A_1\times A_2\times\mathcal P^2:
             |x/p-y/q|\ll\widetilde H/P\}
 \ll \frac{\widetilde H}Y|A_1||A_2||\mathcal P|^2
        +|A_1|^{1/2}|A_2|^{1/2}P^{2-c_0}.
\end{equation}

For clarity, the remaining imported result is the combinatorial
implication proved in \cite[Sections~2--8]{WalshScaling}: estimates
of the forms \eqref{eq:walsh-mixing} and \eqref{eq:walsh-one-step},
with any fixed positive saving, imply the inverse assertion just stated.
Its hypotheses do not prescribe a numerical saving. The full
dependency chain is as follows. Suppose, for a contradiction, that
the asserted inverse conclusion fails while the Fourier correlation
hypothesis holds. The unconditional reduction in Section~2.1, using
Elliott's inequality and the large sieve, then supplies
an $H$-separated configuration
$\mathcal J=\{(x,\alpha_x)\}$ of cardinality $\gg_\eta X/H$,
and $P\in[H^{\epsilon^2},H^\epsilon]$, with
$\gg_\eta (X/H)|\mathcal P|^2$ relations
\[
 |x/p-y/q|<\delta H/P,
 \qquad \|p\alpha_x-q\alpha_y\|\leq C_0/(PH).
\]
Sections~3--4 prove the unconditional phase and fixed-prime lifting
lemmas. Section~5 uses \eqref{eq:walsh-one-step} to keep configuration
sizes and relation densities bounded through the successive lifts
(Proposition~5.8). The same estimate yields the downward expansion
of Lemma~6.5. Here only $c_0>0$ is used: the adjustable loss exponent
$\widetilde c$ is chosen smaller than a fixed multiple of $c_0$ by
increasing $K$. Section~7 constructs a global frequency, and its
Lemma~7.3 uses \eqref{eq:walsh-mixing} to bound its rational denominator.
In that application the path length is a sufficiently large constant
multiple of $\log b/\log P$; increasing that constant absorbs any
fixed decrease in $c$. Finally Section~8 removes the temporary
logarithmic losses in the frequency and phase approximation, again
using \eqref{eq:walsh-one-step}. The resulting conclusion is
\[
 |T_0|\ll_\eta X^2/H^2,\qquad b\ll_\eta1,\qquad
 \left\|\alpha_x-\frac{a_x}b-\frac{T_0}x\right\|\ll_\eta H^{-1}
\]
for $\gg_\eta X/H$ points in $\mathcal J$. The unconditional
short-interval multiplicative-function step described in Section~2.1
then gives $\mathcal D(g;CX^2/H^2,C)\leq C$.

This chain is the published proof with its sole GRH input, Lemma~2.7,
replaced by Lemma~\ref{lem:walsh-prime-input}. All parameters may
still be chosen in the order prescribed in Section~2.3: the prime
input constants are absolute, then the configuration constants depend
on $\eta$, and finally $K$ is sufficiently large in terms of these.
In the construction in Section~7 the lifted scales satisfy
$\log Y\ll_\eta\log X$. Moreover $Y/\widetilde H=X/H\geq X^{1/2}$,
so $\widetilde H\leq Y/(\log Y)^2$ holds at every such scale.
Consequently
$P\geq H^{\epsilon^2}\geq(\log X)^{K\epsilon^2}$ makes the prime
input valid at every scale, after increasing $K$.

We finish by spelling out the consequence for $\mu$ and $\lambda$.
For a fixed $Q$, uniformly for $q\leq Q$, $|t|\leq Z$, and $Z\to\infty$,
the prime version of \eqref{eq:walsh-twisted-perron} and partial
summation give
\begin{equation}\label{eq:walsh-negative-prime}
 \Re\sum_{p\leq Z}\frac{\chi(p)p^{it}}p
 \geq-\log\log\log Z-O_Q(1).
\end{equation}
Here is a direct verification. Put $y=(\log Z)^{128}$.
The primes $p\leq y$ contribute at worst
$-\log\log y-O(1)$. On $[y,Z]$ the error term in the prime
counting formula contributes
$O(y^{-1/16}\log^2(3QZ))=O(1)$ after partial summation with $1/v$.
For a principal character the remaining real main term is
\[
 \int_y^Z\frac{\cos(t\log v)}{v\log v}\,dv
 =\int_{\log y}^{\log Z}\frac{\cos(tw)}w\,dw\geq-O(1)
\]
uniformly in $t$: the part with $|tw|\leq1$ is nonnegative, and
integration by parts bounds every subinterval of $|tw|\geq1$ by
an absolute constant. For a nonprincipal character that main term
is absent. This proves \eqref{eq:walsh-negative-prime}.
Since $\mu(p)=\lambda(p)=-1$, Mertens' estimate now implies
\[
 \mathcal D(g;Z,Q)^2\geq
       \log\log Z-\log\log\log Z-O_Q(1)\longrightarrow\infty.
\]
For $H\leq X^{1/2}$, the inverse theorem would contradict this
bound along any sequence with normalized Fourier average at least
a fixed positive $\eta$, since $Z=CX^2/H^2\geq CX$.
For $X^{1/2}\leq H\leq X$, partition each interval into pieces of
length $h=X^{1/4}$ and one remainder of length at most $h$.
The triangle inequality bounds its maximal Fourier sum by the sum
of the corresponding maxima on the pieces, plus $O(h)$. Integrating,
each translated starting-point interval lies in $[X,3X]$. The
unconditional power-length result of Matom\"aki--Radziwi\l\l--Tao
\cite{MRTFourier}, applied on a fixed finite covering by intervals of
the form $[Y,2Y]$ with $Y\asymp X$, bounds each integrated piece by
$o(Xh)$. There are $O(H/h)$ pieces and the remainder is
$O(Xh)=o(XH)$. This proves $o(XH)$ throughout the remaining range.
The two ranges together prove the full published Fourier-cancellation
conclusion.
\end{proof}

\paragraph{Range of the imported inverse argument.}
The printed inverse theorem itself is formulated without an upper
restriction on $H$. Its mixing lemma has the upper restriction
$\widetilde H\leq Y/(\log Y)^2$, and the fixed-power predecessors
do not explicitly settle the general-function inverse statement for
$H$ very close to $X$. We therefore do not assert that larger inverse
range. The theorem proved here is the complete Fourier-cancellation
conclusion stated in the published abstract and introduction; the
unconditional long-interval argument above supplies its full range.

The transferred conclusion concerns linear phases. The author's
discussion of higher-step nilsequences and almost exponential growth
of Liouville sign patterns is a proposed extension, not a theorem
proved in that paper, and is not asserted here. The recent improvement
of the unconditional interval range by Pilatte, arXiv:2604.26564,
still explicitly distinguishes Walsh's GRH conclusion; its range
$H\geq\exp((\log X)^{2/5+\varepsilon})$ does not include the range
established above.

% Bibliography:
% \bibitem{GreenTaoMobius2012} B. Green and T. Tao,
% The M\"obius function is strongly orthogonal to nilsequences,
% Ann. of Math. (2) 175 (2012), 541--566,
% doi:10.4007/annals.2012.175.2.3.
% \bibitem{GreenTaoOrbits2012} B. Green and T. Tao,
% The quantitative behaviour of polynomial orbits on nilmanifolds,
% Ann. of Math. (2) 175 (2012), 465--540,
% doi:10.4007/annals.2012.175.2.2;
% correction, Ann. of Math. (2) 179 (2014), 1175--1183,
% doi:10.4007/annals.2014.179.3.8.

\section{Power decay in M\"obius correlations with polynomial nilsequences}
\label{sec:green-tao-power}

Green--Tao's unconditional nilsequence theorem has decay faster
than every fixed negative power of $\log N$. Their published
remarks immediately after Theorem~1.1 explicitly assert a stronger
conclusion under GRH: decay $N^{-c}$, with $c>0$ depending only
on dimension and filtration degree
\cite[p.~543]{GreenTaoMobius2012}. We prove that complete
power-decay conclusion. The logarithmic theorem and its mere
effectivity are not the assertion being counted here.

We specify the terminology. A nilmanifold is $G/\Gamma$, where
$G$ is a connected, simply connected nilpotent Lie group and
$\Gamma$ is a discrete cocompact subgroup. A degree-$d$ filtration
$G_\bullet$ is a descending sequence of closed connected subgroups
$G=G_0=G_1\supseteq\cdots\supseteq G_{d+1}=\{1\}$
with $[G_i,G_j]\subseteq G_{i+j}$. A sequence
$g:\mathbb Z\to G$ is polynomial relative to this filtration
if every iterated multiplicative difference
$\partial_{h_i}\cdots\partial_{h_1}g$ takes values in $G_i$,
where $\partial_hg(n)=g(n+h)g(n)^{-1}$.
A Mal'cev basis $\mathcal X=(X_1,\ldots,X_m)$ identifies
$G$ with $\mathbb R^m$ by
$\exp(t_1X_1)\cdots\exp(t_mX_m)$, identifies $\Gamma$ with
integer coordinates, and satisfies that
$\operatorname{span}(X_{j+1},\ldots,X_m)$ is a Lie algebra
ideal for each $0\leq j<m$.
It is adapted to $G_\bullet$ if each filtration subgroup is
spanned by an appropriate final segment of the basis, and
$Q$-rational if all its Lie-bracket structure constants are
rational of height at most $Q$, where the height of a reduced
fraction $a/b$ is $\max\{|a|,|b|\}$. We use the right-invariant
coordinate metric and induced quotient metric $d_{\mathcal X}$
of \cite[Definitions~2.1--2.4]{GreenTaoOrbits2012}.
For a function $F$ on this quotient, write
\[
 \|F\|_{\mathrm{Lip}}
 =\|F\|_\infty+
   \sup_{x\ne y}\frac{|F(x)-F(y)|}{d_{\mathcal X}(x,y)}.
\]

\begin{theorem}[Green--Tao's published GRH improvement]
\label{thm:green-tao-power}
For every pair of positive integers $m,d$ there are effective
constants $c=c(m,d)>0$ and $C=C(m,d)>0$ such that the following
holds. Suppose $G/\Gamma$ has dimension $m$, a degree-$d$
filtration, and an adapted $Q$-rational Mal'cev basis, $Q\geq2$.
For every $g\in\operatorname{poly}(\mathbb Z,G_\bullet)$,
every Lipschitz function $F:G/\Gamma\to[-1,1]$, and every
integer $N\geq2$,
\[
 \left|\frac1N\sum_{n\leq N}\mu(n)F(g(n)\Gamma)\right|
 \leq C Q^C(1+\|F\|_{\mathrm{Lip}})N^{-c}.
\]
The constants are uniform in $g$, the nilmanifold, its stated
rationality parameter, $F$, and $N$.
\end{theorem}

\begin{proof}
We first establish the required analytic estimate, including
arithmetic progressions which are not coprime to their modulus.

\emph{A uniform M\"obius estimate with polynomial modulus loss.}
There are effective absolute constants $B\geq1$ and
$\delta>0$ such that, for every Dirichlet character modulo $q$,
including a principal or induced character,
\begin{equation}\label{eq:gt-mobius-character}
 \left|\sum_{n\leq t}\mu(n)\chi(n)\right|
                  \ll q^B t^{1-\delta}\qquad(t\geq1).
\end{equation}
Here a small unspecified positive saving is sufficient.
We give a proof which avoids any Lindel\"of estimate.

Put $a=15/16$. The zero-free input implies the effective
polynomial-growth bound
\begin{equation}\label{eq:gt-reciprocal-growth}
 |L(s,\chi)^{-1}|\ll\{q(3+|\Im s|)\}^{B_0}
              \qquad(a\leq\Re s\leq2)
\end{equation}
for an effective absolute integer $B_0\geq1$.
To verify this, first take a primitive nonprincipal character.
On the disc centered at $2+it$ of radius $35/32$, one has
$\Re s\geq29/32$. The character partial sums
$A(u)=\sum_{n\leq u}\chi(n)$ satisfy $|A(u)|\leq q$, so
partial summation gives
\[
 L(s,\chi)=s\int_1^\infty A(u)u^{-s-1}\,du,
 \qquad |L(s,\chi)|\leq q|s|/(\Re s).
\]
Consequently $\log|L|\ll\log(q(3+|t|))$ on the disc.
The whole disc lies in $\Re s>7/8$ and is zero-free.
Choose the logarithm at its center by the absolutely convergent
Euler product, so its value there is $O(1)$.
Borel--Carath\'{e}odory on the concentric disc of radius $17/16$
therefore gives $|\log L|\ll\log(q(3+|t|))$.
This proves \eqref{eq:gt-reciprocal-growth} for primitive
nonprincipal characters. For the primitive principal character,
apply the same argument to the holomorphic, nonvanishing function
$(s-1)\zeta(s)$ on these discs. Its logarithm at the center is
$O(\log(3+|t|))$. The elementary summation formula
\[
 (s-1)\zeta(s)=s-s(s-1)\int_1^\infty\{u\}u^{-s-1}\,du
\]
bounds its absolute value on the disc by $O((3+|t|)^2)$.
The zero of $1/\zeta$ at $1$ is harmless.
For an induced character, the extra reciprocal Euler factors
are bounded, uniformly on the strip, by
\[
 \prod_{p\mid q}(1-p^{-a})^{-1}
 \leq (1-2^{-a})^{-\omega(q)}\leq q^{C_0}.
\]
Enlarge $B_0$ to obtain \eqref{eq:gt-reciprocal-growth} in
all cases.

Choose an integer $k>B_0+1$ and define the $k$th Riesz sum
\[
 R_k(t)=\frac1{k!}\sum_{n\leq t}\mu(n)\chi(n)(t-n)^k.
\]
Its Mellin formula and a contour shift from $\Re s=2$ to
$\Re s=a$ give
\[
 R_k(t)=\frac1{2\pi i}\int_{(a)}
 \frac{t^{s+k}}{L(s,\chi)s(s+1)\cdots(s+k)}\,ds
                  \ll q^{B_0}t^{k+a}.
\]
There is no pole in the intervening strip. Absolute convergence
on the new line and vanishing of the horizontal integrals follow
from $k>B_0+1$ and \eqref{eq:gt-reciprocal-growth}.
Set $\delta=(1-a)/(k+1)$ and $h=t^{1-\delta}/k$.
If $\Delta_h$ denotes the forward difference with step $h$,
repeated integration of the $k$th derivative gives
\[
 h^{-k}\Delta_h^kR_k(t)
 =\int_{[0,1]^k}\sum_{n\leq t+h(u_1+\cdots+u_k)}
                      \mu(n)\chi(n)\,d\boldsymbol u.
\]
The right side differs from $\sum_{n\leq t}\mu(n)\chi(n)$
by at most $kh+1$. On the left, the Riesz bound and
$t+kh\leq2t$ give $O(q^{B_0}t^{a+k\delta})$.
Since $a+k\delta=1-\delta$, this proves
\eqref{eq:gt-mobius-character}, after enlarging constants
for bounded $t$.

For any $q$-periodic function $f$ of absolute value at most one,
the same estimate implies, for an effective absolute $D$,
\begin{equation}\label{eq:gt-periodic}
 \left|\sum_{n\leq t}\mu(n)f(n)\right|
                     \ll q^D t^{1-\delta}.
\end{equation}
First suppose $f$ vanishes outside the units modulo $q$.
Expand in the characters of $(\mathbb Z/q\mathbb Z)^\times$.
Parseval and Cauchy--Schwarz bound the sum of the absolute
Fourier coefficients by $\sqrt{\phi(q)}$, proving the claim
with modulus factor $q^{B+1/2}$.
In general, when $\mu(n)\ne0$, the integer
$d=(n,q)$ is squarefree and $n=du$ with $(u,q)=1$.
Thus the sum is
\[
 \sum_{d\mid\operatorname{rad}(q)}\mu(d)
     \sum_{u\leq t/d}\mu(u)f(du)\boldsymbol1_{(u,q)=1}.
\]
For every $d$ the function in the inner sum is still
$q$-periodic and vanishes off the units. Keeping this modulus
$q$ retains all the necessary coprimality restrictions.
There are at most $q$ choices of $d$, and
$(t/d)^{1-\delta}\leq t^{1-\delta}$, so $D=B+2$ suffices.
Taking a difference of two initial sums now shows that for
every arithmetic progression $P\subseteq[1,N]$ of common
difference $q$,
\begin{equation}\label{eq:gt-progression}
 \left|\frac1N\sum_{n\in P}\mu(n)\right|
                         \ll q^D N^{-\delta}.
\end{equation}

\emph{The unconditional nilsequence inputs.}
We use two published quantitative theorems. First, the
one-variable factorization theorem
\cite[Theorem~1.19]{GreenTaoOrbits2012} states that for each
$B_1>0$ and $M_0\geq2$, an $M_0$-rational input has a
factorization
\[
 g=\varepsilon g'\gamma,\qquad
             M_0\leq M\ll_{m,d,B_1}M_0^{A_1},
\]
where $A_1=A_1(m,d,B_1)$ is effective. Here
$\varepsilon$ is $(M,N)$-smooth, meaning
$d_{\mathcal X}(\varepsilon(n),1)\leq M$ and
$d_{\mathcal X}(\varepsilon(n),\varepsilon(n-1))\leq M/N$;
$g'$ takes values in a rational subgroup $G'$ and its orbit
is totally $M^{-B_1}$-equidistributed in $G'/\Gamma'$;
and $\gamma$ is $M$-rational, with $\gamma(n)\Gamma$
periodic of some period $q\leq M$.
Totally $\rho$-equidistributed means that every mean-zero
Lipschitz test function $H$ has average of magnitude at most
$\rho\|H\|_{\mathrm{Lip}}$ on every progression of length
at least $\rho N$.
The 2014 correction to the companion paper explicitly
leaves this one-variable theorem unchanged.

Second, \cite[Proposition~2.1]{GreenTaoMobius2012} gives
effective constants $c_1=c_1(m,d)>0$ such that an orbit which
is totally $\rho$-equidistributed in a nilmanifold with an
adapted $Q_1$-rational basis satisfies
\begin{equation}\label{eq:gt-equid}
 \left|\frac1N\sum_{n\in P}\mu(n)H(g(n)\Gamma)\right|
       \ll_{m,d}\rho^{c_1}Q_1\|H\|_{\mathrm{Lip}}\log N
\end{equation}
when $H$ has integral zero and $|P|\geq N/Q_1$.
This is the unconditional Type~I/II theorem, valid for all
$0<\rho<1/2$, not just logarithmic values of $\rho$.
We take constants uniformly over dimensions at most $m$.

We also record the precise coordinate consequences used to
join these two inputs. They are the unconditional claim and
its proof on p.~547 of \cite{GreenTaoMobius2012}, using
\cite[Appendix~A, Propositions~A.9 and Lemmas~A.3--A.5,
A.12--A.14, A.17]{GreenTaoOrbits2012}.
Choose representatives $\gamma_j$ of $\gamma(j)\Gamma$ in
the coordinate fundamental domain. They have rational
coordinates of height $M^{O_{m,d}(1)}$. Put
$H_j=\gamma_j^{-1}G'\gamma_j$,
$\Lambda_j=H_j\cap\Gamma$, and
$g_j(n)=\gamma_j^{-1}g'(n)\gamma_j$.
For any $a_0\in G$ with $d_{\mathcal X}(a_0,1)\leq M$,
the function
\[
 F_{j,a_0}(u\Lambda_j)=F(a_0\gamma_j u\Gamma)
\]
is well-defined. There are effective $b>0$ and $C_1>0$,
depending only on $m,d$, such that these quotients have
$M^{C_1}$-rational adapted bases, the transformed functions
have Lipschitz norm at most $M^{C_1}$ when the original
norm is at most one, and the transformed orbit is totally
$M^{-bB_1+C_1}$-equidistributed. Enlarging $C_1$ absorbs
the fixed multiplicative constants. In particular, neither
$b$ nor $C_1$ depends on $B_1$.

\emph{Choice of parameters and the full correlation.}
Normalize $F$ by $1+\|F\|_{\mathrm{Lip}}$; restoring this
factor at the end is harmless. Thus we may suppose both
its absolute value and Lipschitz norm are at most one.
We first choose $B_1$, depending only on $m,d$, sufficiently
large as specified below. This fixes the factorization
exponent $A_1\geq1$. Then choose $\eta>0$ so small that
\begin{equation}\label{eq:gt-parameter-choice}
 \eta A_1(D+3)<\delta/2,\qquad
                       3\eta A_1<1/2.
\end{equation}
Assume $Q\leq N^\eta$ and apply factorization with
$M_0=N^\eta$; finitely many bounded $N$ are absorbed in
the effective constant. Then $M\ll N^{\eta A_1}$ and
$M\geq N^\eta$.

Split the residue classes modulo $q$ into progressions $P$
whose diameters are at most $2N/M^2$ and whose sizes are
at least $N/(2qM^2)$. Such a partition exists for all
sufficiently large $N$, because \eqref{eq:gt-parameter-choice}
ensures $N\gg M^3$. It has $O(M^3)$ members, each of
size at least $N/(2M^3)$. On a progression in the residue
class $j$, freeze $\varepsilon(n)$ at any point $n_P\in P$,
putting $a_P=\varepsilon(n_P)$. Right invariance of the
coordinate metric gives
\[
 |F(\varepsilon(n)g'(n)\gamma_j\Gamma)
       -F(a_Pg'(n)\gamma_j\Gamma)|\ll M^{-1}.
\]
After summing over the partition and normalizing by $N$,
the total freezing error is $O(M^{-1})$.
The remaining contribution on $P$ equals
\[
 \frac1N\sum_{n\in P}\mu(n)
              F_{j,a_P}(g_j(n)\Lambda_j).
\]

Subtract the Haar mean of $F_{j,a_P}$. Its constant part is
$O(M^D N^{-\delta})$ by \eqref{eq:gt-progression}, since
the progression has common difference $q\leq M$ and the
mean has absolute value at most one. Over all the pieces
these parts total
\begin{equation}\label{eq:gt-constant-total}
 O(M^{D+3}N^{-\delta})\ll N^{-\delta/2}.
\end{equation}

For the mean-zero part apply \eqref{eq:gt-equid}, taking
$Q_1$ to be a sufficiently large fixed power of $M$ to
control both the rational basis and $N/|P|$.
The preceding coordinate bounds give, after summing over
the $O(M^3)$ pieces,
\[
 O\bigl(M^{-b c_1 B_1+C_2}\log N\bigr),
\]
where $C_2=C_2(m,d)$ is independent of $B_1$.
Choose $B_1$ so large that $b c_1B_1\geq C_2+3$.
This is the earlier choice, made before $A_1$ and $\eta$.
The displayed bound is then
$O(M^{-3}\log N)\ll N^{-\eta}$.
A zero-dimensional subgroup has no mean-zero part and
requires no application of \eqref{eq:gt-equid}.

Together with the freezing error and
\eqref{eq:gt-constant-total}, this proves an effective
$O_{m,d}(N^{-c})$ bound when $Q\leq N^\eta$, where
$c=\min\{\eta,\delta/2\}>0$.
If $Q>N^\eta$, the theorem follows from the trivial bound
by choosing its exponent $C$ so that $C\eta\geq c$.
Restoring $1+\|F\|_{\mathrm{Lip}}$ finishes the proof.
\end{proof}

The proof uses the published unconditional factorization,
coordinate and Type~I/II results with all parameter losses
made explicit above. It does not assume an inverse theorem
with polynomial bounds for Gowers norms.

% Bibliography additions:
% \bibitem{MangerelRigidity} A. P. Mangerel, On a rigidity property for
% quadratic Gauss sums, Mathematika 72 (2026), no. 1, e70061,
% doi:10.1112/mtk.70061. Published online 23 November 2025.
% \bibitem{GSSpectrum} A. Granville and K. Soundararajan, The spectrum
% of multiplicative functions, Ann. of Math. (2) 153 (2001), 407--470,
% doi:10.2307/2661346.

\section{Rigidity from approximate quadratic Gauss-sum symmetries}
\label{sec:gauss-rigidity}

Mangerel's Theorem~1.3(b) in \cite{MangerelRigidity} extends a
rigidity statement to arbitrarily small fixed powers of the prime
modulus, assuming a specified zero-free region for its Dirichlet
$L$-functions. Theorem~\ref{thm:input} supplies that region for all
sufficiently large moduli. We prove its entire conditional conclusion
below. The author's unconditional Theorem~1.1 and the converse in
Theorem~1.3(a) are not counted as additional transfers.

Write $e(t)=\exp(2\pi it)$. If $N$ is an odd prime and
$f:\mathbb N\to\{-1,1\}$, define
\[
 S_f(a)=\sum_{1\leq n<N}f(n)e(an/N),\qquad a\in\mathbb Z/N\mathbb Z.
\]
Here ``multiplicative'' means multiplicative on coprime arguments;
complete multiplicativity of $f$ is not required.

\begin{theorem}[Mangerel's conditional rigidity conclusion]
\label{thm:gauss-rigidity}
Fix $0<c<1$ and constants $B_1,B_2>0$. There are constants
$M_0,N_0,C>0$, depending only on $c,B_1,B_2$, with the following
property. Let $N\geq N_0$ be prime, let $M_0\leq M\leq N$, and
let $f:\mathbb N\to\{-1,1\}$ be multiplicative. Suppose that
$\mathcal A$ is a set of primes less than $N$ and that signs
$g(p)\in\{-1,1\}$ are specified for the primes $p\leq N^c$, with
\begin{align}
 \frac1N\sum_{a\bmod N}|S_f(ap)-g(p)S_f(a)|^2
       &\leq B_1\frac NM
       &&(p\in\mathcal A,\ p\leq N^c),
       \label{eq:gauss-small-dilations}\\
 \sum_{\substack{p<N\\p\notin\mathcal A}}\frac1p
       &\leq \frac{B_2}{\sqrt{\min\{M,\log N\}}}.
       \label{eq:gauss-missing-primes}
\end{align}
Then a real Dirichlet character $\psi$ modulo $N$ satisfies
\[
 \#\{1\leq n<N:f(n)\ne\psi(n)\}\leq C\frac N{\sqrt M}.
\]
The principal character and the Legendre symbol are the two
possibilities for $\psi$.
\end{theorem}

\begin{proof}
We first state the two published inputs and check the analytic
hypothesis of the one that was conditional. Mangerel calls a prime
$N$ of $A$-Littlewood type when every nonprincipal character modulo
$N$ has a nonvanishing $L$-function throughout
\begin{equation}\label{eq:gauss-littlewood}
 \Re s>1-A\frac{\log\log N}{\log N},\qquad |\Im s|\leq N.
\end{equation}
For each fixed $A$, choose $N$ so large that
$A\log\log N/\log N<1/8$. The region in
\eqref{eq:gauss-littlewood} is then contained in $\Re s>7/8$.
Thus Theorem~\ref{thm:input} establishes its nonvanishing for
every such $N$.

We derive the needed good-prime representation statement directly
from \cite[Proposition~2.7]{MangerelRigidity}, keeping its constant
parameters independent. Put $G=(\mathbb Z/N\mathbb Z)^\times$,
fix $0<d<\min\{c,1/2\}$, and put $C_0=1/d$.
Choose a constant $U$ sufficiently large for that proposition,
allowing dependence on $C_0$, with $dU>2$. Set
\[
 L=dU,\qquad a_0=\frac{d}{2(\log(2U))^2},\qquad
 x=N^L,\quad y=N^d,\quad z=N^{a_0}.
\]
The source parameters then satisfy
\[
 u=\frac{\log x}{\log y}=U,\qquad
 v=\frac{\log x}{\log z}=\frac L{a_0},\qquad
 \frac vu=2(\log(2U))^2,\qquad y\leq N\leq y^{C_0}.
\]
Choose a sufficiently small fixed
$0<\eta<(U\log U)^{-2}$, and choose $A$ sufficiently large in
terms of $\eta,C_0$. This order of choices ensures all the
proposition's parameter conditions. The rough-and-smooth range in
its proof also holds for large $N$: $y\leq\sqrt x$, $y\geq z^2$,
$y\leq z^{\log\log x}$, and $z\geq\exp(\sqrt{\log x})$.

Choose $M_0\geq(B_2/\eta)^2$ and
$\log N_0\geq(B_2/\eta)^2$, so that
\eqref{eq:gauss-missing-primes} is at most $\eta$.
Apply the proposition to $\mathcal A\cup\{N\}$; adjoining $N$
only accommodates its convention that the missing-prime sum is
taken over $p\leq N$, and $N>y$ cannot occur in a represented
integer. Its conclusion is that, for each $u_0\in G$, the number
of integers $v_{u_0}\leq x$ representing $u_0$ modulo $N$ whose
prime factors belong to $\mathcal A\cap(z,y]$ is at least a
constant multiple of
\[
 \frac{xU^{-2U}}{vN\log x}
   =\frac{U^{-2U}}{vL}\frac{N^{L-1}}{\log N}.
\]
This tends to infinity because $L>2$. In particular, for all
sufficiently large $N$ such a representative exists. Since all
of its prime factors exceed $N^{a_0}$, it has at most
$K=\lceil L/a_0\rceil$ prime factors, counted with multiplicity.
We have therefore proved that every $u_0\in G$ has a representative
satisfying
\begin{equation}\label{eq:gauss-good-representative}
 v_{u_0}\equiv u_0\pmod N,\quad v_{u_0}\leq N^L,\quad
 \Omega(v_{u_0})\leq K,\quad
 p\mid v_{u_0}\Longrightarrow p\in\mathcal A\cap[2,N^d].
\end{equation}
Here $\Omega$ counts prime factors with multiplicity. The only analytic condition on $N$
in the imported proposition is \eqref{eq:gauss-littlewood}; it was
verified above. Increasing $N_0$ accounts for all the fixed
thresholds. All primes occurring in the representative are covered by
\eqref{eq:gauss-small-dilations}.

The second input is the uniform real mean-value lower bound of
Granville--Soundararajan \cite[Theorem~1 and the extension to
merely multiplicative functions in the introduction]{GSSpectrum}:
there is an absolute $\delta_1>-2/3$ such that
\begin{equation}\label{eq:gauss-real-mean}
 \frac1x\sum_{n\leq x}h(n)\geq\delta_1+o(1)
\end{equation}
uniformly over real multiplicative $h$ with $|h(n)|\leq1$.
In particular, for all sufficiently large $x$ the left-hand side
exceeds $-2/3$. The uniformity allows $h$ to depend on $N$.
Mangerel also records this as Lemma~3.2.

We give the remaining finite-group argument explicitly. Put
$G=(\mathbb Z/N\mathbb Z)^\times$ and let $Q\subset G$ be its
subgroup of squares. On functions on $\mathbb Z/N\mathbb Z$ use
the norm
\[
 \|V\|_{\mathrm{Fourier}}^2=\frac1N\sum_{a\bmod N}|V(a)|^2
\]
and the unitary dilation operators $U_rV(a)=V(ar)$ for $r\in G$.
Extend the given prime signs completely multiplicatively on integers
whose prime factors belong to $\mathcal A\cap[2,N^d]$; this is
an auxiliary extension of $g$, not an extra hypothesis on $f$.
For any product $v=p_1\cdots p_k$ of such primes, a telescoping
of the commuting unitary operators gives
\begin{equation}\label{eq:gauss-telescoping}
 \|U_vS_f-g(v)S_f\|_{\mathrm{Fourier}}
 \leq\sum_{j=1}^k
       \|U_{p_j}S_f-g(p_j)S_f\|_{\mathrm{Fourier}}
 \leq k\sqrt{B_1N/M}.
\end{equation}
For example, the first inequality follows by expanding
$U_{p_1}\cdots U_{p_k}-\prod_jg(p_j)$ as the sum of $k$ terms,
each containing a single factor $U_{p_j}-g(p_j)$, and applying
the triangle inequality. The other factors preserve the norm.

For every $b\in Q$, choose $u\in G$ with $u^2=b$ and use the
representative $v_u$ in \eqref{eq:gauss-good-representative}.
Then $v_u^2\equiv b\pmod N$, $\Omega(v_u^2)\leq2K$, and
$g(v_u^2)=1$. Therefore \eqref{eq:gauss-telescoping} implies
\begin{equation}\label{eq:gauss-square-invariance}
 \|U_bS_f-S_f\|_{\mathrm{Fourier}}^2
      \leq4K^2B_1N/M\qquad(b\in Q).
\end{equation}

Define $F(0)=0$ and $F(n)=f(n)$ for the representatives
$1\leq n<N$. Its additive Fourier transform is $S_f$.
With $R_bF(n)=F(b^{-1}n)$, Parseval's identity converts
\eqref{eq:gauss-square-invariance} exactly into
\[
 \sum_{n\bmod N}|R_bF(n)-F(n)|^2\leq4K^2B_1N/M.
\]
Let $P_QF=|Q|^{-1}\sum_{b\in Q}R_bF$. Averaging a finite
unitary group action is an orthogonal projection; directly,
expanding the squares and using $P_Q^2=P_Q=P_Q^*$ gives
\[
 \frac1{|Q|}\sum_{b\in Q}\|R_bF-F\|_2^2
       =2\|F-P_QF\|_2^2.
\]
Consequently
\begin{equation}\label{eq:gauss-two-cosets}
 \|F-P_QF\|_2^2\leq2K^2B_1N/M.
\end{equation}

The projection is constant on each of the two cosets of $Q$ in
$G$. Let these constants be $r,s\in[-1,1]$, and put
$m=(N-1)/2$. Since $F$ takes only the values $\pm1$ on $G$,
\[
 \|F-P_QF\|_2^2=m(1-r^2)+m(1-s^2).
\]
Round $r,s$ separately to their nearer signs, making any choice
in a tie, and call the resulting function on $G$ $F_0$.
The number $J$ of disagreements between $F$ and $F_0$ is
\[
 J=\frac m2(1-|r|)+\frac m2(1-|s|)
   \leq\frac12\|F-P_QF\|_2^2
   \leq K^2B_1\frac NM.
\]
There are just four possible rounded functions:
$1,-1,\chi_N,-\chi_N$, where $\chi_N$ is the Legendre symbol.

The two negative choices are impossible once $M_0,N_0$ have
been increased. Indeed, if $F_0=-\psi$ for $\psi=1$ or
$\psi=\chi_N$, then $h(n)=f(n)$ or $h(n)=f(n)\chi_N(n)$,
respectively, is a real multiplicative function bounded by one,
and
\[
 \frac1{N-1}\sum_{n<N}h(n)
      =-1+\frac{2J}{N-1}
      \leq-1+\frac{2K^2B_1N}{M(N-1)}.
\]
For instance $M_0>12K^2B_1$ makes this less than $-2/3$
for all sufficiently large $N$, contradicting
\eqref{eq:gauss-real-mean} at $x=N-1$.
Thus $F_0=\psi$ is a real character on $G$. The displayed bound
for $J$ proves, in fact, $J\ll_{c,B_1,B_2}N/M$, which implies
the asserted published bound $J\ll_{c,B_1,B_2}N/\sqrt M$.
\end{proof}

The analytic transfer uses only the finite-height region explicitly
required in the published theorem. No complete multiplicativity
assumption, density condition stronger than
\eqref{eq:gauss-missing-primes}, or lower restriction such as
$c>1/4$ has been added. The square-subgroup averaging above is
a direct replacement for the source's final Fourier analysis;
the sharper intermediate estimate is not counted as a separate
published-result transfer.

% Bibliography additions:
% \bibitem{SofosNonresidues} E. Sofos, Statistics of small prime quadratic
% non-residues, Rend. Semin. Mat. Univ. Politec. Torino 80 (2022), no.1,
% 73--85. https://seminariomatematico.polito.it/rendiconti/80-1/Sofos.pdf
% \bibitem{MrazovicPaley} R. Mrazovi\'c, A random model for the Paley graph,
% Q. J. Math. 68 (2017), 193--206, doi:10.1093/qmath/haw037.
% \bibitem{MontgomeryTopics} H. L. Montgomery, Topics in multiplicative
% number theory, Lecture Notes in Mathematics 227, Springer, 1971.

\section{Large first prime nonresidues and gaps between them}
\label{sec:large-nonresidue-gaps}

For a prime $p$, write $n_1(p)<n_2(p)<\cdots$ for the primes
that are quadratic nonresidues modulo $p$. In particular, $p$
itself is not in this list. Sofos's Theorem~4 in
\cite{SofosNonresidues} proves a lower bound of order $\log p$
unconditionally, and a lower bound of order $\log p\log\log p$
under GRH, for the simultaneous largeness of $n_1(p)$ and
$n_2(p)-n_1(p)$. Its entire conditional conclusion follows here.

\begin{theorem}[Sofos's conditional large-gap conclusion]
\label{thm:large-nonresidue-gaps}
There is an absolute constant $c_0>0$ such that
\[
 \min\{n_1(p),\ n_2(p)-n_1(p)\}
     >c_0(\log p)(\log\log p)
\]
for infinitely many primes $p$.
\end{theorem}

\begin{proof}
We prove the prime sign-pattern estimate used in the argument,
including its conductor and uniformity details. All logarithms
in this proof are natural. Fix
\[
 \kappa=\frac1{32\log2},\qquad y=\kappa(\log x)(\log\log x),
 \qquad k=\pi(y),
\]
where $x$ tends to infinity. Assign any signs
$\varepsilon_\ell\in\{-1,1\}$ to the primes $\ell\leq y$.
We will count primes $p\in(x,2x]$ with all
$\bigl(\frac\ell p\bigr)=\varepsilon_\ell$, and, for later
use, also impose $p\equiv1\pmod4$.

Put
\[
 Q=8\prod_{\substack{3\leq\ell\leq y\\\ell\text{ prime}}}\ell.
\]
The quadratic symbol $\bigl(\frac\ell p\bigr)$ on primes
$p>y$ is the value at $p$ of a real Dirichlet character modulo
$Q$. Indeed, one can first take the primitive character of
fundamental discriminant $8$ for $\ell=2$, and of fundamental
discriminant $\ell$ or $4\ell$ for an odd prime $\ell$, and
then induce it modulo $Q$. Denote this character by $\chi_\ell$.
Also write $\chi_{-4}$ for the character giving the sign of
$-1$, induced modulo $Q$.

For a subset $S$ of the primes at most $y$, set
$d_S=\prod_{\ell\in S}\ell$, $\chi_S=\prod_{\ell\in S}\chi_\ell$,
and $\varepsilon_S=\prod_{\ell\in S}\varepsilon_\ell$.
The empty products are the principal character modulo $Q$ and $1$,
respectively. On primes coprime to $Q$, $\chi_S$ is the
quadratic character of the positive squarefree integer $d_S$.
It is principal precisely when $S$ is empty. Moreover,
$\chi_{-4}\chi_S$ is always nonprincipal: its quadratic
squareclass is $-d_S$. The corresponding fundamental discriminants
all divide $Q$. This verifies that exactly one of the
$2^{k+1}$ characters in the following expansion is principal.

For $x$ large enough that $x>y$, the weighted number of the
desired primes is exactly
\begin{align}
 W(x)&=\sum_{x<p\leq2x}(\log p)
       \frac{1+\chi_{-4}(p)}2
       \prod_{\ell\leq y}\frac{1+\varepsilon_\ell\chi_\ell(p)}2
       \notag\\
 &=\frac1{2^{k+1}}
   \sum_{S\subseteq\{\ell\leq y:\ell\text{ prime}\}}
     \varepsilon_S\sum_{x<p\leq2x}
        \bigl(\chi_S(p)+\chi_{-4}(p)\chi_S(p)\bigr)\log p.
        \label{eq:nonresidue-pattern-projector}
\end{align}
The prime-power contribution to a von Mangoldt sum up to $2x$
is $O(\sqrt x\log^2(2x))$, uniformly in its character. Thus
Lemma~\ref{lem:psi} gives, for every character $\xi$ in this
expansion,
\[
 \sum_{x<p\leq2x}\xi(p)\log p
 =\delta_\xi x+O\bigl(x^{7/8}\log^2(3Qx)\bigr),
\]
where $\delta_\xi$ is $1$ for the principal character and $0$
otherwise. This estimate is valid for the induced characters as
well; alternatively the omitted prime factors all divide $Q$
and lie below $y<x$, so they do not change the displayed prime sum.
Every coefficient $\varepsilon_S$ has absolute value one.
Consequently \eqref{eq:nonresidue-pattern-projector} is
\begin{equation}\label{eq:nonresidue-pattern-asymptotic}
 W(x)=\frac{x}{2^{k+1}}
      +O\bigl(x^{7/8}\log^2(3Qx)\bigr),
\end{equation}
uniformly over all the choices of signs.

Chebyshev's estimate gives $\log Q\ll y$. The prime number
theorem gives
\[
 k=(\kappa+o(1))\log x,\qquad
 2^{k+1}=x^{1/32+o(1)}.
\]
The ratio of the error in \eqref{eq:nonresidue-pattern-asymptotic}
to its main term is therefore
\[
 \ll 2^{k+1}x^{-1/8}(\log x+y)^2
       =x^{-3/32+o(1)}\longrightarrow0.
\]
In particular every prescribed sign pattern occurs at some prime
$p\in(x,2x]$ with $p\equiv1\pmod4$, for all sufficiently large $x$.

Now let $r$ be the largest prime at most $y/2$. Prescribe
$\varepsilon_r=-1$ and $\varepsilon_\ell=1$ at every other
prime $\ell\leq y$. For a prime $p$ supplied by the preceding
argument, $n_1(p)=r$ and $n_2(p)>y$. The prime number theorem
ensures $r=(1+o(1))y/2$, whence
\[
 \min\{n_1(p),n_2(p)-n_1(p)\}
     \geq\min\{r,y-r\}=(1+o(1))y/2.
\]
Since $x<p\leq2x$, both $\log p/\log x$ and
$\log\log p/\log\log x$ tend to one uniformly. Any fixed
$c_0<\kappa/2$, for example $c_0=\kappa/4$, therefore satisfies
the stated strict inequality for every sufficiently large $x$
and the chosen prime $p$. Taking $x$ through an unbounded
sequence proves infinitude.
\end{proof}

The same argument recovers the classical GRH lower order for
large cliques in prime Paley graphs, recorded in the published
abstract and introduction of \cite{MrazovicPaley} and attributed
there to \cite[Chapter~13]{MontgomeryTopics}. This is a consequence
of the same prime-pattern calculation, not a different analytic
input. We specify both common graph conventions.

\begin{corollary}[The published Paley clique lower order]
\label{cor:paley-large-cliques}
For infinitely many primes $p\equiv1\pmod4$, the Paley graph
on $\mathbb F_p$, in which distinct vertices $a,b$ are adjacent
when $a-b$ is a nonzero square, has a clique of size
$\gg\log p\log\log p$. The same lower order holds for the
Paley sum graph, in which adjacency means that $a+b$ is a
nonzero square.
\end{corollary}

\begin{proof}
In the sign-pattern construction above choose every
$\varepsilon_\ell=1$. Then every integer $1\leq n\leq y$ is
a square modulo $p$, since each prime in its factorization is
a square modulo $p$. The set
$\{0,1,\ldots,\lfloor y\rfloor\}$ is a clique in the difference
graph: each nonzero difference has absolute value at most $y$,
and $-1$ is a square because $p\equiv1\pmod4$.
For the sum graph, use
$\{1,2,\ldots,\lfloor y/2\rfloor\}$ instead; distinct vertices
have sums between $1$ and $y$, and these sums are nonzero modulo
$p$. Both sets have size $\gg\log p\log\log p$.
\end{proof}

The quantified conclusion of Sofos's theorem asserts the existence
of some positive constant $c_0$; that entire conclusion has been
preserved. This argument does not assert a particular optimal
leading constant for Montgomery's least-nonresidue bound, nor
the square-logarithm upper bound that requires the sharper
GRH error term.

% Bibliography:
% \bibitem{MourtadaMurtyOmega} M. Mourtada and V. Kumar Murty,
% Omega theorems for $L'/L(1,\chi_D)$, Int. J. Number Theory
% 9 (2013), no.3, 561--581, doi:10.1142/S1793042112501485.
% Full original-author source: M. Mourtada, University of Toronto thesis
% (2013), Chapter 4, Theorem 17, printed p.30; the chapter explicitly
% identifies itself as based on the joint published paper. Journal theorem
% numbering is not asserted: its complete PDF was not obtained.

\section{Extreme Euler--Kronecker constants of quadratic fields}
\label{sec:extreme-quadratic-euler-kronecker}

For a number field $K$, its Euler--Kronecker constant is
\[
 \gamma_K=\lim_{s\longrightarrow1}
       \left(\frac{\zeta_K'}{\zeta_K}(s)+\frac1{s-1}\right).
\]
For a fundamental discriminant $D$, the factorization
$\zeta_{\mathbb Q(\sqrt D)}(s)=\zeta(s)L(s,\chi_D)$ gives
\[
 \gamma_{\mathbb Q(\sqrt D)}
       =\gamma+\frac{L'}L(1,\chi_D),
\]
where $\gamma$ is Euler's constant.
Mourtada--Murty \cite{MourtadaMurtyOmega} proved unconditionally
that both signs attain the lower order $\log\log|D|+O(1)$
infinitely often. Their GRH result adds the term
$\log\log\log|D|$. We recover that complete conditional lower
bound, including the coefficient one on both logarithms and the
published $\gg\sqrt x$ abundance. For the full statement and
proof in an accessible author source, see
\cite[Chapter~4, Theorem~17]{MourtadaThesis}; that chapter is
explicitly identified as the work published in
\cite{MourtadaMurtyOmega}.

\begin{theorem}[Mourtada--Murty's conditional omega conclusions]
\label{thm:extreme-quadratic-euler-kronecker}
There are absolute constants $C_+,C_-$ such that, for every
sufficiently large $x$, there are $\gg\sqrt x$
primes $p\leq x$, $p\equiv1\pmod4$, separately for each sign, such that
\[
 \frac{L'}L(1,\chi_p)
       \geq\log\log x+\log\log\log x-C_+,
\]
and $\gg\sqrt x$ such primes for which
\[
 -\frac{L'}L(1,\chi_p)
       \geq\log\log x+\log\log\log x-C_-.
\]
Consequently the same two lower bounds hold for
$\gamma_{\mathbb Q(\sqrt p)}$ and
$-\gamma_{\mathbb Q(\sqrt p)}$, after altering the constants.
\end{theorem}

\begin{proof}
We give the full averaging argument. Let $X$ tend to infinity,
and put
\[
 \kappa=\frac1{32\log2},\qquad
 y=\kappa(\log X)(\log\log X),\qquad
 Z=(\log X)^{32},\qquad k=\pi(y).
\]
For sufficiently large $X$ one has $2<y<Z<X$.
For $\epsilon\in\{-1,1\}$ let $\mathcal P_\epsilon$ consist of
the primes $p\in(X,2X]$ satisfying $p\equiv1\pmod4$ and
\[
 \left(\frac{\ell}{p}\right)=\epsilon
       \quad\text{for every prime }\ell\leq y.
\]
Write $W_\epsilon=\sum_{p\in\mathcal P_\epsilon}\log p$.
The prime-pattern computation
\eqref{eq:nonresidue-pattern-projector}--%
\eqref{eq:nonresidue-pattern-asymptotic} gives
\begin{equation}\label{eq:ek-pattern-mass}
 W_\epsilon
     =\frac{X}{2^{k+1}}
           +O\!\left(X^{7/8}\log^2(3QX)\right),
 \qquad
 Q=8\prod_{\substack{3\leq\ell\leq y\\\ell\text{ prime}}}\ell.
\end{equation}
Indeed, the characters in the projector are the quadratic
characters of the squareclasses $d_S$ and $-d_S$, where
$d_S=\prod_{\ell\in S}\ell$ and $S$ runs through subsets of the
primes at most $y$. Exactly the empty positive squareclass is
principal. Their primitive conductors divide $Q$.
The prime number theorem and Chebyshev's bound give
\[
 2^{k+1}=X^{1/32+o(1)},\qquad \log Q\ll y.
\]
In particular $W_\epsilon\geq X/2^{k+2}>0$ for all sufficiently
large $X$.

We first justify a sufficiently short expansion of the
logarithmic derivative. For every $p\in(X,2X]$, Lemma~\ref{lem:psi}
and partial summation imply
\begin{equation}\label{eq:ek-logderivative-truncation}
 -\frac{L'}L(1,\chi_p)
    =\sum_{n\leq Z}\frac{\Lambda(n)\chi_p(n)}n
      +O\!\left(Z^{-1/8}\log^2(3pZ)\right)
    =\sum_{n\leq Z}\frac{\Lambda(n)\chi_p(n)}n+o(1),
\end{equation}
uniformly in these primes. To check the first identity directly,
the same estimate for $\psi(t,\chi_p)$ shows that the series
$\sum_n\Lambda(n)\chi_p(n)/n$ converges. Its tail beyond $Z$ is
\[
 -\frac{\psi(Z,\chi_p)}Z+
        \int_Z^\infty\frac{\psi(t,\chi_p)}{t^2}\,dt
       \ll Z^{-1/8}\log^2(3pZ).
\]
Abel's theorem identifies the convergent series with
$-L'/L(1,\chi_p)$, by taking real $s\downarrow1$ in the
absolutely convergent Dirichlet series at $s>1$.
The error in \eqref{eq:ek-logderivative-truncation} is
$O((\log X)^{-2})$ with our choice of $Z$.

For every prime $\ell$ with $y<\ell\leq Z$, the same projector,
now multiplied by the character $p\mapsto(\ell/p)$, gives
\begin{equation}\label{eq:ek-unprescribed-prime}
 \sum_{p\in\mathcal P_\epsilon}(\log p)\chi_p(\ell)
       \ll X^{7/8}\log^2(12Q\ell X).
\end{equation}
There is no principal term: all the resulting squareclasses
are $\ell d_S$ or $-\ell d_S$, and the new prime $\ell>y$
occurs to an odd exponent. Their primitive conductors divide
$4Q\ell$. All primes dividing these moduli lie below $X$, so
inducing the characters introduces no change in the displayed
prime sums. In the normalized projector the sum of the absolute
values of the coefficients is one. This proves the claimed
uniform bound without a loss of $2^k$.

Average \eqref{eq:ek-logderivative-truncation} over
$\mathcal P_\epsilon$ with positive weights $(\log p)/W_\epsilon$.
Only prime powers occur. For $\ell\leq y$, their character values
are exactly $\epsilon^a$ at $\ell^a$. For $\ell>y$ and even
$a$, their character values are exactly one, since $p>Z$.
The total contribution of these even powers is bounded by
\[
 \sum_{\ell>y}\frac{\log\ell}{\ell^2-1}
      \leq\sum_{n>y}\frac{\log n}{n^2-1}
      \ll\frac{\log y}{y}=o(1).
\]
For odd powers of primes $\ell>y$, apply
\eqref{eq:ek-unprescribed-prime}. Their combined contribution
in absolute value is at most
\begin{align*}
 &\frac{X^{7/8}}{W_\epsilon}
        \log^2(12QZX)
             \sum_{n\leq Z}\frac{\Lambda(n)}n\\
 &\hspace{15mm}\ll
    2^{k+2}X^{-1/8}\log^2(12QZX)\log Z
       =X^{-3/32+o(1)}=o(1).
\end{align*}
Here $\sum_{n\leq Z}\Lambda(n)/n\ll\log Z$ follows by partial
summation from Chebyshev's estimate.

Extending the prescribed prime powers from $\ell^a\leq Z$ to
all $a\geq1$ changes the sum by at most
\[
 \frac2Z\sum_{\ell\leq y}\log\ell\ll\frac yZ=o(1).
\]
Consequently the exact weighted averages satisfy
\begin{equation}\label{eq:ek-prescribed-average}
 \frac1{W_\epsilon}
  \sum_{p\in\mathcal P_\epsilon}
       (\log p)\left(-\frac{L'}L(1,\chi_p)\right)
     =\sum_{\ell\leq y}\frac{\epsilon\log\ell}{\ell-\epsilon}
          +o(1).
\end{equation}

The classical Mertens estimate
$\sum_{\ell\leq y}(\log\ell)/\ell=\log y+O(1)$
and convergence of
$\sum_\ell(\log\ell)/(\ell(\ell-1))$ show that the
right side of \eqref{eq:ek-prescribed-average} is
$\log y+O(1)$ when $\epsilon=1$, and
$-\log y+O(1)$ when $\epsilon=-1$.
We retain the abundance assertion in the published conclusion.
For either desired sign, let $V_p$ denote that signed value of
$L'/L(1,\chi_p)$ and choose the corresponding pattern
$\epsilon$. There is an absolute $C$ such that its weighted
mean is at least $\log y-C$. The truncation
\eqref{eq:ek-logderivative-truncation} gives the pointwise bound
$|V_p|\leq B\log\log X$ for an absolute $B$ and all sufficiently
large $X$. If $\alpha$ is the total normalized weight of primes
with $V_p\geq\log y-C-1$, then
\[
 \log y-C
 \leq \alpha B\log\log X+(1-\alpha)(\log y-C-1).
\]
Thus $\alpha\gg1/\log\log X$. Since each prime weight before
normalization is at most $\log(2X)$, the number of these primes is
\[
 \gg\frac{W_\epsilon}{(\log X)(\log\log X)}
 \gg\frac{X}{2^{k+2}(\log X)(\log\log X)}
       =X^{31/32-o(1)}\gg\sqrt X.
\]
Finally
\[
 \log y=\log\log X+\log\log\log X+\log\kappa,
\]
Set $X=x/2$. Replacing $X$ by $x$ changes the two iterated
logarithms by $o(1)$, and the primes just counted lie below $x$.
This proves both abundance statements and, in particular,
infinitude for each sign. The formula for
$\gamma_{\mathbb Q(\sqrt p)}$ proves the final assertion.
\end{proof}

The theorem is an omega statement, not an upper bound for
all quadratic fields. The full leading terms of the published
GRH conclusion have been retained. No particular optimized
numerical value of the bounded remainder is asserted.

% Bibliography additions:
% \bibitem{Badzyan2010} A. I. Badzyan, The Euler--Kronecker constant,
% Math. Notes 87 (2010), 31--42, doi:10.1134/S0001434610010050;
% Russian original Mat. Zametki 87 (2010), 35--47,
% doi:10.4213/mzm4736, Section 2.
% \bibitem{FordLucaMoree2014} K. Ford, F. Luca and P. Moree,
% Values of the Euler phi-function not divisible by a given odd prime,
% and the distribution of Euler--Kronecker constants for cyclotomic fields,
% Math. Comp. 83 (2014), 1447--1476,
% doi:10.1090/S0025-5718-2013-02749-4.

\section{Cyclotomic Euler--Kronecker constants and a second asymptotic coefficient}
\label{sec:cyclotomic-euler-kronecker}

Write $K_m=\mathbb Q(\zeta_m)$, where $\zeta_m$ is a primitive
$m$th root of unity, and define
\[
 \gamma_m=\lim_{s\longrightarrow1}
 \left(\frac{\zeta_{K_m}'}{\zeta_{K_m}}(s)+\frac1{s-1}\right).
\]
Badzyan's published conditional conclusion
\cite[Section~2]{Badzyan2010} concerns every positive integer $m$,
including composite conductors. We retain that scope and its full
order of magnitude. The second conclusion below is the GRH clause
of Ford--Luca--Moree's Theorem~2 \cite{FordLucaMoree2014}.

\begin{theorem}[Badzyan's bound]
\label{thm:cyclotomic-euler-kronecker}
There is an effective absolute constant $C$ such that, for every
integer $m\geq3$,
\[
 |\gamma_m|\leq C\log m\log\log(3m).
\]
\end{theorem}

We prove the sieve estimate needed for the prime-power terms
explicitly. This also avoids applying a prime-only
Brun--Titchmarsh estimate to a sum containing higher powers.

\begin{lemma}\label{lem:cyclotomic-prime-power-sieve}
For $m\geq3$, put
\[
 \mathcal M_m=\{j\in\mathbb N:mj+1\leq m^{32},\quad
                  mj+1\text{ is a prime power}\}.
\]
Uniformly for $1\leq T\leq m^{31}$,
\[
 A_m(T):=\#\{j\in\mathcal M_m:j\leq T\}
       \ll \frac m{\varphi(m)}\frac T{\log(2T)}.
\]
Consequently
\[
 \sum_{j\in\mathcal M_m}\frac1j
       \ll \frac m{\varphi(m)}\log\log(3m).
\]
All implied constants are effective and absolute.
\end{lemma}

\begin{proof}
It suffices first to treat large $T$; bounded $T$ follows by
enlarging the absolute constant. Put $z=T^{1/8}$ and
\[
 G_m(z)=\sum_{\substack{d\leq z\\(d,m)=1}}
                         \frac{\mu^2(d)}{\varphi(d)}.
\]
Here $\mu$ is the M\"obius function. For a squarefree $d$, the sum
of $1/n$ over all positive integers with radical $d$ is
$1/\varphi(d)$. Therefore
\[
 G_m(z)\geq H_m(z):=
           \sum_{\substack{n\leq z\\(n,m)=1}}\frac1n.
\]
Every positive integer factors uniquely as $ab$, where every prime
factor of $a$ divides $m$ and $(b,m)=1$. Writing $a\mid m^\infty$
for the first condition, we obtain
\[
 \sum_{n\leq z}\frac1n
 =\sum_{a\mid m^\infty}\frac1a H_m(z/a)
 \leq H_m(z)\prod_{p\mid m}(1-p^{-1})^{-1}.
\]
In particular
\begin{equation}\label{eq:cyclotomic-sieve-denominator}
 G_m(z)\geq\frac{\varphi(m)}m\log z.
\end{equation}

For completeness, the required upper sieve follows by minimizing
a finite quadratic form. Use real weights $\lambda_d$ supported
on squarefree $d\leq z$ with $(d,m)=1$ and $\lambda_1=1$.
The number of $j\leq T$ for which no prime $p\leq z$, $p\nmid m$,
divides $mj+1$ is at most
\begin{align*}
 \sum_{j\leq T}\left(\sum_{d\mid mj+1}\lambda_d\right)^2
 &=T\sum_{d,e}\frac{\lambda_d\lambda_e}{[d,e]}
       +O\!\left(\left(\sum_d|\lambda_d|\right)^2\right).
\end{align*}
The progression modulo $[d,e]$ has exactly one allowed residue,
since $([d,e],m)=1$. Using
$(d,e)=\sum_{r\mid(d,e)}\varphi(r)$, put
$v_r=\sum_{r\mid d}\lambda_d/d$. Then
\[
 \sum_{d,e}\frac{\lambda_d\lambda_e}{[d,e]}
      =\sum_r\varphi(r)v_r^2,
 \qquad \lambda_1=\sum_r\mu(r)v_r.
\]
Choose $v_r=\mu(r)/(\varphi(r)G_m(z))$ on the same support.
M\"obius inversion yields
\[
 \lambda_d=
 \frac{\mu(d)d}{\varphi(d)G_m(z)}
       \sum_{\substack{s\leq z/d\\(s,dm)=1}}
                        \frac{\mu^2(s)}{\varphi(s)}.
\]
These weights satisfy $\lambda_1=1$, have quadratic form
$G_m(z)^{-1}$, and obey $|\lambda_d|\leq d/\varphi(d)\leq d$.
Thus $\sum|\lambda_d|\ll z^2$, and the sifted count is
\[
 \ll \frac m{\varphi(m)}\frac T{\log z}+z^4.
\]

If $mj+1=p^a$ with $p>z$, it is among these sifted integers.
For a fixed prime $p\leq z$ occurring in such a power, one has
$p\nmid m$. Let $f$ be its multiplicative order modulo $m$.
Every admissible exponent $a$ is a multiple of $f$, and
$p^f\geq m+1$. Hence there are at most $32$ admissible powers
$p^a\leq m^{32}$ for this fixed base $p$. This bounds the number
of small-base contributions by $32\pi(z)\leq32z$.
It is the number of admissible exponents that is bounded here;
the exponents themselves need not be at most $32$.
We conclude that
\[
 A_m(T)\ll\frac m{\varphi(m)}\frac T{\log T}
                  +T^{1/2}+T^{1/8}
       \ll\frac m{\varphi(m)}\frac T{\log(2T)}.
\]
Finally, partial summation, with $V=m^{31}$, gives
\[
 \sum_{j\in\mathcal M_m}\frac1j
 =\frac{A_m(V)}V+\int_1^V\frac{A_m(t)}{t^2}\,dt
 \ll\frac m{\varphi(m)}
       \left(1+\int_1^V\frac{dt}{t\log(2t)}\right),
\]
which is the asserted bound.
\end{proof}

\begin{proof}[Proof of Theorem~\ref{thm:cyclotomic-euler-kronecker}]
Define nonnegative coefficients $\Lambda_{K_m}(n)$ by
\[
 -\frac{\zeta_{K_m}'}{\zeta_{K_m}}(s)
      =\sum_{n\geq1}\frac{\Lambda_{K_m}(n)}{n^s}
      \quad(\Re s>1).
\]
The abelian factorization uses the primitive characters inducing
all characters modulo $m$:
$\zeta_{K_m}(s)=\prod_{\chi\bmod m}L(s,\chi^*)$.
Exactly one factor is $\zeta(s)$. Summing Lemma~\ref{lem:psi}
over these $\varphi(m)$ factors gives
\[
 \sum_{n\leq t}\Lambda_{K_m}(n)
      =t+E_m(t),\qquad
 E_m(t)\ll\varphi(m)t^{7/8}\log^2(3mt).
\]
Partial summation and the Laurent expansion at $1$ now give,
for every $Y\geq2$,
\begin{align}
 \gamma_m
 &=\log Y-\sum_{n\leq Y}\frac{\Lambda_{K_m}(n)}n
       +\frac{E_m(Y)}Y-\int_Y^\infty\frac{E_m(t)}{t^2}\,dt
                                                        \notag\\
 &=\log Y-\sum_{n\leq Y}\frac{\Lambda_{K_m}(n)}n
       +O\!\left(\varphi(m)Y^{-1/8}\log^2(3mY)\right).
 \label{eq:cyclotomic-ek-truncation}
\end{align}
For example, the constant in the first identity is identified by
taking real $s\downarrow1$ in the logarithmic-derivative series;
the integrable bound on $E_m(t)/t^2$ justifies that passage.
Take $Y=m^{32}$, so the error is $O(1)$. Positivity already
gives $\gamma_m\leq32\log m+O(1)$.

We bound the positive sum in
\eqref{eq:cyclotomic-ek-truncation}. If $p\nmid m$ has order
$f$ modulo $m$, it splits into $\varphi(m)/f$ prime ideals of norm
$p^f$. Thus its contributions are exactly
$\varphi(m)\log p/p^a$ for the exponents with $p^a\equiv1\pmod m$.
By Lemma~\ref{lem:cyclotomic-prime-power-sieve}, their total is at most
\[
 \varphi(m)\sum_{j\in\mathcal M_m}
                   \frac{\log(mj+1)}{mj+1}
 \leq32\log m\,\frac{\varphi(m)}m
                       \sum_{j\in\mathcal M_m}\frac1j
 \ll\log m\log\log(3m).
\]

For a prime dividing $m$, write $m=p^a u$ with $p\nmid u$.
Its ramification index is $\varphi(p^a)$, its residue degree is $f=\operatorname{ord}_u(p)$, with $f=1$
when $u=1$, and there are $\varphi(u)/f$ prime ideals above it.
Even the sum over all their powers, without the truncation, is
\[
 \frac{\varphi(u)\log p}{p^f-1}\leq\log p,
\]
because $u\mid p^f-1$ and $\varphi(u)\leq u$.
The contribution of primes dividing $m$ is therefore at most
$\sum_{p\mid m}\log p\leq\log m$.
These bounds in \eqref{eq:cyclotomic-ek-truncation} prove the
claimed two-sided estimate, with an effective absolute constant.
\end{proof}

\begin{corollary}[Ford--Luca--Moree's GRH error term]
\label{cor:totient-second-coefficient}
For an odd prime $q$, define $e_0(q),e_1(q)$ by the classical
asymptotic expansion, with $q$ fixed,
\[
 \#\{n\leq x:q\nmid\varphi(n)\}
 =\frac{x}{(\log x)^{1/(q-1)}}
   \left(e_0(q)+\frac{e_1(q)}{\log x}
                       +O_q((\log x)^{-2})\right).
\]
Then, as $q$ varies through odd primes,
\[
 \frac{e_1(q)}{e_0(q)}
 =\frac{1-\gamma}{q-1}
           +O\!\left(\frac{\log q\log\log(3q)}{q^2}\right),
\]
with an effective absolute implied constant.
\end{corollary}

\begin{proof}
We record the unconditional coefficient identity and its derivation
to specify both normalizations. Put $f_p=\operatorname{ord}_q(p)$,
\[
 S(q)=\sum_{\substack{p\ne q\\ f_p\geq2}}
                    \frac{\log p}{p^{f_p}-1},\qquad
 C(q,s)=\prod_{\substack{p\ne q\\f_p\geq2}}
                       (1-p^{-f_ps})^{(q-1)/f_p}.
\]
The Dirichlet series of the counting function is
\[
 H_q(s)=(1-q^{-2s})\zeta(s)
       \bigl(C(q,s)(1-q^{-s})\zeta_{K_q}(s)\bigr)^{-1/(q-1)}.
\]
This follows by checking the Euler factors: $q\nmid\varphi(n)$
allows the exponent of $q$ to be at most one and excludes primes
$p\equiv1\pmod q$ from $n$.
Set $\alpha=(q-2)/(q-1)$ and
$F_q(s)=H_q(s)(s-1)^\alpha/s$. The unconditional
Selberg--Delange coefficient calculation
\cite[Propositions~1--2]{FordLucaMoree2014} gives
$e_0=F_q(1)/\Gamma(\alpha)>0$ and
$e_1=F_q'(1)/\Gamma(\alpha-1)$. Consequently
\[
 (q-1)\frac{e_1(q)}{e_0(q)}=-\frac{F_q'(1)}{F_q(1)}.
\]
Since $C'(q,1)/C(q,1)=(q-1)S(q)$, logarithmic
differentiation of the displayed formula for $H_q$ yields
\begin{equation}\label{eq:totient-second-identity}
 (q-1)\frac{e_1(q)}{e_0(q)}
 =1-\gamma+\frac{(3-q)\log q}{(q-1)^2(q+1)}
                  +S(q)+\frac{\gamma_q}{q-1}.
\end{equation}

Theorem~\ref{thm:cyclotomic-euler-kronecker} bounds the last term.
It remains to bound $S(q)$, for which the preceding sieve suffices.
Expand $1/(p^{f_p}-1)$ as a geometric series and split the
resulting powers at $Y=q^{32}$. Below $Y$, the sum is at most
\[
 \sum_{\substack{n\leq Y\\n\equiv1\pmod q}}\frac{\Lambda(n)}n
                  \ll\frac{\log q\log\log(3q)}q.
\]
All terms above $Y$ have exponent at least two. Their contribution
is bounded by
\[
 \sum_{\substack{p^a>Y\\a\geq2}}\frac{\log p}{p^a}
                         \ll\frac{\log Y}{\sqrt Y}.
\]
Indeed, bases $p\leq\sqrt Y$ contribute at most
$(2/Y)\sum_{p\leq\sqrt Y}\log p\ll Y^{-1/2}$ by summing
each geometric tail, while bases $p>\sqrt Y$ contribute at most
$2\sum_{n>\sqrt Y}(\log n)/n^2\ll(\log Y)/\sqrt Y$.
It follows that $S(q)\ll q^{-1}\log q\log\log(3q)$.
Substitution into \eqref{eq:totient-second-identity} proves exactly
the stated error term.
\end{proof}

The leading-order existence of the asymptotic expansion is already
unconditional. The recovered Ford--Luca--Moree conclusion is its
specific uniform error as the prime $q$ varies. No
Elliott--Halberstam or prime-tuple conclusions from that paper are
asserted here.

\section{The maximum quadratic-character bias for products of two primes}
\label{sec:semiprime-bias}

Hough proved the following precise asymptotic under GRH
\cite[Theorem~1.4]{HoughBias}. The lower bound was already unconditional;
the conditional part was the uniform upper bound when the conductor is
allowed to be as large as the counting parameter. We prove that the fixed
zero-free strip suffices for the same asymptotic, including its leading
constant.

Let $\mathcal X(x)$ denote the nonprincipal primitive quadratic Dirichlet
characters of conductor at most $x$. For $\chi\in\mathcal X(x)$ of
conductor $d$, and $\eta\in\{-1,1\}$, put
\[
 N_d(x)=\#\{(p,q):p,q\text{ prime},\ pq\leq x,\ (pq,d)=1\},
\]
\[
 N_{\chi,\eta}(x)=\#\{(p,q):p,q\text{ prime},\ pq\leq x,
                         \ \chi(p)=\chi(q)=\eta\},
 \qquad R_{\chi,\eta}(x)=\frac{4N_{\chi,\eta}(x)}{N_d(x)}.
\]
Here pairs are ordered, as in the sums in the published proof. The
asymptotic below is unchanged if products are counted without ordering.

\begin{theorem}[Hough's maximum-bias asymptotic, unconditionally]
\label{thm:hough-bias}
For either fixed $\eta\in\{-1,1\}$,
\[
 \max_{\chi\in\mathcal X(x)}|R_{\chi,\eta}(x)-1|
       \sim\frac{\log\log\log x}{\log\log x}
       \qquad(x\longrightarrow\infty).
\]
In fact the maximum equals
$\{\log\log\log x+O(1)\}/\log\log x$.
\end{theorem}
\begin{proof}
We give the uniform counting argument; this is the point where GRH was
used in \cite[Section~3]{HoughBias}. Write
\[
 L_2=\log\log x,\qquad L_3=\log\log\log x,
 \qquad A_\chi(t)=\sum_{p\leq t}\chi(p).
\]
All estimates below are for sufficiently large $x$, uniformly in
$d\leq x$. Removing prime powers from Lemma~\ref{lem:psi} and partially
summing gives
\begin{equation}\label{eq:bias-prime-bound}
 |A_\chi(t)|\ll t^{7/8}\log^2(dt)\qquad(t\geq2).
\end{equation}
The same argument for $\zeta$ gives
$\pi(t)=\operatorname{Li}(t)+O(t^{7/8}\log^2(2t))$.
We deliberately retain the harmless extra logarithms.

The prime reciprocal series
\[
 B_\chi=\sum_p\frac{\chi(p)}p
\]
converges by \eqref{eq:bias-prime-bound}. The Euler product and the
absolutely convergent contribution of higher prime powers give
\[
 B_\chi=\log L(1,\chi)+O(1),
 \qquad |B_\chi|\leq L_3+O(1),
\]
where the latter estimate follows from the two-sided bound in
Theorem~\ref{thm:L1}. The constants are uniform, including the finitely
many small conductors. Partial summation also gives
\begin{equation}\label{eq:bias-tail}
 \sum_{p>\sqrt x}\frac{\chi(p)}p
       \ll x^{-1/16}\log^2 x=o(1).
\end{equation}
To see the uniformity in the infinite tail, bound
$\log(dt)\leq\log x+\log t$ and integrate
$t^{-9/8}(\log x+\log t)^2$ from $\sqrt x$ to infinity.

First control the denominator without discarding ramified primes.
The hyperbola decomposition and the above prime-number theorem yield
\[
 N_1(x)=2\sum_{p\leq\sqrt x}\pi(x/p)-\pi(\sqrt x)^2
       =\frac{2x}{\log x}\bigl(L_2+O(1)\bigr).
\]
For completeness, the aggregate prime-number-theorem error here is at
most
\[
 x^{7/8}\log^2 x\sum_{n\leq\sqrt x}n^{-7/8}
       \ll x^{15/16}\log^2x=o(x/\log x).
\]
In the main term, replacing $\operatorname{Li}(x/p)$ by
$x/\{p\log(x/p)\}$ costs
$O(xL_2/\log^2x)$, and replacing $\log(x/p)$ by $\log x$
costs $O(x/\log x)$ since $\sum_{p\leq\sqrt x}\log p/p\ll\log x$.
Mertens' estimate then gives the displayed formula for $N_1$.

We have the uniform elementary bound
\[
 \sum_{p\mid d}\frac1p\leq\log\log\log(8d)+O(1).
\]
Indeed, for $d$ large split at $z=\log d$. Mertens' estimate controls
the primes up to $z$, while there are at most $\log d/\log z$
prime divisors larger than $z$, whose total reciprocal contribution
is at most $1/\log z$. Small $d$ is absorbed in the constant.
Every excluded pair contains a prime dividing $d$. For such primes
$p\leq\sqrt x$, use $\pi(x/p)\ll x/(p\log x)$; for larger
$p\mid d$, use $\pi(x/p)\leq\sqrt x$ and
$\omega(d)\ll\log x$. Hence
\begin{equation}\label{eq:bias-denominator}
 N_d(x)=\frac{2x}{\log x}\bigl(L_2+O(1+L_3)\bigr).
\end{equation}
In particular this denominator is positive for all sufficiently large
$x$, uniformly over the conductors in question.

Let
\[
 T_\chi(x)=\sum_{\substack{pq\leq x\\(pq,d)=1}}\chi(p),
 \qquad
 U_\chi(x)=\sum_{pq\leq x}\chi(p)\chi(q),
\]
with all variables prime. Put
$\pi_d(t)=\#\{p\leq t:p\nmid d\}$.
The exact hyperbola identity is
\[
 T_\chi(x)=
 \sum_{p\leq\sqrt x}\chi(p)\pi_d(x/p)
 +\sum_{\substack{q\leq\sqrt x\\q\nmid d}}A_\chi(x/q)
 -A_\chi(\sqrt x)\pi_d(\sqrt x).
\]
By \eqref{eq:bias-prime-bound}, the last two terms are
$O(x^{15/16}\log^2x)$. Replacing $\pi_d$ by $\pi$ in the
first sum costs at most $\omega(d)\pi(\sqrt x)$, which is
$O(\sqrt x\log x)$. Applying the prime-number theorem to that
sum and using the same aggregate error as above, we obtain
\[
 T_\chi(x)=\sum_{p\leq\sqrt x}\chi(p)\operatorname{Li}(x/p)
             +O(x^{15/16}\log^2x).
\]
The same two main-term replacements as for $N_1$, now with
$|\chi(p)|\leq1$, and \eqref{eq:bias-tail}, give
\begin{equation}\label{eq:bias-linear}
 T_\chi(x)=\frac{x}{\log x}\bigl(B_\chi+O(1)\bigr).
\end{equation}
Similarly,
\[
 U_\chi(x)=2\sum_{p\leq\sqrt x}\chi(p)A_\chi(x/p)
                 -A_\chi(\sqrt x)^2
       \ll x^{15/16}\log^2x+x^{7/8}\log^4x
       =o(x/\log x).
\]

On pairs coprime to $d$, expanding
$(1+\eta\chi(p))(1+\eta\chi(q))$ gives the exact identity
\[
 4N_{\chi,\eta}(x)=N_d(x)+2\eta T_\chi(x)+U_\chi(x).
\]
Using \eqref{eq:bias-denominator} and \eqref{eq:bias-linear} yields
\[
 R_{\chi,\eta}(x)-1
 =\frac{\eta B_\chi+O(1)}{L_2+O(1+L_3)}
 =\frac{\eta B_\chi+O(1)}{L_2}.
\]
The last error is uniform because
$|B_\chi|\ll1+L_3$ and $(1+L_3)^2/L_2=o(1)$.
Thus the maximum in the theorem is at most
$(L_3+O(1))/L_2$.

