\section{Reduction to finitely many primes}\label{sec:global}

In this section we show that for each $9\leq d\leq 22$ it is enough to rule out the primes in \Cref{table:local} below. We put $\kappa=2^{19}/325$, so that \Cref{prop:gonality} a) says that $\gon_\Q X_1(p)\geq 8(p^2-1)/\kappa$.

\subsection{Oesterl\'e's bound and a version at the prime \texorpdfstring{$2$}{2}}\label{sec:dyadic}
Let $\T\subseteq\operatorname{End}J_0(p)$ be the Hecke algebra generated over $\Z$ by the Hecke operators $T_n$, let $e\in H_1(X_0(p),\Q)$ be the winding element, i.e.\ the class of the path from $0$ to $i\infty$, let $I=\Ann_\T(e)$, and let
$$\pi:J_0(p)\to A=J_0(p)/IJ_0(p)$$
be the winding quotient. The group $A(\Q)$ is finite \cite[Theorem 2.2]{DKSS}. Following \cite[Definition 6.5]{DKSS} we put
$$T_n'=\sum_{m\mid n}\mu(n/m)T_m,\qquad L_n=T'_{2n}-2T_n'.$$
For an odd prime $M$ let $\varepsilon_M(a)=0$ if the representative of $a\in(\torz M)^\times$ in $\{1,\dots,M-1\}$ is less than $M/2$, and $\varepsilon_M(a)=1$ otherwise.

\begin{lemma}\label{lem:intersection}
Let $m\geq 1$, let $\ell$ be a prime, let $M>m$ be an odd prime, let $p>2mM$ be a prime, and let $u$ be such that $pu\equiv1\pmod M$. If the $m\times(M-1)$ matrix
$$\bigl(\varepsilon_M(na)-\varepsilon_M(nu/a)\bigr)_{1\leq n\leq m,\ a\in(\torz M)^\times}$$
has rank $m$ modulo $\ell$, then $T_1e,\dots,T_me$ are linearly independent in $\T e/\ell\T e$.
\end{lemma}

\begin{proof}
By \cite[Lemma 6.7]{DKSS} the entries of the matrix are, up to sign, the intersection numbers of $L_ne\in H_1(X_0(p),\Z)$ with the modular symbols $\{0,a/M\}$, so $L_1e,\dots,L_me$ are linearly independent in $H_1(X_0(p),\F_\ell)$. The $\Z$-span of $L_1,\dots,L_m$ is the same as that of $(T_2-3)T_1,\dots,(T_2-3)T_m$, and $(T_2-3)\T e\subseteq H_1(X_0(p),\Z)$ (see the proofs of \cite[Corollaries 6.4 and 6.6]{DKSS}). So if $\sum\lambda_nT_ne\in\ell\T e$ with $\lambda_n\in\Z$, then $\sum\lambda_n(T_2-3)T_ne\in\ell H_1(X_0(p),\Z)$, and hence all the $\lambda_n$ are divisible by $\ell$.
\end{proof}

\begin{definition}
Let $\ell$ be a prime and $d\geq1$. We say that a prime $p$ is \textit{$\ell$-admissible for $d$} if $p$ divides $\#E(\F_{\ell^f})$ for some elliptic curve $E$ over $\F_{\ell^f}$ with $f\leq d$, or if $p$ divides $\ell^f-1$ or $\ell^f+1$ for some $f<d$.
\end{definition}

\begin{lemma}\label{lem:onecusp}
Let $\ell\neq p$ be primes, let $K$ be a number field of degree $d$, let $E/K$ be an elliptic curve with a point $P$ of order $p$, and let $D_0$ be the trace divisor of the point $(E,\dm P)\in X_0(p)(K)$. If $p$ is not $\ell$-admissible for $d$, then $\overline{D_0}$ (the reduction modulo $\ell$) is $d$ times one of the two cusps of $X_0(p)_{\F_\ell}$.
\end{lemma}

