\section{Equal-length geodesics under a fixed rational map}\label{sec:fixed}
This section proves the following proposition, the arithmetic input of
the proof of Theorem~\ref{thm:main}.

\begin{proposition}\label{prop:fixed}
Let $G\in\GL_2(\bQ)\setminus\cK$. Then, as $L\to\infty$,
\[
 \#\bigl\{v\in\bZ^2_\prim:\ Gv\in\bZ^2_\prim,\ N(v)=N(Gv)\le L\bigr\}=o_G(L^2).
\]
\end{proposition}

By the length formula \eqref{eq:length}, the condition $N(v)=N(Gv)$ is the equality
$m(v)=m(Gv)$ of two labels, and labels are values of integral polynomials
on the Markoff surface $a^2+b^2+c^2=3abc$ (\S\ref{sec:markoff-surface}). The proof combines a zero-one law for the $3$-adic
dynamics of $\SL_2(\bZ)$ on this surface, a rigidity statement for rational
isometries of $N$, and a count of lattice points in orbits of finite-index
subgroups of $\SL_2(\bZ)$.

\subsection{The Markoff surface and the mapping class group action}
\label{sec:markoff-surface}
For a word $w\in F_2$ there is a unique polynomial $\tau_w\in\bZ[X,Y,Z]$
such that $\tr\sigma(w)=\tau_w(\tr\sigma(x),\tr\sigma(y),\tr\sigma(xy))$
for every representation $\sigma:F_2\to\SL_2(R)$ over every commutative
ring $R$; this is the classical trace calculus of Fricke, see
\cite{Goldman}*{\S2.2}. The trace relation $X^2+Y^2+Z^2=XYZ$ expresses $\tr\sigma([x,y])=-2$ by
the Fricke identity \eqref{eq:fricke}. In the scaled coordinates $a=X/3$, $b=Y/3$, $c=Z/3$, a
change of coordinates over $\bQ$, it becomes the \emph{Markoff
surface}
\[
 \mathcal M:\quad a^2+b^2+c^2=3abc ,
\]
and we use this equation over $\bZ$ as the integral model.

The group $\operatorname{Aut}(F_2)$ acts on trace triples: an automorphism
$\phi$ sends the character of $\sigma$ to the character of $\sigma\circ\phi$,
and on the coordinates $(X,Y,Z)$ this is the polynomial map
$(\tau_{\phi(x)},\tau_{\phi(y)},\tau_{\phi(xy)})$.

By Nielsen's theorem \cite{MKS}
$\operatorname{Aut}(F_2)$ is generated by the substitutions
$(x,y)\mapsto(y,x)$, $(x,y)\mapsto(x^{-1},y)$ and $(x,y)\mapsto(xy,y)$,
which act on $(X,Y,Z)$ by $(Y,X,Z)$, $(X,Y,XY-Z)$ and $(Z,Y,YZ-X)$
respectively (we used $\tr(x^{-1}y)=XY-Z$ and $\tr(xy^2)=YZ-X$). In the
scaled coordinates these are the transposition $(a,b,c)\mapsto(b,a,c)$,
the map $(a,b,c)\mapsto(a,b,3ab-c)$, which is the \emph{Vieta involution}
in the variable $c$, and the map $(a,b,c)\mapsto(c,b,3bc-a)$. We call the
group of polynomial automorphisms of $\mathcal M$ generated by the
coordinate permutations and the Vieta involutions in the three variables the \emph{Nielsen group},
and its elements \emph{Nielsen moves}. Each Nielsen move is a polynomial map with integer
coefficients whose inverse is again a Nielsen move.

Inner automorphisms of $F_2$ act
trivially on characters, and $\operatorname{Aut}(F_2)/\operatorname{Inn}(F_2)\cong\GL_2(\bZ)$
via the action on $H_1=\bZ^2$. We obtain a \emph{right action} of
$\GL_2(\bZ)$ on $\mathcal M$ by Nielsen moves, written $P\mapsto P\ast\gamma$,
characterized by
\begin{equation}\label{eq:evaluation}
 Q_w(P\ast\gamma)=Q_{\phi(w)}(P)\qquad(w\in F_2,\ \phi\in\operatorname{Aut}(F_2)
 \text{ inducing }\gamma\text{ on }H_1),
\end{equation}
where $Q_w(a,b,c):=\tfrac13\tau_w(3a,3b,3c)$ is the scaled trace function
of $w$; it lies in $\tfrac13\bZ[a,b,c]$, and in $\bZ[a,b,c]$ when $w$ is
primitive, see \eqref{eq:Qv}. (The action is a right action because the character of
$\sigma\circ\phi\circ\psi$ is obtained by applying $\psi$ to the character
of $\sigma\circ\phi$.) The element $-I$ acts trivially, since it is induced
by $(x,y)\mapsto(x^{-1},y^{-1})$, which preserves the traces of $x$, $y$
and $xy$.