For the reverse bound, the unconditional Corollary~2.2 of
\cite{HoughBias}, derived there from the large-value theorem of
Granville and Soundararajan, supplies primitive quadratic characters
of conductor at most $x$ with
$B_\chi\geq\log\log\log x-O(1)$. Applying the uniform formula
just proved gives the matching lower bound for either fixed sign
$\eta$. No GRH input is used in that large-value statement.

Finally, passing from ordered pairs to unordered prime products
changes each count by half its diagonal contribution, of size at
most $\pi(\sqrt x)$. Since
$N_d(x)\asymp xL_2/\log x$, the resulting change in the normalized
ratio is $O(x^{-1/2}/L_2)$, which is negligible.
\end{proof}

\paragraph{Scope of the transfer.}
The assertion is Hough's published maximum-bias asymptotic. The
uniform formula in the proof is included to verify its dependence on
the conductor and on primes dividing it. It does not establish the
usual GRH-based limiting distributions for ordinary prime-number
races, which depend on zeros on the critical line and often on
additional independence hypotheses.

% HoughBias: P. Hough, A lower bound for biases amongst products of two
% primes, Research in Number Theory 3 (2017), article 19, 11 pp.
% DOI 10.1007/s40993-017-0083-9.

\section{Littlewood's orders of magnitude on the line \texorpdfstring{$\Re s=1$}{Re s = 1}}
\label{sec:zeta-one-line}

The assertions below are the qualitative orders of magnitude in the classical
RH-conditional bounds of Littlewood. For the reciprocal, see
J.~E.~Littlewood, \emph{Mathematical Notes (5): On the Function
$1/\zeta(1+ti)$}, \emph{Proc. London Math. Soc.} (2) \textbf{27} (1928),
349--357, \href{https://doi.org/10.1112/plms/s2-27.1.349}{doi:10.1112/plms/s2-27.1.349}.
The logarithmic-derivative assertion and its historical RH dependence are
recorded in the introduction to A.~Chirre, M.~Val\aa s Hagen and
A.~Simoni\v c, \emph{Conditional estimates for the logarithmic derivative
of Dirichlet $L$-functions}, \emph{Indag. Math.} \textbf{35} (2024),
14--27, \href{https://doi.org/10.1016/j.indag.2023.07.005}{doi:10.1016/j.indag.2023.07.005}.
We recover the orders of magnitude, not the sharper numerical leading
constants available under RH.

\begin{theorem}\label{thm:zeta-one-line}
There is an effective absolute constant $C$ such that, for $|t|\ge3$,
\[
 |\zeta(1+it)|\le C\ell(|t|),\qquad
 \frac1{|\zeta(1+it)|}\le C\ell(|t|),\qquad
 \left|\frac{\zeta'}{\zeta}(1+it)\right|\le C\ell(|t|).
\]
Here $\ell$ is the positive modified iterated logarithm defined in
Section~\ref{sec:analytic}.
\end{theorem}

\begin{proof}
Complex conjugation reduces the problem to positive $t$. It suffices to work
with large $t$, since on any remaining compact segment of $\Re s=1$ bounded
away from its pole the functions in question are continuous and nonzero
where appropriate, by Theorem~\ref{thm:input}.
Put
\[
 \kappa=\frac1{32},\qquad y=(\log t)^{64},\qquad s=1+it.
\]
We first justify two bounds on a horizontal strip at height comparable to $t$:
\begin{equation}\label{eq:zeta-log-control}
 |\log\zeta(\sigma+i\tau)|+
 \left|\frac{\zeta'}{\zeta}(\sigma+i\tau)\right|\ll\log t
 \quad\left(\frac{31}{32}\le\sigma\le2,\quad
 \frac t2\le\tau\le\frac{3t}{2}\right).
\end{equation}
The logarithm is continued from its Euler-product value on $\Re s>1$.
For large $t$, disks of radius $35/32$ centered at $2+i\tau$ lie in
$\Re s>7/8$, avoid the pole, and have imaginary parts comparable to $t$.
The classical polynomial growth bound for $\zeta$ gives
$\Re\log\zeta=\log|\zeta|\ll\log t$ on these disks, while the
Euler series gives $|\log\zeta(2+i\tau)|\ll1$ at their centers.
Borel--Carath\'eodory bounds the logarithm on the concentric disks of
radius $17/16$ by $O(\log t)$. These inner disks contain the needed
horizontal segments together with a fixed neighborhood. Cauchy's estimate
on circles of radius $1/64$ then gives the derivative bound in
\eqref{eq:zeta-log-control}. All radii are fixed and all constants effective.

For $F=\log\zeta$ and $F=-\zeta'/\zeta$, Mellin inversion and absolute
convergence on $\Re w=1$ give, respectively,
\begin{align}
 \sum_{n\ge2}\frac{\Lambda(n)e^{-n/y}}{n^s\log n}
 &=\frac1{2\pi i}\int_{1-i\infty}^{1+i\infty}
           \log\zeta(s+w)\Gamma(w)y^w\,dw,\label{eq:zeta-mellin-log}\\
 \sum_{n\ge2}\frac{\Lambda(n)e^{-n/y}}{n^s}
 &=\frac1{2\pi i}\int_{1-i\infty}^{1+i\infty}
           -\frac{\zeta'}{\zeta}(s+w)\Gamma(w)y^w\,dw.
 \label{eq:zeta-mellin-deriv}
\end{align}
Truncate the integrals at $|\Im w|=t/2$ and shift the finite contour to
$\Re w=-\kappa$. Throughout the shifted rectangle, $s+w$ has imaginary
part between $t/2$ and $3t/2$. Thus the pole of $\zeta$ at $s+w=1$,
which would occur at $w=-it$, is outside the rectangle; no singularity of
$\log\zeta$ is crossed. Theorem~\ref{thm:input} also excludes all zeros
there. The only crossed pole is the simple pole of $\Gamma(w)$ at $w=0$,
with residue $1$.

Stirling's formula bounds the two omitted tails on $\Re w=1$, and the
two horizontal sides, by $O(y t^2 e^{-\pi t/4}\log t)$. The precise power
of $t$ is immaterial here. The new vertical side is, by
\eqref{eq:zeta-log-control},
\[
 \ll y^{-\kappa}\log t
      \int_{-\infty}^{\infty}|\Gamma(-\kappa+iv)|\,dv
 \ll \frac1{\log t},
\]
since $y^{-\kappa}=(\log t)^{-2}$ and $-\kappa$ is not a pole of
$\Gamma$. Consequently
\begin{align}
 \log\zeta(1+it)
 &=\sum_{n\ge2}\frac{\Lambda(n)e^{-n/y}}{n^{1+it}\log n}+O(1),
 \label{eq:zeta-short-log}\\
 -\frac{\zeta'}{\zeta}(1+it)
 &=\sum_{n\ge2}\frac{\Lambda(n)e^{-n/y}}{n^{1+it}}+O(1).
 \label{eq:zeta-short-deriv}
\end{align}

The unconditional Mertens estimate and the Chebyshev bound
$\sum_{n\le u}\Lambda(n)\ll u$, followed by summation by parts, imply
\[
 \sum_{n\ge2}\frac{\Lambda(n)e^{-n/y}}{n\log n}
 \le\log\log y+O(1),\qquad
 \sum_{n\ge2}\frac{\Lambda(n)e^{-n/y}}n\ll\log y.
\]
For the first bound, the portion $n\le y$ is bounded by the unsmoothed
Mertens sum; the remaining portion is $O(1)$ by the same partial
summation. For the second bound, the initial portion is $O(\log y)$
and the exponentially weighted tail is $O(1)$.
Taking real parts in \eqref{eq:zeta-short-log}, with both signs, and
then exponentiating proves the first two assertions, because
$\log y=64\log\log t$. The triangle inequality in
\eqref{eq:zeta-short-deriv} proves the third assertion.
\end{proof}

\begin{corollary}\label{cor:dirichlet-logderiv}
For every primitive nonprincipal Dirichlet character modulo $q$,
\[
 \left|\frac{L'}L(1,\chi)\right|\ll\ell(q).
\]
\end{corollary}
\begin{proof}
Lemma~\ref{lem:psi} and partial summation give the convergent expansion
\[
 -\frac{L'}L(1,\chi)
 =\sum_{n\le y}\frac{\Lambda(n)\chi(n)}n
    +O\bigl(y^{-1/8}\log^2(qy)\bigr).
\]
Take $y=(\log(3q))^{24}$. The error is bounded, while the absolute value
of the finite sum is at most $\sum_{n\le y}\Lambda(n)/n\ll\log y$.
This is $O(\ell(q))$. The order of magnitude is the one previously
obtained under GRH in the logarithmic-derivative literature just cited.
\end{proof}
% Bibliography: DDLL2024, JLMS 110 (2024), e12996,
% doi:10.1112/jlms.12996. Final publisher HTML and author PDF inspected.
\section{The asymmetric tails of cubic \texorpdfstring{$L$}{L}-values}
\label{sec:cubic-l1-tails}

Put $K=\mathbb Q(\omega)$, where $\omega^2+\omega+1=0$.
In this section $\mathcal F_3(X)$ is the family of primitive Dirichlet
characters of exact order three, conductor at most $X$, and conductor
\emph{coprime to three}. This is precisely the family defined in
\cite[Section~2, (2.1)]{DDLL2024}. In particular it does not include
characters whose conductors are divisible by nine. Write $\log_j$ for
the $j$-fold iterated logarithm. Define
\[
 \phi_X(t)=\frac{\#\{\chi\in\mathcal F_3(X):|L(1,\chi)|>e^\gamma t\}}
 {|\mathcal F_3(X)|},\qquad
 \psi_X(t)=\frac{\#\{\chi\in\mathcal F_3(X):
 |L(1,\chi)|<(\zeta(3)e^{-\gamma})^{1/2}/t\}}
 {|\mathcal F_3(X)|}.
\]
The constants in the following theorem are
\begin{align*}
 2C_+&=\int_0^1\frac{2e^{2u}-2e^{-u}}{u(e^{2u}+2e^{-u})}\,du
       -\int_1^\infty\frac{6}{u(e^{3u}+2)}\,du,\\
 C_-&=\int_0^1\frac{2e^u-2e^{-2u}}{u(e^{-2u}+2e^u)}\,du
       -\int_1^\infty\frac{3e^{-2u}}{u(e^{-2u}+2e^u)}\,du.
\end{align*}
They are the source's $C_{\max}$ and $C_{\min}$, respectively.

\begin{theorem}[Darbar--David--Lal\'{i}n--Lumley, Theorem~1.4]
\label{thm:cubic-l1-tails}
Fix $C>0$. For sufficiently large $X$ and
$e^{10}\leq A\leq(\log_2 X)^C$, uniformly in the source's range
\[
 1\leq t\leq\log_2 X+\log_3 X-\log_2 A-37+C_++o(1),
\]
one has
\[
 \phi_X(t)=\exp\left\{-\frac{2e^{t-C_+}}t
          \left(1+O_C(t^{-1/2}+A^{-1})\right)\right\}.
\]
Similarly, uniformly for
\[
 1\leq t\leq
 \left(\log_2 X+\log_3 X-\log_2 A-37+C_-+o(1)\right)^{1/2},
\]
one has
\[
 \psi_X(t)=\exp\left\{-\frac{e^{t^2-C_-}}{t^2}
          \left(1+O_C(t^{-1/2}+A^{-1})\right)\right\}.
\]
These conclusions require no GRH assumption. The $o(1)$ in the ranges
may be taken to be zero; allowing the usual vanishing endpoint
adjustment gives exactly the published formulation.
\end{theorem}

The proof uses the finite-order Hecke part of the supplied theorem over
$K$, in addition to its Dirichlet part. We replace the conditional
character averages and moment comparisons in \cite[Section~6]{DDLL2024}.
Their numerical auxiliary error exponents are not asserted here.

\begin{lemma}[Uniform finite-order Hecke sums]
\label{lem:cubic-family-sum}
For positive integers $m$ that are not cubes,
\[
 S(X;m):=\sum_{\chi\in\mathcal F_3(X)}\chi(m)
 \ll X^{15/16}\exp\{c(\log(3mX))^{3/4}\}.
\]
The constant $c$ and the implied constant are absolute and effective.
\end{lemma}
\begin{proof}
First let $\eta$ be any nonprincipal finite-order Hecke character of $K$
with a chosen modulus of norm $Q$. (For a primitive character this is
its conductor; for an induced character the omitted Euler factors are
included in this modulus.) On $\sigma\geq15/16$, uniformly in $v$, we have
\begin{equation}
 \label{eq:cubic-log-subpower}
 |\log L(\sigma+iv,\eta)|
 \ll (\log(3Q(3+|v|)))^{3/4}.
\end{equation}
Here the logarithm is the branch continued horizontally from the
absolutely convergent Euler product. To verify the assertion, the
zero-free half-plane $\Re s>7/8$, the usual polynomial growth of this
fixed-degree $L$-function, and Borel--Carath\'{e}odory on discs centered
at $2+iv$ give $|\log L(s,\eta)|\ll\log(3Q(3+|\Im s|))$ on
$\Re s\geq57/64$. This bound also follows for an induced character by
including its omitted Euler factors. Set
$H=\log(3Q(3+|v|))$ and $Y=H^{10}$. Mellin inversion and a shift to
$\Re w=-3/64$ give
\[
 \log L(s,\eta)=
 \sum_{\mathfrak p,k\geq1}
 \frac{\eta(\mathfrak p)^k}{k(N\mathfrak p)^{ks}}
 e^{-(N\mathfrak p)^k/Y}+O(Y^{-3/64}H).
\]
The exponential decay of $\Gamma(w)$ justifies the shift and its tails;
only its pole at zero is crossed. The absolute value of the displayed
sum is $O(1+Y^{1/16})$: the number of ideals of $K$ of norm at most
$u$ is $O(u)$, and the prime-power coefficients are at most one.
Thus the two bounds are $O(H^{5/8})$ and $O(H^{17/32})$.
This proves \eqref{eq:cubic-log-subpower}, with room to spare.

For the cubic residue character
$\eta_m(\mathfrak a)=(m/\mathfrak a)_3$, the conductor divides
$(9m)$, so $Q\ll m^2$. This character is nonprincipal if $m$ is not a
cube: a rational number that is a cube in the quadratic field $K$ is
already a rational cube. The standard cubic reciprocity construction,
including primes over three, is the construction used in
\cite[Section~3 and Lemma~6.2]{DDLL2024}.

Let $d$ be a positive rational integer. Truncated Perron inversion for
\[
 L(s,\eta_m)\prod_{\mathfrak p\mid d}
       (1-\eta_m(\mathfrak p)(N\mathfrak p)^{-s})
\]
and a shift to $15/16$ show that its coefficients satisfy
\[
 \left|\sum_{\substack{N\mathfrak a\leq Z\\(\mathfrak a,d)=1}}
       \eta_m(\mathfrak a)\right|
 \ll 4^{\omega(d)}Z^{15/16}
       \exp\{c(\log(3mX))^{3/4}\},\qquad 1\leq Z\leq X.
\]
For completeness, take the Perron endpoint to be a half-integer with
the same floor as $Z$ and a height of order $(3mX)^4$.
The coefficients in absolute value are bounded by the ideal-counting
coefficients, which are at most the ordinary divisor function. The
truncation error is therefore $O(1)$ after a harmless fixed enlargement
of the height. Equation~\eqref{eq:cubic-log-subpower} bounds the shifted
vertical integral, and the horizontal integrals are smaller. At most
two prime ideals lie over each rational prime, accounting for
$4^{\omega(d)}$. These details avoid any inference of a Lindel\"of
bound on the critical line.

The unconditional M\"obius decomposition in
\cite[(3.3), equivalently (6.1)]{DDLL2024} removes square factors and
rational prime divisors from the primary Eisenstein integers that
parameterize the family. In absolute value it bounds $S(X;m)$ by a
constant times the sum of the preceding estimate with
$Z=X/(d^2(N\mathfrak l)^2)$, over $d\geq1$ and ideals $\mathfrak l$.
Both majorants converge:
\[
 \sum_{d\geq1}\frac{4^{\omega(d)}}{d^{15/8}}<\infty,
 \qquad \sum_{\mathfrak l}(N\mathfrak l)^{-15/8}<\infty.
\]
The coprimality restrictions can be discarded in this upper bound.
This proves the lemma.
\end{proof}

\paragraph{The exact random model.}
Let $\mathbb X(p)$ be independent, taking $1,\omega,\omega^2$ with equal
probabilities if $p=3$ or $p\equiv2\pmod3$. For $p\equiv1\pmod3$, put
\[
 \mathbb P(\mathbb X(p)=0)=\frac2{p+2},\qquad
 \mathbb P(\mathbb X(p)=\omega^j)=\frac p{3(p+2)}\quad(0\leq j<3).
\]
Write $\alpha_p=1$ in the first case and $p/(p+2)$ in the second,
and $L_y(\chi)=\prod_{p\leq y}(1-\chi(p)/p)^{-1}$, with the analogous
random product $L_y(\mathbb X)$. The unconditional counting formula
\cite[Proposition~2.1]{DDLL2024} says
\begin{equation}
 \label{eq:cubic-cube-average}
 \frac{S(X;m)}{|\mathcal F_3(X)|}
  =\prod_{p\mid m}\alpha_p+O_\epsilon(3^{\omega(m)}X^{-3/8+\epsilon})
 \quad(m\text{ a cube}),\qquad |\mathcal F_3(X)|\asymp X.
\end{equation}
We use its unconditional exponent $5/8$ before normalization, not its
separate conditional improvement.

\begin{lemma}[Moments with room at the published endpoint]
\label{lem:cubic-real-moments}
Put $L=\log X$, $\ell=\log_2 X$, $y=A^4L\ell$, and
$r_0=e^{-37}L\ell/\log A$. Uniformly for $|r|\leq4r_0$,
\[
 \frac1{|\mathcal F_3(X)|}\sum_\chi|L_y(\chi)|^{2r}
 =\mathbb E|L_y(\mathbb X)|^{2r}(1+O_C(X^{-1/32})).
\]
\end{lemma}
\begin{proof}
An exact four-point interpolation makes all supports finite. For a
fixed prime put
\[
 a=(1-1/p)^{-2r},\quad b=(1+1/p+1/p^2)^{-r},\quad
 c_0=(a+2b)/3.
\]
On $w\in\{0,1,\omega,\omega^2\}$ one has
\[
 |1-w/p|^{-2r}=1+\frac{a-b}3(w+w^2)+(c_0-1)w^3.
\]
Expanding the product produces coefficients $c_m$, with each prime
exponent at most three. Thus every $m$ in its support has
$\log m\leq3\vartheta(y)\ll y$. Its random expectation is exactly the
sum over cube $m$, weighted by $\prod_{p\mid m}\alpha_p$.

Here is a uniform bound on the total absolute coefficient mass,
including the factors $3^{\omega(m)}$ in
\eqref{eq:cubic-cube-average}. Let
\[
 E_p=1-\alpha_p+\alpha_pc_0,\qquad
 B_p=1+2|a-b|+3|c_0-1|,\qquad R=|r|+1.
\]
Then $c_0\geq1/3$ (use $a\geq1$ for $r\geq0$ and $b\geq1$ for
$r\leq0$), and $\alpha_p\geq7/9$. Consequently $B_p/E_p\leq32$.
If $p>4R$, elementary exponential inequalities give
$|a-1|\leq6R/p$, $|b-1|\leq4R/p$, and
$E_p\geq e^{-3R/p}$. Hence $B_p/E_p\leq e^{40R/p}$.
It follows, uniformly when $4R<y$, that
\[
 \log\frac{\sum_m3^{\omega(m)}|c_m|}
                {\mathbb E|L_y(\mathbb X)|^{2r}}
 \leq\pi(4R)\log32+40R\sum_{4R<p\leq y}\frac1p.
\]
This is $o(L)$ if $R\leq\sqrt L$. Otherwise the effective prime number
theorem bounds it, for sufficiently large $X$, by
\[
 \frac{200R}{\log(4R)}+
       40R\log\frac{\log y}{\log(4R)}.
\]
Both terms increase over the relevant interval up to $R=4r_0+1$;
for the second the derivative is
$\log(\log y/\log(4R))-1/\log(4R)>0$, using
the actual margin $y/(4R)>e^2$ and $\log(4R)>1$.
At that endpoint $\log y-\log(4R)\leq8\log A$ and
$\log(4R)\geq\ell/2$. Substitution gives an upper bound
$(3000e^{-37}+o(1))L<L/1000$. All these estimates hold uniformly for
the stated range of $A$; $C$ is fixed.

Lemma~\ref{lem:cubic-family-sum} bounds every noncube term by
$X^{15/16+o_C(1)}$, since $y=L\ell^{O_C(1)}$ and
$(\log(3mX))^{3/4}=o_C(L)$. The cube terms use
\eqref{eq:cubic-cube-average}. Dividing by the positive random moment,
the two relative errors are at most
$X^{-1/16+1/1000+o_C(1)}$ and
$X^{-3/8+\epsilon+1/1000}$, respectively. This proves the assertion.
\end{proof}

\begin{lemma}[Discarding a small set in the Euler-product truncation]
\label{lem:cubic-short-product}
For all but $O_C(X^{1-1/2000})$ members of $\mathcal F_3(X)$,
\[
 L(1,\chi)=L_y(\chi)\left(1+O_C\left(\frac1{A\ell}\right)\right).
\]
\end{lemma}
\begin{proof}
The Dirichlet prime-sum estimate already proved in this record gives,
by partial summation, the uniform truncation
$L(1,\chi)=L_z(\chi)(1+O(L^{-2}))$ at $z=L^{32}$.
For large $X$, $y<z$ and $L^{-2}=o_C((A\ell)^{-1})$.
Split $(y,z]$ into intervals $(u,2u]$, truncated at $z$ if necessary,
where $u=2^jy$ and $0\leq j\ll\ell$.

For each integer $k\geq1$, expansion of an even moment and
Lemma~\ref{lem:cubic-family-sum} give
\begin{align*}
 \sum_{\chi\in\mathcal F_3(X)}
 \left|\sum_{u<p\leq\min(2u,z)}\frac{\chi(p)}p\right|^{2k}
 &\ll X\left(\frac{32k}{u\log u}\right)^k\\
 &\quad+X^{15/16}
 e^{c(\log X+3k\log z)^{3/4}}
 \left(\sum_{u<p\leq2u}\frac1p\right)^{2k}.
\end{align*}
To justify the cube part without a combinatorial estimate on multinomial
coefficients, take independent uniform cubic roots $\xi_p$.
Its sum is exactly the moment of $\sum\xi_p/p$.
The real and imaginary parts are centered bounded independent sums.
The elementary exponential bound for such sums gives
$\mathbb P(|\sum\xi_p/p|>v)\leq4\exp(-v^2/(4\sum p^{-2}))$.
Integrating this bound yields at most
$4\cdot4^k k!(\sum p^{-2})^k\leq(16k\sum p^{-2})^k$.
Use $\sum_{u<p\leq2u}p^{-2}\leq2/(u\log u)$ for large $u$.
The noncube part has $m\leq z^{3k}$, which proves its displayed bound.

Set $D_j=5A2^{j/3}$ and $k=\lfloor L/(1000\log D_j)\rfloor$.
Markov's inequality, with threshold $2^{-j/6}/(A\ell)$, bounds the
cube contribution to the exceptional count by
\[
 X\left(\frac{32kA^22^{j/3}\ell^2}{u\log u}\right)^k
 \leq XD_j^{-k}\leq X^{1-1/1100}
\]
for sufficiently large $X$. For the other contribution,
$\sum_{u<p\leq2u}p^{-1}\leq2\log2/\log u$ and
$\log u\geq\ell/2$. Thus its Markov factor is at most
$D_j^{2k}\leq X^{2/1000}$, while the exponential in the preceding
display is $X^{o_C(1)}$. This contribution is $O(X^{19/20})$.
Summing over $O_C(\ell)$ intervals leaves $O_C(X^{1-1/2000})$
exceptions. Outside them, the geometric sum of the thresholds is
less than $10/(A\ell)$. For sufficiently large $X$, the prime-power
error and the initial truncation error are each at most $1/(A\ell)$.
Thus, on compatible logarithm branches,
$|\log L(1,\chi)-\log L_y(\chi)|\leq12/(A\ell)$.
Exponentiation proves the lemma, with for example the explicit
relative-error constant $30$ for sufficiently large $X$.
\end{proof}

\begin{proof}[Proof of Theorem~\ref{thm:cubic-l1-tails}]
We give the remaining distribution argument to specify exactly the
precision needed from the moments. The unconditional random-product
calculation \cite[Proposition~4.5 and Proposition~6.6]{DDLL2024} gives,
for $1\ll r<y/4$,
\begin{align*}
 \log\mathbb E(e^{-\gamma}|L_y(\mathbb X)|)^{2r}
 &=2r\log\log r+\frac{2r(C_+-1)}{\log r}
   +O\left(\frac r{(\log r)^2}+\frac{r^2}{y\log r}\right),\\
 \log\mathbb E(\zeta(3)e^{-\gamma}|L_y(\mathbb X)|^{-2})^r
 &=r\log\log r+\frac{r(C_--1)}{\log r}
   +O\left(\frac r{(\log r)^2}+\frac{r^2}{y\log r}\right).
\end{align*}
For either normalized variable $W$, write $a=2,C_*=C_+$ in the first
case and $a=1,C_*=C_-$ in the second, and
$m_y(r)=\log\mathbb E W^{ar}$. The same calculation gives
\[
 \frac{m_y'(r)}a=\log\log r+\frac{C_*}{\log r}
       +O\left((\log r)^{-2}+\frac r{y\log y}\right),
 \qquad 0\leq m_y''(r)\ll\frac1{r\log r}.
\]
These derivative assertions do not require differentiating an unspecified
error term. They follow from the full-product derivative estimates in
\cite[Proposition~4.5]{DDLL2024}, then deleting primes above $y$:
their first-derivative contribution is
$O(r/(y\log y)+1/(y^2\log y))$ by the local Taylor expansion for
$p>y>4r$. An explicit bound, useful at the endpoint, is
\[
 |m_\infty'(r)-m_y'(r)|
 \leq\frac{100r}{y\log y}+\frac{100}{y^2\log y}.
\]
Indeed $U_p=\log|1-\mathbb X(p)/p|^{-2}$ satisfies
$|U_p|\leq3/p$ and $|\mathbb E U_p|\leq2/p^3$ for $p>y$.
The derivative of its tilted mean is its tilted variance, at most
$9/p^2$. Integrate this bound from zero to $r$ (or to $-r$) and sum
over $p>y$, using the effective prime number theorem. Each second
derivative is a nonnegative variance, so deletion
only decreases it. In particular, with
$t_r=\exp(m_y'(r)/a)$,
\[
 t_r=\log r+C_*+O((\log r)^{-1}+r/y).
\]

Apply Lemma~\ref{lem:cubic-real-moments} to the corresponding empirical
variable on the finite family. Its moments at $r$ and at
$r\pm c r/\sqrt{\log r}$ differ from the random moments by relative
$O_C(X^{-1/32})$. Tilt its probability measure by $W^{ar}$.
Taylor's theorem and the displayed second-derivative bound show that,
for a sufficiently large fixed $B$, the tilted probability of
\[
 |W-t_r|>B/\sqrt{\log r}
\]
is $O(\exp(-c_1r/(\log r)^2))+O_C(X^{-1/32})$.
Indeed apply Markov with increments
$\pm c_2r/\sqrt{\log r}$; the linear term cancels by the definition
of $t_r$, and choosing $B$ relative to the second-derivative constant
makes the remaining exponent negative. For large $r$ the interval
therefore has tilted probability at least $1/2$.

Here are the inequalities behind this step and the return to the
original measure. Put $M_X(r)=\mathbb E_XW^{ar}$, where
$\mathbb E_X$ denotes the uniform empirical average, and let
$\mathbb P_{X,r}$ have density $W^{ar}/M_X(r)$ with respect to it.
For $h>0$ and $u>0$,
\[
 \mathbb P_{X,r}(\log W>m_y'(r)/a+u)
 \leq \frac{M_X(r+h)}{M_X(r)}
       \exp\{-h m_y'(r)-ahu\}.
\]
The lower-tail inequality uses $r-h$ in the numerator and changes
the sign of the linear term. For $h\asymp r/\sqrt{\log r}$ and
$u\asymp B/(\log r)^{3/2}$, the logarithm of the right side is at most
\[
 O\!\left(\frac{h^2}{r\log r}\right)-ahu+O_C(X^{-1/32}),
\]
which is negative of order $r/(\log r)^2$ when $B$ is large enough.
This proves the asserted concentration, since $t_r\asymp\log r$.
If $\delta=B/\sqrt{\log r}$ and $t<t_r-\delta$, it also gives
\[
 \mathbb P_X(W>t)\geq
 \frac{M_X(r)}{2(t_r+\delta)^{ar}},
 \qquad
 \mathbb P_X(W>t)\leq\frac{M_X(r)}{t^{ar}}.
\]
For the lower bound we choose $r$ with $t_r$ just above $t+\delta$;
for the upper bound we choose $r$ with $t_r$ at $t$ to within the same
error. The estimates for $t_r$ place both choices at
$r=e^{t-C_*}(1+O(t^{-1/2}+e^t/y))$.

Substituting the formula for $m_y(r)$ in these two bounds gives,
uniformly in the required range,
\[
 \mathbb P(W>t)=
 \exp\left\{-\frac{ae^{t-C_*}}t
   \left(1+O(t^{-1/2}+e^t/y)\right)\right\}.
\]
One can obtain the value at any prescribed $t$ by taking parameters on
the two sides of $r=e^{t-C_*}$, with relative changes
$O(t^{-1/2}+r/y)$. The range $|r|\leq4r_0$ in
Lemma~\ref{lem:cubic-real-moments} provides room for these changes even
at $t=\log r_0+C_*$. More explicitly, the preceding bound with
constant $100$ and $r_0/y=e^{-37}/(A^4\log A)$ show that
$t_{2r_0}>\log r_0+C_*+0.6$ for sufficiently large $X$ uniformly in
$A$. The remaining shifts tend to zero, so they still lie below
$4r_0$. Thus no loss of $\log4$ in the endpoint is
necessary. Bounded $t$ is included by the source's unconditional
Theorem~1.3, or by increasing the absolute constants in the stated
error terms.

For the second normalized variable the parameter here is $t^2$ in the
notation of the theorem. It gives a relative error $O(t^{-1}+e^{t^2}/y)$,
which is stronger than the asserted $O(t^{-1/2}+A^{-1})$.
In both cases the extra truncation error $e^t/y$ (respectively
$e^{t^2}/y$) is $O(A^{-4}/\log A)$ at the published endpoint.

Finally Lemma~\ref{lem:cubic-short-product} changes the tail arguments
by a relative $O((A\ell)^{-1})$. Since $t$ (respectively $t^2$) is
$O_C(\ell)$, this changes the exponent by relative $O_C(A^{-1})$.
Quantitatively, the logarithm bound $12/(A\ell)$ above changes the
large-value argument by at most $30/A$ and the squared small-value
argument by at most $60/A$, for sufficiently large $X$.
The discarded proportion is $O_C(X^{-1/2000})$. The modeled tails
throughout the stated ranges are at least $X^{-1/10000}$ for large $X$:
at the endpoint their negative logarithms are at most
$(3e^{-37}/\log A+o(1))\log X$.
Hence the discarded proportion is negligible even relatively to the
tail probability. This proves both assertions.
\end{proof}

\paragraph{Scope of the transfer.}
The whole published Theorem~1.4 is recovered, including its constants
$C_\pm$ and its endpoint $-37$. The unconditional smaller-range
Theorem~1.3 is not counted as a new result. The prime-conductor extreme
values in Theorem~1.5 have a different sharp constant and are not
asserted here. The proof replaces the source's conditional auxiliary
exponents by smaller fixed savings and uses its already-unconditional
random-product calculations. In particular it assumes neither a
critical-line Lindel\"of estimate nor GRH over another number field.
% Bibliography: GSDistribution, GAFA13(2003)992--1028,
% DOI10.1007/s00039-003-0438-3; errata GAFA14(2004)245--246,
% DOI10.1007/s00039-004-0456-9.
\section{The larger quadratic \texorpdfstring{$L$}{L}-value tail range}
\label{sec:quadratic-l1-tails}

Let $\mathcal D(X)$ consist of the nontrivial fundamental discriminants
$d$ with $|d|\leq X$, of either sign, and let $\chi_d$ be the associated
primitive quadratic character. The trivial discriminant $1$, at which
the $L$-function would have a pole, is omitted throughout. Define
\[
 \Phi_X(t)=\frac{\#\{d\in\mathcal D(X):L(1,\chi_d)>e^\gamma t\}}
 {|\mathcal D(X)|},\qquad
 \Psi_X(t)=\frac{\#\{d\in\mathcal D(X):
 L(1,\chi_d)\leq\zeta(2)e^{-\gamma}/t\}}{|\mathcal D(X)|},
\]
and put
\[
 C_1=\int_0^1\frac{\tanh u}{u}\,du+
       \int_1^\infty\frac{\tanh u-1}{u}\,du.
\]

\begin{theorem}[Granville--Soundararajan, Theorem~4]
\label{thm:quadratic-l1-tails}
For sufficiently large $X$, uniformly for
\[
 e\leq A\leq\log_2 X,\qquad
 1\leq t\leq\log_2 X+\log_3 X-\log_2 A-20,
\]
both $F_X=\Phi_X$ and $F_X=\Psi_X$ satisfy
\[
 F_X(t)=\exp\left\{-\frac{e^{t-C_1}}t
     \left(1+O\left(A^{-1}+t^{-1}\right)\right)\right\}.
\]
This is the complete larger-range conclusion stated under GRH in
\cite[Theorem~4]{GSDistribution}, now without that assumption.
\end{theorem}

We include the uniform estimates and the final concentration argument,
in particular the sharper $t^{-1}$ error. The smaller unconditional
range in the source is not being counted again.

\begin{proof}
Write $L=\log X$, $\ell=\log_2 X$, $K=e^{10}$, and set
\[
 y=(KA)^4L\ell,\qquad r_0=e^{-20}L\ell/\log A.
\]
The fixed enlargement $K$ makes the Euler-product approximation
quantitatively harmless even at the lower endpoint $A=e$.

\emph{Averages of quadratic characters.}
The Dirichlet version of the logarithm and Perron argument in
Lemma~\ref{lem:cubic-family-sum} gives, for every nonprincipal character
$\xi$ of a chosen modulus $q$,
\[
 \sum_{n\leq Z}\xi(n)
 \ll Z^{15/16}\exp\{c(\log(3qZ))^{3/4}\}.
\]
Indeed the same smoothed logarithm contour at $57/64$, with cutoff
$(\log(3q(3+|v|)))^{10}$, proves
$|\log L(\sigma+iv,\xi)|\ll(\log(3q(3+|v|)))^{3/4}$ on
$\sigma\geq15/16$; the ordinary Dirichlet coefficients are even simpler
than the ideal coefficients in that lemma. A modulus, rather than
just a primitive conductor, controls the omitted Euler factors.

If $n$ is not a square, expand the squarefree condition in the usual
description of fundamental discriminants
$d=m$ with squarefree $m\equiv1\pmod4$, or $d=4m$ with squarefree
$m\equiv2,3\pmod4$, allowing both signs. Characters modulo four
detect the congruences. The resulting nonzero sums involve
nonprincipal quadratic characters of modulus at most $8n$, evaluated
on intervals of length at most $X/a^2$. They are nonprincipal because
the squarefree kernel of $n$ is not one: an odd prime in that kernel
cannot be removed by a twist modulo four; if the kernel is two, the
character modulo eight cannot be canceled by such a twist. When
$n$ is even the even-discriminant terms vanish. Summing over the
squarefree-sieve variable $a$, using $\sum a^{-15/8}<\infty$, proves
\begin{equation}
 \label{eq:quadratic-nonsquare-average}
 \sum_{d\in\mathcal D(X)}\chi_d(n)
 \ll X^{15/16}\exp\{c(\log(3nX))^{3/4}\}\quad(n\text{ nonsquare}).
\end{equation}
For square $n$, elementary squarefree counting instead gives
\begin{equation}
 \label{eq:quadratic-square-average}
 \frac1{|\mathcal D(X)|}\sum_d\chi_d(n)
 =\prod_{p\mid n}\frac p{p+1}
  +O_\epsilon(3^{\omega(n)}X^{-1/2+\epsilon}),
 \qquad |\mathcal D(X)|=\frac6{\pi^2}X+O(\sqrt X).
\end{equation}
This is the unconditional square-term formula used in
\cite[Sections~5--6]{GSDistribution}; it follows directly by M\"obius
inversion and inclusion--exclusion at the primes dividing $n$.
Only squarefree $\sqrt n$ will be needed below, so its divisor-function
error is bounded by the displayed $3^{\omega(n)}$.

\emph{Real moments of the short product.}
Let the independent variables $\mathbb Y(p)$ take values $0,1,-1$
with probabilities $1/(p+1),p/(2p+2),p/(2p+2)$, respectively.
Use $L_y(\chi)$ and $L_y(\mathbb Y)$ for the products up to $y$.
For a real $r$, put
\[
 a=(1-1/p)^{-r},\quad b=(1+1/p)^{-r},\quad c_0=(a+b)/2.
\]
The identity
\[
 (1-w/p)^{-r}=1+\frac{a-b}2w+(c_0-1)w^2
 \quad(w=0,1,-1)
\]
expands the full product into a finite sum $\sum_nc_n\chi(n)$.
Every prime exponent is at most two, hence $\log n\leq2\vartheta(y)$.
Its random expectation is precisely the sum of its square terms,
weighted by $\prod_{p\mid n}p/(p+1)$.

Set $R=|r|+1$, $\alpha_p=p/(p+1)$,
$E_p=1-\alpha_p+\alpha_pc_0$, and
$B_p=1+3(|a-b|/2+|c_0-1|)$.
As $c_0\geq1/2$ and $\alpha_p\geq2/3$, one has $B_p/E_p\leq32$.
For $p>4R$, the elementary exponential bounds give
$|a-1|\leq3R/p$, $|b-1|\leq2R/p$, and
$E_p\geq e^{-2R/p}$, so $B_p/E_p\leq e^{40R/p}$.
As in Lemma~\ref{lem:cubic-real-moments},
\[
 \log\frac{\sum_n3^{\omega(n)}|c_n|}{\mathbb E L_y(\mathbb Y)^r}
 \leq\pi(4R)\log32+40R\sum_{4R<p\leq y}\frac1p.
\]
For $R\leq\sqrt L$ this is $o(L)$. For larger $R\leq4r_0+1$,
the preceding prime-number-theorem argument bounds it by
\[
 \frac{200R}{\log(4R)}+
       40R\log\frac{\log y}{\log(4R)}
 \leq(30000e^{-20}+o(1))L<L/1000.
\]
For clarity, at the upper endpoint
$\log y-\log(4R)\leq64\log A$ and $\log(4R)\geq\ell/2$.
The two functions of $R$ increase in this interval, since
$\log y-\log(4R)>2$. Substitution yields the last displayed bound.
Equations~\eqref{eq:quadratic-nonsquare-average} and
\eqref{eq:quadratic-square-average} now prove, uniformly for
$|r|\leq4r_0$,
\begin{equation}
 \label{eq:quadratic-real-moments}
 \frac1{|\mathcal D(X)|}\sum_d L_y(\chi_d)^r
 =\mathbb E L_y(\mathbb Y)^r(1+O(X^{-1/32})).
\end{equation}
Here $y=L\ell^{O(1)}$, so the exponential in
\eqref{eq:quadratic-nonsquare-average} is $X^{o(1)}$ throughout the
finite support. Both signs of $r$ are covered by the local ratios;
no lower bound of one for the negative random moment is assumed.

\emph{Removing the long prime tail.}
The same high-moment argument as in Lemma~\ref{lem:cubic-short-product},
with independent signs in place of cubic roots and
$\widetilde A=KA$, proves
\begin{equation}
 \label{eq:quadratic-product-removal}
 |\log L(1,\chi_d)-\log L_y(\chi_d)|
 \leq\frac{12}{KA\ell}
 \quad\text{outside }O(X^{1-1/2000})\text{ discriminants}.
\end{equation}
Here are the estimates needed for that substitution. Initially truncate
uniformly at $z=L^{32}$ using the Dirichlet prime-sum estimate.
On an interval $(u,2u]$ with $u=2^jy$, expansion and
\eqref{eq:quadratic-nonsquare-average} give
\[
 \sum_d\left|\sum_{u<p\leq\min(2u,z)}\frac{\chi_d(p)}p\right|^{2k}
 \ll X\left(\frac{32k}{u\log u}\right)^k
 +X^{15/16}e^{c(\log X+2k\log z)^{3/4}}
             \left(\sum_{u<p\leq2u}\frac1p\right)^{2k}.
\]
The square terms are bounded by the moments of independent signs,
using the same exponential tail estimate. Take
$k=\lfloor L/(1000\log(5\widetilde A2^{j/3}))\rfloor$ and threshold
$2^{-j/6}/(\widetilde A\ell)$. The two exceptional counts are at most
$X^{1-1/1100}$ and $X^{19/20}$, respectively, for sufficiently large
$X$. Summing the $O(\ell)$ intervals gives the claimed exceptional set.
The thresholds sum to less than $10/(\widetilde A\ell)$; the initial
truncation and prime-power errors are each eventually at most
$1/(\widetilde A\ell)$. This proves
\eqref{eq:quadratic-product-removal} with its explicit constant.

\emph{The tail asymptotic and its $t^{-1}$ error.}
For the upper and lower tails, respectively, define random variables
\[
 W_+=e^{-\gamma}L_y(\mathbb Y),\qquad
 W_-=\zeta(2)e^{-\gamma}L_y(\mathbb Y)^{-1},
\]
and the same variables on the finite discriminant family.
The unconditional random-product calculations in
\cite[Section~3, (3.1)--(3.5), (3.10)]{GSDistribution} give for either
sign, writing $m_y(r)=\log\mathbb E W_\pm^r$,
\begin{align*}
 m_y(r)&=r\log\log r+\frac{r(C_1-1)}{\log r}
      +O\left(\frac r{(\log r)^2}+\frac{r^2}{y\log r}\right),\\
 m_y'(r)&=\log\log r+\frac{C_1}{\log r}
      +O\left((\log r)^{-2}+\frac{r+1}{y\log y}\right),
 \qquad 0\leq m_y''(r)\ll\frac1{r\log r}.
\end{align*}
The derivative statements follow from the differentiated local factors,
not by formal differentiation of the first error term. For example,
the local tilted variance is
$O(p^{-2}e^{-r/(2p)})$, since the winning sign has probability bounded
away from zero and its logarithm is separated from the other two
values by at least $1/(2p)$. Summation proves the second-derivative
bound. For the first derivative the source's prime-sum expression
$I(r;y)$ gives the stated constant $C_1$. To check explicitly the
negative normalization, let $E_p^+(r)=\mathbb E(1-\mathbb Y(p)/p)^{-r}$.
Symmetry of $\mathbb Y(p)$ gives the exact local identity
\[
 (1-p^{-2})^{-r}\mathbb E(1-\mathbb Y(p)/p)^r
 =E_p^+(r)+\frac1{p+1}\big((1-p^{-2})^{-r}-1\big).
\]
For $p\leq\sqrt r$, the added term and its logarithmic derivative
are exponentially suppressed relative to the winning sign, since
$\log(1+1/p)\geq1/(2p)$. For $p>\sqrt r$, differentiating the
relative added term bounds its contribution by
$O(p^{-3}+rp^{-4})$. Summation is $O(r^{-1/2})$, hence
$o((\log r)^{-2})$. The full normalized negative moment therefore has
the same first-derivative constant $C_1$ as the positive moment.
Deleting primes above $y$ changes that derivative by at most
$100(r+1)/(y\log y)$: use
$|\log(1-\mathbb Y(p)/p)^{-1}|\leq2/p$, its mean $O(p^{-2})$,
and tilted variance at most $4/p^2$.

Let $t_r=e^{m_y'(r)}=\log r+C_1+O((\log r)^{-1}+r/y)$.
Tilt the empirical measure by $W_\pm^r$, and apply
\eqref{eq:quadratic-real-moments} at $r$ and at
$r\pm c r/\log r$. The second-derivative bound and Markov's inequality
give, for a sufficiently large fixed $B$,
\[
 \mathbb P_r\left(|W_\pm-t_r|>\frac B{\log r}\right)
 \ll\exp\left(-\frac{c_1r}{(\log r)^3}\right)+X^{-1/32}.
\]
In fact, Taylor expansion cancels the linear term at $m_y'(r)$;
the increment is $cr/\log r$, and the deviation in $\log W_\pm$
is of order $(\log r)^{-2}$. Both the quadratic term and the
favorable linear deviation are therefore of order
$r/(\log r)^3$, with the latter larger by the choice of $B$.
More explicitly, write $M_X(s)$ for the empirical moment and put
$h=cr/\log r$. If $d>0$, the upper tilted tail is at most
\[
 \frac{M_X(r+h)}{M_X(r)}e^{-h(m_y'(r)+d)}
 \leq(1+O(X^{-1/32}))
 \exp\left(\frac{C_0h^2}{r\log r}-hd\right).
\]
The lower tilted tail uses $r-h$ and satisfies the same bound.
With $\delta=B/\log r$, both logarithmic distances from $t_r$ to
$t_r\pm\delta$ are at least $B/(3(\log r)^2)$ for large $r$.
Choosing $B>6C_0c$ makes the exponent negative as asserted.
The probability of the complementary interval is at least $1/2$.

Undoing the tilt there, and using ordinary Markov for the other bound,
uses the concrete inequalities
\[
 \mathbb P(W_\pm\geq t_r-\delta)
 \geq\frac{M_X(r)}{2(t_r+\delta)^r},\qquad
 \mathbb P(W_\pm\geq t)\leq\frac{M_X(r)}{t^r}.
\]
Inserting the moment expansion and bracketing a prescribed $t$ by the
two choices of $r$ gives
\[
 \mathbb P(W_\pm>t)=
 \exp\left\{-\frac{e^{t-C_1}}t
       \left(1+O(t^{-1}+e^t/y)\right)\right\}.
\]
The same estimate holds with $\geq$; the interval argument provides
both versions without any assumption concerning atoms.
The two bracketing parameters differ from $e^{t-C_1}$ by relative
$O(t^{-1}+e^t/y)$; all of them lie in $[1,4r_0]$ in the stated
range. In particular at the upper endpoint $e^{t-C_1}=e^{-C_1}r_0$,
and the explicit derivative truncation bound above leaves ample room.
Bounded $t$ follows from the source's unconditional smaller-range
theorem, after increasing the error constant if necessary.

Finally \eqref{eq:quadratic-product-removal} changes the argument by
at most $30/(KA)$ for sufficiently large $X$, which changes the
negative logarithm of the modeled tail by relative $O(A^{-1})$.
Also $e^t/y\ll e^{-20}/((KA)^4\log A)\ll A^{-1}$.
The modeled tails at the largest permitted $t$ have negative logarithm
at most $2e^{-20}L/\log A$ for large $X$; here the explicit enlargement
$K=e^{10}$ controls the argument shift even when $A=e$.
Thus they are at least $X^{-1/10000}$. The discarded proportion
$O(X^{-1/2000})$ is negligible relatively to these tails. Substitution
proves both conclusions, with exactly the published range and the
published error $O(A^{-1}+t^{-1})$.
\end{proof}

\paragraph{Published scope and later work.}
The 2004 errata \cite{GSDistributionErrata} correct notation and do not
alter this theorem. Darbar--Maiti's 2025 paper \cite{DarbarMaiti2025}
on large quadratic $L$-values still explicitly distinguishes the smaller unconditional
range from this larger GRH range. Their extreme-value statements do
not replace the present two tail asymptotics. No sharp prime-conductor
constant from Granville--Soundararajan's Theorem~5a is inferred here.

\section{The first Fourier coefficient of a Maass newform}
\label{sec:maass-first-coefficients}

Hoffstein--Lockhart's Theorem~0.1 \cite{HoffsteinLockhart1994}
gives the bounds below subject to a real zero-free interval for
the adjoint $L$-function. Goldfeld--Hoffstein--Lieman
\cite{GHL1994} removed that condition for non-dihedral forms,
but retained a weaker level bound for dihedral forms because
of possible quadratic Dirichlet exceptional zeros. We recover
the entire original conclusion, uniformly over both kinds of
forms and over the level and Laplace eigenvalue.

\begin{theorem}[The full Hoffstein--Lockhart bound]
\label{thm:maass-first-coefficients}
Let $f$ be a weight-zero Maass newform for $\Gamma_0(N)$ with
even Dirichlet nebentype, Laplace eigenvalue
$\lambda=1/4+t^2$, and normalization
\[
 \frac1{\operatorname{vol}(\Gamma_0(N)\backslash\mathbb H)}
 \int_{\Gamma_0(N)\backslash\mathbb H}|f(z)|^2\frac{dx\,dy}{y^2}=1.
\]
Define its Fourier coefficients by
\[
 f(z)=\sum_{n\ne0}\rho_f(n)|n|^{-1/2}W_t(nz),
 \qquad
 W_t(x+iy)=(|y|\cosh\pi t)^{1/2}
       K_{it}(2\pi|y|)e^{2\pi ix}.
\]
Let $F=\operatorname{Ad}f$ denote its adjoint lift, with the
standard $L$-function normalized to have first Dirichlet
coefficient $1$. There are absolute effectively computable
constants $c,C>0$ such that
\[
 L(1,F)\geq\frac c{\log(1+\lambda N)},
 \qquad
 |\rho_f(1)|^2\leq C\log(1+\lambda N).
\]
\end{theorem}

\begin{proof}
We first isolate the exceptional-zero classification needed here.
The proof in \cite[pp.~180--181]{GHL1994} establishes an
absolute effective $c_0>0$ such that any real zero of $L(s,F)$
in
\begin{equation}\label{eq:maass-zero-interval}
 1-\frac{c_0}{\log(1+\lambda N)}<s<1
\end{equation}
must be a zero of a nonprincipal quadratic Dirichlet
$L$-function of conductor at most $N$.
This is an unconditional structural input, not an assertion
of GRH for a higher-degree $L$-function.

Here is the distinction between its two cases. For a
non-dihedral $f$, the positive-coefficient product
$\zeta(s)L(s,F)^2L(s,F\times F)$ has a pole of order two
at $1$, while a zero of $L(s,F)$ would have multiplicity
at least three in it. The positive-coefficient zero-count
lemma in \cite[p.~178]{GHL1994} rules this out in
\eqref{eq:maass-zero-interval}. For a dihedral form
$\pi=\operatorname{AI}_{K/\mathbb Q}\theta$, with $K$
quadratic and nontrivial automorphism $\sigma$, the factorization is
\[
 L(s,F)=L(s,\chi_K)L_K(s,\theta/\theta^\sigma).
\]
The second character is inverted by $\sigma$.
If its square is nontrivial, the usual complex-character
zero-free argument rules out a real exceptional zero, with
the uniform constants in the cited proof.
If its square is trivial, its automorphic induction splits
into quadratic Dirichlet characters. The quotient structure
is essential here: writing $\psi=\theta/\theta^\sigma$,
and taking a lift $\tau$ of $\sigma$ in the global Weil group,
one has $\psi(\tau^2)=1$, since $\tau$ commutes with
$\tau^2$. Thus the two extensions of $\psi$ may take
$\tau$ to $+1$ and $-1$, and both have order at most two.
These characters have conductor
at most $N$. This is precisely the remaining alternative
described on p.~181 of that appendix.
The Dirichlet QRH input excludes zeros of all these factors
for $s>7/8$. Since $\lambda\geq3/16$, decreasing $c_0$
if necessary puts the interval \eqref{eq:maass-zero-interval}
inside $(7/8,1)$. Consequently this interval is zero-free
for every $f$.

For completeness we give the positive-coefficient residue
argument that converts this zero-free interval into both
bounds, including the bad local factors. Put
$Q=1+\lambda N$, let $a_f(n)=\rho_f(n)/\rho_f(1)$ for $n>0$,
and consider
\[
 H_1(s)=\zeta(s)L(s,F),\qquad
 H_2(s)=\zeta(2s)\sum_{n\geq1}\frac{|a_f(n)|^2}{n^s}.
\]
The unconditional local and Rankin--Selberg facts recorded
in \cite[\S1, especially Lemma~1.2]{HoffsteinLockhart1994}
are as follows. Each $H_j$ is a Dirichlet series
$\sum b_j(n)n^{-s}$ with $b_j(n)\geq0$ and $b_j(1)=1$,
absolutely convergent for $\operatorname{Re}s>1$.
Each has a meromorphic continuation to
$\operatorname{Re}s>0$ with only a simple pole at $1$.
For absolute effective $A,B,C_0$,
\[
 |H_j(1/2+iv)|\leq C_0 Q^A(1+|v|)^B.
\]
Moreover $H_2(s)=L_N(s)H_1(s)$, where the finite local
factor $L_N$ has neither zeros nor poles in the real
interval under consideration. Their residues are exactly
\begin{equation}\label{eq:maass-residues}
 R_1=L(1,F),\qquad
 R_2=\frac{2\pi}{3}|\rho_f(1)|^{-2}.
\end{equation}
These are the source normalization and its equation~(0.5).
Both residues are positive, since a Dirichlet series with
nonnegative coefficients is positive to the right of its
simple real pole.

Choose an absolute $A_1$ sufficiently large and put
$M=Q^{A_1}$, $\delta=1/\log M$, and $\beta=1-\delta$.
We may ensure $\beta>3/4$, $C_0Q^A\leq M$, and that
$[\beta,1)$ lies in the zero-free interval already obtained.
Both $H_j$ are negative on $[\beta,1)$: this is true just
to the left of their pole, and the sign cannot change
without a real zero.

Fix an integer $r>B+2$ and $Y\geq2$. Mellin inversion gives
\[
 \frac1{2\pi i}\int_{(2)}
   \frac{H_j(s+\beta)Y^s}{s(s+1)\cdots(s+r)}\,ds
 =\frac1{r!}\sum_{n\leq Y}b_j(n)n^{-\beta}(1-n/Y)^r
 \geq\frac{2^{-r}}{r!}.
\]
Shift to $\operatorname{Re}s=1/2-\beta$.
The crossed poles are $s=\delta$ and $s=0$.
The growth bound and $r>B+2$ give
\[
 \frac{2^{-r}}{r!}
 \leq\frac{R_jY^\delta}
             {\delta(1+\delta)\cdots(r+\delta)}
        +\frac{H_j(\beta)}{r!}
        +O(MY^{1/2-\beta}).
\]
The middle term is negative. Taking $Y=M^{C_1}$ with
an absolute sufficiently large $C_1$ makes the final
error less than half the left side, since
$1/2-\beta<-1/4$. Also $Y^\delta=e^{C_1}$.
It follows that $R_j\gg\delta\asymp1/\log Q$, with
absolute effective constants. Substituting
\eqref{eq:maass-residues} gives both assertions.
\end{proof}

\paragraph{Scope.}
The non-dihedral conclusion was already unconditional in 1994
and is included here solely because the published original
theorem quantified over all Maass newforms. The removed
obstruction is the uniform level dependence for dihedral
forms. No zero-free fixed strip for a general adjoint or
Rankin--Selberg $L$-function is claimed.

% Bibliography:
% \bibitem{HoffsteinLockhart1994} J. Hoffstein and P. Lockhart,
% Coefficients of Maass forms and the Siegel zero,
% Ann. of Math. (2) 140 (1994), 161--176.
% \href{https://doi.org/10.2307/2118543}{doi:10.2307/2118543}.
% \bibitem{GHL1994} D. Goldfeld, J. Hoffstein, and D. Lieman,
% Appendix: An effective zero-free region,
% Ann. of Math. (2) 140 (1994), 177--181.
% \href{https://doi.org/10.2307/2118544}{doi:10.2307/2118544}.

\section{The exponent of imaginary quadratic class groups}\label{sec:exponent}

For a negative fundamental discriminant $D$, let $E(D)$ be the exponent
of the ideal class group of $K=\mathbb Q(\sqrt D)$: the least positive
integer annihilating every ideal class. Boyd and Kisilevsky
\cite{BK} proved under ERH that $E(D)\to\infty$. The following recovers
that exact qualitative conclusion, and the published order of magnitude
recorded in \cite[Introduction]{EKN}. The sharper asymptotic coefficient
$1/2$ obtained under ERH is not asserted.

\begin{lemma}[A small split prime]\label{lem:split-prime}
There is an effective absolute constant $C_1$ such that for every negative
fundamental discriminant $D$, some rational prime $p$ satisfies
\[
 p\nmid D,\qquad \left(\frac Dp\right)=1,
 \qquad p\leq C_1(\log(3|D|))^8.
\]
Here the symbol is the Kronecker symbol, including at $p=2$.
\end{lemma}
\begin{proof}
Put $Q=|D|$ and $\chi=\chi_D$. This is a real primitive nonprincipal
Dirichlet character modulo $Q$. Add the principal smoothed sum to
\eqref{eq:smoothed}. The estimates proved there give
\[
 \sum_{n\leq x}\Lambda(n)(1+\chi(n))(1-n/x)
 =\frac x2+O\bigl(x^{7/8}\log(3Q)
       +x^{7/8}\log^2(2x)+\log(Qx)\bigr).
\]
If there were no split prime at most $x$, all contributions with $n=p$
and $p\nmid D$ would vanish. The terms supported on prime powers with
$p\mid D$ are $O(\log(3Q)\log x)$: each such prime contributes at most
$2\log x$, and there are at most $\log Q/\log2$ such primes.
The remaining prime-power terms with exponent at least two have total
absolute value $O(\sqrt x\log^2(2x))$. Indeed, there are at most
$\sqrt x$ possible underlying primes, at most $\log x/\log2$
exponents per prime, and each von Mangoldt weight is at most $\log x$;
the slightly sharper stated bound also follows by summing
$\sum_{a\geq2}\psi(x^{1/a})$ and the elementary bound $\psi(t)\ll t$.
Consequently the entire left side would be bounded by these two errors.

Take $x=C_1(\log(3Q))^8$. The ratio of the character-zero error to $x$
is $O(C_1^{-1/8})$, while each other displayed error is $o(x)$ as
$Q\to\infty$. Choosing $C_1$ large gives a contradiction for all
sufficiently large $Q$. The effective estimates determine the threshold;
increase $C_1$ effectively over the finite remaining set. A split prime
for each such field can be found by exhaustive search, whose termination
follows from the ordinary prime number theorem for arithmetic
progressions. This proves the lemma.
\end{proof}

\begin{theorem}[Boyd--Kisilevsky qualitative conclusion]\label{thm:class-exponent}
As $D$ runs through negative fundamental discriminants,
\[
 E(D)\gg\frac{\log |D|}{\log\log |D|}
 \qquad (|D|\geq16),
\]
with an effective absolute implied constant. In particular $E(D)\to\infty$,
and for every fixed positive integer $M$ there are only finitely many
imaginary quadratic fields with $E(D)\leq M$. They lie in an effectively
computable finite interval of discriminants.
\end{theorem}
\begin{proof}
Choose the split prime $p$ from Lemma~\ref{lem:split-prime}, and write
$(p)=\mathfrak p\overline{\mathfrak p}$ with distinct prime ideals.
If $e$ is the order of $[\mathfrak p]$ in the class group, then
$\mathfrak p^e=(\alpha)$ for an algebraic integer $\alpha$.
We have $e\mid E(D)$ and
\[
 p^e=|N_{K/\mathbb Q}(\alpha)|.
\]
The element $\alpha$ is not rational. If it were rational, it would be
an integer and its valuations at $\mathfrak p$ and
$\overline{\mathfrak p}$ would be equal, whereas those of
$\mathfrak p^e$ are $e$ and $0$.
Every algebraic integer of this quadratic field can be written
$\alpha=(a+b\sqrt D)/2$ with $a,b\in\mathbb Z$, and $b\ne0$ here.
Therefore
\[
 p^e=\frac{a^2+|D|b^2}{4}\geq\frac{|D|}{4},
 \qquad
 E(D)\geq e\geq
 \frac{\log(|D|/4)}{\log C_1+8\log\log(3|D|)}.
\]
This proves the stated order and its effectivity after adjusting the
absolute constant over a finite initial interval. The displayed explicit
function tends to infinity, so solving its inequality with right side
$M$ gives an effective upper bound for all discriminants with
$E(D)\leq M$.
\end{proof}

This argument applies to every fixed exponent, including exponent $7$.
It does not identify the complete numerical lists for exponents $3,5,6$
or $7$: a new effective discriminant cutoff need not be below the range
of an existing computation.

% Bibliographic key BK:
% D. W. Boyd and H. Kisilevsky, On the exponent of the ideal class groups
% of complex quadratic fields, Proc. Amer. Math. Soc. 31 (1972), 433--436.
% DOI 10.1090/S0002-9939-1972-0289454-4.
\section{Pointwise torsion bounds for every quadratic and cubic class group}
\label{sec:pointwise-class-torsion}

Ellenberg--Venkatesh \cite[Proposition~3.1]{EllenbergVenkatesh2007}
prove under GRH that, for a degree-$n$ number field $K$ and fixed
positive integer $m$,
\[
 |\operatorname{Cl}_K[m]|
 \ll_{n,m,\varepsilon}D_K^{1/2-1/(2m(n-1))+\varepsilon},
 \qquad D_K=|\operatorname{disc}(K)|.
\]
Here $\operatorname{Cl}_K[m]$ is the subgroup of the ordinary ideal
class group annihilated by $m$. We recover this exact published
conclusion for every quadratic and every cubic field. The cases of
prime torsion $m\geq5$ are the principal new cases: the corresponding
claims for $m=2,3$ were already unconditional, with stronger bounds
available in several cases. This is a pointwise assertion about every
field, without an exceptional family.

\begin{theorem}[The quadratic and cubic cases of Ellenberg--Venkatesh]
\label{thm:quadratic-cubic-torsion}
For each integer $m\geq2$ and each $\varepsilon>0$,
\[
 |\operatorname{Cl}_K[m]|
 \ll_{m,\varepsilon}
 \begin{cases}
 D_K^{1/2-1/(2m)+\varepsilon},&[K:\mathbb Q]=2,\\
 D_K^{1/2-1/(4m)+\varepsilon},&[K:\mathbb Q]=3.
 \end{cases}
\]
The constants are effective and uniform over the indicated fields.
In the quadratic case the proof gives the more precise bound
\begin{equation}\label{eq:quadratic-torsion-logarithms}
 |\operatorname{Cl}_K[m]|
 \ll_m D_K^{1/2-1/(2m)}\log(3D_K)\ell(D_K),
 \qquad \ell(x)=\log\log(e^e x).
\end{equation}
\end{theorem}

\paragraph{Uniform supplies of degree-one primes.}
For a quadratic field of signed fundamental discriminant $\Delta$,
put $D=|\Delta|$ and let $\chi_\Delta$ be its primitive quadratic
Dirichlet character. Lemma~\ref{lem:psi}, its principal-character
version, and removal of prime powers give
\begin{equation}\label{eq:torsion-quadratic-primes}
 \sum_{\substack{p\leq x\\\chi_\Delta(p)=1}}\log p
 =\frac{x}{2}
 +O\bigl(x^{7/8}\log^2(Dx)+\sqrt{x}\log^2(2x)
                  +\log(3D)\log(2x)\bigr).
\end{equation}
Indeed the indicator is $(1+\chi_\Delta(p))/2$ away from primes
dividing $D$. The higher prime powers contribute
$O(\sqrt{x}\log^2(2x))$, and the omitted ramified prime powers
contribute $O(\log(3D)\log(2x))$. The same argument with a minus
sign counts the primes with $\chi_\Delta(p)=-1$.
Thus for every fixed $a,c>0$, at
$x=cD^a$ there are $\gg_{a,c}D^a/\log(3D)$ primes of either sign,
once $D$ exceeds an effective threshold. Each prime of sign $+1$
supplies a degree-one unramified prime ideal of the quadratic field.

If $K$ is cyclic cubic, its two nontrivial Artin characters are
primitive Dirichlet characters $\chi,\overline\chi$ of order three.
Their conductor $f$ satisfies $D_K=f^2$. Character orthogonality gives
\[
 1_{\{\chi(p)=1\}}=\frac{1+\chi(p)+\overline\chi(p)}3
 \qquad(p\nmid f).
\]
The same explicit-formula argument consequently counts
$\gg_aD_K^a/\log(3D_K)$ completely split primes below $D_K^a$.

If $K$ is non-Galois cubic, the Galois group of its normal closure is
$S_3$. Its quadratic resolvent is $\mathbb Q(\sqrt{\Delta_K})$,
where $\Delta_K$ is the signed field discriminant. The primitive
character $\chi_d$ of this resolvent has fundamental discriminant
$d$ with $|d|\leq D_K$, since $\Delta_K/d$ is an integer square.
For $p\nmid D_K$, the condition $\chi_d(p)=-1$ says that Frobenius
is an odd permutation. In $S_3$ this is necessarily a transposition,
so $p$ has splitting type $(1,2)$ in $K$ and supplies one degree-one
unramified prime ideal. Formula~\eqref{eq:torsion-quadratic-primes}
with the minus sign, conductor $|d|\leq D_K$, and removal of the
primes dividing $D_K$, again supplies
\begin{equation}\label{eq:torsion-cubic-primes}
 M\gg_a D_K^a/\log(3D_K)
\end{equation}
such ideals of norm at most $D_K^a$. Its error is uniform even when
the resolvent discriminant stays small. No prime theorem for the
nonabelian normal closure has been assumed.

\paragraph{A complete quadratic argument, including the regulator.}
We give a direct version of the mechanism behind
\cite[Lemma~2.3 and Remark~2.4]{EllenbergVenkatesh2007}, so that the
infinite unit group in a real quadratic field causes no hidden gap.
Set $D=D_K$, $h=|\operatorname{Cl}_K|$, $h_m=|\operatorname{Cl}_K[m]|$,
and
\[
 Y=4^{-1/m}D^{1/(2m)}.
\]
Select all rational split primes $p\leq Y$ and one prime ideal
$\mathfrak p$ over each. Their number $M$ satisfies
\begin{equation}\label{eq:torsion-prime-number}
 M\gg_m D^{1/(2m)}/\log(3D)
\end{equation}
for effectively large $D$, by
\eqref{eq:torsion-quadratic-primes}. These are distinct rational
primes, and every one is unramified.

Partition these ideals according to their classes in
$\operatorname{Cl}_K/\operatorname{Cl}_K[m]$, a group of size $h/h_m$.
If $\mathfrak p,\mathfrak q$ lie in the same part, then
\[
 (\mathfrak p\mathfrak q^{-1})^m=(\alpha)
\]
for some $\alpha\in K^\times$. Multiplying by the rational integer
$q^m$ gives an algebraic integer $\gamma=q^m\alpha$ with
\begin{equation}\label{eq:torsion-small-generator}
 (\gamma)=\mathfrak p^m\overline{\mathfrak q}^{\,m},
 \qquad |N_{K/\mathbb Q}\gamma|=(pq)^m.
\end{equation}
For $p\ne q$, this ideal is not fixed by the nontrivial automorphism
of $K$, so $\gamma\notin\mathbb Q$. Every nonrational algebraic
integer of a quadratic field satisfies
\begin{equation}\label{eq:torsion-conjugate-gap}
 |\sigma_1\gamma-\sigma_2\gamma|\geq\sqrt D.
\end{equation}
To verify this directly, write
$\mathcal O_K=\mathbb Z+\mathbb Z\omega$ with
$\omega-\overline\omega=\sqrt{\Delta_K}$. The difference of the
two conjugates of $a+b\omega$, for $b\ne0$, has absolute value
$|b|\sqrt D$.

For imaginary quadratic $K$, the two conjugates of $\gamma$ have
equal absolute value. Equations~\eqref{eq:torsion-small-generator}
and \eqref{eq:torsion-conjugate-gap} would imply
\[
 \sqrt D\leq 2(pq)^{m/2}\leq2Y^m=\frac{\sqrt D}{2},
\]
which is impossible. Every part therefore has at most one member,
and $h_m\leq h/M$.

For real quadratic $K$, fix the first embedding $\sigma_1$ and
choose a fundamental unit $\epsilon_K$ with
$|\sigma_1\epsilon_K|>1$. Put
$R=\log|\sigma_1\epsilon_K|$; units of norm $-1$ are included.
For each nonempty part choose a reference prime $p_0$. For every
prime $p$ in that part choose $\alpha_p$ with
$(\alpha_p)=(\mathfrak p\mathfrak p_0^{-1})^m$, and define the point
\[
 u_p=\log|\sigma_1\alpha_p|-\frac m2\log(p/p_0)
          \pmod{R\mathbb Z}
\]
on the circle of length $R$. Changing the generator multiplies it
by a unit, and hence does not change this point.

For two distinct primes $p,q$ in the part, multiply
$\alpha_p/\alpha_q$ by a unit so that the balanced first logarithm
is the shortest signed difference $t$ between $u_p$ and $u_q$.
The resulting $\gamma=q^m(\alpha_p/\alpha_q)\epsilon_K^j$ is still
an algebraic integer with the ideal and norm in
\eqref{eq:torsion-small-generator}. Its two real absolute values are
\[
 |\sigma_1\gamma|=(pq)^{m/2}e^t,
 \qquad |\sigma_2\gamma|=(pq)^{m/2}e^{-t}.
\]
This remains true when their signs differ. Therefore
\[
 \sqrt D\leq|\sigma_1\gamma-\sigma_2\gamma|
 \leq2Y^m e^{|t|}=\frac{\sqrt D}{2}e^{|t|},
 \qquad |t|\geq\log2.
\]
The points in each part are thus pairwise separated by at least
$\log2$ in circular distance. There are at most $1+R/\log2$ of
them: if there are at least two, add the successive gaps around
the circle. Also $R\geq\log((1+\sqrt5)/2)$, as follows at once
from the integer trace and norm $\pm1$ of a fundamental unit.
Consequently
\[
 M\leq\frac h{h_m}\left(1+\frac R{\log2}\right)
 \ll\frac{hR}{h_m},\qquad h_m\ll\frac{hR}{M}.
\]
This is the required regulator factor; replacing $hR$ by $h$ in
this argument would be unjustified.

The quadratic class number formulas and Theorem~\ref{thm:L1} give,
effectively,
\[
 h\ll\sqrt D\ell(D)\quad(K\text{ imaginary quadratic}),
 \qquad hR\ll\sqrt D\ell(D)\quad(K\text{ real quadratic}).
\]
For example the exact real formula is
$2hR=\sqrt D L(1,\chi_D)$. Combining these estimates with
\eqref{eq:torsion-prime-number} proves
\eqref{eq:quadratic-torsion-logarithms} for effectively large $D$.
For bounded $D$ the effective elementary upper bound
$h\ll\sqrt D\log(3D)$ absorbs the remaining cases. The stated
quadratic exponent follows by absorbing the logarithmic factors
in $D^\varepsilon$.

\paragraph{The published small-prime lemma and the cubic deduction.}
We use the following unconditional result with its full hypotheses.
Ellenberg--Venkatesh \cite[Lemma~2.3]{EllenbergVenkatesh2007} state:
if $K/K_0$ has degree $d>1$, $m$ is a positive integer,
$0<a<1/(2m(d-1))$, and there are $M$ unramified prime ideals of $K$
of norm at most $N_{K_0/\mathbb Q}(\mathfrak D_{K/K_0})^a$ which
are not extensions of prime ideals of any proper intermediate field,
then, for every $v>0$,
\begin{equation}\label{eq:EV-small-prime-import}
 |\operatorname{Cl}_K[m]|
 \ll_{[K:\mathbb Q],m,a,v}D_K^{1/2+v}/M.
\end{equation}
Here $\mathfrak D_{K/K_0}$ denotes the relative discriminant ideal.
Dependence on the strict margin in $a$ is included explicitly.
This is an imported unconditional lemma, not a consequence of GRH.
Its proof uses small neighborhoods in the Arakelov class group.
Writing $\mathcal D=N_{K_0/\mathbb Q}(\mathfrak D_{K/K_0})$,
collisions between their $m$th powers give a generator of height
$O(\mathcal D^{ma})$, while their Lemma~2.2 bounds the height of a
primitive generator below by a constant times
$\mathcal D^{1/(2(d-1))}$. The nonextension hypothesis rules out the
remaining collisions from proper subfields, except for a bounded
unit multiplicity. The volume upper bound needed is only
$h_KR_K\ll_n\sqrt{D_K}(\log(3D_K))^{n-1}$, which follows
effectively from the residue upper bound and the class number
formula. No ineffective lower half of Brauer--Siegel is needed.
The bounded-degree height and unit estimates are effective, so
\eqref{eq:EV-small-prime-import} has an effective implied constant.

Apply this lemma with $K_0=\mathbb Q$, $d=3$, and the ideals in
\eqref{eq:torsion-cubic-primes}. A cubic field has no proper
intermediate field besides $\mathbb Q$, and a degree-one prime
ideal cannot be $p\mathcal O_K$, whose norm is $p^3$. Thus all
hypotheses are satisfied. It is enough to treat
$0<\varepsilon<1/(4m)$; larger $\varepsilon$ follows from such a
smaller choice. Put
\[
 a=\frac1{4m}-\frac\varepsilon3,
 \qquad v=\frac\varepsilon3.
\]
Then \eqref{eq:EV-small-prime-import} and
\eqref{eq:torsion-cubic-primes} give
\[
 |\operatorname{Cl}_K[m]|
 \ll_{m,\varepsilon}
 D_K^{1/2-1/(4m)+2\varepsilon/3}\log(3D_K)
 \ll_{m,\varepsilon}D_K^{1/2-1/(4m)+\varepsilon}.
\]
All thresholds and constants are effective. This completes the
proof of Theorem~\ref{thm:quadratic-cubic-torsion}.

\paragraph{Published scope and later results.}
The exponents asserted in the theorem are exactly the degree-two
and degree-three specializations of the published GRH proposition.
The more precise quadratic logarithmic estimate is a consequence
of the proof, not a separate published theorem being counted.
Heath-Brown's later work \cite[Theorems~1, 5, and 10]{HeathBrownTorsion2026}
already gives the cubic exponent for pure cubic fields, gives a
conditional version for arbitrary cubics using only a weak
zero-free disk for the same quadratic or cubic Dirichlet character,
and gives the quadratic exponent when all prime divisors of the
discriminant are sufficiently small. Those existing special cases
are not new admissions. Neither those results nor averaged
torsion estimates supply the unrestricted pointwise assertions here.
We use the exponent $1/(4m)$ in the cubic saving, as in
Ellenberg--Venkatesh and Heath-Brown's Theorem~5; no stronger
exponent inferred from the later paper's printed Corollary~7 or
Theorem~11 is claimed.

