\documentclass[11pt,reqno]{amsart}
\usepackage[T1]{fontenc}
\usepackage{lmodern}
\usepackage{amsmath,amssymb,amsthm,mathtools}
\usepackage{microtype}
\usepackage{enumitem}
\usepackage{booktabs}
\usepackage{xcolor}
\usepackage[colorlinks=true,linkcolor=blue!45!black,citecolor=blue!45!black,urlcolor=blue!45!black]{hyperref}
\hypersetup{
 pdftitle={Watkins's conjecture for elliptic curves with rational two-torsion},
 pdfauthor={Qiyue Tang},
 pdfsubject={Watkins's conjecture},
 pdfkeywords={elliptic curves, modular degree, rational two-torsion}}
\usepackage[margin=1.12in]{geometry}
\newcommand{\Q}{\mathbb Q}
\newcommand{\Z}{\mathbb Z}
\newcommand{\F}{\mathbb F}
\newcommand{\C}{\mathbb C}
\newcommand{\OO}{\mathcal O}
\DeclareMathOperator{\Gal}{Gal}
\DeclareMathOperator{\Hom}{Hom}
\DeclareMathOperator{\Sel}{Sel}
\DeclareMathOperator{\rank}{rank}
\DeclareMathOperator{\Spec}{Spec}
\DeclareMathOperator{\Spf}{Spf}
\DeclareMathOperator{\im}{im}
\DeclareMathOperator{\Ker}{ker}
\DeclareMathOperator{\Pic}{Pic}
\DeclareMathOperator{\Jac}{Jac}
\DeclareMathOperator{\ord}{ord}
\DeclareMathOperator{\Tr}{Tr}
\DeclareMathOperator{\Nm}{Nm}
\DeclareMathOperator{\End}{End}
\DeclareMathOperator{\GL}{GL}
\newtheorem{theorem}{Theorem}[section]
\newtheorem{proposition}[theorem]{Proposition}
\newtheorem{lemma}[theorem]{Lemma}
\newtheorem{corollary}[theorem]{Corollary}
\theoremstyle{remark}
\newtheorem{remark}[theorem]{Remark}
\numberwithin{equation}{section}
\setlist[enumerate]{label=\textup{(\roman*)},leftmargin=2em}
\setlength{\emergencystretch}{2em}
\title[Watkins's conjecture and rational two-torsion]{Watkins's conjecture for elliptic curves\\with rational two-torsion}
\author{Qiyue Tang}
\address{Zhili College, Tsinghua University, Beijing 100084, China}
\email{tangqy24@mails.tsinghua.edu.cn}
\date{November 10, 2026}
\subjclass[2020]{11G05, 11G18, 11G40, 14G35}
\keywords{Elliptic curve, modular degree, rational two-torsion, quadratic twist, Watkins's conjecture}
\begin{document}
\begin{abstract}
We prove that the modular degree of every elliptic curve \(E/\Q\)
with \(E(\Q)[2]\ne0\) is divisible by \(2^{\rank E(\Q)}\).
\end{abstract}
\maketitle
\section{Introduction}\label{sec:introduction}

For an elliptic curve \(E/\Q\) of conductor \(N\), the modularity
theorem gives a nonconstant morphism \(X_0(N)\to E\) defined over
\(\Q\) \cite{Modularity}. Its least possible degree, denoted by
\(m_E\), is the modular degree of \(E\). This invariant is related
to congruences between modular forms \cite{ARS}. In 2002, Watkins
developed a method for computing it in large families using the
Rankin--Selberg formula relating the modular degree to a special
value of the symmetric-square \(L\)-function. He attributes this
formula to Shimura's work, in the form given by Flach
\cite[Section~1]{Watkins}. The analogy with class-number formulas
suggested studying prime divisors of the modular degree. His
computations revealed a further dependence of its divisibility
by powers of two on the Mordell--Weil rank. These observations
led to his conjecture \cite[Conjecture~4.1]{Watkins} that
\[
                 2^{\rank E(\Q)}\mid m_E.
\]
We prove this divisibility for elliptic curves with nontrivial
rational two-torsion.

\begin{theorem}\label{thm:main}
Let \(E/\Q\) be an elliptic curve, let \(N\) be its conductor, and put
\(r=\rank E(\Q)\). If \(E(\Q)[2]\ne0\), then
\[
                  2^r\mid\deg(\phi)
\]
for every nonconstant \(\Q\)-morphism \(\phi:X_0(N)\to E\).
In particular, \(2^r\mid m_E\).
\end{theorem}

The parity of the modular degree was an early focus. Stein and
Watkins determined it for the Neumann--Setzer curves in 2004
\cite{SW}. Calegari and Emerton subsequently obtained restrictions
on the conductor and the residual
representation, and proved that the analytic rank is even
\cite[Theorem~1.1]{CE}. Their argument includes a multiplicity-one
theorem at two. Yazdani studied the corresponding congruence number
using the rational cuspidal subgroup \cite{Yazdani}. Kazalicki and
Kohen proved that odd congruence number forces Mordell--Weil rank
zero, with the corrected statement given in their 2019 corrigendum
\cite{KK,KKcorr}. Since congruence number and modular degree
have the same parity when \(4\nmid N\), this settles the
odd-modular-degree case under that hypothesis. More recently,
Kazalicki and Slijep\v{c}evi\'c obtained divisibility by four for
positive-rank curves of prime conductor and root number \(+1\),
proving Watkins's conjecture for the rank-two curves in this class
\cite{KS}.

A deformation-theoretic approach was introduced by Dummigan in
2006 \cite{Dummigan}. Dummigan and Krishnamoorthy corrected the
original Selmer-group comparison and extended the approach to
modular abelian varieties \cite[Proposition~8.2]{DK}.
The original comparison lost one factor of two; see the discussion
in \cite{Allen}. The method compares a two-Selmer group with a cotangent space of
a deformation ring, and then relates this space to a congruence
ideal through a suitable complete-intersection \(2\)-adic \(R=T\)
theorem. Allen carries out this approach for curves with
\(E(\Q)[2]=0\), \(2\parallel N\), and odd valuation of the minimal
discriminant at every prime of multiplicative reduction
\cite{Allen}. His lower bound incorporates both the two-Selmer
rank and the number of prime divisors of the conductor.

For curves with rational two-torsion, quadratic twists provide
another approach. In 2021, Esparza-Lozano and Pasten proved that, for each
fixed \(E\) with \(E(\Q)[2]\ne0\), Watkins's conjecture holds for
twists by fundamental discriminants with sufficiently many prime
divisors \cite{ELP}. Their effective threshold gives the conjecture
for a density-one subset of each such twist family. Caro subsequently
proved it for every quadratic twist of a curve with rational
two-torsion and prime-power conductor \cite{Caro}; these families
include the congruent-number curves.