For a primitive vector $v$ we put $Q_v:=Q_{w_v}$; this is well defined
because conjugate words and inverse words have the same trace. Then
\begin{equation}\label{eq:Qv}
 Q_v\in\bZ[a,b,c],\qquad Q_v(o)=m(v)\ \text{ for }o:=(1,1,1),\qquad
 Q_v(P\ast\gamma)=Q_{\gamma v}(P)\quad(\gamma\in\GL_2(\bZ)).
\end{equation}
The integrality of $Q_v$ holds because $w_v$ is the image of $x$ under an
automorphism of $F_2$, so that $Q_v$ is the first coordinate of the
Nielsen move attached to that automorphism, a polynomial with integer
coefficients. The value at $o$ is $\tr\rho(w_v)/3=m(v)$ because $o$ is the
scaled character of $\rho$. The last formula is \eqref{eq:evaluation} for
$w=w_v$, since $\phi(w_v)$ has homology class $\gamma v$.

Finally, for $G\in\GL_2(\bQ)$ let
\[
 H_G:=\Gamma\cap G^{-1}\Gamma G=\{h\in\Gamma:\ GhG^{-1}\in\Gamma\},
\]
a subgroup of $\Gamma=\SL_2(\bZ)$ containing $-I$.

\begin{lemma}\label{lem:HG}
Let $G\in\GL_2(\bQ)$. Then $H_G$ has finite index in $\Gamma$, and the set
$\{v\in\bZ^2_\prim:Gv\in\bZ^2_\prim\}$ is $H_G$-stable and is a finite union
of $H_G$-orbits.
\end{lemma}

\begin{proof}
Choose an integer $D>0$ with $\mathbf A:=DG$ integral, and put
$\Delta=|\det\mathbf A|$. For $h\in\Gamma$ one has
$GhG^{-1}=I+\mathbf A(h-I)\operatorname{adj}(\mathbf A)/\det\mathbf A$, which
is integral if $h\equiv I\pmod\Delta$. Thus $H_G$ contains the principal
congruence subgroup $\Gamma(\Delta)$.

If $v$ is primitive with $Gv$
primitive and $h\in H_G$, then $Ghv=(GhG^{-1})(Gv)$ is primitive. For
primitive $v$, the adjugate identity $\operatorname{adj}(\mathbf A)\mathbf Av=(\det\mathbf A)v$
shows that $\gcd(\mathbf Av)$ divides $\Delta$, and $Gv=\mathbf Av/D$ is
primitive integral if and only if $\gcd(\mathbf Av)=D$; this condition
depends only on $v$ modulo $\Delta$.

Primitive vectors $v,v'$ with
$v\equiv v'\pmod\Delta$ lie in the same $\Gamma(\Delta)$-orbit: complete
$v$ to a matrix $(v\,|\,u)\in\Gamma$, then choose $u'\equiv u\pmod\Delta$
with $\det(v'\,|\,u')=1$ (possible since $\det(v'\,|\,u)\equiv1\pmod\Delta$
and $v'$ is primitive), and observe that
$(v'\,|\,u')(v\,|\,u)^{-1}\in\Gamma(\Delta)$ sends $v$ to $v'$. Hence the
set in question is a union of finitely many $\Gamma(\Delta)$-orbits.
\end{proof}

\subsection{$3$-adic points and normalized coordinates}\label{sec:3adic}
We now pass to $3$-adic points. Let
\[
 \cX:=\{(a,b,c)\in(\bZ_3^\times)^3:\ a^2+b^2+c^2=3abc\}\subset\bZ_3^3 .
\]
The base point $o=(1,1,1)$ lies in $\cX$, and $\cX$ is stable under the
Nielsen moves, since $3ab-c\equiv-c\pmod3$ is a unit when $c$ is. On
$\bZ_3^3$ we use the metric $|P-P'|_3=\max_i|P_i-P'_i|_3$. Because the
Nielsen moves and their inverses are polynomial maps with integer
coefficients, they are isometries of $\cX$ for this metric; in particular
they act on the finite sets $\cX(3^n):=\cX\bmod3^n\subset(\bZ/3^n)^3$,
compatibly with reduction. A \emph{state modulo $3^n$} of a point of
$\cX$, or of $\cX^2$, is its image in $\cX(3^n)$, or in $\cX(3^n)^2$.

The set $\cX$ is a disjoint union of the eight \emph{residue balls}
$\cX_\varepsilon=\{P\in\cX:P\equiv\varepsilon\pmod3\}$,
$\varepsilon\in\{\pm1\}^3$, each of which is nonempty by Hensel's lemma,
since $a^2+b^2+c^2\equiv0\pmod 3$ for all units and the derivative
$2c-3ab\equiv2c$ with respect to $c$ is a unit.

Fix a point
$P_\varepsilon=(a_0,b_0,c_0)$ in each ball. By the formal implicit
function theorem there is a unique power series
$c_\varepsilon\in\bZ_3[[s_1,s_2]]$ with constant term $c_0$ such that
$(a_0+s_1,b_0+s_2,c_\varepsilon(s_1,s_2))$ lies on $\mathcal M$ identically; its coefficients lie in $\bZ_3$ because the
derivative $2c_0-3a_0b_0$ is a unit.