For prime $m=2$, genus theory settles the quadratic case and the
known cubic bounds are stronger. For prime $m=3$, the quadratic
bound was already unconditional in Ellenberg--Venkatesh and is
improved by Chan--Koymans \cite{ChanKoymansTorsion}; the cubic bound $D_K^{1/3+\varepsilon}$
was already unconditional as well. Lemke Oliver--Zaman's general
unconditional improvement \cite{LemkeOliverZamanTorsion}
over the trivial estimate gives a
logarithmic saving, rather than the power savings asserted here.
The current-literature check records these overlaps explicitly;
it does not assert a global priority determination.

% Bibliography:
% EllenbergVenkatesh2007: J. S. Ellenberg and A. Venkatesh,
% Reflection principles and bounds for class group torsion,
% Int. Math. Res. Not. 2007, article rnm002, 18 pp.
% DOI 10.1093/imrn/rnm002. Final PDF, exact numbering:
% https://citeseerx.ist.psu.edu/document?doi=0726565361147d67a9040ab27e3c2ac466803f10&repid=rep1&type=pdf
% Local work/source/ellenberg-venkatesh2007-final.pdf/.txt.
% HeathBrownTorsion2026: D. R. Heath-Brown,
% ell-Torsion in Class Groups via Dirichlet L-functions,
% Int. J. Number Theory (2026), DOI10.1142/S1793042126500168.
% Author version https://arxiv.org/abs/2412.07701v2.
% ChanKoymansTorsion: S. Chan and P. Koymans,
% A new pointwise bound for 3-torsion of class groups,
% arXiv:2505.00611 (2025). Prior-art comparison only.
% LemkeOliverZamanTorsion: R. J. Lemke Oliver and A. Zaman,
% Improving the trivial bound for ell-torsion in class groups,
% arXiv:2502.03464 (2025). Prior-art comparison only.
\subsection{Further field families with the same published torsion exponent}
\label{sec:torsion-covered-fields}

The same published proposition has additional full-family specializations
within the precise scope of the available zero-free theorems. The
following criterion records the group-theoretic reason; it is used to
identify those specializations, not to assert the proposition for
arbitrary number fields.

\begin{lemma}[An abelian quotient detecting degree-one primes]
\label{lem:torsion-abelian-quotient}
Fix $n\geq2$. Let $K/\mathbb Q$ have degree $n$, normal closure $N$,
and transitive Galois group $G\leq S_n$. Suppose that there is a
nonempty subset $C$ of the abelianization $A=G/[G,G]$ such that every
element of $G$ mapping to $C$ fixes at least one of the $n$ embeddings
of $K$. Then, for each fixed $a>0$, the number of degree-one
unramified prime ideals of $K$ of norm at most $D_K^a$ is
\[
 \gg_{n,a}D_K^a/\log(3D_K)
\]
for effectively large $D_K$. All constants are uniform in $K$ and
the indicated Galois group.
\end{lemma}

\begin{proof}
Let $F=N^{[G,G]}$. It is abelian over $\mathbb Q$, with group $A$.
Its characters are primitive Dirichlet characters after passage to
their individual conductors. By the conductor--discriminant formula,
each such conductor divides $D_F$, and their least common multiple
is at most $D_F$. Also
\[
 D_F\leq D_N\leq D_K^{n!}.
\]
For the second inequality, write $N$ as a compositum of at most $n$
conjugates of $K$ and use the standard discriminant inequality
$D_N\leq\prod_iD_{K_i}^{[N:K_i]}$. The exponent of $D_K$ is at most
$[N:\mathbb Q]\leq n!$. A weaker fixed-degree power would suffice.

For an unramified rational prime $p$, character orthogonality in $A$
expresses $1_C(\operatorname{Frob}_p|_F)$ as a linear combination
of at most $|A|\leq n!$ Dirichlet characters. Its trivial-character
coefficient is $|C|/|A|\geq1/n!$, and every coefficient has absolute
value at most one. Lemma~\ref{lem:psi} and removal of prime powers
therefore give, uniformly for $x\geq2$,
\[
 \sum_{\substack{p\leq x,\ p\nmid D_N\\
                 \operatorname{Frob}_p|_F\in C}}\log p
 =\frac{|C|}{|A|}x
 +O_n\bigl(x^{7/8}\log^2(D_Kx)
          +\sqrt{x}\log^2(2x)+\log(3D_K)\log(2x)\bigr).
\]
At $x=D_K^a$ the error is smaller than half the main term beyond
an effective threshold. Each prime counted has a Frobenius fixed
point in the action on the embeddings of $K$, and hence has a
degree-one unramified prime ideal in $K$. Dividing the weighted
count by $\log x$ proves the assertion.
\end{proof}

\begin{corollary}[Further specializations of Ellenberg--Venkatesh]
\label{cor:torsion-covered-fields}
Fix $n\geq2$, an integer $m\geq2$, and $\varepsilon>0$. Then
\begin{equation}\label{eq:torsion-covered-exponent}
 |\operatorname{Cl}_K[m]|
 \ll_{n,m,\varepsilon}
 D_K^{1/2-1/(2m(n-1))+\varepsilon}
\end{equation}
holds effectively and uniformly for degree-$n$ fields in any of
the following classes:
\begin{enumerate}
 \item abelian extensions of $\mathbb Q$;
 \item fields of prime degree whose normal closure has solvable
       Galois group;
 \item quartic fields whose normal-closure Galois group is not $S_4$;
 \item fields containing $E=\mathbb Q(\sqrt{-3})$ which are abelian
       over $E$.
\end{enumerate}
The fourth assertion uses the imported finite-order Hecke zero-free
theorem over $E$; the first three use only the Dirichlet theorem.
These are stated restrictions of the published GRH proposition,
with the same exponent, rather than a claim covering all degree-$n$
fields. Existing unconditional subcases are not counted again.
\end{corollary}

\begin{proof}
First apply Lemma~\ref{lem:torsion-abelian-quotient} to the first
three classes. For an abelian transitive faithful action the action
is regular, so $C=\{1\}$ works.

For a solvable transitive group $G$ of prime degree $p$, the action
is primitive. A minimal nontrivial normal subgroup is elementary
abelian; its orbits form a block system, so it is transitive.
An abelian transitive subgroup in a faithful primitive permutation
action is regular: a point stabilizer fixes every point. Hence
this normal subgroup has order $p$. Identifying it with the
translations of $\mathbb F_p$, its normalizer is the affine group,
and
\[
 G=C_p\rtimes C_s\leq\operatorname{AGL}_1(\mathbb F_p),
 \qquad s\mid p-1.
\]
If $s=1$, use the abelian case. If $s>1$, the commutator subgroup
is $C_p$ and the abelianization is $C_s$. Every affine map
$x\mapsto ax+b$ with $a\ne1$ has the unique fixed point
$b/(1-a)$. Thus $C=C_s\setminus\{1\}$ satisfies the criterion.

The transitive subgroups of $S_4$ other than $S_4$ are
$C_4,V_4,D_4,A_4$, where $D_4$ has order eight. The first two are
abelian. For $A_4$ the commutator subgroup is $V_4$, and both
nontrivial cosets in $A_4/V_4$ consist of three-cycles, each fixing
one point. For $D_4$, use
\[
 r=(1234),\qquad s=(24),\qquad [D_4,D_4]=\{1,r^2\}.
\]
The coset $s[D_4,D_4]=\{(24),(13)\}$ consists of permutations
with two fixed points. This supplies the required $C$.
For comparison, neither coset of $[S_4,S_4]=A_4$ has this property:
one contains double transpositions and the other contains
four-cycles. No conclusion for general $S_4$-quartics is drawn.

In all these cases select one of the degree-one prime ideals above
each counted rational prime. Such an ideal is never the extension
of a prime ideal from a proper intermediate field $K_0$:
an extended ideal has norm $N_{K_0/\mathbb Q}(\mathfrak p)^{[K:K_0]}$,
which cannot be the rational prime $p$ when $[K:K_0]>1$.
The unconditional lemma \eqref{eq:EV-small-prime-import}, with base
$\mathbb Q$ and any $a<1/(2m(n-1))$, therefore applies. Choose
$a=1/(2m(n-1))-\varepsilon/3$ and $v=\varepsilon/3$ when
$\varepsilon$ is small, and absorb $\log(3D_K)$ into the remaining
$D_K^{\varepsilon/3}$. Larger $\varepsilon$ follows by weakening
a smaller positive value. This proves
\eqref{eq:torsion-covered-exponent} in the first three classes.

For the fourth class, write $[K:E]=r$, so $n=2r$, and let
$N=K\overline K$. Because $K/E$ and $\overline K/E$ are abelian,
$N/E$ is abelian of degree $g\leq r^2$. The field $N$ is stable
under complex conjugation and normal over $E$, hence is normal
over $\mathbb Q$. It contains the normal closure of $K$ and indeed
is that closure. The discriminant bound for a compositum gives
\[
 D_N\leq D_K^{[N:K]}D_{\overline K}^{[N:\overline K]}
 \leq D_K^{2r}.
\]
By the conductor--discriminant formula over $E$, every finite-order
Hecke character $\psi$ associated with $N/E$ has conductor
$\mathfrak f_\psi$ satisfying
\[
 N_{E/\mathbb Q}\mathfrak f_\psi
 \leq N_{E/\mathbb Q}\mathfrak D_{N/E}\leq D_N.
\]
The character of conductor one is interpreted through $\zeta_E$.
The imported fixed-field theorem and the explicit formula proved
in \eqref{eq:eisenstein-psi} apply to every other character, with
degree two and uniform conductor dependence. Orthogonality in
$\operatorname{Gal}(N/E)$ therefore gives
\[
 \sum_{\substack{\mathfrak p\text{ prime of }E, N\mathfrak p\leq x\\
              \mathfrak p\text{ splits completely in }N/E}}
       \log N\mathfrak p
 =\frac{x}{g}
  +O_n\bigl(x^{7/8}\log^2(D_Kx)
       +\sqrt{x}\log^2(2x)+\log(3D_K)\log(2x)\bigr),
\]
where primes ramified in $N/E$ are omitted. The principal term uses
$\zeta_E(s)=\zeta(s)L(s,\chi_{-3})$; both factors are within the
Dirichlet input. Higher powers and the omitted conductor primes
have been bounded exactly as in the rational explicit formula.

Prime ideals of $E$ of residue degree two have norm $p^2$ and
contribute $O(\sqrt{x}\log(2x))$. After deleting them and the prime
above three, every remaining prime ideal lies above a rational
prime split in $E$. If one such prime splits completely in $N/E$,
so does its conjugate, since $N/\mathbb Q$ is Galois. The rational
prime consequently splits completely in $N$ and in $K$.
Each rational prime is counted at most twice. At $x=D_K^a$ this
again supplies $\gg_{n,a}D_K^a/\log(3D_K)$ rational primes and
degree-one ideals of $K$. The preceding application of
\eqref{eq:EV-small-prime-import} finishes the proof.
\end{proof}

The inclusion of fixed-degree abelian extensions does not label every
subcase as previously open. Genus theory, the known $2$- and
$3$-torsion results, and stronger bounds for some elementary abelian
extensions overlap this corollary. Its purpose is to give the exact
uniform domain on which the published GRH exponent follows from
the stated analytic input, while retaining the unrestricted
quadratic and cubic prime-$m\geq5$ cases as the main applications.

\section{The sharper average for odd imaginary-quadratic class numbers}
\label{sec:odd-class-average}

For a positive integer $h$, let $\mathcal F(h)$ be the number of
imaginary quadratic fields with ideal class number $h$. Lamzouri's
published GRH theorem \cite[Theorem~1.2]{LamzouriAverage2017} is the
following estimate, including its error term. The leading asymptotic
was already made unconditional in \cite[Theorem~1.1]{LamzouriPrime2017},
with the weaker denominator $(\log H)^{3/2}$ in the error. The
conclusion recovered here is the sharper error term.

\begin{theorem}[Lamzouri's odd-class-number average]
\label{thm:odd-class-average}
As $H\to\infty$,
\[
 \sum_{\substack{h\le H\\h\ {\rm odd}}}\mathcal F(h)
 =\frac{15}{4}\frac{H^2}{\log H}
 +O\!\left(\frac{H^2(\log\log H)^3}{(\log H)^2}\right).
\]
The implied constant and the threshold are effective and absolute.
\end{theorem}

We prove the required complex-moment estimate rather than importing
its GRH version. All logarithms in the proof are natural; parameters
are sufficiently large whenever iterated logarithms are used.

\subsection{Complex moments over prime discriminants}

Let $Y(p)$, indexed by the rational primes, be independent random
variables with values $1,-1$, each of probability $1/2$, and put
\[
 \mathcal L=\prod_p(1-Y(p)/p)^{-1}.
\]
The product converges almost surely to a positive number. Indeed,
$\log\mathcal L=\sum_pY(p)/p+O(\sum_pp^{-2})$, and the independent
mean-zero series converges almost surely by the finite variance sum.
All real moments exist. For each complex $z$, define the multiplicative
function $d_z$ by
\[
 d_z(p^j)=\frac{z(z+1)\cdots(z+j-1)}{j!},\qquad d_z(1)=1.
\]
Expanding the local factors and taking expectations gives
\begin{equation}\label{eq:odd-random-moment}
 \mathbb E\mathcal L^z=\sum_{m\ge1}\frac{d_z(m^2)}{m^2}.
\end{equation}
Here and below powers of a positive number use its real logarithm.
To justify absolute convergence and passage from finite products,
take an integer $k\ge\max(1,|z|)$. Then $|d_z(n)|\le d_k(n)$.
For integers $j\ge0$,
\[
 d_k(p^{2j})\le d_{k(k+1)/2}(p^j).
\]
One elementary proof pairs an ordered nondecreasing list of $2j$
members of $\{1,\ldots,k\}$ consecutively. The resulting multiset
of $j$ unordered pairs determines the original multiset, giving
an injection into multisets of $j$ of the $k(k+1)/2$ pair types.
Consequently, for $\sigma>1/2$,
\begin{equation}\label{eq:odd-square-majorant}
 \sum_{m\ge1}\frac{d_k(m^2)}{m^{2\sigma}}
 \le\zeta(2\sigma)^{k(k+1)/2}.
\end{equation}
The same argument bounds all finite-product moments uniformly;
using a higher real moment gives uniform integrability and proves
\eqref{eq:odd-random-moment} for the limiting random product.

\begin{lemma}\label{lem:odd-prime-moments}
Uniformly for
\[
 |z|\le\frac{\log x}{100(\log\log x)^2},
\]
one has
\[
 \sum_{\substack{p\le x\\p\equiv3\ (4)}}L(1,\chi_{-p})^z
 =\frac{\operatorname{Li}(x)}2\mathbb E\mathcal L^z
   +O(x^{15/16}),
 \qquad \operatorname{Li}(x)=\int_2^x\frac{dt}{\log t}.
\]
The constants and the lower threshold for $x$ are absolute and
effective.
\end{lemma}

\begin{proof}
Put $Z=\exp((\log x)^2)$ and $k=\max(1,\lceil|z|\rceil)$.
We first establish, uniformly for primitive nonprincipal $\chi$
of conductor $q\le x$,
\begin{equation}\label{eq:odd-mellin-approx}
 L(1,\chi)^z
 =\sum_{n\ge1}\frac{d_z(n)\chi(n)}n e^{-n/Z}
   +O\!\left(e^{-(\log x)^2/64}\right).
\end{equation}
Use the holomorphic Euler-product branch of $\log L(s,\chi)$
on $\Re s>7/8$. On $\Re s\ge31/32$ with real part bounded above,
\[
 |\log L(s,\chi)|\ll\log(q(|\Im s|+3)).
\]
For clarity, this follows from Borel--Carath\'eodory on fixed-radius
discs centered at $2+i\Im s$: the outer disc stays in
$\Re s>7/8$, the Euler product bounds its central logarithm,
and the usual uniform polynomial bound for $L$ bounds the real
part of that logarithm. The distances from the inner disc to
the outer boundary are fixed positive constants.

Mellin inversion of $e^{-u}$ gives the sum in
\eqref{eq:odd-mellin-approx} as
\[
 \frac1{2\pi i}\int_{(1)}L(1+w,\chi)^z\Gamma(w)Z^w\,dw.
\]
Shift to $\Re w=-1/32$. Only the pole of $\Gamma$ at $0$ is
crossed. The logarithm bound and Stirling's formula bound the new
integral by
\[
 Z^{-1/32}\exp\{Ck\log x+Ck\log(k+2)+C\}.
\]
This is at most the error in \eqref{eq:odd-mellin-approx} for
all sufficiently large effective $x$, since
$k\ll\log x/(\log\log x)^2$. The same estimates make the
horizontal contour integrals tend to zero. For real quadratic
$\chi$, the branch at $1$ is the real logarithm since $L(1,\chi)>0$.

Next, quadratic reciprocity gives $\chi_{-p}(n)=(n/p)$ for
$p\equiv3\pmod4$. If $n>0$ is nonsquare, the primitive quadratic
character attached to its positive squarefree part is nonprincipal
and even. Its product with $\chi_{-4}$ is odd and is also
nonprincipal. Their conductors are at most $4n$. Lemma~\ref{lem:psi},
the removal of prime powers, and partial summation therefore give
\begin{equation}\label{eq:odd-prime-orthogonality}
 \sum_{\substack{p\le x\\p\equiv3\ (4)}}\chi_{-p}(n)
 =\frac{\operatorname{Li}(x)}2\,\mathbf 1_{n=\square}
  +O\!\left(x^{7/8}\log^2(4nx)+\log(2n)\right).
\end{equation}
When replacing a Kronecker symbol by its primitive character,
primes dividing the removed square part of $n$ contribute at most
$\omega(n)$. This is covered by the final term. The same term
accounts for the primes dividing $n$ in the square case. The prime
number theorem in the two classes modulo $4$ follows from the
same lemma, including its principal term.

The smoothed sum of the errors is small enough even though $Z$
is much larger than a power of $x$. Specifically, with
$a=1/\log Z$, the inequality $e^{-n/Z}\le e n^{-a}$ and two
derivatives of $\zeta(1+a)^k$ give
\begin{equation}\label{eq:odd-smoothed-mass}
 \sum_{n\ge1}\frac{d_k(n)}n e^{-n/Z}\log^2(4nx)
 \ll (k+1)^2(\log Z)^2\{C\log Z\}^{k}=x^{o(1)}.
\end{equation}
The $o(1)$ is uniform in the displayed range for $z$ and is
effective: the logarithm of the right side is
$O(k\log\log Z+\log(k+2)+\log\log Z)=o(\log x)$.
In particular it is at most $x^{1/32}$ for sufficiently large $x$.
This all-integer bound also controls the removed ramified primes;
using the much larger bound \eqref{eq:odd-square-majorant} for
that error would be insufficient.

Finally, $|1-e^{-u}|\le u^{1/4}$ and
\eqref{eq:odd-square-majorant} with $\sigma=3/4$ imply
\[
 \sum_{m\ge1}\frac{|d_z(m^2)|}{m^2}
                 |e^{-m^2/Z}-1|
 \le Z^{-1/4}\zeta(3/2)^{k(k+1)/2}
 \ll e^{-(\log x)^2/8}.
\]
Average \eqref{eq:odd-mellin-approx} over the primes, insert
\eqref{eq:odd-prime-orthogonality}, and use
\eqref{eq:odd-smoothed-mass} and this last estimate. The total
error is $O(x^{29/32}+1)$, which is within the stated
$O(x^{15/16})$. Equation~\eqref{eq:odd-random-moment} gives
the main term.
\end{proof}

\subsection{From the moments to the class-number count}

\begin{proof}[Proof of Theorem~\ref{thm:odd-class-average}]
Set $l=\log\log H$ and $X=H^2(\log H)^4$. The effective lower bound
in Corollary~\ref{cor:class} shows that every negative fundamental
discriminant with $h(D)\le2H$ has $|D|\le X$ for sufficiently
large effective $H$. To justify the inversion, the inequality
$\sqrt{|D|}\ll H\log\log(e^e|D|)$ first gives $|D|\ll H^3$
for large $H$, and then gives $|D|\ll H^2l^2<X$.
Thus no exceptional discriminant or ineffective cutoff is needed.

Genus theory says that an imaginary quadratic field has odd class
number exactly when its fundamental discriminant has one prime
discriminant factor. These fields have discriminant $-p$ with
$p\equiv3\pmod4$, together with $-4$ and $-8$. Except for $p=3$,
the class-number formula is
\[
 h(-p)=\frac{\sqrt p}{\pi}L(1,\chi_{-p}).
\]
The finitely many stated exceptions affect all counts below by $O(1)$.

Put
\[
 c=\frac1{\log H},\qquad
 T=\frac{\log X}{1000(\log\log X)^2}.
\]
For $s=c+it$, $|t|\le T$, Lemma~\ref{lem:odd-prime-moments}
applies with $z=-s$ uniformly to every endpoint
$\sqrt X\le y\le X$, after increasing the absolute threshold.
Partial summation, the class-number formula, and the omission of
the initial range up to $\sqrt X$ give
\begin{equation}\label{eq:odd-class-moments}
 \sum_{\substack{p\le X\\p\equiv3\ (4)}}h(-p)^{-s}
 =\frac{\pi^s}{2}\mathbb E\mathcal L^{-s}
       \int_2^X\frac{u^{-s/2}}{\log u}\,du
   +O\bigl((1+|s|)X^{15/16}\bigr).
\end{equation}
For the omitted range, the actual sum has modulus at most $\sqrt X$
because $h(-p)\ge1$, and the model integral has that size because
$|\mathbb E\mathcal L^{-s}|\le\mathbb E\mathcal L^{-c}\ll1$.
In particular the sign in the random moment is $-s$, as required
by the class-number formula.

We give the smoothing argument explicitly. Take
\[
 N=\lceil100\log\log H\rceil,\qquad
 \lambda=10/T,\qquad \Delta=\lambda N
       \ll\frac{(\log\log H)^3}{\log H}.
\]
The letter $N$ in this paragraph is a smoothing parameter.
Define
\[
 I(y)=\frac1{2\pi i}\int_{(c)}
        y^s\left(\frac{e^{\lambda s}-1}{\lambda s}\right)^N
            \frac{ds}{s}.
\]
This is the average of $\mathbf1_{ye^U>1}$ over
$U=t_1+\cdots+t_N$, with the $t_i$ independent uniform variables
on $[0,\lambda]$. This identity follows by integrating Perron's
formula; its boundary sets have measure zero. Hence $0\le I\le1$,
$I(y)=1$ for $y\ge1$, and $I(y)=0$ for $y\le e^{-\Delta}$.

Let $A(H)=\sum_{h\le H,\ h\ {\rm odd}}\mathcal F(h)$ and
\[
 S(H)=\sum_{\substack{p\le X\\p\equiv3\ (4)}}I(H/h(-p)).
\]
The cutoff already proved and the support properties give
\begin{equation}\label{eq:odd-sandwich}
 S(He^{-\Delta})+O(1)\le A(H)\le S(H)+O(1),
\end{equation}
where the same parameters $X,c,T,N,\lambda$ are used in both
sums. Since $\Delta=o(1)$, these cutoffs also include every
field needed for the two smoothed sums.

The part $|t|>T$ of the Mellin integral for $S(H)$ is bounded by
\[
 \ll\frac XN\left(\frac3{\lambda T}\right)^N
 \ll\frac{H^2}{(\log H)^{20}}.
\]
Here $H^c=e$ and $h^{-c}\le1$. On the remaining part,
the smoothing factor has modulus at most $e^{\lambda cN}\ll1$.
Insert \eqref{eq:odd-class-moments}; its contribution to the
error is at most $O(X^{15/16}(T+\log(T/c)+1))$, again
$O(H^2/(\log H)^{20})$. Extending the model integral back
to the whole line costs the same tail bound, since
$\mathbb E\mathcal L^{-c}\ll1$. Fubini and the uniform-average
description of $I$ now give
\begin{equation}\label{eq:odd-smoothed-model}
 S(H)=\frac12\mathbb E_{U,Y}
       J\!\left(\min\left(X,
            \frac{\pi^2H^2e^{2U}}{\mathcal L^2}\right)\right)
       +O\!\left(\frac{H^2}{(\log H)^{20}}\right),
\end{equation}
where $J(v)=\int_2^vdu/\log u$ for $v\ge2$ and $J(v)=0$
for $v<2$. The powers in the model have therefore been used
with the correct reciprocal of $\mathcal L$.

We justify the two final estimates for this model. All fixed
negative moments of $\mathcal L$ were established above. Thus
\[
 \mathbb E\!\left(\mathcal L^{-2}
       \mathbf1_{\mathcal L<2\pi/(\log H)^2}\right)
 \le\left(\frac{2\pi}{(\log H)^2}\right)^{12}
         \mathbb E\mathcal L^{-14}
 \ll(\log H)^{-24}.
\]
Since $U\le\Delta=o(1)$, $J(v)\ll v$, and $X=H^2(\log H)^4$,
this removes the truncation by $X$ in
\eqref{eq:odd-smoothed-model} with an error of the same
negligible size.

Uniformly for $0\le u\le\Delta$, the estimate
$J(v)=v/\log v+O(v/(\log v)^2)$ gives
\begin{equation}\label{eq:odd-li-average}
 \mathbb E J(\pi^2H^2e^{2u}\mathcal L^{-2})
 =\frac{\pi^2H^2e^{2u}}{2\log H}\mathbb E\mathcal L^{-2}
       +O(H^2/(\log H)^2).
\end{equation}
Here is a direct bound for the expectation error. On
$H\le v=\pi^2H^2e^{2u}\mathcal L^{-2}\le H^3$,
\[
 \left|\frac1{\log v}-\frac1{2\log H}\right|
 \ll\frac{1+|\log\mathcal L|}{(\log H)^2},
\]
and $\mathbb E[\mathcal L^{-2}(1+|\log\mathcal L|)]<\infty$
by fixed positive and negative moments. The portions $v>H^3$
and $v<H$ are $O(H^{-1})$, using, for example, the fixed moments
$\mathbb E\mathcal L^{-12}$ and $\mathbb E\mathcal L^{12}$
and the bound $J(v)\ll v$. Thus
\eqref{eq:odd-li-average} holds with an effective constant.

Finally,
\[
 \mathbb E\mathcal L^{-2}
 =\prod_p(1+p^{-2})=\frac{\zeta(2)}{\zeta(4)}
 =\frac{15}{\pi^2},\qquad
 \mathbb E e^{2U}=1+O(\Delta).
\]
Equations \eqref{eq:odd-smoothed-model} and
\eqref{eq:odd-li-average} give
\[
 S(H)=\frac{15}{4}\frac{H^2}{\log H}
 +O\!\left(\frac{H^2}{(\log H)^2}
                +\frac{H^2\Delta}{\log H}\right).
\]
The same formula with $H$ replaced by $He^{-\Delta}$ holds
with the fixed smoothing parameters. Its main term changes by
$O(H^2\Delta/\log H)$. The sandwich
\eqref{eq:odd-sandwich} and the bound for $\Delta$ prove the theorem.
Every cutoff and constant in this argument is effective.
\end{proof}

\paragraph{Scope and source comparison.}
The asymptotic for the cumulative count, rather than a formula for
each individual $\mathcal F(h)$, is the published conclusion.
The moment error in Lemma~\ref{lem:odd-prime-moments} is weaker
than the square-root error available under GRH, but it is a fixed
power saving and gives the exact published counting error after
smoothing. No new conclusion for individual prescribed class
numbers is inferred.

\section{Small class-group exponents and Euler's idoneal numbers}
\label{sec:idoneal}

The numerical classifications in this section use published finite
computations. We give the complete removal of their analytic hypotheses;
we do not claim to have rerun their large searches. The precise
zero-free interval needed is much smaller than the critical strip.
The October 5 companion paper \cite[Introduction]{OAIshort} already
announces the exponent-dividing-$2$ consequence and completeness of
Euler's $65$ idoneal numbers. We record their full deduction here with
that attribution; these two applications are not newly identified in
this investigation. The extension to the published exponent-$4$ and
exponent-$8$ lists is checked separately below.

\begin{lemma}[Tatuzawa's alternative, imported]\label{lem:tatuzawa}
Let $D<0$ be a fundamental discriminant, $Q=|D|$, and
$0<\epsilon<1/2$. If
\[
 Q\geq\max(e^{1/\epsilon},e^{11.2})
 \quad\hbox{and}\quad
 L(1,\chi_D)\leq0.655\epsilon Q^{-\epsilon},
\]
then $L(s,\chi_D)$ has a real zero in
$(1-\epsilon/4,1)$.
\end{lemma}

This is the unconditional implication used in
\cite[Lemma 2]{EKN}, with attribution there to Tatuzawa's Lemma 9 and
Theorem 2. Its usual companion assertion, that there is at most one
exceptional discriminant for a fixed $\epsilon$, is not needed here.

\begin{lemma}[The explicit class-number bound needed by the classification]
\label{lem:tatuzawa-bound}
For every negative fundamental discriminant with $Q=|D|>e^{11.2}$,
\[
 h(D)>\frac{0.655}{\pi e}\frac{\sqrt Q}{\log Q}.
\]
\end{lemma}
\begin{proof}
Take $\epsilon=1/\log Q$ in Lemma~\ref{lem:tatuzawa}. Its numerical
hypotheses hold. Moreover
\[
 1-\frac{\epsilon}{4}
 =1-\frac1{4\log Q}
 >1-\frac1{44.8}>\frac78.
\]
Theorem~\ref{thm:input} excludes the real zero in Tatuzawa's alternative,
so $L(1,\chi_D)>0.655/(e\log Q)$. As $D<-4$, the analytic class-number
formula is $h(D)=\sqrt Q\,L(1,\chi_D)/\pi$, giving the claim.
\end{proof}

\begin{theorem}[Elsenhans--Kl\"uners--Nicolae classification]
\label{thm:ekn}
There are exactly $1046$ imaginary quadratic fields whose ideal class
group has exponent dividing $8$. The counts by exact exponent, and
largest absolute fundamental discriminants, are
\[
\begin{array}{c|r|r}
\text{exact exponent}&\text{number of fields}&\max|D|\\\hline
1&9&163\\
2&56&5460\\
4&203&435435\\
8&778&430950520.
\end{array}
\]
Their discriminants and class-group structures are precisely the lists
in \cite{EKNlists}.
\end{theorem}
\begin{proof}
The published computation \cite[Theorems 1 and 2, Sections 4--6]{EKN}
establishes the following implication: if the lower bound
\[
 h(D)>\frac{0.655}{\pi e}\frac{\sqrt{|D|}}{\log|D|}
 \quad (|D|>e^{11.2})
\]
holds for negative fundamental discriminants, then its lists of exact
exponents $2,4,8$ are complete. This is the precise mathematical
content of the no-Siegel-zero assumption used for that part of their
Theorem 2; see their Lemma 3 and the discussion preceding Algorithm 4.
The small-discriminant class groups are included in their computation.
Lemma~\ref{lem:tatuzawa-bound} supplies this lower bound without a
conjectural assumption. Their computed counts and maxima consequently
apply to all negative fundamental discriminants. The exponent-$1$
list of nine fields was already unconditional. Adding the four counts
gives $9+56+203+778=1046$.
\end{proof}

\paragraph{Extent of the imported computation.}
The unconditional finite search in \cite[Theorem 1]{EKN} treats every
field with $|D|\leq3.1\cdot10^{20}$ and $E(D)\leq8$. For exponents
$4$ and $8$, their complete search under the displayed class-number
bound goes further: genus theory and their Theorem 4 reduce the
problem to $|D|<d_{24}<2.38\cdot10^{34}$ and
$|D|<d_{58}<3.17\cdot10^{110}$, respectively, where $d_j$ is the product
of the first $j$ primes. Their enumeration uses bounds on the $4$-rank
to avoid scanning all discriminants in these intervals. Thus one must
not justify completeness merely by comparing the two large cutoffs
with $3.1\cdot10^{20}$: the additional enumeration in their Section 5
is an essential published computational input.

For clarity, we also give an independent analytic exclusion that
underlies the exponent-$2$ case.

\begin{proposition}[No elementary $2$-class group above the known list]
\label{prop:65-fields}
There are precisely $65$ imaginary quadratic fields with class group
of exponent dividing $2$, and none has $|D|>5460$.
\end{proposition}
\begin{proof}
Put $d_{11}=2\cdot3\cdot5\cdots31=200560490130$ and
$a_0=0.655/(\pi e)$. Direct bounds give
\[
 a_0\frac{\sqrt{d_{11}}}{\log d_{11}}>2^{10},
 \qquad \frac{\log31}{2}-\log2-\frac{\log31}{\log d_{11}}>0.
\]
Suppose that $Q=|D|\geq d_{11}$ and the class-group exponent divides
$2$. Genus theory gives $h(D)=2^{k-1}$, where $k$ is the number of
distinct prime factors of $D$. The function $\sqrt t/\log t$ is
increasing for $t>e^2$. If $k\leq11$, Lemma~\ref{lem:tatuzawa-bound}
therefore gives $h(D)>2^{10}\geq2^{k-1}$, a contradiction.

If $k>11$, then $Q\geq d_{11}31^{k-11}$. For real $u\geq0$ define
\[
 F(u)=\frac{(\sqrt{31}/2)^u}{\log d_{11}+u\log31}.
\]
Its logarithmic derivative is
\[
 \frac{F'(u)}{F(u)}
 =\frac{\log31}{2}-\log2
   -\frac{\log31}{\log d_{11}+u\log31}>0.
\]
Consequently
\[
 \frac{a_0\sqrt Q}{2^{k-1}\log Q}
 \geq\frac{a_0\sqrt{d_{11}}}{2^{10}}F(k-11)
 \geq\frac{a_0\sqrt{d_{11}}}{2^{10}\log d_{11}}>1,
\]
again contradicting $h(D)=2^{k-1}$ and
Lemma~\ref{lem:tatuzawa-bound}. This excludes all $Q\geq d_{11}$.
Since $d_{11}<3.1\cdot10^{20}$, the unconditional finite computation
in \cite[Theorem 1]{EKN} supplies exactly the $9+56$ fields below it,
with largest absolute discriminant $5460$.
\end{proof}

The positive numbers $|D|$ for these $65$ fields are
\[
\begin{gathered}
3,4,7,8,11,15,19,20,24,35,40,43,51,52,67,84,88,91,115,120,123,132,\\
148,163,168,187,195,228,232,235,267,280,312,340,372,403,408,420,427,\\
435,483,520,532,555,595,627,660,708,715,760,795,840,1012,1092,1155,\\
1320,1380,1428,1435,1540,1848,1995,3003,3315,5460.
\end{gathered}
\]
They are fundamental discriminants; this list is different from the
list of idoneal integers below.

\begin{theorem}[Completeness of Euler's idoneal list]\label{thm:idoneal}
The idoneal positive integers are exactly
\[
\begin{gathered}
1,2,3,4,5,6,7,8,9,10,12,13,15,16,18,21,22,24,25,28,30,33,37,\\
40,42,45,48,57,58,60,70,72,78,85,88,93,102,105,112,120,130,133,\\
165,168,177,190,210,232,240,253,273,280,312,330,345,357,385,408,\\
462,520,760,840,1320,1365,1848.
\end{gathered}
\]
Here an integer $n\geq1$ is called idoneal when every odd integer $m>1$
coprime to $n$ is prime if $m=x^2+ny^2$ has exactly one solution with
$x,y\geq0$ and that solution is proper; ``proper'' means
$\gcd(x,y)=1$. Uniqueness counts all nonnegative solutions, not only
the proper ones.
\end{theorem}
\begin{proof}
We use three established results about positive definite binary
quadratic forms, in the precise form recorded by Kani \cite{Kani}.
First, Grube's criterion (Theorem 6 there) says that $n$ is idoneal if
and only if the proper class group of primitive forms of discriminant
$-4n$ has exponent dividing $2$. Second, Corollary 14 there says that
if an idoneal integer $n>288$ is congruent to $1$ or $2$ modulo $4$,
then it is squarefree; if it is divisible by $4$, then $n/4$ is a
squarefree idoneal integer congruent to $2$ modulo $4$; and it is never
congruent to $3$ modulo $4$. Third, Theorem 1 there gives precisely the
displayed $65$ idoneal integers up to $10000$.

Suppose an additional idoneal integer exists. The finite theorem gives
$n>10000$. If $n\equiv1,2\pmod4$, it is squarefree, so $D=-4n$
is fundamental. Grube's criterion contradicts
Proposition~\ref{prop:65-fields}, since $|D|=4n>5460$.
Otherwise $4\mid n$, and $m=n/4>2500$ is squarefree, idoneal, and
congruent to $2$ modulo $4$. Now $D=-4m$ is fundamental and
$|D|=4m>10000>5460$, giving the same contradiction. These cases
exhaust all possibilities, proving completeness.
\end{proof}

\paragraph{Independent finite checks and provenance.}
We downloaded the author-maintained lists \cite{EKNlists}, checked their
counts and largest discriminants, and independently enumerated reduced
primitive binary quadratic forms to verify the class numbers of all
$65$ fields in Proposition~\ref{prop:65-fields}. The same elementary
enumeration verifies the displayed idoneal list through $n=10000$:
a reduced class has order dividing $2$ precisely when its representative
$(a,b,c)$ has $b=0$, $|b|=a$, or $a=c$.
We additionally recomputed all $1046$ listed class-group structures with
PARI/GP 2.17.3, using \texttt{bnfinit} followed in every case by the full
unconditional verification routine \texttt{bnfcertify} with default flag.
The field discriminant, cyclic factors, and class number agreed for every
entry. The saved verification log records all $1046$ successful checks.
These checks verify transcription and the small finite claims. The
larger completeness computations in \cite{EKN} remain imported
published results. This avoids relying on the undocumented historical
Lehmer computation discussed in \cite[Remark 24(b)]{Kani}.

% Bibliographic keys:
% EKN: A.-S. Elsenhans, J. Klueners and F. Nicolae, Imaginary quadratic
% number fields with class groups of small exponent, Acta Arith.193
% (2020),217--233, DOI10.4064/aa180220-20-3; arXiv1803.02056.
% EKNlists: author-maintained tables, accessed 9 October2026,
% https://math.uni-paderborn.de/en/ag/ca/research/exponent/exponent0 .
% Kani: E. Kani, Idoneal Numbers and some Generalizations, Ann. Sci.
% Math. Quebec35(2011),197--227,
% https://www.labmath.uqam.ca/~annales/volumes/35-2/PDF/197-227.pdf .

\subsection{The eighteen exceptions to \texorpdfstring{$xy+yz+zx=d$}{xy+yz+zx=d}}

\begin{theorem}[Louboutin--Newman's exact exceptional set]
\label{thm:diophantine-18}
For a positive integer $d$, the equation
\[
 xy+yz+zx=d,\qquad x,y,z\in\mathbb Z_{>0},
\]
has no solution if and only if
\[
 d\in\{1,2,4,6,10,18,22,30,42,58,70,78,102,130,
          190,210,330,462\}.
\]
\end{theorem}
\begin{proof}
We use the unconditional characterization in
\cite[Theorem 1, first assertion]{LouboutinNewman}: failure of a
positive solution is equivalent to
\[
 d\in\{1,4,18\}\quad\hbox{or}\quad
 \left\{\begin{array}{l}
 d\text{ is squarefree},\quad d\equiv2\pmod4,\\
 \operatorname{Cl}(\mathbb Q(\sqrt{-d}))\text{ has exponent dividing }2.
 \end{array}\right.
\]
For such squarefree $d\equiv2\pmod4$, the field discriminant is
$-4d$. Filtering the fundamental discriminants of
Proposition~\ref{prop:65-fields} by this condition gives
\[
 d\in\{2,6,10,22,30,42,58,70,78,102,130,190,210,330,462\}.
\]
These $15$ values are disjoint from $\{1,4,18\}$, and their union
is exactly the stated set. The characterization proves both
nonexistence for these values and existence for every other positive
$d$. It also covers $d=1$ directly, since $xy+yz+zx\geq3$.

The structural characterization is an unconditional published input;
its proof uses reduction of positive binary quadratic forms of
discriminant $-4d$. The GRH hypothesis in the final assertion of
\cite[Theorem 1]{LouboutinNewman} was used solely for completeness
of the quadratic-field list, now supplied by
Proposition~\ref{prop:65-fields}.
\end{proof}

% LouboutinNewman: S. Louboutin and M. F. Newman, On the
% diophantine equation xy+yz+zx=d, Acta Math. Inform. Univ.
% Ostraviensis 6 (1998),155--158.
% https://dml.cz/handle/10338.dmlcz/120528

\section{The complete abelian one-class-per-genus classifications}
\label{sec:abelian-genus}

For an imaginary abelian extension $N/\mathbb Q$, write $H_N$ for
its Hilbert class field, and $G_N$ for its genus field: the maximal
abelian extension of $\mathbb Q$ containing $N$ which is unramified
over $N$ at all finite primes. Put
\[
 h_N=[H_N:N],\qquad g_N=[G_N:N].
\]
There are no real places of $N$, so the finite-prime qualification
causes no distinction between ordinary and narrow class fields here.
The property \emph{one class in each genus} is $h_N=g_N$.

\begin{lemma}\label{lem:abelian-hilbert-genus}
For imaginary abelian $N/\mathbb Q$, the following are equivalent:
$h_N=g_N$, $H_N=G_N$, and $H_N/\mathbb Q$ is abelian.
If $N$ is quadratic, these are also equivalent to
$\operatorname{Cl}(N)$ having exponent dividing $2$.
\end{lemma}
\begin{proof}
By definition $G_N/N$ is unramified and abelian, so $G_N\subseteq H_N$.
Thus equality of the degrees over $N$ is equivalent to equality of
the fields, and equality implies that $H_N/\mathbb Q$ is abelian.
Conversely, if $H_N/\mathbb Q$ is abelian, its maximality property in
the definition of $G_N$ gives $H_N\subseteq G_N$.

For an imaginary quadratic field $N$, the Hilbert class field is
Galois over $\mathbb Q$: conjugation sends every unramified abelian
extension of $N$ to another one, and hence preserves the maximal such
extension. Its Galois group is
\[
 \operatorname{Gal}(H_N/\mathbb Q)
   \simeq \operatorname{Cl}(N)\rtimes\langle c\rangle,
 \qquad c^2=1,
\]
where $c$ is complex conjugation and acts by inversion. Indeed
$\mathfrak a\overline{\mathfrak a}$ is principal for every ideal
$\mathfrak a$ of $N$, and the Artin isomorphism is equivariant for
conjugation. This semidirect product is abelian exactly when every
class equals its inverse, proving the last assertion.
\end{proof}

\begin{theorem}[The completed Chang--Kwon classification]
\label{thm:489-genus}
There are exactly $489$ imaginary abelian number fields $N$ with
$h_N=g_N$, or equivalently with $H_N/\mathbb Q$ abelian. They consist
of the $65$ quadratic fields of Proposition~\ref{prop:65-fields}
and the $424$ nonquadratic fields in Chang--Kwon's tables
\cite{ChangKwon}. Among the latter, $77$ are cyclic and $347$ are
noncyclic. All $489$ fields have degree at most $24$ and conductor
at most $65689$.
\end{theorem}
\begin{proof}
For the quadratic fields, Lemma~\ref{lem:abelian-hilbert-genus}
reduces the classification exactly to Proposition~\ref{prop:65-fields}.
The largest absolute fundamental discriminant in that list is $5460$;
it is also the largest conductor in the quadratic part.

For the nonquadratic fields, we invoke the unconditional published
\cite[Theorem 1]{ChangKwon}. It gives precisely the stated $424$
fields, their cyclic/noncyclic counts, and their degree and conductor
bounds. The two classes are disjoint because their degrees differ.
Their union therefore has size $65+424=489$ and satisfies the stated
bounds. Chang--Kwon explicitly left only the completeness of the
quadratic list dependent on GRH; that is the step supplied here.
\end{proof}

\begin{theorem}[Miyada's multiquadratic classification, completed]
\label{thm:301-genus}
There are exactly $301$ imaginary multiquadratic fields $N$ with
$h_N=g_N$: $65$ have degree $2$, $219$ have degree $4$, and $17$
have degree $8$. None has larger degree.
\end{theorem}
\begin{proof}
Miyada's unconditional structural theorem, restated in
\cite[Theorem 2]{ChangKwon}, proves that an imaginary
multiquadratic field with $h_N=g_N$ has degree at most $8$.
The unconditional enumerations \cite[Proposition 3(2) and
Proposition 4]{ChangKwon} give respectively $219$ fields of degree
$4$ and $17$ of degree $8$. The quadratic case is exactly the $65$
fields already proved complete above. Hence the total is
$65+219+17=301$. This is the formerly GRH-dependent classification
of \cite{Miyada}, using the corrected nonquadratic tables in
\cite{ChangKwon}.
\end{proof}

The genus condition here is not interchangeable with the condition
that the ideal class group have exponent dividing $2$ once the degree
is larger than $2$. Also, the $424$ nonquadratic fields were already
classified unconditionally: the new deduction is completeness of the
full $489$-field classification and its $301$-field multiquadratic
subclassification. The finite computations supporting Chang--Kwon's
published theorem are imported established results and have not been
rerun in this investigation.

% Bibliography:
% ChangKwon: K.-Y. Chang and S.-H. Kwon, The imaginary abelian
% number fields with class numbers equal to their genus class numbers,
% J. Theor. Nombres Bordeaux 12 (2000),349--365,
% DOI 10.5802/jtnb.283.
% https://jtnb.centre-mersenne.org/item/JTNB_2000__12_2_349_0.pdf
% Miyada: I. Miyada, On imaginary abelian number fields of type
% (2,2,...,2) with one class in each genus, Manuscripta Math.
% 88 (1995),535--540. DOI 10.1007/BF02567840.

\section{The complete multiquadratic exponent-two classification}
\label{sec:multiquadratic-exponent-two}

This section removes the GRH assumption from Ahn--Kwon's published
classification \cite[Theorem~1]{AK}. Its finite arithmetic has been
independently recomputed here. An imaginary multiquadratic field is a
number field $N$ without real embeddings such that
$\operatorname{Gal}(N/\mathbb Q)\simeq(\mathbb Z/2\mathbb Z)^n$.
Throughout this section, exponent dividing $2$ includes the trivial
class group. This condition concerns the ordinary ideal class group;
it is different from equality of the class number and genus number.

\begin{theorem}[Ahn--Kwon, unconditionally]\label{thm:ahn-kwon}
There are exactly $650$ imaginary multiquadratic fields whose ideal
class groups have exponent dividing $2$. Their numbers by degree are
\[
\begin{array}{c|rrrr}
[N:\mathbb Q]&2&4&8&16\\\hline
\text{number of fields}&65&483&99&3.
\end{array}
\]
There are no examples of larger degree. All have conductor at most
$233905$ and class number at most $32$. The fields of degrees at least
$4$ are exactly those in Ahn--Kwon's published Tables~4--6.
\end{theorem}

\begin{proof}
We give the mathematical reduction, the exact finite computation,
and its unconditional verification. The complete list is supplied
separately in text and JSON formats. The accompanying verification
archive contains the arithmetic and exclusion records.

\emph{Norm descent.}
Let $L/F$ be quadratic, with $F$ imaginary. Class field theory gives
\[
 [\operatorname{Cl}(F):N_{L/F}\operatorname{Cl}(L)]
 =[L\cap H_F:F]\leq2,
\]
where $H_F$ is the ordinary Hilbert class field. If $L/F$ ramifies at
a finite prime, the index equals $1$. Consequently, if
$\operatorname{Cl}(L)$ has exponent dividing $2$, then
$\operatorname{Cl}(F)$ has exponent dividing $4$ and at most one
cyclic factor of order $4$. In the ramified case its exponent divides
$2$. These are precisely the unconditional norm assertions of
\cite[Proposition~2]{AK}.

We shall also use their elementary refinement. If an abelian
$2$-group $G$ has exponent dividing $4$ and at most one cyclic factor
of order $4$, then $|2G|\leq2$. If $G$ maps onto a subgroup $H$ of
an abelian group $C$ with $[C:H]\leq2$, then $C$ is a $2$-group and
\[
 |2C|\leq [C:H]\,|2H|\leq4.
\]
In particular, $C$ has exponent dividing $8$. If the map is
surjective onto $C$, then $C$ itself has exponent dividing $4$ and
at most one cyclic factor of order $4$.

\emph{Existence of subfields to which ramified descent applies.}
Suppose $N$ is imaginary multiquadratic of degree $2^n$, $n\geq2$.
Write $G=\operatorname{Gal}(N/\mathbb Q)$ additively and let
$c\ne0$ be complex conjugation. The inertia subgroups at finite
primes generate $G$: their common fixed field would otherwise be a
nontrivial extension of $\mathbb Q$ unramified at all finite primes,
contrary to Minkowski's theorem. A nonzero inertia element $h\ne c$
gives an imaginary index-two subfield $N^{\langle h\rangle}$ over
which $N$ ramifies. If no such $h$ existed, the inertia subgroups
would generate at most $\langle c\rangle$. If only one existed,
they would generate at most $\langle c,h\rangle$. Thus there is at
least one such subfield for $n\geq2$, and at least two distinct ones
for $n\geq3$. In the latter case their compositum is $N$, and their
intersection has degree $2^{n-2}$.

\emph{The complete quadratic inputs.}
Proposition~\ref{prop:65-fields} supplies the $65$ imaginary quadratic
fields of exponent dividing $2$. Among the $203$ fields of exact
exponent $4$ in Theorem~\ref{thm:ekn}, exactly $161$ have precisely
one cyclic factor of order $4$. The latter count is obtained by
filtering the published group structures \cite{EKNlists}; all these
quadratic class-group structures have been independently verified
as described above. Their largest absolute discriminant is $40755$.
The exponent-dividing-$8$ lists in the same theorem supply the
additional quadratic obstructions used below.

An eligible quartic field has two distinct imaginary quadratic
subfields. At least one belongs to the $65$-field list, and the other
belongs either to that list or to the $161$-field list, by norm
descent. Therefore exactly
\[
 \binom{65}{2}+65\cdot161=12545
\]
quartic candidates suffice. There is no duplication: the two
imaginary quadratic subfields determine their quartic compositum.

\emph{Exact representation and arithmetic verification.}
Represent a multiquadratic field by the finite subgroup
$V\subset\mathbb Q^\times/\mathbb Q^{\times2}$ of its quadratic
characters, recording each squareclass by its signed squarefree
integer representative. Thus $|V|=[N:\mathbb Q]$, the identity is
$1$, and multiplication of representatives is
\[
 a\ast b=\frac{ab}{\gcd(|a|,|b|)^2}.
\]
The span of two such subgroups represents the compositum and their
intersection represents the common subfield. All distinct
index-two subgroups of $V$ are enumerated; those containing a
negative representative give the imaginary index-two subfields.
For a nonidentity representative $a$, put
\[
 d(a)=\begin{cases}a,&a\equiv1\pmod4,\\4a,&a\not\equiv1\pmod4.
 \end{cases}
\]
The conductor--discriminant formula gives the exact integers
\[
 |\operatorname{disc}N|=
 \left|\prod_{a\in V\setminus\{1\}}d(a)\right|,
 \qquad f_N=\operatorname{lcm}_{a\in V\setminus\{1\}}|d(a)|.
\]
For a quadratic extension $N/F$ between the imaginary fields under
consideration, finite ramification is equivalent to
$|\operatorname{disc}N|\ne|\operatorname{disc}F|^2$.

For every directly tested field, a basis of its squareclass subgroup
produces a defining polynomial by successive linearly disjoint
quadratic composita. PARI/GP~2.17.3 computes the class group with
\texttt{bnfinit(P,1)} and then verifies its correctness with
\texttt{bnfcertify(B)} using the default flag $0$. This last step
removes the GRH assumption from the class-group computation.
Only a return value of $1$ is accepted. Each resulting field
discriminant is compared with the independent product formula
above; the order of the displayed group is also checked against the
computed class number. No unverified class group is used as an
arithmetic input or a reason to exclude a field.

\emph{Quartic computation.}
All $12545$ quartic candidates, including every negative case, were
directly computed and verified in this manner. Exactly $483$ have
exponent dividing $2$. Their class-number distribution is
\[
\begin{array}{c|rrrrrr}
h_N&1&2&4&8&16&32\\\hline
\#N&47&160&112&132&26&6.
\end{array}
\]
Their largest conductor is $233905$.

\emph{Octic computation and explicit exclusions.}
Among unordered pairs of the $483$ quartic survivors, exactly $12922$
have quadratic intersection. Their composita give $8686$ distinct
octic candidates. Every candidate is decided as follows.
\begin{enumerate}
\item Ramified norm descent excludes $6848$ candidates with an
imaginary quartic subfield absent from the complete $483$-field
list. Another $623$ are excluded by already verified class groups
of unramified quartic subfields whose exponent or $4$-rank violates
norm descent. These give $7471$ exclusions at the first stage.
\item For a quartic subfield $F$ over which $N/F$ is unramified,
norm descent requires exponent dividing $4$ and at most one cyclic
factor of order $4$. Applying the preceding refinement to its
imaginary quadratic subfields excludes another $817$ octics, using
the complete quadratic lists and exact ramification tests.
\item The remaining quartic-subfield questions were resolved by
$735$ direct, unconditionally verified quartic computations. Their
class-group exponent or $4$-rank excludes another $237$ octics.
\item The remaining $161$ octic candidates were all directly
computed and verified. Exactly $99$ have exponent dividing $2$.
\end{enumerate}
The three exclusion sets are disjoint and, together with the $161$
directly tested candidates, exhaust all $8686$ candidates, since
$7471+817+237+161=8686$. Each excluded field has an explicit
obstructing subfield in the supplied data. The surviving class-number
distribution is
\[
\begin{array}{c|rrrrrr}
h_N&1&2&4&8&16&32\\\hline
\#N&17&27&19&32&1&3.
\end{array}
\]
Their largest conductor is $6460$.

\emph{Degrees sixteen and thirty-two.}
The $99$ octic survivors give $674$ unordered pairs with quartic
intersection and $278$ distinct composita of degree $16$.
Ramified norm descent to the complete octic list excludes $261$.
For the remaining $17$, the unramified norm restriction is tested
on $122$ additional imaginary octic subfields, whose class groups
are all directly computed and unconditionally verified. These
exclude $14$ more candidates. The three remaining fields are
directly verified to have groups $C_2,C_2^2,C_2^2$, and are
\[
 \mathbb Q(\sqrt{-1},\sqrt{-2},\sqrt{-3},\sqrt{-5}),\quad
 \mathbb Q(\sqrt{-1},\sqrt{-3},\sqrt{-5},\sqrt{-7}),\quad
 \mathbb Q(\sqrt{-2},\sqrt{-3},\sqrt{-7},\sqrt{-10}).
\]
Their conductors are respectively $120,420,840$.

The three pairwise composita of these fields all equal
\[
 N_{32}=\mathbb Q(\sqrt{-1},\sqrt{-2},\sqrt{-3},\sqrt{-5},\sqrt{-7}).
\]
Its subfield
$M=\mathbb Q(\sqrt{-1},\sqrt{-2},\sqrt{-5},\sqrt{-7})$
has class group $C_4$, again checked with
\texttt{bnfinit} and \texttt{bnfcertify}. The exact discriminants give
\[
 \frac{|\operatorname{disc}N_{32}|}{|\operatorname{disc}M|^2}
 =3^{16}>1.
\]
Thus $N_{32}/M$ ramifies and norm surjectivity excludes $N_{32}$.
The earlier descent proves that every possible higher-degree example
would contain an eligible degree-$32$ subfield. None therefore exist.

Finally, the $483$, $99$, and $3$ computed squareclass subgroups have
been compared individually with the published Tables~4, 5, and~6 of
\cite{AK}; their sets agree exactly. The $99$ and $3$ class numbers
also agree entry by entry. The table transcriptions, visually checked
corrections of the scanned text, and comparison program are included
with the computations. A second enumeration, written independently
using binary vectors of prime squareclasses and importing none of
the first enumeration's functions, checks all candidate sets,
intersection counts, exclusion partitions, discriminants, group
orders, and the final conductor and class-number maxima. It gives
$65+483+99+3=650$, as asserted.
\end{proof}

\paragraph{Scope of the computation.}
The analytic completeness of the quadratic inputs comes from the
preceding unconditional theorems. The remaining proof is finite
arithmetic, verified without GRH-dependent bounds for class-group
generators. The attached archive contains the executable inputs,
complete PARI outputs for all computations used in the proof,
explicit subfield exclusions, the independently written enumeration
check, and the complete $650$-field list. A preliminary slow computation
of a degree-$16$ negative case was stopped after its exclusion had
been proved from an octic subfield; its partial log is retained and
is not used in the proof.

% Bibliography addition:
% \bibitem{AK} J.-H. Ahn and S.-H. Kwon,
% The class groups of the imaginary Abelian number fields with Galois
% group $(\mathbb Z/2\mathbb Z)^n$,
% Bulletin of the Australian Mathematical Society 70 (2004), 267--277.
% DOI 10.1017/S0004972700034481.

% Analytic proof and complete 149024-field computation independently checked.
\section{The complete Richaud--Degert class-number-two classification}
\label{sec:rd-class-two}

For this section, a squarefree integer $D>1$ is of
\emph{extended Richaud--Degert type} if there are integers $m\geq1$
and $r\ne0$ such that
\[
 D=m^2+r,\qquad r\mid4m.
\]
This is the divisibility definition in
\cite[Introduction]{MollinRD2009}; no additional normalization of $r$
is imposed. We use $D$ for the squarefree radicand and
$\Delta=D$ if $D\equiv1\pmod4$, and $\Delta=4D$ otherwise, for the
fundamental discriminant. The class number is the ordinary ideal
class number, without a positivity condition on generators.

\begin{theorem}[Mollin's complete list]
\label{thm:rd-class-two}
There are exactly $107$ real quadratic fields of extended
Richaud--Degert type with ordinary class number two. Their squarefree
radicands are precisely the following:
\[
\begin{array}{rrrrrrr}
10&15&26&30&34&35&39\\
42&51&65&66&78&85&87\\
95&102&105&110&119&122&123\\
138&143&146&165&182&194&203\\
205&215&221&222&230&258&285\\
287&318&327&357&362&365&395\\
402&429&447&482&485&527&533\\
623&629&635&645&678&741&782\\
843&885&902&957&965&1022&1085\\
1157&1173&1205&1245&1298&1469&1517\\
1533&1605&1685&1853&1965&2013&2037\\
2045&2085&2093&2117&2301&2373&2397\\
2613&2717&2813&3005&3237&3365&3597\\
3605&3813&4245&4277&4773&4893&5645\\
5757&5885&5957&6573&7157&7733&8333\\
9005&14405&&&&&
\end{array}
\]
The list is the one in \cite[Theorems~3.1--3.13 and
Remark~3.1]{MollinRD2009}; its completeness now requires no GRH.
\end{theorem}

\begin{lemma}[A regulator bound for the full divisibility family]
\label{lem:rd-regulator}
If $D\geq3$ is of extended Richaud--Degert type and $R_D$ denotes
the logarithm of its fundamental unit greater than one, then
\[
 R_D\leq\log(16D).
\]
\end{lemma}
\begin{proof}
Fix a representation $D=m^2+r$ as above and put
\[
 \eta=\frac{(m+\sqrt D)^2}{|r|}.
\]
Its norm is one, and its trace is
\[
 \frac{4m^2}{|r|}+2\operatorname{sgn}(r)\in\mathbb Z,
\]
because $|r|\mid4m$. Thus $\eta$ is an algebraic integer unit.
It is greater than one: equivalently,
$(m+\sqrt D)^2>|m^2-D|$, which holds for $m,D>0$.
Consequently $R_D\leq\log\eta$, regardless of whether the
fundamental unit has norm $1$ or $-1$.

The divisibility condition implies $|r|\leq4m$, and hence
$(m-2)^2\leq D+4$ and $m\leq2+\sqrt{D+4}$. Since $|r|\geq1$,
\[
 \eta\leq(2+\sqrt{D+4}+\sqrt D)^2\leq16D
 \quad(D\geq3).
\]
For the last inequality, $\sqrt{D+4}\leq3\sqrt D-2$ follows by
squaring, since it is equivalent to $8D\geq12\sqrt D$.
This proves the bound.
\end{proof}

\begin{lemma}[An explicit cutoff]
\label{lem:rd-class-two-cutoff}
If an extended Richaud--Degert field has class number two, then
$D<10^8$.
\end{lemma}
\begin{proof}
Tatuzawa's original real-character lemma
\cite[Lemma~9, with the hypotheses on p.~170]{Tatuzawa1951}
applies to every primitive real Dirichlet character, of either parity.
It states that, for $0<\epsilon<1/2$ and
$\Delta\geq\max(e^{11.2},e^{1/\epsilon})$, the inequality
\[
 L(1,\chi_\Delta)\leq0.655\epsilon\Delta^{-\epsilon}
\]
forces a real zero in $(1-\epsilon/4,1)$. This entire interval lies
to the right of $7/8$, so Theorem~\ref{thm:input} excludes that
alternative. Taking $\epsilon=1/\log\Delta$, for
$\Delta\geq e^{11.2}$ we obtain
\[
 L(1,\chi_\Delta)>\frac{0.655}{e\log\Delta}.
\]
The real quadratic class-number formula, with the ordinary class
number and the fundamental unit of either norm, is
\[
 2h_D R_D=\sqrt\Delta\,L(1,\chi_\Delta).
\]
If $h_D=2$ and $D\geq10^8$, Lemma~\ref{lem:rd-regulator}
would therefore imply
\[
 4\log(16D)\geq4R_D>
 \frac{0.655\sqrt\Delta}{e\log\Delta}
 \geq\frac{0.655\sqrt D}{e\log(4D)}.
\]
This is impossible. Indeed, at $D=10^8$,
\[
 \frac{\sqrt D}{\log(4D)\log(16D)}>\frac{10000}{20\cdot22}
 =\frac{250}{11}>
 \frac{4e}{0.655},
\]
using $\log(4\cdot10^8)<20$, $\log(16\cdot10^8)<22$, and
$4e/0.655<16.61$. The expression on
the left increases for $D\geq10^8$, since its logarithmic
derivative with respect to $\log D$ is
\[
 \frac12-\frac1{\log(4D)}-\frac1{\log(16D)}>0.
\]
The contradiction proves the cutoff.
\end{proof}

\begin{proof}[Proof of Theorem~\ref{thm:rd-class-two}]
The preceding lemma reduces the problem to squarefree $D<10^8$.
The finite search is exhaustive with the following explicit bounds:
for $1\leq m\leq10002$, enumerate every positive divisor $s$ of
$4m$ and form $D=m^2+s$ and $D=m^2-s$. Keep $1<D<10^8$
that are squarefree, and remove duplicates. Every possible field
occurs because
\[
 m\leq2+\sqrt{D+4}<2+\sqrt{10^8+4}<10003.
\]
Conversely, every retained radicand satisfies the defining condition.
This gives exactly $149024$ distinct squarefree radicands. An
independent enumeration, reversing the divisor loops and testing
squarefreeness with an integer sieve, gives the identical candidate set.

For each retained radicand, compute the full ideal class group and
verify the computation with PARI/GP's unconditional
\texttt{bnfcertify} routine. Select the fields whose class number
is two. The resulting set is exactly the displayed set of $107$
radicands. The program, complete enumeration record, and comparison
with the independently transcribed published list accompany the
computational supplement. In particular, completeness uses the full
finite enumeration, not merely verification of the $107$ positive
entries. Together with the analytic cutoff, this proves the theorem.
\end{proof}

\paragraph{Source conventions and scope.}
The theorem recovers the global classification in
\cite[Introduction and Remark~3.7]{MollinRD2009}. Several displayed
lists in that source are labeled $\Delta$ even though their entries
are the radicands $D=\Delta/4$; its worked examples make the intended
convention clear. The table here consistently lists radicands. We
do not import the source's separate continued-fraction and
prime-producing-polynomial equivalences, some of which have additional
typographical defects. The complete search and the regulator argument
above provide an independent route to the stated global classification.

% Append after the class-number-two section; the same computation proves this.
% Bibliography additions:
% \bibitem{LouboutinPrime1990} S. Louboutin, Prime producing quadratic
% polynomials and class-numbers of real quadratic fields,
% Canad. J. Math. 42 (1990), no. 2, 315--341,
% doi:10.4153/CJM-1990-018-3.
% \bibitem{BiroLapkova2016} A. Bir\'o and K. Lapkova, The class number
% one problem for the real quadratic fields $\mathbb Q(\sqrt{(an)^2+4a})$,
% Acta Arith. 172 (2016), no. 2, 117--131,
% doi:10.4064/aa7957-12-2015.
% \bibitem{LeeWide2009} J. Lee, The complete determination of wide
% Richaud--Degert types which are not 5 modulo 8 with class number one,
% Acta Arith. 140 (2009), no. 1, 1--29, doi:10.4064/aa140-1-1.

\subsection{The complete class-number-one list in the same family}

The same finite enumeration also settles the earlier conditional
class-number-one list. Louboutin \cite[pp.~315--316]{LouboutinPrime1990}
records the following $43$ radicands, attributing the classification
under the extended Riemann hypothesis to his work and to
Mollin--Williams. That source normalizes $r$ by $-m<r\leq m$
or permits $r=\pm4m/3$. Here we prove the identical list for the
full divisibility definition of extended Richaud--Degert type
from the beginning of this section, which contains that family.

\begin{corollary}[The complete extended Richaud--Degert class-number-one list]
\label{cor:rd-class-one}
There are exactly $43$ real quadratic fields of extended
Richaud--Degert type with ordinary class number one. Their squarefree
radicands are precisely
\[
\begin{array}{rrrrrrr}
2&3&5&6&7&11&13\\
14&17&21&23&29&33&37\\
38&47&53&62&69&77&83\\
93&101&141&167&173&197&213\\
227&237&293&398&413&437&453\\
573&677&717&1077&1133&1253&1293\\
1757&&&&&&
\end{array}
\]
\end{corollary}

\begin{proof}
The cutoff proof for Lemma~\ref{lem:rd-class-two-cutoff} actually
excludes every field with $h_D\leq2$ and $D\geq10^8$. Indeed, its
only use of the class-number value is
\[
 \sqrt\Delta L(1,\chi_\Delta)=2h_D R_D
       \leq4R_D\leq4\log(16D),
\]
which holds for all such $h_D$. The same Tatuzawa lower bound
contradicts this inequality for $D\geq10^8$. Thus every field in
this corollary is among the $149024$ candidates already enumerated
and unconditionally verified in the proof of
Theorem~\ref{thm:rd-class-two}.

Selecting the records with class number one gives exactly the
$43$ displayed radicands. This selected list has been compared,
entry by entry, with the published list on pp.~315--316 of
\cite{LouboutinPrime1990}; the two lists agree. All positive
entries and all exclusions use the same complete arithmetic
verification as the class-number-two classification. This proves
both directions without a further hypothesis or a new enumeration.
\end{proof}

This corollary concerns the complete divisibility family. Several
subfamilies already have unconditional classifications: Lee's
Theorem~1.1 \cite{LeeWide2009} treats the wide types not congruent
to $5$ modulo $8$, and Bir\'o--Lapkova's Theorem~1.1
\cite{BiroLapkova2016} treats $D=(an)^2+4a$ with $a,n$ odd and
positive. Those earlier conclusions are not counted again here.
The new use of the imported zero-free strip is the completeness
of the full published $43$-field list; its proof shares the
regulator bound, cutoff, and complete computation above.

% Bibliography: LouboutinPolynomial2026 = S. R. Louboutin,
% Czechoslovak Math. J.76(2026),677--697, DOI10.21136/CMJ.2026.0455-25.
% Uses existing Tatuzawa1951 and thm:input. Independent mathematical and
% alternative-sieve audit PASS; root has reviewed the algebraic/analytic proof.
\section{A complete polynomial-factorization classification}
\label{sec:polynomial-factor-count}

For a positive integer $n$, let $\omega(n)$ denote its number of
distinct prime divisors. For odd $d\geq1$, put
\[
 M_{\mathrm{odd}}(d)=
 \max_{\substack{1\leq x\leq\sqrt d\\x\text{ odd}}}\omega(d+x^2).
\]
The following is the complete classification in
\cite[Theorem~1.3]{LouboutinPolynomial2026}. The published statement
allows one exceptional value without its restricted Riemann hypothesis.

\begin{theorem}\label{thm:polynomial-factor-count}
Let $d\equiv7\pmod8$ be prime or a product of two distinct primes.
Then $M_{\mathrm{odd}}(d)\leq2$ if and only if
\[
\begin{split}
 d\in\{&7,15,23,31,39,47,55,79,103,127,151,223,247,\\
       &463,487,583,823,1087,1423\}.
\end{split}
\]
For each such $d$, the ideal class group of $\mathbb Q(\sqrt{-d})$
is cyclic and is generated by the class of either prime ideal above
$2$. Its class number satisfies $h(-d)\leq\log(2d)/\log2$.
\end{theorem}

\begin{lemma}\label{lem:polynomial-factor-class-bound}
For a squarefree $d\equiv7\pmod8$ with
$M_{\mathrm{odd}}(d)\leq2$, the class group is generated by a prime
above $2$. If $d$ is prime or the product of two distinct primes,
then
\[
 h(-d)\leq\frac{\log(3d)}{\log2}.
\]
\end{lemma}
\begin{proof}
Write $K=\mathbb Q(\sqrt{-d})$ and
$(2)=\mathfrak p_2\overline{\mathfrak p}_2$.
The ideal classes of prime ideals of norm at most $\sqrt d$ generate
$\operatorname{Cl}(K)$: the usual imaginary quadratic Minkowski
bound is $2\sqrt d/\pi<\sqrt d$, and factoring the resulting
integral ideal gives this assertion. Inert prime ideals are principal.

Let $\ell\leq\sqrt d$ be an odd noninert prime. There is an odd
$x$ with $1\leq x\leq\ell$ and $x^2\equiv-d\pmod\ell$;
use the two opposite roots and choose the odd representative, with
$x=\ell$ when the root is zero. Since $8\mid d+x^2$ and
$M_{\mathrm{odd}}(d)\leq2$, we have
\[
 d+x^2=2^a\ell^b,\qquad a\geq3,\quad b\geq1.
\]
If $b\geq2$, squarefreeness implies $\ell\nmid x$. Set
$x'=2\ell-x$. Then $x'$ is positive and odd, and
\[
 (x')^2\leq4\ell^2\leq\tfrac12\,2^a\ell^b
 =\tfrac12(d+x^2)\leq d.
\]
Furthermore, $\ell$ divides $d+(x')^2$ exactly once, because
$d+(x')^2=d+x^2+4\ell^2-4\ell x$.
The defining polynomial condition therefore gives
$d+(x')^2=2^{a'}\ell$. Thus, in either case, there is an odd $u$
such that
\[
 d+u^2=2^v\ell,\qquad v\geq3.
\]
The integer $\alpha=(u+\sqrt{-d})/2$ has norm $2^{v-2}\ell$.
Its principal ideal is primitive: if a rational integer greater
than one divided $\alpha$ in $\mathcal O_K$, it would divide
the coefficient $1$ of $(1+\sqrt{-d})/2$.
Consequently $(\alpha)=\mathfrak q_2^{v-2}\mathfrak q_\ell$
for primes above $2$ and $\ell$. The class of either prime above
$\ell$ is therefore in $\langle[\mathfrak p_2]\rangle$.
This proves the cyclicity assertion.

Suppose first that $d=pq$ with odd primes $p<q$. Taking $x=p$
shows that $p+q=2^a$ with $a\geq3$. Also $q<9p$. Otherwise
both $x=p$ and $x=3p$ are permitted, and the same condition gives
$q+p=2^a$ and $q+9p=2^b$ with $b>a$. Subtracting gives
$8p=2^a(2^{b-a}-1)$, whence $a=3$ and $p+q=8$, contrary to
$q\geq9p$. Now put
\[
 \alpha=\frac{(q-p)/2+\sqrt{-pq}}2.
\]
Since $(q-p)/2$ is odd, this is an algebraic integer, and
\[
 N\alpha=\frac{(p+q)^2}{16}=2^{2a-4}.
\]
Its ideal is again primitive, so the order of $[\mathfrak p_2]$
divides $2a-4$. Since $1<q/p<9$,
\[
 2^{2a-4}=\frac{(p+q)^2}{16}
 <\frac{25}{36}pq<d.
\]
It follows that $h(-d)\leq2a-4<\log d/\log2$.

Suppose next that $d=p$ is prime. The prime $p\equiv7\pmod8$
splits in $\mathbb Z[\sqrt2]$, a principal ideal domain with unit
$1+\sqrt2$ of norm $-1$. Hence there is an element of norm $-p$.
Multiplying it by a power of $3+2\sqrt2$, and changing its sign,
puts its positive real embedding $z_0$ in
\[
 (\sqrt2-1)\sqrt p\leq z_0<(\sqrt2+1)\sqrt p.
\]
The other embedding is $-p/z_0$. Writing the element as
$x+y\sqrt2$, and replacing it by the negative of its conjugate
if necessary, gives integers $0<x<\sqrt p$, $0<y<\sqrt p$ with
$p+x^2=2y^2$. The bounds follow from
$|x|=|z_0-p/z_0|/2$ and $y=(z_0+p/z_0)/(2\sqrt2)$;
their endpoints cannot be attained by integers since $p$ is not a
square. Congruences modulo $8$ show that $x$ is odd and $y=2z$,
so
\[
 p+x^2=8z^2.
\]
If $z=2^u$, the primitive integer $(x+\sqrt{-p})/2$ has norm
$2^{2u+1}$, and thus
$h(-p)\leq2u+1\leq\log(p/2)/\log2$.

If $z$ is not a power of $2$, observe that
$0<2z-x\leq\sqrt p$ and
\[
 p+(2z-x)^2=4z(3z-x),\qquad \gcd(z,3z-x)=1.
\]
The gcd assertion follows from $p+x^2=8z^2$: a prime common to
$z$ and $x$ would have its square divide $p$.
The polynomial condition and the presence of an odd prime in $z$
force $3z-x=2^u$. Then
\[
 p+(-3x+8z)^2=8(3z-x)^2=2^{2u+3}.
\]
The primitive integer $(-3x+8z+\sqrt{-p})/2$ therefore has norm
$2^{2u+1}$ and $h(-p)\leq2u+1$.
For $0\leq x\leq\sqrt p$, the function
$\sqrt{8p+8x^2}-3x$ is positive and decreasing, so
\[
 0<-3x+8z\leq\sqrt{8p},\qquad
 2^{2u+1}\leq\frac{9p}{4}<3p.
\]
This proves the stated bound in every case.
\end{proof}

\begin{proof}[Proof of Theorem~\ref{thm:polynomial-factor-count}]
For $d\geq e^{11.2}$, Tatuzawa's Lemma~9 and the $7/8$ strip give
\[
 L(1,\chi_{-d})>\frac{0.655}{e\log d}.
\]
Indeed, its contrary inequality with $\epsilon=1/\log d$ forces
a real zero in $(1-\epsilon/4,1)$, as in the proof of
Lemma~\ref{lem:rd-class-two-cutoff}. Here the imaginary quadratic
class-number formula is $\pi h(-d)=\sqrt d L(1,\chi_{-d})$.
Lemma~\ref{lem:polynomial-factor-class-bound} consequently implies
\[
 \frac{\sqrt d}{\log d\log(3d)}
 <\frac{\pi e}{0.655\log2}<19.
\]
This is impossible for $d\geq10^8$: at that endpoint the left
side exceeds $10000/(19\cdot20)>26$, and its logarithmic derivative
is $1/2-1/\log d-1/\log(3d)>0$ thereafter. Thus $d<10^8$.