Caro and Pasten proved the conjecture for semistable curves with
exactly one rational point of order two when the number of primes
of non-split multiplicative reduction is odd, or when all bad primes
have non-split multiplicative reduction \cite{CP}.
Bhakta, Krishnamoorthy, and Pasupulati obtained further semistable
cases, including curves with full rational two-torsion, under
additional hypotheses involving reduction, the two-torsion in the
Tate--Shafarevich group, or rank parity
\cite[Theorem~3.6]{BKP}. Bhakta and
Krishnamoorthy obtained quantitative results for families with
rational torsion, including a positive proportion of curves with
rational two-torsion ordered by height \cite{BK}. Hatley and Kundu
studied curves with rational two-torsion and conductor \(2^m p\),
and established the conjecture for specified prime twists of these
curves \cite{HK}. Their work treats additive reduction at two
together with multiplicative reduction at an odd prime.

Our proof compares two-isogeny descent with quadratic twists having
a common Atkin--Lehner character. At odd additive primes, the local
descent conditions contain a matrix of Legendre symbols. Its rank
decreases the rank bound, while its kernel parametrizes the twist
family. Character sums of the corresponding oldforms produce
differentials divisible by powers of two. These differentials lie
in the cotangent lattice of the same quotient through which the
original modular parametrization factors. Pullback under the dual
homomorphism supplies a divisor of the remaining map degree.
The semistable equality case is completed by specialization at two
and a parity calculation with CM fixed points on the quotient.

For \(v_2(N)\le1\), integrality follows from the good or semistable
model of the modular curve. For additive reduction at two, we use
the dyadic normalizer and divide morphisms over number fields
unramified at two. The integral lifting argument follows the method
of Chi, Liu, and Nie \cite{CLN}. Section~\ref{sec:lifting} proves the
number-field lifting and component statements used here, from the
unbounded-denominators theorem of Calegari, Dimitrov, and Tang
\cite{CDT}, the connectedness of Igusa curves \cite{KM}, and the
local Manin-constant theorem of \v{C}esnavi\v{c}ius \cite{Ces}.
It also proves the required oddness of the optimal Manin constant.
When every odd additive prime is removable by twisting, an exact
Petersson-norm formula completes the comparison. The final step
passes from the optimal curve to every target in its rational
isogeny class.

\subsection{Notation and normalization}

Write \(v_p\) for the valuation with \(v_p(p)=1\), and \(\omega(n)\)
for the number of distinct prime divisors of \(n\).
The identity point of an elliptic curve is denoted by \(O\),
and \(L(E,s)\) is its Hasse--Weil \(L\)-function.
For a number field \(K\), write \(\OO_K\) for its ring of integers.
Let \(\mathfrak H=\{z\in\C:\operatorname{Im}z>0\}\).
Under reduction \(\mathrm{SL}_2(\Z)\to\mathrm{SL}_2(\Z/N\Z)\),
the inverse images of the upper-triangular, upper-unipotent, and trivial
subgroups are denoted by \(\Gamma_0(N)\), \(\Gamma_1(N)\), and \(\Gamma(N)\),
respectively. We write
\(\mathcal E^0\) for the identity component of a N\'eron model and
\(E^0(K)\) for its points over a local field \(K\).
For an odd prime \(p\), put
\[
 p^*=(-1)^{(p-1)/2}p,\qquad
 [u/p]=\begin{cases}0&(u/p)=1,\\1&(u/p)=-1.\end{cases}
\]
The bracket is used only when \(p\nmid u\).
The quadratic character attached to a discriminant \(D\) is
\(\chi_D\), and \(E^{(D)}\) is the quadratic twist.
For an abelian variety \(A/\Q\), let \(\mathcal A\) be its
N\'eron model and \(e\) its identity section. Write
\(\Omega(A)=e^*\Omega^1_{\mathcal A/\Z}\) for its lattice of
invariant differentials. For a curve \(Y\),
we identify \(\Omega(J_Y)\otimes\Q\) with
\(H^0(Y,\Omega_Y^1)\), where \(J_Y=\Jac(Y)\).
Over a number field the analogous notation is used locally at
each finite place.
For an elliptic curve \(C/\Q\), let \(\Delta_C\) denote its
minimal discriminant and let
\(c_p(C)=[C(\Q_p):C^0(\Q_p)]\) be its Tamagawa number.

Put \(q=e^{2\pi iz}\). For a cusp form \(g\), write \(a_n(g)\)
for its coefficient of \(q^n\). Let
\(f_E=\sum_{n\ge1}a_nq^n\), \(a_1=1\), be the newform of \(E\),
where \(a_n=a_n(f_E)\). The Petersson pairing at weight two is
\[
 \langle g_1,g_2\rangle_N
 =\int_{\Gamma_0(N)\backslash\mathfrak H}
       g_1(z)\overline{g_2(z)}\,dx\,dy,\qquad z=x+iy.
\]
We identify a weight-two cusp form \(f\) with the differential
\(f(q)\,dq/q\). A minimal modular parametrization is normalized by
\(\phi(\infty)=O\), and its Manin constant is defined, up to sign, by
\[
                 \phi^*\omega_E=c_Ef_E(q)\frac{dq}{q},
\]
where \(\omega_E\) is a global minimal N\'eron differential.
Changing the sign of \(\omega_E\) lets us take \(c_E>0\).
For a general morphism, its pullback differential determines its multiplier.

Atkin--Lehner involutions are indexed by exact divisors \(d\mid N\),
that is, \((d,N/d)=1\). Their group is denoted by \(W\). Its character
on \(f_E\) is \(\varepsilon:W\to\{\pm1\}\).
Write \(J_0(N)=\Jac(X_0(N))\).
The arithmetic form \(X_\mu(N)\) of \(X_1(N)\) parametrizes a
subgroup with a specified embedding of \(\mu_N\); this form has the
rational Tate cusp used in the lifting argument.

\begin{lemma}\label{lem:optimal-reduction}
It suffices to prove Theorem~\ref{thm:main} for a positive-rank
optimal elliptic quotient of \(J_0(N)\), with its optimal
parametrization.
\end{lemma}
\begin{proof}
Rank zero is immediate. A map to \(E\), after translation at
\(\infty\), induces a homomorphism \(J_0(N)\to E\). The newform
quotient with connected kernel is an elliptic curve \(E_0\);
the homomorphism factors through an isogeny \(E_0\to E\).
The factorization follows either from the connected-kernel
quotient or from the multiplicity-one decomposition of \(J_0(N)\)
at the newform of exact level \(N\). Thus degrees multiply.
This also applies to any larger-degree map to \(E_0\).