For $s\in(3\bZ_3)^2$ the series
converges, and by the uniqueness in Hensel's lemma
$c_\varepsilon(s)$ is the unique $c\equiv c_0\pmod 3$ with $(a_0+s_1,b_0+s_2,c)\in\cX$.
Hence the \emph{normalized coordinates}
\[
 \cX_\varepsilon\longrightarrow\bZ_3^2,\qquad
 (a,b,c)\longmapsto x=\Bigl(\frac{a-a_0}3,\frac{b-b_0}3\Bigr)
\]
form a bijection, and $c=c_\varepsilon(3x_1,3x_2)$ is given by a power series in
$x$ whose coefficient of a monomial of degree $d$ lies in $3^d\bZ_3$. We
write $\bZ_3\langle x_1,\dots,x_k\rangle$ for the ring of \emph{restricted
power series}, that is, power series with coefficients in $\bZ_3$ tending to
$0$; these are exactly the power series that converge on all of $\bZ_3^k$,
and they are continuous there. Thus $c\in\bZ_3\langle x_1,x_2\rangle$.
Similarly, a product ball $\cX_\varepsilon\times\cX_{\varepsilon'}$ of
$\cX^2$ has normalized coordinates $x\in\bZ_3^4$.

\subsection{A zero-one law for analytic dynamics on orbit closures}
\label{sec:zeroone}
We use the following theorem of Strassmann~\cite{Strassmann}; see
\cite{CasselsLF}*{Chapter 4}.

\begin{quote}
\textbf{Strassmann's theorem.} Let $f(t)=\sum_{n\ge0}a_nt^n$ with
$a_n\in\bQ_3$, $a_n\to0$, and $f\ne0$. Then $f$ has only finitely many
zeros in $\bZ_3$ (at most the largest $n$ with $|a_n|_3=\max_k|a_k|_3$).
\end{quote}

\begin{lemma}[Zero-one law]\label{lem:zeroone}
Let $Z$ be a compact subset of $\bZ_3^d$ and let a finitely generated group
$J$ act on $Z$ on the right by isometries of the $3$-adic metric. Let
$z_0\in Z$, let $Y$ be the closure of the orbit $z_0\ast J$, and let
$\mu_Y$ be the probability measure on $Y$ whose image on each finite
quotient $Y(3^n):=Y\bmod3^n$ is the uniform measure. Fix a finite
generating set of $J$, and assume that for each $g$ in it there is a
continuous map $\Phi_g:\bZ_3\times Y\to Y$ with
\[
 \Phi_g(n,z)=z\ast g^n\quad(n\in\bZ_{\ge0}),\qquad
 \Phi_g(t+1,z)=\Phi_g(t,z)\ast g\quad(t\in\bZ_3).
\]
Let $F:Y\to\bZ_3$ be continuous, and assume that for every $z\in Y$ and
every $g$ in the generating set the function $t\mapsto F(\Phi_g(t,z))$ on $\bZ_3$ is
given by a power series with coefficients tending to $0$. Then
$\mu_Y(F=0)\in\{0,1\}$, and if $\mu_Y(F=0)=1$ then $F$ vanishes
identically on $Y$.
\end{lemma}

The measure $\mu_Y$ is well defined. The set $Y(3^n)$ is the finite
transitive $J$-set $z_0\ast J\bmod3^n$, and the reduction
$Y(3^{n+1})\to Y(3^n)$ is a $J$-equivariant surjection between transitive
$J$-sets; so all its fibres have the same cardinality, and the uniform
measures are compatible. Since $Y$ is the inverse limit of the $Y(3^n)$,
the uniform measures define a Borel probability measure $\mu_Y$ on $Y$. It is $J$-invariant, and it has full support
(every residue ball meeting $Y$ has positive measure).

\begin{proof}
\emph{Ergodicity.} Let $f\in L^2(\mu_Y)$ satisfy $f\circ g=f$ almost
everywhere for all $g\in J$. Its conditional expectation $f_n$ with
respect to the partition of $Y$ into residue classes modulo $3^n$ is a
function on $Y(3^n)$, and it is $J$-invariant, because $g$ permutes the
residue classes and preserves $\mu_Y$. A $J$-invariant function on the
transitive finite $J$-set $Y(3^n)$ is constant. Since the residue
partitions generate the Borel $\sigma$-algebra, $f_n\to f$ in $L^2$ by
the martingale convergence theorem, so $f$ is constant almost everywhere.

\emph{Invariance under the flows.} Fix $g$ in the generating set and
$t\in\bZ_3$, and
choose nonnegative integers $n_k\to t$ in $\bZ_3$. By uniform continuity
of $\Phi_g$ on the compact set $\bZ_3\times Y$, $\Phi_g(n_k,\cdot)\to\Phi_g(t,\cdot)$
uniformly on $Y$, so for every continuous $\psi$ on $Y$
\[
 \int_Y\psi(\Phi_g(t,z))\,d\mu_Y(z)=\lim_k\int_Y\psi(z\ast g^{n_k})\,d\mu_Y(z)
 =\int_Y\psi\,d\mu_Y .
\]
Thus $\Phi_g(t,\cdot)$ preserves $\mu_Y$.

\emph{The dichotomy.} Put $E=\{z\in Y:F(z)=0\}$, a closed set. Fix $g$ in
the generating set and $z\in Y$. By hypothesis $t\mapsto F(\Phi_g(t,z))$ is
given by a power series with coefficients tending to zero, so by
Strassmann's theorem it either vanishes identically or has finitely many
zeros in $\bZ_3$. In both cases the function
$t\mapsto1_E(\Phi_g(t+1,z))-1_E(\Phi_g(t,z))$ vanishes outside a finite
set, hence
\[
 \int_{\bZ_3}\bigl|1_E(\Phi_g(t+1,z))-1_E(\Phi_g(t,z))\bigr|\,dt=0
\]
for the Haar probability measure $dt$ on $\bZ_3$.