The remaining verification is an exhaustive computation with
integers. Initialize $\omega(n)=0$ for $1\leq n\leq2\cdot10^8$.
For $p=2,3,\ldots,2\cdot10^8$, if its current entry is zero,
increment the entry of every positive multiple of $p$. Such $p$
are exactly the primes: a composite already has a smaller prime
divisor, while a prime has none. The final entries are therefore
exactly the numbers of distinct prime divisors.

For every one of the $12500000$ integers $7\leq d<10^8$ with
$d\equiv7\pmod8$, test successive positive odd $x$ while $x^2\leq d$,
rejecting the value as soon as $\omega(d+x^2)>2$. Every array
access satisfies $d+x^2<2\cdot10^8$. This examines $14416679$
polynomial values in total and leaves the displayed nineteen
values together with $63,135,175,207,343$. The latter five are not
squarefree. Exact trial division of the survivors confirms that
each of the nineteen retained values is prime or a product of two
distinct primes. The program and its complete output are included
in the computational supplement.

An independent sieve, marking numbers whose odd part is one or a
power of a single odd prime, gives exactly the same test outcomes
and survivor lists. Thus the finite classification was reproduced
without using the distinct-prime-divisor counting sieve.

Cyclicity and the generator assertion follow from
Lemma~\ref{lem:polynomial-factor-class-bound}. For the precise
remaining numerical bound in the published statement, enumerate
the reduced positive definite integral binary quadratic forms of
discriminant $-d$ for the nineteen values. The class numbers, in
the displayed increasing order, are
\[
 1,2,3,3,4,5,4,5,5,5,7,7,6,7,7,8,9,9,9.
\]
This enumeration takes $1\leq a\leq\sqrt{d/3}$,
$-a\leq b\leq a$, $c=(b^2+d)/(4a)\in\mathbb Z$, $a\leq c$,
$\gcd(a,b,c)=1$, with $b\geq0$ when $|b|=a$ or $a=c$.
These are exactly the usual reduced-form representatives.
The integer inequalities $2^{h(-d)}\leq2d$ hold for every entry,
and prove the stated bound without rounding logarithms.
\end{proof}

\paragraph{The full odd-parameter list.}
Combining this theorem with the already unconditional
\cite[Theorems~1.1--1.2]{LouboutinPolynomial2026} gives the exact
classification for all odd positive $d$: besides the nineteen
values above, the values are
\[
 \{1,9,25,27,49,63,135,175,207,343\}
 \quad\text{and}\quad
 \{3,5,11,13,17,19,37,43,67,73,97,163,193\}.
\]
Thus there are $42$ odd positive parameters in total. The new
unconditional part is the formerly exceptional nineteen-value
case; the other two parts are cited published unconditional results.

\paragraph{Source and verification scope.}
The generator argument follows \cite[Section~5]{LouboutinPolynomial2026},
with its unit normalization supplied explicitly and its semiprime
generator and numerical estimates corrected above. These repairs
yield a safe preliminary bound $h(-d)\leq\log(3d)/\log2$; the exact
published bound follows after the complete enumeration. The cutoff
uses the original real-zero alternative of Tatuzawa, rather than
assuming the source's restricted Riemann hypothesis. No conclusion
is asserted for the separate even-parameter conjectures in that paper.

\section{Class-group exponents of simplest cyclic cubic fields}
\label{sec:simplest-cubic}

We use the precise convention of Louboutin \cite{LouboutinCubic}.
For an integer $m\geq-1$, put
\[
 P_m(X)=X^3-mX^2-(m+3)X-1,\qquad f_m=m^2+3m+9,
 \qquad K_m=\mathbb Q(\rho_m),\quad P_m(\rho_m)=0.
\]
Restrict to the values of $m$ for which
$\mathcal O_{K_m}=\mathbb Z[\rho_m]$. Equivalently, either
$3\nmid m$ and $f_m$ is squarefree, or $m\equiv0,6\pmod9$ and
$f_m/9$ is squarefree. For these parameters $K_m/\mathbb Q$ is
cyclic of degree $3$, has conductor $f_m$, and has discriminant $f_m^2$.
This restriction is part of the term ``simplest cubic field'' in that
paper; it must not be silently dropped.

\begin{lemma}[A small prime splitting in a cyclic cubic field]
\label{lem:cubic-split}
There is an effective absolute constant $C_2$ such that every cyclic
cubic field of conductor $f$ has a rational prime $p\nmid f$ which
splits completely and satisfies $p\leq C_2(\log(3f))^8$.
\end{lemma}
\begin{proof}
Let $\chi$ be a primitive cubic Dirichlet character associated with
the field; the other nontrivial character is $\overline\chi$.
For $p\nmid f$, complete splitting is equivalent to $\chi(p)=1$.
Adding the two instances of \eqref{eq:smoothed} and the principal
smoothed sum gives
\[
 \sum_{n\leq x}\Lambda(n)
 (1+\chi(n)+\overline\chi(n))(1-n/x)
 =\frac{x}{2}
 +O\bigl(x^{7/8}\log(3f)+x^{7/8}\log^2(2x)+\log(fx)\bigr).
\]
For an unramified prime $p$, the coefficient in parentheses is $3$
when $p$ splits completely and $0$ otherwise. If no such split prime
lies below $x$, only ramified prime powers and higher prime powers
can contribute. Their total is
\[
 O\bigl(\log(3f)\log x+\sqrt{x}\log^2(2x)\bigr),
\]
by exactly the elementary prime-power estimates used in
Lemma~\ref{lem:split-prime}. At $x=C_2(\log(3f))^8$ this contradicts
the main term when $C_2$ is sufficiently large. The estimates are
effective; a further finite enlargement handles the remaining
conductors. This proves the assertion.
\end{proof}

\begin{theorem}[Louboutin's exponent-growth conclusion]
\label{thm:simplest-cubic}
Let $e_m$ be the exponent of $\operatorname{Cl}(K_m)$ in the family
just defined. For every permitted $m\geq1$,
\[
 e_m\geq
 \frac{\log(2m+3)}{\log C_2+8\log\log(3f_m)}.
\]
In particular, effectively,
\[
 e_m\gg\frac{\log m}{\log\log m}\qquad(m\geq3),
\]
so the exponents tend to infinity and only finitely many fields in
this family have any fixed bounded class-group exponent.
\end{theorem}
\begin{proof}
The unconditional arithmetic input is
\cite[Proposition 9(1)]{LouboutinCubic}: the least absolute norm of
a nonzero principal integral ideal of $K_m$ which is not $(n)$ for a
rational integer $n\geq1$ equals $2m+3$ (we use it only for $m\geq1$).
Louboutin derives this from the minimum-norm theorem of
Lemmermeyer--Peth\H{o} \cite[Theorem 1]{LemmermeyerPetho}.

Choose $p$ as in Lemma~\ref{lem:cubic-split}. Its factorization is
$(p)=\mathfrak p_1\mathfrak p_2\mathfrak p_3$, with three distinct
prime ideals of norm $p$. Since $e_m$ annihilates the class group,
$\mathfrak p_1^{e_m}$ is a principal integral ideal. It cannot equal
$(n)$ for a positive rational integer $n$: a rational integer has
equal valuations at the three primes above $p$, whereas this ideal
has valuations $(e_m,0,0)$. Its norm is therefore at least $2m+3$,
so
\[
 2m+3\leq p^{e_m}\leq
 \bigl(C_2(\log(3f_m))^8\bigr)^{e_m}.
\]
Taking logarithms gives the displayed bound. Since $f_m\asymp m^2$,
the claimed order of magnitude and divergence follow. For fixed
$E$, the inequality
$2m+3\leq(C_2(\log(3f_m))^8)^E$ places $m$ in an effective finite
interval; the two excluded small parameters $-1,0$ cause no issue.
\end{proof}

This is the full order-of-magnitude conclusion of the formerly
GRH-dependent \cite[Proposition 9(4)]{LouboutinCubic}. The paper's
separate exact five-field classification for exponent $2$ used a
stronger numerical cutoff; its completeness does not follow just by
replacing that cutoff by a qualitative logarithmic bound. Also, the
paper's exponent-$3$ classification was already unconditional and is
not counted as a new consequence here.

% LouboutinCubic: S. Louboutin, The exponent three class group problem
% for some real cyclic cubic number fields, Proc. Amer. Math. Soc.
% 130 (2002),353--361. DOI 10.1090/S0002-9939-01-06168-8.
% Author uploaded full text:
% https://www.researchgate.net/publication/344903006_The_exponent_three_class_group_problem_for_some_real_cyclic_cubic_number_fields
% LemmermeyerPetho: F. Lemmermeyer and A. Petho, Simplest cubic fields,
% Manuscripta Math.88(1995),53--58.

\section{Daileda's class-number bound for pure cubic fields}
\label{sec:pure-cubic-class}

This application uses the full finite-order Hecke statement of
\cite[Theorem 1.1]{OAI}, rather than only its Dirichlet consequence:
for $K_0=\mathbb Q(\sqrt{-3})$, every finite-order Hecke $L$-function
over $K_0$ has no zero in $\Re s>7/8$. The primitive characters used
below have order three. Their conductors vary, while their base field
is always $K_0$.

\begin{lemma}[The $L(1)$ upper bound over the Eisenstein field]
\label{lem:eisenstein-L1}
Let $\eta$ be a nonprincipal primitive finite-order Hecke character of
$K_0$, of conductor $\mathfrak f$, and put
$Q=3\mathrm N\mathfrak f$. Then
\[
 |L_{K_0}(1,\eta)|\ll \ell(Q),
\]
with an absolute effective implied constant.
\end{lemma}
\begin{proof}
Extend $\eta$ by zero on ideals not coprime to $\mathfrak f$.
For a nonzero integral ideal $\mathfrak a$, put
$\Lambda_{K_0}(\mathfrak a)=\log\mathrm N\mathfrak p$ if
$\mathfrak a=\mathfrak p^j$ for a prime ideal $\mathfrak p$ and $j\geq1$,
and put it equal to zero otherwise. Define
\[
 \Psi_\eta(x)=\sum_{\mathrm N\mathfrak a\leq x}
             \Lambda_{K_0}(\mathfrak a)\eta(\mathfrak a).
\]
The completed Hecke $L$-function has degree two, conductor $Q$, and a
fixed complex gamma factor, because a finite-order character has trivial
archimedean type. Its functional equation relates $\eta$ and
$\overline\eta$. Thus its nontrivial zeros lie in
$1/8\leq\Re\rho\leq7/8$, and its ordinary zero count is
\[
 \#\{\rho:|\Im\rho|\leq T\}
       \ll (T+1)\log\bigl(Q(T+2)\bigr).
\]
The unconditional truncated explicit formula consequently gives
\begin{equation}\label{eq:eisenstein-psi}
 \Psi_\eta(x)\ll x^{7/8}\log^2(Qx)\qquad(x\geq2).
\end{equation}
Here is the uniformity argument. At a half-integer $x$, take a permissible
height $T\asymp x$ in the explicit formula. Its zero sum is
$-\sum_{|\Im\rho|\leq T}x^\rho/\rho$; the error and the contributions
at zero are $O(\log^2(Qx))$. The zero count and $\Re\rho\geq1/8$ bound
$\sum_{|\Im\rho|\leq T}|\rho|^{-1}$ by $O(\log^2(Q(T+2)))$.
The constant term at zero is $O(\log Q)$: subtract the completed
logarithmic derivatives at $1$ and $2$, whose zero contributions are
bounded absolutely by
$\sum_\rho |(1-\rho)(2-\rho)|^{-1}\ll\log Q$, and then use the
functional equation and the absolutely convergent series at $2$.
Finally, the coefficient of a rational prime power $p^j$ in
$-L'_{K_0}/L_{K_0}$ has absolute value at most $2\log p$.
Moving to a neighboring half-integer therefore costs only $O(\log(2x))$.
These are precisely the explicit-formula arguments of
Lemma~\ref{lem:psi}, with fixed degree two in place of degree one.

The Euler-product logarithm and summation by parts, using
\eqref{eq:eisenstein-psi}, now give
\begin{equation}\label{eq:eisenstein-logL}
 \log L_{K_0}(1,\eta)
 =\sum_{\mathrm N\mathfrak a\leq y}
   \frac{\Lambda_{K_0}(\mathfrak a)\eta(\mathfrak a)}
        {\mathrm N\mathfrak a\log\mathrm N\mathfrak a}
 +O\left(\frac{y^{-1/8}\log^2(Qy)}{\log y}\right).
\end{equation}
As in Lemma~\ref{lem:logL}, the logarithm is continued from the Euler
product on the positive real interval $s>1$. The same tail integral
proves convergence and the stated error; there is no pole because
$\eta$ is nonprincipal.

The untwisted positive sum on the right has coefficient one:
\begin{equation}\label{eq:eisenstein-mertens}
 \sum_{\mathrm N\mathfrak a\leq y}
   \frac{\Lambda_{K_0}(\mathfrak a)}
        {\mathrm N\mathfrak a\log\mathrm N\mathfrak a}
     =\log\log y+O(1).
\end{equation}
Indeed, higher powers contribute $O(1)$; rational primes
$p\equiv1\pmod3$ give two prime ideals of norm $p$, rational primes
$p\equiv2\pmod3$ give one prime ideal of norm $p^2$, and the only
ramified rational prime is $3$. Hence the sum is
$2\sum_{p\leq y,\ p\equiv1\ (3)}p^{-1}+O(1)
=\log\log y+O(1)$, by the unconditional Mertens estimate for the fixed
progression $1\pmod3$.

Take $y=(\log(3Q))^{24}$ in \eqref{eq:eisenstein-logL}.
Its error is bounded absolutely. Taking real parts, using
$\Re\eta(\mathfrak a)\leq1$, and applying
\eqref{eq:eisenstein-mertens} gives
$\log|L_{K_0}(1,\eta)|\leq\log\log y+O(1)$.
Exponentiation proves the lemma.
\end{proof}

\begin{theorem}[Daileda's pure cubic bound, without GRH]
\label{thm:pure-cubic-class}
There is an effective absolute constant $C$ such that every pure cubic
number field $F=\mathbb Q(\sqrt[3]{m})$ of degree three, with absolute
discriminant $D_F$ and ideal class number $h_F$, satisfies
\[
 h_F\leq C\,\frac{\sqrt{D_F}\,\ell(D_F)}{\log D_F}.
\]
For $D_F\to\infty$ this is the exact order of magnitude of the
GRH-conditional pure cubic conclusion of
\cite[Proposition 3, p.~243]{Daileda2006}.
\end{theorem}
\begin{proof}
Replacing $m$ by a rationally equivalent radicand, take $m$ to be a
positive cube-free integer. The splitting field
$N=F(\zeta_3)$ has group $S_3$ over $\mathbb Q$ and is cyclic of
degree three over $K_0$. If $\eta$ is either nontrivial character of
$\operatorname{Gal}(N/K_0)$, viewed by class field theory as a primitive
finite-order Hecke character, Artin induction gives
\begin{equation}\label{eq:pure-cubic-factor}
 \zeta_F(s)=\zeta(s)L_{K_0}(s,\eta).
\end{equation}
Explicitly, the degree-three permutation representation of $S_3$ is
the sum of the trivial representation and the irreducible representation
$\operatorname{Ind}_{A_3}^{S_3}\eta$. Induction of Artin $L$-functions
therefore proves \eqref{eq:pure-cubic-factor} at every prime, including
ramified primes. The conductor-discriminant formula for this permutation
representation gives
\[
 D_F=3\mathrm N\mathfrak f_\eta.
\]
Equivalently, the degree-two Artin $L$-function in
\cite[Lemma 7]{Daileda2006} has conductor $D_F$ and is the finite-order
Hecke $L$-function over $K_0$ just described. This identification requires
neither the Artin conjecture nor GRH.

The signature of $F$ is $(1,1)$ and its only roots of unity are
$\{1,-1\}$. Taking residues at $1$ in
\eqref{eq:pure-cubic-factor}, the analytic class-number formula yields
\begin{equation}\label{eq:pure-cubic-class-formula}
 h_F=\frac{\sqrt{D_F}}{2\pi R_F}L_{K_0}(1,\eta),
\end{equation}
where $R_F$ is the regulator. The value on the right is positive, as is
also immediate from the positive residue of $\zeta_F$.

For completeness, the required regulator lower bound has a direct proof.
Choose the fundamental unit $\epsilon$ positive and greater than $1$
in the unique real embedding; then $R_F=\log\epsilon$ and
$\mathrm N_{F/\mathbb Q}\epsilon=1$. Its other conjugates are
$z,\overline z$, with $|z|=\epsilon^{-1/2}$. The unit is not rational,
so it has degree three and $\mathbb Z[\epsilon]$ is an order in $F$.
Consequently
\[
 D_F\leq |\operatorname{disc}(\epsilon)|
 =|\epsilon-z|^4|z-\overline z|^2
 \leq4\epsilon^{-1}(\epsilon+\epsilon^{-1/2})^4
 \leq64\epsilon^3.
\]
Moreover, the nonzero integer
$\mathrm N_{F/\mathbb Q}(1-\epsilon)$ has absolute value
$(\epsilon-1)|1-z|^2\leq4(\epsilon-1)$, so
$\epsilon\geq5/4$. It follows that
\[
 \log D_F\leq\log64+3R_F
 \leq\left(3+\frac{\log64}{\log(5/4)}\right)R_F.
\]
Thus $R_F\gg\log D_F$ with an explicit positive constant.
Apply Lemma~\ref{lem:eisenstein-L1} with $Q=D_F$ to
\eqref{eq:pure-cubic-class-formula} to finish the proof.
\end{proof}

The distinction between one and two powers of $\log\log D_F$ matters.
A crude degree-two Euler-product majorant would lose this distinction.
Here the fixed quadratic resolvent $K_0$ gives
\eqref{eq:eisenstein-mertens}, which supplies the single power needed
in Daileda's published pure cubic bound. The more general assertions in
his Proposition 3 for arbitrary cubic fields have varying quadratic
resolvent fields and are not asserted here.

\section{The mean least completely split prime in cyclic fields}
\label{sec:mean-split-prime}

Fix an odd prime $l$, and let $\mathcal K_l(X)$ be the set of cyclic
extensions $K/\mathbb Q$ of degree $l$ with conductor $f_K\leq X$.
Write $N_l(X)=\#\mathcal K_l(X)$, and let $r_K$ be the least rational
prime that splits completely in $K$. In particular, a ramified prime
does not qualify. Define, for rational primes $q$,
\[
 c_l(q)=
 \begin{cases}
  (l^2-1)/(l^2+l-1),&q=l,\\
  \displaystyle\frac{l-1}{l}\frac{q+l}{q+l-1},&q\equiv1\pmod l,\\
  (l-1)/l,&q\ne l,\ q\not\equiv1\pmod l.
 \end{cases}
\]
These numbers include the contribution of ramification in the
probability of failing to split completely.

\begin{theorem}[Pollack's mean-value theorem]\label{thm:mean-split-prime}
For every fixed odd prime $l$,
\[
 \lim_{X\to\infty}\frac{1}{N_l(X)}
     \sum_{K\in\mathcal K_l(X)}r_K
  =\Delta_l:=\sum_{p\ {\mathrm{prime}}}p(1-c_l(p))
                      \prod_{q<p}c_l(q).
\]
The series converges. The same mean results when the fields are
ordered by discriminant. This is the conclusion of
\cite[Theorem~1.2]{PollackCyclic}, with its RH assumptions removed.
The case $l=3$ was already unconditional in that paper, so the
new cases of this transfer are $l\geq5$.
\end{theorem}
\begin{proof}
We first prove the uniform estimate replacing the sole RH input
in Pollack's argument. A field $K$ as above corresponds to $l-1$
primitive Dirichlet characters of order $l$ and conductor $f_K$.
Choose one, $\chi$. Every $\chi^j$, $1\leq j<l$, is primitive
of the same conductor: its kernel is the kernel of $\chi$.
For $p\nmid f_K$, character orthogonality gives
\[
 \mathbf1_{\{p\ {\text{splits completely in}}\ K\}}
       =\frac1l\sum_{j=0}^{l-1}\chi(p)^j.
\]
In the term $j=0$ we use the principal character modulo $f_K$,
so that the average is zero at integers not coprime to $f_K$.
Apply \eqref{eq:smoothed} to the $l-1$ nonprincipal characters,
and Lemma~\ref{lem:psi} followed by integration to the principal
term. After removing powers $p^a$ with $a\geq2$, this yields
\begin{align*}
 &\sum_{\substack{p\leq y\\p\ {\rm splits\ completely\ in}\ K}}
                      \log p(1-p/y)\\
 &\quad=\frac{y}{2l}
  +O_l\bigl(y^{7/8}\log(3f_K)+y^{7/8}\log^2(2y)
       +\log(3f_K)\log(2y)+\sqrt y\log^2(2y)\bigr).
 \end{align*}
Here powers of primes dividing $f_K$ contribute at most
$O(\log(3f_K)\log(2y))$, while all powers with exponent at
least two contribute $O(\sqrt y\log^2(2y))$.
Put $y=C_l(\log(3f_K))^8$. The ratio of the first error term to
$y$ is $O_l(C_l^{-1/8})$; the remaining ratios tend effectively
to zero as $f_K\to\infty$. Choose $C_l$ large enough, and enlarge
it effectively for the finitely many remaining conductors. The
displayed sum is positive, proving
\begin{equation}\label{eq:cyclic-small-split}
 r_K\leq C_l(\log(3f_K))^8.
\end{equation}
The finite enlargement can, for example, be made by enumerating
the primitive order-$l$ characters of the bounded conductors and
testing successive primes; Dirichlet's theorem guarantees termination.

We next state exactly the unconditional counting results imported
from \cite{PollackCyclic}. Its Lemma~2.1 gives
$N_l(X)\sim a_lX$ with $a_l>0$. Its Lemma~3.1 gives, for every
fixed finite set $Q$ of rational primes,
\begin{equation}\label{eq:pollack-local}
 \frac{\#\{K\in\mathcal K_l(X):
             \text{no }q\in Q\text{ splits completely in }K\}}
      {N_l(X)}\longrightarrow\prod_{q\in Q}c_l(q).
\end{equation}
Finally its Lemma~3.2, together with the $(l-1)$-to-one
character--field correspondence, gives constants $b_l,c_l'>0$
such that, for $2\leq u\leq(10l^2)^{-1}\log X$,
\begin{equation}\label{eq:pollack-tail}
 \#\{K\in\mathcal K_l(X):r_K\geq u\}
       \leq b_lX\exp(-c_l'u/\log u).
\end{equation}
These lemmas are unconditional. The higher reciprocity and
Chebotarev arguments used to prove them are qualitative
equidistribution statements for each fixed auxiliary field;
they do not invoke an RH bound for those fields. In particular
no zero-free theorem for general Kummer extensions is being assumed.

Fix $z\geq2$. By applying \eqref{eq:pollack-local} first to all
primes below $p$, and then to all primes at most $p$, subtraction gives
\[
 \lim_{X\to\infty}\frac{\#\{K\in\mathcal K_l(X):r_K=p\}}{N_l(X)}
       =(1-c_l(p))\prod_{q<p}c_l(q).
\]
There are only finitely many primes $p\leq z$, so their contribution
to the mean tends to the corresponding partial sum defining $\Delta_l$.

To justify passage from partial sums to the full mean, set
$u_X=(10l^2)^{-1}\log X$. For $X$ large enough that $u_X>z$,
\eqref{eq:pollack-tail} bounds the first part of the remaining sum by
\[
 \frac1{N_l(X)}\sum_{\substack{K\in\mathcal K_l(X)\\z<r_K\leq u_X}}r_K
 \ll_l\sum_{\substack{p>z\\p\ {\rm prime}}}
                         p\exp(-c_l'p/\log p).
\]
The series on the right converges, as is seen by comparison with
$\sum_{m\geq2}m\exp(-c_l'm/\log m)$, and its tail tends to zero
as $z\to\infty$. For the second part, use
\eqref{eq:cyclic-small-split} for every $f_K\leq X$ and
\eqref{eq:pollack-tail} at $u_X$:
\[
 \frac1{N_l(X)}\sum_{\substack{K\in\mathcal K_l(X)\\r_K>u_X}}r_K
 \ll_l (\log(3X))^8\exp(-c_l'u_X/\log u_X)=o(1).
\]
Consequently the tails of the finite means vanish uniformly after
taking $\limsup_{X\to\infty}$ and then $z\to\infty$.

For completeness, $c_l(q)\leq\rho_l<1$ for every sufficiently
large prime $q$. Thus the $p$th summand in $\Delta_l$ is at most
$O_l(p\rho_l^{\pi(p)})$. The elementary lower bound
$\pi(t)\gg t/\log t$ proves convergence directly. Combining
this convergence with the preceding tail estimates proves the
asserted limit. Finally the conductor--discriminant formula is
$|D_K|=f_K^{l-1}$, so changing from a discriminant cutoff to a
conductor cutoff only replaces $X$ by $X^{1/(l-1)}$.
\end{proof}

% PollackCyclic: P. Pollack, The smallest inert prime in a cyclic number
% field of prime degree, Math. Res. Lett.20(2013),163--179.
% DOI:10.4310/MRL.2013.v20.n1.a13.
% Published primary PDF:
% https://intlpress.com/site/pub/files/_fulltext/journals/mrl/2013/0020/0001/MRL-2013-0020-0001-a013.pdf
% The old author PDF has an obsolete 2011 placeholder header; the final
% citation above is verified against the publisher and the author's CV.

\section{The upper order of CM torsion in odd degrees}\label{sec:cm-torsion}

For a positive integer $d$, let $T_{\mathrm{CM}}(d)$ be the largest
cardinality of $E(F)_{\mathrm{tors}}$, where $F$ ranges over number
fields of degree $d$ and $E/F$ ranges over elliptic curves with complex
multiplication. The order of complex multiplication is allowed to be
nonmaximal. Bourdon and Pollack \cite[Theorem~1.3]{BP} determined,
under GRH, the upper order of this function on odd degrees. We recover
that order of magnitude; the numerical constant in their GRH upper
bound is not claimed.

\begin{theorem}\label{thm:cm-torsion}
There is an effective absolute constant $C$ such that, for every odd
positive integer $d$,
\[
 T_{\mathrm{CM}}(d)\leq C\bigl(d\ell(d)\bigr)^{2/3}.
\]
Moreover,
\[
 0<\limsup_{\substack{d\to\infty\\ d\text{ odd}}}
 \frac{T_{\mathrm{CM}}(d)}{(d\log\log d)^{2/3}}<\infty.
\]
\end{theorem}
\begin{proof}
We state precisely the unconditional algebraic input. The Strong Odd
Degree Theorem \cite[Theorems~1.1--1.2]{BP} implies that the torsion
group has order at most $4$, or is cyclic of order $p^n$ or $2p^n$,
where $p\equiv3\pmod4$ is prime and $n\geq1$. Write
$h_p=h(\mathbb Q(\sqrt{-p}))$. If $p>3$, then in either cyclic case
\begin{equation}\label{eq:cm-degree}
 h_p\frac{p-1}{2}p^{\lfloor3n/2\rfloor-1}\mid d.
\end{equation}
The source gives an additional factor $3$ in some cases; omitting that
factor only weakens the necessary divisibility used here. If $p=3$
and $n\geq2$, it gives
\begin{equation}\label{eq:cm-three}
 3^{\lfloor3n/2\rfloor-2}\mid d.
\end{equation}
For $p=3,n=1$, the torsion order is at most $6$. These statements hold
for every CM order, including the nonmaximal orders that can achieve
the smallest degrees.

Suppose first that $p>3$. Since $-p$ is a negative fundamental
discriminant, Corollary~\ref{cor:class} yields the effective bound
\[
 h_p\gg\frac{\sqrt p}{\ell(p)}.
\]
Using $(p-1)/2\geq p/3$ and
$\lfloor3n/2\rfloor+1/2\geq3n/2$ for integral $n$, we obtain
from \eqref{eq:cm-degree}
\[
 d\geq h_p\frac{p-1}{2}p^{\lfloor3n/2\rfloor-1}
 \gg \frac{p^{\lfloor3n/2\rfloor+1/2}}{\ell(p)}
 \geq\frac{p^{3n/2}}{\ell(p)}.
\]
Also, $h_p\geq1$ and $\lfloor3n/2\rfloor-1\geq0$ show
that $p\leq2d+1$. The function $\ell$ is increasing and satisfies
$\ell(2d+1)\ll\ell(d)$ for $d\geq1$. Consequently
\[
 p^{3n/2}\ll d\ell(d),\qquad
 \#E(F)_{\mathrm{tors}}\leq2p^n
 \ll\bigl(d\ell(d)\bigr)^{2/3}.
\]

For $p=3,n\geq2$, \eqref{eq:cm-three} and
$\lfloor3n/2\rfloor\geq3n/2-1/2$ imply
\[
 d\geq3^{3n/2-5/2},\qquad
 \#E(F)_{\mathrm{tors}}\leq2\cdot3^n
 \leq2\cdot3^{5/3}d^{2/3}.
\]
The bounded torsion cases are absorbed into the absolute constant.
This proves the asserted uniform upper bound, and hence the finiteness
of the limsup.

For completeness, the positivity of the limsup was already
unconditional in \cite[Theorem~1.3(1)]{BP}. Its mechanism is as
follows. Joshi's theorem \cite[Theorem~1]{Joshi}, in the form recorded
in \cite[Proposition~3.1]{BP}, supplies infinitely many primes
$p\equiv3\pmod4$, tending to infinity, such that
\[
 L(1,\chi_{-p})\ll\frac1{\log\log p}.
\]
Set $d_p=h_p(p-1)/2$. Genus theory gives $h_p$ odd, since $-p$
has one prime discriminant factor; thus $d_p$ is odd. Dirichlet's
class number formula, for $p>3$, gives
\[
 d_p=\frac{\sqrt p}{\pi}L(1,\chi_{-p})\frac{p-1}{2}
 \ll\frac{p^{3/2}}{\log\log p}.
\]
The Strong Odd Degree Theorem shows that a cyclic group of order $p$
is realized in degree $d_p$ when $p\equiv3\pmod8$, and one of order
$2p$ is realized in degree $d_p$ when $p\equiv7\pmod8$. In particular
$T_{\mathrm{CM}}(d_p)\geq p$. Since $d_p\geq(p-1)/2$,
the degrees $d_p$ tend to infinity. The preceding two inequalities
give
$\log\log d_p=\log\log p+O(1)$, and therefore
\[
 d_p\log\log d_p\ll p^{3/2},\qquad
 T_{\mathrm{CM}}(d_p)\gg(d_p\log\log d_p)^{2/3}.
\]
This proves positivity.
\end{proof}

\paragraph{Comparison with the published statement.}
Theorem~\ref{thm:cm-torsion} proves the qualitative upper-order
conclusion of \cite[Theorem~1.3]{BP}. The already unconditional lower
bound there gives the more precise lower limsup constant
$(12e^\gamma/\pi)^{2/3}$. Its upper limsup constant
$(24e^\gamma/\pi)^{2/3}$ uses Littlewood's numerical GRH constant,
which is not supplied by the fixed zero-free strip. The previously
unconditional all-odd-degree estimate in that paper was
$T_{\mathrm{CM}}(d)\ll_\varepsilon d^{2/3+\varepsilon}$; the proof
above replaces it by the published GRH order of magnitude.

% Bibliography additions:
% \bibitem{BP} A. Bourdon and P. Pollack, Torsion subgroups of CM
% elliptic curves over odd degree number fields, International
% Mathematics Research Notices 2017 (2017), no. 16, 4923--4961.
% DOI: 10.1093/imrn/rnw163. https://arxiv.org/abs/1601.00351
% \bibitem{Joshi} P. T. Joshi, The size of L(1,chi) for real
% nonprincipal residue characters chi with prime modulus,
% Journal of Number Theory 2 (1970), 58--73.

% Bibliography:
% \bibitem{CGPS2022} P. L. Clark, T. Genao, P. Pollack and F. Saia,
% The least degree of a CM point on a modular curve,
% J. London Math. Soc. (2) 105 (2022), 825--883,
% doi:10.1112/jlms.12518.
% Final published PDF: work/source/cm-least-degree2022.pdf.
% Author errata, May 4, 2026:
% https://www.pollack-math.net/leastdeg-errata.pdf.

\section{The typical least degree of a CM point on a modular curve}
\label{sec:typical-cm-degrees}

For a modular curve $X/\mathbb Q$, let $d_{\rm CM}(X)$ be the
least residue-field degree over $\mathbb Q$ of a noncuspidal
closed point represented by an elliptic curve with complex
multiplication. For a negative quadratic-order discriminant
$\Delta$, let $d_{\Delta,{\rm CM}}(X)$ denote the corresponding
minimum with endomorphism order of discriminant $\Delta$.
The curves $X_0(N)$ and $X_1(N)$ classify, respectively, elliptic
curves with a cyclic subgroup of order $N$ and with a point of
order $N$. All orders, including nonmaximal orders, are permitted.

Clark--Genao--Pollack--Saia proved the following two assertions
under GRH \cite[Theorem~1.7]{CGPS2022}. The proof below preserves
their exact typical exponent. Their sharper maximal-order
estimates in Theorems~1.3 and~1.5 are separate assertions and
are not being transferred here.

\begin{theorem}[The published typical-degree conclusions]
\label{thm:typical-cm-degrees}
For every $\epsilon>0$, all but $o(x)$ positive integers $N\leq x$
satisfy both
\[
 2^{(1/2-\epsilon)\log\log x}
 \leq d_{\rm CM}(X_0(N))
 \leq 2^{(1/2+\epsilon)\log\log x}
\]
and
\[
 N\,2^{(1/2-\epsilon)\log\log x}
 \leq d_{\rm CM}(X_1(N))
 \leq N\,2^{(1/2+\epsilon)\log\log x}.
\]
\end{theorem}

\begin{proof}
We reproduce the counting argument of
\cite[\S5.6]{CGPS2022}, with the analytic estimates replaced
explicitly. All logarithms in this proof are natural.
It suffices by monotonicity to prove the assertions for
$0<\epsilon<1/4$.

\emph{The algebraic inputs.}
Write $h_\Delta$ for the proper class number of the order.
For squarefree $B$, put
$B_-=\prod_{p\mid B,\;(\Delta/p)=-1}p$, where the symbols are
Kronecker symbols, and put
$\psi_0(B)=B\prod_{p\mid B}(1+1/p)$.
The unconditional algebraic results
\cite[Lemma~4.4 and Proposition~4.6]{CGPS2022} give
\begin{align}
 d_{\Delta,{\rm CM}}(X_0(B))
       &\asymp h_\Delta\psi_0(B_-),\qquad B\ \text{squarefree},
       \label{eq:cmtyp-algebra}\\
 \frac{\phi(N)}6d_{\rm CM}(X_0(N))
       &\leq d_{\rm CM}(X_1(N))
        \leq\frac{\phi(N)}2d_{\rm CM}(X_0(N)),\qquad N\geq3.
       \label{eq:cmtyp-tower}
\end{align}
The constants in the first line are absolute and uniform in
$\Delta$ and $B$. Also, if $\Delta$ is fundamental and
$(\Delta/p)=1$ for every $p\mid N$, then
\begin{equation}\label{eq:cmtyp-heegner}
 d_{\rm CM}(X_0(N))\leq2h_\Delta.
\end{equation}
Indeed, over the Hilbert class field $H$ of
$K=\mathbb Q(\sqrt\Delta)$, an elliptic curve with CM by
$\mathcal O_K$ has a cyclic $N$-isogeny: choose at each
$p^a\Vert N$ one of the two split prime ideals, to the power
$a$, and multiply them. The resulting ideal $I$ satisfies
$\mathcal O_K/I\cong\mathbb Z/N\mathbb Z$, and its ideal
isogeny is defined over $H$. Since $[H:\mathbb Q]=2h_\Delta$,
this proves \eqref{eq:cmtyp-heegner}, the fundamental-discriminant
case of \cite[Proposition~4.7]{CGPS2022}.
For $B\mid N$, forgetting part of the level structure gives
$d_{\Delta,{\rm CM}}(X_0(B))
 \leq d_{\Delta,{\rm CM}}(X_0(N))$.

Theorem~\ref{thm:L1} and the order class-number formula give,
with $b(t)=\log\log(3t)$,
\begin{equation}\label{eq:cmtyp-class}
 \frac{c\sqrt{|\Delta|}}{b(|\Delta|)^2}
       \leq h_\Delta
       \leq C\sqrt{|\Delta|}\,b(|\Delta|)^2
\end{equation}
for every negative order discriminant. To check the lower
bound as well as the upper bound, write $\Delta=f^2D$ with
$D$ fundamental and use
\[
 h_\Delta
 =\frac{f h_D}{[\mathcal O_D^\times:\mathcal O_\Delta^\times]}
       \prod_{p\mid f}\left(1-\frac{\chi_D(p)}p\right),
 \qquad
 1\leq[\mathcal O_D^\times:\mathcal O_\Delta^\times]\leq3.
\]
The product lies between $\phi(f)/f$ and $f/\phi(f)$;
$f/\phi(f)\ll b(f)$ proves \eqref{eq:cmtyp-class}.
This includes the unit correction recorded in the authors'
May~2026 errata.

\emph{The prime estimates.}
For every nonprincipal Dirichlet character modulo $m$, including
an imprimitive one, Lemma~\ref{lem:psi} implies
\begin{equation}\label{eq:cmtyp-primes}
 \sum_{p\leq t}\chi(p)\ll t^{7/8}\log^2(3mt).
\end{equation}
Pass first to the primitive character, remove prime powers,
and then apply partial summation; the primes dividing $m$
contribute at most $O(\log(3m))$ and are absorbed.
Consequently $\sum_p\chi(p)/p$ converges and, uniformly for
$T\geq Z\geq2$,
\begin{equation}\label{eq:cmtyp-tail}
 \left|\sum_{Z<p\leq T}\frac{\chi(p)}p\right|
       \ll Z^{-1/8}\log^2(3mZ).
\end{equation}
This follows by bounding the tail to infinity using
\eqref{eq:cmtyp-primes}. In particular its full sum has
absolute value at most
\begin{equation}\label{eq:cmtyp-total}
 \log\log\log(3m)+O(1),
\end{equation}
after changing the absolute constant for bounded $m$:
split at $Z=(\log(3m))^{32}$, bound the initial segment by
$\sum_{p\leq Z}1/p$, and apply \eqref{eq:cmtyp-tail}.
These are the replacements for the GRH estimates in
\cite[Lemma~5.7]{CGPS2022}.

\emph{The lower typical bound.}
Fix $0<\epsilon<1/4$, let $L=\log\log x$, and restrict to
\begin{equation}\label{eq:cmtyp-omega}
 |\omega(N)-L|\leq\sqrt L\log L.
\end{equation}
The Hardy--Ramanujan theorem excludes only $o(x)$ integers.
Suppose
$d_{\rm CM}(X_0(N))<2^{(1/2-\epsilon)L}$ and choose the
discriminant of a point achieving that degree. Apply
\eqref{eq:cmtyp-algebra} to $B=\operatorname{rad}(N)$.
Since $h_\Delta\geq1$, \eqref{eq:cmtyp-algebra} and
\eqref{eq:cmtyp-class} show, for sufficiently large $x$,
that
\begin{equation}\label{eq:cmtyp-lowerconditions}
 |\Delta|<2^{(1-\epsilon)L},\qquad
 (\Delta/p)\ne-1\quad
       \text{if }p\mid N,\ p>2^{L/2}.
\end{equation}
For the first conclusion one may first invert
$\sqrt t/b(t)^2\ll2^{(1/2-\epsilon)L}$ to get
$t\leq\exp(O(L))$; its logarithmic denominator is then
$\exp(o(L))$, which gives the asserted margin $\epsilon L$.
For the second, a single such inert prime would make the
degree $\gg p>2^{L/2}$, a contradiction.

For each $\Delta$ in this range let $\mathcal P_\Delta$ be
the primes $p\leq x$ for which either $p\leq2^{L/2}$ or
$(\Delta/p)\ne-1$. Equations \eqref{eq:cmtyp-tail} and
\eqref{eq:cmtyp-total}, Mertens' estimate, and
$\sum_{p\mid\Delta}1/p\ll\log\log(3|\Delta|)$ give
\begin{equation}\label{eq:cmtyp-halfharmonic}
 \sum_{p\in\mathcal P_\Delta}\frac1p
       \leq \frac L2+O(\log L).
\end{equation}
For clarity, use
$\boldsymbol 1_{(\Delta/p)\ne-1}
 =(1+\chi_\Delta(p))/2+\boldsymbol1_{p\mid\Delta}/2$,
and enlarge the set by all the small primes.

We use the unconditional restricted Hardy--Ramanujan inequality
\cite[Lemma~5.8]{CGPS2022}: there are absolute $A,B>0$ such
that for any prime set $\mathcal P\subseteq[2,x]$ and $k\geq1$,
\[
 \#\{n\leq x:\omega(n)=k,\ p\mid n\Rightarrow p\in\mathcal P\}
 \leq\frac{Ax}{\log x}\,
       \frac{(\sum_{p\in\mathcal P}p^{-1}+B)^{k-1}}{(k-1)!}.
\]
For $k=L+O(\sqrt L\log L)$, Stirling's formula and
\eqref{eq:cmtyp-halfharmonic} bound the right side by
$x\exp(-(\log2+o(1))L)$, uniformly in $\Delta$.
Indeed the logarithm of its factor after $x$ is
$-L+k(1+\log((L/2+O(\log L))/k))+O(\log L)
 =-(\log2)L+o(L)$.
There are at most $2^{(1-\epsilon)L}$ choices of $\Delta$
and $\exp(o(L))$ choices of $k$. The total is
$x\exp(-(\epsilon\log2+o(1))L)=o(x)$.
This proves the lower bound.

\emph{Preparation for the upper bound.}
Keep $0<\epsilon<1/4$ and put
\[
 \theta=(1+\epsilon)\log2,\qquad
 U=(\log x)^\theta,\qquad z=\exp(\sqrt L).
\]
In addition to \eqref{eq:cmtyp-omega}, restrict to integers
$N\leq x$ for which the largest squarefull divisor is at
most $L$, the largest divisor composed of primes at most
$z$ is at most $z^{\log L}$, and
$P^+(N)>x^{1/L}$. Here $P^+$ and $P^-$ denote largest and
least prime factors, with $P^+(1)=1$ and $P^-(1)=\infty$.
Each restriction removes $o(x)$ integers, as follows.
The squarefull restriction removes at most
$x\sum_{s>L,\ s\ {\rm squarefull}}s^{-1}\ll x/\sqrt L$.
For the second, the average logarithm of the $z$-smooth
part is at most
$\sum_{p\leq z}\sum_{a\geq1}(\log p)/p^a\ll\log z$,
so Markov's inequality gives $O(x/\log L)$ exceptions.
Finally set $y=x^{1/L}$ and $\sigma=1-1/\log y$.
Rankin's bound gives
\[
 \#\{N\leq x:P^+(N)\leq y\}
 \leq x^\sigma\prod_{p\leq y}(1-p^{-\sigma})^{-1}
 \ll x e^{-L}\log y =x/L.
\]
The product bound follows from Mertens' theorem at $\sigma=1$:
its logarithm changes by $O(1)$ when $\sigma$ moves to
$1-1/\log y$, because
$\sum_{p\leq y}(\log p)/p\ll\log y$ and
$p^{1/\log y}\leq e$.

Let $\mathcal D$ be the negative fundamental discriminants
with $U/2<|\Delta|<U$.
We will prove that, except for $o(x)$ of these admissible
$N$, some $\Delta\in\mathcal D$ satisfies
$(\Delta/p)=1$ for every $p\mid N$. Equations
\eqref{eq:cmtyp-heegner} and \eqref{eq:cmtyp-class} then give
\[
 d_{\rm CM}(X_0(N))
       \ll U^{1/2}(\log L)^2
       <2^{(1/2+\epsilon)L}
\]
for sufficiently large $x$.

Write
$N=p_0p_1\cdots p_k$, where $p_0$ is its entire $z$-smooth
part and $z<p_1<\cdots<p_k$ are primes. The squarefull
restriction ensures that these large primes occur only once.
The largest-prime restriction ensures $k\geq1$, and
\eqref{eq:cmtyp-omega} gives $k\leq L+o(L)$.
For $0\leq i\leq k$, let $\mathcal D_i$ contain those
$\Delta\in\mathcal D$ splitting all primes dividing
$p_0p_1\cdots p_i$.
Uniformly in $p_0\leq z^{\log L}=(\log x)^{o(1)}$,
\begin{equation}\label{eq:cmtyp-initial}
 |\mathcal D_0|\geq(\log x)^{\theta-o(1)}.
\end{equation}
To see this, count the negative squarefree integers
$\Delta\equiv1\pmod{8p_0}$ in the interval in question.
They are fundamental and split $2$ and every odd prime
dividing $p_0$. For $M_0=8p_0$, elementary Möbius inversion
gives their number as
\[
 \frac{U}{2M_0}\prod_{p\nmid M_0}(1-p^{-2})+O(\sqrt U).
\]
Indeed, only square divisors coprime to $M_0$ can occur;
each such divisor $d^2$ leaves one residue class modulo
$M_0$, giving $U/(2M_0d^2)+O(1)$, and the omitted tail
of the main sum is $O(\sqrt U/M_0)$.
Since $M_0=U^{o(1)}$, the main term proves
\eqref{eq:cmtyp-initial}.

Choose $\delta>0$ so small that
$\theta+\log(1/2-\delta)>0$, and fix
$0<\theta'<\min\{1,\theta+\log(1/2-\delta)\}$.
If $\mathcal D_k$ is empty, let $i$ be the first index
with
$|\mathcal D_{i+1}|\leq(1/2-\delta)|\mathcal D_i|$.
Then
$|\mathcal D_i|\geq(1/2-\delta)^i|\mathcal D_0|
 \geq(\log x)^{\theta'}$.
Writing
\[
 M=p_0p_1\cdots p_i,\quad q=p_{i+1},\quad
 r=p_{i+2}\cdots p_k,
\]
we have
\begin{equation}\label{eq:cmtyp-factor}
 N=Mqr,\quad q>z,\quad
 P^-(r)>q>P^+(M),\quad T:=x/M>x^{1/L}.
\end{equation}
The set
$\mathcal D(M)=\{\Delta\in\mathcal D:
       (\Delta/p)=1\text{ for all }p\mid M\}$
has size $J\geq(\log x)^{\theta'}$, and at least
$(1/2+\delta)J$ of its members fail to split $q$.
The inequality for $T$ follows because $qr$ contains the
largest prime factor of $N$. We now count such factorizations.

\emph{The case $r=1$.}
Fix $M$ and choose a prime $q\leq T$ uniformly.
For $\Delta\in\mathcal D(M)$ define
\[
 X_\Delta(q)=\boldsymbol1_{(\Delta/q)\ne1}
       =\frac{1-\chi_\Delta(q)}2
          +\frac{\boldsymbol1_{q\mid\Delta}}2,\qquad
 X(q)=\sum_{\Delta\in\mathcal D(M)}X_\Delta(q).
\]
Because $T>x^{1/L}$ and $|\Delta\Delta'|\leq U^2$,
\eqref{eq:cmtyp-primes} and $\pi(T)\gg T/\log T$ give
\[
 \mathbb E X_\Delta=\frac12+O((\log x)^{-10}),\qquad
 \mathbb E(X_\Delta X_{\Delta'})
       =\frac14+O((\log x)^{-10})\quad(\Delta\ne\Delta').
\]
For the second estimate, expand the product. Its character
terms are $\chi_\Delta,\chi_{\Delta'}$ and
$\chi_\Delta\chi_{\Delta'}$; the last is nonprincipal since
distinct fundamental discriminants have distinct squareclasses.
The primes dividing $\Delta\Delta'$ contribute
$O(\log(U)/\pi(T))$, also absorbed in the stated error.
Thus
\[
 \mathbb E(X-J/2)^2
       \ll J+J^2(\log x)^{-10}.
\]
Chebyshev's inequality bounds the fraction of bad primes
by $O(J^{-1}+(\log x)^{-10})
\ll(\log x)^{-\theta'}$. Their number is at most
\[
 \ll \frac{xL}{M\log x}(\log x)^{-\theta'}.
\]
Summing over $M\leq x$ gives
$O(xL(\log x)^{-\theta'})=o(x)$.

\emph{The case $r>1$.}
For fixed $M,q$, the elementary upper-bound sieve gives
\begin{equation}\label{eq:cmtyp-rough}
 \#\{r\leq x/(Mq): P^-(r)>P^+(M)\}
       \ll\frac{x}{Mq\log(2P^+(M))}.
\end{equation}
We use this bound only when a factorization
\eqref{eq:cmtyp-factor} exists, so $x/(Mq)>P^+(M)$,
which is the required sieve range. It is also valid
for $M=1$ with the displayed normalization. This is the
unconditional upper-bound sieve used in
\cite[\S5.6, equation~(18)]{CGPS2022}.

For fixed $M$, give the primes $z<q\leq T$ probability
$1/(qW)$, where
$W=\sum_{z<q\leq T}q^{-1}=L+O(\log L)$.
Define $X_\Delta$ and $X$ as before.
By \eqref{eq:cmtyp-tail}, uniformly for each character of
modulus at most $U^2$ involved in the expansion,
\[
 \left|\frac1W\sum_{z<q\leq T}\frac{\chi(q)}q\right|
       \ll z^{-1/8}L.
\]
The primes dividing a discriminant contribute
$O(z^{-1}\log U/W)=O(z^{-1})$.
It follows that
\[
 \mathbb E(X-J/2)^2
       \ll J+J^2 z^{-1/8}L.
\]
Consequently the weighted fraction of bad primes is
$O(J^{-1}+z^{-1/8}L)$.
Since $J^{-1}\leq\exp(-\theta'L)$ and $z=\exp(\sqrt L)$,
we conclude, for large $x$, that
\begin{equation}\label{eq:cmtyp-badweight}
 \sum_{\substack{z<q\leq T\\X(q)\geq(1/2+\delta)J}}\frac1q
       \ll W\bigl((\log x)^{-\theta'}+z^{-1/8}L\bigr)
       \ll z^{-1/10}.
\end{equation}
Combine \eqref{eq:cmtyp-rough} and
\eqref{eq:cmtyp-badweight}, and sum over $M$.
The elementary estimate
\[
 \sum_{M\leq x}\frac1{M\log(2P^+(M))}\ll L
\]
follows by taking $M=1$ separately and grouping the
other integers by their largest prime factor:
\[
 \sum_{\substack{M\geq1\\P^+(M)=p}}\frac1M
 =\frac1p\prod_{\ell\leq p}(1-1/\ell)^{-1}
       \ll\frac{\log(2p)}p.
\]
Therefore the number in the case $r>1$ is
$O(xLz^{-1/10})=o(x)$. Both cases together prove
that $\mathcal D_k\ne\varnothing$ except for $o(x)$
integers, completing the upper bound for $X_0(N)$.

Finally apply the two bounds just proved with
$\epsilon/2$ in place of $\epsilon$.
Since $\phi(N)/N$ lies between
$c/\log\log(3N)$ and $1$, equation
\eqref{eq:cmtyp-tower} absorbs this factor and the
absolute constants into the available margin
$2^{(\epsilon/2)L}$, uniformly for $3\leq N\leq x$.
The finitely many smaller levels have no effect.
This proves the full assertion for $X_1(N)$ and finishes
the theorem.
\end{proof}

The same paper records the following GRH consequence immediately
after Theorem~1.7 \cite[p.~830]{CGPS2022}. We include the details
because passing from prime moduli to arbitrary $N$ requires
accounting for prime powers and for nonsquares having a
nontrivial square factor.

\begin{corollary}[The published normal order of the least nonsquare
that is a square modulo $N$]\label{cor:cmtyp-nonsquare}
Let $R(N)$ be the least positive integer which is not a square
in $\mathbb Z$ but is congruent to a square modulo $N$.
For every $\epsilon>0$, all but $o(x)$ integers $N\leq x$ satisfy
\[
 2^{(1-\epsilon)\log\log x}
       \leq R(N)\leq2^{(1+\epsilon)\log\log x}.
\]
In particular $R(N)=(\log N)^{\log2+o(1)}$ as $N$ tends to
infinity along a set of asymptotic density one.
\end{corollary}

\begin{proof}
For the upper bound repeat the discriminant-sieving portion of
the preceding proof, again reducing to $0<\epsilon<1/4$
by monotonicity of the asserted bounds, with positive fundamental
discriminants $U/2<\Delta<U$, where
$U=2^{(1+\epsilon)\log\log x}$.
Every estimate remains valid: the initial set contains the
positive squarefree integers $\Delta\equiv1\pmod{8p_0}$,
and distinct positive fundamental discriminants have
nonprincipal product character. Thus for all but $o(x)$
integers $N\leq x$ there is such a $\Delta$ with
$(\Delta/p)=1$ at every $p\mid N$.
For each odd $p^a\Vert N$, a root modulo $p$ lifts to a root
modulo $p^a$ because $\Delta$ is coprime to $p$.
If $2\mid N$, then $(\Delta/2)=1$ means
$\Delta\equiv1\pmod8$, so it is a square modulo every power
of $2$. The Chinese remainder theorem gives a square root
modulo $N$. The positive fundamental discriminant $\Delta>1$
is not an integer square, so $R(N)\leq\Delta<U$.

For the lower bound set $A=2^{(1-\epsilon)L}$, where
$L=\log\log x$, and suppose that a positive nonsquare
$a<A$ is a square modulo $N$. Write $a=bc^2$ with
$b>1$ squarefree. Every prime $p\mid N$ with $p>A$
is coprime to $2a$, and hence $(b/p)=1$.
The nonprincipal quadratic character associated with
$\mathbb Q(\sqrt b)$ has conductor at most $4b$.
For each $b\leq A$, enlarge the permitted prime set by
all primes $p\leq A$ and by the ramified primes.
Its reciprocal sum is at most $L/2+O(\log L)$ by
\eqref{eq:cmtyp-total}. Restrict again to
$\omega(N)=L+O(\sqrt L\log L)$ and apply the same
restricted Hardy--Ramanujan inequality. For each $b$ it gives
at most $x\exp(-(\log2+o(1))L)$ integers $N$.
There are at most $A$ choices of $b$, so their union
has size at most
$x\exp(-(\epsilon\log2+o(1))L)=o(x)$.
This permits arbitrary square factors $c^2$ without summing
over them. The inequalities follow.

To obtain the stated density-one formulation with $\log N$,
discard $N\leq\sqrt x$, for which there are $o(x)$ choices,
and absorb the bounded difference between
$\log\log N$ and $\log\log x$ into an arbitrarily small
exponent margin. For every fixed margin the resulting
exceptional set has density zero. A diagonal choice of
margins tending to zero yields a single density-one set
along which the displayed $o(1)$ tends to zero.
\end{proof}

\section{Effective bounds for prime-degree isogenies over quadratic fields}
\label{sec:quadratic-isogenies}

For a number field $K$, let $\operatorname{IsogPrimeDeg}(K)$ be the set
of rational primes $p$ for which some elliptic curve over $K$ admits a
$K$-rational isogeny of degree $p$. Banwait's published
Algorithm~1.6 asserts, under GRH, the existence of an algorithm computing
an upper bound for this set for every quadratic field other than an
imaginary quadratic field of class number one
\cite[Algorithm~1.6]{BanwaitQuadratic}. We recover this entire algorithmic
statement. Momose had already proved finiteness for these quadratic
fields; effectivity is the conclusion at issue here.

\begin{theorem}[Banwait's effective quadratic-field isogeny bound]
\label{thm:quadratic-isogeny-bound}
There is an unconditional algorithm which, given a quadratic field $K$
that is not an imaginary quadratic field of class number one, outputs
an integer $B_K$ such that
\[
 p\in\operatorname{IsogPrimeDeg}(K)\quad\Longrightarrow\quad p\leq B_K.
\]
In particular it computes a finite superset of
$\operatorname{IsogPrimeDeg}(K)$.
\end{theorem}

We first give the analytic step with all uniformity needed for this
algorithm. For an abelian extension $F/\mathbb Q$, its conductor means
an integer $m_F$ such that $F\subseteq\mathbb Q(\zeta_{m_F})$; choosing
the least such integer is unnecessary.

\begin{lemma}\label{lem:isogeny-split-prime}
Fix a positive integer $n$. There is an effective constant $C_n$ with
the following property. If $L/\mathbb Q$ is abelian, $[L:\mathbb Q]\leq n$,
and $L\subseteq\mathbb Q(\zeta_m)$, there is a prime $q$ such that
\[
 q\nmid m,\qquad q\text{ splits completely in }L,\qquad
 q\leq C_n(\log(3m))^8.
\]
\end{lemma}
\begin{proof}
Let $X$ be the group of Dirichlet characters corresponding to $L$,
viewed as characters modulo $m$, and put $h=|X|\leq n$.
For a prime $q\nmid m$, character orthogonality gives
\[
 \boldsymbol 1_{q\text{ splits in }L}
       =\frac1h\sum_{\chi\in X}\chi(q).
\]
Apply the smoothed explicit formula \eqref{eq:smoothed} to the primitive
character inducing each nonprincipal $\chi\in X$. Its contribution is
\[
 O\bigl(x^{7/8}\log(3m)+\log(3m)\log(2x)\bigr),
\]
where the second term also accounts for Euler factors removed at primes
dividing $m$. The principal character contributes
$x/2+O(x^{7/8}\log^2(2x)+\log(3m)\log(2x))$ by
Lemma~\ref{lem:psi}. Prime powers of exponent at least two have total
weight $O(\sqrt{x}\log^2(2x))$. Consequently
\begin{align*}
 &\sum_{\substack{q\leq x\text{ prime}\\q\nmid m\\q\text{ splits in }L}}
      \log q\,(1-q/x)\\
 &\qquad=\frac{x}{2h}
 +O\bigl(x^{7/8}\log(3m)+x^{7/8}\log^2(2x)
          +\log(3m)\log(2x)+\sqrt{x}\log^2(2x)\bigr).
\end{align*}
The implied constant is absolute: the average over $X$ cancels its
cardinality. Set $x=C_n(\log(3m))^8$. The first error divided by $x$ is
$O(C_n^{-1/8})$; the other errors divided by $x$ tend effectively to
zero with $m$. Choose $C_n$ large enough in terms of $n$, and enlarge
it effectively for the finitely many remaining moduli. For those
moduli one can enumerate primes until a completely split prime is
found; Dirichlet's theorem ensures termination. The sum is positive,
which proves the assertion.
\end{proof}

We use the following previously published unconditional algebraic
inputs. If $\lambda:G_K\to\mathbb F_p^\times$ is the character through
which $G_K$ acts on the kernel of a rational $p$-isogeny, and
$\chi_p$ is the mod-$p$ cyclotomic character, the isogeny is of
\emph{Momose type 2} when $\lambda^{12}=\chi_p^6$.
Banwait--Derickx prove the following statements:
\begin{enumerate}[label=(\roman*)]
\item There are algorithms computing nonzero integers $M_K$ and $T_K$
such that an isogeny prime not of Momose type 1, 2 or 3 divides $M_K$,
and a Momose type 1 isogeny prime divides $T_K$
\cite[Theorems~1.4 and~1.5]{BanwaitDerickx}.
\item A Momose type 3 isogeny requires $K$ to contain the Hilbert class
field of an imaginary quadratic field
\cite[Definition~3.20]{BanwaitDerickx}.
\item If $p$ is of Momose type 2, $q$ is a rational prime, and
$\mathfrak q\mid q$ is a prime of $K$ of residue degree $f$, then
\[
 q^f<p/4,\qquad f\text{ odd},\qquad q^{2f}+q^f+1\not\equiv0\pmod p
 \quad\Longrightarrow\quad
 q\text{ does not split in }\mathbb Q(\sqrt{-p})
\]
\cite[Proposition~6.1]{BanwaitDerickx}.
\end{enumerate}
These are unconditional theorems, including the algorithmic
effectivity in (i). The proof of (iii) distinguishes potentially good
reduction, where Momose's local lemma makes $q$ inert, from potentially
multiplicative reduction, where splitting forces $q^f$ to be a
nontrivial cube root of unity modulo $p$. We import these established
local and algebraic results; the conditional least-prime estimate in
\cite[Proposition~6.3]{BanwaitDerickx} is not used.

\begin{proof}[Proof of Theorem~\ref{thm:quadratic-isogeny-bound}]
Write $D$ for the fundamental discriminant of $K$. For any prime $p$,
the compositum $L=K\mathbb Q(\sqrt{-p})$ is abelian of degree at most
four and is contained in $\mathbb Q(\zeta_m)$ for
$m=\operatorname{lcm}(|D|,|D_{-p}|)\leq4|D|p$, where $D_{-p}$ is the
fundamental discriminant of $\mathbb Q(\sqrt{-p})$.
Lemma~\ref{lem:isogeny-split-prime} supplies a prime $q$ split in both
fields with
\[
 q\leq Q_D(p):=C_4\bigl(\log(12|D|p)\bigr)^8.
\]
There is a prime of $K$ above $q$ with residue degree one. If
$p>3Q_D(p)^2$, then, since $q\geq2$,
\[
 4q\leq3q^2<p,\qquad 0<q^2+q+1\leq3q^2<p.
\]
Input (iii), applied with $f=1$, now contradicts the splitting of $q$
in $\mathbb Q(\sqrt{-p})$. Thus every Momose type 2 prime satisfies
\begin{equation}\label{eq:isogeny-type-two-bound}
 p\leq3C_4^2\bigl(\log(12|D|p)\bigr)^{16}.
\end{equation}
An integer $B_2(D)$ above all positive solutions of this inequality is
computable. Indeed the function
\[
 t\longmapsto \frac{t}{(\log(12|D|t))^{16}}
\]
is increasing once $\log(12|D|t)>16$, and tends to infinity. Starting in that range,
double $t$ until the strict reverse of
\eqref{eq:isogeny-type-two-bound} holds. This gives a terminating
algorithm for such a bound.

The hypotheses on $K$ exclude Momose type 3: if the Hilbert class
field $H_A$ of an imaginary quadratic field $A$ is contained in the
quadratic field $K$, then $A=K$ and $[H_A:A]=1$. Compute the nonzero
integers $M_K,T_K$ from (i), factor them, and output the maximum of
$B_2(D)$ and their prime divisors. Every isogeny prime is bounded by
this maximum, by (i)--(iii). All computations terminate. This proves
the exact existence-of-an-algorithm assertion in
\cite[Algorithm~1.6]{BanwaitQuadratic} without GRH.
\end{proof}

\paragraph{Precisely what is recovered.}
The new conclusion is the full qualitative algorithmic statement of
Banwait's Algorithm~1.6, with no restrictions on the eligible quadratic
input field. We have not recovered the numerical GRH bounds in its
tables, the particular computed candidate lists, or their subsequent
exact classifications. The local filtering in the published algorithms
can still be applied after replacing their conditional cutoff by the
cutoff proved here. Deciding which members of a finite candidate list
actually occur is a separate rational-point problem and is not asserted
to be solved by this argument.

% BanwaitQuadratic: B. S. Banwait, Explicit isogenies of prime degree over
% quadratic fields, Int. Math. Res. Not. IMRN 2023, no.14, 11829--11876.
% DOI 10.1093/imrn/rnac134; author manuscript arXiv:2101.02673v3.
% BanwaitDerickx: B. S. Banwait and M. Derickx, Explicit isogenies of
% prime degree over number fields, Algebra Number Theory 19 (2025),
% no.6,1147--1197. DOI 10.2140/ant.2025.19.1147.

\section{Uniform Rasmussen--Tamagawa finiteness in every odd degree}
\label{sec:rasmussen-tamagawa}

Let $K$ be a number field and $\ell$ a prime. Write
$\mu_{\ell^\infty}=\bigcup_{a\geq1}\mu_{\ell^a}$, and let
$\Omega_{K,\ell}$ be the maximal pro-$\ell$ extension of
$K(\mu_{\ell^\infty})$ unramified away from primes above $\ell$,
inside a fixed algebraic closure of $K$. Let
\[
 \mathcal A(K,g,\ell)=
 \{[A]_K:\dim A=g,\ K(A[\ell^\infty])\subseteq\Omega_{K,\ell}\}.
\]
Here $[A]_K$ denotes $K$-isomorphism class, and the torsion field is
generated by the coordinates of all $\ell$-power torsion points.
The condition says that, after adjoining the $\ell$-power roots of
unity, this torsion field lies in a pro-$\ell$ extension unramified
away from $\ell$. In particular $A$ has good reduction at every
finite prime not above $\ell$.

Rasmussen--Tamagawa proved the following full uniform statement under
GRH in \cite[Theorem~5.2]{RasmussenTamagawa}. The argument below
replaces its analytic input and retains all dimensions and all odd
degrees in that theorem.

\begin{theorem}[Uniform Rasmussen--Tamagawa theorem in odd degree]
\label{thm:rt-odd-degree}
For every positive integer $g$ and every positive odd integer $n$,
there is an effectively computable bound $B(g,n)$ such that
\[
 [K:\mathbb Q]=n,\quad \ell>B(g,n)
       \quad\Longrightarrow\quad \mathcal A(K,g,\ell)=\varnothing.
\]
The bound is independent of the number field $K$ and of the abelian
variety. In particular, for every fixed number field of odd degree,
the Rasmussen--Tamagawa finiteness assertion holds in every dimension.
\end{theorem}

\begin{proof}
We explain the unconditional algebraic input and reproduce the local
contradiction, so that both the uniformity and the precise use of the
zero-free strip are explicit. Put
\[
 M_g=|\operatorname{GL}_{2g}(\mathbb F_3)|,
 \qquad C_{\rm alg}(g,n)
       =\max\{5,\,2^{\,2g+1+2gM_gn^2}\}.
\]
This deliberately generous bound avoids any need to optimize the
indices of semistable reduction.

Suppose $[A]\in\mathcal A(K,g,\ell)$ and
$\ell>C_{\rm alg}(g,n)$. Let
$\chi:G_{\mathbb Q}\to\mathbb F_\ell^\times$ be the mod-$\ell$
cyclotomic character. By \cite[Lemma~3.3]{RasmussenTamagawa},
the semisimplification of the representation on $A[\ell]$ is
\begin{equation}\label{eq:rt-diagonal}
 \overline\rho_{A,\ell}^{\rm ss}
       =\bigoplus_{r=1}^{2g}\chi^{i_r}|_{G_K}
\end{equation}
for integers $i_r$. The group-theoretic reason is that the normal
pro-$\ell$ subgroup acts trivially on simple modules in characteristic
$\ell$, and the remaining quotient is a subgroup of
$\mathbb F_\ell^\times$; its simple representations are therefore
one-dimensional powers of the cyclotomic character.

For a prime $\lambda\mid\ell$ of $K$, let $a_\lambda$ be the
minimal ramification index over the maximal unramified extension of
$K_\lambda$ needed for semistable reduction of $A$. Standard
semistable-reduction theory gives $a_\lambda\mid M_g$ for $\ell>3$:
one may use the action on the $3$-torsion, as in
\cite[Section~3.1]{RasmussenTamagawa}. Set
\[
 e_\lambda=a_\lambda e(\lambda/\ell),\qquad
       1\leq e_\lambda\leq M_g n.
\]
The finite-flat group-scheme calculation in
\cite[Section~3.3, equation~(3.1)]{RasmussenTamagawa}, an
unconditional application of Tate--Oort theory after semistable base
change, gives integers $j_{\lambda,r}$ satisfying
\begin{equation}\label{eq:rt-tame-weights}
 0\leq j_{\lambda,r}\leq e_\lambda,\qquad
 e_\lambda i_r\equiv j_{\lambda,r}\pmod{\ell-1}.
\end{equation}
These two structural facts are the established algebraic inputs.

Choose a prime $\mathfrak p_0$ of $K$ above $2$, and put
$q_0=\mathrm N\mathfrak p_0\leq2^n$. It is a prime of good
reduction because $\ell>3$. Let
$\alpha_1,\ldots,\alpha_{2g}$ be the Frobenius eigenvalues there.
The characteristic polynomial is integral, and the Weil bounds give
$|\alpha_r|=\sqrt{q_0}$ in every complex embedding. For each $\lambda$,
\eqref{eq:rt-diagonal} and \eqref{eq:rt-tame-weights} imply the
coefficientwise congruence
\[
 \prod_{r=1}^{2g}(T-\alpha_r^{e_\lambda})
   \equiv\prod_{r=1}^{2g}(T-q_0^{j_{\lambda,r}})\pmod\ell.
\]
For $1\leq k\leq2g$, the absolute difference of the coefficients of
$T^{2g-k}$ is at most
\[
 \binom{2g}{k}
      \bigl(q_0^{e_\lambda k/2}+q_0^{e_\lambda k}\bigr)
       \leq2^{\,2g+1+2gM_gn^2}<\ell.
\]
Both polynomials are integral, so the congruence is an equality.
Comparison of the absolute values of their roots then gives
\begin{equation}\label{eq:rt-half-weight}
 j_{\lambda,r}=e_\lambda/2,\qquad
 e_\lambda i_r\equiv e_\lambda/2\pmod{\ell-1}
 \quad(1\leq r\leq2g).
\end{equation}
In particular $e_\lambda$ is even.

Consider the characters of $G_{\mathbb Q}$
\[
 \varepsilon_{r,s}=\chi^{i_r+i_s-1},\qquad
 m=\operatorname{lcm}_{1\leq r,s\leq2g}
                          \operatorname{ord}(\varepsilon_{r,s}).
\]
They have finite order dividing $\ell-1$. Fixing any $\lambda$ and
adding the congruences in \eqref{eq:rt-half-weight} shows that
$\varepsilon_{r,s}^{e_\lambda}=1$ for all $r,s$. Hence
\begin{equation}\label{eq:rt-m-bound}
 m\mid\ell-1,\qquad m\mid e_\lambda,\qquad m\leq M_g n.
\end{equation}
This weaker bound suffices here; the finer divisibility and parity
properties of the corresponding $m_{\mathbb Q}$ in the published
paper are not needed.

Let $L$ be the unique degree-$m$ subfield of
$\mathbb Q(\zeta_\ell)$. A prime $p\ne\ell$ splits completely in
$L$ precisely when $p\bmod\ell$ is an $m$-th power in
$\mathbb F_\ell^\times$. Applying
Lemma~\ref{lem:isogeny-split-prime} with degree bound $M_gn$
and modulus $\ell$ gives such a prime with
\begin{equation}\label{eq:rt-small-prime}
 p\leq C_{M_gn}(\log(3\ell))^8.
\end{equation}
Choose an effective bound $C_{\rm an}(g,n)$ so that for every real
$t>C_{\rm an}(g,n)$,
\[
 C_{M_gn}^{\,n}(\log(3t))^{8n}<\frac{t}{4g}.
\]
Such a bound is computable: $t/(\log(3t))^{8n}$ is increasing for
$\log(3t)>8n$ and tends to infinity, so a doubling search beyond
that point terminates. Set
$B(g,n)=\max\{C_{\rm alg}(g,n),C_{\rm an}(g,n)\}$.

Assume now $\ell>B(g,n)$. Factor the ideal $p\mathcal O_K$.
Since $\sum_{\mathfrak p\mid p}e(\mathfrak p/p)f(\mathfrak p/p)=n$
is odd, at least one prime $\mathfrak p\mid p$ has odd residue
degree $f=f(\mathfrak p/p)\leq n$. Put $q=p^f$. Then
\begin{equation}\label{eq:rt-small-norm}
 q\leq p^n<\ell/(4g).
\end{equation}
This does not require $p$ to be unramified in $K$. The abelian variety
has good reduction at $\mathfrak p$, because $p\ne\ell$.
As $p$ is an $m$-th power modulo $\ell$, so is $q$, and
\eqref{eq:rt-m-bound} implies
\[
 q^{i_r+i_s-1}=1\pmod\ell\quad\text{for all }r,s.
\]

We reproduce the contradiction of
\cite[Proposition~4.2]{RasmussenTamagawa}. Let
$\beta_1,\ldots,\beta_{2g}$ be the eigenvalues of Frobenius at
$\mathfrak p$, and write $a_k=\sum_r\beta_r^k\in\mathbb Z$.
Then
\[
 a_2\equiv\sum_r q^{2i_r}=2gq\pmod\ell,
       \qquad |a_2|\leq2gq.
\]
Because $4gq<\ell$, this forces $a_2=2gq$. Each
$\beta_r^2$ has complex absolute value $q$, so equality in the
triangle inequality forces $\beta_r^2=q$ for every $r$.
Thus every $\beta_r$ equals $\sqrt q$ or $-\sqrt q$.
Since $f$ is odd, $\sqrt q=p^{(f-1)/2}\sqrt p$ is irrational.
The integer $a_1$ must therefore be zero. But reduction modulo
$\ell$ gives
\[
 0=a_1^2\equiv
       \sum_{r,s}q^{i_r+i_s}=4g^2q\pmod\ell.
\]
This is impossible: $\ell>2g$ and $p\ne\ell$. The contradiction
proves $\mathcal A(K,g,\ell)=\varnothing$, with all constants
depending only on $g,n$.

For a fixed $K$, only finitely many $\ell$ remain. For each such
$\ell$, finiteness of $\mathcal A(K,g,\ell)$ is the established
Shafarevich finiteness theorem, since the varieties have good reduction
away from $\ell$. This proves the stated fixed-field consequence.
\end{proof}

\paragraph{Scope and algebraic dependencies.}
This is the entire formerly GRH-conditional statement of
\cite[Theorem~5.2]{RasmussenTamagawa}, including $n=1$ and arbitrary
$g$. The local finite-flat and semistable-reduction facts are
unconditional; they were stated explicitly before their use, and the
remaining character and Frobenius arguments were given in full.
The theorem places a uniform bound on the allowed primes $\ell$;
it does not enumerate all isomorphism classes or assert that their
union over all degree-$n$ fields is finite. No corresponding theorem
for every even degree, or the general varying-base-field assertion
of the source's Theorem~5.3, is claimed here.

% RasmussenTamagawa: C. Rasmussen and A. Tamagawa, Arithmetic of abelian
% varieties with constrained torsion, Trans. Amer. Math. Soc.369 (2017),
% no.4,2395--2424. DOI 10.1090/tran/6790.
% Author-linked primary manuscript: arXiv:1302.1477v1.
% Current author publication page confirms this manuscript's linkage:
% https://crasmussen.faculty.wesleyan.edu/research/

\section{Rational CM newforms of every fixed weight}\label{sec:cm-newforms}

Sch\"utt's published finiteness theorem \cite[Theorem 2.1]{Schuett}
assumes ERH for odd real Dirichlet characters. It is an application of
the preceding class-group exponent theorem; it does not require a
zero-free theorem for the varying infinite-order Hecke characters that
define the modular forms.