The existence of rational two-torsion is invariant under rational
isogeny. Indeed, a minimum-degree isogeny between two fixed curves
has cyclic kernel: a noncyclic finite subgroup of an elliptic
curve contains the full \(E[\ell]\) for some prime \(\ell\), and
factoring through \([\ell]\) would reduce the degree.
An odd isogeny preserves the rational two-torsion. If a cyclic
isogeny has even degree, both its kernel and its dual kernel have
a unique order-two subgroup, which is rational. In particular,
the optimal curve has a nonzero rational point of order two.
Ranks are invariant under isogeny. These facts prove the reduction.
\end{proof}

\subsection{Translations and degree on a quotient}

Let \(w\) be an automorphism with
\(w^*f_E=\varepsilon(w)f_E\), where \(\varepsilon(w)\in\{1,-1\}\).
Equality of differentials gives
\begin{equation}\label{eq:translation}
              \phi w=\varepsilon(w)\phi+t_w,
              \qquad t_w=\phi(w\infty).
\end{equation}
Write \(t(w)=t_w\), and \(t_d=t_{w_d}\) for an exact divisor \(d\).
The restriction of \(t\) to \(H=\ker\varepsilon\) is a
homomorphism. For an involution in \(H\), its image is killed by two.
Atkin--Lehner translations are rational cuspidal torsion
by the Manin--Drinfeld theorem \cite{Manin,Drinfeld}.
We shall also use the vanishing
\begin{equation}\label{eq:fricke-zero}
 r>0\quad\Longrightarrow\quad L(E,1)=0
       \quad\Longrightarrow\quad t_{w_N}=\phi(0)=O.
\end{equation}
The first implication is the contrapositive of the analytic-rank-zero
theorem \cite{Kolyvagin}; the second follows by integrating the
newform from \(i\infty\) to \(0\). The vanishing integral gives \(\phi(0)=O\).

We record a polarization calculation used in both integral arguments.
Suppose that \(\phi=\psi\pi\), where \(\pi:X_0(N)\to Y\) is a
quotient, and let \(i:E\to J_Y\) be the dual of
\(\psi_*:J_Y\to E\). Then
\begin{equation}\label{eq:polarization-degree}
                  \psi_*i=[\deg\psi].
\end{equation}
If \(f_Y\) denotes the descent of \(f_E(q)dq/q\), then
\(\psi^*\omega_E=c_Ef_Y\), and hence
\begin{equation}\label{eq:orthogonal-degree}
 i^*\left(\frac{f_Y+g_Y}{2^b}\right)
       =\frac{\deg\psi}{c_E2^b}\,\omega_E
\end{equation}
for \(b\in\Z\) and a holomorphic differential \(g_Y\) orthogonal
to \(f_Y\) for the Petersson, or
equivalently the polarization, pairing. The vanishing on \(g_Y\)
is the adjointness of pullback and trace. Pullback from \(Y\)
multiplies this pairing by \(\deg\pi\), so orthogonality proved
on \(X_0(N)\) descends to \(Y\). If the differential on
the left belongs to the N\'eron cotangent lattice of \(J_Y\),
then the coefficient on the right is in \(\Z_2\), because
homomorphisms extend to N\'eron models. When \(c_E\) is odd this
implies \(v_2(\deg\psi)\ge b\).

\section{Integral lifts and identity components}\label{sec:lifting}

We use the lifting method of Chi--Liu--Nie \cite[Sections 3--5]{CLN}
for morphisms from $X_0(N)$ over number fields.  The passage from
integral expansions to a congruence subgroup uses the unbounded-denominators
theorem of Calegari--Dimitrov--Tang \cite{CDT}.

For an elliptic curve $A$ over a nonarchimedean local field $L$, write
$A^0(L)$ for the points reducing into the identity component of its N\'eron
model, and $A^1(L)$ for the kernel of reduction.  A minimal Weierstrass equation
has parameter $t=-x/y$ at the origin.  Its normalized invariant differential
has formal logarithm $L_A(t)=t+O(t^2)$.

\begin{lemma}\label{lem:additive-log}
Let $R$ be the ring of integers of a finite unramified extension of $\Q_p$,
and let $A/\operatorname{Frac}(R)$ have additive reduction.  Then
\[
 L_A(t),\ L_A^{-1}(t)\in tR[[t]].
\]
In particular $A^1(\operatorname{Frac}(R))$ is torsion-free.  If $A/\Q_p$
has additive reduction, then
\[
 \#A^0(\Q_p)[p^\infty]\leq p.
\]
For an arbitrary finite extension $L/\Q_p$, additive reduction implies
that $A^0(L)$ has no nonzero torsion of order prime to $p$.
\end{lemma}

\begin{proof}
The identity component of the special fibre is the additive group.  Hence
multiplication by $p$ on its formal group is zero.  Since $p$ is a uniformizer
of $R$, the formal multiplication law has the form
\[
 [p](t)=p g(t),\qquad
 g(t)=t+\sum_{n\geq2}g_nt^n\in tR[[t]].
\]
Write $L_A(t)=t+\sum_{n\geq2}b_nt^n$.  The identity
$L_A([p](t))=pL_A(t)$, divided by $p$ and compared in degree $n\geq2$,
gives
\[
 (1-p^{n-1})b_n
 =g_n+\sum_{k=2}^{n-1}p^{k-1}b_k[t^n]g(t)^k.
\]
The coefficient on the left is a unit.  Induction proves $b_n\in R$.
The inverse of a series in $tR[[t]]$ with linear coefficient one again
belongs to $tR[[t]]$.  Both series converge on $pR$ and give mutually
inverse group isomorphisms between $A^1(\operatorname{Frac}(R))$ and the
additive group $pR$.  This proves torsion-freeness.

For $L=\Q_p$, smooth reduction gives
\[
 0\longrightarrow A^1(\Q_p)\longrightarrow A^0(\Q_p)
 \longrightarrow (\F_p,+)\longrightarrow0.
\]
The torsion subgroup therefore injects into $(\F_p,+)$.  For a general
finite extension $L/\Q_p$, multiplication by an integer prime to $p$ is
an automorphism on the formal group, whereas the smooth reduction quotient
is the additive group of the residue field.  Neither group has nonzero
prime-to-$p$ torsion, which proves the last assertion.
\end{proof}

\subsection{The arithmetic curve and a congruence lift}

Let $X_\mu(N)$ be the smooth projective curve over $\Q$ compactifying the
coarse moduli curve \(Y_\mu(N)\) of pairs
\[
 (A,\iota),\qquad \iota:\mu_N\hookrightarrow A[N].
\]
Its complex uniformization is by
$\Gamma_1^{\pm}(N)=\langle\Gamma_1(N),-I\rangle$.
The cusp $\infty$ is given by the Tate curve together with its canonical
inclusion of $\mu_N$; it is rational and has parameter $q$.
For $\delta\in(\Z/N\Z)^\times$, the diamond operator is
\[
 \langle\delta\rangle(A,\iota)=(A,\iota\circ[\delta]).
\]
It is defined over $\Q$, and $\langle-1\rangle$ acts trivially.
Forgetting the embedding and retaining its image defines
$\varpi_N:X_\mu(N)\to X_0(N)$ and identifies
\[
 X_\mu(N)/\bigl((\Z/N\Z)^\times/\langle-1\rangle\bigr)
 \simeq X_0(N).
\]
These conventions, including the arithmetic choice of cusp, are those of
the inclusion moduli problem in \cite[Sections 4.9 and 8.6]{KM}.