\begin{proof}
Let $v$ be a prime of $K$ above $\ell$, with residue field $\F_{\ell^f}$. If $E$ had good reduction at $v$, then $P$ would reduce to a point of order $p$, so $E$ has bad reduction at $v$. The prime to $\ell$ torsion of $E(K_v)$ injects into the group of components when the reduction is additive, so as this group has order at most $4$, the reduction is multiplicative. If $P$ reduces to the identity component, then $p$ divides $\ell^f-1$ or $\ell^f+1$, so $f=d$, $v$ is the only prime above $\ell$, and over the unramified extension of $K_v$ over which $E$ is a Tate curve, $\dm P$ is the canonical subgroup $\mu_p$, so $(E,\dm P)$ reduces to the cusp $\infty$ at $v$. Otherwise $\dm P\neq\mu_p$, and $(E,\dm P)$ reduces to the cusp $0$ at $v$. Hence either all the points in the support of $D_0$ reduce to $0$, or there is just one prime above $\ell$ and they all reduce to $\infty$.
\end{proof}

The following proposition for odd $\ell$ is the argument of Oesterl\'e \cite[Section 6]{DKSS} (see also \cite[Theorem 4.18]{parentformal}). For $\ell=2$ it is new. The extra factor $2$ in $m=2d$ compensates for the two ways in which reduction modulo $2$ behaves worse than reduction modulo an odd prime: the kernel of reduction on rational torsion is only killed by $2$, and the cotangent lattice of the N\'eron model of $A$ may have index $2^r$ in its saturation. The second point is dealt with in the following lemma.

\begin{lemma}\label{lem:dyadic}
Let $m\geq1$, and let $p$ be a prime such that $T_1e,\dots,T_me$ are linearly independent in $\T e/2\T e$. Let $A_{\Z_2}$ be the N\'eron model of $A$ over $\Z_2$, let
$$f_m:X_0(p)^{(m)}\to A,\qquad D\mapsto\pi[D-m\infty],$$
and let $s_1,\dots,s_m$ be the elementary symmetric functions in the $q$-parameter at $\infty$, which are formal coordinates on $X_0(p)^{(m)}_{\Z_2}$ at $m\infty$. Then there are formal functions $g_1,\dots,g_m$ on $A_{\Z_2}$ at $0$, vanishing at $0$, such that
$$f_m^*g_i=2s_i+Q_i(s_1,\dots,s_m),\qquad Q_i\in(s_1,\dots,s_m)^2.$$
\end{lemma}

\begin{proof}
Let $S=H^0(X_0(p)_{\Z_2},\Omega^1)$, $M=S[I]$, and $L=\pi^*H^0(A_{\Z_2},\Omega^1)\subseteq M$. We first show that $2M\subseteq L$. This follows from a theorem of Raynaud \cite[Appendix A, Theorem A.1]{AU}, applied to the exact sequence $0\to IJ_0(p)\to J_0(p)\to A\to 0$ of abelian varieties with good reduction over $\Q_2$, whose ramification index is $1=2-1$: the cokernel of the map of tangent spaces of the N\'eron models over $\Z_2$ is killed by $2$ (compare \cite[Section 4.4]{ARS}). Dually, $L$ has index killed by $2$ in its saturation, which is $M$.

The pairing $\T\otimes\Z_2\times S\to\Z_2$, $(t,\omega)\mapsto a_1(t\omega)$, is perfect (see \cite[Lemma 2.1]{AU}), so $M\simeq\operatorname{Hom}(\T/I\otimes\Z_2,\Z_2)$. As $\T e\simeq\T/I$, our assumption implies that the map $M\to\Z_2^m$, $\omega\mapsto(a_1(\omega),\dots,a_m(\omega))$, is surjective, where $\omega=\sum a_n(\omega)q^{n-1}dq$ is the $q$-expansion at $\infty$.

The cotangent map of $f_m$ at $m\infty$ is $\omega\mapsto(a_1(\pi^*\omega),-a_2(\pi^*\omega),\dots,(-1)^{m-1}a_m(\pi^*\omega))$ \cite[Lemma 4.16]{parentformal}, so by the two previous paragraphs its image contains $2\Z_2^m$. Hence there are $g_1,\dots,g_m$ as required.
\end{proof}

\begin{proposition}\label{prop:dyadic}
Let $\ell$ be a prime, $d\geq1$, and put $m=d$ if $\ell$ is odd and $m=2d$ if $\ell=2$. Let $p\neq\ell$ be a prime such that $T_1e,\dots,T_me$ are linearly independent in $\T e/\ell\T e$. If $p\in S(d)$, then $p$ is $\ell$-admissible for $d$.
\end{proposition}

\begin{proof}
Suppose the opposite. By \Cref{lem:onecusp}, after applying the Atkin-Lehner involution if necessary, there is a non-cuspidal effective divisor $D_0$ of degree $d$ on $X_0(p)$, defined over $\Q$, with $\overline{D_0}=d\infty$. For $k\geq1$ let $f_k:X_0(p)^{(k)}\to A$, $D\mapsto\pi[D-k\infty]$. The point $f_d(D_0)\in A(\Q)$ is torsion and it reduces to $f_d(d\infty)=0$.