We use Sch\"utt's convention for twisting. Ordinarily a quadratic
Dirichlet character $\varphi$ acts on a newform by taking the newform
associated to $\sum_{n\geq1}\varphi(n)a_nq^n$. On the corresponding
Hecke character $\psi$ of $K$, this is multiplication by
$\varphi\circ N_{K/\mathbb Q}$. For $K=\mathbb Q(i)$ and
$K=\mathbb Q(\sqrt{-3})$, the convention additionally permits the
quartic and sextic twists, respectively, of the Hecke character that
preserve rational coefficients, as in \cite[Section 1]{Schuett}.
These exceptional twists must be included in the statement below.

\begin{theorem}[Sch\"utt's finiteness conclusion]\label{thm:cm-finite}
For every fixed integer weight $k\geq2$, there are only finitely many
normalized cuspidal CM newforms with rational Fourier coefficients,
of arbitrary level, up to twisting in the preceding sense.
Equivalently, for each positive infinity type $l$, only finitely many
Hecke characters of imaginary quadratic fields with rational associated
newforms occur up to this twisting equivalence.
\end{theorem}
\begin{proof}
Put $l=k-1$. The unconditional Hecke--Shimura construction and Ribet's
converse, recalled in \cite[Theorems 1.1 and 1.4]{Schuett}, associate
a CM newform of weight $k$ to a Hecke character $\psi$ of its unique
imaginary quadratic CM field $K$, of infinity type $l$. Rationality
of the Fourier coefficients implies that $\psi$ takes integral ideals
coprime to its conductor to $\mathcal O_K$
\cite[Lemma 2.2]{Schuett}.

We detail the resulting class-group restriction. Let $\mathfrak m$ be
the conductor. For $\alpha$ prime to $\mathfrak m$,
\[
 \eta(\alpha)=\frac{\psi((\alpha))}{\alpha^l}
\]
factors through the finite group
$(\mathcal O_K/\mathfrak m)^\times$. It has values in $K$ by the
rationality statement, hence its values are roots of unity in $K$ and
are units in $\mathcal O_K$. Thus
$(\psi((\alpha)))=(\alpha)^l$ as ideals.
Take any ideal class and choose an integral representative
$\mathfrak a$ coprime to $\mathfrak m$. If its order is $j$, write
$\mathfrak a^j=(\alpha)$. Multiplicativity gives
\[
 (\psi(\mathfrak a))^j
   =(\psi((\alpha)))=(\alpha)^l=\mathfrak a^{jl}.
\]
The group of fractional ideals is free abelian on the prime ideals, so
equality of $j$th powers implies
$(\psi(\mathfrak a))=\mathfrak a^l$. Therefore $\mathfrak a^l$ is
principal and $j\mid l$. Since the original ideal class was arbitrary,
$E(D_K)\mid l$.

Theorem~\ref{thm:class-exponent} leaves only finitely many possible
fields $K$. Sch\"utt's unconditional classification
\cite[Theorem 2.4]{Schuett} states that, for fixed $l$, sending a
rational-coefficient Hecke character to its CM field is a bijection
between the twisting classes and the imaginary quadratic fields with
$E(D_K)\mid l$. In particular there is just one such twisting class
for each of the finitely many admissible fields. The Hecke--Shimura
correspondence gives the claimed finiteness for newforms.
\end{proof}

The newly unrestricted part is the statement for every fixed weight.
Sch\"utt already established unconditional finiteness for weights
$2,3,4,5,6$, and for weights $2^r+1$ and $3\cdot2^r+1$ in his
theorem. We do not count those special cases again.
At weight $3$, his explicit table has precisely the $65$ CM fields
from Proposition~\ref{prop:65-fields}; that table is now complete,
by the same unconditional correspondence. Its formerly possible extra
field is excluded by Proposition~\ref{prop:65-fields}.

% Bibliography: Schuett = M. Schuett, CM newforms with rational
% coefficients, Ramanujan J.19(2009),187--205,
% DOI10.1007/s11139-008-9147-8, https://arxiv.org/abs/math/0511228 .

\section{Geometric consequences of the complete exponent-two classification}
\label{sec:geometric-classifications}

\subsection{The Elkies--Sch\"utt realization theorem}

A singular K3 surface means a smooth projective K3 surface whose
geometric Picard number is $20$. Thus its transcendental part
$T_\ell(X)$ in second $\ell$-adic cohomology has dimension $2$.
Here a normalized cuspidal Hecke eigenform is associated to $X$ when
its two-dimensional Galois representation is the transcendental
representation of $X$; in particular their characteristic polynomials
of Frobenius agree at all common good primes. This is the notion of
association in \cite{ES}.

\begin{theorem}[Elkies--Sch\"utt, with the ERH hypothesis removed]
\label{thm:k3-realization}
Let $f=\sum_{n\geq1}a_nq^n$ be a normalized cuspidal newform of weight
$3$ with rational Fourier coefficients, of arbitrary level and
nebentypus $\varepsilon$. Then $f$ is associated to a singular K3
surface $X$ defined over $\mathbb Q$. At all but finitely many rational
primes $p$, the Frobenius polynomial on $T_\ell(X)$ is
\[
 1-a_pT+\varepsilon(p)p^2T^2.
\]
\end{theorem}
\begin{proof}
Ribet's theorem, as stated in \cite[Corollary 1.2]{Schuett}, says that
an odd-weight newform with real coefficients has CM by its quadratic
nebentypus; the corresponding quadratic field $K$ is imaginary.
These are unconditional facts also recalled in
\cite[Section 3 and Theorem 4]{ES}. Sch\"utt's classification identifies
its twisting class with $K$, and the exponent of $\operatorname{Cl}(K)$
divides $3-1=2$. Proposition~\ref{prop:65-fields} proves that $K$ is
one of the $65$ fields in the table on page 5 of \cite{ES}.

The following geometric input is the unconditional construction in
\cite[Lemma 7, Sections 5, 7--9]{ES}: each one of these $65$ fields is
realized by a singular K3 surface over $\mathbb Q$; the associated
newforms account for one representative of every twisting class, and
all required twists are geometrically realized. We spell out the
twisting step to distinguish this from realizing only $65$ individual
newforms. Their modularity uses Livn\'e's theorem, stated as
\cite[Theorem 3]{ES}. It identifies the transcendental factor of
second cohomology, not the entire $22$-dimensional cohomology group.

For fields other than $\mathbb Q(i)$ and $\mathbb Q(\sqrt{-3})$, the
constructed surface has an elliptic fibration with section over
$\mathbb Q$, of Weierstrass form
\[
 y^2=x^3+A(t)x+B(t),\qquad A,B\in\mathbb Q[t].
\]
For a quadratic character $\chi_d$, replace it by
\[
 d y^2=x^3+A(t)x+B(t),\qquad d\in\mathbb Q^\times.
\]
The smooth minimal surface is geometrically isomorphic to the original
surface, so it is again a singular K3 surface. Over
$\mathbb Q(\sqrt d)$, the two equations are identified by scaling
$y$. The nontrivial Galois descent action is the fiberwise involution
$y\mapsto-y$. It acts by $-1$ on the holomorphic $2$-form
$dt\wedge dx/y$, hence also on its complex conjugate. Since the
transcendental Betti space has rank $2$ for a singular K3 surface,
the involution acts by $-1$ on that entire space, and therefore on
$T_\ell(X)$ by comparison. The new Galois representation is precisely
$T_\ell(X)\otimes\chi_d$, as required.

The exceptional fields require additional twists. Lemma 7 of
\cite{ES} explicitly supplies them: for $K=\mathbb Q(\sqrt{-3})$,
the relevant Kummer surface has an isotrivial fibration with
$A(t)=0$, permitting cubic twists fiberwise; combined with quadratic
twists these give the sextic twisting convention. For $K=\mathbb Q(i)$,
the order-$4$ automorphisms of the corresponding Kummer realization
(equivalently the Fermat-quartic realization discussed there) provide
the biquadratic twists. These are precisely the extra Hecke-character
twists in Sch\"utt's classification. Their realization is part of that
unconditional lemma.

Thus every twist belonging to every one of the $65$ CM fields is
realized over $\mathbb Q$. These exhaust the weight-$3$ rational
newforms, proving the theorem. In the published proof of \cite[Theorem
1]{ES}, ERH was used only to assert that this field list is complete;
the present argument replaces exactly that step.
\end{proof}

The explicit equations and proofs of their Picard numbers in
\cite{ES} are imported established geometric results. The argument here
does not claim a fresh verification of every equation in their tables.

\subsection{Products of non-CM elliptic curves that are not Jacobians}

Let $F$ be an algebraically closed field, and let $E_1,E_2$ be elliptic
curves over $F$ with
$\operatorname{Hom}(E_1,E_2)=\mathbb Z h$ for an isogeny $h$.
Put $n=\deg h$. This is Kani's notion of a pair of type $n$; in
particular the curves are isogenous and have endomorphism ring
$\mathbb Z$. An isomorphism of their product with a Jacobian below
is an isomorphism of abelian varieties; it does not require the
product principal polarization to become the Jacobian polarization.

\begin{theorem}[Kani's exact exceptional list]\label{thm:kani-21}
The abelian surface $E_1\times E_2$ is not isomorphic to the Jacobian
of a smooth genus-$2$ curve if and only if
\[
\begin{split}
 n\in\{&1,2,4,6,10,12,18,22,28,30,42,58,60,70,78,\\
        &102,130,190,210,330,462\}.
\end{split}
\]
Equivalently, these are exactly the types of such products which contain
no smooth irreducible curve of genus $2$.
\end{theorem}
\begin{proof}
Kani's unconditional structural theorem
\cite[Theorem 38]{Kani} states that a product of type $n$ contains no
smooth genus-$2$ curve if and only if
\[
 n=1\quad\hbox{or}\quad
 \bigl(n\text{ is even and idoneal, and }8\nmid n\bigr).
\]
It is the criterion underlying the formerly GRH-conditional
completeness of the exceptional list in \cite[Theorem 5]{KaniModuli}.
Theorem~\ref{thm:idoneal} supplies all idoneal integers. Filtering its
$65$ values by the displayed criterion gives exactly the $21$ integers
listed above, including $28$.

For completeness, the equivalence of the two geometric formulations
is the standard genus-$2$ polarization fact used in Kani's theorem.
A smooth genus-$2$ curve embedded in an abelian surface has
self-intersection $2$ by adjunction and defines an irreducible
principal polarization; the resulting principally polarized surface
is its Jacobian. Conversely a genus-$2$ Jacobian contains its Abel--Jacobi
image as a smooth genus-$2$ curve, and an isomorphism of abelian
varieties transports this curve to $E_1\times E_2$. Thus the absence
of such a curve is exactly the stated failure to be a Jacobian.
\end{proof}

% ES: N. D. Elkies and M. Schuett, Modular forms and K3 surfaces,
% Adv. Math.240(2013),106--131, DOI10.1016/j.aim.2013.03.008,
% https://arxiv.org/abs/0809.0830 (v4,25March2013).
% KaniModuli: E. Kani, The moduli spaces of Jacobians isomorphic to
% a product of two elliptic curves, Collect. Math.67(2016),21--54,
% DOI10.1007/s13348-015-0148-9; author preprint
% https://mast.queensu.ca/~kani/papers/jacob10.pdf .

\section{Pasten's height estimate for all Heegner points}\label{sec:heegner-height}

The following recovers the order of the error term in
\cite[Proposition~13.3]{Pasten}. We specify the metric because changing
the height normalization changes the exact formula used in the proof.

Let $D\geq1$ be squarefree with an even number of prime divisors, and
let $B/\mathbb Q$ be the indefinite quaternion algebra ramified exactly
at the primes dividing $D$. Fix a maximal order $\mathcal O_B$.
For compact open subgroups $U$ of $(B\otimes\mathbb A_f)^\times$,
let $X_U$ be the compactified Shimura curves and let
$X=\varprojlim_U X_U$ be their tower. A quadratic imaginary field $K$
satisfies the \emph{Heegner hypothesis for $D$} when every prime
dividing $D$ is inert in $K$. An optimal embedding
$\mathcal O_K\hookrightarrow\mathcal O_B$ determines a Heegner point
$P_K=[\tau_K,1]\in X(\overline{\mathbb Q})$, where $\tau_K$ is the
fixed point in the upper half-plane for $K^\times$.

Use the Arakelov height $h_{\mathrm{Ar}}$ defined in
\cite[\S13.3--13.4]{Pasten}: the integral line bundle is the relative
dualizing sheaf on the sufficiently small-level integral models,
and its metric under the complex uniformization is
\[
 \|f(z)\,dz\|=2|f(z)|\operatorname{Im}z.
\]
Pulling back along the integral extensions of the point and gluing at
auxiliary levels gives a metrized rank-one $\mathcal O_F$-module
$\widehat M$, for a number field $F$ defining the chosen finite-level
point. The height is the normalized degree
\[
 h_{\mathrm{Ar}}(P_K)=\frac1{[F:\mathbb Q]}
 \left(\log\#(M/\mathcal O_F\eta)
       -\sum_{\sigma:F\hookrightarrow\mathbb C}
                   \log\|\eta\|_\sigma\right),\qquad 0\ne\eta\in M.
\]
The compatibility of the integral models makes this independent of
the auxiliary levels, $F$, and $\eta$. This is Pasten's source
normalization; it is a height relative to the displayed hyperbolic
metric, rather than to an unspecified metric on a canonical bundle.

\begin{theorem}\label{thm:heegner-height}
Let $d_K=|\operatorname{disc}(K)|$. Uniformly for the preceding $D$
and every imaginary quadratic field $K$ satisfying the Heegner
hypothesis for $D$,
\[
 h_{\mathrm{Ar}}(P_K)=\frac12\log(d_KD)+O(\ell(d_K)),
\]
with an effective absolute implied constant.
\end{theorem}
\begin{proof}
Write $\chi_K$ for the primitive quadratic Dirichlet character of
conductor $d_K$. The unconditional geometric input is Pasten's height
formula \cite[Theorem~13.2]{Pasten}:
\[
 h_{\mathrm{Ar}}(P_K)
 =-\frac{L'}L(0,\chi_K)+\frac12\log(D/d_K).
\]
For $D>1$ this follows from the Chowla--Selberg height formula and the
integral-model comparison in that theorem; the same displayed formula
for $D=1$ is the classical Chowla--Selberg case. Its geometric
hypotheses require the inertness condition stated above, and no
Riemann hypothesis is used in this input.

Because $K$ is imaginary quadratic, $\chi_K$ is odd. Its completed
$L$-function
\[
 \xi_K(s)=\left(\frac{d_K}{\pi}\right)^{(s+1)/2}
                \Gamma\!\left(\frac{s+1}{2}\right)L(s,\chi_K)
\]
satisfies $\xi_K(s)=\xi_K(1-s)$. Taking logarithmic derivatives at
$s=0$ and $s=1$ gives
\[
 -\frac{L'}L(0,\chi_K)
 =\frac{L'}L(1,\chi_K)+\log(d_K/\pi)
       +\frac12\left(\frac{\Gamma'}\Gamma(1/2)
                     +\frac{\Gamma'}\Gamma(1)\right).
\]
Since $\Gamma'/\Gamma(1)=-\gamma$ and
$\Gamma'/\Gamma(1/2)=-\gamma-2\log2$, substitution yields the exact
identity
\[
 h_{\mathrm{Ar}}(P_K)
 =\frac12\log(d_KD)+\frac{L'}L(1,\chi_K)
        -(\gamma+\log(2\pi)).
\]
This also verifies the signs and normalizations in
\cite[Section~13.7]{Pasten}. Apply
Corollary~\ref{cor:dirichlet-logderiv} with conductor $d_K$. Its
effective constant is absolute and independent of $D$, proving the
asserted uniform estimate.
\end{proof}

The conclusion applies to every eligible $K$. Pasten's paper also
obtains sufficient height bounds unconditionally for suitably chosen
$K$ by zero-density arguments; that already unconditional selection
result is different from Proposition~13.3, which is the all-$K$
estimate recovered here. The more precise $2+\varepsilon$ error
constant stated under GRH in that proposition is not asserted here.

% Bibliography addition:
% \bibitem{Pasten} H. Pasten, Shimura curves and the abc conjecture,
% Journal of Number Theory 254 (2024), 214--335.
% DOI: 10.1016/j.jnt.2023.07.002.
% https://www.sciencedirect.com/science/article/am/pii/S0022314X2300149X

\section{Wei's height bound for adjacent CM types}\label{sec:wei-height}

Wei's published Theorem~1.4 \cite{Wei} assumes the absence of certain
Siegel zeros for relative $L$-functions of CM fields, a consequence of
GRH. Its hypothesis can be removed even though the imported zero-free
theorem does not cover these relative $L$-functions: Stark's theorem
reduces the particular exceptional zeros in question to imaginary
quadratic Dirichlet $L$-functions. The argument uses the proved
averaged Colmez formula, not the full Colmez conjecture.

For a number field $F$, set
$d_F=|\operatorname{disc}(F)|$ and
$r_F=[F:\mathbb Q]^{-1}\log d_F$, the logarithm of its root
discriminant. A CM field $E$ of degree $2g$ is a totally imaginary
quadratic extension of its maximal totally real subfield $E^+$.
A CM type $\Phi$ chooses one embedding from each complex-conjugate
pair of embeddings $E\hookrightarrow\mathbb C$.
Write $h(E,\Phi)$ for the stable Faltings height of an abelian variety
with multiplication by the full ring $\mathcal O_E$ and type $\Phi$,
using Wei's normalization. It depends only on $(E,\Phi)$.

\begin{theorem}\label{thm:wei-height}
For each positive integer $g$, there are effective constants
$C_1(g)>0$ and $C_2(g)$ with the following property. Let $E$ be any
CM field of degree $2g$. Let $A_i/K_i$, for $i=1,2$, be abelian
varieties of dimension $g$ with embeddings
\[
 \mathcal O_E\hookrightarrow\operatorname{End}_{K_i}(A_i),
\]
and let their CM types be $\Phi_i$. If
$|\Phi_1\cap\Phi_2|=g-1$, then
\[
 \frac{h_{\mathrm{Falt}}^{\mathrm{st}}(A_1)
            +h_{\mathrm{Falt}}^{\mathrm{st}}(A_2)}2
 \leq C_1(g)\frac{r_{K_1}+r_{K_2}}2+C_2(g).
\]
\end{theorem}

\begin{proof}
We first remove the exceptional-zero hypothesis, then reconstruct
the height and discriminant comparisons.

\emph{Exceptional zeros.}
Put $F=E^+$ and $\chi=\chi_{E/F}$, so that
$L(s,\chi)=\zeta_E(s)/\zeta_F(s)$ is the entire quadratic Hecke
$L$-function attached to $E/F$. The usual Dedekind zero-free-region
theorem, in the form used by Wei, states that this function has at
most one zero in
\[
 \operatorname{Re}s\geq1-\frac1{4\log d_E},\qquad
 |\operatorname{Im}s|\leq\frac1{4\log d_E},
\]
and a zero there is real and simple. This follows also from
Stark's Lemma~3 applied to $\zeta_E$, since the entire factor
$L(s,\chi)$ divides $\zeta_E$.

Stark's Lemma~9 \cite{Stark}, stated for a totally real field of
degree $g$ and its totally complex quadratic extension, says that a
real zero $\beta$ of $L(s,\chi)$ in the range
\begin{equation}\label{eq:wei-stark-range}
 1-\frac1{16g!\log d_E}\leq\beta<1
\end{equation}
is also a zero of the Dedekind zeta function of an imaginary quadratic
subfield $k\subset E$. Since $\zeta(s)$ has no real zero in $(0,1)$,
the factorization $\zeta_k(s)=\zeta(s)L(s,\chi_k)$ forces
$L(\beta,\chi_k)=0$. But $d_E\geq3$ and $g!\geq1$ give
\[
 \beta\geq1-\frac1{16\log3}>\frac78,
\]
contradicting Theorem~\ref{thm:input}. Thus there is no zero in
\eqref{eq:wei-stark-range}. Combining this with the preceding
reality statement proves Wei's generalized no-Siegel-zero
hypothesis, with the effective choice $C_{\mathrm{zero}}(g)=16g!$.
This argument makes no assertion of a fixed zero-free strip for
general Dedekind or Hecke $L$-functions.

\emph{A uniform height bound in terms of $d_E$.}
The unconditional analytic estimate used in the proof of
\cite[Proposition~5.3]{WeiPreprint}, isolating the possible exceptional zero $\beta_0$
in the wider region of width $1/(4\log d_E)$, is
\[
 -\frac{L'}L(0,\chi)-\frac{\delta}{1-\beta_0}
 \leq\frac{75}{2}\log d_E
       +\frac12\log\frac{d_E}{d_F}
       +\frac g2\left(\frac{\Gamma'}\Gamma(1/2)-\log\pi\right).
\]
Here $\delta=1$ if such a zero exists and $\delta=0$ otherwise; the
fraction involving $\beta_0$ is defined as zero in the latter case.
This is the explicit zero estimate preceding the invocation of the
no-Siegel-zero hypothesis in that proof. Since a possible
$\beta_0$ lies outside \eqref{eq:wei-stark-range},
\[
 \frac{\delta}{1-\beta_0}\leq16g!\log d_E.
\]
Therefore
\begin{equation}\label{eq:wei-average-bound}
 -\frac12\frac{L'}L(0,\chi)
       -\frac14\log\frac{d_E}{d_F}
 \leq\left(\frac{75}{4}+8g!\right)\log d_E+O(g),
\end{equation}
with an effective absolute constant in $O(g)$.

The proved averaged Colmez formula, in the source normalization, is
\[
 \frac1{2^g}\sum_\Phi h(E,\Phi)
 =-\frac12\frac{L'}L(0,\chi)
       -\frac14\log\frac{d_E}{d_F},
\]
where the sum runs over all $2^g$ CM types, with no quotient by
isomorphism. Also, stable Faltings heights satisfy the effective
universal lower bound $h(E,\Phi)\geq-gC_0$ for an absolute
constant $C_0$. These are the unconditional inputs recorded in
\cite[Theorems~2.1 and 5.2]{WeiPreprint}. For any chosen $\Phi_0$,
isolating its term and applying \eqref{eq:wei-average-bound} gives
\[
 \begin{split}
 h(E,\Phi_0)
 &=2^g\left(-\frac12\frac{L'}L(0,\chi)
                  -\frac14\log\frac{d_E}{d_F}\right)
       -\sum_{\Phi\ne\Phi_0}h(E,\Phi)\\
 &\leq A_g\log d_E+B_g,
 \end{split}
\]
for effective $A_g>0,B_g$ depending only on $g$. For example, the
coefficient $A_g=2^g(75/4+8g!)$ suffices after increasing $B_g$.

\emph{Adjacent types and reflex fields.}
Let $E_i^*$ be the reflex field of $(E,\Phi_i)$, and put
$M=E_1^*E_2^*$. We prove that $M$ contains a conjugate of $E$,
following the elementary argument of Wei's Lemma~5.5.
The reflex field of a type $\Phi$ is generated by the type traces
$\sum_{\varphi\in\Phi}\varphi(x)$ for $x\in E$.
Write $E=F(\sqrt{-a})$ with $a\in F$ totally positive. The two
types differ at exactly one real embedding $\sigma_0:F\hookrightarrow
\mathbb R$. Let $\varphi_1,\varphi_2$ be their respective extensions
at that embedding; these extensions are complex conjugates.
Subtracting the two type traces of $\sqrt{-a}$ gives
\[
 2\varphi_1(\sqrt{-a})\in M.
\]
Choose $b\in F$ with $F=\mathbb Q(b)$. Subtracting the type traces
of $b\sqrt{-a}$ gives
$2\sigma_0(b)\varphi_1(\sqrt{-a})\in M$. Division shows that
$\sigma_0(b)\in M$, and therefore $\varphi_1(E)\subset M$.

Root discriminants are nondecreasing under field extensions, and
the discriminant inequality for a compositum gives
$r_{E_1^*E_2^*}\leq r_{E_1^*}+r_{E_2^*}$. Hence
\[
 \frac{\log d_E}{2g}=r_E
 \leq r_M\leq r_{E_1^*}+r_{E_2^*}.
\]
Because the full $\mathcal O_E$-actions are defined over $K_i$,
the field $K_i$ contains the corresponding reflex field $E_i^*$,
after the fixed compatible embeddings into $\mathbb C$.
Consequently
\[
 \log d_E\leq2g(r_{K_1}+r_{K_2}).
\]
Apply the preceding individual height bound to $\Phi_1$ and
$\Phi_2$ and average. The required inequality follows with
$C_1(g)=4gA_g$ and $C_2(g)=B_g$.
\end{proof}

\paragraph{Source scope and a typographical correction.}
The journal's Theorem~1.4 is Theorem~1.7 in the arXiv version
\cite{WeiPreprint}. Both printed displays repeat $[K_1:\mathbb Q]$
in the denominator of the $d_{K_2}$ term. The symmetric expression
with $[K_2:\mathbb Q]$ in that denominator is what their
root-discriminant proof establishes, and it has been proved
explicitly above. The published special case where $E$ has no
imaginary quadratic subfield was already unconditional; the
present argument includes CM fields with such subfields.
Wei's separate theorem for individual heights relative to the root
discriminant of the field of definition assumes the full Colmez
conjecture in general, and is not asserted here.

\subsection{Individual heights for every abelian CM field}

The abelian-CM-field specialization of \cite[Theorem~1.3]{Wei} has no
remaining Colmez assumption, because the Colmez formula for abelian
CM fields is a theorem of Colmez and Obus. The published
unconditional special case \cite[Theorem~4.10]{Wei} excludes
imaginary quadratic subfields. The next result removes that
restriction. We give a direct proof to display exactly which
$L$-functions are required.

\begin{corollary}\label{cor:wei-abelian-height}
For each $g\geq1$, there are effective constants $C_3(g)>0,C_4(g)$
such that
\[
 h_{\mathrm{Falt}}^{\mathrm{st}}(A)\leq C_3(g)r_K+C_4(g)
\]
whenever $A/K$ has dimension $g$ and admits an embedding
$\mathcal O_E\hookrightarrow\operatorname{End}_K(A)$ for a CM
field $E$ of degree $2g$ that is Galois and abelian over $\mathbb Q$.
\end{corollary}
\begin{proof}
Let $G=\operatorname{Gal}(E/\mathbb Q)$, identify its embeddings with
$G$, and let $\Phi\subset G$ be the CM type of $A$. Its stabilizer
$H=\{h\in G:h\Phi=\Phi\}$ has fixed field the reflex field
$R=E^H$. The $\mathcal O_E$-action being defined over $K$ implies
$R\subset K$.

In the abelian case, the class function entering the Colmez formula
is simply $A_\Phi(\sigma)=|\Phi\cap\sigma\Phi|$. Its character
expansion has coefficients
\[
 m_\chi=\frac1{2g}
       \left|\sum_{\varphi\in\Phi}\chi(\varphi)\right|^2\geq0,
 \qquad A_\Phi=\sum_{\chi\in\widehat G}m_\chi\chi.
\]
This identity follows by expanding the square and applying finite
character orthogonality. In particular $m_1=g/2$ and, evaluating
at the identity, $\sum_\chi m_\chi=g$.
Let $c\in G$ be complex conjugation. The disjoint union
$G=\Phi\sqcup c\Phi$ shows that $m_\chi=0$ for every nontrivial
even character $\chi$. Therefore the nontrivial terms are odd and
their coefficients sum to $g/2$.
Moreover, if $m_\chi\ne0$, invariance $h\Phi=\Phi$ forces
$\chi(h)=1$ for every $h\in H$. Hence every character that occurs
factors through $\operatorname{Gal}(R/\mathbb Q)$.

Write $q_\chi$ for the conductor of the primitive Dirichlet character
corresponding to $\chi$. The conductor--discriminant formula for the
abelian extension $R/\mathbb Q$ gives
\[
 d_R=\prod_{\psi\in\widehat{\operatorname{Gal}(R/\mathbb Q)}}
                      q_\psi,
 \qquad q_\chi\leq d_R\quad\text{if }m_\chi\ne0.
\]
The proved abelian Colmez formula, in Wei's normalization
\cite[Theorem~4.8]{WeiPreprint}, is
\[
 h(E,\Phi)=-Z_\Phi-\tfrac12\mu_\Phi,
\]
where
\[
 Z_\Phi=-\tfrac g2\log(2\pi)
       +\sum_\chi m_\chi\frac{L'}L(0,\chi),
 \qquad \mu_\Phi=\sum_\chi m_\chi\log q_\chi.
\]
The trivial-character contribution to $Z_\Phi$ cancels its first
term, since $\zeta'(0)/\zeta(0)=\log(2\pi)$ and $m_1=g/2$.
For each remaining, odd character, its functional equation gives
\[
 -\frac{L'}L(0,\chi)
 =\log q_\chi-(\gamma+\log(2\pi))
      +\frac{L'}L(1,\overline\chi).
\]
The constant root number disappears under logarithmic
differentiation. Substitution yields the exact real identity
\[
 \begin{split}
 h(E,\Phi)
 &=\frac12\sum_{\chi\ne1}m_\chi\log q_\chi
   +\sum_{\chi\ne1}m_\chi\frac{L'}L(1,\overline\chi)
   -\frac g2(\gamma+\log(2\pi)).
 \end{split}
\]
The terms of conjugate characters pair to real values.
Corollary~\ref{cor:dirichlet-logderiv}, positivity of the $m_\chi$,
and their sum $g/2$ now give
\[
 h(E,\Phi)\leq\frac g4\log d_R+O\bigl(g\ell(d_R)+g\bigr),
\]
with an effective absolute constant in the $O$ term.
Since $[R:\mathbb Q]\leq2g$, the discriminant formula in a tower
implies
\[
 \log d_R=[R:\mathbb Q]r_R\leq2g r_K.
\]
Finally $\ell(x)\ll1+\log x$ for $x\geq1$. This proves the
corollary with effective constants depending only on $g$.
\end{proof}

The corollary retains the hypothesis that $E/\mathbb Q$ is abelian.
It makes no claim to the individual-height theorem for arbitrary
CM fields, where the full Colmez formula remains a separate input.

% Bibliography additions:
% \bibitem{Wei} X. Wei, Smallness of Faltings heights of CM abelian
% varieties, Journal of Number Theory 242 (2023), 73--101.
% DOI: 10.1016/j.jnt.2022.07.007.
% \bibitem{WeiPreprint} X. Wei, arXiv:2111.00617v1 (2021),
% https://arxiv.org/abs/2111.00617 .
% \bibitem{Stark} H. M. Stark, Some effective cases of the
% Brauer--Siegel theorem, Inventiones Mathematicae 23 (1974),135--152.
% DOI: 10.1007/BF01405166. Lemma9 is on pp.145--146.

\section{Fully effective Andr\'e--Oort for powers of the modular curve}
\label{sec:effective-ao}

Identify $Y(1)$ with the affine $j$-line. A \emph{special point} is a
singular modulus, the $j$-invariant of an elliptic curve with complex
multiplication. Its discriminant is the negative discriminant of its
endomorphism order, which need not be maximal.

A special subvariety of $Y(1)^n$ is an irreducible component of a locus
defined by fixing some coordinates to singular moduli and imposing
modular equations $\Phi_N(x_i,x_j)=0$ among the remaining coordinates.
Here $\Phi_N$ is the classical modular polynomial for cyclic
$N$-isogenies, and $\Phi_1(X,Y)=X-Y$. Equivalently, partition the
nonconstant coordinates into blocks, choose one distinguished
coordinate per block, and impose such a modular relation between it
and each other coordinate of the block. For a special subvariety $V$,
let $D(V)$ be the largest absolute discriminant of its constant
coordinates, with $D(V)=0$ if there are none. A special subvariety of
$X$ is \emph{maximal} if it is not contained in a larger special
subvariety of $X$.

The result below is the fully effective conclusion described in
\cite[Section 1.2 and Theorem 1]{BinyaminiAO} under GRH for imaginary
quadratic fields. It is stronger than the unconditional assertion
that there are finitely many maximal special subvarieties: the bound
and a terminating enumeration are computable from the input.

\begin{lemma}[Effective class numbers for every imaginary quadratic order]
\label{lem:order-siegel-effective}
For every rational $0<\eta<1/2$, an effectively computable positive
constant $c_\eta$ satisfies
\[
 h(\Delta)\geq c_\eta |\Delta|^{1/2-\eta}
\]
for every negative quadratic-order discriminant $\Delta$.
\end{lemma}
\begin{proof}
Write $\Delta=f^2D$, where $D$ is fundamental. Corollary~\ref{cor:class}
gives an effective positive constant $c$ with
$h(D)\geq c\sqrt{|D|}/\ell(|D|)$.
Since $t^\eta/\ell(t)$ has an effectively computable positive lower
bound for $t\geq3$, this implies
$h(D)\geq c'_{\eta}|D|^{1/2-\eta}$ effectively.
The order class-number formula gives
\[
 h(f^2D)=\frac{f h(D)}{[\mathcal O_K^\times:\mathcal O_f^\times]}
       \prod_{p\mid f}\left(1-\frac{\chi_D(p)}p\right)
 \geq\frac{h(D)}3\varphi(f).
\]
The unit index is at most $3$. For any $\eta>0$, one can effectively
choose $P_\eta$ such that
$1-p^{-1}\geq p^{-2\eta}$ for all primes $p>P_\eta$. The finite
product over smaller primes then proves
$\varphi(f)\geq c''_\eta f^{1-2\eta}$, with an effective positive
constant. Multiplying the two inequalities proves the assertion.
\end{proof}

\begin{theorem}[Binyamini's fully effective Andr\'e--Oort conclusion]
\label{thm:effective-ao}
For positive integers $n,d,r$, there is an effectively computable
constant $B(n,d,r)$ with the following property. If an algebraic
subvariety $X\subseteq Y(1)^n$ is defined over a number field $F$,
$\deg X\leq d$, and $[F:\mathbb Q]\leq r$, then every maximal
special subvariety $V\subseteq X$ satisfies
\[
 \deg V\leq B(n,d,r),\qquad D(V)\leq B(n,d,r).
\]
The degree is taken in the standard projective compactification
$\mathbb A^n\subset\mathbb P^n$, with the degrees of irreducible
components summed for reducible $X$. All maximal special subvarieties
of an explicitly given $X$ can be computed by a terminating algorithm.
In particular, the bound is independent of the heights of the
coefficients defining $X$.
\end{theorem}
\begin{proof}
We state exactly the established input being used. In
\cite[Section 2.2]{BinyaminiAO}, a fixed Siegel--Tatuzawa exceptional
field $K_*$ is introduced to account for the possible failure of an
effective class-number lower bound with exponent $1/2-\eta$.
Theorem 1 of that paper bounds $\deg V$ and the discriminants of all
constant coordinates whose CM fields differ from $K_*$, effectively
in terms of $\deg X$ and $[F:\mathbb Q]$ (with $n$ fixed).
The other discriminants have a bound that additionally depends on
the unknown discriminant of $K_*$. Section 1.2 explicitly includes
the case where the same effective lower bound holds without an
exception: in that case one takes $K_*=\varnothing$ and obtains the
fully effective result for every coordinate.

Lemma~\ref{lem:order-siegel-effective}, for example with the paper's
fixed choice $\eta=1/100$, supplies exactly this effective
class-number input for every order. Thus $K_*=\varnothing$ is now
permitted. All remaining inputs in that theorem are unconditional:
its effective point-counting estimates, its algebraic reduction to
isolated special points, and the effective version of Duke's
equidistribution theorem in the appendix by Kowalski. The last
effectivity depends on the same class-number lower bound, so it
introduces no second exceptional field or additional GRH assumption.
Applying the theorem gives the two stated bounds. Replacing the
actual degree and field degree by their finitely many possible values
at most $d,r$, and taking their maximum, gives $B(n,d,r)$ as stated.

We give the finite enumeration argument. Put $B=\lceil B(n,d,r)\rceil$.
There are finitely many quadratic-order discriminants $\Delta$ with
$|\Delta|\leq B$, and their singular moduli can be computed by
enumerating reduced primitive positive binary quadratic forms and
computing the corresponding class polynomials. These are terminating
unconditional algorithms; complex approximations can be made
rigorous with error bounds for the $j$-expansion.

Every modular relation needed in a block description of $V$ may be
chosen with $N\leq\deg V\leq B$. Indeed, project $V$ onto the two
coordinates of that relation. Its image is the irreducible modular
curve $\Phi_N=0$. Linear projection cannot increase the degree, and
this curve has degree at least
$\deg_X\Phi_N=N\prod_{p\mid N}(1+1/p)\geq N$.
Consequently one enumerates finitely many partitions of the coordinate
set, finitely many constant singular moduli from the preceding list,
and finitely many choices $1\leq N\leq B$ for the modular relations.
Compute the irreducible components of the resulting loci over
$\overline{\mathbb Q}$, retain those contained in $X$, and retain
only the maximal ones under inclusion. Factorization and containment
of explicitly given algebraic varieties over number fields are
effective. Every maximal special subvariety occurs in this list by
the proved bounds, and discarding contained entries introduces no
loss. Thus the algorithm terminates with precisely the required
collection.
\end{proof}

The effective differential-algebraic and point-counting theorems of
\cite{BinyaminiAO} are imported published inputs. Their proofs are
not reproduced here. The deduction above removes their sole
exceptional-field obstruction and records the complete enumeration
argument. It does not claim that the constants are small enough for
practical computation.

% BinyaminiAO: G. Binyamini, with an appendix by E. Kowalski,
% Some effective estimates for Andre--Oort in Y(1)^n,
% J. Reine Angew. Math.767(2020),17--35.
% DOI10.1515/crelle-2019-0028; https://arxiv.org/abs/1809.05302.

\subsection{Effectivity of Binyamini's polynomial bounds}
\label{sec:ao-polynomial}

There is a useful quantitative refinement of
Theorem~\ref{thm:effective-ao}. In this refinement the bound is
polynomial in the degree and logarithmic height of the input variety.
The corresponding polynomial bound, with an ineffective constant,
was already unconditional; the additional conclusion is that its
constants, and hence the algorithm using them, can be specified
effectively.

For a variety $X\subseteq\mathbb A^n$ defined over a number field
$F$, let $h(X)$ be the absolute logarithmic Weil height of its Chow
coordinates in the standard projective embedding, and set
\[
 \delta_X=\max\{1,[F:\mathbb Q],\deg X,h(X)\}.
\]
This is the complexity convention used in
\cite[Section~1.1.4]{BinyaminiFoliations}; we do not identify it
with the bit length of an arbitrary representation of the input.

\begin{theorem}[Effective constants in the polynomial Andr\'e--Oort bound]
\label{thm:ao-polynomial}
For each $n$, one can compute a polynomial $P_n$ such that every
maximal special subvariety $V$ of an algebraic
$X\subseteq Y(1)^n$ satisfies
\[
 \deg V\leq P_n(\delta_X),\qquad D(V)\leq P_n(\delta_X).
\]
The algorithm of \cite[Theorem~7 and Section~9.4]{BinyaminiFoliations}
for computing all such $V$ has an effective polynomial bound in
$\delta_X$ for fixed $n$, in the arithmetic presentation used there.
\end{theorem}
\begin{proof}
We specify the input and the dependence being removed.
Binyamini's Theorem~7 gives precisely these polynomial degree and
discriminant bounds, and the corresponding polynomial-step
algorithm, but with an ineffective constant. The paragraph
following that theorem identifies the sole source of ineffectivity
as Siegel's lower bound for quadratic class numbers. In the proof,
the class-number input supplies the Galois-orbit lower bound in
equation~(126). Section~9.2 reduces the positive-dimensional problem
to special points by effective algebraic constructions with
polynomial bounds. The point-counting estimates used in Section~9.3
are effective, and Section~9.4 uses effective algebraic separation
and the $j$-expansion to turn the bound into the asserted algorithm.

Lemma~\ref{lem:order-siegel-effective} now supplies the needed
uniform effective estimate for every imaginary quadratic order.
For example $h(\Delta)\geq c|\Delta|^{1/4}$ has an effectively
computable absolute $c>0$. Consequently the orbit constants in
the cited argument are effective. Explicitly, if a special point
$p=(j_1,\ldots,j_n)$ has coordinate discriminants $\Delta_i$ and
$\Delta(p)=\prod_i|\Delta_i|$, then
\[
 [\mathbb Q(p):\mathbb Q]\geq\max_i h(\Delta_i)
       \geq c\Delta(p)^{1/(4n)}.
\]
Over the defining field $F$, the orbit size is at least this
quantity divided by $[F:\mathbb Q]$. This supplies an explicit
effective polynomial lower bound of the form needed in
equation~(126).

One may also check separately the height input in equation~(121)
of \cite{BinyaminiFoliations}. If $j$ has order discriminant
$\Delta=f^2D$, the height identity
\cite[Lemma~4.1]{HabeggerHeight} and the nonnegativity of every
conductor correction give
\[
 h_F(E)\leq\frac14\log|\Delta|
      +\frac12\frac{L'}L(1,\chi_D)+C
 \leq C'\log(3|\Delta|)
\]
with effective constants, by
Corollary~\ref{cor:dirichlet-logderiv}.
The effective height comparison in equation~(3.1) of
\cite{HabeggerHeight} is
\[
 h(j)-c_0\log(3+h(j))\leq12h_F(E).
\]
Since $c_0\log(3+t)\leq t/2+C_0$ effectively for $t\geq0$, it
follows that $h(j)\leq C_1\log(3|\Delta|)$ effectively.
In particular the weaker bound $h(j)\ll_\varepsilon
|\Delta|^\varepsilon$ used in the point-counting proof has an
effective constant for every positive rational $\varepsilon$.
Thus no hidden ineffective height constant remains.

For the remaining passage to the point-counting region, use the
alternative in \cite[Remark~41]{BinyaminiFoliations}. It uses the
height estimate~(121) and logarithmic subdivision in place of
equidistribution to cover the relevant Galois conjugates by
$O_\varepsilon(\Delta(p)^\varepsilon)$ many foliation balls,
after adjusting $\varepsilon$. The height estimate just proved
makes these constants effective. This route preserves the
polynomial bounds and requires no separate equidistribution rate.

All formerly ineffective parameters in the published proof of
Theorem~7 have now been supplied effectively. Its finite sequence
of algebraic operations and polynomial point-counting bounds
therefore computes the coefficients and exponents of a valid
$P_n$, and supplies the asserted effective bound for its algorithm.
The polynomial-time existence assertion itself is not being claimed
as new: it is already part of Binyamini's unconditional theorem.
\end{proof}

% BinyaminiFoliations: G. Binyamini, Point counting for foliations over
% number fields, Forum Math. Pi 10(2022),e6,1--39.
% DOI10.1017/fmp.2021.20.
% HabeggerHeight: P. Habegger, Weakly bounded height on modular curves,
% Acta Math. Vietnam.35(2010),43--69.
% https://math.ac.vn/uploads/files/1001043.pdf.

\section{Edixhoven--Richard's Andr\'e--Oort theorem modulo a prime}
\label{sec:modp-ao}

Fix a rational prime $p$. A \emph{CM point over $\mathbb Q$} in
$\mathbb A^2_{\mathbb Q}$ means a closed point both of whose coordinates
are singular moduli. Its closure in $\mathbb A^2_{\mathbb Z}$ is finite
over $\mathbb Z$. Its \emph{reduction at $p$} means the underlying
reduced finite closed subset of its fibre over $p$. Thus the reduction
includes the reductions of the entire $G_{\mathbb Q}$-orbit, rather
than one chosen pair of singular moduli. This distinction is essential.

\begin{theorem}[Edixhoven--Richard]
\label{thm:modp-ao}
Let $\Sigma$ be any collection of reductions at $p$ of CM points over
$\mathbb Q$, and let $Z\subseteq\mathbb A^2_{\mathbb F_p}$ be the Zariski
closure of their union. Every one-dimensional irreducible component
of $Z$ is either a fibre of one of the coordinate projections or an
irreducible component of the image of
$Y_0(n)_{\mathbb F_p}\to\mathbb A^2_{\mathbb F_p}$ for some integer
$n\geq1$.
\end{theorem}

This is the complete statement of
\cite[Theorem~1.2]{EdixhovenRichard}, originally proved under GRH for
quadratic fields. The proof below replaces its only conditional input
and includes the passage from individual CM reductions to every curve
component. The special curves here include Frobenius transforms of
modular curves; the integer $n$ need not be prime to $p$.

\begin{proof}
We use the unconditional CM reduction facts established in
\cite[Sections~2--3]{EdixhovenRichard}. For an imaginary quadratic
order $\mathcal O_{K,f}=\mathbb Z+f\mathcal O_K$ with $p\nmid f$,
if $p$ splits in $K$, reduction gives a bijection between its CM
$j$-invariants and its ordinary $j$-invariants over
$\overline{\mathbb F}_p$. The resulting set $J_{K,f}$ has cardinality
$h(f^2D_K)$ and is a torsor under $\operatorname{Pic}(\mathcal O_{K,f})$.
Every ordinary $j$-invariant belongs to exactly one such set.
If a conductor is divisible by $p$, its prime-to-$p$ part gives the
same reduced set. If $p$ does not split in the CM field, all reductions
are supersingular, and the set of all supersingular $j$-invariants
in characteristic $p$ is finite.

In particular, each coordinate projection of an $s\in\Sigma$ is
entirely ordinary or entirely supersingular. In the ordinary case its
image is exactly one $J_{K,f}$. For an ordinary pair in $s$, its
canonical lifts have the same endomorphism orders as the reductions;
the reductions of the full Galois orbit of that pair of canonical lifts
are again exactly $s$. These assertions remain true for the original
CM points with conductor divisible by $p$: removing the $p$-primary
conductor is the quotient by inertia in the CM class-group action.

Suppose first that $Z$ is a reduced curve with no component a fibre
of a coordinate projection, and that the union of the $s\in\Sigma$
is dense in $Z$. Write $d_1,d_2$ for the degrees of the two projections
of $Z$, summed over components. Only finitely many points of $Z$ have
a supersingular coordinate. We may discard all $s$ with such a
coordinate and retain density: their union is contained in the
intersection of $Z$ with finitely many fibres.

For any remaining $s$, put
\[
 N_s=\#s(\overline{\mathbb F}_p),\qquad
 \Delta_i=f_i^2D_i\quad(i=1,2),\qquad
 D=\max\{|\Delta_1|,|\Delta_2|\},
\]
where $\mathcal O_{K_i,f_i}$ is its $i$-th coordinate endomorphism
order and $D_i$ is the fundamental discriminant of $K_i$.
The projections are surjective onto the corresponding CM torsors, so
\begin{equation}\label{eq:modp-orbit-size}
 \max_i h(\Delta_i)\leq N_s\leq h(\Delta_1)h(\Delta_2).
\end{equation}
Lemma~\ref{lem:order-siegel-effective}, with exponent $1/4$, and the
elementary upper bound $h(\Delta)\ll\sqrt{|\Delta|}\log(3|\Delta|)$
therefore give effective absolute constants with
\[
 N_s\geq cD^{1/4},\qquad \log N_s\ll\log(3D).
\]
There are only finitely many such sets $s$ for bounded $D$, because
there are only finitely many pairs of endomorphism orders and finitely
many points in each product $J_{K_1,f_1}\times J_{K_2,f_2}$.

We now replace the GRH step in the published Theorem~4.1. Define
\[
 m=p f_1f_2|D_1D_2|
          \prod_{\substack{r\leq\log N_s\\r\text{ prime}}}r.
\]
The empty product is $1$. The field $L=K_1K_2$ is abelian over
$\mathbb Q$, has degree at most $4$, and is contained in
$\mathbb Q(\zeta_m)$. The elementary bound
$\sum_{r\leq t}\log r\ll t$, together with
\eqref{eq:modp-orbit-size} and $f_1f_2\leq D$, gives
\[
 \log(3m)\ll_p\log(3D).
\]
Lemma~\ref{lem:isogeny-split-prime} supplies a prime $\ell$ with
\begin{equation}\label{eq:modp-splitting-prime}
 \ell\nmid p f_1f_2D_1D_2,\qquad
 \ell\text{ splits in both }K_1,K_2,\qquad
 \log N_s<\ell\ll_p(\log(3D))^8.
\end{equation}
It is thus split in both orders. Since a positive power of $D$
eventually exceeds every fixed power of its logarithm, all but finitely
many $s$ satisfy
\begin{equation}\label{eq:modp-bezout-size}
 N_s>2d_1d_2(\ell+1)^2.
\end{equation}
As $D$ tends to infinity, $\log N_s$ does too, so the primes obtained
in \eqref{eq:modp-splitting-prime} range over an infinite set.

Let $T_\ell$ be the Hecke correspondence on the $j$-line which sends
an elliptic curve to its $\ell+1$ quotients by subgroups of order
$\ell$. We verify
\begin{equation}\label{eq:modp-hecke-inclusion}
 s\subseteq (T_\ell\times T_\ell)(s).
\end{equation}
Choose an ordinary pair $(E_1,E_2)$ in $s$ and their canonical CM
lifts, with the CM fields embedded compatibly with their actions on
tangent spaces. Since $\ell$ splits in both fields and is prime to
both conductors, choose a prime of $K_1K_2$ above $\ell$; its
intersections $\mathfrak l_i$ with the two orders have index $\ell$.
CM reciprocity identifies simultaneous Frobenius action on the pair
of lifts with the inverse ideal-class actions
$[\mathfrak l_i]^{-1}$. The corresponding ideal actions give
$\ell$-isogenies in both coordinates. Both the original pair and its
simultaneous conjugate reduce to $s$, so the original pair lies in
the Hecke image of $s$. This proves
\eqref{eq:modp-hecke-inclusion} for every pair in $s$.

Consequently $s\subseteq Z\cap(T_\ell\times T_\ell)Z$.
In $\mathbb P^1\times\mathbb P^1$, the two projection degrees of
$(T_\ell\times T_\ell)Z$, with its correspondence multiplicities,
are $(\ell+1)^2d_1$ and $(\ell+1)^2d_2$. If the two curves had no
common component, their intersection would have at most
$2d_1d_2(\ell+1)^2$ geometric points by the intersection pairing on
$\mathbb P^1\times\mathbb P^1$. This contradicts
\eqref{eq:modp-bezout-size}. Thus for infinitely many $\ell$ the
intersection has a curve component.

We state precisely the unconditional geometric input used next:
\cite[Theorem~5.1]{EdixhovenRichard} says that if an irreducible
curve $C\subseteq\mathbb A^2_{\mathbb F_p}$ is not a coordinate fibre
and $(T_\ell\times T_\ell)C$ is reducible for infinitely many
primes $\ell$, then $C$ is a component of a modular correspondence.
No GRH is assumed in this criterion. Its inputs are the large
mod-$\ell$ monodromy of non-isotrivial elliptic curves over function
fields, Goursat's lemma for the two monodromy groups, and Zarhin's
isogeny theorem. More explicitly, reducibility forces the two
representations to be isomorphic up to a quadratic character for
infinitely many $\ell$. The characters range over a finite set:
outside the bad-reduction set they are unramified, and in
characteristic $2$ the common semistable extension obtained from
the two $3$-torsion representations bounds their conductors.
One twist therefore occurs infinitely often, and Zarhin's theorem
gives an isogeny of the generic elliptic curves. The minimal isogeny
gives the asserted modular component. This explains both the
unconditional nature of the criterion and its validity at $p=2$.

Write $Z=\bigcup_{i\in I}Z_i$ for its irreducible components. For
each of the infinitely many primes just obtained, some $Z_i$ is
contained in $(T_\ell\times T_\ell)Z_j$. When $\ell>12d_1$, this
image must be reducible. Indeed, if irreducible it equals $Z_i$.
For any ordinary $(x,y)$ in $Z_j$, the set $T_\ell(y)$ has at least
$(\ell+1)/12$ distinct points, by the elementary ordinary-isogeny
multiplicity bound used in \cite[Section~6]{EdixhovenRichard}.
Fixing any $x'\in T_\ell(x)$ would then give more than $d_1$ points
in one projection fibre of $Z_i$, which is impossible. Since $I$
is finite, one $Z_j$ has reducible Hecke image for infinitely many
$\ell$. The unconditional criterion shows that this $Z_j$ is special.

It remains to justify that this argument proves the assertion for
\emph{every} component, and for the original $Z$. This point needs
the full-orbit hypothesis. For an integer $n\geq1$, let $T(n)$
denote the reduced integral correspondence of pairs admitting an
isogeny of degree $n$. It is a finite union of modular
correspondences (in characteristic zero one factors out
multiplication by an integer from the kernel). In the ordinary
locus, if $s$ meets $T(n)_{\mathbb F_p}$, it is wholly contained
there. To see this, canonically lift the isogeny at the meeting
point. Every Galois conjugate of the lifted pair still admits an
isogeny of degree $n$, and all their reductions comprise $s$.

Choose $n$ for the special component just found, and remove all
components of $Z$ contained in $T(n)_{\mathbb F_p}$. Their complement
$Z'$ meets that correspondence in only finitely many points.
The sets $s$ meeting $T(n)_{\mathbb F_p}$ contribute only those
finitely many points to $Z'$. The remaining full sets $s$ are
contained in $Z'$ and have dense union there. Induction on the
number of components proves the assertion for every component of
a curve $Z$ without coordinate fibres.

Finally, for a general $Z$, the assertions are empty if its dimension
is $0$ or $2$. Otherwise remove its isolated points and its coordinate
fibre components. This removal can also be performed using whole
sets $s$. Let $B_1$ be the finite first-coordinate image of the
vertical components and isolated points, and $B_2$ the analogous
second-coordinate image of the horizontal components and isolated
points. If a projection of $s$ meets $B_i$, then that entire
projection is either supersingular or the unique ordinary CM torsor
$J_{K,f}$ containing the meeting point. Hence the union of all such
projections is finite. All discarded $s$ therefore lie on a finite
union of coordinate fibres; this union meets the remaining
non-fibre components in a finite set. The undiscarded $s$ are
contained in those remaining components and are still dense there.
The preceding induction applies, and proves the theorem.
\end{proof}

\paragraph{Scope.}
The theorem concerns reductions of full CM orbits over $\mathbb Q$,
not arbitrary individual points over $\overline{\mathbb F}_p$.
It is distinct from characteristic-zero Andr\'e--Oort and from
positive-characteristic formulations in terms of dense families of
positive-dimensional special subvarieties. We do not assert the
conjectural extensions to other orbit fields or higher dimensions.

% EdixhovenRichard: B. Edixhoven and R. Richard, A mod p variant of the
% Andre--Oort conjecture, Rend. Circ. Mat. Palermo (2) 69 (2020), 151--157.
% DOI: 10.1007/s12215-018-00392-y.
% Final author version, 14 December 2018:
% https://websites.math.leidenuniv.nl/edixhoven/publications/2018/andre-oort_mod_p_arxiv.pdf
% Publisher primary full text:
% https://link.springer.com/article/10.1007/s12215-018-00392-y

\section{Weakly bounded height on curves in the modular plane}
\label{sec:weakly-bounded-height}

Write $h(x)$ for the absolute logarithmic Weil height and
$h(x,y)=\max\{h(x),h(y)\}$. In the modular plane
$\mathbb A^2_{\overline{\mathbb Q}}$, a special curve is a modular
curve $Y_0(N)$ or a coordinate fibre whose fixed coordinate is a
singular modulus. A special point is a pair of singular moduli.
The plane itself is also special. Every point $P$ lies in a unique
smallest special subvariety $S(P)$. Define $S_{\mathbb Q}(P)$ to be
the union of the distinct Galois conjugates of $S(P)$ over
$\mathbb Q$, and take degrees in the compactification
$\mathbb P^1\times\mathbb P^1$ with respect to
$\mathcal O(1,1)$; the degree of a finite reduced set is its
cardinality.

\begin{theorem}[Habegger's weakly bounded height theorem]
\label{thm:weakly-bounded-height}
Let $C\subset\mathbb A^2_{\overline{\mathbb Q}}$ be an irreducible
algebraic curve which is not special. Let $d_1,d_2$ be the degrees
of its two coordinate functions on the smooth projective model of
$C$, with degree zero for a constant function. Suppose $d_1\ne d_2$.
There exists a constant $c(C)>0$ such that every
$P\in C(\overline{\mathbb Q})$ with $\dim S(P)\leq1$ satisfies
\[
 h(P)\leq c(C)\log\bigl(1+\deg S_{\mathbb Q}(P)\bigr).
\]
\end{theorem}

This is the complete conclusion of
\cite[Corollary~1.2(ii)]{HabeggerWBH}, whose hypothesis was GRH
for all odd real Dirichlet $L$-functions. The logarithmic bound is
uniform over the infinitely many special curves meeting $C$.
It is not a claim of bounded height independent of the special
subvariety, which would be false in general.

\begin{proof}
We first prove the uniform CM estimate needed for the coordinate
fibres. Let $j$ be a singular modulus and let its endomorphism order
have discriminant $\Delta=f^2D$, where $D<0$ is fundamental.
Let $E$ have $j$-invariant $j$, and write $h_F(E)$ for the stable
Faltings height in Deligne's normalization. The unconditional
Chowla--Selberg and conductor formula
\cite[Lemma~4.1]{HabeggerWBH} is
\begin{equation}\label{eq:wbh-cm-height}
 2h_F(E)=\frac12\log|\Delta|
       +\frac{L'}{L}(1,\chi_D)
       -\sum_{r\mid f}e_f(r)\log r-\gamma-\log(2\pi),
\end{equation}
where, for $r^a\Vert f$,
\[
 e_f(r)=\frac{1-\chi_D(r)}{r-\chi_D(r)}
                  \frac{1-r^{-a}}{1-r^{-1}}\geq0.
\]
The logarithmic derivative estimate
Corollary~\ref{cor:dirichlet-logderiv} therefore gives
$h_F(E)\ll\log|\Delta|$, with an absolute constant. The
unconditional comparison between the two heights
\cite[equation~(3.1)]{HabeggerWBH} gives an absolute $A>0$ with
\[
 h(j)-A\log(3+h(j))\leq12h_F(E)\leq h(j)+A.
\]
Since $A\log(3+t)\leq t/2+B_A$ for $t\geq0$ and a suitable
absolute $B_A$, the left inequality implies
$h(j)\ll\log|\Delta|$.

The class polynomial of this order is irreducible over $\mathbb Q$,
so $[\mathbb Q(j):\mathbb Q]=h(\Delta)$. Applying
Lemma~\ref{lem:order-siegel-effective} with exponent $1/4$ yields
$h(\Delta)\geq c_0|\Delta|^{1/4}$ for an absolute $c_0>0$.
Consequently
\[
 \log|\Delta|\leq4\log h(\Delta)+4|\log c_0|
       \ll\log(1+h(\Delta)).
\]
We have proved, for every singular modulus and every conductor,
\begin{equation}\label{eq:wbh-cm-degree}
 h(j)\ll\log\bigl(1+[\mathbb Q(j):\mathbb Q]\bigr).
\end{equation}
All constants in this auxiliary estimate can be chosen effectively.

We recall two unconditional height comparisons and give the argument
for the non-CM modular case as well. The coordinate-height relation
on a fixed curve, obtained from the height pairing for divisors
on its smooth projective model, is
\begin{equation}\label{eq:wbh-coordinate}
 |d_2h(x)-d_1h(y)|\leq A_C\sqrt{1+h(x)}
       \qquad((x,y)\in C(\overline{\mathbb Q})),
\end{equation}
provided $d_1>0$, after enlarging $A_C$ to include the finitely many
points over singularities. This is the unconditional relation
\cite[equation~(3.2)]{HabeggerWBH}. It follows from the fact that
the divisor $d_2(x)_\infty-d_1(y)_\infty$ has degree zero; its
height is bounded by a constant times the square root of a height
associated with the positive-degree divisor $(x)_\infty$.
In particular $h(y)\ll_C1+h(x)$. The same assertion holds with
the two coordinates interchanged whenever $d_2>0$.

Suppose first that neither coordinate of $P=(x,y)$ is a singular
modulus. Then $S(P)=Y_0(N)$ for a unique $N\geq1$. Indeed, a
cyclic isogeny between two elliptic curves without CM generates
their rank-one group of homomorphisms: if it were an integer
multiple of a generator by an integer of absolute value greater
than one, its kernel would contain the noncyclic full torsion
subgroup for that integer. Thus two cyclic isogenies between
the same pair have the same degree. In this case
\[
 \deg S_{\mathbb Q}(P)=2\Psi(N),\qquad
 \Psi(N)=N\prod_{r\mid N}(1+r^{-1})\geq N.
\]
Choose elliptic curves $E_x,E_y$ with these $j$-invariants. Their
cyclic degree-$N$ isogeny gives the unconditional Faltings estimate
$|h_F(E_x)-h_F(E_y)|\leq\frac12\log N$.
Combining this with the height comparison above gives
\begin{equation}\label{eq:wbh-isogeny-height}
 |h(x)-h(y)|\leq A\log(3+h(x)+h(y))+6\log N
\end{equation}
for an absolute $A$.
At least one projection degree is positive; interchange the
coordinates if necessary so that $d_1>0$. By
\eqref{eq:wbh-coordinate}, $h(y)\ll_C1+h(x)$.
Since the nonzero integer $d_2-d_1$ has absolute value at least one,
\[
 h(x)\leq |d_2h(x)-d_1h(y)|+d_1|h(y)-h(x)|
       \leq B_C\sqrt{1+h(x)}+6d_1\log N.
\]
The logarithm in \eqref{eq:wbh-isogeny-height} is absorbed into
the square-root term. The inequality
$B_C\sqrt{1+t}\leq t/2+B_C'$ implies
$h(x)\ll_C\log(1+N)$, and the same follows for $h(y)$.
As $2\Psi(N)\geq N$, this proves the desired inequality in this case.
This reproduces the unconditional part of Habegger's argument.

Suppose next that $x$ is a singular modulus. If $y$ is also a
singular modulus, then $S(P)=\{P\}$ and
\[
 \deg S_{\mathbb Q}(P)=[\mathbb Q(x,y):\mathbb Q]
      \geq[\mathbb Q(x):\mathbb Q].
\]
If $y$ is not a singular modulus, then
$S(P)=\{x\}\times\mathbb A^1$ and
$\deg S_{\mathbb Q}(P)=[\mathbb Q(x):\mathbb Q]$.
Thus \eqref{eq:wbh-cm-degree} bounds $h(x)$ by an absolute constant
times $\log(1+\deg S_{\mathbb Q}(P))$ in both cases.
Moreover $d_1>0$: otherwise $C=\{x\}\times\mathbb A^1$ would
be special, contrary to the hypothesis. Equation
\eqref{eq:wbh-coordinate} bounds $h(y)$ by $O_C(1+h(x))$;
the additive constant is absorbed because
$\log(1+\deg S_{\mathbb Q}(P))\geq\log2$.
The case where only $y$ is singular follows by interchanging the
coordinates. These cases exhaust $\dim S(P)\leq1$.
\end{proof}

The condition $d_1\ne d_2$ remains essential to this proof's
non-CM modular branch. The argument does not establish weakly
bounded height for all nonspecial plane curves. Nor does it
identify bounded-degree finiteness as new: that conclusion was
already unconditional in \cite[Corollary~1.1 and p.~46]{HabeggerWBH}.

% HabeggerWBH: P. Habegger, Weakly bounded height on modular curves,
% Acta Mathematica Vietnamica 35 (2010), no.1, 43--69.
% Primary published full text: https://math.ac.vn/uploads/files/1001043.pdf
% Exact formerly conditional statement: Corollary1.2(ii), pp47 and67--68.

\section{Effective Brauer--Manin sets for singular and CM Kummer surfaces}
\label{sec:cm-k3-brauer-manin}

For a smooth projective variety $X$ over a number field $k$, put
$\operatorname{Br}X=H^2_{\mathrm{\acute et}}(X,\mathbb G_m)$,
$\operatorname{Br}_0X=\operatorname{im}(\operatorname{Br}k\to
\operatorname{Br}X)$, and
$\operatorname{Br}_1X=\ker(\operatorname{Br}X\to
\operatorname{Br}X_{\overline k})$. Its Brauer--Manin set is
\[
 X(\mathbb A_k)^{\operatorname{Br}}
 =\left\{(P_v)_v:\sum_v\operatorname{inv}_v\alpha(P_v)=0
                 \text{ for every }\alpha\in\operatorname{Br}X\right\}.
\]
A singular K3 surface means a smooth K3 surface whose geometric
N\'eron--Severi group has rank $20$. The Kummer surface of an
abelian surface is the minimal resolution of its quotient by $[-1]$.

\begin{theorem}[Balestrieri--Johnson--Newton's effectivity theorem]
\label{thm:cm-k3-brauer-manin}
Let $k$ be a number field and let $X/k$ be either a singular K3
surface or a surface geometrically isomorphic to
$\operatorname{Kum}(E_1\times E_2)$, where both elliptic curves
$E_i/\mathbb C$ have complex multiplication by imaginary quadratic
orders. Then $X(\mathbb A_k)^{\operatorname{Br}}$ is effectively
computable from equations for $X$ and $k$.
\end{theorem}

This is the full conclusion of
\cite[Theorem~7.8]{BJN2023}, stated there under GRH. The orders may
be nonmaximal, the two CM fields may differ, and $X$ need not be
a Kummer surface over $k$. Effective computability is in the
sense of \cite[Theorem~1]{KreschTschinkel2011}: an effective
description of the indicated adelic subset, with a computable
bound on the algorithm's running time in terms of the input.
It does not decide the existence of a rational point whenever
that subset is nonempty.

\begin{proof}
We replace the analytic input and then verify all the geometric
and algorithmic hypotheses. Throughout, implied constants are
absolute and effectively computable.

Let $E/F$ be a CM elliptic curve, where $d=[F:\mathbb Q]$,
and let $\Delta=f^2D<0$ be the discriminant of its endomorphism
order. The class polynomial gives
$h(\Delta)=[\mathbb Q(j(E)):\mathbb Q]\leq d$. Lemma
\ref{lem:order-siegel-effective}, with exponent $1/4$, implies
\begin{equation}\label{eq:brauer-cm-discriminant}
 |\Delta|\ll d^4.
\end{equation}
The CM height formula \eqref{eq:wbh-cm-height}, its nonnegative
conductor correction, and Corollary
\ref{cor:dirichlet-logderiv} also give
\begin{equation}\label{eq:brauer-cm-height}
 h_F(E)\ll\log(2|\Delta|)\ll\log(2d).
\end{equation}
Here $h_F$ is the stable Faltings height. Changing between the
normalizations used in the cited isogeny theorems adds a fixed
constant, which is harmless in this inequality.

We next bound the transcendental Brauer group of a product
$A=E_1\times E_2$ over $F$, uniformly in its CM orders.
If the two curves are geometrically isogenous, their CM field is
the same imaginary quadratic field $K$. Write
$\Delta_i=f_i^2D_K$ for their order discriminants. The
unconditional statement \cite[Theorem~6.4]{BJN2023} supplies an
extension $M/FK$ of degree dividing $\#\mathcal O_K^\times\leq6$
over which all homomorphisms between the two curves are defined,
and gives
\[
 \#\frac{\operatorname{Br}A}{\operatorname{Br}_1A}
 \leq\frac4{\pi^2}f_1^2f_2^2|D_K|[M:\mathbb Q]^4.
\]
Since $[M:\mathbb Q]\leq12d$ and
$f_1^2f_2^2|D_K|=|\Delta_1\Delta_2|/|D_K|$, equation
\eqref{eq:brauer-cm-discriminant} proves
\begin{equation}\label{eq:brauer-isogenous-product}
 \#\frac{\operatorname{Br}A}{\operatorname{Br}_1A}\ll d^{12}.
\end{equation}

If the curves are geometrically non-isogenous, put $F'=FK_1K_2$,
so $[F':\mathbb Q]\leq4d$. All endomorphisms of $A_{\overline F}$
are defined over $F'$. The unconditional isogeny and Brauer
estimates of \cite[Theorems~1.5(3) and~1.8]{GaudronRemond2023},
applied to the product as in \cite[equation~(6.6)]{BJN2023},
give a positive integer $b$ such
that the exponent of
$\operatorname{Br}(A_{\overline F})^{\operatorname{Gal}(\overline F/F')}$
is at most $2b^{3/2}$ and
\[
 b\leq241^4\,2^{60}[F':\mathbb Q]^4
 \max\{1,\log[F':\mathbb Q],h_F(E_1)+h_F(E_2)+3\}^{4}.
\]
For clarity, in the notation of Gaudron--R\'emond this
specialization has $n=2$ and $b\leq\Upsilon^4$. Their bound
for $\Upsilon$ is $241\,2^9\exp(4)[F':\mathbb Q]$ times
the displayed maximum, and $\exp(4)<2^6$ gives the stated
estimate. Here the $e$ in their formula $(en)^{2n}$ is
Euler's number; we use this formula directly rather than
the smaller numerical constant printed in (6.6). Equation
\eqref{eq:brauer-cm-height} therefore yields
$b\ll d^4\log(2d)^4$.
The geometric N\'eron--Severi rank of this product is $2$;
accordingly $\operatorname{Br}(A_{\overline F})\simeq
(\mathbb Q/\mathbb Z)^4$. A finite subgroup of this group
with exponent at most $2b^{3/2}$ has at most $16b^6$ elements.
The natural injection of the transcendental quotient into
these Galois invariants proves
\begin{equation}\label{eq:brauer-nonisogenous-product}
 \#\frac{\operatorname{Br}A}{\operatorname{Br}_1A}
 \ll d^{24}\log(2d)^{24}.
\end{equation}
The injections used here, and below, do not require a rational
point: for every extension $L/F$, the map
$\operatorname{Br}A/\operatorname{Br}_1A\to
\operatorname{Br}A_L/\operatorname{Br}_1A_L$ is injective
because both map to the same geometric Brauer group.

We pass from products to surfaces. Let $M(r)$ be the least
common multiple of the orders of finite subgroups of
$\operatorname{GL}_r(\mathbb Z)$. Minkowski's theorem makes
this an effectively computable integer. If $X$ is geometrically
a Kummer surface of a product, the unconditional geometric
results \cite[Remark~3.7, Theorem~3.5, and Corollary~3.10]{BJN2023}
give an extension $L/k$ with
\[
 [L:k]\leq2^9\,3M(20)
\]
and CM elliptic curves $E_1,E_2/L$ such that
\[
 \frac{\operatorname{Br}X}{\operatorname{Br}_1X}
 \lhook\joinrel\longrightarrow
 \frac{\operatorname{Br}(E_1\times E_2)}
      {\operatorname{Br}_1(E_1\times E_2)}.
\]
These results include the possible $2$-covering of the abelian
surface: an extension of degree at most $16$ trivializes it.
Thus they apply to every geometric Kummer surface in the
statement, not only to a product construction already given
over $k$. Equations \eqref{eq:brauer-isogenous-product} and
\eqref{eq:brauer-nonisogenous-product} give, for $d=[k:\mathbb Q]$,
\begin{equation}\label{eq:brauer-cm-kummer}
 \#\frac{\operatorname{Br}X}{\operatorname{Br}_1X}
 \leq C d^{24}\log(2d)^{24}
\end{equation}
for an effective absolute $C$.

For an arbitrary singular K3 surface, the unconditional
Shioda--Inose construction, with its descent as used in
\cite[proof of Theorem~7.5]{BJN2023}, gives an extension
$k'/k$ of degree at most $2M(20)$ and a dominant rational map
$Y\dashrightarrow X_{k'}$ of degree two, where $Y/k'$ is a
Kummer surface with geometric N\'eron--Severi rank $20$.
Its elliptic factors are isogenous CM curves. Pullback on
Brauer groups induces a map on transcendental quotients
whose kernel is killed by two; this follows from the
restriction--corestriction identity for the degree-two
extension of function fields. The kernel injects into
$\operatorname{Br}(X_{\overline k})[2]$, which has order $4$
because $\operatorname{Br}(X_{\overline k})\simeq
(\mathbb Q/\mathbb Z)^2$. Hence
\[
 \#\frac{\operatorname{Br}X}{\operatorname{Br}_1X}
 \leq4\,
 \#\frac{\operatorname{Br}Y}{\operatorname{Br}_1Y}.
\]
The preceding effective uniform bound applies to $Y$ and
again gives \eqref{eq:brauer-cm-kummer}, after enlarging $C$.
Resolution of the rational map causes no change in these
Brauer groups, by birational invariance for smooth projective
surfaces.

It remains to include the algebraic Brauer group and construct
the adelic set. The group $\operatorname{Pic}(X_{\overline k})$
is torsion free of rank $r\leq20$. The unconditional bound
\cite[Remark~1.4]{BJN2023} is
\[
 \#\frac{\operatorname{Br}_1X}{\operatorname{Br}_0X}
 \leq M(r)^r\leq M(20)^{20}.
\]
We have therefore produced a computable bound for
$\#(\operatorname{Br}X/\operatorname{Br}_0X)$, depending
only on $[k:\mathbb Q]$. The unconditional algorithm
\cite[Theorem~8.38]{PoonenTestaVanLuijk2015} computes the
geometric N\'eron--Severi group with its Galois action and
divisor representatives. Its applicability to K3 surfaces
in characteristic zero uses the established Tate theorem
for K3 surfaces, not an additional conjecture. Since
$\operatorname{Pic}^0(X_{\overline k})=0$, these divisors
generate the geometric Picard group. The hypotheses of
\cite[Theorem~1]{KreschTschinkel2011} are now all satisfied:
equations for a smooth projective surface, generators for
its torsion-free geometric Picard group, and an effective
bound for the Brauer group modulo constants. That theorem
computes $X(\mathbb A_k)^{\operatorname{Br}}$, as required.
\end{proof}

The numerical constants of the original GRH bounds in
\cite[Theorems~7.4--7.6]{BJN2023} are not claimed here; the
complete published algorithmic statement in Theorem~7.8 is
the admitted conclusion. The rank-$20$ Kummer subcase was
already unconditional in their Theorem~7.7. The full statement
also includes non-Kummer singular K3 surfaces and products
of non-isogenous CM elliptic curves. Algorithms for principal
CM K3 surfaces, including Valloni's algorithm and Monnet's
later explicit bounds, impose maximal-order CM and do not
by themselves give this entire statement.

% Bibliography entries to add to the assembled manuscript:
% \bibitem{BJN2023} F. Balestrieri, A. Johnson, and R. Newton,
% Explicit uniform bounds for Brauer groups of singular K3 surfaces,
% Ann. Inst. Fourier 73 (2023), 567--607. DOI:10.5802/aif.3526.
% \bibitem{GaudronRemond2023} E. Gaudron and G. Remond,
% Nouveaux theoremes d'isogenie, Mem. Soc. Math. France (N.S.) 176
% (2023), 1--123. DOI:10.24033/msmf.484.
% \bibitem{KreschTschinkel2011} A. Kresch and Y. Tschinkel,
% Effectivity of Brauer--Manin obstructions on surfaces,
% Adv. Math. 226 (2011), 4131--4144. DOI:10.1016/j.aim.2010.11.012.
% \bibitem{PoonenTestaVanLuijk2015} B. Poonen, D. Testa, and R. van Luijk,
% Computing Neron--Severi groups and cycle class groups,
% Compos. Math. 151 (2015), 713--734. DOI:10.1112/S0010437X14007878.