We shall also use the integral Tate neighbourhood of $\infty$ on $X_0(N)$.
Over the integer ring $R$ of any local field its completion is $R[[q]]$, and the
curve is smooth along this cusp.  Here the Tate parameter is as in
\cite[Theorem 8.11.10]{KM}, and smoothness of the cusp section on the
integral model is recorded in \cite[Remark 5.3]{Ces}.
Consequently, if $F:X_0(N)_K\to B$ is a morphism over a number field and
$F(\infty)=O$, the N\'eron mapping property gives
\begin{equation}\label{eq:cusp-integrality}
 t_B(F(q))\in q\OO_{K_v}[[q]]
\end{equation}
at every finite place $v$, for a parameter from a minimal local equation
of $B$, by the smooth Tate neighbourhood of the cusp.

\begin{lemma}\label{lem:congruence-lift}
Let $K$ be a number field, let $\nu:A\to B$ be a $K$-isogeny, and let
$F:X_0(N)_K\to B$ satisfy $F(\infty)=O$.  Fix an embedding $K\hookrightarrow
\C$, and let $\psi:\mathfrak H\to A(\C)$ be the lift of $F$ through $\nu$
which tends to $O$ at $\infty$.  Suppose that, for every finite place $v$
of $K$, the formal expansion of this lift in a minimal parameter of $A$
belongs to $q\OO_{K_v}[[q]]$.  Then $\psi$ induces a $K$-morphism
\[
 \psi_\mu:X_\mu(N)_K\longrightarrow A,
 \qquad \psi_\mu(\infty)=O,\qquad
 \nu\circ\psi_\mu=F\circ\varpi_N.
\]
For every diamond operator there is a point $\tau_\delta\in\Ker\nu(K)$
such that
\begin{equation}\label{eq:diamond-translation}
 \psi_\mu\circ\langle\delta\rangle=\psi_\mu+\tau_\delta.
\end{equation}
\end{lemma}

\begin{proof}
The result is immediate for a constant $F$, so suppose that $F$ is
nonconstant.  The isogeny is an analytic covering and $\mathfrak H$ is
simply connected.  Its lift is determined by the branch taking the value
$O$ over the cusp.  Equivalently, it is obtained by inverting the formal
isogeny at $O$ in characteristic zero.  This also shows that its formal
coefficients belong to $K$.  The two lifts $\psi(z+1)$ and $\psi(z)$ have
the same limit at the cusp, so they are equal.

Pass to the Hilbert class field $H$ of $K$.  The principal ideal
theorem makes every ideal class of $K$ principal in $H$ \cite{CFT}.
In particular it principalizes the Weierstrass ideal class of $A$.
Minimal equations remain minimal under unramified extensions, and the
criterion for a global minimal equation in
\cite[Chapter VIII, Proposition 8.2]{Silverman} therefore gives a minimal
Weierstrass equation for $A_H$ over $\OO_H$.
The hypothesis on formal expansions persists under this
unramified extension and under integral changes between minimal equations.

On this equation put
\[
 t=-\frac{x}{y},\qquad w=-\frac1y.
\]
Both functions are regular at $O$.  If the coefficients of the equation
are $a_i\in\OO_H$, they satisfy
\[
 w=t^3+a_1tw+a_2t^2w+a_3w^2+a_4tw^2+a_6w^3.
\]
The formal implicit-function recursion yields
$w\in t^3\OO_H[[t]]$.  Thus both $t(\psi(q))$ and $w(\psi(q))$ lie in
$\OO_H[[q]]$.  The functions $t,w$ generate the function field of $A$,
because $x=t/w$ and $y=-1/w$.

For $\gamma\in\Gamma_0(N)$, the difference
\[
 \rho(\gamma)=\psi(\gamma z)-\psi(z)
\]
is independent of $z$ and belongs to $\Ker\nu(\C)$.  It defines a
homomorphism, and $G=\Ker\rho$ has finite index in $\Gamma_0(N)$.
The compact curve associated to $G$ is the component, selected by
$(\infty,O)$, of the finite \'etale pullback
\[
 X_0(N)\mathbin{\times}_{B,\nu}A.
\]
In particular $t\circ\psi$ and $w\circ\psi$ are meromorphic modular
functions for $G$, algebraic over the function field of $X_0(N)$.

For either function $r$, its noncuspidal poles have algebraic $j$-values.
Choose a nonzero polynomial $P_r(j)\in\OO_H[j]$ whose zeros cancel all
these poles, taking their conjugates and increasing multiplicities if
necessary.  A sufficiently high power of the discriminant modular form
$\Delta$ then cancels the remaining poles at all cusps.  Hence
\[
 \Delta^{m_r}P_r(j)r
\]
is a holomorphic modular form for $G$.  Its Fourier coefficients have
bounded denominators: $r$ has integral coefficients and $j,\Delta$ have
integral Laurent expansions.  By \cite[Theorem 1.0.1 and Remark 6.3.1]{CDT},
this modular form is congruence.  Dividing by its level-one factors shows
that each of $t\circ\psi,w\circ\psi$ is a congruence modular function.
Their joint stabilizer inside $\Gamma_0(N)$ is exactly $G$, since $t,w$
separate the generic points of $A$.  Thus $G$ contains a principal
congruence subgroup.

The compact pullback is \'etale, so the monodromy around each cusp and
each elliptic point is trivial.  Consequently the cusp widths for $G$
are those of their images on $X_0(N)$, and their least common multiple
is $N$.  Moreover $-I\in G$.  Wohlfahrt's theorem \cite{Wohlfahrt} gives
$\Gamma(N)\subseteq G$.  The width-one translation
$T=\left(\begin{smallmatrix}1&1\\0&1\end{smallmatrix}\right)$ also belongs
to $G$.  Since the image of $\Gamma_1(N)$ modulo $N$ is generated by the
image of $T$, we obtain
$\Gamma_1^{\pm}(N)\subseteq G$.  This proves the asserted descent over
$\C$, including extension across the cusps.