Integrating over $z$, using Fubini's theorem, the relation
$\Phi_g(t+1,z)=\Phi_g(t,z)\ast g$ and the invariance of $\mu_Y$ under
$\Phi_g(t,\cdot)$, we obtain
\[
 0=\int_{\bZ_3}\int_Y\bigl|1_E(\Phi_g(t,z)\ast g)-1_E(\Phi_g(t,z))\bigr|\,d\mu_Y(z)\,dt
  =\int_Y\bigl|1_E(z\ast g)-1_E(z)\bigr|\,d\mu_Y(z),
\]
that is, $\mu_Y(E\,\triangle\,E\ast g^{-1})=0$. The set of $g\in J$ with
this property is a subgroup containing the generating set, so it is all
of $J$. Hence $1_E$ is
$J$-invariant in $L^2(\mu_Y)$, and by ergodicity $\mu_Y(E)\in\{0,1\}$. If
$\mu_Y(E)=1$, then the closed set $E$ contains the support of $\mu_Y$,
which is $Y$.
\end{proof}

\subsection{Interpolation of iterates}\label{sec:interpolation}
Let $\varepsilon,\varepsilon'\in\{\pm1\}^3$ and let $x\in\bZ_3^4$ be the
normalized coordinates of the product ball
$\cX_\varepsilon\times\cX_{\varepsilon'}$ of $\cX^2$. The next lemma is
Poonen's interpolation theorem~\cite{Poonen}*{Theorem 1} for the prime $3$, in the
normalization we need; we include the short proof.

\begin{lemma}\label{lem:interpolation}
Let $\gamma,\gamma'\in\GL_2(\bZ)$ and let $g:\cX^2\to\cX^2$ be the map
$g(P,P')=(P\ast\gamma,P'\ast\gamma')$. Assume that $g$ fixes every point of
$\cX^2$ modulo $9$. Then $g$ maps each product ball to itself, and in
normalized coordinates it is given by
\[
 g(x)=x+3u(x),\qquad u\in\bZ_3\langle x_1,\dots,x_4\rangle^4 .
\]
Moreover there is $\Phi_g\in\bZ_3\langle t,x_1,\dots,x_4\rangle^4$ with
$\Phi_g(n,x)=g^n(x)$ for all integers $n\ge0$, and
$\Phi_g(t+t',x)=\Phi_g(t,\Phi_g(t',x))$ for all $t,t'\in\bZ_3$. In
particular $\Phi_g(t,z)$ lies in the closure of $\{g^n(z):n\ge0\}$ for
every $z$.
\end{lemma}

\begin{proof}
We first write $g$ in normalized coordinates, which gives the first claim,
and then build $\Phi_g$ as a binomial series in the difference operator
$\Delta f=f\circ g-f$.

Since $g$ fixes all points modulo $9$, it fixes them modulo $3$ and maps
each product ball to itself. On the ball, in the unnormalized coordinates
$s=(a-a_0,b-b_0,a'-a_0',b'-b_0')\in(3\bZ_3)^4$, the map $g$ is the composite
of the implicit functions $c=c_\varepsilon(s_1,s_2)$, $c'=c_{\varepsilon'}(s_3,s_4)$, the
polynomial Nielsen moves with integer coefficients, and the projection to
the $(a,b,a',b')$ coordinates. Hence, if the image point is also written in
unnormalized coordinates, $g$ is given by a power series
$\mathbf G(s)=\sum_{d\ge0}\mathbf G_d(s)$ with coefficients in $\bZ_3$,
$\mathbf G_d$ homogeneous of degree $d$; the constant term $\mathbf G_0$,
the coordinate vector of the image of the point $(P_\varepsilon,P_{\varepsilon'})$
where $s=0$, lies in $9\bZ_3^4$ by the hypothesis. In the normalized coordinates $s=3x$,
\[
 g(x)=\frac{\mathbf G(3x)}3=\frac{\mathbf G_0}3+\mathbf G_1(x)+\sum_{d\ge2}3^{d-1}\mathbf G_d(x).
\]
The terms of degree $d\ge2$ have coefficients in $3^{d-1}\bZ_3\subset3\bZ_3$,
and the constant term lies in $3\bZ_3^4$.

The hypothesis also gives
$g(x)\equiv x\pmod3$ for every $x\in\bZ_3^4$; reducing the display modulo
$3$ shows that the linear map $\mathbf G_1$ satisfies
$\mathbf G_1(x)\equiv x\pmod 3$ for all $x\in\bZ_3^4$, so its matrix is
$\equiv I\pmod3$. Hence $g(x)-x$ has all coefficients in $3\bZ_3$, and
they tend to $0$; this is the first claim.