Suppose first that $\ell$ is odd. Then $f_d(D_0)=0$ by \Cref{lem:torsion} a), and $f_d$ is a formal immersion at $d\infty$ modulo $\ell$ by \cite[Theorem 4.18]{parentformal} (see \cite[Proposition 6.3]{DKSS}), so $D_0=d\infty$ by \cite[Lemma 4.2]{DKSS}, which is a contradiction.

Suppose now that $\ell=2$, so $m=2d$. Then $2f_d(D_0)=f_m(2D_0)=0$ by \Cref{lem:torsion} a). As $\overline{D_0}=d\infty$, the polynomial $E_{D_0}(t)=\prod_j(1-q_jt)$, where the $q_j$ are the values of $q$ at the points of $D_0$, has coefficients in $\Z_2$ and is congruent to $1$ modulo $2$. Hence $E_{2D_0}(t)=E_{D_0}(t)^2\equiv1\pmod 4$, i.e.\ all the coordinates $s_i(2D_0)$ are in $4\Z_2$, and as $D_0\neq d\infty$, not all of them are $0$. Let $k\geq2$ be the minimum of their valuations, attained at $s_i$, and let $g_i$ be as in \Cref{lem:dyadic}. Then $2s_i(2D_0)$ has valuation $k+1$, while $Q_i(s(2D_0))$ has valuation at least $2k>k+1$. Hence $g_i(f_m(2D_0))\neq0$, which contradicts $f_m(2D_0)=0$.
\end{proof}

\begin{remark}
In particular, if $p>(2^{d/2}+1)^2$ and $T_1e,\dots,T_{2d}e$ are linearly independent in $\T e/2\T e$, then $p\notin S(d)$, which is the analogue of Oesterl\'e's bound with $3$ replaced by $2$. Using Parent's estimate \cite[Proposition 1.9]{parentformal} instead of \Cref{lem:intersection}, the same argument should give $p\leq\max\{(2^{d/2}+1)^2,65(4d)^6\}$ for all $p\in S(d)$ (see the note \githubbare{dyadic/asymptotic_prime_bound.pdf}), but we do not need this.
\end{remark}

For $d\in\{9,10\}$ Oesterl\'e's bound $p\leq(3^{d/2}+1)^2$ \cite[Theorem 6.1]{DKSS} is smaller than $10^5$, and for the larger $d$ we use \Cref{prop:dyadic}.

\begin{corollary}\label{cor:bound}
Let $11\leq d\leq 22$, let $\ell$, $M$ and $B(d)$ be as in \Cref{table:bound}, and let $p\in S(d)$. Then $p\leq B(d)$, and if $p>10^5$, then $p$ is one of the $N(d)$ primes listed in \githubbare{large_primes.md}.
\end{corollary}

\begin{proof}
Let $m=d$ if $\ell$ is odd and $m=2d$ if $\ell=2$. We compute that the matrices of \Cref{lem:intersection} have rank $m$ modulo $\ell$ for all $u\in(\torz M)^\times$ (\gitlink{audit11/verify_large_odd_bound.py}{$d=11$}, \gitlink{degree12/prepare_bound.py}{$d=12$}, \gitlink{degree13/verify_dyadic.py}{$d\geq13$}), so by \Cref{prop:dyadic} every $p\in S(d)$ with $p>2mM$ is $\ell$-admissible for $d$, for each $\ell$ in the table. As $2mM<10^5$ in all cases, it remains to determine the admissible primes. An elliptic curve over $\F_{\ell^f}$ has at most $(\ell^{f/2}+1)^2$ points, and if its trace of Frobenius is divisible by $\ell$, it is supersingular, so $j=0$ for $\ell\in\{2,3,5\}$ and $j=1728$ for $\ell=7$, and we can list all the possible group orders. Note that an ordinary elliptic curve over $\F_{2^f}$ has a rational point of order $2$, so a prime $p$ dividing its order satisfies $2p\leq(2^{f/2}+1)^2$. For $d\geq 13$ this gives $p\leq B(d)$, and in all cases we \gitlink{degree22/verify_prime_coverage.py}{compute} the admissible primes above $10^5$.
\end{proof}