The resulting graph is the unique geometric component through
$(\infty,O)$ of
\[
 X_\mu(N)_K\mathbin{\times}_{F\circ\varpi_N,B,\nu}A,
\]
and its projection to $X_\mu(N)_K$ has degree one.
The pullback and this point are defined over
$K$.  Galois therefore fixes the component, so its degree-one projection
and the resulting morphism descend to $K$.  Finally, applying $\nu$ to
the difference in \eqref{eq:diamond-translation} gives zero; connectedness
makes the difference a constant in $\Ker\nu$.  Evaluation at $\infty$
shows that it is $K$-rational, since all diamond translates of this cusp
are rational.
\end{proof}

\subsection{A connected source at every prime of the level}

The next lemma extends the component argument of
\cite[Section 5]{CLN} to finite extensions of $\Q_p$.

\begin{lemma}\label{lem:diamond-components}
Let $L/\Q_p$ be finite, let $p\mid N$, and let $A/L$ be an elliptic curve.
Suppose that a morphism $\psi:X_\mu(N)_L\to A$ satisfies
\[
 \psi\circ\langle\delta\rangle=\psi+\tau_\delta,
 \qquad \tau_\delta\in A(L),
\]
for every $\delta\in(\Z/N\Z)^\times$.  Then
$\tau_\delta\in A^0(L)$ for every $\delta$.
\end{lemma}

\begin{proof}
Write $N=p^aM$ with $p\nmid M$.  Choose $n\geq3$ prime to $p$ and
divisible by $M$, and choose a primitive $n$th root of unity $\zeta$.
We first construct a smooth auxiliary source over
$R_0=\Z_p[\zeta]$.  Let $B$ classify triples $(C,P,Q)$ in which $C$
is an elliptic curve and $(P,Q)$ is a basis of $C[n]$ satisfying
$e_n(P,Q)=\zeta$.  Full level $n\geq3$ is a fine moduli problem, and
fixing this Weil pairing selects an open and closed component of the
smooth full-level curve \cite[Corollary 4.7.2; 9.1.5, 9.1.6 and
9.4.3.1]{KM}.  Thus $B/R_0$ is smooth and carries a universal elliptic
curve.  Remove its supersingular special-fibre points, obtaining an open
$U$ with entire generic fibre and ordinary special fibre
\cite[Lemmas 12.5.2 and 12.5.4]{KM}.

Over $U$ consider the functor of quadruples
\[
 (C,P,Q,\iota_{p^a}),\qquad
 \iota_{p^a}:\mu_{p^a}\hookrightarrow C[p^a].
\]
By the inclusion representability theorem \cite[Section 4.9]{KM}, this
functor is represented by an affine \'etale $U$-scheme $S$.  It is of
finite presentation, so $S/R_0$ is smooth of finite type.  On its generic
fibre the first basis vector defines
\[
 \iota_M:\mu_M\hookrightarrow C[M],\qquad
 \iota_M(\zeta^{n/M})=[n/M]P.
\]
When $M=1$ this is the trivial structure.  Multiplication identifies
$\mu_M\times\mu_{p^a}$ with $\mu_N$.  Under this identification
$(x,y)\mapsto\iota_M(x)+\iota_{p^a}(y)$ is an inclusion
$\iota_N:\mu_N\hookrightarrow C[N]$, since the two image groups have
coprime orders.  It defines a generic-fibre morphism
\[
 j:S_{\operatorname{Frac}(R_0)}\longrightarrow Y_\mu(N).
\]

Each diamond has an individual lift to $S$.  Given $\delta$ modulo $N$,
choose $v\in(\Z/n\Z)^\times$ reducing to $\delta$ modulo $M$; this is
possible because reduction on unit groups is surjective.  Set
\begin{equation}\label{eq:diamond-auxiliary}
 \widetilde\delta(C,P,Q,\iota_{p^a})
 =\bigl(C,[v]P,[v^{-1}]Q,\iota_{p^a}\circ[\delta]\bigr).
\end{equation}
The pairing is unchanged, and this formula defines an $R_0$-automorphism
with $j\widetilde\delta=\langle\delta\rangle j$.

We verify that the geometric special fibre of $S$ is nonempty and
connected.  Let $k$ be an algebraic closure of the residue field of $R_0$.
Write $F^a:C\to C^{(p^a)}$ for the iterated relative Frobenius
and $V^a:C^{(p^a)}\to C$ for its dual Verschiebung.
On the ordinary universal elliptic curve over $U_k$ there is an exact
sequence
\[
 0\longrightarrow\Ker F^a\longrightarrow C[p^a]
 \xrightarrow{F^a}\Ker V^a\longrightarrow0,
\]
where $\Ker V^a$ is \'etale and locally cyclic of order $p^a$
\cite[Lemmas 12.2.1, 12.2.3, 12.2.5 and Proposition 12.3.6]{KM}.
Every homomorphism from $\mu_{p^a}$ to $\Ker V^a$ is zero: it is zero
on geometric fibres, and its vanishing locus is open and closed
\cite[Lemma 4.10.0(3)]{KM}.  Therefore an inclusion $\iota_{p^a}$
factors through $\Ker F^a$ and is an isomorphism onto it.  Cartier
duality and the canonical principal polarizations identify
$(\Ker F^a)^D$ with $\Ker V^a$ \cite[(2.8.2.1)]{KM}.  The map
$\iota_{p^a}\mapsto(\iota_{p^a}^D)^{-1}$ consequently identifies our
inclusions with isomorphisms
\[
 (\Z/p^a\Z)\xrightarrow{\sim}\Ker V^a.
\]
This is precisely an Igusa generator on the ordinary locus.

The Igusa problem over $B_k$ assigns a
section $Z\in C^{(p^a)}$ such that $V^aZ=0$ and
\[
 \sum_{i=1}^{p^a}[iZ]=\Ker V^a
\]
as effective Cartier divisors.  This definition makes sense at
supersingular points as well \cite[Definition 12.3.1]{KM}.
Let $C_a$ be the scheme classifying the simultaneous full-level and
Igusa structures.  The product construction of moduli problems and
relative representability give a finite flat morphism
\[
 C_a\longrightarrow B_k
 \quad\hbox{of degree }p^{a-1}(p-1)
\]
\cite[4.3.4 and Theorem 12.6.1(1)]{KM}.  The preceding Cartier-dual
description, being functorial in the base, proves
\[
 S_k\simeq C_a\mathbin{\times}_{B_k}U_k.
\]
The fixed-pairing full-level problem is representable, finite \'etale,
and surjective over the moduli problem of elliptic curves over $k$:
an $n$-torsion basis exists \'etale locally, and rescaling one basis
vector gives the prescribed Weil pairing.
The fixed-pairing full-level curve $B_k$ is connected by connectedness
of its smooth compactification \cite[Corollary 10.13.12]{KM}.
Katz--Mazur's Igusa theorem gives connectedness of $C_a$ and its
smoothness \cite[Corollary 12.6.2(2) and (1)]{KM}.  A connected smooth
curve over $k$ is irreducible.  Since the supersingular $j$-values form
a finite set and $C_a\to B_k$ is finite flat of positive degree, its
ordinary open is nonempty.  It is therefore connected, proving the
claim about $S_k$.