Let $\mathcal R=\bZ_3\langle x_1,\dots,x_4\rangle$ and define
$\Delta f:=f\circ g-f$ for $f\in\mathcal R$; composition with $g$ is
well defined on $\mathcal R$ since $g$ has coefficients in $\bZ_3$. By
Taylor's formula, $f(x+3u)-f(x)=\sum_{|\alpha|\ge1}3^{|\alpha|}(D^\alpha f)(x)u^\alpha$,
where the divided derivatives $D^\alpha f=\partial^\alpha f/\alpha!$ again
lie in $\mathcal R$. Hence $\Delta(3^r\mathcal R)\subset3^{r+1}\mathcal R$
for all $r\ge0$. Define
\[
 \Phi_g(t,x):=\sum_{k\ge0}\binom tk\,\Delta^k x,\qquad
 \binom tk=\frac{t(t-1)\cdots(t-k+1)}{k!}\in\bQ_3[t],
\]
applied to the vector $x=(x_1,\dots,x_4)$ of coordinate functions. The
polynomial $\binom tk$ has coefficients of $3$-adic valuation at least
$-v_3(k!)\ge-k/2$, while $\Delta^kx\in3^k\mathcal R^4$; so the $k$-th
term has coefficients of valuation at least $k/2$, and the series
converges in $\bZ_3\langle t,x\rangle^4$. For an integer $n\ge0$,
$\sum_{k\le n}\binom nk\Delta^k=(1+\Delta)^n$ is the operator
$f\mapsto f\circ g^n$, so $\Phi_g(n,x)=g^n(x)$.

The identity
$\Phi_g(t+t',x)=\Phi_g(t,\Phi_g(t',x))$ holds for $t,t'\in\bZ_{\ge0}$, and
both sides are continuous in $(t,t')$, so it holds on $\bZ_3^2$ by
density. The last assertion follows by continuity in $t$.
\end{proof}

\subsection{Rational isometries of the stable norm}\label{sec:rigidity}

\begin{lemma}\label{lem:rigidity}
If $G\in\GL_2(\bQ)$ satisfies $N(Gx)=N(x)$ for all $x\in\bR^2$, then
$G\in\cK$.
\end{lemma}

\begin{proof}
We show, by comparing the corner formula \eqref{eq:corner} at a primitive
vector $v$ and at the primitive vector on the ray of $Gv$, that $G$ maps
primitive vectors to primitive vectors and has determinant $\pm1$; then $G$
permutes the six primitive vectors of minimal norm, which forces
$G\in\cK$.

Put $\delta=|\det G|$ and $f(t)=\log\coth(t/2)$ for $t>0$. Since $G$ is a
linear isometry of $N$, one-sided derivatives transform by
$D_{Gh}N(Gx)=D_hN(x)$, hence $J_N(Gx;Gh)=J_N(x;h)$; and $J_N(x;h)$ depends
only on the ray through $x$, since $N$ is homogeneous.

Let $v$ be primitive and write $Gv=c_vw$ with $c_v\in\bQ_{>0}$ and $w$
primitive. Choose $D\in\bZ_{>0}$ with $\mathbf A=DG$ integral. Then
$Gv=\mathbf Av/D$ and $c_v=\gcd(\mathbf Av)/D$, and by the adjugate identity
$\gcd(\mathbf Av)$ divides $\det\mathbf A$; so $c_v$ takes only finitely
many values as $v$ ranges over $\bZ^2_\prim$. Put $l=N(v)$, so that
$N(w)=l/c_v$. For $h$ with $\det(v,h)\ne0$, the corner formula
\eqref{eq:corner} applied at $v$ and at $w$ gives
\begin{align*}
 4|\det(v,h)|f(l)&=J_N(v;h)=J_N(Gv;Gh)=J_N(w;Gh)\\
 &=4|\det(w,Gh)|f(l/c_v)=4\frac{\delta}{c_v}|\det(v,h)|f(l/c_v),
\end{align*}
using $\det(w,Gh)=\det(Gv,Gh)/c_v=(\det G/c_v)\det(v,h)$. Hence
\begin{equation}\label{eq:corner-compare}
 f(l)=\frac{\delta}{c_v}\,f\Bigl(\frac l{c_v}\Bigr)\qquad(v\in\bZ^2_\prim,\ l=N(v)).
\end{equation}

Some value $c_*$ of $c_v$ is taken for infinitely many primitive $v$, hence
along a sequence with $l=N(v)\to\infty$. Since $f(t)\sim2e^{-t}$ as
$t\to\infty$, \eqref{eq:corner-compare} gives
$e^{-l(1-1/c_*)}\to\delta/c_*$ along this sequence, which forces $c_*=1$
and then $\delta=1$.

Now \eqref{eq:corner-compare} reads $c_vf(l)=f(l/c_v)$ for every
primitive $v$, or $\varphi(l)=\varphi(l/c_v)$ with $\varphi(t)=tf(t)$. Both
$l=N(v)$ and $l/c_v=N(w)$ are norms of primitive vectors, hence at least
$2\arcosh(3/2)>1$. On $[1,\infty)$ the function $\varphi$ is strictly
decreasing: $f'(t)=-1/\sinh t$, and
\[
 f(t)=\int_t^\infty\frac{du}{\sinh u}<\int_t^\infty\frac{\cosh u}{\sinh^2u}\,du=\frac1{\sinh t},
 \qquad\text{so}\qquad
 \varphi'(t)=f(t)-\frac t{\sinh t}<\frac{1-t}{\sinh t}\le0 .
\]

Therefore $c_v=1$ for every primitive $v$: $G$ maps primitive vectors to
primitive vectors, so $G\in\operatorname{Mat}_2(\bZ)$, and $|\det G|=1$.
Thus $G\in\GL_2(\bZ)$, and it permutes the primitive vectors of minimal
norm. By Lemma~\ref{lem:dictionary}, these are the vectors of label $1$,
which form the single $\cK$-orbit $\{\pm e_1,\pm e_2,\pm(e_1+e_2)\}$ of
$e_2$ (the only sorted Markoff triple with maximum $1$ is $(1,1,1)$). A
linear map permuting this hexagon is determined by the images of $e_1$
and $e_2$; there are six choices for $Ge_1$ and then exactly two choices
for $Ge_2$ for which $Ge_1+Ge_2$ again lies in the hexagon, so the group
of such maps has order twelve and equals $\cK$.
\end{proof}