\section{Joint equidistribution of CM points}
\label{sec:joint-cm-equidistribution}

Khayutin's published Theorems~1.3 and~3.10
\cite{Khayutin2019} assume the absence of exceptional
Landau--Siegel zeros of the quadratic CM fields. We remove
this analytic assumption. The two fixed splitting primes,
the stated restrictions on the orders, and the genericity
conditions are retained. The maximal-order case of the second
statement is the published Theorem~1.4.

\begin{theorem}[Khayutin's joint-packet and Galois-orbit conclusions]
\label{thm:joint-cm-equidistribution}
The following statements hold without an RH or GRH assumption.
\begin{enumerate}
\item Let $G$ be a $\mathbb Q$-form of $\operatorname{PGL}_2$,
let $K_f\subset G(\mathbb A_f)$ be compact open, and fix a
compact real torus $K_\infty\subset G(\mathbb R)$. Put
\[
 Y=G(\mathbb Q)\backslash G(\mathbb A)/(K_\infty K_f).
\]
Let $P_i$ be $K_\infty$-invariant toral packets with negative
fundamental discriminants $D_i$, and also write $P_i$ for
their finite images in $Y$. Here a toral packet is the image
of an adelic orbit of an anisotropic rational torus, as in
\cite[\S\S2.4.1--2.4.2]{Khayutin2019}. The finite packet is a principal
homogeneous space for a finite abelian group $C_i$, with a
canonical surjection
$C_i\longrightarrow\operatorname{Pic}(\mathcal O_{E_i})$,
where $E_i=\mathbb Q(\sqrt{D_i})$.
Choose $\sigma_i\in C_i$ and put
\[
 N_i=\min\{\operatorname N\mathfrak a:
       0\ne\mathfrak a\subseteq\mathcal O_{E_i},\ 
       [\mathfrak a]=[\sigma_i]\},\qquad
 \mu_i=\frac1{|P_i|}\sum_{z\in P_i}\delta_{(z,\sigma_i z)}.
\]
Assume $N_i\longrightarrow\infty$ and that two fixed
distinct primes $p_1,p_2$ split in every $E_i$.
Every weak-$*$ limit point of $(\mu_i)$ is a convex combination
of the uniform probability measures on the connected
components of $Y\times Y$.

\item Let $G$ be a $\mathbb Q$-form of $\operatorname{PGL}_2$
split over $\mathbb R$, and let $X$ be a finite product of
indefinite Shimura curves relative to this same $G$, at fixed
levels. Let $x_i\in X$ be special points such that all
coordinates of $x_i$ have CM by the same imaginary quadratic
order $\mathcal O_i\subset E_i$. Assume that its conductor
$f_i=[\mathcal O_{E_i}:\mathcal O_i]$ is bounded independently
of $i$. Let $\nu_i$ be the normalized counting
measure on the finite Galois orbit of $x_i$.
Assume that two fixed distinct primes $p_1,p_2$ split in
every $E_i$, and that, for every proper special subvariety
$Z\subsetneq X$, the set $\{i:x_i\in Z\}$ is finite.
Every weak-$*$ limit point of $(\nu_i)$ is a convex combination
of the uniform probability measures on the connected
components of $X$.
\end{enumerate}
Here uniform measure means the normalized invariant measure
on the indicated locally homogeneous component. In a
connected product the conclusion is convergence to its
uniform probability measure.
\end{theorem}

\begin{proof}
We first give the exact analytic replacement, and then spell
out the published unconditional geometric and sieve inputs
that it makes applicable. For an imaginary quadratic field
$E$ of fundamental discriminant $D$, write $\chi_D$ for its
primitive quadratic Dirichlet character. We have
\begin{equation}\label{eq:joint-cm-analytic}
 \zeta_E(s)=\zeta(s)L(s,\chi_D),\qquad
 \left|\frac{L'}{L}(1,\chi_D)\right|
       \ll\log\log(e^e|D|),\qquad
 L(1,\chi_D)\gg\frac1{\log\log(e^e|D|)}.
\end{equation}
The last two assertions follow from
Corollary~\ref{cor:dirichlet-logderiv} and
Theorem~\ref{thm:L1}. In particular, for a single absolute
constant $C$, uniformly in all these fields,
\[
 \frac{L'}{L}(1,\chi_D)\le C\log|D|.
\]
This is exactly the analytic inequality assumed in
\cite[Proposition~10.15]{Khayutin2019} and deduced there
from the no-exceptional-zero hypothesis in \S10.4.
Alternatively, the zero-free half-plane for both factors of
$\zeta_E$ directly excludes every exceptional zero in its
usual region $\beta>1-c/\log|D|$ once $|D|$ is large.
The fixed constant $c$ in the definition of that region is
immaterial here.

We record the proof mechanism to identify the full
dependency on this inequality. In the notation of
\cite[Theorem~3.2]{Khayutin2019}, joint packets lift to
homogeneous toral sets
\[
 H_i=[T_i(\mathbb A)^\Delta(g_i,s_i g_i)]
       \subset [G\times G],\qquad
 [G]=G(\mathbb Q)\backslash G(\mathbb A).
\]
In the following adelic argument write $\mu_i$ for their
invariant probability measures, whose finite projections are
the packet measures in the statement.
The superscript $+$ on $G(\mathbb A)^+$ denotes the image
of the adelic points of the simply connected cover of $G$.
The unconditional reduction in
\cite[Proposition~3.4 and Corollary~3.5]{Khayutin2019}
makes the split tori at $p_1,p_2$ fixed by bounded right
translations. Duke's theorem gives tightness and the correct
one-coordinate marginals. The unconditional joining
classification used in
\cite[Theorem~4.4 and Corollary~4.5]{Khayutin2019}
then says that a limit is a mixture of
$(G\times G)(\mathbb A)^+$-invariant measures and the
intermediate measures supported on translates of homogeneous
Hecke correspondences.

For a general joint lift, let $\mathcal O_i$ be its associated
order and define $N_i$ as the minimum norm of an integral
invertible $\mathcal O_i$-ideal in the class of $s_i$, as in
\cite[Lemma~10.4]{Khayutin2019}. This agrees with the notation
of part~(1). The following two ranges exhaust the possible twists.
Let $\theta<1/2$ be an available unconditional bound towards
Ramanujan in the normalization of
\cite[\S10.4, equation~(56)]{Khayutin2019}.
For an admissible ellipse-counting exponent $\theta_l>2/3$
sufficiently close to $2/3$, put
\[
 a=\frac{2-\theta_l^{-1}}3,
 \qquad b=\frac1{2+2/(1-\theta)}.
\]
Since $a\to1/6$ as $\theta_l\downarrow2/3$ and $b>1/6$,
we can fix $a<c<b$. Separate the indices into
$N_i\ge |D_i|^c$ and $N_i<|D_i|^c$.

In the first range,
\cite[Lemma~10.4, Theorem~8.7, Proposition~10.15, and
\S10.4]{Khayutin2019} give, for the published Bowen test
neighborhoods $B^{(-n,n)}$, for each fixed $n$ and translated
Hecke measure $\lambda_\xi$, and all sufficiently large $i$,
\[
 \operatorname{Cor}[\mu_i,\lambda_\xi](B^{(-n,n)})
 \ll F(\operatorname{ctr}(\xi))p_1^{-4n}
       \left(1+\frac{|D_i|^{-2/3+o(1)}}{L(1,\chi_{D_i})}\right).
\]
Here the cross-correlation is the integral of the nonnegative
automorphic kernel, as in
\cite[Definitions~8.1--8.2]{Khayutin2019}:
\[
 \operatorname{Cor}[\alpha,\beta](B)
 =\int_{[G\times G]}\int_{[G\times G]}
   \sum_{\gamma\in(G\times G)(\mathbb Q)}
   \mathbf1_{B\times B}(x^{-1}\gamma y)\,d\alpha(x)\,d\beta(y).
\]
Also $\operatorname{ctr}(\xi_1,\xi_2)
=\xi_1^{-1}\xi_2$, and $F$ is a positive continuous
function independent of $i,n$. These are unconditional
estimates with the explicit displayed logarithmic-derivative
inequality as input; the class-number formula cancels the
factor $\sqrt{|D_i|}L(1,\chi_{D_i})$ against the toral
volume. Equation~\eqref{eq:joint-cm-analytic} makes the
parenthesis bounded. The unconditional entropy comparison
\cite[Lemma~10.1]{Khayutin2019}, with $\rho=1$, excludes
all intermediate Hecke measures. Its continuity requirement
on $F$ is established in the cited \S10.4.

In the second range the unconditional
Ellenberg--Michel--Venkatesh argument, with the adaptations
proved in \cite[\S10.4, equations~(56)--(59)]{Khayutin2019},
applies with the fixed gap $b-c>0$. It uses a Hecke norm
gap and Linnik's basic lemma; both are unconditional.
The otherwise ineffective use of Siegel's lower bound in
that basic lemma can also be replaced by
\eqref{eq:joint-cm-analytic}, although effectivity is not
needed for the qualitative conclusion. The resulting
maximal-entropy statement again implies
$(G\times G)(\mathbb A)^+$-invariance. Passing to
subsequences in the two ranges therefore proves the
conclusion of the published Theorem~3.2 whenever its
non-analytic hypotheses hold. This argument imports the
proved joining, geometric, and sieve lemmas just identified;
it assumes no unproved automorphic bound.

For part~(1), the fundamental-discriminant condition means
that the conductor is $1$. Minkowski's bound gives
$N_i\ll\sqrt{|D_i|}$, so $N_i\to\infty$ forces
$|D_i|\to\infty$. The condition $N_i\to\infty$ is the
escape from every fixed Hecke correspondence used in the
passage from the published Theorem~3.2 to Theorem~1.3.
All the hypotheses of that passage are now satisfied. The
projection from $[G\times G]$ to $Y\times Y$ sends the
invariant limit measures to the stated combinations of
component measures. The residual spectrum may prescribe
unequal component weights, as explained in
\cite[Proposition~3.6]{Khayutin2019}; no equality of these
weights is asserted.

For part~(2), now writing $D_i=\operatorname{disc}(\mathcal O_i)$,
bounded $|D_i|$ would allow only finitely many
CM points at the fixed levels. Since a special point is a
proper special subvariety, the hypothesis implies
$|D_i|\to\infty$. Since $D_i=f_i^2\operatorname{disc}(E_i)$
and $f_i$ is bounded, the field discriminants also tend to
infinity. The geometric and sieve estimates above are uniform
after partitioning the sequence into the finitely many possible
conductors: their allowed dependence on $f_i$ causes no loss.
The logarithmic-derivative inequality uses the field character,
exactly as required by the published Proposition~10.15.
The passage to many factors is
\cite[Theorem~3.9]{Khayutin2019}: the same unconditional
joining classification reduces it to the two-coordinate
case, because a connected reductive subgroup of $G^r$
projecting onto $G\times G$ in every pair of coordinates
is all of $G^r$. The special-subvariety hypothesis implies
escape from every fixed pairwise Hecke correspondence.
Shimura reciprocity identifies the finite Galois-orbit
measure with the push-forward of the homogeneous toral
measure, as in \cite[\S3.5, Theorem~3.10]{Khayutin2019}.
If the coordinates belong to different CM orbits of the
same order, the bounded compact translations appearing
there admit convergent subsequences. Right translation
preserves the required invariance because $G^r(\mathbb A)^+$
is normal. Pushing forward therefore gives exactly the
conclusion in part~(2). Tightness, supplied by the marginal
equidistribution, also proves the asserted convergence when
the product is connected.
\end{proof}

The published targets are Theorems~1.3 and~3.10 of
\cite{Khayutin2019}, including Theorem~1.4 as its
maximal-order specialization, with their no-exceptional-zero
assumption removed. No varying splitting-prime substitution
is made. Results for products of pairwise distinct quaternion
algebras do not by themselves imply this repeated-factor
mixing statement. Nor does this argument remove the fixed
splitting-prime condition from the more general mixing
conjecture.

% Bibliography entry:
% \bibitem{Khayutin2019} I. Khayutin,
% Joint equidistribution of CM points,
% Ann. of Math. (2) 189 (2019), 145--276.
% DOI:10.4007/annals.2019.189.1.4.
% Official primary PDF:
% https://annals.math.princeton.edu/wp-content/uploads/annals-v189-n1-p04-s.pdf

\section{Effective bounds for Campagna's singular \texorpdfstring{$S$}{S}-units}
\label{sec:singular-s-units}

A \emph{singular modulus} is the $j$-invariant of a complex elliptic
curve with complex multiplication. It is an algebraic integer. For a
set $S$ of rational primes, a nonzero algebraic integer $\alpha$ is an
$S$-unit if every prime divisor of
$|N_{\mathbb Q(\alpha)/\mathbb Q}(\alpha)|$ belongs to $S$.
The set $S$ is allowed to be infinite.

\begin{theorem}[Campagna's effective singular-$S$-unit conclusion]
\label{thm:singular-s-units}
Let $\ell\geq5$ be a rational prime, and put
\[
 S_0=\{p\text{ prime}:p\equiv1\pmod3\},\qquad
 S_\ell=S_0\cup\{\ell\}.
\]
There is an effectively computable $B(\ell)$ such that every
singular modulus $j$ which is an $S_\ell$-unit has order discriminant
$\Delta$ satisfying $|\Delta|\leq B(\ell)$. All these singular
moduli can consequently be determined by a finite algorithm.
\end{theorem}

This is the precise effective conclusion of
\cite[Theorem~1.4]{CampagnaBounds}, published under GRH for the
Dirichlet $L$-functions of imaginary quadratic fields. Mere
finiteness was already unconditional. The point here is the
computability of a bound valid for every discriminant.

\begin{proof}
We first verify the analytic hypothesis isolated in
\cite[Definition~5.1 and Theorem~5.5]{CampagnaBounds}. That hypothesis
asks for one effective $k\geq0$ such that, for every negative
fundamental discriminant $D$,
\begin{equation}\label{eq:campagna-P}
 \frac{L'}{L}(1,\chi_D)\geq-0.2485\log|D|-k.
\end{equation}
Corollary~\ref{cor:dirichlet-logderiv} gives an effective absolute
$A$ with $|L'/L(1,\chi_D)|\leq A\ell(|D|)$.
Because $A\ell(t)-0.2485\log t$ tends to $-\infty$ effectively,
its positive part has an effectively bounded supremum for $t\geq3$.
Any effective upper bound for that supremum is a valid $k$.
Thus the hypothesis in Campagna's stronger Theorem~5.5 is satisfied.

We spell out the remaining transfer, including why its height
comparison has a strict positive margin. Write $d=|\Delta|$ and
$\Delta=f^2D$. In the normalization used in
\cite[Proposition~5.4]{CampagnaBounds}, the unconditional
Chowla--Selberg and Nakkajima--Taguchi formulas give
\[
 h_F(E)=\frac14\log d+\frac12\frac{L'}L(1,\chi_D)
  -\frac12\sum_{p\mid f}e_f(p)\log p
  -\frac12(\gamma+\log(2\pi)),
 \quad
 e_f(p)=\frac{1-\chi_D(p)}{p-\chi_D(p)}
              \frac{1-p^{-v_p(f)}}{1-p^{-1}}.
\]
Here $h_F$ is the stable Faltings height with Deligne's
normalization. The unconditional height comparison used in that
proposition is $h(j)\geq12h_F(E)+8.64$, where $h$ is the absolute
logarithmic Weil height. These geometric formulas are established
inputs, and involve no Riemann hypothesis.

For completeness the conductor correction cannot spoil the
coefficient in the height lower bound. Since
$e_f(p)\leq2(1-p^{-v_p(f)})/((p+1)(1-p^{-1}))$, define the additive
function
\[
 \delta(m)=0.2485\log m-
  \sum_{p\mid m}\frac{\log p}{p+1}
                 \frac{1-p^{-v_p(m)}}{1-p^{-1}}.
\]
For $r\geq1$ its increment at a prime power is
\[
 \delta(p^{r+1})-\delta(p^r)
   =\left(0.2485-\frac{p^{-r}}{p+1}\right)\log p>0.
\]
Also $\delta(p)>0$ for $p\geq5$, whereas
$\delta(2),\delta(3)<0$. Hence
\[
 0.2485\log f-\frac12\sum_{p\mid f}e_f(p)\log p
 \geq\delta(f)\geq\delta(2)+\delta(3)>-0.0605.
\]
Substituting \eqref{eq:campagna-P} and $|D|=d/f^2$ into the height
formula proves
\begin{equation}\label{eq:campagna-height-lower}
 h(j)\geq1.509\log d-C_k,
\end{equation}
with an effective absolute constant $C_k$ depending on $k$.

Next an $S_\ell$-unit in the theorem must in fact be an
$\{\ell\}$-unit. We give the reduction used in
\cite[Theorem~5.5]{CampagnaBounds}, based on
\cite[Theorem~1.2 and Claim~3.1]{CampagnaUnits}.
Suppose a prime $p\equiv1\pmod3$ divides the norm of $j$.
At a prime above $p$, its CM elliptic curve and the curve with
$j$-invariant $0$ have the same reduction. The latter reduction is
ordinary because $p$ splits in $\mathbb Q(\sqrt{-3})$.
Deuring's reduction theorem then identifies the CM field of $j$
with $\mathbb Q(\sqrt{-3})$.
For every order in this field, reduction at $2$ and at $3$ is
supersingular. In each of these characteristics the only
supersingular $j$-invariant is $0$. Consequently both $2$ and $3$
divide the norm of every nonzero such $j$. Neither belongs to
$S_\ell$, a contradiction. Thus no prime in $S_0$ divides the
norm. If $\ell\equiv1\pmod3$, there are no such moduli, by the
unconditional theorem that no singular modulus is an algebraic
unit. It remains to consider $\ell\equiv2\pmod3$.

Let $H=h(\Delta)$ denote the order class number, to distinguish it
from the Weil height. Since $h(j)=h(j^{-1})$, write
\[
 h(j)=A_\infty+N_\ell,
\]
where the two terms are respectively the archimedean and the
$\ell$-adic contributions to the height of $j^{-1}$.
The two unconditional estimates in
\cite[proof of Theorem~5.5, equations (42)--(44)]{CampagnaBounds}
are, for $d\geq10^{14}$,
\begin{align*}
 A_\infty&\leq\frac{12F(d)\log d}{H}
       +3\log\left(\frac{F(d)\sqrt d\log d}{H}\right)-3.77,
 &F(d)&=\max_{1\leq a\leq\sqrt d}2^{\omega(a)},\\
 N_\ell&\leq
   \max\left\{\frac32(\log(9d)+\log\ell),\,3\log\ell\right\}.
\end{align*}
The first estimate comes from the archimedean analysis of Bilu,
Habegger and K\"uhne quoted there; the second is Campagna's
deformation-theoretic valuation bound, his Theorem~3.1 applied to
$y^2=x^3+1$. The automorphism count is $6$ because $\ell\geq5$,
which is the reason for retaining this restriction on $\ell$.

Here the new effective class-number lower bound makes the final
comparison particularly direct. Put $\eta=1/10000$.
Lemma~\ref{lem:order-siegel-effective} gives
$H\geq c_\eta d^{1/2-\eta}$ effectively.
Also $F(d)\leq C_\eta d^\eta$ effectively: choose a prime
threshold above which $2\leq p^{2\eta}$, bound the product of
the factors $2$ at smaller primes by a fixed constant, and use
$a\leq\sqrt d$.
The preceding archimedean estimate therefore implies
\[
 A_\infty\leq
 C_1d^{-1/2+2\eta}\log d
       +6\eta\log d+3\log\log d+C_2,
\]
with effective constants. For $d\geq\ell/9$, the other estimate is
$N_\ell\leq\tfrac32\log d+C_\ell$, with effective $C_\ell$.
Combining with \eqref{eq:campagna-height-lower} gives
\[
 (0.009-6\eta)\log d
 \leq C_1d^{-1/2+2\eta}\log d+3\log\log d+C_3(\ell,k).
\]
The left coefficient is $0.0084>0$; the right side is
$o(\log d)$ with an effective rate. Choose an effective threshold
$B(\ell)$, enlarged to exceed $10^{14}$ and $\ell/9$, beyond which
this inequality fails. This proves the discriminant bound.

Finally enumerate the negative quadratic-order discriminants
$|\Delta|\leq B(\ell)$ and compute their class polynomials exactly.
Each such polynomial is irreducible over $\mathbb Q$ and its
constant coefficient, up to sign, is the norm of any of its roots.
Omit the polynomial $X$, and test whether the remaining constant
coefficients are powers of $\ell$ up to sign. The reduction above
shows that exactly the roots of the retained polynomials are the
required $S_\ell$-units. Thus this is a terminating exact algorithm.
\end{proof}

% CampagnaBounds: F. Campagna, Effective bounds on differences of singular
% moduli that are S-units, Math. Proc. Cambridge Philos. Soc.174(2023),415--450.
% DOI10.1017/S0305004122000378; arXiv:2102.06396 final author manuscript.
% CampagnaUnits: F. Campagna, On singular moduli that are S-units,
% Manuscripta Math.166(2021),73--90. DOI10.1007/s00229-020-01230-1.
% https://arxiv.org/abs/1904.08958.

\section{Effective representation by positive ternary quadratic forms}
\label{sec:effective-ternary}

The existence theorem of Duke--Schulze-Pillot was already unconditional.
Its \emph{effective} version is the published GRH consequence recovered
here: Kane \cite[Introduction, p.~128]{KaneTernary} explicitly identifies
Dirichlet GRH as sufficient to make the representation threshold
computable. The further GRH assumptions on weight-$2$ modular
$L$-functions in Kane's practical bounds and numerical tables are not
available from Theorem~\ref{thm:input}, and those conclusions are not
asserted here.

An integral ternary quadratic form means a homogeneous quadratic
polynomial $Q$ in three variables with integer coefficients. It is
positive definite if $Q(x)>0$ for nonzero $x\in\mathbb R^3$.
A representation by an integral vector is \emph{primitive} when the
greatest common divisor of its coordinates is $1$. The genus of $Q$
consists of the integral forms equivalent to $Q$ over every
$\mathbb Z_p$; its spinor genus is the usual finer equivalence class
obtained by imposing the local spinor-norm condition. Both contain
finitely many integral equivalence classes.

\begin{theorem}[Effective Duke--Schulze-Pillot theorem]
\label{thm:effective-ternary}
For every positive definite integral ternary form $Q$, one can compute
an integer $B_Q$ with the following property: if $n>B_Q$ is represented
primitively by a form in the spinor genus of $Q$, then $Q$ represents
$n$. Consequently, an algorithm computes the complete finite set
\[
 \{n\geq1:n\text{ is represented primitively by the spinor genus of }Q,
                    \quad n\text{ is not represented by }Q\}.
\]
\end{theorem}
\begin{proof}
Write $r_Q(n)$ for the number of representations of $n$ by $Q$, and
write $r_{\rm spn}(n)$ for the average over its spinor genus, weighted
by the reciprocals of the automorphism-group orders and divided by
the total weight. We use two precise unconditional inputs from
Duke--Schulze-Pillot \cite{DSP}. Their Theorem~3(i), with no imposed
congruence condition on the representing vectors, gives, for every
$\eta>0$,
\begin{equation}\label{eq:ternary-cusp-error}
 |r_Q(n)-r_{\rm spn}(n)|
 \leq A_{Q,\eta}n^{1/2-1/28+\eta},
\end{equation}
where $A_{Q,\eta}$ is effective. This is the half-integral-weight
cusp-form estimate; its proof does not use Siegel's ineffective
class-number lower bound.

The arithmetic part of their Lemma~5(ii), before the application of
Siegel's bound, has the following form on integers represented
primitively by the spinor genus:
\begin{equation}\label{eq:ternary-local-lower}
 r_{\rm spn}(n)\geq b_{Q,\eta}
                 n^{1/2-\eta}L(1,\chi_{\Delta_n}),
 \qquad |\Delta_n|\leq c_Q n.
\end{equation}
Here $\Delta_n<0$ is the fundamental discriminant of
$\mathbb Q(\sqrt{-2n\det A})$, where
$A=(\partial^2 Q/\partial x_i\partial x_j)$, and $b_{Q,\eta}>0$
and $c_Q$ are effective. We specify the arithmetic content of this
input to locate the issue of effectivity. The Siegel mass formula
and its spinor-genus refinement express the averages in local
densities and quadratic class numbers. At primes dividing the fixed
level, primitive representability gives an effective uniform positive
lower bound for the primitive local density. Indeed, if $x$ is a
primitive local vector, the identity
$\operatorname{adj}(A)Ax=(\det A)x$ bounds the minimum valuation of
the coordinates of the gradient $Ax$ by $v_p(\det A)$; Hensel lifting
from an effectively bounded congruence depth then gives such a lower
bound. At anisotropic primes primitivity also bounds the valuation
of $n$. The remaining factors are the elementary Euler
factors in the quadratic-order class-number formula and divisor
sums. Their losses can be bounded by $C_{Q,\eta}n^\eta$ with
effective constants. For instance, for every fixed $\eta>0$,
\[
 \prod_{p\mid m}(1-p^{-1})\geq c_\eta m^{-\eta}
\]
follows by choosing an effective threshold beyond which
$1-p^{-1}\geq p^{-\eta}$ and treating the finitely many smaller
primes separately. The spinor correction is computed by the local
densities in \cite[Theorem~2(ii)]{DSP}. More explicitly,
Schulze-Pillot \cite[Korollar~2 and its proof, pp.~130--131]{SP2}
compares the positive primitive mass of an exceptional half-genus
with the primitive genus mass. The relevant local density ratios
take only finitely many values: at good primes one of the two
local contributions is zero, and at bad primes their recurrences
stabilize, possibly interchanging the contributions, after finitely
many steps. The resulting positive comparison constant is therefore
computable from the fixed lattice and the finitely many exceptional
square classes. The primitive-spinor condition is exactly the
positivity condition used in \cite[Lemma~5(ii)]{DSP}. Thus the constants in
\eqref{eq:ternary-local-lower} preceding $L(1,\chi_{\Delta_n})$
are effective. It is the replacement of this last factor by
Siegel's $|\Delta_n|^{-\eta}$ bound that made the original
representation threshold ineffective.

Theorem~\ref{thm:L1} now gives
$L(1,\chi_{\Delta_n})\geq c/\ell(|\Delta_n|)$.
For fixed $Q$ and $\eta$, the elementary inequality
$\ell(c_Qn)\leq C_{Q,\eta}n^\eta$ has an effective constant.
Therefore \eqref{eq:ternary-local-lower} implies
\[
 r_{\rm spn}(n)\geq b'_{Q,\eta} n^{1/2-2\eta}
\]
effectively. Set $\eta=1/112$. The exponent of the error in
\eqref{eq:ternary-cusp-error} is then $1/2-3\eta$.
It follows that $r_Q(n)>0$ whenever
\[
 n^\eta>2A_{Q,\eta}/b'_{Q,\eta}.
\]
For example, any effectively chosen integer larger than
$\max\{1,(2A_{Q,\eta}/b'_{Q,\eta})^{112}\}$ can serve as $B_Q$.

To obtain the asserted finite set, enumerate the finitely many
integral classes in the genus using positive-definite reduction,
and select the spinor genus by the computable local spinor-norm
conditions. For each $1\leq n\leq B_Q$, test primitive
representation by these finitely many forms and representation by
$Q$. Each test is finite: a computable positive lower bound
$\lambda$ for the least eigenvalue of the Gram matrix bounds the
coordinates of a representing vector by $\sqrt{n/\lambda}$, after
adjusting for the convention $Q(x)=x^tAx/2$. The preceding proof
excludes every larger exception. No assertion about a practical
running time is required or made.
\end{proof}

\paragraph{Why the primitive-spinor hypothesis is retained.}
Local representability alone does not give this theorem: spinor
exceptions may occupy infinite square classes. Moreover, repeated
division by a prime at which $Q$ is anisotropic can leave the number
of representations bounded while $n$ grows. These are the explicit
obstructions discussed after \cite[Lemma~5]{DSP}; neither is removed
by a zero-free region for Dirichlet $L$-functions.

There is also a uniform version for squarefree integers, with the
same determinant exponent as Duke's published theorem.

\begin{theorem}[Effective form of Duke's determinant bound]
\label{thm:duke337}
There is an effective absolute constant $C>0$ such that the following
holds for every positive definite integral ternary form $Q$.
Put
\[
 D=\det\left(\frac{\partial^2Q}{\partial x_i\partial x_j}\right).
\]
If $n$ is positive and squarefree, $n>CD^{337}$, and
$Q(x)\equiv n\pmod{8D^3}$ has a solution, then $Q$ represents $n$
over $\mathbb Z$. In particular, all squarefree integers which are
locally represented by $Q$ but not represented integrally can be
listed by a finite algorithm.
\end{theorem}
\begin{proof}
We retain Duke's published exponent $337$
\cite[Theorem~1]{DukeTernary}, while making its constant effective.
Let $r_{\rm gen}(n)$ denote the automorphism-weighted average over
the genus. Duke's unconditional Theorem~2 gives
\begin{equation}\label{eq:duke-uniform-error}
 |r_Q(n)-r_{\rm gen}(n)|
 \leq A_\varepsilon D^{11/2}n^{1/2-1/28}(Dn)^\varepsilon
\end{equation}
for squarefree $n$, with an effective constant depending only on
$\varepsilon>0$.

Equations~(3)--(4) of that paper express $r_{\rm gen}(n)$ as
a positive absolute normalization factor times
\[
 L(1,\chi)\,\mathcal N(n;Q)\sqrt{n/D},\qquad
 \mathcal N(n;Q)=m^{-2}
 \#\{x\in(\mathbb Z/m\mathbb Z)^3:Q(x)\equiv n\pmod m\},
 \quad m=(2D)^3.
\]
The quadratic character $\chi$ here may be imprimitive; its modulus
$M$ is at most an absolute constant times $Dn$. Its primitive
inducing character $\chi^*$ has conductor at most $M$, and
\[
 L(1,\chi)=L(1,\chi^*)
       \prod_{p\mid M}\left(1-\frac{\chi^*(p)}p\right)
 \geq L(1,\chi^*)\frac{\varphi(M)}M
 \gg\frac1{\ell(M)^2}.
\]
The last inequality uses Theorem~\ref{thm:L1} and the elementary
effective bound $M/\varphi(M)\ll\ell(M)$. The character is
nonprincipal, since the associated quadratic field is imaginary.
The assumed congruence solution gives $\mathcal N(n;Q)\geq m^{-2}$.
Consequently, with an effective absolute $c>0$,
\begin{equation}\label{eq:duke-effective-main}
 r_{\rm gen}(n)\geq
 c\,n^{1/2}D^{-13/2}\ell(Dn)^{-2}.
\end{equation}
This also verifies directly the effectivity of the lower bound
in equation~(5) of Duke's proof.

The ratio of the right side of \eqref{eq:duke-uniform-error} to
the lower bound \eqref{eq:duke-effective-main} is at most
\[
 C_\varepsilon D^{12+\varepsilon}
 n^{-1/28+\varepsilon}\ell(Dn)^2
 \leq C'_{\varepsilon}D^{12+2\varepsilon}
 n^{-1/28+2\varepsilon},
\]
where $\ell(u)^2\ll_\varepsilon u^\varepsilon$ is effective.
Take $\varepsilon=1/(56\cdot676)$ and write
$a=1/28-2\varepsilon>0$. If $n>CD^{337}$, this ratio is at most
\[
 C'_{\varepsilon}C^{-a}
 D^{12+2\varepsilon-337a}
 =C'_{\varepsilon}C^{-a}D^{-1/56}.
\]
An effective absolute choice of $C$ makes this less than $1/2$.
Thus $r_Q(n)\geq r_{\rm gen}(n)/2>0$.

For the final algorithm, test the finitely many squarefree
$n\leq CD^{337}$. Local representability is decided by the same
finite congruence test, as in Duke's theorem, and integral
representability is a finite search in a positive-definite
ellipsoid. The bound excludes all further exceptions.
\end{proof}

\paragraph{Scope of the new effectivity.}
The numerical value of $C$ has not been optimized or evaluated in
this record. It is an effectively computable absolute constant,
which is exactly what the algorithmic conclusion needs. The
existence of a constant with exponent $337$ was already proved
unconditionally by Duke; the conclusion newly justified by the
imported zero-free theorem is its effectivity. Kane's much smaller
practical thresholds, the exact Ramanujan-form exception list, and
his uniform bound of order $p^{14+\varepsilon}$ for supersingular
CM lifting require further weight-$2$ information and are excluded.

% Bibliography additions:
% KaneTernary: B. Kane, Representations of integers by ternary quadratic
% forms, Int. J. Number Theory 6 (2010), 127--158.
% DOI 10.1142/S1793042110002831.
% https://hub.hku.hk/bitstream/10722/192191/1/content.pdf
% DSP: W. Duke and R. Schulze-Pillot, Representation of integers by
% positive ternary quadratic forms and equidistribution of lattice
% points on ellipsoids, Invent. Math. 99 (1990),49--57.
% DOI 10.1007/BF01234411.
% https://www.math.ucla.edu/~wdduke/preprints/lattice2.pdf
% DukeTernary: W. Duke, On ternary quadratic forms,
% J. Number Theory 110 (2005),37--43. DOI 10.1016/j.jnt.2004.06.013.
% https://www.math.ucla.edu/~wdduke/preprints/ternary.pdf

\section{Effective CM lifting to every supersingular elliptic curve}
\label{sec:kane-cm-lifting}

Kane's published Theorems~1.1 and~1.4 \cite{KaneCM} give effective
thresholds for surjectivity and multiplicity of CM reduction under
GRH. We recover those qualitative effective conclusions. The existence
of thresholds without effectivity was already unconditional, by
Elkies--Ono--Yang \cite{EOY}. The numerical cutoffs and exceptional
discriminant lists in Kane's Theorems~1.2--1.3 are not claimed here.

Let $\mathcal S_p$ be the finite set of geometric isomorphism classes
of supersingular elliptic curves in characteristic $p$. For
$E\in\mathcal S_p$, put
\[
 w_E=\#\operatorname{Aut}_{\overline{\mathbb F}_p}(E),\qquad
 W_p=\sum_{E\in\mathcal S_p}\frac1{w_E},\qquad
 \mu(E)=\frac{1/w_E}{W_p},\qquad
 \mu_p=\min_{E\in\mathcal S_p}\mu(E)>0.
\]
For a negative fundamental discriminant $D$, let $H_D(X)\in\mathbb Z[X]$
be the monic Hilbert class polynomial of degree $h(D)$. Fix an
embedding $\overline{\mathbb Q}\hookrightarrow\overline{\mathbb Q}_p$
to define reduction of its roots. When $p$ does not split in
$\mathbb Q(\sqrt D)$, every root reduces to a supersingular invariant.
Let $m_E(D)$ be the number of these roots reducing to $j(E)$,
counted before reduction. Equivalently, it is the multiplicity of
$j(E)$ in $H_D(X)\bmod p$. Thus
\[
 \sum_{E\in\mathcal S_p}m_E(D)=h(D).
\]
Finally, let
$S_p(X)=\prod_{E\in\mathcal S_p}(X-j(E))\in\mathbb F_p[X]$;
the product has distinct roots.

\begin{theorem}[Effective form of Kane's CM lifting theorems]
\label{thm:kane-cm-lifting}
For every prime $p$ and every $0<c<1$, there is an effectively
computable $D_{p,c}$ such that, for every negative fundamental
discriminant $D$ satisfying $|D|\geq D_{p,c}$ and
$\left(\frac Dp\right)\ne1$, one has
\[
 m_E(D)\geq c\,\mu(E)h(D)
 \qquad\text{for every }E\in\mathcal S_p.
\]
In particular,
\[
 S_p(X)^{\lceil c\mu_p h(D)\rceil}\mid H_D(X)\bmod p.
\]
Consequently, an algorithm computes the complete finite set of
negative fundamental discriminants for which $p$ is nonsplit and
the CM reduction map fails to be onto $\mathcal S_p$.
\end{theorem}
\begin{proof}
If $p=2$ or $3$, there is only one geometric supersingular class.
Deuring's reduction theorem then gives $m_E(D)=h(D)$ whenever
$p$ is nonsplit, proving the assertion. Assume henceforth $p\geq5$.
Increasing the threshold allows us to assume $D<-4$, so that
$\#\mathcal O_D^\times=2$.

We first specify the algebraic comparison, including the inert and
ramified cases. For $E\in\mathcal S_p$, its endomorphism ring $R_E$
is a maximal order in the definite quaternion algebra ramified
exactly at $p$ and infinity. Its Gross lattice and theta series are
\[
 L_E=\{x\in\mathbb Z+2R_E:\operatorname{tr}(x)=0\},\qquad
 \theta_E(z)=\sum_{x\in L_E}e^{2\pi i\operatorname{nrd}(x)z}
             =1+\sum_{n\geq1}a_E(n)e^{2\pi inz}.
\]
Each vector of norm $|D|$ determines an embedding
$\mathcal O_D\hookrightarrow R_E$, by sending $\sqrt D$ to that
vector, and conversely. The embedding is optimal because
$\mathcal O_D$ is the maximal quadratic order. Conjugation by
$R_E^\times$ has stabilizer $\mathcal O_D^\times$ of order $2$,
so the number of conjugacy classes of these embeddings is
$2a_E(|D|)/w_E$.

Under the CM lifting correspondence, the fraction of these
embedding classes that are normalized at $p$ is $1/2$ when $p$
is inert and $1$ when $p$ is ramified. A normalized embedding
corresponds to one CM invariant reducing to $j(E)$; these are the
Deuring--Gross--Zagier facts proved in the form needed here in
\cite[Section~3, especially Lemma~3.2]{EOY}. It follows that
\begin{equation}\label{eq:cm-lift-count}
 m_E(D)=\frac{k_p(D)}{w_E}\,a_E(|D|),\qquad
 k_p(D)=
 \begin{cases}
 1,&\left(\frac Dp\right)=-1,\\
 2,&p\mid D.
 \end{cases}
\end{equation}
The important feature is that $k_p(D)$ is independent of $E$.
This orbit calculation fixes the convention that $w_E$ is the
full automorphism-group order.

We next use the unconditional effective cusp-form estimate.
All the lattices $L_E$ lie in one genus: maximal quaternion orders
are conjugate locally, and conjugation preserves both reduced norm
and trace. Their theta series therefore have the same Eisenstein
part. Fix $E_0\in\mathcal S_p$. The differences
$\theta_E-\theta_{E_0}$ are weight-$3/2$ cusp forms of fixed
level $4p$. Duke's bound, as used in \cite[Section~3]{EOY} and
\cite{DSP}, gives effectively, for every $\eta>0$,
\begin{equation}\label{eq:cm-lift-cusp}
 |a_E(|D|)-a_{E_0}(|D|)|
 \leq A_{p,\eta}|D|^{1/2-1/28+\eta}
\end{equation}
for fundamental $D$ outside an effectively computable finite set,
uniformly over the finite set $\mathcal S_p$. To make explicit a
possible half-integral-weight qualification, first remove the
unary-theta component and apply the estimate to its orthogonal
complement. Unary theta series have support in finitely many
computable square classes $t m^2$ at this fixed level. A fundamental
discriminant has square part at most $4$, so those supports contain
only finitely many fundamental $D$. They can all be placed below
the threshold. Thus no assertion about unary-theta coefficients
at arbitrary integers is needed. The constants in this cusp-form
bound are effective; Siegel's class-number lower bound does not
enter its proof.

Set $c_E(D)=a_E(|D|)-a_{E_0}(|D|)$ and
$\overline c(D)=W_p^{-1}\sum_E c_E(D)/w_E$. Summing
\eqref{eq:cm-lift-count} and using $\sum_E m_E(D)=h(D)$ yields
the exact identity
\begin{equation}\label{eq:cm-lift-discrepancy}
 m_E(D)-\mu(E)h(D)
   =\frac{k_p(D)}{w_E}\bigl(c_E(D)-\overline c(D)\bigr).
\end{equation}
In particular, the normalization of the common Eisenstein series
has canceled. Since $k_p(D)\leq2$ and $w_E\geq2$, equations
\eqref{eq:cm-lift-cusp}--\eqref{eq:cm-lift-discrepancy} give
\[
 |m_E(D)-\mu(E)h(D)|
 \leq 2A_{p,\eta}|D|^{1/2-1/28+\eta}.
\]

The class-number formula and Theorem~\ref{thm:L1} supply an
effective absolute $b>0$ with
\[
 h(D)\geq b\frac{\sqrt{|D|}}{\ell(|D|)}.
\]
Take $\eta=1/56$. Dividing the preceding discrepancy estimate by
$h(D)$ gives, with effective $B_p$,
\[
 \left|\frac{m_E(D)}{h(D)}-\mu(E)\right|
 \leq B_p|D|^{-1/56}\ell(|D|).
\]
The right side tends effectively to zero. Choose $D_{p,c}$ above
the finite exceptional set so that it is at most
$(1-c)\mu_p$ for every $|D|\geq D_{p,c}$. Such a choice is
effective, for example by bounding
$\ell(t)\leq C t^{1/112}$ with an effective absolute $C$.
Then
\[
 \frac{m_E(D)}{h(D)}\geq\mu(E)-(1-c)\mu_p
                         \geq c\mu(E).
\]
Since the multiplicities are integers, the claimed divisibility
with the ceiling follows. Every multiplicity is positive, so
the reduction map is surjective.

For the algorithmic conclusion, take, for example, $c=1/2$.
The set $\mathcal S_p$, its automorphism orders, and its Gross
lattices are computable by the finite elliptic-curve and quaternion
procedures described in \cite[Sections~2 and~4]{KaneCM}.
Their modular forms and the effective constants just used therefore
give a computable threshold. Enumerate the finitely many negative
fundamental $D$ below that threshold for which $p$ is nonsplit.
Compute $H_D(X)\bmod p$ and test whether it is divisible by
$S_p(X)$. Hilbert class polynomials are computable exactly, for
example by reduced quadratic forms and rigorous precision bounds
for their complex roots. This finite test determines every
exception, and the proved threshold excludes every larger one.
\end{proof}

\begin{corollary}[Effective fixed multiplicity and modular congruence]
\label{cor:cm-lift-multiplicity}
Given a prime $p$ and a positive integer $t$, one can compute a
threshold $D_{p,t}$ such that every negative fundamental $D$ with
$|D|\geq D_{p,t}$ and $p$ nonsplit satisfies
$S_p(X)^t\mid H_D(X)\bmod p$. In particular, one can compute a
threshold beyond which there exists $G_{D,p}(X)\in\mathbb Z[X]$
of degree at most $\lfloor h(D)/p\rfloor$ satisfying
\[
 H_D(j(z))\,|\,U(p)\equiv G_{D,p}(j(z))\pmod p.
\]
Here $U(p)$ sends $\sum_n a(n)q^n$ to $\sum_n a(pn)q^n$.
\end{corollary}
\begin{proof}
Take $c=1/2$ in Theorem~\ref{thm:kane-cm-lifting} and enlarge its
threshold until $\mu_p h(D)/2\geq t$, using the effective
class-number lower bound in that proof. This proves the first
assertion. For $t=2$, apply the unconditional polynomial congruence
criterion \cite[Theorem~2.3(1)]{EOY}. Its hypothesis only requires
the square of the product of supersingular factors with
$j\notin\{0,1728\}$ to divide $H_D\bmod p$; our stronger
divisibility supplies it. The degree bound is part of that
criterion. The original existence statements were already
unconditional; the recovered conclusion is a computable threshold,
as discussed explicitly by Kane after his Theorem~1.4.
\end{proof}

\paragraph{Scope of the transfer.}
The exponent in the effective discrepancy estimate is used only
to prove termination of the finite procedure. No bound polynomial
in $p$ for the threshold is asserted. In particular, the
$p^{14+\varepsilon}$-type thresholds and the numerical exception
tables requiring weight-$2$ GRH are not supplied by this argument.

% Bibliography additions:
% KaneCM: B. Kane, CM liftings of supersingular elliptic curves,
% J. Theor. Nombres Bordeaux 21 (2009), 635--663.
% DOI 10.5802/jtnb.692.
% https://www.numdam.org/item/10.5802/jtnb.692.pdf
% EOY: N. D. Elkies, K. Ono, T. Yang, Reduction of CM elliptic curves
% and modular function congruences, IMRN 2005, no.44, 2695--2707.
% https://arxiv.org/abs/math/0512350

% Integration fragment. Requires amsmath, amssymb, amsthm, hyperref.
% The analytic input (AH-L1) below is to be supplied by the main document's
% unconditional short Euler product theorem derived from the new zero-free strip.
\section{The Achter--Howe bounds for split abelian surfaces}
\label{sec:achter-howe}

The result recovered here is the second assertion of Achter and Howe,
\emph{Split abelian surfaces over finite fields and reductions of genus-2 curves},
\emph{Algebra \& Number Theory} \textbf{11} (2017), 39--76,
Theorem~1.2, \href{https://doi.org/10.2140/ant.2017.11.39}{doi:10.2140/ant.2017.11.39}.
It concerns varieties over a fixed finite field. It does not assert the conjectured
asymptotic for the primes of split reduction of a fixed abelian surface over a number
field.

Write $N(q)$ for the number of $\mathbb F_q$-isomorphism classes of pairs
$(A,\lambda)$, where $A$ is a two-dimensional abelian variety, $\lambda$ is a
principal polarization defined over $\mathbb F_q$, and $A$ is isogenous over
$\mathbb F_q$ to a product of elliptic curves. This is an ordinary cardinality;
it is not the sum of reciprocal automorphism orders. Put
\[
 L(q)=\log(3q),\qquad \ell(q)=\log\log(e^e q).
\]
These positive expressions avoid conventions for the finitely many small fields.

\begin{theorem}[Achter--Howe's bounds]
\label{thm:achter-howe-transfer}
With absolute positive constants,
\[
 \frac{q^{5/2}}{L(q)\ell(q)^6}\ll N(q)
 \ll q^{5/2}L(q)^2\ell(q)^4
\]
for every prime power $q$. These are the published GRH-conditional bounds,
with exactly the same logarithmic exponents, now obtained using
Theorem~\ref{thm:input} without an additional hypothesis.
\end{theorem}

Theorem~\ref{thm:L1} gives the uniform estimate
\begin{equation}\label{eq:AH-L1}
 L(1,\chi_D)\ll \log\log(e^e|D|)
 \qquad(D<0\text{ a fundamental discriminant}),
\end{equation}
which replaces the conditional analytic input in the original proof.

The use of \eqref{eq:AH-L1} is confined to upper bounds for imaginary quadratic
class numbers. A lower bound for $L(1,\chi_D)$ is not needed.

\subsection{Class numbers and the arithmetic estimate}

For a negative quadratic discriminant $\Delta=f^2D$, with $D$ fundamental,
let $h(\Delta)$ denote the proper ideal class number of the order of discriminant
$\Delta$, and set
\[
 H(\Delta)=\sum_{d\mid f}h(d^2D).
\]
This convention is the unweighted Kronecker class number used by Achter--Howe.
The analytic class number formula and \eqref{eq:AH-L1} give
\begin{equation}\label{eq:AH-fundamental}
 h(D)=\frac{w_D\sqrt{|D|}}{2\pi}L(1,\chi_D)
 \ll \sqrt{|D|}\log\log(e^e|D|),
\end{equation}
where $w_D\in\{2,4,6\}$ is the number of units in the maximal order.
The order class number formula, including its unit index, is
\[
 h(f^2D)=\frac{fh(D)}{[\mathcal O_D^\times:\mathcal O_{f^2D}^\times]}
 \prod_{r\mid f}\left(1-\frac{\chi_D(r)}r\right).
\]
Consequently,
\[
 h(f^2D)\le h(D)\sigma(f),\qquad
 H(f^2D)\le \frac{h(D)}f\sigma(f)^2,
\]
where $\sigma(f)=\sum_{d\mid f}d$. Indeed,
\[
 \sum_{d\mid f}d\prod_{r\mid d}(1+1/r)
 \le \sigma(f)\prod_{r\mid f}(1+1/r)
 \le \frac{\sigma(f)^2}{f}.
\]
The elementary bound $\sigma(f)\ll f\log\log(e^e f)$ therefore implies
\begin{equation}\label{eq:AH-classbounds}
 h(\Delta)\ll\sqrt{|\Delta|}\bigl(\log\log(e^e|\Delta|)\bigr)^2,
 \qquad
 H(\Delta)\ll\sqrt{|\Delta|}\bigl(\log\log(e^e|\Delta|)\bigr)^3.
\end{equation}
The unit index can only improve these upper bounds, including when $D=-3,-4$.

Let $q=p^r$. An ordinary elliptic curve $E/\mathbb F_q$ has Frobenius trace
$a(E)$ with $|a(E)|<2\sqrt q$ and $p\nmid a(E)$. Write
\[
 a^2-4q=f_{a,q}^2D_{a,q}.
\]
If $\operatorname{End}_{\mathbb F_q}(E)$ has conductor $d$ in the maximal
order of $\mathbb Q(\sqrt{a^2-4q})$, define its relative conductor by
$r(E)=f_{a,q}/d$. The ordinary elliptic curves of trace $a$ and endomorphism
order of conductor $d\mid f_{a,q}$ form a set of cardinality $h(d^2D_{a,q})$.
These are the classical Deuring--Waterhouse stratum facts recalled in
Achter--Howe, Section~4; they are unconditional.

Define
\[
 \psi(n)=n\prod_{r\mid n}(1+1/r),\qquad
 A(n)=\sum_{d\mid n}\frac{\psi(d)}d.
\]
Using the order class number formula as an inequality gives
\begin{align}
 \sum_{\substack{E/\mathbb F_q\text{ ordinary}\\a(E)=a}}r(E)
 &=\sum_{d\mid f_{a,q}}\frac{f_{a,q}}d h(d^2D_{a,q})\notag\\
 &\le f_{a,q}h(D_{a,q})A(f_{a,q})
 \ll \sqrt q\,\ell(q)A(f_{a,q}).\label{eq:AH-trace-conductor}
\end{align}
We next establish, uniformly in $q$,
\begin{equation}\label{eq:AH-A-average}
 \sum_{\substack{1\le a<2\sqrt q\\p\nmid a}}A(f_{a,q})
 \ll\sqrt q\,L(q).
\end{equation}

If $d\mid f_{a,q}$ then $(d,q)=1$ and $a^2\equiv4q\pmod{d^2}$.
Let $B_q(d)$ be the number of solutions to this congruence modulo $d^2$.
For odd primes $r\nmid q$, $B_q(r^j)\le2$, while $B_q(2^j)\le8$ when
$2\nmid q$. The latter bound follows by extracting a factor $4$ when
$j\ge2$ and using the at most four square roots of an odd unit modulo a power
of $2$; $j=1$ is immediate.
Let $C$ be the multiplicative function with $C(r^j)=2(1+1/r)$ for $j\ge1$.
By the Chinese remainder theorem,
\[
 \frac{\psi(d)}d B_q(d)\le4C(d)\qquad((d,q)=1).
\]
Interchanging the divisor and trace sums, and counting each residue class in
an interval of length $2\sqrt q$, gives
\begin{align*}
 \sum_{\substack{1\le a<2\sqrt q\\p\nmid a}}A(f_{a,q})
 &\le\sum_{\substack{d\le2\sqrt q\\(d,q)=1}}
 \frac{\psi(d)}d B_q(d)\left(\frac{2\sqrt q}{d^2}+1\right)\\
 &\ll\sqrt q\sum_{d\ge1}\frac{C(d)}{d^2}
       +\sum_{d\le2\sqrt q}C(d).
\end{align*}
The first series converges by its Euler product. For the second sum, let
$D=C*\mu$ in the sense of Dirichlet convolution. Its prime-power values are
$D(r)=1+2/r$ and $D(r^j)=0$ for $j\ge2$, so $D\ge0$ and
\[
 \sum_{n\le x}C(n)
 \le x\sum_{d\le x}\frac{D(d)}d
 \le x\prod_{r\le x}(1+1/r+2/r^2)\ll x\log(3x).
\]
The final bound follows from $\sum_{r\le x}1/r\le\log\log(3x)+O(1)$.
This proves \eqref{eq:AH-A-average}. Since the summands for $a$ and $-a$
are the same, \eqref{eq:AH-trace-conductor} now yields
\begin{equation}\label{eq:AH-total-conductor}
 R(q):=\sum_{E/\mathbb F_q\text{ ordinary}}r(E)
 \ll qL(q)\ell(q).
\end{equation}

\subsection{Upper bound for surfaces}

Let $W(q)$ count those pairs $(A,\lambda)$ in $N(q)$ whose two ordinary
elliptic isogeny factors are nonisogenous. The unconditional gluing estimate of
Achter--Howe, Lemma~6.1, is
\begin{equation}\label{eq:AH-gluing-upper}
 W(q)\le
 \sum_{\mathcal S}\sum_{\mathcal T:\,a(\mathcal T)\ne a(\mathcal S)}
 h(\mathcal O_{\mathcal S})h(\mathcal O_{\mathcal T})
 r(\mathcal S)r(\mathcal T)
 \sum_{n\mid a(\mathcal S)-a(\mathcal T)}\psi(n).
\end{equation}
Here $\mathcal S,\mathcal T$ run over ordinary strata and a divisor sum of a
negative integer means the divisor sum of its absolute value. This estimate uses
Frey--Kani gluing and the finite group-scheme automorphism bound in
Achter--Howe, Proposition~4.3 and Lemma~6.4; none of these requires GRH.

For completeness, if $F(m)=\sum_{n\mid m}\psi(n)$, multiplicativity gives
\[
 \frac{F(m)}m\le\prod_{r\mid m}\frac{1+1/r}{1-1/r}
 \le\left(\frac m{\varphi(m)}\right)^2
 \ll\bigl(\log\log(e^e m)\bigr)^2.
\]
Since $0<|a(\mathcal S)-a(\mathcal T)|<4\sqrt q$, we may enlarge the
sum in \eqref{eq:AH-gluing-upper} to all pairs of strata and obtain
\[
 W(q)\ll\sqrt q\,\ell(q)^2R(q)^2
 \ll q^{5/2}L(q)^2\ell(q)^4.
\]
The other three disjoint types are ordinary isotypic, almost ordinary, and
supersingular split surfaces. The \emph{unconditional} parts of Achter--Howe,
Propositions~3.2--3.4, bound their respective numbers by
\[
 O(q^2L(q)^2\ell(q)),\qquad
 O(q^2L(q)\ell(q)^2),\qquad O(q^2).
\]
Each is absorbed by the asserted upper bound for $N(q)$. Thus one need not
use, or reprove, the conditional refinements of these three propositions.

\subsection{Lower bound for surfaces}

We give the count allowing explicitly for automorphisms of elliptic curves.
There is an absolute $c_0>0$ such that the number $T(q)$ of ordinary elliptic
$\mathbb F_q$-isomorphism classes is at least $c_0q$ for all sufficiently large
$q$. For example, every $j\in\mathbb F_q$ occurs as the invariant of an elliptic
curve defined over $\mathbb F_q$, and the number of supersingular geometric
$j$-invariants is at most $p/12+2$. Hence $T(q)\ge q-p/12-2\ge q/2$ for
all sufficiently large $q$.

For an odd prime $r\ne p$, two elliptic curves have the same symplectic type
modulo $r$ if their $r$-torsion group schemes are isomorphic by a map preserving
the Weil pairing. There are at most $r+4$ such types: for each trace residue
$a\pmod r$ with $a^2\not\equiv4q\pmod r$ there is one type, and for each
of the at most two remaining residues there are at most three. This is the
elementary Frobenius conjugacy classification in Achter--Howe, Lemma~10.1.
If $t_1,\ldots,t_s$ count the ordinary curves of the different types, then
Cauchy--Schwarz gives
\begin{equation}\label{eq:AH-pair-lower}
 \sum_{i=1}^s t_i^2\ge\frac{T(q)^2}{r+4}
 \ge c_1\frac{q^2}{r}
\end{equation}
for an absolute $c_1>0$, uniformly for $r\ge5$ and sufficiently large $q$.

The number of ordered pairs of ordinary elliptic curves that are isogenous is
\[
 \sum_{\substack{|a|<2\sqrt q\\p\nmid a}}H(a^2-4q)^2
 \ll q^{3/2}\ell(q)^6
\]
by \eqref{eq:AH-classbounds}. Choose a fixed positive $c_2$ small enough that
for every prime
\[
 5\le r\le B(q):=c_2\frac{\sqrt q}{\ell(q)^6},\qquad r\ne p,
\]
the last expression is at most $(c_1/2)q^2/r$. Subtraction from
\eqref{eq:AH-pair-lower} leaves at least $(c_1/2)q^2/r$ ordered
nonisogenous ordinary pairs of the same symplectic type.

Restrict to $r\equiv1\pmod4$. Choose $b\pmod r$ with $b^2=-1$. Composition
of a symplectic isomorphism with multiplication by $b$ is an anti-isometry.
There are at least $r-1$ anti-isometries for each such ordered pair:
the centralizer of Frobenius in $\operatorname{GL}_2(\mathbb F_r)$ has order
at least $(r-1)^2$, and the multiplier map has image of size at most $r-1$.
This also proves directly the bound of Achter--Howe, Lemma~10.3.
Thus, for each eligible $r$, there are $\gg q^2$ raw triples
$(E,F,\eta)$ with $E,F$ nonisogenous and $\eta:E[r]\longrightarrow F[r]$
an anti-isometry.

The graph of $\eta$ is maximal isotropic in $(E\times F)[r]$. The quotient
$(E\times F)/\operatorname{graph}(\eta)$ therefore carries a principal
polarization. The uniqueness assertion in the nonisotypic case of Frey--Kani
gluing, recalled in Achter--Howe, Section~5, says that the polarized surface
determines the gluing data up to isomorphism and interchange of the two factors.
An elliptic curve has at most $24$ origin-preserving geometric automorphisms.
Consequently a single polarized isomorphism class is counted by at most
$2\cdot24^2$ of the raw triples just counted. Distinct primes $r$ also give
distinct classes by the same uniqueness assertion. It follows that
\[
 W(q)\gg q^2\#\{r\le B(q):r\text{ prime},\ r\equiv1\pmod4,\ r\ne p\}.
\]
The unconditional prime number theorem for the fixed progression $1\pmod4$
gives a prime count $\gg B(q)/\log B(q)$ as $q\to\infty$; omitting the one
possible prime $p$ does not change this estimate. Since
$\log B(q)\asymp\log q$, we conclude
\[
 N(q)\ge W(q)\gg\frac{q^{5/2}}{L(q)\ell(q)^6}.
\]
Finally, every finite field has an elliptic curve, and its self-product with the
product principal polarization belongs to the set counted by $N(q)$. Enlarging
the upper constant and decreasing the lower constant therefore handles the
finitely many remaining $q$. This completes the proof of
Theorem~\ref{thm:achter-howe-transfer}.

\paragraph{Dependency and scope audit.}
The finite-field algebraic inputs above are the unconditional stratum description,
the gluing estimate and uniqueness assertion, the elementary symplectic-type
classification, and the unconditional estimates for the three nondominant
surface types. Every analytic use of GRH in the published proof of
Theorem~1.2 has been replaced by \eqref{eq:AH-L1}. Neither GRH for higher-degree
Dedekind zeta functions nor a statement about the primes of reduction of a fixed
variety occurs in this argument. The displayed inequalities have the same powers
of $q$, $\log q$, and $\log\log q$ as the published conditional theorem.

\section{Isogenous genus-two curves with a dihedral action}\label{sec:d4}

Let $q$ be an odd prime power. Let $\mathcal Z_q$ be the set of
$\mathbb F_q$-isomorphism classes of smooth projective geometrically
connected genus-two curves whose group of $\mathbb F_q$-rational
automorphisms contains $D_4$, the dihedral group of order eight.
The embedding of $D_4$ is not part of the datum counted in $\mathcal Z_q$.
Let $P(q)$ count unordered pairs of distinct members with Jacobians
isogenous over $\mathbb F_q$.

\begin{theorem}[The conditional bound in Arul et al.]\label{thm:d4}
There is an absolute constant $C$ such that, for every odd prime power
$q>7$,
\[
 P(q)\leq Cq^{3/2}(\log\log q)^6.
\]
Thus the GRH-conditional upper bound of
\cite[Theorem 4.6]{D4} holds unconditionally using
Theorem~\ref{thm:input}.
\end{theorem}

We spell out the arithmetic input and the counting argument. The
geometric classification used here is unconditional: it is
\cite[Lemma 2.4 and Propositions 2.8 and 4.2]{D4}. It gives the following facts.
Every member of $\mathcal Z_q$ has a model
\[
 Z_{c,s}: y^2=c(x^2+1)(x^4+sx^2+1),
 \qquad c\in\mathbb F_q^\times,\quad s\ne\pm2.
\]
There are two possible square classes of $c$, so
$\#\mathcal Z_q\leq2(q-2)$.
Its Jacobian is isogenous to $E^2$, for an elliptic curve $E$ with a
rational point of order two. Equipping $Z$ with an embedding of $D_4$
gives an injective correspondence into pairs $(E,T)$, where $T$ is such
a point. The inverse recovers the displayed model from the model
$y^2=c(X+1)(X^2+sX+1)$ of $E$ with $T=(-1,0)$.

\begin{lemma}\label{lem:elliptic-count}
Let $N(q,t)$ be the number of $\mathbb F_q$-isomorphism classes of elliptic
curves with Frobenius trace $t$. Uniformly for odd $q$ and $|t|\leq2\sqrt q$,
\[
 N(q,t)\ll \sqrt q\,\ell(q)^3.
\]
\end{lemma}
\begin{proof}
Use the unconditional enumeration of elliptic curves in an isogeny class
in \cite[Theorem 4.6]{Schoof}, the same input used in
\cite[Lemma 4.10]{D4}. In the ordinary case, the count is bounded by
an absolute constant times $H(t^2-4q)$, hence by
$C\sqrt q\,\ell(q)^3$ using \eqref{eq:order-class}.
In the supersingular cases, Schoof's formulas consist of bounded terms,
class numbers of orders with discriminants of size at most $4p$, and,
when present, terms of size $O(p)$, where $p=\operatorname{char}\mathbb F_q$.
If $q=p$, the unbounded terms are the class-number terms, which the
same bound controls. If $q=p^a$ with $a\geq2$, then $p\leq\sqrt q$,
so the $O(p)$ terms also satisfy the desired estimate. This covers the
boundary cases $t=\pm2\sqrt q$ when $q$ is a square.
\end{proof}

\begin{proof}[Proof of Theorem~\ref{thm:d4}]
The Frobenius polynomial of $\operatorname{Jac}(Z)$ is
$(X^2-tX+q)^2$, with $t$ even because $E$ has a rational point of order
two. Let $M(q,t)$ count the members with this polynomial.
The injectivity just described gives
\[
 M(q,t)\leq3N(q,t),
\]
since an elliptic curve has at most three nonzero rational points of
order two. Tate's isogeny theorem over finite fields shows that two
Jacobians here are isogenous if and only if their polynomials agree.
Consequently
\[
 P(q)=\sum_{\substack{t^2\leq4q\\t\text{ even}}}\binom{M(q,t)}2
 \leq\frac12\left(\max_t M(q,t)\right)\sum_t M(q,t)
 \ll q^{3/2}\ell(q)^3.
\]
For $q>7$, $\ell(q)\asymp\log\log q$ and
$(\log\log q)^3\ll(\log\log q)^6$. This proves the stated published
bound. The argument happens to give a smaller logarithmic factor; that
observation is not used to claim priority for a new bound.
\end{proof}

The theorem concerns pairs with isogenous Jacobians. It does not count
``doubly isogenous'' pairs involving the additional covers considered
elsewhere in \cite{D4}; the title of that paper must not obscure this
distinction.

\section{Integer factoring in parity and pigeonhole search classes}
\label{sec:factoring}

Je\v r\'abek \cite{Jerabek}, Theorem~3.8(ii--iii), proved under GRH for
quadratic Dirichlet characters that
\[
 \mathsf{Factoring},\mathsf{FullFac}\in\mathsf{PPA},\qquad
 \mathsf{Factoring}\in\mathsf{PWPP},\qquad
 \mathsf{FullFac}\in\mathsf{FP}^{\mathsf{PWPP}}.
\]
These exact qualitative conclusions need only a uniform polylogarithmic
bound for small quadratic-character witnesses. They do not assert a
polynomial-time algorithm for factoring integers.

Here $\mathsf{Factoring}$ takes an integer $n>1$ and asks for a proper
nontrivial divisor if $n$ is composite, or the answer ``prime'' if $n$ is
prime; the latter answer is checkable in deterministic polynomial time.
The problem $\mathsf{FullFac}$ asks for the complete prime factorization.
This total formulation agrees with the usual composite-input formulation
after a polynomial-time primality test. All integers are supplied in binary. The class
$\mathsf{PPA}$ consists of total polynomially verifiable search problems
reducible to finding a second odd-degree vertex of a succinctly represented
undirected graph, given one such vertex. The class $\mathsf{PWPP}$ consists
of search problems reducible to finding a collision in a Boolean circuit
\[
 C:\{0,1\}^{m+1}\longrightarrow\{0,1\}^{m}.
\]
A search reduction must work for every valid answer to its oracle queries.
The notation $\mathsf{FP}^{\mathsf{PWPP}}$ permits polynomially many
adaptive oracle calls; we do not identify this class with $\mathsf{PWPP}$.

\begin{theorem}[Je\v r\'abek's factoring conclusions]
Unconditionally, using Theorem~\ref{thm:input}, one has
\[
 \mathsf{Factoring},\mathsf{FullFac}\in\mathsf{PPA},\qquad
 \mathsf{Factoring}\in\mathsf{PWPP},\qquad
 \mathsf{FullFac}\in\mathsf{FP}^{\mathsf{PWPP}}.
\]
\end{theorem}

\begin{proof}
By Lemma~\ref{lem:witness}, choose fixed effective constants $C,A$ so that every nonprincipal quadratic
Dirichlet character modulo $m$ has an integer
$t\le C(\log(2m))^A$ with $\chi(t)\ne1$. Enlarge
\[
 B(n)=\left\lceil C(\log(2n))^A\right\rceil
\]
to be at least $2$. First perform a deterministic polynomial-time
primality test, returning immediately when $n$ is prime. Handle even
inputs and perfect powers by integer arithmetic. We can therefore assume
$n$ is odd, nonsquare, and has at least
two distinct prime divisors. Trial division through $B(n)$ either finds a
proper divisor, or ensures that every positive integer at most $B(n)$ is a
unit modulo $n$. If $B(n)\ge n$, trial division already succeeds, so this
range causes no problem.

We first prove that some integer $a\le B(n)^2$ satisfies
\[
 \gcd(a,n)=1,\qquad \left(\frac an\right)=1,
 \qquad a\text{ is not a square modulo }n.
 \tag{*}
\]
Write $n=\prod_i p_i^{e_i}$. If any $e_i$ is even, choose such a prime
$p=p_i$; otherwise choose any $p_i$. Then $n/p$ is not a square. In the
first case its exponent at $p$ is odd; in the second case another prime
still occurs to an odd exponent. The Jacobi character modulo $n/p$ is
therefore nonprincipal. The character bound and the unit condition give
$u\le B(n)$ with $(u/(n/p))=-1$. Consequently
\[
 \left(\frac un\right)=-\left(\frac up\right).
\]
If $(u/n)=1$, take $a=u$. Otherwise $(u/n)=-1$ and $(u/p)=1$.
Choose $v\le B(n)$ with $(v/p)=-1$. If $(v/n)=1$, take $a=v$;
otherwise take $a=uv$. In each case $(a/n)=1$ and $(a/p)=-1$, proving
$(\ast)$. The factorization of $n$ and the selected prime $p$ are used
only to prove existence; the algorithm does not know them.

The following two inputs are unconditional theorems from \cite{Jerabek}:
$\mathsf{FacRoot}\in\mathsf{PPA}$ (Theorem~3.4), and
$\mathsf{PPA}$ is closed under polynomial-time Turing reductions
(Theorem~2.1). The problem $\mathsf{FacRoot}$ takes odd $n$ and $a$ with
$(a/n)=1$ and returns either a proper divisor of $n$ or a square root of
$a$ modulo $n$. Query it for every $a\le B(n)^2$ with
$\gcd(a,n)=1$ and $(a/n)=1$. The integer from $(\ast)$ has no square
root, so every possible collection of valid oracle answers contains a
proper factor of $n$. The list and all its arithmetic have polynomial
size in $\log n$. Thus $\mathsf{Factoring}\in\mathsf{PPA}$.
Recursive splitting, with unconditional polynomial-time primality testing,
uses at most $\log_2 n$ splits, proving
$\mathsf{FullFac}\in\mathsf{PPA}$ as well.

For $\mathsf{PWPP}$ we must justify nonadaptive batching. Because $n$ is
not a square, the character bound finds $b\le B(n)$ with $(b/n)=-1$.
For each eligible $a$, consider the problem $\mathsf{FacRootMul}(n,a,b)$:
find a proper divisor of $n$ or a square root of one of $a,b,ab$.
Neither $b$ nor $ab$ is a square, since their Jacobi symbols are $-1$.
For the $a$ in $(\ast)$, every answer to this problem is therefore a
proper factor. All of these queries are nonadaptive.

We reproduce the collision reduction underlying \cite{Jerabek},
Theorem~3.5. For units $a,b$ modulo odd $n>1$, put
$a_0=1,a_1=a,a_2=b$ and define
\[
 F:\{0,1,2\}\times\{1,\ldots,(n-1)/2\}
       \longrightarrow\{1,\ldots,n-1\},\qquad
 F(i,x)=
 \begin{cases}
 a_i x^2\bmod n,&\gcd(x,n)=1,\\
 x,&\gcd(x,n)>1.
 \end{cases}
\]
Given a collision $(i,x)\ne(j,y)$, a nonunit among $x,y$ immediately
gives a proper factor. Otherwise, if $i=j$, then $x\ne y$ and
$x^2\equiv y^2\pmod n$. Our choice $1\le x,y<n/2$ excludes both
$x\equiv y$ and $x\equiv-y\pmod n$, so $\gcd(x-y,n)$ is a proper
nontrivial divisor. If $i<j$, then
$(xy^{-1})^2\equiv a_j/a_i\pmod n$. This gives a square root of $a$
or $b$ for $(i,j)=(0,1),(0,2)$; for $(i,j)=(1,2)$, the element
$axy^{-1}$ is a square root of $ab$.

The domain of $F$ has size $A_0=3(n-1)/2$, and the range has size
$M_0=n-1$. To reduce this to the stated binary definition, take
$m=\lceil\log_2 A_0\rceil$ and pad $F$ to a function on
$\{0,1\}^m$ by sending the new arguments injectively to fresh values
outside its old range. The new range has size
\[
 R=2^m-(A_0-M_0)\le\frac56\,2^m,
\]
because $2^m<2A_0$. Apply this padded function separately to four
$m$-bit blocks and encode the four outputs in radix $R$. As
$(5/6)^4<1/2$, the resulting circuit has $4m$ input bits and at most
$4m-1$ output bits. A collision differs in some block but has the same
value in that block. The added values were injective and disjoint from
the old range, so it gives a collision of $F$. Thus
$\mathsf{FacRootMul}\in\mathsf{PWPP}$.

Finally suppose there are $k$ collision circuits
$C_i:\{0,1\}^{m_i+1}\to\{0,1\}^{m_i}$. Pad them by copying extra
bits until all output lengths equal $m=\max m_i$. For one such circuit
$C$, compress a string of length $L>m$ by repeatedly applying $C$ to
its first $m+1$ bits, leaving the remaining bits untouched, until its
length is $m$. Denote this function by $A_C$. If
$A_C(u)=A_C(v)$ with $u\ne v$, compare the two compression chains at
the first stage where distinct strings become equal. Their equal tails
and equal compressed prefixes give distinct inputs to $C$ with equal
outputs. Taking $L=km+1$, the circuit
\[
 D(z)=\bigl(A_{C_1}(z),\ldots,A_{C_k}(z)\bigr)
\]
has $km+1$ input bits and $km$ output bits. A collision gives a collision
of every $C_i$, so all $k$ queries can be answered by one $\mathsf{PWPP}$
call. This is the batching argument of \cite{Jerabek}, Lemma~3.6,
with the compression step made explicit.

Apply it to the polynomial list of $\mathsf{FacRootMul}$ instances.
At least one answer must split $n$, proving
$\mathsf{Factoring}\in\mathsf{PWPP}$. Recursive splitting gives
$\mathsf{FullFac}\in\mathsf{FP}^{\mathsf{PWPP}}$, as asserted.
\end{proof}

% Bibliography item to add:
% \bibitem{Jerabek} E. Je\v r\'abek, Integer factoring and modular square roots,
% J. Comput. Syst. Sci. 82 (2016), 380--394.
% doi:10.1016/j.jcss.2015.08.001.
% Author PDF: https://users.math.cas.cz/~jerabek/papers/factor.pdf .

\section{Miller's equivalences between factoring and arithmetic functions}
\label{sec:miller-equivalence}

Theorems~3--5 of Miller's published paper \cite{Miller1976} concern
deterministic reductions between arithmetic functions and recognition of
their graphs.  These are separate from the primality-testing conclusion
of that paper, which has long had an unconditional replacement.
We recover the full qualitative conclusions of those three theorems.

For $n\geq1$, let $\lambda(n)$ be the exponent of the finite group
$(\mathbb Z/n\mathbb Z)^\times$, and put
\[
 \lambda'(n)=\mathop{\rm lcm}_{p\mid n}(p-1),
 \qquad \lambda'(1)=1.
\]
Write $\operatorname{Fac}(n)$ for the complete prime factorization of $n$,
including its exponents.  All integers are supplied in binary.

\begin{theorem}[Miller's functional-equivalence and recognition conclusions]
\label{thm:miller-equivalence}
The functions $\operatorname{Fac}$, $\varphi$, $\lambda$, and $\lambda'$
are deterministically polynomial-time equivalent in the following strong
sense: given $n$ and the single value of any one of these functions at
$n$, one can compute the values of all the others in time polynomial in
$\log(2n)$.

Moreover, complete integer factorization is deterministically
polynomial-time Turing equivalent to computing the eventual period of
the base-$b$ expansion of $1/a$, for integers $a\geq1$, $b\geq2$.
Finally, the graphs of $\varphi$, $\lambda$, $\lambda'$, and
$\operatorname{Fac}$ are recognizable in deterministic polynomial time.
\end{theorem}

\begin{proof}
We first give a uniform version of Miller's splitting argument that also
explains why a single supplied value suffices.  Suppose that $n\geq3$ is
odd and that a positive integer $M$ satisfying
\begin{equation}\label{eq:miller-multiple}
                 \lambda'(n)\mid M
\end{equation}
is supplied.  There is a deterministic algorithm factoring $n$ in time
polynomial in $\log(2n)+\log(2M)$.  It does not require the prime
factorization of $M$.