Now put $L'=L(\zeta)$.  This is unramified over $L$.  Base changing
the construction to $\OO_{L'}$ gives a smooth scheme with nonempty
geometrically connected special fibre.  Let $\mathcal A'$ be the
N\'eron model of $A_{L'}$ over $\OO_{L'}$.  The morphism $\psi j$ extends
uniquely to $h:S_{\OO_{L'}}\to\mathcal A'$, and $\tau_\delta$ extends
to a section $\widetilde\tau_\delta$.  The N\'eron mapping property and
\eqref{eq:diamond-auxiliary} give
\[
 h\widetilde\delta=h+\widetilde\tau_\delta.
\]
The image of the connected geometric special fibre of $S$ lies in a
single component of $\mathcal A'_k$.  For any geometric special-fibre
point $s$, the points $h(s)$ and $h(\widetilde\delta s)$ thus have the
same component class.  Their difference is
$\widetilde\tau_\delta$, whose component class is zero.  Hence
$\tau_\delta\in A^0(L')$.  N\'eron models commute with unramified base
change \cite[Section 1.2, Proposition 2(c)]{BLR}, and their identity
components descend under this extension.  Thus
$\tau_\delta\in A^0(L)$.
\end{proof}

We shall also use the following consequence of the ordinary modular charts.

\begin{lemma}\label{lem:prime-to-component}
Let \(p\mid N\), let \(L/\Q_p\) be finite, and let
\(P:X_0(N)_L\to A\) be a morphism to an elliptic curve, with
\(P(\infty)=O\). If \(d\mid N\) is an exact divisor and
\(p\nmid d\), then
\[
                         P(w_d\infty)\in A^0(L).
\]
\end{lemma}
\begin{proof}
Write \(N=p^aM\), with \(p\nmid M\). Choose \(n\ge3\) such that
\(M\mid n\) and \(p\nmid n\), and put
\(L'=L(\zeta_n)\), \(R=\OO_{L'}\). The extension \(L'/L\)
is unramified. Let \(B/R\) be the fine full-level-\(n\) modular
curve with Weil pairing fixed to \(\zeta_n\). Its compactification
is smooth with geometrically connected fibers
\cite[Corollary 10.13.12]{KM}.
Let \(X/R\) be the flat Katz--Mazur compactification obtained
by adding a cyclic subgroup of order \(p^a\).
On the generic fiber, retain this subgroup together with the
order-\(M\) subgroup generated by \((n/M)\) times the first
auxiliary basis vector. Forgetting the rest of the basis gives
a morphism
\[
                      j:X_{L'}\longrightarrow X_0(N)_{L'}.
\]

Over an algebraic closure \(k\) of the residue field, the
noncuspidal block of \(X_k\) indexed by \((a,0)\) parametrizes the subgroup
\(\Ker(F_C^a)\) of the universal elliptic curve \(C\).
Its map to \(B_k\) is finite flat of degree one
\cite[Proposition 13.4.4]{KM}, and hence is an isomorphism.
This block is reduced, has multiplicity one, and meets
the other noncuspidal blocks only at supersingular points
\cite[Theorem 13.4.7]{KM}. Thus \(X\) is relatively smooth
along its ordinary part: the geometric fiber there is smooth
and \(X\) is flat over \(R\).

The closure of this ordinary component also contains every
cusp whose \(p\)-primary subgroup is \(\mu_{p^a}\).
Such a cusp has a full-level Tate chart with elliptic curve
\(\operatorname{Tate}(u^n)\) and completed local ring \(R[[u]]\);
adding the canonical subgroup \(\mu_{p^a}\) leaves this ring
unchanged \cite[Section 8.11, especially Theorem 8.11.10]{KM}.
These cusp sections therefore lie in the relative smooth locus.
There is one, denoted by \(c_\infty\), above \(\infty\).
The exact-divisor cusp \(w_d\infty\) has denominator \(N/d\).
Since \(p^a\mid N/d\), the matrix
\[
                \begin{pmatrix}1&0\\N/d&1\end{pmatrix}
                       \in\Gamma_0(p^a)
\]
sends \(\infty\) to this cusp class and preserves the connected
\(p\)-primary branch. Explicitly, in multiplicative coordinates
on \(\operatorname{Tate}(u^n)\), the two full-level bases are
\[
                 (\zeta_n,u),\qquad(\zeta_nu^{N/d},u).
\]
They have the same Weil pairing. The second basis retains an
order-\(M\) subgroup generated by \(\zeta_n^{n/M}u^{nN/(Md)}\),
together with the canonical subgroup \(\mu_{p^a}\).
Both charts have ring \(R[[u]]\). The second therefore gives
a section \(c_d\) above \(w_d\infty\) on the same component.

Remove the other special-fiber components and the nonsmooth
points of this component. The resulting open \(U\subset X\)
is smooth over \(R\), contains \(c_\infty\) and \(c_d\), and
has geometrically connected special fiber, since this fiber
is a nonempty open of the irreducible \((a,0)\) component.
The morphism \(P\circ j\) extends from \(U_{L'}\) to the
N\'eron model of \(A_{L'}\). Its special-fiber image lies in
one connected component, which is the identity component
because \(c_\infty\) maps to \(O\). Hence \(c_d\) maps into
that component, and \(P(w_d\infty)\in A^0(L')\).
N\'eron models and their identity components commute with
unramified base change, so this membership descends to \(L\).
\end{proof}

\subsection{Optimal quotients and the Manin constant}

\begin{proposition}\label{prop:incoming-unit}
Let $\pi:J_0(N)\to E$ be an optimal elliptic quotient over $\Q$.
Suppose that $\nu:A\to E$ is a $\Q$-isogeny satisfying
\[
 \nu^*\omega_E=\omega_A
\]
for minimal global invariant differentials.  Then
\[
 \Ker\nu(\overline\Q)
 \subseteq A(\Q)\cap\bigcap_{p\mid N}A^0(\Q_p).
\]
In particular, if $E$ has an odd additive prime, there is no such isogeny
of even degree.
\end{proposition}

\begin{proof}
Normalize the modular parametrization
$\phi=\pi\circ\operatorname{AJ}_\infty$, where
$\operatorname{AJ}_\infty(P)=[P]-[\infty]$.
At every prime the isogeny extends to N\'eron models, and its formal
expansion in minimal parameters has integral coefficients and linear
coefficient one.  Its compositional inverse is therefore integral.
Equation \eqref{eq:cusp-integrality} shows that the normalized analytic
lift of $\phi$ through $\nu$ satisfies the hypothesis of
Lemma~\ref{lem:congruence-lift}.  It gives a rational morphism on
$X_\mu(N)$ with rational diamond translations in $\Ker\nu$.
Lemma~\ref{lem:diamond-components} puts all these translations in
$A^0(\Q_p)$ for each $p\mid N$.