\begin{table}[H]
\centering
\begin{tabular}{rlllrr}
\toprule
$d$ & $\ell$ & $M$ & $2mM$ & $B(d)$ & $N(d)$\\
\midrule
$11$ & $3,5$ & $53,73$ & $1166,1606$ & $177989$ & $21$\\
$12$ & $3,5,7$ & $61,59,59$ & $1464,1416,1416$ & $532900$ & $92$\\
$13$ & $2$ & $157$ & $8164$ & $8374$ & $0$\\
$14$ & $2$ & $157$ & $8792$ & $16641$ & $0$\\
$15$ & $2$ & $157$ & $9420$ & $33131$ & $0$\\
$16$ & $2$ & $157$ & $10048$ & $66049$ & $0$\\
$17$ & $2$ & $181$ & $12308$ & $66049$ & $0$\\
$18$ & $2$ & $181$ & $13032$ & $263169$ & $81$\\
$19$ & $2$ & $181$ & $13756$ & $525313$ & $196$\\
$20$ & $2$ & $229$ & $18320$ & $525313$ & $444$\\
$21$ & $2$ & $229$ & $19236$ & $1050024$ & $850$\\
$22$ & $2$ & $229$ & $20152$ & $2099200$ & $1488$\\
\bottomrule
\end{tabular}
\medskip
\caption{The primes $\ell$ and moduli $M$ used in \Cref{lem:intersection}, the resulting bound $B(d)$ for the primes in $S(d)$, and the number $N(d)$ of admissible primes in $(10^5,B(d)]$. For $d\in\{11,12\}$, $B(d)$ is Oesterl\'e's bound.}
\label{table:bound}
\end{table}

\subsection{The results of Derickx and Stoll}
We will use the following two results of Derickx and Stoll, which we state in our notation (see \Cref{lem:torsion}). For $d\geq 1$, let $S_{new}(d)$ be the set of primes $p$ such that $X_1(p)$ has a non-cuspidal closed point of degree $d$, so that $S(d)=\bigcup_{d'\mid d}S_{new}(d')$.

\begin{proposition}[{\cite[Corollary 7.5]{DSt}}]\label{prop:DS75}
Let $d\geq1$ and $p\in S_{new}(d)$. Then one of the following holds:
\begin{itemize}
\item[a)] $p^2\leq \kappa d+1$,
\item[b)] $d$ is even and $p\in\{2d+1,3d+1\}$,
\item[c)] $(p-1)/(2\str(p))$ divides $d$, and the image of the point on $X_H$, where $H\subseteq\Delta(p)$ is the subgroup of order $(p-1)/(2\str(p))$, has degree $2\str(p)d/(p-1)$.
\end{itemize}
\end{proposition}

\begin{proposition}[{\cite[Proposition 4.1]{DSt}}]\label{prop:DS41}
Let $a\in\Delta(p)$ and $\ell\in\{2,3\}$, and put $n=2\ell+1$ if $a\in\{\ell,\ell^{-1}\}$ and $n=2\ell+2$ otherwise. Suppose that $(\dm a-1)J_1(p)(\Q)$ is finite and, if $\ell=2$, that its $2$-primary part is killed by $A_2$. Let $D$ be an effective divisor of degree $d$ on $X_1(p)$, defined over $\Q$, with no cusps in its support. If $nd<\gon_\Q X_1(p)$, then $\dm aD=D$. The same holds with $X_1(p)$ replaced by $X_H$ for a subgroup $H\subseteq\Delta(p)$ and $a\in\Delta(p)/H$.
\end{proposition}

By \Cref{lem:torsion} b) the assumption for $\ell=2$ holds if $p\leq 157$. For larger $p$ we use the following lemma.