Write $M=2^s u$ with $u$ odd, and set
$B=\lceil C_0(\log(3n))^8\rceil$, with $C_0$ from
Lemma~\ref{lem:witness}.  For every composite factor $d\mid n$
encountered during recursion, first test whether $d$ is a prime power.
This takes polynomial time: test the integer roots for
$1\leq e\leq\lfloor\log_2 d\rfloor$, check the identity $r^e=d$,
and test $r$ for primality by an unconditional deterministic
polynomial-time primality algorithm, for example
Agrawal--Kayal--Saxena \cite{AKS2004}.  A prime-power factor is then
completely factored.  Otherwise, for each integer $2\leq a\leq B$,
compute $\gcd(a,d)$; if this is a proper nontrivial divisor, split $d$.
If $\gcd(a,d)=1$, compute
\begin{equation}\label{eq:miller-gcds}
       \gcd\bigl(a^{2^j u}-1,d\bigr),\qquad 0\leq j\leq s,
\end{equation}
using modular exponentiation, and split whenever a proper nontrivial
divisor is found.  The following argument proves that this search always
succeeds when $d$ has two distinct prime divisors.

Choose distinct primes $p,q\mid d$, and write
$v_p=v_2(p-1)$ and $v_q=v_2(q-1)$.  If $v_p>v_q$, apply
Lemma~\ref{lem:witness} to the quadratic character modulo $p$.
It supplies an integer $a\leq B$ with $(a/p)=-1$.  If this $a$ is
not coprime to $d$, its gcd already splits $d$: it is not divisible by
$p$, so that gcd is smaller than $d$.  Otherwise the $2$-part of the
order of $a$ modulo $p$ is exactly $2^{v_p}$, while the $2$-part of
its order modulo $q$ is at most $2^{v_q}$.  These parts are different.
The case $v_q>v_p$ is symmetric.

If $v_p=v_q=v$, apply the same lemma to the nonprincipal quadratic
character
\[
               \chi(a)=(a/p)(a/q)\quad\pmod{pq}.
\]
It gives $a\leq B$ prime to $pq$ for which the two Legendre symbols
are opposite.  Again, either its gcd splits $d$, or $a$ is a unit
modulo $d$.  In the latter case the $2$-part of its order is exactly
$2^v$ at one of $p,q$ and at most $2^{v-1}$ at the other.

Thus in every case there is a tested unit $a$ such that the $2$-parts
of its orders at $p$ and $q$ differ.  Condition
\eqref{eq:miller-multiple} implies that the odd parts of both orders
divide $u$.  Write the orders of $a^u$ modulo $p$ and $q$ as
$2^i$ and $2^j$, where $i\ne j$ and $0\leq i,j\leq s$.
At exponent $2^{\min(i,j)}u$, precisely one of these two prime
divisors divides $a^{2^{\min(i,j)}u}-1$.  The corresponding gcd
in \eqref{eq:miller-gcds} is therefore strictly between $1$ and $d$.
This argument does not assume that $d$ is squarefree: a gcd containing
one prime divisor and omitting another is a proper divisor regardless
of their multiplicities.

For every recursive divisor $d\mid n$, we still have
$\lambda'(d)\mid\lambda'(n)\mid M$.  Hence the same original value
$M$ works at every stage.  There are at most $\log_2 n$ prime factors
counted with multiplicity, and therefore only $O(\log n)$ recursive
nodes.  Each node performs $O(B\log(2M))$ modular exponentiation or
gcd operations on integers of polynomial bit length.  This proves the
claimed deterministic polynomial bound.  For even $n$, first remove
its power of $2$ by division and apply the same procedure to the odd
part; condition \eqref{eq:miller-multiple} remains valid there.

Now each of $\varphi(n)$, $\lambda(n)$, and $\lambda'(n)$ is a
positive multiple of $\lambda'(n)$ and is at most $n$.  The preceding
algorithm therefore recovers $\operatorname{Fac}(n)$ from the single
value of any one of them, in time polynomial in $\log(2n)$.
Conversely, from $n=\prod p^{e_p}$ one computes
\[
 \varphi(n)=\prod_{p\mid n}p^{e_p-1}(p-1),\qquad
 \lambda'(n)=\mathop{\rm lcm}_{p\mid n}(p-1),
\]
and $\lambda(n)=\mathop{\rm lcm}_{p\mid n}\lambda(p^{e_p})$,
where $\lambda(p^e)=p^{e-1}(p-1)$ for odd $p$,
$\lambda(2)=1$, $\lambda(4)=2$, and
$\lambda(2^e)=2^{e-2}$ for $e\geq3$.  Products, gcds, and lcms
have polynomial bit complexity.  This proves the first assertion,
including $n=1,2$ by direct calculation.

For the period assertion the inputs $n\leq2$ are immediate.  For
$n\geq3$, first consider an oracle giving
$\operatorname{ord}_n(a)$ when $\gcd(a,n)=1$.  Enumerate the primes
$a\leq B$ that are coprime to $n$, and call the oracle for their
orders.  By Lemma~\ref{lem:witness}, their residue classes generate
$(\mathbb Z/n\mathbb Z)^\times$.  In a finite abelian group the lcm
of the orders of a generating set is its exponent: it annihilates
every product of generators, and is itself a multiple of each
generator's order.  Consequently the lcm of the returned values is
exactly $\lambda(n)$.  There are polynomially many oracle calls;
each order and their lcm are at most $n$.  Factoring now follows from
the first assertion.  This is a Turing reduction, rather than a
reduction using one supplied order.

To identify this oracle with Miller's period function, remove from
$a$ all prime-power factors supported on primes dividing $b$.
No factorization oracle is needed for that removal: repeatedly divide
the current denominator by its gcd with $b$ until the gcd is $1$.
If the resulting denominator is $v$, then
\[
 \operatorname{period}(a,b)=\operatorname{ord}_v(b),
\]
with the convention that the eventual period is $1$ when $v=1$
(a terminating expansion has a constant zero tail).  In particular,
on coprime inputs the period oracle is exactly the order oracle just
used.  Conversely, a factoring oracle computes the factorization of
$v$, hence $\lambda(v)$, and then factors $\lambda(v)$ as well.
Starting with $t=\lambda(v)$, for each prime $r\mid t$ divide $t$
by $r$ whenever $b^{t/r}\equiv1\pmod v$, repeating until no such
division is possible.  The resulting $t$ is the order: throughout,
the true order divides $t$, and any proper multiple would permit
one more prime division.  All intermediate integers and queries
have bit length polynomial in that of $(a,b)$.  This proves the
second assertion with exactly the oracle notion in Miller's
Theorem~4.

Finally consider a proposed graph input $(n,y)$ for one of
$\varphi,\lambda,\lambda'$.  Reject $y<1$ or $y>n$ immediately.
Run the bounded splitting procedure above with $M=y$, allowing it
to report failure if its complete search at a node finds no split
and no prime-power decomposition.  Whether or not
\eqref{eq:miller-multiple} holds, this computation terminates in
polynomial time.  Accept only if it returns a factorization whose
prime factors and product have been verified, and the chosen
arithmetic function computed from that factorization equals $y$.
If $y$ is correct, \eqref{eq:miller-multiple} holds and the procedure
succeeds.  If $y$ is incorrect, a verified factorization cannot give
an erroneous positive answer.  The graph of $\operatorname{Fac}$
is itself already recognized unconditionally by primality tests and
multiplication; its inclusion here records Miller's complete statement,
not a new consequence.  This
proves the last assertion and also explains the distinction between
recognizing a graph and computing an unknown function value.
\end{proof}

\paragraph{Literature scope.}
Miller's Theorems~3--5 are the admission anchors; his sharp complexity
bound for the particular primality test is not asserted.  The later
unconditional work of Morain--Renault--Smith \cite{MRSOracles}
handles specified restrictions on prime-factor sizes, and
D\k abrowski--Pomyka\l a--Shparlinski \cite{DPSOracles}
still distinguishes the general deterministic reduction under GRH
from its unconditional randomized version.  The very recent primary
preprint \cite{GSV2026} treats special Carmichael numbers and also
retains this distinction.  None of those restricted or randomized
results supplies the general deterministic single-value reductions
proved above.

% Bibliography additions:
% \bibitem{AKS2004} M. Agrawal, N. Kayal, and N. Saxena,
% PRIMES is in P, Ann. of Math. (2) 160 (2004), 781--793.
% DOI: 10.4007/annals.2004.160.781.
% https://annals.math.princeton.edu/2004/160-2/p12 .
% \bibitem{Miller1976} G. L. Miller,
% Riemann's hypothesis and tests for primality,
% J. Comput. System Sci. 13 (1976), 300--317.
% DOI: 10.1016/S0022-0000(76)80043-8.
% Primary final author scan:
% https://www.cs.cmu.edu/~glmiller/Publications/Papers/Mi76.pdf .
% \bibitem{MRSOracles} F. Morain, G. Renault, and B. Smith,
% Deterministic factoring with oracles,
% Appl. Algebra Engrg. Comm. Comput. 34 (2023), 663--690.
% DOI: 10.1007/s00200-021-00521-8; primary text arXiv:1802.08444v2.
% \bibitem{DPSOracles} A. Dabrowski, J. Pomykala, and I. E. Shparlinski,
% On oracle factoring of integers,
% J. Complexity 76 (2023), 101741.
% DOI: 10.1016/j.jco.2023.101741; primary author text arXiv:1912.00345v4.
% \bibitem{GSV2026} N. Gupta, A. Sikarov, and I. Volkovich,
% A computational perspective on Carmichael numbers,
% ECCC Report TR26-212 (September 2026), preprint.
% https://eccc.weizmann.ac.il/report/2026/212/ .

\section{Deterministic extraction of roots}
\label{sec:roots}

Adleman, Manders, and Miller \cite{AMM}, Theorems~I and~III,
proved under ERH that the least square root, and more generally the least
$n$th root for every fixed positive integer $n$, can be found modulo a prime
in deterministic polynomial time. Their Theorem~II(a) gives deterministic
polynomial-time square-root extraction modulo a supplied fully factored
integer. These qualitative statements survive replacing ERH by a uniform
effective polylogarithmic bound for the least power nonresidue.
We give the algebraic argument, including the distinction between fixed
$n$ and $n$ supplied in binary.

\begin{theorem}[Adleman--Manders--Miller root-extraction conclusions]
There is a deterministic algorithm that, given a prime $p$, an integer
$a$, and a positive integer $n$, finds all roots of $X^n-a$ in
$\mathbb F_p$ in time polynomial in $n$ and $\log p+\log(2+|a|)$.
In particular, for each fixed $n$, the least nonnegative root can be found,
or nonexistence decided, in deterministic polynomial time in the bit length
of $(p,a)$. There is also a deterministic polynomial-time algorithm for
finding a square root of $a$ modulo an integer $M$ whose complete prime
factorization is supplied, or deciding that no such root exists.
\end{theorem}

\begin{proof}
Reduce $a$ modulo $p$. If $a=0$, its only root is $0$; hence assume $a\ne0$.
The case $p=2$ is immediate. Write $N=p-1$, and factor $n$ by trial division.
This costs polynomial time in the numerical value $n$, as the theorem
allows; it does not assert polynomial time in $\log n$.

For each prime $r\mid\gcd(n,N)$, compute $s_r=v_r(N)$ and put
$R_r=r^{s_r}$. Put
\[
 U=N\Big/\prod_{r\mid\gcd(n,N)}R_r.
\]
Then $\gcd(n,U)=1$. These calculations require no factorization of $N$
outside the primes already dividing $n$.

For each such $r$, choose successively integers $z=1,2,\ldots$ until
$z\not\equiv0\pmod p$ and $z^{N/r}\ne1$ in $\mathbb F_p$. A nontrivial character of order $r$
has precisely the $r$th powers as its kernel. Lemma~\ref{lem:witness}
therefore guarantees that this search stops after a fixed polynomial
in $\log p$ trials. Put $c_r=z^{N/R_r}$. It has order exactly $R_r$:
the condition $z^{N/r}\ne1$ says that the $r$-part of the order of $z$
is $R_r$, and exponentiation by $N/R_r$, which is prime to $r$, preserves
this part while killing all other primary parts.

Let
\[
 e_r=\frac{N}{R_r}
       \left(\left(\frac{N}{R_r}\right)^{-1}\bmod R_r\right),
 \qquad a_r=a^{e_r}.
\]
Thus $e_r$ is $1$ modulo $R_r$ and $0$ modulo $N/R_r$; exponentiation
by $e_r$ is the projection of the cyclic group $\mathbb F_p^\times$
onto its subgroup of order $R_r$. When $U>1$, define similarly
$e_U=(N/U)((N/U)^{-1}\bmod U)$ and $a_U=a^{e_U}$; when $U=1$, set
$a_U=1$. These projections satisfy
\[
 a=a_U\prod_r a_r.
\]

Compute $j_r\in\{0,\ldots,R_r-1\}$ with $a_r=c_r^{j_r}$ by
successive base-$r$ digits. Explicitly, set $j^{(0)}=0$ and
$\omega=c_r^{r^{s_r-1}}$. Suppose the first $k$ digits have been found,
so $j_r-j^{(k)}$ is divisible by $r^k$. Then
\[
 \left(a_r c_r^{-j^{(k)}}\right)^{r^{s_r-1-k}}
     =\omega^{d_k},\qquad 0\le d_k<r.
\]
Test the $r$ possible digits and put $j^{(k+1)}=j^{(k)}+d_kr^k$.
The order of $\omega$ is $r$, so precisely one digit works.
This determines $j_r$ after $s_r$ stages in time polynomial in
$r$ and $\log p$.

The equation on this primary component is the ordinary linear congruence
\[
 nt_r\equiv j_r\pmod{R_r}.
\]
It is soluble exactly when $d_r:=\gcd(n,R_r)$ divides $j_r$.
If any component fails this test, there is no root. Otherwise extended
Euclid supplies one solution $t_r$ modulo $R_r/d_r$, and all solutions
are $t_r+kR_r/d_r$, $0\le k<d_r$. On the $U$-component the unique root is
$a_U^{n^{-1}\bmod U}$, interpreted as $1$ when $U=1$.
Products of these component roots give all roots in $\mathbb F_p^\times$.
Their number is
\[
 \prod_r d_r=\gcd(n,N)\le n.
\]
Consequently they can all be listed within the claimed time bound, and
their least nonnegative integer representative can be selected. Every
operation described is deterministic. The character-search constants are
uniform in $p$ and $r$, and $\sum_{r\mid n}r\le n$ for $n\ge2$,
so the number of field operations is polynomial in $n$ and $\log p$.

For the factored-modulus assertion, solve separately modulo each supplied
prime power $\ell^e\parallel M$, then use the Chinese remainder theorem.
Here are the local details, including nonunits. Reduce $a$ modulo
$\ell^e$. If $a=0$, take local root $0$. Otherwise write $a=\ell^v u$
with $v<e$ and $\ell\nmid u$. A root exists only if $v$ is even, because
the valuation of a nonzero square below $e$ is even. If $v=2w$, it
suffices to solve
\[
 y^2\equiv u\pmod{\ell^{e-2w}},
\]
then take $x=\ell^w y$ modulo $\ell^e$.
For odd $\ell$, find a root modulo $\ell$ by the prime-field algorithm.
Given $y_k^2\equiv u\pmod{\ell^k}$ with $\ell\nmid y_k$, determine
$t\bmod\ell$ from
\[
 2y_k t\equiv\frac{u-y_k^2}{\ell^k}\pmod\ell,
\]
and set $y_{k+1}=y_k+t\ell^k$. This produces a root at the next precision.
For $\ell=2$, the unit congruence is trivial modulo $2$, soluble modulo
$4$ exactly when $u\equiv1\pmod4$, and soluble modulo $2^h$, $h\ge3$,
exactly when $u\equiv1\pmod8$. In the latter case start with $y_3=1$.
If $y_k^2\equiv u\pmod{2^k}$ for $k\ge3$, choose $t\in\{0,1\}$ so that
\[
 y_{k+1}=y_k+t2^{k-1},\qquad y_{k+1}^2\equiv u\pmod{2^{k+1}}.
\]
Such a choice exists because the change in the square is
$t2^ky_k$ modulo $2^{k+1}$, and $y_k$ is odd. There are at most
$\log_2 M$ local lifting steps in total. The Chinese remainder theorem
then gives one root modulo $M$ in polynomial time.
We make no claim here to find the least root modulo a composite $M$;
that is a different problem in the original paper.
\end{proof}

% Bibliography item to add:
% \bibitem{AMM77} L. Adleman, K. Manders, and G. L. Miller,
% On taking roots in finite fields, Proc. 18th FOCS (1977), 175--178.
% doi:10.1109/SFCS.1977.18.
% Author scan: https://www.cs.cmu.edu/~glmiller/Publications/AMM77.pdf .

\section{Deterministic splitting in even degree and Gao's balance test}
\label{sec:even-splitting}

The input in this section is a prime $p$ and a monic squarefree polynomial
$f\in\mathbb F_p[X]$ of degree $n>1$ which splits completely in
$\mathbb F_p$. The distinct roots need not be known. These input promises
can be checked in polynomial time by taking a gcd with the derivative and
computing $X^p\bmod f$. A \emph{proper factor} means a divisor with degree
strictly between $0$ and $n$.

R\'onyai's published factoring theorem includes a deterministic
polynomial-time algorithm under GRH to find a proper factor of every
such $f$ of even degree; see \cite{RonyaiFactoring} and the explicit
discussion in \cite[Section~1]{GaoFactoring}. Gao's
\cite[Theorems~3.1 and~3.3]{GaoFactoring} gives a more general
decomposition based on a balance condition on the roots. We prove these
conclusions with a direct construction, replacing the GRH-dependent
choice of a scalar root of unity by Lemma~\ref{lem:witness}.

Suppose first that $p$ is odd, and write $p-1=2^s w$ with $w$ odd.
Fix an element $\eta\in\mathbb F_p^\times$ of order $2^s$.
Every $a\ne0$ has a unique expression
\[
 a=\eta^u\theta,\qquad 0\leq u<2^s,\qquad\theta^w=1.
\]
Define $\epsilon_\eta(a)=1$ if $u<2^{s-1}$ and
$\epsilon_\eta(a)=-1$ otherwise. In particular
$\epsilon_\eta(-a)=-\epsilon_\eta(a)$.
For the set $F$ of roots of $f$, put
\[
 t_\alpha=\#\{\beta\in F\setminus\{\alpha\}:
                      \epsilon_\eta(\alpha-\beta)=1\}.
\]
Gao calls $F$ \emph{square balanced with respect to $\eta$} when all
$t_\alpha$ equal $(n-1)/2$. This agrees with his definition using
the scalar square-root choice $\sigma_2$:
$\sigma_2(a^2)=a$ exactly when $u<2^{s-1}$
\cite[Lemma~2.6(d) and Section~2.4]{GaoFactoring}.
When $p\equiv3\pmod4$, $\epsilon_\eta$ is the quadratic character.

\begin{theorem}[Gao's balance decomposition and R\'onyai's even-degree case]
\label{thm:even-splitting}
There is a deterministic algorithm with bit complexity polynomial in
$n$ and $\log p$ which, for odd $p$, constructs $\eta$ as above and
computes all polynomials
\[
 f_j(X)=\prod_{\substack{\alpha\in F\\t_\alpha=j}}(X-\alpha),
       \qquad 0\leq j\leq n-1.
\]
Their product is $f$, and the nonconstant members are pairwise coprime.
The algorithm therefore finds a proper factor unless $F$ is square
balanced with respect to the constructed $\eta$. In particular, every
squarefree completely split polynomial of even degree over a prime
field admits a deterministic polynomial-time proper factor.
\end{theorem}
\begin{proof}
Lemma~\ref{lem:witness}, applied to the quadratic character modulo $p$,
permits an exhaustive search in polynomial time for a quadratic
nonresidue $z$. Set $\eta=z^w$. Since
$\eta^{2^{s-1}}=z^{(p-1)/2}=-1$, $\eta$ has order $2^s$.
Only this scalar construction uses the new analytic input.

Form the explicitly presented commutative algebras
\[
 A=\mathbb F_p[X]/(f),\qquad x=X\bmod f,\qquad
 B=A[Y]/(g(Y)),\quad
 g(Y)=\frac{f(Y)-f(x)}{Y-x},\quad y=Y\bmod g.
\]
As $f(x)=0$, $g$ is a monic polynomial of degree $n-1$ over $A$.
The algebra $B$ is free of rank $n-1$ over $A$, with basis
$1,y,\ldots,y^{n-2}$. Abstractly, evaluation gives
\[
 A\simeq\prod_{\alpha\in F}\mathbb F_p,\qquad
 B\simeq\prod_{\substack{\alpha,\beta\in F\\\alpha\ne\beta}}\mathbb F_p.
\]
These isomorphisms are used only to prove the algorithm correct;
the unknown roots are not required to compute in $A$ or $B$.
The element $d=x-y$ has no zero coordinate in the second product.

We compute $\epsilon_\eta(d)$ simultaneously in all coordinates of $B$
without finding the roots of $f$. Choose $0\leq v<2^s$ with
$wv\equiv1\pmod {2^s}$, and put $E=wv$. Thus $E\equiv1\pmod {2^s}$
and $E\equiv0\pmod w$. Set $V_0=d^E$. At a coordinate where
$d=\eta^u\theta$, one has $V_0=\eta^u$.
For $i=0,\ldots,s-1$ compute in $B$
\[
 S_i=V_i^{\,2^{s-1-i}},\qquad
 b_i=\frac{1-S_i}{2},\qquad
 V_{i+1}=V_i\bigl((1-b_i)+b_i\eta^{-2^i}\bigr).
\]
To verify the recurrence, write $u=\sum_{j=0}^{s-1}u_j2^j$
with $u_j\in\{0,1\}$. Induction on $i$ gives, in this coordinate,
\[
 V_i=\eta^{\sum_{j=i}^{s-1}u_j2^j},\qquad
 S_i=(-1)^{u_i},\qquad b_i=u_i.
\]
Consequently $e=1-b_{s-1}$ is an idempotent of $B$, whose
$(\alpha,\beta)$ coordinate is $1$ exactly when
$\epsilon_\eta(\alpha-\beta)=1$.
All divisions in the recurrence are divisions by the scalar $2$,
which is invertible. No division by a possible zero divisor occurs.

Compute the relative trace
\[
 T=\operatorname{Tr}_{B/A}(e)\in A
\]
as the trace of the matrix for multiplication by $e$ in the displayed
$A$-basis of $B$. Under the evaluation at $\alpha$, that matrix is
the multiplication matrix on
$\prod_{\beta\in F\setminus\{\alpha\}}\mathbb F_p$, so
$T(\alpha)=t_\alpha$ in $\mathbb F_p$.
Since $n\leq p$ and $0\leq t_\alpha\leq n-1$, these integers
have distinct residues modulo $p$. Let $\widetilde T(X)$ be the
representative of $T$ of degree less than $n$. Then ordinary
polynomial gcd computations give exactly
\[
 \gcd\bigl(f(X),\widetilde T(X)-j\bigr)=f_j(X)
       \quad(0\leq j\leq n-1).
\]
This proves the claimed output and the factorization of $f$.

Every unordered pair of roots contributes once to
$\sum_{\alpha\in F}t_\alpha$, because
$\epsilon_\eta(\alpha-\beta)=-\epsilon_\eta(\beta-\alpha)$.
Hence, as an equality of integers,
\[
 \sum_{\alpha\in F}t_\alpha=\frac{n(n-1)}2.
\]
All $f_j$ are trivial except one precisely when all $t_\alpha$
coincide. Their common value must then be $(n-1)/2$.
This is precisely the square-balanced case. When $n$ is even
the common value would not be an integer, so a proper factor
must be produced.

Finally we verify the time bound. The algebra $B$ has dimension
$n(n-1)$ over $\mathbb F_p$ and an explicit multiplication table
computable from $f$. All exponents above have $O(\log p)$ bits,
and there are $s=O(\log p)$ iterations. Repeated squaring,
construction of a multiplication matrix, its trace, and $n$
polynomial gcd computations therefore use a number of field
operations polynomial in $n,\log p$. Arithmetic in $\mathbb F_p$
has polynomial bit complexity, as does the initial search for $z$.
For $p=2$, the input promises and $n>1$ force
$f=X(X-1)$, which is factored immediately.
\end{proof}

The result produces a proper factor in even degree; it does not assert
complete polynomial-time factorization after an odd-degree factor
has appeared. The stronger super-square-balance criterion in
\cite[Theorem~3.7]{GaoFactoring} invokes further automorphism-splitting
machinery and is not inferred from the argument here.

% GaoFactoring: S. Gao, On the deterministic complexity of factoring
% polynomials, J. Symbolic Comput.31(2001),19--36.
% DOI:10.1006/jsco.1999.1001.
% Author primary PDF (linked from the author's publication list):
% https://www.math.clemson.edu/~sgao/papers/FacPoly.pdf
% RonyaiFactoring: L. Ronyai, Factoring polynomials over finite fields,
% J. Algorithms9(1988),391--400. DOI:10.1016/0196-6774(88)90029-6.

\section{R\'onyai's splitting theorem when three divides the number of factors}
\label{sec:three-divisible-splitting}

R\'onyai's published deterministic factoring result under GRH has running
time polynomial in $n^r$ and $\log|k|$ when $r$ is a prime divisor of
the dimension of the relevant split algebra. See \cite{RonyaiFactoring}
and its precise algebraic formulation and unconditional reduction in
\cite[Section~5.2 and Theorem~5.6]{IKRS}. The case $r=3$ uses the
finite-order Hecke theorem over $\mathbb Q(\sqrt{-3})$ in an essential
way. The following theorem retains the polynomial-time conclusion.

\begin{theorem}[R\'onyai's case $r=3$]\label{thm:three-divisible-splitting}
There is a deterministic algorithm, polynomial in $n$ and $\log p$,
which finds a proper factor of every squarefree polynomial
$f\in\mathbb F_p[X]$ that splits completely and whose degree $n$ is
divisible by three.
\end{theorem}

We first supply the one finite-field ingredient that cannot be obtained
from Dirichlet characters alone.

\begin{lemma}\label{lem:eisenstein-cubic-nonresidue}
Let $p\equiv2\pmod3$ be prime, and put
$k=\mathbb F_p[Z]/(Z^2+Z+1)$.
A noncube in $k^\times$ can be found deterministically in time
polynomial in $\log p$.
\end{lemma}
\begin{proof}
The polynomial defining $k$ is irreducible. Identify its image of $Z$
with the reduction of $\omega=e^{2\pi i/3}$ from
$\mathcal O=\mathbb Z[\omega]$, the ring of integers of
$K_0=\mathbb Q(\sqrt{-3})$.
First test the six units of $\mathcal O$ by exponentiation to
$(p^2-1)/3$. If one is a noncube, the algorithm has finished.

Otherwise fix, only for the proof of the search bound, an isomorphism
between the third roots of unity in $k$ and in $\mathbb C$.
The nonprincipal cubic character
$\chi:k^\times\longrightarrow\{1,\omega,\omega^2\}$ obtained from
$z\mapsto z^{(p^2-1)/3}$ is trivial on all units of $\mathcal O$.
Since $\mathcal O$ has class number one, the formula
\[
 \eta((\alpha))=\chi(\alpha\bmod p),\qquad p\nmid\alpha,
\]
therefore defines a finite-order Hecke character on the ideals prime
to $(p)$. It is independent of the generator. It is trivial on every
principal ideal generated by $\alpha\equiv1\pmod p$, so its conductor
divides $(p)$ and its archimedean type is trivial. It is nonprincipal:
every nonzero element of $k$ has an integral lift, and some such lift
has $\chi$-value different from one.

The estimate \eqref{eq:eisenstein-psi}, applied to the primitive
character inducing $\eta$, gives
\[
 \sum_{\substack{\mathrm N\mathfrak a\le x\\(\mathfrak a,(p))=1}}
 \Lambda_{K_0}(\mathfrak a)\eta(\mathfrak a)
 \ll x^{7/8}\log^2(3p^2x).
\]
Removing an Euler factor, if necessary, costs $O(\log(2x))$.
On the other hand $\zeta_{K_0}(s)=\zeta(s)L(s,\chi_{-3})$, so the
Dirichlet explicit formula gives
\[
 \sum_{\substack{\mathrm N\mathfrak a\le x\\(\mathfrak a,(p))=1}}
 \Lambda_{K_0}(\mathfrak a)
 =x+O\bigl(x^{7/8}\log^2(3x)+\log(2x)\bigr).
\]
All constants here are absolute and effective.
If every integral $\alpha$ of norm at most $x$, prime to $(p)$,
had $\chi(\alpha)=1$, the two sums would coincide: every ideal of
norm at most $x$ is principal and has a generator of that same norm.
For
\[
 x=C\bigl(\log(3p)\bigr)^{32}
\]
with an effective absolute constant $C$ sufficiently large, the two
estimates contradict each other. Consequently there is a noncube
$a+b\omega$ with
$a^2-ab+b^2\le x$.
Since this norm is at least $(a^2+b^2)/2$, its two coordinates satisfy
$|a|,|b|\le\sqrt{2x}$.

The algorithm simply enumerates that integer box, reduces each entry
in $k$, discards zero, and tests whether its $(p^2-1)/3$ power is one.
The box has $O(x)$ entries, and every test has polynomial bit complexity
in $\log p$. The analytic argument establishes termination within a
polynomial number of tests; the algorithm never computes a Hecke
character, a prime ideal, or a class field.
\end{proof}

\begin{lemma}\label{lem:cubic-automorphism-splitting}
Let $k$ be either $\mathbb F_p$ with $p\equiv1\pmod3$ or the field of
Lemma~\ref{lem:eisenstein-cubic-nonresidue}.
Given a split commutative $k$-algebra $C$, a nonidentity
$k$-automorphism $\tau$ of order three, and a cubic nonresidue in $k$,
one can find a nonzero zero divisor of $C$ deterministically in time
polynomial in $\dim_k C$ and $\log|k|$.
\end{lemma}
\begin{proof}
All algebras in this argument have an identity, and are given by
structure constants. Write $Q=|k|$ and $Q-1=3^s w$, where $3\nmid w$.
If $z$ is the supplied noncube, then $\zeta=z^w$ has order $3^s$.
In particular $\xi=\zeta^{3^{s-1}}$ is a primitive cube root of unity.

We record explicitly that this data permits taking cube roots in $k$.
For a known cube $a\ne0$, find the discrete logarithm of $a^w$ to the
base $\zeta$ in the group of order $3^s$ by successive ternary digits.
If its first $j$ digits give $u_j$, its next digit $d\in\{0,1,2\}$
is uniquely determined by
\[
 (a^w\zeta^{-u_j})^{3^{s-1-j}}=\xi^d.
\]
This uses $s$ steps and only three comparisons per step. If the resulting
logarithm is $v$, take the least representative
$u\equiv v w^{-1}\pmod{3^s}$. Then
$a=\zeta^u\theta$ with $\theta^w=1$. Since $a$ is a cube, $3\mid u$.
For $3e\equiv1\pmod w$,
$\zeta^{u/3}\theta^e$ is a cube root of $a$; if $w=1$, take $e=0$.
Multiplication by $1,\xi,\xi^2$ gives all three roots. Thus this step
does not require factoring $Q-1$ or a general discrete-logarithm oracle.

The algebra $C$ is a product of copies of $k$. The automorphism $\tau$
permutes these factors and has at least one cycle of length three.
The $\xi$-eigenspace of $\tau$ is therefore nonzero. Solve
$(\tau-\xi I)h=0$ by linear algebra and choose $h\ne0$.
If multiplication by $h$ is singular, then $h$ itself is a nonzero
zero divisor and we finish. Otherwise $h$ is a unit.

For $0\le j\le s$, compute
\[
 v_j=h^{(Q-1)/3^j}.
\]
The first member is $v_0=1$. The last is nonscalar, since
$\tau(v_s)=\xi^w v_s\ne v_s$ and $\tau$ fixes every scalar.
Let $j\ge1$ be the first index for which $v_j$ is nonscalar.
Then $v_j^3=v_{j-1}=a\in k^\times$.
Because $C$ is split, each coordinate of $v_j$ belongs to $k$,
so $a$ is a cube in $k$. Compute its three distinct cube roots
$b_0,b_1,b_2$ by the preceding routine.
At least two occur among the coordinates of the nonscalar element
$v_j$. Consequently at least one $v_j-b_i$ is a nonzero zero divisor.
Testing the three multiplication matrices identifies one.
Every algebraic operation, exponentiation, and linear-system solution
has the asserted polynomial complexity.
\end{proof}

\begin{proof}[Proof of Theorem~\ref{thm:three-divisible-splitting}]
We state precisely the already unconditional algebraic theorem that we
use from \cite[Theorem~5.6]{IKRS}.
For a finite-dimensional commutative semisimple algebra $A$ over a
finite field $k$, a unital subalgebra $B$, and a prime
$r\ne\operatorname{char}k$ dividing
the free $B$-module rank $m$ of $A$, its algorithm, in deterministic
time polynomial in $m^r$ and $\log|A|$, produces either a nonzero
zero divisor of $A$, or a unital subalgebra $C\subseteq A$ and a
semiregular automorphism of $C$ of order $r$, with $C^\tau\supseteq B$.
Here semiregular means that no nonidentity group element acts as the
identity on a nonzero invariant ideal.
This is an unconditional published algorithm, not an additional
analytic hypothesis. Its construction uses the essential part of
$A^{\otimes_B r}$, the kernel intersection of the coordinate
multiplication maps. This part has $B$-rank
$m(m-1)\cdots(m-r+1)$; the coordinate $r$-cycle acts semiregularly.
When $r\mid m$, its rank over $A$ is coprime to $r$, and the descent
of \cite[Proposition~5.2]{IKRS} produces the stated zero divisor or
subalgebra with automorphism. For $r=3$ all these dimensions and the
published running time are polynomial in the input dimension.

Let $f$ be as in the theorem.
For $p>3$ choose
\[
 k=\begin{cases}
       \mathbb F_p,&p\equiv1\pmod3,\\
       \mathbb F_p[Z]/(Z^2+Z+1),&p\equiv2\pmod3 .
    \end{cases}
\]
In the first case Lemma~\ref{lem:witness}, applied to a cubic
Dirichlet character modulo $p$, finds a cubic nonresidue by enumeration;
in the second use Lemma~\ref{lem:eisenstein-cubic-nonresidue}.
Now $A=k[X]/(f)$ is split of dimension $n$. Apply the cited
unconditional algebraic theorem with $B=k$ and $r=3$.
If it returns $C,\tau$, apply
Lemma~\ref{lem:cubic-automorphism-splitting}.
The resulting nonzero zero divisor of $C$ is also a nonzero zero
divisor of $A$, because the inclusion is an algebra embedding.
Represent this element by $g\in k[X]$ of degree less than $n$.
Then $\gcd(f,g)$ is a proper monic factor of $f$.
Although computed over $k$, its roots are a subset of the roots of $f$
in $\mathbb F_p$, so all its coefficients lie in $\mathbb F_p$.
For $p=2,3$ exhaustive testing of the at most three possible roots
already takes polynomial time.
\end{proof}

The usual reduction to the prime-Frobenius fixed algebra also gives the
following consequence. It is recorded separately from the published
split-polynomial statement.

\begin{corollary}\label{cor:three-divisible-factors}
Suppose a finite field $\mathbb F_q$ is given in the usual polynomial
representation over its prime field. A squarefree polynomial over
$\mathbb F_q$ whose number of irreducible factors is divisible by three
admits a proper factor in deterministic time polynomial in its degree
and $\log q$. The number of irreducible factors need not be supplied.
\end{corollary}
\begin{proof}
Put $q=p^e$, $d=\deg f$, and
$R=\mathbb F_q[X]/(f)$. Compute the kernel
\[
 B_0=\{a\in R:a^p=a\}
\]
as an $\mathbb F_p$-linear subspace of the $ed$-dimensional vector
space $R$. The Frobenius map and this kernel are computed by
exponentiation and linear algebra. Since $f$ is squarefree, the
Chinese remainder theorem gives
$R\simeq\prod_{i=1}^t\mathbb F_{q^{d_i}}$ and
$B_0\simeq\mathbb F_p^t$, where $t$ is the number of distinct
irreducible factors. Thus $t=\dim_{\mathbb F_p}B_0$ is itself obtained
without factoring $f$.

Apply the same split-algebra construction to
$A=k\otimes_{\mathbb F_p}B_0$ when $3\mid t$.
If $k=\mathbb F_p$, the resulting nonzero zero divisor is already in
$B_0$. Otherwise write it as $z=z_0+\omega z_1$ with $z_i\in B_0$.
In the description $A\simeq k^t$, a zero coordinate of $z$ forces
both corresponding $\mathbb F_p$-coordinates of $z_0,z_1$ to vanish.
At least one $z_i$ is nonzero, and that $z_i$ is consequently a
nonzero zero divisor in $B_0$ and in $R$.
Taking its gcd with $f$ over $\mathbb F_q$ gives a proper factor.
If $p=2,3$, choose any nonscalar $b\in B_0$ and test $b-c$ for the
at most three $c\in\mathbb F_p$ instead.
The construction of $B_0$, its structure constants, the extension
of degree at most two, and every subsequent operation use time
polynomial in $d$ and $e\log p=\log q$.
\end{proof}

The theorem provides a proper factor under the stated divisibility
condition. Repeated application does not assert complete factorization
in arbitrary degree, since a resulting factor may have a number of
irreducible factors divisible by neither two nor three.

% Bibliography addition:
% \bibitem{IKRS}
% G. Ivanyos, M. Karpinski, L. R\'onyai and N. Saxena,
% Trading GRH for algebra: algorithms for factoring polynomials and
% related structures, Math. Comp. 81 (2012), 493--531.
% DOI: 10.1090/S0025-5718-2011-02505-6.
% Primary published author copy:
% https://www.cse.iitk.ac.in/users/nitin/papers/nogrh.pdf

\section{The Pollack--Schorn algorithm for three squares}
\label{sec:three-square-algorithm}

The existence of a representation by three squares is classical. The
previously conditional conclusion here concerns its computational cost
when the integer is supplied without a factorization. We recover the
exact expected complexity in \cite[Theorem~$3'$]{PollackSchorn}, rather
than just polynomial-time computability. As in that paper, $M(b)$ denotes
a standard bit-complexity bound for multiplying two $b$-bit integers;
one may use ordinary multiplication or either of the fast multiplication
bounds specified there. In particular $M(b)\geq b$ and
$M(cb)=O_c(M(b))$ for every fixed $c>0$.

\begin{theorem}[Pollack--Schorn's three-square algorithm]
\label{thm:three-square-algorithm}
There is a randomized algorithm which, given a positive integer $n$
not of the form $4^k(8m+7)$, returns integers $x,y,z$ with
$n=x^2+y^2+z^2$, always correctly, and has expected bit complexity
\[
 O\!\left(\frac{(\log n)^2}{\log\log n}\,M(\log n)\right)
 \qquad(n\longrightarrow\infty).
\]
No factorization of $n$ is an input.
\end{theorem}
\begin{proof}
First remove powers of $4$ and at the end rescale the three coordinates
by the corresponding power of $2$. This costs $O(\log n)$ bit
operations. It is therefore enough to treat
$n\equiv1,2,3,5,6\pmod8$. Bounded values of $n$ can be treated by
exhaustive search. Throughout the proof let $b=\lceil\log_2(n+1)\rceil$.

We first establish the replacement for the only ERH-dependent input
in \cite[Section~3.1]{PollackSchorn}. There are effective absolute
constants $C,c>0$ such that, for $(a,q)=1$, $q\geq2$, and
$X\geq Cq^{16}$,
\begin{equation}\label{eq:three-square-ap-density}
 \#\{p\leq X:p\text{ prime},\ p\equiv a\pmod q\}
       \geq c\frac{X}{\varphi(q)\log X}.
\end{equation}
Indeed, character orthogonality and Lemma~\ref{lem:psi}, including
the principal-character term, give
\[
 \sum_{\substack{m\leq X\\m\equiv a\ (q)}}\Lambda(m)
   =\frac{X}{\varphi(q)}
       +O\bigl(X^{7/8}\log^2(qX)\bigr).
\]
The contribution from proper prime powers is
$O(X^{1/2}\log^2X)$. Since $\varphi(q)\leq q$, taking the effective
absolute constant $C$ sufficiently large makes the two error terms
at most $X/(2\varphi(q))$ for every $X\geq Cq^{16}$.
Dividing the remaining sum over primes by $\log X$ proves
\eqref{eq:three-square-ap-density}. The exponent $16$ is convenient;
its numerical value will not enter the bit complexity.

We use the following four coprime residue classes from
\cite[Section~2.2]{PollackSchorn}:
\[
\begin{array}{c|c|c|c|c}
 n\bmod8&q&a&D& a_{22}\\ \hline
 2,6&4n&2n-1&(p+1)/n&p\\
 1&8n&6n-1&(p+1)/n&p\\
 3&4n&(5n-1)/2&(2p+1)/n&2p\\
 5&4n&(3n-1)/2&(2p+1)/n&2p
\end{array}
\]
Here $0<a<q$, $p\equiv a\pmod q$, and always
$a_{22}=Dn-1$. In the first two rows respectively
$D\equiv2\pmod4$, $p\equiv3\pmod8$, and
$D\equiv6\pmod8$, $p\equiv5\pmod8$.
In the last two rows $p\equiv3\pmod4$, and respectively
$D\equiv5\pmod8$ and $D\equiv3\pmod8$.

When $p$ is prime, $-D$ is a quadratic residue modulo $p$ in all
four rows. Here is a verification which does not presume $D$ squarefree.
In the first two rows put $d=D/2$. In the first row, quadratic
reciprocity for Jacobi symbols gives
\[
 \left(\frac{-D}{p}\right)
 =\left(\frac{-2}{p}\right)\left(\frac d p\right)
 =\left(\frac{-1}{d}\right)(-1)^{(d-1)/2}=1.
\]
In the second row it gives
$(-D/p)=-(p/d)=-(-1/d)=1$, since $d\equiv3\pmod4$.
In the third row $D\equiv5\pmod8$ gives
\[
 \left(\frac{-D}{p}\right)
 =-\left(\frac pD\right)
 =-\left(\frac{-1}{D}\right)\left(\frac2D\right)=1;
\]
in the fourth row $D\equiv3\pmod8$ gives instead
$(-D/p)=(p/D)=(-1/D)(2/D)=1$.
We used $p\equiv-1\pmod d$ in the first two rows and
$2p\equiv-1\pmod D$ in the last two.

For any candidate $p$ in the indicated progression, we now attempt
the following operation without testing primality. If $p\equiv3\pmod4$,
compute $R=(-D)^{(p+1)/4}\bmod p$ and retain it only when
$R^2\equiv-D\pmod p$. If $p\equiv5\pmod8$, compute
$R=(-D)^{(p+3)/8}\bmod p$. Retain it if its square is $-D$;
if its square is $D$, replace it by $2^{(p-1)/4}R\bmod p$ and
again retain it only if its square is $-D$. In every other case
discard the candidate. For a prime candidate this procedure always
succeeds: Euler's criterion proves the first formula; in the second
case $R^2=\pm D$ and $(2^{(p-1)/4})^2=-1\pmod p$.
For the last two rows replace $R$ by $R+p$, if needed, to make
its parity agree with $-D$. We then have a verified integer $a_{12}$
such that
\[
 a_{12}^2\equiv-D\pmod{a_{22}}.
\]
Successful verification has this meaning even if $p$ is composite.
The operation costs $O(bM(b))$ when $\log p=O(b)$.

To sample candidates efficiently, put
\[
 L=\prod_{\substack{\ell\leq\log n\\
                 \ell\text{ prime},\ \ell\nmid q}}\ell,
 \qquad K=\left\lceil\frac{Cq^{15}}L\right\rceil,
 \qquad X=qLK.
\]
Unconditional estimates for primes imply $\log L=O(\log n)$,
and in fact $L\leq q^2$ for sufficiently large $n$. Consequently
$Cq^{16}\leq X\leq Cq^{16}+q^3$, so $\log X=O(b)$.
The list of primes, the divisibility tests, and their product can be
computed in $O(b^{3/2}M(b))$ bit operations, by the unconditional
precomputation in \cite[Section~3.3]{PollackSchorn}.

For each prime $\ell\mid L$, choose a residue $a_\ell$ independently
and uniformly in $\{1,\ldots,\ell-1\}$. Let $a_0$ be the unique
integer in $(0,qL]$ satisfying
\[
 a_0\equiv a\pmod q,\qquad
 a_0\equiv a_\ell\pmod\ell\quad(\ell\mid L).
\]
Independently choose $k$ uniformly in $\{0,\ldots,K-1\}$ and put
$p=a_0+qLk$. This samples uniformly from the set $S$ of integers
in $(0,X]$ congruent to $a$ modulo $q$ with no prime factor at most
$\log n$. The Chinese remainder theorem gives
$\#S=K\varphi(L)$. Generation costs $O(b^2)$ bit operations in
expectation, by the elementary CRT calculation in
\cite[Section~3.3]{PollackSchorn}; rejection sampling implements
each uniform choice with bounded expected overhead. The larger
value of $K$ here still has $O(b)$ bits.

Each prime in the progression up to $X$ belongs to $S$: its least
positive representative is at least $a>\log n$ for all sufficiently
large $n$. Therefore \eqref{eq:three-square-ap-density} and Mertens'
theorem show that the probability of a prime candidate is at least
\[
 c\frac{qLK}{\varphi(q)\log X}\frac1{K\varphi(L)}
 \gg\frac1{\log n}\frac{qL}{\varphi(q)\varphi(L)}
 =\frac1{\log n}\prod_{\ell\mid qL}(1-1/\ell)^{-1}
 \gg\frac{\log\log n}{\log n}.
\]
All primes at most $\log n$ divide $qL$, which justifies the last
inequality. Repeated independent sampling followed by the verified
square-root operation thus terminates almost surely in
$O(b/\log b)$ expected trials. Every prime trial succeeds;
composite successes can only shorten the running time.

For a successful trial form the integral symmetric matrix
\[
 M_F=\begin{pmatrix}
  (D+a_{12}^2)/a_{22}&a_{12}&1\\
  a_{12}&a_{22}&0\\
  1&0&n
 \end{pmatrix}.
\]
Its first two leading principal minors are positive and $D$,
respectively, and its determinant is $Dn-a_{22}=1$.
Hence it is positive definite. All its entries have $O(b)$ bits.
The unconditional ternary reduction algorithm in
\cite[Proposition~2]{PollackSchorn} computes
$A\in\mathrm{SL}_3(\mathbb Z)$ and a quasi-reduced form satisfying
$M_{F_{\rm qred}}=A^tM_FA$ in $O(b\log b\,M(b))$ bit operations.
The unique positive definite integral quasi-reduced ternary form
of determinant $1$ is the sum of three squares
\cite[Lemma~1]{PollackSchorn}. To recall the short argument, write
$(c_{ij})=M_{F_{\rm qred}}$ and $(C_{ij})=-\operatorname{adj}((c_{ij}))$.
Its quasi-reduction inequalities give $c_{11}<2$,
$|c_{12}|\leq c_{11}/2$, and $|C_{33}|<2$.
Thus $c_{11}=c_{22}=1$, $c_{12}=0$, and $C_{33}=-1$.
The other two inequalities $|C_{13}|,|C_{23}|\leq|C_{33}|/2$
force $c_{13}=c_{23}=0$, after which the determinant gives
$c_{33}=1$. It follows that $A^tM_FA=I_3$.

Output the third column $(x,y,z)^t=A^{-1}(0,0,1)^t$.
Then $x^2+y^2+z^2=n$. Its computation takes $O(M(b))$ operations:
indeed if $H$ is the maximum absolute entry of $M_F$, its largest
eigenvalue is at most $3H$, and determinant $1$ gives smallest
eigenvalue at least $(3H)^{-2}$. Each column $u$ of $A$ satisfies
$u^tM_Fu=1$, hence $\|u\|_2\leq3H$. Thus the entries of $A$
have $O(b)$ bits, and $A^{-1}$ is computed from its $2\times2$ minors.
This elementary argument supplies the needed size bound independently
of the displayed bound on $\|A\|$ in the cited proposition.

The expected bit complexity is consequently
\[
 O\!\left(b^{3/2}M(b)
       +\frac b{\log b}\{b^2+bM(b)\}
       +b\log b\,M(b)\right)
   =O\!\left(\frac{b^2}{\log b}M(b)\right),
\]
as asserted. Every output is verified by the integral construction;
the analytic input controls termination and expected cost.
\end{proof}

% PollackSchorn: P. Pollack and P. Schorn, Dirichlet's proof of the
% three-square theorem: An algorithmic perspective, Math. Comp. 88
% (2019), no. 316, 1007--1019. DOI:10.1090/mcom/3349.
% Author primary PDF: https://www.pollack-math.net/finding3squares-6.pdf
% Publisher: https://www.ams.org/mcom/2019-88-316/S0025-5718-2018-03349-X/

\section{Randomized identity testing for square-root circuits}
\label{sec:radical-identity}

An arithmetic circuit here is a finite directed acyclic graph with
integer constants and variables at its input gates, and addition,
subtraction, or multiplication at its other gates. Its output represents
a polynomial $f\in\mathbb Z[X_1,\ldots,X_k]$; the polynomial is not
expanded. In the \emph{$2$-Radical Identity Testing problem}, or
$2$-RIT, the input also specifies rational primes $a_1,\ldots,a_k$
in binary, and asks whether
\[
 f(\sqrt{a_1},\ldots,\sqrt{a_k})=0,
\]
where the square roots are positive real numbers. There is no bound
on the circuit's formal degree beyond the exponential bound inherent
in its size. Balaji--Nosan--Shirmohammadi--Worrell proved under GRH
that this problem belongs to $\mathrm{coRP}$
\cite[Theorem~2]{RadicalIdentity}. We recover precisely this assertion.
Their unconditional $\mathrm{coNP}$ bound is a different, already
established statement and is not counted as a new consequence here.

\begin{theorem}[$2$-RIT in $\mathrm{coRP}$]
\label{thm:radical-identity}
There is a randomized algorithm with running time bounded by a
polynomial in the input length on every random branch which always
answers ``zero'' when the displayed expression is zero, and answers
``nonzero'' with probability at least $1/2$ when it is nonzero.
\end{theorem}
\begin{proof}
Repeated prime radicands can be identified by merging the corresponding
variables, so assume they are distinct. Choose $s\geq2$ at least
the number of gates and input radicands and at least their bit lengths
and the bit lengths of all integer constants. This is bounded by the
ordinary encoded input length. The primality of the radicands is part
of the input specification and may also be checked in deterministic
polynomial time. The algorithm performs no integer factorization.

Put
\[
 K=\mathbb Q(\sqrt{a_1},\ldots,\sqrt{a_k}),\qquad
 R=\mathbb Z[\sqrt{a_1},\ldots,\sqrt{a_k}],\qquad
 \alpha=f(\sqrt{a_1},\ldots,\sqrt{a_k}).
\]
The distinct primes are independent in
$\mathbb Q^\times/\mathbb Q^{\times2}$, by their valuations.
Consequently $[K:\mathbb Q]=2^k$, and each independent choice of
signs for the square roots is an automorphism of $K$.
One can see the degree assertion inductively: the quadratic
subfields of an already constructed extension with group
$(\mathbb Z/2\mathbb Z)^j$ are the fields generated by square
roots of the nonempty products of its $j$ primes. A new prime
cannot give one of these fields, by its valuation, so adjoining
its square root doubles the degree. In particular the monomials
$\prod_i\sqrt{a_i}^{\,e_i}$, $e_i\in\{0,1\}$, form a basis, and
\begin{equation}\label{eq:rit-ring-presentation}
 R\simeq\mathbb Z[Y_1,\ldots,Y_k]/(Y_i^2-a_i:1\leq i\leq k).
\end{equation}

We need a bound on the number of primes that could erase a nonzero
answer upon reduction. At every complex embedding of $K$, the
input constants and square roots have absolute value at most $2^s$.
If the maximum of $1$ and the absolute values computed up to some
gate is $H$, after one more gate it is at most $2H^2$.
Thus at the output, uniformly over all embeddings,
\[
 \log_2\max\{1,|\sigma(\alpha)|\}\leq(s+1)2^s.
\]
If $\alpha\ne0$, its norm $N=N_{K/\mathbb Q}(\alpha)$ is a
nonzero rational integer satisfying
\begin{equation}\label{eq:rit-norm-bound}
 \log_2|N|\leq(s+1)2^{2s}=:B_s.
\end{equation}
It therefore has at most $B_s$ distinct prime divisors.
Neither $N$ nor $\alpha$ is computed by the algorithm; their
potentially exponential bit lengths cause no computational cost.

We now arrange simultaneous finite-field square roots. Put
\[
 Q=8\prod_{a_i\ne2}a_i,
\]
and find by the Chinese remainder theorem the reduced residue
$a\in\{1,\ldots,Q-1\}$ satisfying
\begin{equation}\label{eq:rit-progression}
 a\equiv7\pmod8,\qquad
 a\equiv(-1)^{(a_i-1)/2}\pmod{a_i}\quad(a_i\ne2).
\end{equation}
Here $(a,Q)=1$ and $\log_2Q\leq s^2+3$.
For every prime $p\equiv a\pmod Q$, the supplementary law gives
$(2/p)=1$. For each odd $a_i$, quadratic reciprocity gives
\[
 \left(\frac{a_i}{p}\right)
  =\left(\frac p{a_i}\right)(-1)^{(a_i-1)/2}
  =\left(\frac{(-1)^{(a_i-1)/2}}{a_i}\right)
                  (-1)^{(a_i-1)/2}=1.
\]
We used $p\equiv3\pmod4$. Thus every $a_i$ is a nonzero square
modulo $p$, and
\begin{equation}\label{eq:rit-roots}
 r_i=a_i^{(p+1)/4}\bmod p
\end{equation}
is a square root. All roots are obtained deterministically by
repeated squaring. This choice of progression treats the radicand
$2$ as well as every odd prime.

The prime-density estimate \eqref{eq:three-square-ap-density}, already
proved from the zero-free strip, supplies effective absolute
constants $c,C>0$. Choose a sufficiently large effective integer
$A$, fixed independently of every input, and set
\[
 Y=2^{A(s+1)^3},\qquad
 J=\lceil Y/Q\rceil,\qquad X=QJ.
\]
For this choice $X\geq CQ^{16}$, $\log X=O_A((s+1)^3)$, and
the number $P$ of primes $p\leq X$ in the progression satisfies
\begin{equation}\label{eq:rit-prime-count}
 P\geq c\frac{X}{\varphi(Q)\log X}\geq4B_s.
\end{equation}
To justify the last inequality uniformly, use
$\varphi(Q)\leq Q\leq2^{s^2+3}$ and
$\log X\leq (A(s+1)^3+1)\log2$. The resulting lower bound is
a fixed positive constant times
$2^{A(s+1)^3-s^2-3}/(A(s+1)^3+1)$, whereas
$B_s=(s+1)2^{2s}$. Enlarging the effective integer $A$ makes
both required inequalities hold for all integers $s\geq2$.

One trial uses $t=\lceil\log_2J\rceil$ random bits to choose
$u\in\{0,\ldots,2^t-1\}$. If $u\geq J$, discard the trial.
Otherwise set $p=a+Qu$ and test primality in deterministic
polynomial time. Discard a composite candidate. For a prime
candidate compute the roots \eqref{eq:rit-roots} and evaluate
the given circuit modulo $p$ at them. If the answer is nonzero,
return ``nonzero''. If it is zero, start the next trial.
The use of a fixed number of random bits, with unsuccessful
draws counted as trials, avoids unbounded rejection sampling.

For correctness, \eqref{eq:rit-ring-presentation} shows that any
selection of roots $r_i$ defines a ring homomorphism
$\rho:R\to\mathbb F_p$. If $\alpha=0$, therefore,
$\rho(\alpha)=0$ on every trial. If $\alpha\ne0$ and $p\nmid N$,
the identity
\[
 N=\prod_{\sigma\in\operatorname{Gal}(K/\mathbb Q)}\sigma(\alpha)
\]
and application of $\rho$ show that every factor on the right has
nonzero image; in particular $\rho(\alpha)\ne0$.
There are at most $B_s$ primes dividing $N$.
By \eqref{eq:rit-prime-count}, at least $3P/4$ primes in the
progression are therefore successful when the answer is nonzero.
Since $J\leq2^t<2J$, one trial succeeds with probability at least
\[
 \frac{3P}{4\cdot2^t}
 \geq\frac{3P}{8J}
 \geq\frac{3c}{8\log X}\frac Q{\varphi(Q)}
 \geq\frac{c_0}{(s+1)^3}
\]
for an effective absolute $c_0>0$.
Perform $\lceil2(s+1)^3/c_0\rceil$ independent trials and, if
none succeeds, return ``zero''. A nonzero input is then missed
with probability at most $e^{-2}<1/2$, and a zero input is
always accepted.

Finally, all CRT data and trial integers have $O(s^3)$ bits.
Primality testing, the $k\leq s$ modular exponentiations, and
evaluation of the $s$-gate circuit modulo $p$ are polynomial-time
operations on such integers. The number of trials is a fixed
polynomial in $s$, on every random branch. We never expand the
circuit polynomial or compute its value as a large algebraic
number. This proves the claimed $\mathrm{coRP}$ bound.
\end{proof}

The statement concerns equality to zero. It makes no assertion about
the sign of a radical expression, about the Sum of Square Roots
comparison problem, or about the source's general radical problem
with arbitrary exponents, whose splitting fields need not be abelian.

% RadicalIdentity: N. Balaji, K. Nosan, M. Shirmohammadi, J. Worrell,
% Identity Testing for Radical Expressions, Proc.37th ACM/IEEE LICS
% (2022), article8,1--11. DOI:10.1145/3531130.3533331.
% Primary accepted manuscript, Oxford institutional repository:
% https://ora.ox.ac.uk/objects/uuid:9d9bbfe8-d1a3-4397-91b1-57781e16c957/files/s2f75r924m
% Source audit note: the accepted manuscript's p=5 mod8 progression
% does not make2 a square. Our p=7 mod8 progression is a replacement,
% and the proof above verifies every input prime, including2.

\section{Two cyclotomic identity-testing theorems}
\label{sec:cyclotomic-identity}

In \emph{Cyclotomic Identity Testing} (CIT), the input is an arithmetic
circuit over $\mathbb Z$ whose input monomials $X^e$ have exponents
written in binary, together with a positive integer $n$ in binary.
Writing $f$ for its output polynomial and $\zeta_n=e^{2\pi i/n}$,
the question is whether $f(\zeta_n)=0$. Equivalently, a multivariate
circuit is evaluated at specified powers of one root of unity.
Balaji--Perifel--Shirmohammadi--Worrell give two GRH-conditional
conclusions which follow from the present Dirichlet input
\cite[Theorems~1 and~4]{CyclotomicIdentity}.

\begin{theorem}[General cyclotomic circuits]
\label{thm:cyclotomic-bpp}
CIT belongs to $\mathrm{BPP}$: it has a randomized algorithm, polynomial
in the input length on every random branch, whose error probability
on each input is at most $1/3$.
\end{theorem}
\begin{proof}
Let $s\geq2$ bound the number of binary arithmetic gates, all integer
bit lengths, and the bit length of $n$. Gates with more than two
inputs and integer weights can be replaced by binary gates with
integer constants at polynomial cost. Set $\alpha=f(\zeta_n)$.
At every embedding of $\mathbb Q(\zeta_n)$, each input monomial has
absolute value $1$. The gate-by-gate bound used in
\eqref{eq:rit-norm-bound}, now with
$[\mathbb Q(\zeta_n):\mathbb Q]=\varphi(n)\leq n\leq2^s$, gives
\[
 \alpha\ne0\quad\Longrightarrow\quad
 0<|N_{\mathbb Q(\zeta_n)/\mathbb Q}(\alpha)|
       \leq2^{B_s},\qquad B_s=(s+1)2^{2s}.
\]
Thus there are at most $B_s$ primes dividing this norm. The
algorithm does not compute the norm or expand the polynomial.

Put $Q=\max\{2,n\}$, and choose a fixed, sufficiently large
effective integer $A$. Define
\[
 Y=2^{A(s+1)},\qquad J=\lceil Y/Q\rceil,\qquad X=QJ.
\]
Increasing $A$ once and for all makes $X\geq CQ^{16}$, and the
prime-density estimate \eqref{eq:three-square-ap-density} gives
\[
 P:=\#\{p\leq X:p\text{ prime},\ p\equiv1\pmod Q\}
 \geq c\frac{X}{\varphi(Q)\log X}\geq100B_s.
\]
Indeed $Q\leq2^s$ and $\log X=O_A(s)$, whereas
$X/Q\geq2^{A(s+1)-s}$. Consequently a uniformly sampled member
of $\{1+Qu:0\leq u<J\}$ is prime with probability at least
$c_1/(s+1)$ for an effective absolute $c_1>0$.
Using $\lceil\log_2J\rceil$ random bits and discarding out-of-range
indices loses a factor at most $2$. Deterministic primality testing
identifies a prime after $O(s)$ bounded trials, with probability
at least $99/100$. On failure we may return an arbitrary answer.
Conditioned on success, the first prime obtained is uniform among
the $P$ primes in question. Thus, if $\alpha\ne0$, it divides
the norm with probability at most $1/100$.

Next we construct a probable generator of $\mathbb F_p^\times$
without factoring $p-1$. Put $b=\lceil\log_2p\rceil$ and
$T=100b$. By trial division compute all primes $r\leq T$ dividing
$p-1$. Sample $h\in\mathbb F_p^\times$ and retain it when
\begin{equation}\label{eq:cit-small-prime-tests}
 h^{(p-1)/r}\ne1\pmod p
       \quad\text{for every such }r.
\end{equation}
For the proof of the probability estimates, fix a generator $g$
and write $h=g^u$. The algorithm does not compute $g$ or $u$.
A uniform $h$ makes $u$ uniform modulo $p-1$, and the tests say
precisely that none of the indicated primes divides $u$.
If $t$ is the number of distinct primes dividing $p-1$, then
$t\leq b$. Listing those primes increasingly as $r_1,\ldots,r_t$
gives $r_i\geq i+1$, hence
\[
 \mathbb P(\text{all tests pass})
 \geq\frac{\varphi(p-1)}{p-1}
 =\prod_{i=1}^t(1-1/r_i)
 \geq\prod_{i=1}^t\frac{i}{i+1}
 =\frac1{t+1}\geq\frac1{b+1}.
\]
Conditioned on the tests, for every prime $r>T$ dividing $p-1$
the probability that $r\mid u$ is exactly $1/r$. This follows
from the Chinese remainder theorem, since the condition involves
only different prime divisors. The union bound therefore gives
\[
 \mathbb P(h\text{ not a generator}\mid\text{tests pass})
 \leq\sum_{\substack{r\mid p-1\\r>T\text{ prime}}}\frac1r
 \leq\frac bT=\frac1{100}.
\]
Sampling by $b$ random bits, and discarding $0$ or a value at
least $p$, gives a valid uniform member of $\mathbb F_p^\times$
with probability at least $1/2$. After $20(b+1)$ bounded trials
the probability of obtaining no retained $h$ is at most
$e^{-10}<1/100$. The first retained value is uniform among
those satisfying \eqref{eq:cit-small-prime-tests}. On failure
we again return an arbitrary answer.

Set $\omega=h^{(p-1)/n}\bmod p$ and evaluate the circuit at
$\omega$ modulo $p$, answering ``zero'' exactly when the result
is zero. Conditional on $h$ being a generator, $\omega$ has
order exactly $n$. Therefore evaluation at $\omega$ defines a
ring homomorphism
\[
 \mathbb Z[\zeta_n]\longrightarrow\mathbb F_p.
\]
Indeed $X^n-1=\prod_{d\mid n}\Phi_d(X)$, and the order of
$\omega$ precludes its vanishing in any factor with $d<n$,
so $\Phi_n(\omega)=0$. A zero input remains zero under this
map. If $\alpha\ne0$ and $p$ does not divide its norm, applying
the map to the product of its Galois conjugates shows that its
image is nonzero.

The four possible bad events are failure to find a prime,
a norm-dividing prime for nonzero $\alpha$, failure to retain
$h$, and a retained $h$ that is not primitive. Their total
probability is less than $4/100<1/3$.
All trial integers have $O(s)$ bits; there are $O(s)$ prime
trials and $O(s)$ generator trials, and only $O(s)$ trial
divisors in \eqref{eq:cit-small-prime-tests}. Primality testing,
modular powers (including the binary input exponents), and
modular circuit evaluation take polynomial time. Every random
branch has polynomial length, proving the theorem.
\end{proof}

\begin{theorem}[The restricted diagonal theorem]
\label{thm:cyclotomic-diagonal}
There is a deterministic polynomial-time algorithm for CIT when
\[
 f(X)=\sum_{i=1}^{m}g(X)^{d_i},
\]
where $g\in\mathbb Z[X]$ is supplied in sparse representation,
its exponents and $n$ are in binary, and the nonnegative integers
$d_i$ are in unary.
\end{theorem}
\begin{proof}
The empty sum and the case $d:=\max_i d_i=0$ are immediate,
so assume $m,d\geq1$. Put
$\gamma=g(\zeta_n)$ and $H(Y)=\sum_iY^{d_i}$, a nonzero
integer polynomial of degree $d$. For $n\leq2$, direct integer
evaluation suffices, so take $n\geq3$.

Lemma~\ref{lem:witness} gives an effective constant $C$ such
that the units modulo $n$ represented by integers at most
$C(\log(3n))^8$ generate $(\mathbb Z/n\mathbb Z)^\times$.
Enumerate this polynomial-size set by gcd computations.
Starting from $\gamma$, construct its orbit under these
generators, stopping as soon as $d+1$ distinct elements appear.
Store an orbit element $g(\zeta_n^u)$ by its exponent
$u\bmod n$. A successor under a generator $v$ is
$g(\zeta_n^{uv})$; all powers in its sparse presentation can
be reduced modulo $n$.

The equality of two stored elements is a sparse cyclotomic
identity test on $g(X^u)-g(X^v)$, which has at most twice
the number of terms of $g$. We use the previously unconditional
deterministic polynomial-time sparse-CIT algorithm, given
in the stronger form $\mathrm{NC}$ in
\cite[Theorem~3]{CyclotomicIdentity}. This is the algorithmic
input imported in this proof. There are only polynomially
many comparisons before either the orbit closes or $d+1$
elements are found.

The Galois action is $\sigma_v(\zeta_n)=\zeta_n^v$.
Since the displayed units generate the full Galois group,
closure under them is the full orbit: in a finite group,
the semigroup generated by a set contains its inverses.
Thus if $d+1$ elements appear, the degree of $\gamma$ exceeds
$d$, so $H(\gamma)\ne0$. Return ``nonzero'' in this case.

Otherwise the complete orbit has at most $d$ elements, and
$[\mathbb Q(\gamma):\mathbb Q]\leq d$. Write
$M=\sum_j|c_j|$ for the sum of the absolute coefficients in
the sparse expression $g(X)=\sum_jc_jX^{e_j}$, and set
\[
 V=m\max\{1,M\}^{d}\geq1.
\]
Every Galois conjugate of $\beta:=H(\gamma)$ has absolute
value at most $V$. If $\beta\ne0$, its norm in
$\mathbb Q(\gamma)$ is a nonzero integer, because $\beta$
is integral. If $r=[\mathbb Q(\gamma):\mathbb Q]\leq d$,
this gives
\[
 1\leq\bigl|N_{\mathbb Q(\gamma)/\mathbb Q}(\beta)\bigr|
     \leq |\beta|V^{r-1}\leq|\beta|V^{d-1}.
\]
Consequently either $\beta=0$ or $|\beta|\geq V^{-(d-1)}$.
The logarithm of this positive lower bound's reciprocal is
polynomial in the input size, since $d$ is supplied in unary.

For completeness, this gap can be used without an oracle for
real arithmetic. Put $\epsilon=\tfrac14 V^{-(d-1)}$ and
approximate each $\zeta_n^{e_j}$ by a rational complex number
to absolute error less than
\[
 \delta=\min\left\{\frac1{2\max\{1,M\}},
     \frac{\epsilon}{2md(M+1)^{d-1}\max\{1,M\}}\right\}.
\]
The angles are $2\pi(e_j\bmod n)/n$. Rational approximations
to $\pi$, sine, and cosine with the required accuracy are
computable in polynomial time by their standard convergent
series and range reduction; $\log(1/\delta)$ is polynomial
in the input size. Form the resulting rational approximation
$\widetilde\gamma$ by exact rational arithmetic. It satisfies
$|\widetilde\gamma-\gamma|<\delta M\leq1/2$ and
$|\widetilde\gamma|\leq M+1$. The identity
$z^e-w^e=(z-w)\sum_{j=0}^{e-1}z^jw^{e-1-j}$ gives
\[
 |H(\widetilde\gamma)-H(\gamma)|
  \leq md(M+1)^{d-1}\delta M<\epsilon.
\]
The exact rational computation of $H(\widetilde\gamma)$ has
polynomial bit complexity, again because $d$ is unary.
Compare its squared complex absolute value with
$(2\epsilon)^2$, a comparison of rational numbers.
For zero $\beta$ the magnitude is less than $\epsilon$;
for nonzero $\beta$ it exceeds $3\epsilon$. This decides
correctly in deterministic polynomial time.
\end{proof}

The analytic dependence in the first theorem is solely prime density
in one arithmetic progression. In the second it is solely a
polynomial-size generating set for the units modulo $n$. The sparse
and bounded-degree cases which were already unconditional in the
source are not counted again.

% CyclotomicIdentity: N. Balaji, S. Perifel, M. Shirmohammadi, J. Worrell,
% Cyclotomic Identity Testing and Applications, ISSAC2021,35--42.
% DOI10.1145/3452143.3465530.
% Primary accepted manuscript:
% https://ora.ox.ac.uk/objects/uuid:7d5978e8-79ac-46ab-a2e9-f3a52daf2b48/files/s8g84mm960

\section{Castel's polynomial-time isotropic-vector algorithm}
\label{sec:castel-quadratic-forms}

The precise published conditional conclusion used here is
\cite[Fact~2]{Kutas2019}, attributed there to Castel: under GRH, a nonzero
isotropic vector for an indefinite rational quadratic form in dimension at
least five can be found in randomized polynomial time. Castel's published
paper \cite[Theorem~2.20 and Section~2F]{Castel2013} supplies the algorithm
and its correctness; it explicitly defers the complete complexity analysis
to his thesis. We prove the qualitative polynomial-time conclusion, without
asserting the original algorithm's more specific operation count or its
particular prime-search range.

\begin{theorem}[Castel's conclusion without GRH]
\label{thm:castel-isotropy}
Given an indefinite symmetric rational matrix $Q$ of dimension
$n\geq5$, there is a Las Vegas algorithm that returns a nonzero rational
vector $v$ with $v^{\mathsf T}Qv=0$, in expected time polynomial in the binary
input length. The algorithm uses no integer-factorization oracle. Clearing
denominators gives a nonzero integral solution when desired.
\end{theorem}

We use three established algorithmic inputs with their precise scopes.
Integer Hermite and Smith normal forms, including their transformation
matrices, can be computed in polynomial time. Simon's indefinite LLL
algorithm \cite{Simon2005} either returns an isotropic vector or an
integrally equivalent reduced matrix, in polynomial time. Finally, two
unconditional randomized algorithms are used: the
Adleman--Estes--McCurley algorithm \cite{AEM1987} solves
$x^2+ay^2=b\pmod m$ for odd $m$ and $(ab,m)=1$ without knowing the
factorization of $m$ (a returned answer is checked and failures are
repeated); Simon's algorithm \cite[Algorithms~5--7]{Simon2006}
finds a rational isotropic vector in fixed dimension at least four when one
exists and the factorization of the determinant is supplied. The latter
input is also recorded as \cite[Fact~1]{Kutas2019}; its required
factorization here will always be the already known factorization of
$\pm2p$. Simon's use of quadratic $2$-class groups is through the
unconditional randomized algorithm of Bosma--Stevenhagen
\cite{BosmaStevenhagen1996}; see especially its Section~6, where the
remaining random step is finding quadratic nonresidues modulo known primes.
The Adleman--Estes--McCurley input is important: the older
Pollard--Schnorr implementation cited by Castel was originally analyzed
conditionally, and is not silently being treated as unconditional here.

\begin{lemma}[Controlled minimization]
\label{lem:castel-minimization}
For an integral nondegenerate indefinite matrix $Q$ of size five one can,
in expected polynomial time, either find an isotropic vector or construct
an integral matrix $A$ rationally similar to $Q$ such that
\[
 \det A\ne0,\qquad \det A\text{ is odd},\qquad
 \operatorname{SNF}(A)=\operatorname{diag}(D,1,1,1,1),
 \quad D=|\det A|.
\]
The matrix $A$ and the accumulated similarity transformation have bit
length polynomial in that of $Q$, and $D\leq|\det Q|$.
\end{lemma}

\begin{proof}
Write the positive Smith invariants in the order
$d_5\mid d_4\mid\cdots\mid d_1$. If $d_2>1$, let $k\geq2$ be the largest
index with $d_k>1$. The Smith transformation gives an integral unimodular
change of variables after which the first $k$ rows and columns of $Q$ are
divisible by any chosen divisor $m>1$ of $d_k$.
For $k\geq3$ choose $m=d_k$, multiply the last $5-k$ basis vectors by
$m$, and divide the form by $m$. The resulting matrix is integral and its
determinant is the previous determinant times $m^{5-2k}$, hence decreases
in absolute value.

For $k=2$, take $m=2$ if $d_2$ is even and otherwise take $m=d_2$.
The bottom $3\times3$ block is nonsingular modulo every prime dividing
$m$. If $m=2$, its associated quadratic function on $\mathbb F_2^3$ is
linear, so a nonzero zero is found by linear algebra. For odd $m$, perform
Gram--Schmidt over $\mathbb Z/m\mathbb Z$. A nonzero nonunit encountered
in testing a pivot yields a proper divisor of $m$ by a gcd; replace $m$
by this divisor and restart. Each such replacement at least halves $m$.
If all the tested norms vanish, testing sums of basis vectors and the
invertibility of $2$ supplies a nonzero pivot or a proper divisor. Thus
one obtains, after polynomially many operations, a diagonal ternary form
with unit coefficients $a,b,c$ modulo the current odd $m$.
The Adleman--Estes--McCurley algorithm solves
\[
 x^2+(b/a)y^2=-c/a\pmod m.
\]
Consequently the ternary block has a zero represented by a vector primitive
modulo $m$. Lift it to an integral vector and divide by the gcd of its
coordinates; that gcd is coprime to $m$, so the resulting primitive vector
is still a zero modulo $m$. Complete it to an integral unimodular basis
of the ternary block. In the resulting full matrix, the first two rows
are divisible by $m$ and the third diagonal entry is divisible by $m$.
Multiplying the last two basis vectors by $m$ and dividing the form by
$m$ therefore gives an integral matrix and divides its determinant by
$m$. This is the minimization behind \cite[Section~2B]{Castel2013}, with
the unconditional bivariate-congruence routine specified explicitly.