It remains to see that the translations exhaust the geometric kernel.
The connected kernel of $\pi$ gives a surjection on integral homology
\[
 H_1(J_0(N)(\C),\Z)\longrightarrow H_1(E(\C),\Z).
\]
Indeed, in the exact sequence of complex tori the quotient lattice is
the target lattice precisely when the kernel is connected.  The
Abel--Jacobi map identifies $H_1(X_0(N)(\C),\Z)$ with the homology of
its Jacobian, so $\phi_*$ is also surjective.  Using the compatible
differentials, write
\[
 A(\C)=\C/\Lambda_A,\qquad E(\C)=\C/\Lambda_E,
 \qquad\Lambda_A\subseteq\Lambda_E.
\]
The monodromy of the lift is reduction of the periods of $\phi$ modulo
$\Lambda_A$.  Surjectivity on homology makes its image all of
$\Lambda_E/\Lambda_A=\Ker\nu(\C)$.  By
Lemma~\ref{lem:congruence-lift}, this monodromy factors through
$\Gamma_0(N)/\Gamma_1^{\pm}(N)$, so each kernel point is one of the
diamond translations.  This proves the inclusion.

Isogenous elliptic curves have the same conductor and reduction
category at each prime.  If an odd prime $p$ is additive for $E$, it is
additive for $A$.  An even-order geometric kernel has an element of
order two, and the inclusion just proved would put it in $A^0(\Q_p)$.
This contradicts Lemma~\ref{lem:additive-log}.
\end{proof}

\begin{proposition}\label{prop:manin-odd}
Let $E/\Q$ have conductor $N$, and let $\phi:X_0(N)\to E$
be an optimal modular parametrization normalized at $\infty$.
Write
\[
 \phi^*\omega_E=c_Ef_E(q)\frac{dq}{q}
\]
for a minimal global invariant differential. Then $c_E$ is an odd integer.
\end{proposition}

\begin{proof}
The leading coefficient of the integral cusp parameter
$t_E(\phi(q))$ is $c_E$.  Thus $c_E\in\Z$; changing the sign of
$\omega_E$ makes it positive.  The local Manin-constant theorem
\cite[Theorem 2.11]{Ces} gives
\[
 p^2\nmid N\quad\Longrightarrow\quad p\nmid c_E.
\]
Suppose that $2\mid c_E$.  Then $4\mid N$, so $E$ has additive reduction
at $2$, and the local newform relation gives $a_{2n}=0$ for every $n$.
In particular
\[
 \ell_E(q)=\sum_{n\geq1}\frac{a_n}{n}q^n
          =\sum_{n\ \mathrm{odd}}\frac{a_n}{n}q^n
 \in q\Z_2[[q]].
\]

Consider the normalized lift of $\phi$ through $[2]:E\to E$.
At each odd prime the formal inverse of $[2]$ has integral coefficients,
so this lift is integral by \eqref{eq:cusp-integrality}.  At $2$,
Lemma~\ref{lem:additive-log} and integration with zero constant term give
\[
 L_E(t_E(\phi(q)))=c_E\ell_E(q),\qquad
 t_E(\psi(q))=L_E^{-1}\bigl((c_E/2)\ell_E(q)\bigr)
 \in q\Z_2[[q]].
\]
Lemma~\ref{lem:congruence-lift} therefore applies.  Surjectivity on
homology, as in Proposition~\ref{prop:incoming-unit}, says that the
monodromy of this lift is all of $E[2](\C)$.  Consequently the four
points of $E[2]$ are rational diamond translations.
Lemma~\ref{lem:diamond-components} at $2$ places them all in
$E^0(\Q_2)[2]$.  Lemma~\ref{lem:additive-log} bounds this group by two
elements, a contradiction.  Hence $2\nmid c_E$.
\end{proof}

\subsection{Division of an arbitrary morphism}

\begin{proposition}\label{prop:map-division}
Let $K$ be a number field unramified at $2$, and let $A/K$ be an elliptic
curve with additive reduction at every place above $2$.  Suppose that
$A$ also has additive reduction at some place $w$ of odd residue
characteristic $p$, where $p\mid N$.  Let
\[
 F:X_0(N)_K\longrightarrow A,\qquad F(\infty)=O,
\]
be a morphism.  For each $v\mid2$, choose a minimal invariant
differential $\omega_v$ and write
\[
 F^*\omega_v=\sum_{n\geq1}b_{n,v}q^n\frac{dq}{q}.
\]
If, for an integer $h\geq0$,
\[
 b_{2n,v}=0\quad\hbox{and}\quad
 b_{n,v}\in2^h\OO_{K_v}
 \qquad(n\geq1,\ v\mid2),
\]
then there is a unique $K$-morphism $F_0:X_0(N)_K\to A$ with
\[
 F_0(\infty)=O,\qquad F=[2^h]\circ F_0.
\]
\end{proposition}

\begin{proof}
The assertions are immediate for $h=0$ or for constant $F$, so assume
otherwise.  Take the normalized analytic lift of $F$ through $[2^h]$.
At places of odd residue characteristic its formal expansion is
integral, since the formal multiplication law has unit linear
coefficient and \eqref{eq:cusp-integrality} applies.

For $v\mid2$, the unramified hypothesis and additive reduction allow
Lemma~\ref{lem:additive-log} over $\OO_{K_v}$.  In the minimal parameter
corresponding to $\omega_v$, integration of the displayed differential
gives
\[
 L_A(t_A(F(q)))
   =\sum_{n\ \mathrm{odd}}\frac{b_{n,v}}nq^n
   \in2^h q\OO_{K_v}[[q]].
\]
There is no integration constant because $F(\infty)=O$.  Thus
\[
 t_A(\psi(q))
 =L_A^{-1}\left(2^{-h}
   \sum_{n\ \mathrm{odd}}\frac{b_{n,v}}nq^n\right)
 \in q\OO_{K_v}[[q]].
\]
Lemma~\ref{lem:congruence-lift} now yields a $K$-morphism
$\psi_\mu:X_\mu(N)_K\to A$ and translations
$\tau_\delta\in A[2^h](K)$.  Applying
Lemma~\ref{lem:diamond-components} over $K_w$ puts each translation in
$A^0(K_w)$.  This group has no nonzero $2$-primary torsion, by the odd
additive hypothesis and Lemma~\ref{lem:additive-log}.  Therefore every
$\tau_\delta$ vanishes.  The morphism $\psi_\mu$ is invariant under
all diamonds and descends over $K$ to the quotient $X_0(N)$, giving
$F_0$ with the required normalization and equality.  Finally, the
difference between any two such morphisms takes values in the finite
group $A[2^h]$, hence is constant; its value at $\infty$ is zero.
\end{proof}

\section{Two-isogeny descent and integral isogeny directions}
\label{sec:descent}

The local conditions in two-isogeny descent will also index the twist
construction. All vector spaces in this section are over $\F_2$.