Lemma~\ref{lem:rigidity} identifies $\cK$ with the group of automorphisms
of $H_1(\mathbb T,\bZ)=\bZ^2$ induced by the isometries of $\mathbb T$. An
isometry of $\mathbb T$ maps simple closed geodesics to simple closed
geodesics of the same length, so the automorphism it induces preserves $N$
and lies in $\cK$. Conversely, $T$ normalizes $\Gamma'$, and the reflection
$z\mapsto-\bar z$ normalizes $\PSL_2(\bZ)$ and hence its commutator
subgroup $\Gamma'$; so both induce isometries of $\mathbb T$. Since
$TAT^{-1}=AB$, $TBT^{-1}=A^{-1}$ and the reflection exchanges $A$ and $B$,
the two isometries act on $H_1$ by $r^{-1}$ and $sr^{-1}$, which generate $\cK$.

\begin{lemma}\label{lem:dense-directions}
Let $J\le\Gamma$ be a subgroup of finite index and $v'\in\bZ^2_\prim$. The
directions of the vectors in the orbit $Jv'$ are dense in $\bR\mathbb P^1$.
\end{lemma}

\begin{proof}
Let $u$ be primitive, $\gamma_u\in\Gamma$ with $\gamma_ue_1=u$, and
$p_u=\gamma_uT\gamma_u^{-1}$; then $p_ux=x+\det(u,x)\,u$ for all $x$.
Since $J$ has finite index, $p_u^k\in J$ for some $k\ge1$, and
$p_u^{kn}v'=v'+kn\det(u,v')\,u$ converges in direction to $u$ as
$n\to\infty$ if $\det(u,v')\ne0$; if $\det(u,v')=0$ the direction of $u$ is
that of $v'$ itself. Hence every rational direction is a limit of
directions of $Jv'$, and rational directions are dense.
\end{proof}

\subsection{Counting lattice points in cusp orbits}\label{sec:cuspcount}
For a subgroup $U\le\Gamma$ of finite index and $v\in\bZ^2_\prim$, choose
$\gamma_v\in\Gamma$ with $\gamma_ve_1=v$. The
stabilizer of $v$ in $\Gamma$ is $\{\gamma_vT^k\gamma_v^{-1}:k\in\bZ\}$, and
the \emph{cusp width} of $v$ relative to $U$ is the least integer
$\omega(v;U)\ge1$ with $\gamma_vT^{\omega(v;U)}\gamma_v^{-1}\in U$; it does not depend on
the choice of $\gamma_v$. We use the following asymptotic count.

\begin{theorem}[after Burrin--Nevo--R\"uhr--Weiss]\label{thm:cuspcount}
Let $U\le\Gamma$ be a subgroup of finite index containing $-I$, let
$v\in\bZ^2_\prim$, and let $\Omega\subset\bR^2$ be a
bounded star-shaped set with respect to the origin whose radial function
is piecewise Lipschitz. Then, as $L\to\infty$,
\begin{equation}\label{eq:cuspcount}
 \#\bigl(Uv\cap L\Omega\bigr)=\frac{\omega(v;U)}{[\Gamma:U]}\,\frac{\area(\Omega)}{\zeta(2)}\,L^2
 +o_{U,v,\Omega}(L^2).
\end{equation}
\end{theorem}

The counting theorem \cite{BNRW}*{Theorem 2.7} states, for any non-uniform lattice
$\Gamma_0\subset\SL_2(\bR)$, any discrete orbit
$\Gamma_0v\subset\bR^2\setminus\{0\}$ and any $\Omega$ as above, that
$\#(\Gamma_0v\cap L\Omega)=C_{\Gamma_0,v,\Omega}L^2+O_{\Gamma_0,v,\Omega,\varepsilon}(L^{q+\varepsilon})$
for every $\varepsilon>0$, with an exponent $q<2$ that depends only on the spectral gap of $\Gamma_0$. A subgroup $U$
of finite index in $\Gamma$ is a non-uniform lattice in $\SL_2(\bR)$, and
its orbit $Uv$ is discrete, so the theorem applies to $U$.

The form of the constant in \eqref{eq:cuspcount} comes from the proof of
that theorem in \cite{BNRW}*{\S5.2}. There the orbit map
$g\mapsto gv$ carries the elements of $U$ lying in a region of
$\SL_2(\bR)$, built from $L\Omega$ and a fundamental domain of
$U\cap\Stab(v)$ in $\Stab_{\SL_2(\bR)}(v)$, bijectively onto
$Uv\cap L\Omega$ \cite{BNRW}*{Lemma 5.7}. The counting theorem of
Gorodnik and Nevo, quoted as \cite{BNRW}*{Theorem 5.6}, shows that the
number of these elements is asymptotic to the Haar measure of that region divided by the
Haar measure of $U\backslash\SL_2(\bR)$.