\begin{lemma}\label{lem:oddiso}
Let $h\in\Delta(p)$ be such that $(h-1)J_1(p)(\Q)$ is finite, and suppose that there is an endomorphism $\beta$ of $J_1(p)$ which kills $J_1(p)(\Q)_\tor$ and restricts to an isogeny of odd degree on $B=(h-1)J_1(p)$. Then $(h-1)J_1(p)(\Q)$ has odd order.
\end{lemma}

\begin{proof}
The group $(h-1)J_1(p)(\Q)$ is contained in $B(\Q)$ and is killed by $\beta$.
\end{proof}

We will apply this lemma with $\beta=A_3$, or a combination of several $A_q$ with $q$ odd. To show that $A_3$ has odd degree on $B$ we compute its determinant on the rational homology of $B$, which is the sum of the components of $H_1(X_1(p),\Q)$ belonging to the characters $\chi$ with $\chi(h)\neq1$, and on each of them the determinant is an element of the field of values of $\chi$ whose norm is odd.

\subsection{Primes above \texorpdfstring{$10^5$}{100000}}\label{sec:large}

\begin{lemma}\label{lem:screen}
Let $p$ be a prime with $p^2>\kappa d+1$ and $p\notin\{2d'+1,3d'+1\}$ for all $d'\mid d$, let $m=(p-1)/2$, and let $r$ be a prime with $v_r(m)>v_r(d)$. If no even character modulo $p$ whose order $n$ satisfies $v_r(n)\geq v_r(m)-v_r(d)$ is strange, then $p\notin S(d)$.
\end{lemma}

\begin{proof}
The strange characters generate a cyclic group of order $\str(p)$, and by assumption $v_r(\str(p))<v_r(m)-v_r(d)$. Hence $v_r(m/\str(p))>v_r(d)$, so $m/\str(p)$ does not divide any divisor $d'$ of $d$, and the result follows from \Cref{prop:DS75}.
\end{proof}

To show that a character is not strange we use the method of \cite[Section 5]{DSt}, made rigorous as follows.

\begin{lemma}\label{lem:nonstrange}
Let $\chi$ be a non-trivial even character modulo $p$ of order $n$, and let $q\nmid 6p(p-1)$ be a prime with $q\equiv1\pmod n$, so $\chi$ takes values in $\F_q$. Let $V$ be the plus part of the space of modular symbols of weight $2$, level $p$ and character $\chi$ over $\F_q$, let $V_0\subseteq V$ be its cuspidal subspace, of dimension $k$, and let $e'=(T_2-1-2\chi(2))(T_2-2-\chi(2))\{0,\infty\}$, which lies in $V_0$. If $e',T_2e',\dots,T_2^{k-1}e'$ are linearly independent, then $\chi$ (and every character of order $n$) is not strange.
\end{lemma}

\begin{proof}
The space $V$ and the action of $T_2$ are the reductions of their analogues over the ring of integers of $\Q(\chi)$ localized at a prime above $q$, so the corresponding vectors in characteristic $0$ are linearly independent as well. Hence $e'$ generates the cuspidal part as a module over the Hecke algebra, so its projection to the eigenspace of every newform $f$ with character $\chi$ is non-zero. This projection is a non-zero multiple of $L(f,1)$, so $L(f,1)\neq0$. The characters of order $n$ are Galois conjugate.
\end{proof}

In practice we take a random linear functional $\lambda$ on $V_0$ and check that the sequence $\lambda(T_2^ie')$, $0\leq i<2k$, has linear complexity $k$, i.e.\ that it does not satisfy a linear recurrence of length less than $k$, which implies the assumption of \Cref{lem:nonstrange}. We certify the linear complexity by a rational function $\phi/\psi$ with $\psi(0)=1$, $\deg\psi\leq k$, $\deg\phi<k$, $\max(\deg\psi,\deg\phi+1)=k$, $\gcd(\phi,\psi)=1$, and $\psi\cdot\sum_i\lambda(T_2^ie')x^i\equiv\phi\pmod{x^{2k}}$. For $p$ up to $2.1\cdot10^6$ the dimension $k$ is close to $p/12$, so these are large sparse computations, for which we wrote our own implementation (see \Cref{sec:computations}).