After each minimization, apply indefinite LLL with a fixed parameter
$1/4<\delta<1$, stopping if it finds an isotropic vector. Otherwise write
the Gram--Schmidt diagonal entries as $B_1,\ldots,B_5$. They satisfy
$|B_i|\leq\gamma|B_{i+1}|$, where $\gamma=(\delta-1/4)^{-1}$, and the
size-reduction coefficients have absolute value at most $1/2$. Every
leading principal minor is a nonzero integer. In particular
\[
 |B_5|=\frac{|\det Q|}{|\det Q_{[1,4]}|}\leq |\det Q|,
 \qquad |B_i|\leq\gamma^{5-i}|\det Q|.
\]
The entries of the reduced matrix are therefore at most $C|\det Q|$ in
absolute value, with an absolute constant $C$. There are at most
$\log_2|\det Q|$ determinant-decreasing steps. Smith transformations,
the modular operations, and the individual LLL transformations have
polynomial bit complexity; multiplication of this polynomial number of
transformation matrices preserves a polynomial bound on their accumulated
bit length. We have thus reached $d_2=1$ with controlled size.

It remains to remove the even part. Let $v=v_2(\det Q)$ for the present
matrix. A Smith change of basis makes the first row and column divisible
by $2^v$. Dividing the first basis vector by $2^{\lfloor v/2\rfloor}$
keeps the matrix integral and leaves determinant valuation zero or one.
The other four-dimensional block stays invertible modulo $2$, and the
rank modulo every odd prime is unchanged. If the valuation is one, write
the matrix modulo the first row and column as a nonsingular symmetric
bilinear form $B$ on $\mathbb F_2^4$. Such a form has a two-dimensional
totally isotropic subspace. For an alternating form this is a Lagrangian
plane. Otherwise let $w$ be the characteristic vector defined by
$B(x,x)=B(x,w)$. Orthogonal decomposition into one-dimensional forms and
alternating planes shows $B(w,w)=0$ because the dimension is even; choose
$v\in w^\perp$ outside $\langle w\rangle$, and use
$\langle w,v\rangle$. A basis of this plane can be put in the first two
positions of the four-dimensional block by an integral unimodular lift
of a matrix in $\mathrm{GL}_4(\mathbb F_2)$.
Now multiply the entire form by $2$ and divide its first three basis
vectors by $2$. The first row of the previous matrix was even, and the
chosen $2\times2$ block was zero modulo $2$, so all the resulting entries
are integral. The determinant is divided by $2$ and is odd. The rank at
every odd prime is unchanged, hence the new matrix still has $d_2=1$.
All these additional operations have polynomial bit complexity.
\end{proof}

\begin{lemma}[Prime completion]
\label{lem:castel-prime-completion}
Let $A$ satisfy Lemma~\ref{lem:castel-minimization}, with $D>1$. For either
specified sign $\sigma\in\{1,-1\}$, one can find, in expected polynomial
time, an integral column $u$ and an odd prime $p\nmid D$ such that
\[
 u^{\mathsf T}\operatorname{adj}(A)u\equiv 2\sigma p\pmod D,
 \qquad p\leq C_0D^{32},
\]
where $C_0$ is an absolute effectively computable integer. The expected
number of trials is $O(\log(2D))$; the algorithm does not factor $D$.
\end{lemma}

\begin{proof}
Put $G=(\mathbb Z/D\mathbb Z)^\times$ and $H=G^2$. For each $\ell^e\Vert D$,
local congruence diagonalization over $\mathbb Z/\ell^e\mathbb Z$ puts $A$
in the form $\operatorname{diag}(a_1,a_2,a_3,a_4,0)$, with all $a_i$ units.
Here $\ell$ is odd and the Smith hypothesis gives rank four at $\ell$.
It follows that the adjugate quadratic form is a unit times the square
of a primitive linear form. Its unit values constitute a single square
coset locally; every such value has exactly $2\ell^{4e}$ preimages.
Chinese remaindering shows that the unit values of
$u^{\mathsf T}\operatorname{adj}(A)u$ form one coset $aH$, and every one
has exactly $hD^4$ preimages modulo $D$, where
\[
 h=[G:H]=2^{\omega(D)}\leq D.
\]
This factorization is used only to prove the distribution statement.
The algorithm itself samples $u$ directly modulo $D$.

Let $cH=(\sigma/2)aH$. Orthogonality on $G/H$ and the prime-counting
estimate from the $7/8$ Dirichlet strip give, uniformly in this coset,
\[
 \pi_{cH}(X)=\frac{\operatorname{Li}(X)}{h}
       +O\bigl(X^{7/8}\log^2(DX)\bigr).
\]
Indeed all characters of $G/H$ are quadratic Dirichlet characters
modulo $D$; the factor $1/h$ in the orthogonality formula cancels the
number of error terms. Induced characters differ from their primitive
characters only at primes dividing $D$, which is harmless in the stated
error. The principal term uses the same zeta zero-free input.
Taking $K=C_0D^{31}$ and $X=DK=C_0D^{32}$, with $C_0$ large enough,
gives at least $X/(3h\log X)$ odd primes in $cH$. To see uniformity, the
ratio of the error to $X/(h\log X)$ is at most
$C D X^{-1/8}\log^3(DX)$; this is made uniformly small for $D\geq3$ by
one effective choice of $C_0$.

One trial samples $u\in\{0,\ldots,D-1\}^5$ uniformly, computes
$b=u^{\mathsf T}\operatorname{adj}(A)u\bmod D$, and discards the trial
if $(b,D)>1$. Otherwise let $r\in\{1,\ldots,D\}$ represent
$(\sigma/2)b\bmod D$, choose $j\in\{0,\ldots,K-1\}$ uniformly, and test
$p=r+jD$ for being an odd prime. An exact polynomial-time primality
test makes this a Las Vegas procedure. Each admissible prime appears in
a trial with probability exactly $h/(DK)=h/X$: its corresponding value
$b$ has $hD^4$ preimages among the $D^5$ possible columns, and $j$ has
$K$ possibilities. Thus the success probability is at least
$1/(3\log X)$. All sampled numbers have $O(\log(2D))$ bits, and the
adjugate and its value are computed with polynomially many bit
operations. This proves the assertion.
\end{proof}

\begin{proof}[Proof of the theorem]
If $Q$ is singular, a nonzero vector in its rational kernel already
solves the problem and is found by linear algebra. Otherwise rational
diagonalization first reduces the problem to a five-dimensional
indefinite subform: choose five nonzero diagonal coefficients including
both signs. Clear denominators, and apply
Lemma~\ref{lem:castel-minimization}. Unless a solution has already been
found, let $A$ be its output and write $\Delta=\det A$.
Choose $\sigma$ so that adding a one-dimensional form of sign
$-\sigma/\Delta$ makes both signature indices at least two. Explicitly,
if the negative index is one take $\sigma=\operatorname{sign}(\Delta)$;
if the positive index is one take the opposite sign; if both indices
are already at least two either sign works.

Use Lemma~\ref{lem:castel-prime-completion} and set
\[
 z=\frac{u^{\mathsf T}\operatorname{adj}(A)u-2\sigma p}{\Delta},
 \qquad F=\begin{pmatrix}A&u\\u^{\mathsf T}&z\end{pmatrix}.
\]
This is integral, $\det F=-2\sigma p$, and its Schur complement is
$-2\sigma p/\Delta$, so its two signature indices are at least two.
If $D=1$, simply use $u=0$, $p=3$ and the same formula for $z$.
Every entry has polynomial bit length and the full factorization of
$\det F$ is known. Meyer's theorem gives isotropy, and Simon's
unconditional algorithm with this supplied factorization constructs a
primitive isotropic vector $t$.

Complete $t$ to a unimodular integral basis. If the gcd of the entries
in its first Gram row is $a$, then $a^2\mid\det F$: the top-left entry
is zero, and each term in the determinant uses one further first-row
entry and one further first-column entry. Since $\det F=\pm2p$ is
squarefree, $a=1$. Euclidean operations on the remaining basis vectors
therefore make the first row $(0,1,0,0,0,0)$. Subtracting multiples of
the first vector from the others and reducing the second diagonal
entry modulo $2$ splits off a block
\[
 \begin{pmatrix}0&1\\1&\varepsilon\end{pmatrix},\qquad
 \varepsilon\in\{0,1\}.
\]
The complementary integral form $F_4$ has determinant $\pm2p$ and is
indefinite. It is locally isotropic at every odd prime not dividing
$2p$: its nonsingular reduction in four variables has a nonzero zero,
which lifts. At $2$ and $p$ its determinant is nonsquare because the
valuation is one; an anisotropic four-dimensional quadratic form over
a nonarchimedean local field of characteristic zero has square
determinant. Thus it is isotropic at these places as well, and it is
isotropic over $\mathbb R$. The Hasse--Minkowski theorem proves its
rational isotropy. Simon's algorithm, still with only the known
factorization $2p$, constructs a second primitive isotropic vector.
The same gcd and splitting argument gives a second hyperbolic plane.
All these fixed-dimensional linear operations have polynomial bit
complexity.

The two first vectors of these planes span a two-dimensional totally
isotropic rational subspace $W$ for $F$. Its intersection with the
hyperplane having last coordinate zero is nonzero. Computing that
intersection gives a nonzero isotropic vector for $A$. Undo the stored
similarities and the initial restriction to obtain the required vector
for $Q$. The only potentially unbounded repetitions were the
unconditional bivariate-congruence calls and the prime-completion
trials, both of expected polynomial length, so the total expected bit
complexity is polynomial.
\end{proof}

\section{Finding prime values of positive definite quadratic forms}
\label{sec:prime-quadratic-values}

An integral quadratic form in $r$ variables is a homogeneous polynomial
$F\in\mathbb Z[X_1,\ldots,X_r]$ of degree two. It is primitive when the
gcd of its coefficients is one, equivalently the gcd of its values on
$\mathbb Z^r$ is one. Write $F(X)=X^tGX$, with half-integral symmetric
Gram matrix $G$, and use the discriminant convention
\[
 \operatorname{disc}(F)=
 \begin{cases}
 (-1)^{r/2}\det(2G),&r\text{ even},\\
 \tfrac12(-1)^{(r+1)/2}\det(2G),&r\text{ odd}.
 \end{cases}
\]
The input length is the total binary length of the coefficients.

\begin{theorem}[Wesolowski's prime-value algorithm]
\label{thm:quadratic-prime-values}
There is an effective absolute constant $c>0$ and a Las Vegas
algorithm with the following property. Given a primitive, positive
definite, integral quadratic form $F$ of rank $r\geq2$, and an integer
\[
 \rho>\bigl(2^{r^2}|\operatorname{disc}(F)|\bigr)^c,
\]
the algorithm returns $v\in\mathbb Z^r$ such that $F(v)$ is prime and
$\rho<F(v)\leq\rho^2$. Its expected bit complexity is polynomial in
the input length of $F$ and $\log\rho$. It requires no integer
factorization oracle.
\end{theorem}

This is the prime-value conclusion of
\cite[Proposition~III.1]{Wesolowski}, also stated as Proposition~3.6
in the full version. The constant $c$ there is unspecified, so
enlarging this absolute constant preserves the published conclusion.
Rank at least two is the domain of the source's binary-form reduction;
rank one must be excluded, since the primitive form $X^2$ has no
prime values. The sharper bounds $|\operatorname{disc}(F)|^{1+\epsilon}$
in other propositions of that paper are not asserted here.

\begin{proof}
We first supply a uniform lower bound for primes represented by a
binary quadratic form. This uses a published unconditional
Chebotarev theorem, together with the present Dirichlet input only
to remove its possible exceptional real zero.

Let $g(X,Y)=aX^2+bXY+cY^2$ be a primitive positive definite integral
binary form of discriminant $D=b^2-4ac<0$, and write $D=f^2D_K$,
where $D_K$ is the fundamental discriminant of
$K=\mathbb Q(\sqrt D)$. Let $L$ be the ring class field of the order
$\mathbb Z+f\mathcal O_K$. Class field theory identifies
\[
 H=\operatorname{Gal}(L/K)\simeq\operatorname{Pic}(\mathbb Z+f\mathcal O_K),
 \qquad |H|=h(D).
\]
Moreover $L/\mathbb Q$ is Galois, with generalized dihedral group:
complex conjugation acts on $H$ by inversion. The Artin element
$\sigma\in H$ of the class corresponding to $g$ has conjugacy class
$C=\{\sigma,\sigma^{-1}\}$ in
$\operatorname{Gal}(L/\mathbb Q)$, with repetitions removed.
A rational prime $p\nmid D$ with Artin class $C$ is represented by
$g$. In particular $|C|\geq1$ and
$[L:\mathbb Q]=2h(D)$.

For a Hecke character $\chi\in\widehat H$, its conductor divides
$f\mathcal O_K$. Thus the conductor parameter
\[
 Q_L=\max_{\chi\in\widehat H}\mathrm N_{K/\mathbb Q}\mathfrak f_\chi
 \quad\text{satisfies}\quad
 |D_K|Q_L\leq |D_K|f^2=|D|.
\]
This parameter, rather than the discriminant of the potentially
large ring class field $L$, is essential.

We recall precisely the consequence of the unconditional
\cite[Theorem~1.4]{ThornerZamanUnified} that we use. There are
effective absolute constants $c_2,c_3>0$ for which, when
$x\geq(4|D_K|Q_L)^{c_2}$,
\begin{align*}
 \pi_C(x)&=\frac{|C|}{2h(D)}
 \bigl(\operatorname{Li}(x)-\theta_1\operatorname{Li}(x^{\beta_1})\bigr)
 (1+O(E(x))),\\
 E(x)&=\exp\left(-\frac{c_3\log x}{\log(4|D_K|Q_L)}\right)
       +\exp\left(-\sqrt{c_3\log x/2}\right).
\end{align*}
Here $\pi_C$ counts unramified rational primes of class $C$, the
implied constant is effective and absolute, and the term involving
$\beta_1$ is omitted unless a real character of $H$ has a real zero
\[
 \beta_1=1-\frac{\lambda_1}{\log(4|D_K|Q_L)},\qquad
                  0<\lambda_1<\tfrac18.
\]
The field degree in the exponential error is $[K:\mathbb Q]=2$;
there is no dependence on $h(D)$ in that error.

Such an exceptional zero is absent here. For the trivial character,
the Hecke $L$-function is $\zeta_K(s)=\zeta(s)L(s,\chi_{D_K})$.
For a nontrivial real character $\chi$ of $H$, let
$M=L^{\ker\chi}$. The inversion action becomes trivial on
$H/\ker\chi\simeq C_2$, so $M/\mathbb Q$ is biquadratic.
If its other two quadratic fields have primitive Dirichlet
characters $\chi_1,\chi_2$, the zeta factorizations give
\[
 L_K(s,\chi)=\frac{\zeta_M(s)}{\zeta_K(s)}
                         =L(s,\chi_1)L(s,\chi_2).
\]
Theorem~\ref{thm:input} excludes zeros of these factors for
$\Re s>7/8$. The possible $\beta_1$ lies in this region, since
$4|D_K|Q_L\geq12$ and hence $\log(4|D_K|Q_L)>1$.
This removes the exceptional term without assuming a zero-free
half-plane for arbitrary Hecke characters.

Choose an effective absolute $A$ sufficiently large that the
relative error above is at most $1/2$ for all
$x\geq(4|D|)^A$. Increase $A$ further to absorb the at most
$\omega(|D|)\ll\log(3|D|)$ primes dividing $D$, using the
class-number upper bound below. If $\pi_g(x)$ counts primes
represented by $g$, we obtain
\begin{equation}\label{eq:quadratic-prime-density}
 \pi_g(x)\geq\pi_C(x)-\omega(|D|)
             \geq\frac{\operatorname{Li}(x)}{8h(D)}
             \gg\frac{x}{h(D)\log x}
       \qquad (x\geq(4|D|)^A).
\end{equation}
We also use the standard unconditional class-number upper bound
\begin{equation}\label{eq:quadratic-class-upper}
 h(D)\ll\sqrt{|D|}\log(3|D|).
\end{equation}
For clarity this is uniform for nonfundamental $D$: the order class
number formula multiplies the maximal-order value by
$f\prod_{p\mid f}(1-\chi_{D_K}(p)/p)$, divided by the unit index.
The usual upper bound for the imprimitive Dirichlet value
$L(1,\chi_D)$ is $O(\log(3|D|))$; the order class-number formula
then gives \eqref{eq:quadratic-class-upper}. It is also the
unconditional estimate used in the source's prime-sampling proof.

We next turn the lower density into an exact discrete sampling
algorithm. Apply Gauss reduction to $g$, recording its integral
change of variables. We may assume $|b|\leq a\leq c$; hence
\[
 3ac\leq |D|\leq4ac,\qquad
 g(x,y)\geq\tfrac12(ax^2+cy^2),\qquad c\leq|D|.
\]
Set $R=\rho^2$ and sample integer pairs uniformly from the rectangle
\[
 |x|\leq\left\lceil\sqrt{2R/a}\right\rceil,
 \qquad
 |y|\leq\left\lceil\sqrt{2R/c}\right\rceil.
\]
Integer square-root computations determine the endpoints exactly.
Uniform integer sampling by binary rejection has constant expected
overhead. If $R\geq|D|$, this rectangle contains
$O(R/\sqrt{|D|})$ lattice points and contains every integral pair
with $g(x,y)\leq R$.

Choose an absolute $A_1$ sufficiently large, and suppose
$\rho>(4|D|)^{A_1}$. Equation
\eqref{eq:quadratic-prime-density}, with $x=\rho^2$, and the trivial
bound of $\rho$ for the number of primes at most $\rho$, imply
\[
 \#\{p:\rho<p\leq\rho^2,\ p\text{ prime and represented by }g\}
          \gg\frac{\rho^2}{h(D)\log\rho}.
\]
Indeed the subtracted $\rho$ is absorbed uniformly by this main
term, by \eqref{eq:quadratic-class-upper} and the choice of $A_1$.
Each such prime supplies at least one pair in the sampling rectangle.
Therefore the probability that a trial gives a prime value in the
desired interval is at least
\[
 \gg\frac{\sqrt{|D|}}{h(D)\log\rho}
 \gg\frac1{\log(3|D|)\log\rho}.
\]
Evaluate $g(x,y)$, check the interval, and apply deterministic
primality testing. Repeat until successful. Each trial has bit
complexity polynomial in $\operatorname{length}(g)+\log\rho$,
and the expected number of trials is polynomial in these quantities.
All outputs are checked; no continuous sampling or real-arithmetic
oracle is used.

Finally we reduce arbitrary rank $r\geq2$ to the binary case while
controlling its discriminant. Put
$\Delta=|\operatorname{disc}(F)|$ and $B=2^{r^2}\Delta$.
The unconditional LLL algorithm supplies an integral basis
$b_1,\ldots,b_r$ with
\[
 \prod_{i=1}^rF(b_i)\leq2^{r(r-1)/2}\det G
              \leq2^{r(r-1)/2}\Delta=:U.
\]
Every $F(b_i)$ is a positive integer, so each is at most $U$.
Let $u=b_1$ and $m=F(u)$. If $m=1$, set $v=b_2$; then
$g(X,Y)=F(Xu+Yv)$ is positive definite and primitive.

Suppose $m>1$. Sample $v=\sum_i v_ib_i$, with the $v_i$ independent
and uniform in $\{0,\ldots,m-1\}$, until
$\gcd(m,F(v))=1$. This uses gcd computations, not factorization.
Here is a uniform bound for its success probability. For every odd
prime $p\mid m$, primitivity of $F$ implies that its reduction is
a nonzero polynomial over $\mathbb F_p$ of degree two. At most
$2p^{r-1}$ vectors are zeros, by the elementary polynomial root bound.
For $p=2$, its restriction to $\mathbb F_2^r$ is a nonzero multilinear
polynomial of degree at most two: diagonal terms become linear, and
distinct cross terms remain distinct. Such a polynomial is nonzero
on at least one quarter of the vectors. To see this, if a quadratic
coefficient occurs, fix all other variables and examine its two
variables; their product coefficient is nonzero, so at least one of
the four values is nonzero. If no quadratic coefficient occurs, a
nonzero linear or constant polynomial has the same lower bound.
The Chinese remainder theorem makes the conditions for different
$p\mid m$ independent.

If $p_1<\cdots<p_t$ are the odd prime divisors of $m$, then
$p_i\geq i+2$ and $t\leq\log_2m$. Consequently
\[
 \mathbb P(\gcd(m,F(v))=1)
 \geq\frac14\prod_{i=1}^t(1-2/p_i)
 \geq\frac14\prod_{i=1}^t\frac{i}{i+2}
 =\frac1{2(t+1)(t+2)}.
\]
The expected number of trials is thus $O((1+\log m)^2)$.
On success $u,v$ are linearly independent: since $u$ is a basis
vector, an integral $v$ in its rational span would be an integral
multiple of $u$ and would have $m\mid F(v)$.
Moreover $\gcd(F(u),F(v))=1$ makes the binary restriction primitive.

The Cauchy--Schwarz inequality for the positive form gives
\[
 F(v)\leq\left(\sum_i|v_i|\sqrt{F(b_i)}\right)^2
             \leq r^2m^2U.
\]
For the binary discriminant $D_g$ this yields
\[
 |D_g|\leq4F(u)F(v)\leq4r^2U^4\leq B^5.
\]
The same bound holds in the case $m=1$.
All basis transformations and constructed vectors have polynomial
bit length; LLL, gcd, evaluation, and reduction have polynomial bit
complexity. Taking the absolute constant $c$ in the theorem large
enough ensures that $\rho>B^c$ implies
$\rho>(4|D_g|)^{A_1}$. Apply the binary algorithm to $g$ and return
$xu+yv$ when it produces the pair $(x,y)$. The two successive random
searches have polynomial expected running time, and primality and
the required interval are checked exactly. This proves the theorem.
\end{proof}

The ring class field is used only in the proof of prime density; the
algorithm never constructs it, its class group, or the factorization
of its discriminant. The full isogeny-path equivalence in
\cite{Wesolowski} also uses class-group generation by small prime
ideals over varying quadratic fields. That additional assertion is
not proved by this argument and is not included in the theorem.

% Wesolowski: B. Wesolowski, The supersingular isogeny path and
% endomorphism ring problems are equivalent, FOCS2021,1100--1111,
% DOI10.1109/FOCS52979.2021.00109 (proceedings published2022).
% Final published PDF:
% https://ieee-focs.org/FOCS-2021-Papers/pdfs/FOCS2021-5stbVHiOp5jRHWlSl41FkR/205500b100/205500b100.pdf
% Full version: https://arxiv.org/abs/2111.01481
% ThornerZamanUnified: J. Thorner and A. Zaman, A unified and improved
% Chebotarev density theorem, Algebra Number Theory13(2019),1039--1068,
% DOI10.2140/ant.2019.13.1039, Theorem1.4.
% https://msp.org/ant/2019/13-5/ant-v13-n5-p02-s.pdf

\section{Worst-case to average-case reductions to supersingular maximal orders}
\label{sec:average-maxorder}

For a prime $p>3$, let $B_{p,\infty}$ be the rational quaternion algebra
ramified precisely at $p$ and at the real place. All endomorphisms below
are geometric endomorphisms. The problem $\mathsf{MaxOrder}$ takes a
supersingular elliptic curve $E/\mathbb F_{p^2}$ and asks for a maximal
order in a presented copy of $B_{p,\infty}$ isomorphic to
$\operatorname{End}(E)$. The problem $\mathsf{MOER}$ additionally asks
for an explicit isomorphism with $\operatorname{End}(E)$, represented by
four efficiently evaluable endomorphisms and their corresponding
quaternions. An efficient representation of an isogeny permits its
evaluation in time polynomial in the input length, the logarithm of its
degree, and the degree of the field containing the evaluation point.

The stationary distribution on geometric supersingular isomorphism
classes is
\[
 \mu_p(E)=\frac{24}{(p-1)\#\operatorname{Aut}(E)}.
\]
It has total variation distance $O(p^{-1})$ from the uniform distribution.
As in the source, an average-case reduction permits a query distribution
at negligible statistical distance from $\mu_p$; here $p^{-1}$ is
negligible in the bit length $\log p$.

\begin{theorem}[Herl\'edan Le Merdy--Wesolowski's maximal-order reduction]
\label{thm:average-maxorder}
For every prime $p>3$, the worst-case $\mathsf{MOER}$ problem reduces
to the average-case $\mathsf{MaxOrder}$ problem in probabilistic
polynomial time. The query consists of one curve whose distribution
is at total variation distance at most $p^{-1}$ from $\mu_p$.
The reduction's running time is polynomial in the input and oracle-output
lengths. It applies to arbitrary valid maximal-order outputs, including
outputs in different presented copies of $B_{p,\infty}$.
\end{theorem}

This is the entire conclusion of \cite[Section~7.3]{MerdyWesolowskiTCC},
Proposition~17 in the authors' current minor revision of their TCC~2025
paper (Proposition~7.5 in the earlier version). The source assumes GRH
when $p\equiv1\pmod8$. We give the missing uniform construction and
then detail the unconditional remainder of the reduction.

\begin{proof}
We first construct, without an oracle, one curve $E_0$ with a known
solution of $\mathsf{MOER}$ in time polynomial in $\log p$.
For $p\not\equiv1\pmod8$, this is already unconditional in
\cite[Propositions~1 and~3]{EHLMP2018}. Suppose therefore that
$p\equiv1\pmod8$. Set $\chi_1=\chi_{-4}$ and $\chi_2=\chi_p$.
For an odd prime $q\ne p$, the desired conditions are
\begin{equation}\label{eq:special-auxiliary-prime}
 q\equiv3\pmod4,\qquad (p/q)=-1.
\end{equation}
The three characters $\chi_1,\chi_2,\chi_1\chi_2$ are nonprincipal.
Apply \eqref{eq:smoothed} to them, together with its principal-character
version. The indicator of their simultaneous values $(-1,-1)$ is
$\tfrac14(1-\chi_1)(1-\chi_2)$ on integers coprime to $4p$. Consequently
\[
 \sum_{\substack{n\le x\,,\ (n,4p)=1\\
             \chi_1(n)=\chi_2(n)=-1}}
       \Lambda(n)(1-n/x)
 =\frac{x}{8}
  +O\bigl(x^{7/8}\log(3p)+\log(3p)\log(2x)
                 +x^{7/8}\log^2(2x)\bigr).
\]
The contribution of prime powers of exponent at least two is
$O(\sqrt{x}\log^2(2x))$. Choosing
$x=C\log^8(3p)$ with a sufficiently large effective absolute $C$
therefore proves the existence of a prime satisfying
\eqref{eq:special-auxiliary-prime} and $q\le C\log^8(3p)$.
The finitely many small $p$ are absorbed effectively, as in
Lemma~\ref{lem:witness}. Testing successive primes and Legendre symbols
finds such a $q$ in deterministic polynomial time in $\log p$.

We spell out why this weaker auxiliary-prime bound suffices for the
special-curve construction of \cite[Proposition~3]{EHLMP2018}.
Put $K=\mathbb Q(\sqrt{-q})$ and $R=\mathcal O_K$.
Quadratic reciprocity gives $(-q/p)=-1$, so $p$ is inert in $K$.
Compute the Hilbert class polynomial $H_{-q}$ by the classical complex
CM algorithm. This is an unconditional computation in time polynomial
in $q$: reduced forms can be enumerated in polynomial time, the degree
is at most $q$, and the coefficient heights and the required precision
are polynomially bounded in $q$. In particular, this cost is polynomial
in $\log p$. CM reduction shows that its roots modulo $p$ are
supersingular and lie in $\mathbb F_{p^2}$. Genus theory gives
$h(-q)$ odd, since $-q$ has just one prime discriminant. Frobenius acts
on the roots, counted with multiplicity, in orbits of sizes one or two;
there is therefore a root $j_0\in\mathbb F_p$. This argument does not
require the reductions of distinct complex singular moduli to remain
distinct. Find such a root by finite-field polynomial factorization,
and choose a curve $E_0/\mathbb F_p$ with invariant $j_0$.

The geometric endomorphism ring of $E_0$ contains an element $\alpha$
with $\alpha^2=[-q]$. We can find it as follows. Enumerate the $q+1$
cyclic subgroups of $E_0[q]$, form their quotients by V\'elu's formulas,
and, whenever the quotient is isomorphic to $E_0$, enumerate the
isomorphisms and test the identity $\alpha^2=[-q]$.
Every degree-$q$ isogeny is separable and has such a kernel because
$q\ne p$. Thus the CM endomorphism occurs in this list. The torsion
and the required isomorphisms are defined over extensions of degree
polynomial in $q$ (one may use the bound $\#\operatorname{GL}_2(\mathbb F_q)$
for the torsion and a further factor at most six). Rational maps of
degree $q$ and their compositions can be computed and compared in
time polynomial in $q$ and $\log p$. This gives $\alpha$ with the
claimed running time.

Write $\pi$ for the $p$-power Frobenius of $E_0$. Since $E_0$ is
supersingular over $\mathbb F_p$ and $p>3$, $\pi^2=[-p]$.
Put $t=\operatorname{tr}(\alpha\pi)$.
Both $\alpha\pi$ and its dual are inseparable, so their sum $[t]$
has zero differential and $p\mid t$. Moreover
$\alpha\pi+\pi\alpha=[t]$. If $p>4q$, the degree--trace inequality
$|t|\le2\sqrt{pq}<p$ gives $t=0$ immediately. If $p\le4q$, compute
\[
 t=1+pq-\deg(1-\alpha\pi)
\]
by rational-map arithmetic: the maps involved have degree $O(q^2)$,
so this computation is polynomial in $q$ and $\log p$.
The quadratic fields $\mathbb Q(\alpha)$ and $\mathbb Q(\pi)$ are
distinct because $p$ and $q$ are distinct primes. Hence $\alpha$
and $\pi$ do not commute, and the strict degree--trace inequality
gives $\delta:=4pq-t^2>0$. Consequently
\[
 S=\mathbb Z\langle1,\alpha,\pi,\alpha\pi\rangle
       \subset\operatorname{End}(E_0)
\]
is an order of discriminant $\delta^2$. The endomorphism ring is
maximal, of discriminant $p^2$, so its index over $S$ is exactly
\[
 m=\frac{\delta}{p}=4q-\frac{t^2}{p},\qquad 1\le m\le4q.
\]
Since $p\mid t$ and $q\ne p$, we have $m\equiv4q\pmod p$,
and therefore $p\nmid m$.
In particular,
\[
 S\subset\operatorname{End}(E_0)\subset m^{-1}S.
\]
Enumerate the $m^4$ residue classes in $m^{-1}S/S$.
For a representative $\gamma/m$, test whether $\gamma$ kills
$E_0[m]$. Since $p\nmid m$, this is equivalent to $\gamma/m$
being an endomorphism. The same polynomial-degree torsion construction
makes all these tests effective in time polynomial in $q$ and
$\log p$. Equivalently one can use the unconditional
\textsc{IsogenyDivision} algorithm of
\cite[Proposition~3]{MerdyWesolowskiTCC}.
Hermite normal form applied to the accepted representatives and $S$
now gives a basis of the full endomorphism ring and its explicit
quaternionic isomorphism. If a Hilbert-symbol presentation is desired,
the elements $\alpha$ and $j'=2q\pi+t\alpha$ satisfy
\[
 \alpha^2=-q,\qquad (j')^2=-q\delta,\qquad
 \alpha j'=-j'\alpha.
\]
The unconditional \textsc{IsogenyDivision} algorithm
\cite[Proposition~3]{MerdyWesolowskiTCC} supplies efficient evaluators
for the accepted fractions. Here division can also be implemented by
lifting an evaluation point under $[m]$ and evaluating $\gamma$;
the result is independent of the lift and all necessary field degrees
are polynomial in $q$.
This proves the required special-curve construction.

We now follow the reduction in \cite[Section~7.3]{MerdyWesolowskiTCC}.
Given the input curve $E$, choose a squarefree product $N$ of successive
primes at least $17$, omitting $p$, until $N\ge p^8$, and take a random
$N$-isogeny walk $\eta:E\to E'$. The prime number theorem shows that
the largest prime used is $O(\log p)$, while $\log N=O(\log p)$.
The normalized $\ell$-walk operators have nonconstant eigenvalues of
absolute value at most $2\sqrt\ell/(\ell+1)$; this is the unconditional
Ramanujan estimate, with stationary weights $\mu_p$.
For $\ell\ge17$, this bound is at most $\ell^{-1/4}$.
The weighted Cauchy--Schwarz inequality therefore bounds the total
variation distance from $\mu_p$ after this walk by
$\sqrt p\,N^{-1/4}\le p^{-3/2}<p^{-1}$.
This also gives a direct quantitative version of the source's
Proposition~5 and Corollary~1. The walk and its dual have efficient
representations of polynomial length.

Query the average-case oracle on $E'$ and let $O'$ be a valid answer.
The unconditional change-of-quaternion-model algorithm
\cite[Proposition~1]{MerdyWesolowskiTCC} puts $O'$ in the algebra
containing the known order $O_0=\operatorname{End}(E_0)$.
Compute a connecting left $O_0$-ideal $I$ with right order $O'$,
and scale it by a rational integer so that $I\subseteq O_0$.
This is the unconditional lattice computation used in
\cite[Section~7.3]{MerdyWesolowskiTCC}, citing
Kirschmer--Voight's Algorithm~3.5. The unconditional
\textsc{IdealToIsogeny} algorithm
\cite[Proposition~4]{MerdyWesolowskiTCC} computes the associated
isogeny $\psi:E_0\to F$, and identifies the right order with
$\operatorname{End}(F)$. This algorithm allows arbitrary ideal norm;
no powersmooth-ideal theorem is being invoked.

For completeness, the dictionary is transported explicitly as follows.
Put $m=\deg\psi=\operatorname{Nrd}(I)$. The inclusion
$mO_0\subseteq I$ and the identity $IO'\subseteq I$ imply
$m\beta\in O_0$ for every $\beta\in O'$.
Writing $\beta=\gamma/m$ with $\gamma\in O_0$, its corresponding
endomorphism is
\[
 \frac{\psi\,\gamma\,\widehat\psi}{m^2}.
\]
Unconditional isogeny division computes these maps from a basis of
$O'$. The Deuring correspondence says that isomorphic maximal orders
correspond to supersingular curves up to Frobenius conjugation.
Thus $F$ is isomorphic to $E'$ or to $(E')^{(p)}$. An isomorphism,
and if necessary the Frobenius isogeny, transports the dictionary to
$E'$; division by $p$ in the latter case is again covered by isogeny
division. In particular, all four generators of $\operatorname{End}(E')$
are now efficiently represented.

Finally recover the kernel ideal of $\widehat\eta:E'\to E$.
For each prime $\ell\mid N$, find its one-dimensional kernel inside
$E'[\ell]$. Evaluating the known endomorphism basis on a generator
of this kernel gives two linear equations modulo $\ell$; their
solutions give precisely the ideal of endomorphisms killing the
kernel. Coordinates in $E'[\ell]$ can be found by exhaustive search
since $\ell=O(\log p)$. Intersect these ideals over $\ell\mid N$.
Since $N$ is squarefree, the intersection is exactly the kernel ideal
of $\widehat\eta$. Its right order and the same transport formula,
applied once to $\widehat\eta$, produce a solution of
$\mathsf{MOER}$ for $E$. Computing the entire kernel ideal before
transport avoids any growth from repeatedly rebuilding evaluation
representations. Integer lattice operations, torsion computations,
and the two isogeny-division steps have polynomial input and output
lengths. This proves the stated reduction.
\end{proof}

Combining Theorem~\ref{thm:average-maxorder} with the unconditional
worst-case equivalences in \cite[Theorem~1]{MerdyWesolowskiTCC}
removes the second exceptional case in their Theorem~2: the target
may now be $\mathsf{MaxOrder}$, or its prescribed-model variant
$\mathsf{MaxOrder}_{\mathcal Q}$, for every $p$. As in the source,
reductions involving the latter variant retain oracle access to the
model-selection algorithm $\mathcal Q$. The remaining exception,
where the source problem is $\ell$-\textsf{IsogenyPath}, is not
removed by this argument: it prescribes a prime-power isogeny degree.

% Bibliography entries:
% \bibitem{MerdyWesolowskiTCC} A. Herl\'edan Le Merdy and B. Wesolowski,
% Unconditional foundations for supersingular isogeny-based cryptography,
% Theory of Cryptography--TCC 2025, LNCS 16270 (2026), 266--297,
% first online 3 December 2025. DOI:10.1007/978-3-032-12296-4_9.
% Author minor revision: arXiv:2502.17010v2, 2 February 2026.
% \bibitem{EHLMP2018} K. Eisentr\"ager, S. Hallgren, K. Lauter,
% T. Morrison, and C. Petit, Supersingular isogeny graphs and endomorphism
% rings: reductions and solutions, EUROCRYPT 2018, LNCS 10822,
% 329--368. DOI:10.1007/978-3-319-78372-7_11.

\begin{thebibliography}{99}
\raggedright
\bibitem{Castel2013}
P. Castel, \emph{Solving quadratic equations in dimension 5 or more without
factoring}, The Open Book Series \textbf{1} (2013), 213--233.
\href{https://doi.org/10.2140/obs.2013.1.213}{DOI:10.2140/obs.2013.1.213}.
\href{https://msp.org/obs/2013/1-1/obs-v1-n1-p11-s.pdf}{Publisher full text}.

\bibitem{Kutas2019}
P. Kutas, \emph{Splitting quaternion algebras over quadratic number fields},
Journal of Symbolic Computation \textbf{94} (2019), 173--182.
\href{https://doi.org/10.1016/j.jsc.2018.08.002}{DOI:10.1016/j.jsc.2018.08.002}.
\href{https://arxiv.org/abs/1606.01053v2}{Accepted author manuscript}.

\bibitem{AEM1987}
L. M. Adleman, D. R. Estes and K. S. McCurley,
\emph{Solving bivariate quadratic congruences in random polynomial time},
Mathematics of Computation \textbf{48} (1987), no.~177, 17--28.
\href{https://doi.org/10.1090/S0025-5718-1987-0866095-8}{DOI:10.1090/S0025-5718-1987-0866095-8}.

\bibitem{Simon2005}
D. Simon, \emph{Solving quadratic equations using reduced unimodular
quadratic forms}, Mathematics of Computation \textbf{74} (2005),
no.~251, 1531--1543.
\href{https://doi.org/10.1090/S0025-5718-05-01729-1}{DOI:10.1090/S0025-5718-05-01729-1}.

\bibitem{Simon2006}
D. Simon, \emph{Quadratic equations in dimensions 4, 5 and more},
preprint, 4 July 2006.
\href{https://simond.users.lmno.cnrs.fr/maths/Dim4.pdf}{Author's full text}.

\bibitem{BosmaStevenhagen1996}
W. Bosma and P. Stevenhagen, \emph{On the computation of quadratic
$2$-class groups}, Journal de Th\'eorie des Nombres de Bordeaux
\textbf{8} (1996), no.~2, 283--313;
erratum, \textbf{9} (1997), no.~1, 249 (reference numbering).
\href{https://www.numdam.org/item/JTNB_1996__8_2_283_0.pdf}{Full text};
\href{https://doi.org/10.5802/jtnb.200}{erratum}.

\bibitem{GSDistribution} A. Granville and K. Soundararajan,
The distribution of values of $L(1,\chi_d)$,
\emph{Geom. Funct. Anal.} \textbf{13} (2003), 992--1028.
\href{https://doi.org/10.1007/s00039-003-0438-3}{doi:10.1007/s00039-003-0438-3};
\href{https://arxiv.org/abs/math/0206031}{author's version}.

\bibitem{GSDistributionErrata} A. Granville and K. Soundararajan,
Errata to: The distribution of values of $L(1,\chi_d)$,
\emph{Geom. Funct. Anal.} \textbf{14} (2004), 245--246.
\href{https://doi.org/10.1007/s00039-004-0456-9}{doi:10.1007/s00039-004-0456-9};
\href{https://dms.umontreal.ca/~andrew/PDF/L1chi2002Errata.pdf}{published errata}.

\bibitem{DarbarMaiti2025} P. Darbar and G. Maiti,
Large values of quadratic Dirichlet $L$-functions,
\emph{Math. Ann.} \textbf{392} (2025), 4573--4605.
\href{https://doi.org/10.1007/s00208-025-03187-6}{doi:10.1007/s00208-025-03187-6};
\href{https://archive.mpim-bonn.mpg.de/5065/1/mpim-preprint_2024-13.pdf}{author's version}.

\bibitem{DDLL2024} P. Darbar, C. David, M. Lal\'{i}n, and A. Lumley,
Asymmetric distribution of extreme values of cubic $L$-functions at $s=1$,
\emph{J. London Math. Soc.} \textbf{110} (2024), no.~4, e12996, 61~pp.
\href{https://doi.org/10.1112/jlms.12996}{doi:10.1112/jlms.12996};
\href{https://pure.mpg.de/rest/items/item_3616423_1/component/file_3616425/content}{published version}.

\bibitem{LamzouriAverage2017} Y. Lamzouri,
On the average of the number of imaginary quadratic fields with a
given class number,
\emph{Ramanujan J.} \textbf{44} (2017), 411--416.
\href{https://doi.org/10.1007/s11139-017-9910-9}{doi:10.1007/s11139-017-9910-9};
\href{https://arxiv.org/abs/1512.07134}{author's version}.

\bibitem{LamzouriPrime2017} Y. Lamzouri,
The number of imaginary quadratic fields with prime discriminant
and class number up to $H$,
\emph{Q. J. Math.} \textbf{68} (2017), 1379--1393.
\href{https://doi.org/10.1093/qmath/hax026}{doi:10.1093/qmath/hax026};
\href{https://arxiv.org/abs/1701.05267}{author's version}.

\bibitem{Miller1976} G. L. Miller,
Riemann's hypothesis and tests for primality,
\emph{J. Comput. System Sci.} \textbf{13} (1976), 300--317.
\href{https://doi.org/10.1016/S0022-0000(76)80043-8}{doi:10.1016/S0022-0000(76)80043-8};
\href{https://www.cs.cmu.edu/~glmiller/Publications/Papers/Mi76.pdf}{author-hosted published scan}.

\bibitem{AKS2004} M. Agrawal, N. Kayal, and N. Saxena,
PRIMES is in P,
\emph{Ann. of Math. (2)} \textbf{160} (2004), 781--793.
\href{https://doi.org/10.4007/annals.2004.160.781}{doi:10.4007/annals.2004.160.781}.

\bibitem{MRSOracles} F. Morain, G. Renault, and B. Smith,
Deterministic factoring with oracles,
\emph{Appl. Algebra Engrg. Comm. Comput.} \textbf{34} (2023), 663--690.
\href{https://doi.org/10.1007/s00200-021-00521-8}{doi:10.1007/s00200-021-00521-8}.

\bibitem{DPSOracles} A. D\k abrowski, J. Pomyka\l a, and I. E. Shparlinski,
On oracle factoring of integers,
\emph{J. Complexity} \textbf{76} (2023), article 101741.
\href{https://doi.org/10.1016/j.jco.2023.101741}{doi:10.1016/j.jco.2023.101741}.

\bibitem{GSV2026} N. Gupta, A. Sikarov, and I. Volkovich,
A computational perspective on Carmichael numbers,
\emph{ECCC Report} TR26-212 (2026), preprint.
\href{https://eccc.weizmann.ac.il/report/2026/212/}{primary preprint}.

\bibitem{HoffsteinLockhart1994} J. Hoffstein and P. Lockhart,
Coefficients of Maass forms and the Siegel zero,
\emph{Ann. of Math. (2)} \textbf{140} (1994), 161--176.
\href{https://doi.org/10.2307/2118543}{doi:10.2307/2118543}.

\bibitem{GHL1994} D. Goldfeld, J. Hoffstein, and D. Lieman,
Appendix: An effective zero-free region,
\emph{Ann. of Math. (2)} \textbf{140} (1994), 177--181.
\href{https://doi.org/10.2307/2118544}{doi:10.2307/2118544}.

\bibitem{KMT2023} O. Klurman, A. P. Mangerel, and J. Ter\"av\"ainen,
Multiplicative functions in short arithmetic progressions,
\emph{Proc. London Math. Soc. (3)} \textbf{127} (2023), 366--446.
\href{https://doi.org/10.1112/plms.12546}{doi:10.1112/plms.12546};
\href{https://pure.mpg.de/rest/items/item_3521580/component/file_3524771/content}{published open-access copy}.

\bibitem{MerdyWesolowskiTCC} A. Herl\'edan Le Merdy and B. Wesolowski,
Unconditional foundations for supersingular isogeny-based cryptography,
\emph{Theory of Cryptography--TCC 2025}, LNCS \textbf{16270}
(2026), 266--297; first online 3 December 2025.
\href{https://doi.org/10.1007/978-3-032-12296-4_9}{doi:10.1007/978-3-032-12296-4\_9};
\href{https://arxiv.org/abs/2502.17010}{author's minor revision,
version 2, 2 February 2026}.

\bibitem{EHLMP2018} K. Eisentr\"ager, S. Hallgren, K. Lauter,
T. Morrison, and C. Petit, Supersingular isogeny graphs and endomorphism
rings: reductions and solutions, \emph{EUROCRYPT 2018},
LNCS \textbf{10822}, 329--368.
\href{https://doi.org/10.1007/978-3-319-78372-7_11}{doi:10.1007/978-3-319-78372-7\_11}.

\bibitem{Wesolowski} B. Wesolowski,
The supersingular isogeny path and endomorphism ring problems are equivalent,
\emph{2021 IEEE 62nd Annual Symposium on Foundations of Computer Science
(FOCS)}, 1100--1111.
\href{https://doi.org/10.1109/FOCS52979.2021.00109}{doi:10.1109/FOCS52979.2021.00109};
\href{https://arxiv.org/abs/2111.01481}{full version}.

\bibitem{BJN2023} F. Balestrieri, A. Johnson, and R. Newton,
Explicit uniform bounds for Brauer groups of singular K3 surfaces,
\emph{Ann. Inst. Fourier} \textbf{73} (2023), 567--607.
\href{https://doi.org/10.5802/aif.3526}{doi:10.5802/aif.3526}.

\bibitem{GaudronRemond2023} \'E. Gaudron and G. R\'emond,
Nouveaux th\'eor\`emes d'isog\'enie,
\emph{M\'em. Soc. Math. France (N.S.)} \textbf{176} (2023), 1--123.
\href{https://doi.org/10.24033/msmf.484}{doi:10.24033/msmf.484}.

\bibitem{KreschTschinkel2011} A. Kresch and Y. Tschinkel,
Effectivity of Brauer--Manin obstructions on surfaces,
\emph{Adv. Math.} \textbf{226} (2011), 4131--4144.
\href{https://doi.org/10.1016/j.aim.2010.11.012}{doi:10.1016/j.aim.2010.11.012}.

\bibitem{PoonenTestaVanLuijk2015} B. Poonen, D. Testa, and R. van Luijk,
Computing N\'eron--Severi groups and cycle class groups,
\emph{Compos. Math.} \textbf{151} (2015), 713--734.
\href{https://doi.org/10.1112/S0010437X14007878}{doi:10.1112/S0010437X14007878}.

\bibitem{ThornerZamanUnified} J. Thorner and A. Zaman,
A unified and improved Chebotarev density theorem,
\emph{Algebra Number Theory} \textbf{13} (2019), 1039--1068.
\href{https://doi.org/10.2140/ant.2019.13.1039}{doi:10.2140/ant.2019.13.1039}.

\bibitem{IKRS} G. Ivanyos, M. Karpinski, L. R\'onyai, and N. Saxena,
Trading GRH for algebra: algorithms for factoring polynomials and
related structures, \emph{Math. Comp.} \textbf{81} (2012), 493--531.
\href{https://doi.org/10.1090/S0025-5718-2011-02505-6}{doi:10.1090/S0025-5718-2011-02505-6};
\href{https://www.cse.iitk.ac.in/users/nitin/papers/nogrh.pdf}{published author copy}.

\bibitem{Khayutin2019} I. Khayutin,
Joint equidistribution of CM points,
\emph{Ann. of Math. (2)} \textbf{189} (2019), 145--276.
\href{https://doi.org/10.4007/annals.2019.189.1.4}{doi:10.4007/annals.2019.189.1.4}.

\bibitem{HabeggerWBH} P. Habegger, Weakly bounded height on modular curves,
\emph{Acta Math. Vietnam.} \textbf{35} (2010), no.~1, 43--69.
\href{https://math.ac.vn/uploads/files/1001043.pdf}{Published paper}.

\bibitem{EdixhovenRichard} B. Edixhoven and R. Richard,
A mod $p$ variant of the Andr\'e--Oort conjecture,
\emph{Rend. Circ. Mat. Palermo (2)} \textbf{69} (2020), 151--157.
\href{https://doi.org/10.1007/s12215-018-00392-y}{doi:10.1007/s12215-018-00392-y}.

\bibitem{CyclotomicIdentity} N. Balaji, S. Perifel, M. Shirmohammadi,
and J. Worrell, Cyclotomic identity testing and applications,
\emph{Proceedings of the 2021 International Symposium on Symbolic
and Algebraic Computation (ISSAC '21)} (2021), 35--42.
\href{https://doi.org/10.1145/3452143.3465530}{doi:10.1145/3452143.3465530}.

\bibitem{RadicalIdentity} N. Balaji, K. Nosan, M. Shirmohammadi,
and J. Worrell, Identity testing for radical expressions,
\emph{Proceedings of the 37th ACM/IEEE Symposium on Logic in
Computer Science (LICS '22)} (2022), article~8, 1--11.
\href{https://doi.org/10.1145/3531130.3533331}{doi:10.1145/3531130.3533331}.

\bibitem{RasmussenTamagawa} C. Rasmussen and A. Tamagawa,
Arithmetic of abelian varieties with constrained torsion,
\emph{Trans. Amer. Math. Soc.} \textbf{369} (2017), no.~4, 2395--2424.
\href{https://doi.org/10.1090/tran/6790}{doi:10.1090/tran/6790}.

\bibitem{PollackSchorn} P. Pollack and P. Schorn,
Dirichlet's proof of the three-square theorem: An algorithmic perspective,
\emph{Math. Comp.} \textbf{88} (2019), no.~316, 1007--1019.
\href{https://doi.org/10.1090/mcom/3349}{doi:10.1090/mcom/3349}.

\bibitem{HoughBias} P. Hough, A lower bound for biases amongst products
of two primes, \emph{Res. Number Theory} \textbf{3} (2017), article 19.
\href{https://doi.org/10.1007/s40993-017-0083-9}{doi:10.1007/s40993-017-0083-9}.
\bibitem{Daileda2006} R. C. Daileda, Non-abelian number fields with very
large class numbers, \emph{Acta Arith.} \textbf{125} (2006), 215--255.
\href{https://doi.org/10.4064/aa125-3-2}{doi:10.4064/aa125-3-2}.
\bibitem{BanwaitQuadratic} B. S. Banwait, Explicit isogenies of prime
degree over quadratic fields, \emph{Int. Math. Res. Not.}
\textbf{2023}, no.~14, 11829--11876.
\href{https://doi.org/10.1093/imrn/rnac134}{doi:10.1093/imrn/rnac134}.
\bibitem{BanwaitDerickx} B. S. Banwait and M. Derickx, Explicit isogenies
of prime degree over number fields, \emph{Algebra Number Theory}
\textbf{19} (2025), no.~6, 1147--1197.
\href{https://doi.org/10.2140/ant.2025.19.1147}{doi:10.2140/ant.2025.19.1147}.
\bibitem{GaoFactoring} S. Gao, On the deterministic complexity of
factoring polynomials, \emph{J. Symbolic Comput.} \textbf{31} (2001), 19--36.
\href{https://doi.org/10.1006/jsco.1999.1001}{doi:10.1006/jsco.1999.1001}.
\bibitem{RonyaiFactoring} L. R\'onyai, Factoring polynomials over finite
fields, \emph{J. Algorithms} \textbf{9} (1988), 391--400.
\href{https://doi.org/10.1016/0196-6774(88)90029-6}{doi:10.1016/0196-6774(88)90029-6}.
\bibitem{PollackCyclic} P. Pollack, The smallest inert prime in a
cyclic number field of prime degree, \emph{Math. Res. Lett.}
\textbf{20} (2013), 163--179.
\href{https://doi.org/10.4310/MRL.2013.v20.n1.a13}{doi:10.4310/MRL.2013.v20.n1.a13};
\href{https://pollack.uga.edu/cyclic.pdf}{Author's copy}.
\bibitem{AK} J.-H. Ahn and S.-H. Kwon, The class groups of the
imaginary Abelian number fields with Galois group
$(\mathbb Z/2\mathbb Z)^n$, \emph{Bull. Austral. Math. Soc.}
\textbf{70} (2004), 267--277.
\href{https://doi.org/10.1017/S0004972700034481}{doi:10.1017/S0004972700034481}.
\bibitem{BinyaminiFoliations} G. Binyamini, Point counting for
foliations over number fields, \emph{Forum Math. Pi}
\textbf{10} (2022), e6, 1--39.
\href{https://doi.org/10.1017/fmp.2021.20}{doi:10.1017/fmp.2021.20}.
\bibitem{HabeggerHeight} P. Habegger, Weakly bounded height on
modular curves, \emph{Acta Math. Vietnam.} \textbf{35} (2010), 43--69.
\href{https://math.ac.vn/uploads/files/1001043.pdf}{Published paper}.
\bibitem{CampagnaBounds} F. Campagna, Effective bounds on differences
of singular moduli that are $S$-units,
\emph{Math. Proc. Cambridge Philos. Soc.} \textbf{174} (2023), 415--450.
\href{https://doi.org/10.1017/S0305004122000378}{doi:10.1017/S0305004122000378};
\href{https://arxiv.org/abs/2102.06396}{Author preprint}.
\bibitem{CampagnaUnits} F. Campagna, On singular moduli that are $S$-units,
\emph{Manuscripta Math.} \textbf{166} (2021), 73--90.
\href{https://doi.org/10.1007/s00229-020-01230-1}{doi:10.1007/s00229-020-01230-1}.
\bibitem{GS2001} A. Granville and K. Soundararajan, Large character sums,
\emph{J. Amer. Math. Soc.} \textbf{14} (2001), 365--397.
\href{https://doi.org/10.1090/S0894-0347-00-00357-X}{doi:10.1090/S0894-0347-00-00357-X};
\href{https://dms.umontreal.ca/~andrew/PDF/ChiSums.pdf}{Author's copy}.
\bibitem{GHH} A. Granville, A. J. Harper, and K. Soundararajan,
A new proof of Hal\'asz's theorem, and its consequences,
\emph{Compos. Math.} \textbf{155} (2019), 126--163.
\href{https://doi.org/10.1112/S0010437X18007522}{doi:10.1112/S0010437X18007522};
\href{https://arxiv.org/abs/1706.03749}{Author preprint}.
\bibitem{BinyaminiAO} G. Binyamini, with an appendix by E. Kowalski,
Some effective estimates for Andr\'e--Oort in $Y(1)^n$,
\emph{J. Reine Angew. Math.} \textbf{767} (2020), 17--35.
\href{https://doi.org/10.1515/crelle-2019-0028}{doi:10.1515/crelle-2019-0028};
\href{https://arxiv.org/abs/1809.05302}{Author preprint}.
\bibitem{KaneTernary} B. Kane, Representations of integers by ternary
quadratic forms, \emph{Int. J. Number Theory} \textbf{6} (2010), 127--158.
\href{https://doi.org/10.1142/S1793042110002831}{doi:10.1142/S1793042110002831}.
\bibitem{DSP} W. Duke and R. Schulze-Pillot, Representation of integers
by positive ternary quadratic forms and equidistribution of lattice
points on ellipsoids, \emph{Invent. Math.} \textbf{99} (1990), 49--57.
\href{https://doi.org/10.1007/BF01234411}{doi:10.1007/BF01234411};
\href{https://www.math.ucla.edu/~wdduke/preprints/lattice2.pdf}{Author's copy}.
\bibitem{DukeTernary} W. Duke, On ternary quadratic forms,
\emph{J. Number Theory} \textbf{110} (2005), 37--43.
\href{https://doi.org/10.1016/j.jnt.2004.06.013}{doi:10.1016/j.jnt.2004.06.013};
\href{https://www.math.ucla.edu/~wdduke/preprints/ternary.pdf}{Author's copy}.
\bibitem{SP2} R. Schulze-Pillot, Darstellungsma\ss e von
Spinorgeschlechtern tern\"arer quadratischer Formen,
\emph{J. Reine Angew. Math.} \textbf{352} (1984), 114--132.
\href{https://gdz.sub.uni-goettingen.de/download/pdf/PPN243919689_0352/LOG_0010.pdf}{Original published paper}.
\bibitem{KaneCM} B. Kane, CM liftings of supersingular elliptic curves,
\emph{J. Th\'eor. Nombres Bordeaux} \textbf{21} (2009), 635--663.
\href{https://doi.org/10.5802/jtnb.692}{doi:10.5802/jtnb.692}.
\bibitem{EOY} N. D. Elkies, K. Ono, and T. Yang, Reduction of CM elliptic
curves and modular function congruences,
\emph{Int. Math. Res. Not.} \textbf{2005} (2005), no. 44, 2695--2707.
\href{https://arxiv.org/abs/math/0512350}{Author preprint}.
\bibitem{OAI} OpenAI, \emph{The Quasi-Riemann Hypothesis: A Zero-Free
Half-Plane $\Re s>7/8$}, 30 September 2026, Theorem 1.1.
\href{https://github.com/openai/math/tree/main/preprints/The-Quasi-Riemann-Hypothesis-September-30-2026}{Official manuscript and source}.
\bibitem{OAIshort} OpenAI, \emph{The Quasi-Riemann Hypothesis},
5 October 2026, companion proof of the $11/12$ boundary.
\href{https://github.com/openai/math/tree/main/preprints/The-Quasi-Riemann-Hypothesis-October-5-2026}{Official manuscript and source}.
\bibitem{Davenport} H. Davenport, \emph{Multiplicative Number Theory},
3rd ed., revised by H. L. Montgomery, Springer, 2000.
\bibitem{Littlewood} J. E. Littlewood, On the class-number of the corpus
$P(\sqrt{-k})$, \emph{Proc. London Math. Soc.} (2) \textbf{27}
(1928), 358--372.
\bibitem{FI} J. B. Friedlander and H. Iwaniec,
A note on Dirichlet $L$-functions, \emph{Exposition. Math.}
\textbf{36} (2018), 343--350.
\href{https://doi.org/10.1016/j.exmath.2018.06.003}{doi:10.1016/j.exmath.2018.06.003};
\href{https://arxiv.org/abs/1701.03771}{author preprint}.
\bibitem{Jerabek} E. Je\v r\'abek, Integer factoring and modular square
roots, \emph{J. Comput. Syst. Sci.} \textbf{82} (2016), 380--394.
\href{https://doi.org/10.1016/j.jcss.2015.08.001}{doi:10.1016/j.jcss.2015.08.001}.
\bibitem{AMM} L. Adleman, K. Manders, and G. Miller,
On taking roots in finite fields, \emph{18th Annual Symposium on
Foundations of Computer Science} (1977), 175--178.
\href{https://www.cs.cmu.edu/~glmiller/Publications/AMM77.pdf}{Original paper}.
\bibitem{AH} J. D. Achter and E. W. Howe, Split abelian surfaces over
finite fields and reductions of genus-2 curves,
\emph{Algebra Number Theory} \textbf{11} (2017), 39--76.
\href{https://doi.org/10.2140/ant.2017.11.39}{doi:10.2140/ant.2017.11.39}.
\bibitem{D4} V. Arul, J. Booher, S. R. Groen, E. W. Howe, W. Li,
V. Matei, R. Pries, and C. Springer,
Doubly isogenous genus-2 curves with $D_4$-action,
\emph{Math. Comp.} \textbf{93} (2024), 347--381.
\href{https://doi.org/10.1090/mcom/3891}{doi:10.1090/mcom/3891}.
\bibitem{Schoof} R. Schoof, Nonsingular plane cubic curves over finite
fields, \emph{J. Combin. Theory Ser. A} \textbf{46} (1987), 183--211.
\bibitem{GS} A. Granville and K. Soundararajan, Large character sums:
pretentious characters and the P\'olya--Vinogradov theorem,
\emph{J. Amer. Math. Soc.} \textbf{20} (2007), 357--384.
\href{https://doi.org/10.1090/S0894-0347-06-00536-4}{doi:10.1090/S0894-0347-06-00536-4}.
\bibitem{MV} H. L. Montgomery and R. C. Vaughan, Exponential sums with
multiplicative coefficients, \emph{Invent. Math.} \textbf{43}
(1977), 69--82. \href{https://doi.org/10.1007/BF01390204}{doi:10.1007/BF01390204}.
\bibitem{BK} D. W. Boyd and H. Kisilevsky, On the exponent of the ideal
class groups of complex quadratic fields, \emph{Proc. Amer. Math. Soc.}
\textbf{31} (1972), 433--436.
\href{https://doi.org/10.1090/S0002-9939-1972-0289454-4}{doi:10.1090/S0002-9939-1972-0289454-4}.
\bibitem{EKN} A.-S. Elsenhans, J. Kl\"uners, and F. Nicolae,
Imaginary quadratic number fields with class groups of small exponent,
\emph{Acta Arith.} \textbf{193} (2020), 217--233.
\href{https://doi.org/10.4064/aa180220-20-3}{doi:10.4064/aa180220-20-3};
\href{https://arxiv.org/abs/1803.02056}{author preprint}.
\bibitem{EKNlists} A.-S. Elsenhans, J. Kl\"uners, and F. Nicolae,
\emph{Imaginary quadratic fields with small exponent}, author-maintained
tables, accessed 9 October 2026.
\href{https://math.uni-paderborn.de/en/ag/ca/research/exponent/exponent0}{Complete tables}.
\bibitem{Kani} E. Kani, Idoneal numbers and some generalizations,
\emph{Ann. Sci. Math. Qu\'ebec} \textbf{35} (2011), 197--227.
\href{https://www.labmath.uqam.ca/~annales/volumes/35-2/PDF/197-227.pdf}{Published paper}.
\bibitem{BP} A. Bourdon and P. Pollack, Torsion subgroups of CM
elliptic curves over odd degree number fields, \emph{Int. Math. Res. Not.}
2017 (2017), no. 16, 4923--4961.
\href{https://doi.org/10.1093/imrn/rnw163}{doi:10.1093/imrn/rnw163};
\href{https://arxiv.org/abs/1601.00351}{author preprint}.
\bibitem{Joshi} P. T. Joshi, The size of $L(1,\chi)$ for real
nonprincipal residue characters $\chi$ with prime modulus,
\emph{J. Number Theory} \textbf{2} (1970), 58--73.
\bibitem{Schuett} M. Sch\"utt, CM newforms with rational coefficients,
\emph{Ramanujan J.} \textbf{19} (2009), 187--205.
\href{https://doi.org/10.1007/s11139-008-9147-8}{doi:10.1007/s11139-008-9147-8};
\href{https://arxiv.org/abs/math/0511228}{author preprint}.
\bibitem{Pasten} H. Pasten, Shimura curves and the abc conjecture,
\emph{J. Number Theory} \textbf{254} (2024), 214--335.
\href{https://doi.org/10.1016/j.jnt.2023.07.002}{doi:10.1016/j.jnt.2023.07.002};
\href{https://www.mat.uc.cl/~hector.pasten/preprints/ShABC.pdf}{author manuscript}.
\bibitem{ES} N. D. Elkies and M. Sch\"utt, Modular forms and K3 surfaces,
\emph{Adv. Math.} \textbf{240} (2013), 106--131.
\href{https://doi.org/10.1016/j.aim.2013.03.008}{doi:10.1016/j.aim.2013.03.008};
\href{https://arxiv.org/abs/0809.0830}{author preprint}.
\bibitem{KaniModuli} E. Kani, The moduli spaces of Jacobians isomorphic
to a product of two elliptic curves, \emph{Collect. Math.}
\textbf{67} (2016), 21--54.
\href{https://doi.org/10.1007/s13348-015-0148-9}{doi:10.1007/s13348-015-0148-9}.
\bibitem{Wei} X. Wei, Smallness of Faltings heights of CM abelian varieties,
\emph{J. Number Theory} \textbf{242} (2023), 73--101.
\href{https://doi.org/10.1016/j.jnt.2022.07.007}{doi:10.1016/j.jnt.2022.07.007}.
\bibitem{WeiPreprint} X. Wei, \emph{Smallness of Faltings heights of CM
abelian varieties}, arXiv:2111.00617v1 (2021).
\href{https://arxiv.org/abs/2111.00617}{Preprint with the numbering used in the proof}.
\bibitem{Stark} H. M. Stark, Some effective cases of the Brauer--Siegel
theorem, \emph{Invent. Math.} \textbf{23} (1974), 135--152.
\href{https://doi.org/10.1007/BF01405166}{doi:10.1007/BF01405166}.
\bibitem{ChangKwon} K.-Y. Chang and S.-H. Kwon, The imaginary abelian
number fields with class numbers equal to their genus class numbers,
\emph{J. Th\'eor. Nombres Bordeaux} \textbf{12} (2000), 349--365.
\href{https://doi.org/10.5802/jtnb.283}{doi:10.5802/jtnb.283}.
\bibitem{Miyada} I. Miyada, On imaginary abelian number fields of type
$(2,2,\ldots,2)$ with one class in each genus,
\emph{Manuscripta Math.} \textbf{88} (1995), 535--540.
\href{https://doi.org/10.1007/BF02567840}{doi:10.1007/BF02567840}.
\bibitem{LouboutinCubic} S. Louboutin, The exponent three class group
problem for some real cyclic cubic number fields,
\emph{Proc. Amer. Math. Soc.} \textbf{130} (2002), 353--361.
\href{https://doi.org/10.1090/S0002-9939-01-06168-8}{doi:10.1090/S0002-9939-01-06168-8}.
\bibitem{LemmermeyerPetho} F. Lemmermeyer and A. Peth\H{o},
Simplest cubic fields, \emph{Manuscripta Math.} \textbf{88}
(1995), 53--58.
\href{https://doi.org/10.1007/BF02567804}{doi:10.1007/BF02567804};
\href{https://arxiv.org/abs/1202.6022}{author preprint}.
\bibitem{LouboutinNewman} S. Louboutin and M. F. Newman,
On the diophantine equation $xy+yz+zx=d$,
\emph{Acta Math. Inform. Univ. Ostraviensis} \textbf{6} (1998), 155--158.
\href{https://dml.cz/handle/10338.dmlcz/120528}{Published paper}.
\bibitem{EllenbergVenkatesh2007} J. S. Ellenberg and A. Venkatesh,
Reflection principles and bounds for class group torsion,
\emph{Int. Math. Res. Not.} 2007 (2007), article rnm002, 18 pp.
\href{https://doi.org/10.1093/imrn/rnm002}{doi:10.1093/imrn/rnm002}.
\bibitem{HeathBrownTorsion2026} D. R. Heath-Brown,
$\ell$-Torsion in class groups via Dirichlet $L$-functions,
\emph{Int. J. Number Theory} (2026).
\href{https://doi.org/10.1142/S1793042126500168}{doi:10.1142/S1793042126500168};
\href{https://arxiv.org/abs/2412.07701v2}{Author version}.
\bibitem{ChanKoymansTorsion} S. Chan and P. Koymans,
A new pointwise bound for $3$-torsion of class groups,
arXiv:2505.00611 (2025). Prior-art comparison only.
\href{https://arxiv.org/abs/2505.00611}{Author preprint}.
\bibitem{LemkeOliverZamanTorsion} R. J. Lemke Oliver and A. Zaman,
Improving the trivial bound for $\ell$-torsion in class groups,
arXiv:2502.03464 (2025). Prior-art comparison only.
\href{https://arxiv.org/abs/2502.03464}{Author preprint}.
\bibitem{WalshScaling} M. N. Walsh,
Stability under scaling in the local phases of multiplicative functions,
\emph{Invent. Math.} \textbf{241} (2025), 325--362.
\href{https://doi.org/10.1007/s00222-025-01343-y}{doi:10.1007/s00222-025-01343-y};
\href{https://arxiv.org/abs/2310.07873}{author-linked full version}.
\bibitem{MRTFourier} K. Matom\"aki, M. Radziwi\l\l, and T. Tao,
Fourier uniformity of bounded multiplicative functions in short intervals
on average, \emph{Invent. Math.} \textbf{220} (2020), 1--58.
\href{https://doi.org/10.1007/s00222-019-00926-w}{doi:10.1007/s00222-019-00926-w}.
\bibitem{MollinRD2009} R. A. Mollin,
Class number two for real quadratic fields of Richaud--Degert type,
\emph{Serdica Math. J.} \textbf{35} (2009), 287--300.
\href{https://www.math.bas.bg/serdica/2009/2009-287-300.pdf}{Published paper}.
\bibitem{Tatuzawa1951} T. Tatuzawa, On a theorem of Siegel,
\emph{Japanese J. Math.} \textbf{21} (1951), 163--178.
\href{https://doi.org/10.4099/jjm1924.21.0_163}{doi:10.4099/jjm1924.21.0\_163}.
\bibitem{LouboutinPolynomial2026} S. R. Louboutin,
Ideal class groups of some quadratic number fields and factorization
of values of some quadratic polynomials,
\emph{Czechoslovak Math. J.} \textbf{76} (2026), 677--697.
\href{https://articles.math.cas.cz/10.21136/CMJ.2026.0455-25}{Publisher record};
\href{https://arxiv.org/abs/2511.15243}{author version}.
\bibitem{MangerelRigidity} A. P. Mangerel,
On a rigidity property for quadratic Gauss sums,
\emph{Mathematika} \textbf{72} (2026), no.~1, e70061, 30 pp.
\href{https://doi.org/10.1112/mtk.70061}{doi:10.1112/mtk.70061}.
\bibitem{GSSpectrum} A. Granville and K. Soundararajan,
The spectrum of multiplicative functions,
\emph{Ann. of Math.} (2) \textbf{153} (2001), 407--470.
\href{https://doi.org/10.2307/2661346}{doi:10.2307/2661346}.
\bibitem{SofosNonresidues} E. Sofos,
Statistics of small prime quadratic non-residues,
\emph{Rend. Semin. Mat. Univ. Politec. Torino} \textbf{80} (2022),
no.~1, 73--85.
\href{https://seminariomatematico.polito.it/rendiconti/80-1/Sofos.pdf}{Published paper}.
\bibitem{MrazovicPaley} R. Mrazovi\'c,
A random model for the Paley graph,
\emph{Q. J. Math.} \textbf{68} (2017), 193--206.
\href{https://doi.org/10.1093/qmath/haw037}{doi:10.1093/qmath/haw037}.
\bibitem{MontgomeryTopics} H. L. Montgomery,
\emph{Topics in Multiplicative Number Theory},
Lecture Notes in Mathematics \textbf{227}, Springer, 1971.
\bibitem{LouboutinPrime1990} S. Louboutin,
Prime producing quadratic polynomials and class-numbers of real
quadratic fields, \emph{Canad. J. Math.} \textbf{42} (1990),
no.~2, 315--341.
\href{https://doi.org/10.4153/CJM-1990-018-3}{doi:10.4153/CJM-1990-018-3}.
\bibitem{BiroLapkova2016} A. Bir\'o and K. Lapkova,
The class number one problem for the real quadratic fields
$\mathbb Q(\sqrt{(an)^2+4a})$,
\emph{Acta Arith.} \textbf{172} (2016), no.~2, 117--131.
\href{https://doi.org/10.4064/aa7957-12-2015}{doi:10.4064/aa7957-12-2015}.
\bibitem{LeeWide2009} J. Lee,
The complete determination of wide Richaud--Degert types which
are not $5$ modulo $8$ with class number one,
\emph{Acta Arith.} \textbf{140} (2009), no.~1, 1--29.
\href{https://doi.org/10.4064/aa140-1-1}{doi:10.4064/aa140-1-1}.
\bibitem{MourtadaMurtyOmega} M. Mourtada and V. Kumar Murty,
Omega theorems for $\frac{L'}L(1,\chi_D)$,
\emph{Int. J. Number Theory} \textbf{9} (2013), no.~3, 561--581.
\href{https://doi.org/10.1142/S1793042112501485}{doi:10.1142/S1793042112501485}.
\bibitem{MourtadaThesis} M. Mourtada,
\emph{The distribution of values of logarithmic derivatives of real
$L$-functions}, Ph.D. thesis, University of Toronto, 2013,
Chapter~4, especially Theorem~17.
\href{https://collectionscanada.gc.ca/obj/thesescanada/vol2/OTU/TC-OTU-35913.pdf}{Author's full thesis}.
\bibitem{Badzyan2010} A. I. Badzyan,
The Euler--Kronecker constant,
\emph{Math. Notes} \textbf{87} (2010), 31--42;
Russian original, \emph{Mat. Zametki} \textbf{87} (2010), 35--47.
\href{https://doi.org/10.1134/S0001434610010050}{English publication};
\href{https://doi.org/10.4213/mzm4736}{Russian original}.
\bibitem{FordLucaMoree2014} K. Ford, F. Luca, and P. Moree,
Values of the Euler $\varphi$-function not divisible by a given odd
prime, and the distribution of Euler--Kronecker constants for
cyclotomic fields, \emph{Math. Comp.} \textbf{83} (2014),
1447--1476.
\href{https://doi.org/10.1090/S0025-5718-2013-02749-4}{doi:10.1090/S0025-5718-2013-02749-4};
\href{https://arxiv.org/abs/1108.3805v3}{Revised author version, with the numbering used here}.
\bibitem{CGPS2022} P. L. Clark, T. Genao, P. Pollack, and F. Saia,
The least degree of a CM point on a modular curve,
\emph{J. London Math. Soc.} (2) \textbf{105} (2022), 825--883.
\href{https://doi.org/10.1112/jlms.12518}{doi:10.1112/jlms.12518};
\href{https://www.pollack-math.net/leastdeg-errata.pdf}{Author errata, 4 May 2026}.
\bibitem{GreenTaoMobius2012} B. Green and T. Tao,
The M\"obius function is strongly orthogonal to nilsequences,
\emph{Ann. of Math.} (2) \textbf{175} (2012), 541--566.
\href{https://doi.org/10.4007/annals.2012.175.2.3}{doi:10.4007/annals.2012.175.2.3}.
\bibitem{GreenTaoOrbits2012} B. Green and T. Tao,
The quantitative behaviour of polynomial orbits on nilmanifolds,
\emph{Ann. of Math.} (2) \textbf{175} (2012), 465--540.
\href{https://doi.org/10.4007/annals.2012.175.2.2}{doi:10.4007/annals.2012.175.2.2};
correction, \emph{Ann. of Math.} (2) \textbf{179} (2014), 1175--1183,
\href{https://doi.org/10.4007/annals.2014.179.3.8}{doi:10.4007/annals.2014.179.3.8}.
\end{thebibliography}
\end{document}