Hence the leading constant is the
Lebesgue measure of $\Omega$ times
\[
 \frac{\text{Haar measure of a fundamental domain of }U\cap\Stab(v)
       \text{ in }\Stab_{\SL_2(\bR)}(v)\cong\bR}
      {\text{Haar measure of }U\backslash\SL_2(\bR)},
\]
and replacing $U$ by $\Gamma$ divides the numerator by $\omega(v;U)$ and the
denominator by $[\Gamma:U]$. The absolute normalization is fixed by the
case $U=\Gamma$, $v=e_1$, where $\Gamma e_1=\bZ^2_\prim$ and the number of
primitive vectors in $L\Omega$ is $\area(\Omega)L^2/\zeta(2)+O_\Omega(L\log L)$.

We apply the theorem with $\Omega=\ball$, whose radial function
$\theta\mapsto1/N(\cos\theta,\sin\theta)$ is Lipschitz, for fixed $U$
and $v$, and use the error term only in the form $o(L^2)$.

\subsection{Proof of Proposition~\ref{prop:fixed}}\label{sec:proof-fixed}
Let $G\in\GL_2(\bQ)\setminus\cK$. By Lemma~\ref{lem:HG} it
suffices to prove, for one $H_G$-orbit $H_Gv_0$ with $Gv_0=:w_0$ primitive,
that
\begin{equation}\label{eq:orbit-goal}
 \#\{v\in H_Gv_0:\ N(v)=N(Gv)\le L\}=o_{G,v_0}(L^2).
\end{equation}

\emph{The paired action.} For $z=(P,P')\in\cX^2$ and $h\in H_G$ define
\[
 z\star h:=\bigl(P\ast h,\ P'\ast GhG^{-1}\bigr).
\]
This is a right action of $H_G$ on $\cX^2$ by isometries, since
$GhG^{-1}\in\Gamma$ for $h\in H_G$. Let
\[
 J:=\{h\in H_G:\ z\star h\equiv z\pmod 9\text{ for all }z\in\cX^2\},
\]
the kernel of the induced action of $H_G$ on the finite set $\cX(9)^2$. It is
a normal subgroup of finite index in $H_G$, it contains $-I$, and it is
finitely generated.

Since $J$ is normal in $H_G$, the orbit $H_Gv_0$ is the
finite union of the $J$-orbits $Jh_iv_0=h_iJv_0$, $h_i$ running over
representatives of $J\backslash H_G$; so it suffices to prove
\eqref{eq:orbit-goal} with $H_Gv_0$ replaced by $h_0Jv_0$ for a fixed
$h_0\in H_G$.

Define
\[
 z_0:=\bigl(o\ast h_0,\ o\ast Gh_0G^{-1}\bigr)\in\cX^2,\qquad
 F(P,P'):=Q_{v_0}(P)-Q_{w_0}(P')\in\bZ[a,b,c,a',b',c'].
\]
For $j\in J$, the properties \eqref{eq:Qv} of the polynomials $Q_v$ give
\begin{equation}\label{eq:pair-eval}
 F\bigl(z_0\star j\bigr)
 =Q_{h_0jv_0}(o)-Q_{(Gh_0jG^{-1})w_0}(o)
 =m(h_0jv_0)-m(Gh_0jv_0),
\end{equation}
where $Gh_0jG^{-1}\in\Gamma$ because $h_0j\in H_G$. By the length formula \eqref{eq:length},
$F(z_0\star j)=0$ if and only if $N(v)=N(Gv)$ for $v=h_0jv_0$.

\emph{The zero-one law applies.} Let $Y\subset\cX^2$ be the closure of
$z_0\star J$ and $\mu_Y$ the measure of Lemma~\ref{lem:zeroone}. Fix a
finite generating set of $J$. For each $j$ in it, the map
$g_j:z\mapsto z\star j$ fixes every point of $\cX^2$ modulo $9$, so
Lemma~\ref{lem:interpolation} provides, on each product ball, a restricted
power series $\Phi_{g_j}(t,x)$ interpolating the iterates of $g_j$. This
series is continuous, and $\Phi_{g_j}(t,z)\in Y$ for $z\in Y$ because $Y$ is closed
and $J$-stable.

For $z\in Y$ the function $t\mapsto F(\Phi_{g_j}(t,z))$ is obtained by
substituting the restricted power series
$\Phi_{g_j}(t,z)\in\bZ_3\langle t\rangle^4$ into the polynomial $F$, whose
variables $c,c'$ are themselves restricted power series in the normalized
coordinates; so it lies in $\bZ_3\langle t\rangle$. Thus
Lemma~\ref{lem:zeroone} applies, and $\mu_Y(F=0)\in\{0,1\}$.