\begin{proposition}\label{prop:large}
Let $9\leq d\leq 22$ and $p>10^5$. Then $p\notin S(d)$.
\end{proposition}

\begin{proof}
For $d\leq 10$ this follows from Oesterl\'e's bound, and for $13\leq d\leq 17$ from \Cref{cor:bound}. For the other $d$, let $p$ be one of the $N(d)$ primes of \Cref{cor:bound}. For each of them we choose $r$ as in \Cref{lem:screen} and show, using \Cref{lem:nonstrange}, that no character of the required orders is strange. This requires $73$, $656$, $615$, $1147$, $3020$, $5289$ and $10065$ character orders for $d=11,12,18,19,20,21,22$, respectively, many of which are shared between the degrees (\gitlink{audit11/large_order.m}{$d=11$}, \gitlink{degree12/large_order.m}{$d=12$}, \gitlink{degree18/large_order.m}{$d=18$}, \gitlink{degree22/verify_large_simd.py}{$d\geq19$}). The result follows from \Cref{lem:screen}.
\end{proof}

Michael Stoll has sent us the list of the strange characters modulo all primes $p<4\cdot10^5$ (private communication), which extends \cite[Table 2]{DSt}, and this gives an independent check of \Cref{prop:large} for $p<4\cdot10^5$. Using his list, we \gitlink{stoll/check_stoll.py}{compute} that $(p-1)/(2\str(p))\geq 4787$ for all primes $10^5<p<4\cdot10^5$, so by \Cref{prop:DS75} none of them is in $S(d)$ for $d\leq 22$. As $B(11)$ and $B(18)$ are smaller than $4\cdot10^5$, together with \Cref{cor:bound} this gives a proof of \Cref{prop:large} for $d\in\{11,18\}$ which does not use \Cref{lem:nonstrange}. Moreover, none of the $5450$ pairs $(p,n)$ with $p<4\cdot10^5$ for which we showed in the proof of \Cref{prop:large} that the characters of order $n$ modulo $p$ are not strange appears in his list. Note that his list does not cover the primes above $4\cdot10^5$, which we need for $d=12$ and $19\leq d\leq 22$.

\subsection{Primes below \texorpdfstring{$10^5$}{100000}}\label{sec:medium}
For three primes above $157$ we check the $2$-primary assumption of \Cref{prop:DS41} as follows.

\begin{lemma}\label{lem:oddorder}
Let $(p,a)$ be one of $(163,8)$, $(167,2)$ and $(181,64)$. Then $(\dm a-1)J_1(p)(\Q)$ is finite and has odd order.
\end{lemma}

\begin{proof}
The group is finite by \Cref{lem:finite}, as $163$ and $167$ are not strange, and $\dm{64}$ is trivial on the characters of order $6$ modulo $181$, which are the strange ones. For $p\in\{163,167\}$ we \gitlink{degree19/odd_anti163_character_norms.m}{compute} (\gitlink{degree20/anti167.m}{$p=167$}) that $A_3$ restricts to an isogeny of odd degree on $(\dm a-1)J_1(p)$, so \Cref{lem:oddiso} applies with $\beta=A_3$. For $p=181$ the operator $A_3$ has even degree on some components, and we use instead $\beta=EA_{11}+(45-E)A_3$, where $u=\dm2^2$ (of order $45$) and $E=5N_{u^5}-N_u$, $N_g$ denoting the sum of the powers of $g$. On the components of $H_1(X_1(181),\Q)$ belonging to characters of order $5$ and $10$, $E$ acts as $45$, and on the other components of $(\dm{64}-1)J_1(181)$ it acts as $0$. We \gitlink{degree21/anti181.m}{compute} that $A_{11}$, respectively $A_3$, has odd determinant on these components, so \Cref{lem:oddiso} applies.
\end{proof}

\begin{proposition}\label{prop:medium}
Let $9\leq d\leq 22$, and let $p<10^5$ be a prime which is neither one of the primes listed for $d$ in \Cref{thm:main} nor one of the primes listed for $d$ in \Cref{table:local}, and such that $(d,p)\notin\{(14,127),(16,127),(16,193)\}$. Then $p\notin S(d)$.
\end{proposition}

\begin{proof}
Let $p\in S_{new}(d')$ for some $d'\mid d$. If $p^2>\kappa d+1$, then by \Cref{prop:DS75} and \cite[Table 2]{DSt}, and as $(d,p)\neq(16,193)$, $p$ is one of $181$ (for $d=15$), $409$ and $1021$ (for $d=17$). We \gitlink{degree22/verify_prime_coverage.py}{check} this for all $p<10^5$, using that the possible exceptions b) of \Cref{prop:DS75} are in $S(d)$. For these three primes we have $(p-1)/(2\str(p))=d$, so \Cref{prop:DS75} c) gives a non-cuspidal rational point on $X_0(p)$, which does not exist by Mazur's theorem \cite[Theorem 1]{mazur78}.

The remaining primes satisfy $p^2\leq \kappa d+1$, and as $(d,p)\notin\{(14,127),(16,127)\}$, they are either in \Cref{table:local} or in \Cref{table:medium}. For $(p,a,\ell,n)$ and $d$ as in \Cref{table:medium}, the assumptions of \Cref{prop:DS41} hold: $(\dm a-1)J_1(p)(\Q)$ is finite by \Cref{lem:finite} (the only strange $p$ in the table is $181$, and $\dm a$ is trivial on the characters of order $6$ modulo $181$), the gonality bound holds by \Cref{prop:gonality} a) (for $p\in\{163,173\}$ and $d=22$ we need its second bound), and the $2$-primary assumption holds by \Cref{lem:torsion} b) for $p\leq 157$ and by \Cref{lem:oddorder} for the larger $p$ with $\ell=2$. Hence the trace divisor $D$ of degree $d'$ is invariant under $\dm a$. As $p>67$, \Cref{lem:orbits} shows that the orbits of $\dm a$ on its support have length $\ord(a)$, which is listed in \Cref{table:medium} and does not divide $d'$. This is a contradiction.
\end{proof}

\begin{table}[H]
\centering
\begin{tabular}{rrrrlr}
\toprule
$p$ & $a$ & $\ell$ & $n$ & $d$ & $\ord(a)$\\
\midrule
$103$ & $2$ & $2$ & $5$ & $9,10$ & $51$\\
$107$ & $2$ & $2$ & $5$ & $9$--$11$ & $53$\\
$109$ & $2$ & $2$ & $5$ & $9$--$11$ & $18$\\
$113$ & $2$ & $2$ & $5$ & $9$--$12$ & $14$\\
$127$ & $2$ & $2$ & $5$ & $10$--$13$, $15$ & $7$\\
$131$ & $2$ & $2$ & $5$ & $11$--$17$ & $65$\\
$137$ & $2$ & $2$ & $5$ & $12$--$18$ & $34$\\
$139$ & $2$ & $2$ & $5$ & $12$--$19$ & $69$\\
$149$ & $2$ & $2$ & $5$ & $14$--$22$ & $74$\\
$151$ & $6$ & $2$ & $6$ & $15$ & $75$\\
$151$ & $2$ & $2$ & $5$ & $16$--$22$ & $15$\\
$157$ & $2$ & $2$ & $5$ & $16$--$22$ & $26$\\
$163$ & $3$ & $3$ & $7$ & $17,18$ & $81$\\
$163$ & $8$ & $2$ & $6$ & $19$--$22$ & $27$\\
$167$ & $3$ & $3$ & $7$ & $18,19$ & $83$\\
$167$ & $2$ & $2$ & $5$ & $20$--$22$ & $83$\\
$173$ & $3$ & $3$ & $7$ & $19$--$22$ & $86$\\
$179$ & $3$ & $3$ & $7$ & $20$--$22$ & $89$\\
$181$ & $64$ & $2$ & $6$ & $21,22$ & $15$\\
\bottomrule
\end{tabular}
\medskip
\caption{The applications of \Cref{prop:DS41}. Here $\ord(a)$ is the order of $a$ in $\Delta(p)$.}
\label{table:medium}
\end{table}

\begin{lemma}\label{lem:gon127}
Let $Y=X_1(127)/\dm2$, where $\dm2$ has order $7$. Then $\gon_\Q Y\geq20$.
\end{lemma}

\begin{proof}
We \gitlink{degree14/quotient127.m}{compute} that $X_1(127)_{\F_2}$ has $48$ supersingular closed points of degree $14$, each fixed by $\dm2$, and that they map to $48$ distinct closed points of degree $2$ on $Y_{\F_2}$. Hence $\#Y(\F_4)\geq96$, so $\gon_{\F_4}Y\geq96/5$, and $\gon_\Q Y\geq\gon_{\F_2}Y\geq\gon_{\F_4}Y\geq20$.
\end{proof}