If $\mu_Y(F=0)=1$, then $F$ vanishes on $Y\supset z_0\star J$, so by
\eqref{eq:pair-eval} $N(Gv)=N(v)$ for every $v$ in the orbit $h_0Jv_0$. By
Lemma~\ref{lem:dense-directions} the directions of these $v$ are dense in
$\bR\mathbb P^1$; since $N\circ G$ and $N$ are continuous and homogeneous,
$N(Gx)=N(x)$ for all $x\in\bR^2$, and Lemma~\ref{lem:rigidity} gives
$G\in\cK$, a contradiction. Therefore $\mu_Y(F=0)=0$, and since the
closed sets $\{F\equiv0\bmod3^n\}$ decrease to $\{F=0\}$,
\begin{equation}\label{eq:localnull}
 \mu_Y\bigl(F\equiv0\pmod{3^n}\bigr)\longrightarrow0\qquad(n\to\infty).
\end{equation}

\emph{From states to cusp orbits.} Fix $n\ge1$ and let
\[
 S:=\{j\in J:\ z_0\star j\equiv z_0\pmod{3^n}\},
\]
the stabilizer in $J$ of the state of $z_0$ modulo $3^n$; it has finite
index in $J$ and contains $-I$. The map $Sj\mapsto z_0\star j\bmod3^n$
identifies the finite set $Y(3^n)$ of states of $Y$ with the set
$S\backslash J$ of cosets $Sj$, as right $J$-sets, and $\mu_Y$ induces the
uniform measure on $S\backslash J$. Let $\mathcal E\subset S\backslash J$ be
the set of cosets $Sj$ with $F(z_0\star j)\equiv0\pmod{3^n}$; this
condition depends only on the state, so $\mathcal E$ is well defined, and
\begin{equation}\label{eq:E-measure}
 \frac{|\mathcal E|}{[J:S]}=\mu_Y\bigl(F\equiv0\pmod{3^n}\bigr).
\end{equation}

Choose $\gamma_0\in\Gamma$ with $\gamma_0e_1=v_0$, let
$\omega=\omega(v_0;J)$ be the cusp width of $v_0$ relative to $J$, and put
$p=\gamma_0T^{\omega}\gamma_0^{-1}\in J$. Then $\Stab_J(v_0)=\langle p\rangle$,
since $\Stab_\Gamma(v_0)=\{\gamma_0T^k\gamma_0^{-1}\}$. The element $p$
fixes $v_0$ and $GpG^{-1}$ fixes $w_0$, so \eqref{eq:pair-eval} gives
$F(z_0\star jp)=F(z_0\star j)$ for all $j$: the function
$j\mapsto F(z_0\star j)$ is invariant under right multiplication by $p$.
Consequently $\mathcal E$ is a union of orbits of the right action of
$\langle p\rangle$ on $S\backslash J$; we call these orbits \emph{cycles}
and write $\ell(Sj)$ for the length of the cycle through $Sj$.

The map $j\mapsto h_0jv_0$ from $J$ onto the orbit $h_0Jv_0$ has fibres
the cosets $j\langle p\rangle$, and the double cosets $Sj\langle p\rangle$
partition $J$. The double coset of $j$ corresponds to the cycle through
$Sj$, and its image under this map is the set
\[
 h_0Sj\langle p\rangle v_0=h_0Sjv_0=U_S\,v_j,\qquad
 U_S:=h_0Sh_0^{-1},\quad v_j:=h_0jv_0 ,
\]
the orbit of $v_j$ under the finite-index subgroup $U_S\le\Gamma$, which
contains $-I$ and has index $[\Gamma:U_S]=[\Gamma:J][J:S]$.

We compute the cusp width of $v_j$ relative to $U_S$. Since
$v_j=h_0j\gamma_0e_1$, it is the least $k\ge1$ with
$h_0j\gamma_0T^k\gamma_0^{-1}j^{-1}h_0^{-1}\in h_0Sh_0^{-1}$, that is, with
$j(\gamma_0T^k\gamma_0^{-1})j^{-1}\in S$. As $S\subset J$ and $j\in J$, this
forces $\gamma_0T^k\gamma_0^{-1}\in J$, that is, $\omega\mid k$; for
$k=\omega k'$ the condition becomes $jp^{k'}j^{-1}\in S$, that is
$Sjp^{k'}=Sj$, which holds exactly when $\ell(Sj)$ divides $k'$. Hence
\begin{equation}\label{eq:width-cycle}
 \omega(v_j;U_S)=\omega\cdot\ell(Sj).
\end{equation}

\emph{Conclusion.} Let $v=h_0jv_0$ satisfy $N(v)=N(Gv)\le L$. Then
$F(z_0\star j)=0$, so $Sj\in\mathcal E$, and $v\in U_Sv_j$. Choosing one
representative $j$ for each cycle contained in $\mathcal E$, we obtain
\[
 \#\{v\in h_0Jv_0:\ N(v)=N(Gv)\le L\}
 \le\sum_{\text{cycles in }\mathcal E}\#\bigl(U_Sv_j\cap L\ball\bigr).
\]

By Theorem~\ref{thm:cuspcount} and \eqref{eq:width-cycle}, each term is
\[
 \frac{\omega\,\ell(Sj)}{[\Gamma:J][J:S]}\,\frac{\area(\ball)}{\zeta(2)}\,L^2+o_{U_S,v_j}(L^2),
\]
and the cycle lengths add up to $|\mathcal E|$. With \eqref{eq:E-measure},
\[
 \limsup_{L\to\infty}\frac1{L^2}\#\{v\in h_0Jv_0:\ N(v)=N(Gv)\le L\}
 \le\frac{\omega}{[\Gamma:J]}\frac{\area(\ball)}{\zeta(2)}\,
   \mu_Y\bigl(F\equiv0\pmod{3^n}\bigr)
\]
for every $n$. Letting $n\to\infty$ and using the decay \eqref{eq:localnull} proves
the bound \eqref{eq:orbit-goal} for the orbit $h_0Jv_0$, and Proposition~\ref{prop:fixed}
follows by summing over the finitely many orbits. \qed