\begin{proposition}\label{prop:127medium}
We have $127\notin S(14)$ and $127\notin S(16)$.
\end{proposition}

\begin{proof}
Let $d\in\{14,16\}$, and suppose that $127\in S(d)$. As $127\notin S(d')$ for $d'\leq 8$, there is a trace divisor $D$ of a point of order $127$ over a number field of degree $d$ which is a closed point of degree $d$. Note that $\ord(\dm2)=7$, that $127$ is not strange, and that $\gon_\Q X_1(127)\geq84>5d$ by \Cref{prop:gonality} a). So \Cref{prop:DS41} with $(a,\ell,n)=(2,2,5)$ applies (the $2$-primary assumption holds by \Cref{lem:torsion} b)), and $D$ is $\dm2$-invariant. By \Cref{lem:orbits} its support consists of orbits of length $7$, so $d=14$, and $D$ is a pullback from $Y=X_1(127)/\dm 2$, of an effective divisor $D'$ of degree $2$. The image of $\dm 3$ in $\Delta(127)/\dm2$ has order $9$, $(\dm3-1)J_Y(\Q)$ is finite by \Cref{lem:finite}, and $\gon_\Q Y\geq20>7\cdot2$ by \Cref{lem:gon127}, so \Cref{prop:DS41} on $Y$ with $(a,\ell,n)=(3,3,7)$ shows that $D'$ is a sum of $\dm3$-orbits. These have length $9$ or $3$, which is a contradiction.
\end{proof}

\begin{proposition}\label{prop:193}
We have $193\notin S(16)$.
\end{proposition}

\begin{proof}
Suppose the opposite. As $193\notin S(d')$ for $d'\leq 8$, we have $193\in S_{new}(16)$. As $\str(193)=12$ \cite[Table 2]{DSt}, \Cref{prop:DS75} shows that the image of the point on $Y=X_H$, where $H\subseteq\Delta(193)$ is the subgroup of order $8$, is a non-cuspidal point $y$ of degree $2$. If $y$ had non-cuspidal reduction modulo $2$, then a point above it on $X_1(193)_{\F_2}$ would have degree at most $16$ and $j$-invariant in $\F_4$, and we \gitlink{degree16/census193.m}{compute} that there are no such points. The non-rational cusps of $Y_{\F_2}$ have degree $6$, so the trace divisor of $y$ reduces to a sum of two rational cusps of $Y$. We \gitlink{degree16/quotient193.m}{compute} an element $\alpha$ of the Hecke algebra of $J_Y$ with $\alpha J_Y(\Q)$ finite, and check that $f_{t,2}$ with $t=\alpha A_3$ is a formal immersion at all these divisors. As $t(J_Y(\Q))=0$ by \Cref{lem:torsion} b), \Cref{lem:fi} b) shows that the trace divisor of $y$ is a rational cuspidal divisor, which is a contradiction.
\end{proof}

\begin{table}[H]
\centering
\begin{tabular}{rl}
\toprule
$d$ & primes $p$ treated in \Cref{sec:local,sec:exceptions}\\
\midrule
$9$ & $37,41,43,47,53,59,61,67,71,73,79,83,89,97,101$\\
$10$ & $41,43,47,53,59,61,67,71,73,79,83,89,97,101$\\
$11$ & $37,41,43,47,53,59,61,67,71,73,79,83,89,97,101,103$\\
$12$ & $41,47,53,59,61,67,71,73,79,83,89,97,101,103,107,109$\\
$13$ & $41,43,47,53,\dots,113$\\
$14$ & $47,53,\dots,113$\\
$15$ & $41,47,53,\dots,113$\\
$16$ & $41,43,47,53,\dots,113$\\
$17$ & $47,53,\dots,113,127$\\
$18$ & $47,53,\dots,113,127,131$\\
$19$ & $47,53,\dots,113,127,131,137$\\
$20$ & $53,59,67,71,\dots,113,127,131,137,139$\\
$21$ & $53,59,61,67,\dots,113,127,131,137,139$\\
$22$ & $59,61,71,73,\dots,113,127,131,137,139$\\
\bottomrule
\end{tabular}
\medskip
\caption{The primes that remain after \Cref{prop:large,prop:medium,prop:127medium,prop:193}. Here $53,\dots,113$ denotes all the primes from $53$ to $113$.}
\label{table:local}
\end{table}