\subsection{The two descent spaces}

Let $T$ be a nonzero rational point of order two.  Completing the square,
and translating $T$ to the origin, gives equations
\begin{equation}\label{eq:two-isogeny-models}
 E:y^2=x(x^2+Ax+B),\qquad
 E':y^2=x(x^2-2Ax+D),\qquad D=A^2-4B.
\end{equation}
Here $\eta:E\longrightarrow E'$ has kernel $\langle T\rangle$, and
$\widehat\eta:E'\longrightarrow E$ is its dual.  We choose $A,B\in\Z$
so that the first equation is minimal at every odd prime.  Such a choice
is obtained from a global minimal equation by a change of variables
whose only possible denominator is a power of two.  The second equation
is also minimal at odd primes: a further odd scaling would give an odd
prime factor in the minimal differential multiplier of a degree-two
isogeny, which is impossible because the multiplier and that of the
dual have product $2$.

The descent maps are
\[
 \alpha_B:E(\Q)\longrightarrow\Q^\times/\Q^{\times2},\qquad
 \alpha_D:E'(\Q)\longrightarrow\Q^\times/\Q^{\times2},
\]
where $\alpha_B(O)=1$, $\alpha_B(T)=B$, and
$\alpha_B(x,y)=x$ for $x\ne0$, and likewise with $D$ on $E'$.
Their kernels are $\widehat\eta E'(\Q)$ and $\eta E(\Q)$,
respectively.  These assertions follow either from the explicit
two-isogeny formulas, or from the homogeneous equation
\[
 d u^4+A u^2v^2+(B/d)v^4=w^2
\]
for the class $d$ on the $E$ side; see also \cite[Chapter X]{Silverman}.
For each place $v$, let $L_{B,v}$ and $L_{D,v}$ be the images
of the corresponding maps on $E(\Q_v)$ and $E'(\Q_v)$.
Set
\[
 \mathcal S_B=\{s\in\Q^\times/\Q^{\times2}:
                  s_v\in L_{B,v}\text{ for every }v\},
\]
and define $\mathcal S_D$ in the same way using $L_{D,v}$.
Here $s_v$ is the image of $s$ in
$\Q_v^\times/\Q_v^{\times2}$, with $\Q_\infty=\mathbb R$.
The global Kummer images lie in these spaces.

\begin{lemma}\label{lem:isogeny-descent}
If $r=\rank E(\Q)$, then
\begin{equation}\label{eq:descent-index}
 \dim\alpha_B(E(\Q))+\dim\alpha_D(E'(\Q))=r+2.
\end{equation}
Consequently $r+2\leq\dim\mathcal S_B+\dim\mathcal S_D$.
\end{lemma}

\begin{proof}
Put $t=\dim E(\Q)[2]$.  The exact sequence
\[
 0\longrightarrow
 \frac{E'(\Q)[\widehat\eta]}{\eta(E(\Q)[2])}
 \longrightarrow \frac{E'(\Q)}{\eta E(\Q)}
 \xrightarrow{\widehat\eta}\frac{E(\Q)}{2E(\Q)}
 \longrightarrow\frac{E(\Q)}{\widehat\eta E'(\Q)}
 \longrightarrow0
\]
has first term of dimension $2-t$ and middle term
$E(\Q)/2E(\Q)$ of dimension $r+t$.  Taking dimensions proves
\eqref{eq:descent-index}.
\end{proof}

Let $a$ and $m$ denote the numbers of odd additive and odd
multiplicative primes, and put $f=v_2(N)$.  Write $S$ for the set of
odd additive primes and $Q$ for the set of odd multiplicative primes.
The odd primes dividing both $B$ and $D$ are precisely $S$, and the
odd primes dividing at least one are precisely $S\cup Q$.  Indeed,
at an odd additive prime the identity component has no two-torsion,
so $T$ is singular and $p\mid A,B$.  Conversely, $p\mid B,D$ implies
$p\mid A$, hence additive reduction.  A bad nonadditive prime divides
exactly one of $B,D$.

The ambient squareclass space on the $B$ side is generated by $-1$
and the primes dividing $B$; the analogous assertion holds on the
$D$ side.  For example, if $q\nmid B$ and $v_q(x)\ne0$, comparison
of valuations in \eqref{eq:two-isogeny-models} shows that $v_q(x)$ is
even.  The same argument at a local point proves the assertion for
the Selmer space.  In particular the total number of odd-prime
coordinates in the two spaces is $2a+m$, in addition to their two
separate sign coordinates.

We use the matrix and row
\begin{equation}\label{eq:rank-matrices}
 K=\bigl([q/p]\bigr)_{q\in Q,\ p\in S},\qquad
 \zeta=\bigl([2/p]\bigr)_{p\in S},\qquad k=\rank K.
\end{equation}
The rows of $K$ always refer to \emph{odd} multiplicative primes.
Define $K^*=K$ when $f$ is even and
$K^*=\left(\begin{smallmatrix}K\\\zeta\end{smallmatrix}\right)$
when $f$ is odd, and put $k^*=\rank K^*$.  Thus $k\leq k^*\leq k+1$.
In particular, when $f=1$, $K^*$ is the matrix obtained by including
the multiplicative prime $2$.

\subsection{Independent local conditions}

At an odd additive prime $p$, the local squareclass group
$\Q_p^\times/\Q_p^{\times2}$ has dimension two, with valuation and unit
Legendre coordinates.  The local index formula gives
\[
 |L_{B,p}|=2\frac{c_p(E)}{c_p(E')},\qquad
 |L_{D,p}|=2\frac{c_p(E')}{c_p(E)},
\]
and therefore
\begin{equation}\label{eq:local-dimension-sum}
 \dim L_{B,p}+\dim L_{D,p}=2.
\end{equation}
To obtain this formula, compare the component groups,
the smooth identity reductions, and the formal subgroups under the
two isogenies.  On the formal subgroups both maps are isomorphisms
at odd $p$, their rational kernels have order two, and the smooth
identity reductions of the two additive curves both have $p$ points.

For a local squareclass $s$, choose a representative $p^e u$ with
$e\in\{0,1\}$ and $u\in\Z_p^\times$, and set
$v_p(s)=e\in\F_2$ and $\operatorname{unit}_p(s)=[u/p]$.
Thus valuations of squareclasses in the following linear equations
are taken modulo two.
Call $p$ \emph{regular} if both local images are ramified lines.
Each such image is cut out, for a suitable $b_p\in\F_2$ depending
on the image, by an equation
\begin{equation}\label{eq:regular-local-row}
 \operatorname{unit}_p(s)+b_p v_p(s)=0.
\end{equation}
Thus, in either global block, its coefficient at a generator
$q\ne p$ is $[q/p]$, and its sign coefficient is $[-1/p]$.
If $p$ is not regular, one local image is contained in the unit
line.  Otherwise both would contain a ramified vector, and
\eqref{eq:local-dimension-sum} would make both ramified lines.
Consequently, at every nonregular prime we have a pure valuation
condition $v_p(s)=0$ in at least one of the two blocks.

Suppose there are $e$ nonregular primes, and let $K_R$ be the
restriction of $K$ to the regular columns.  Project the regular
local rows onto the multiplicative-prime coordinates.  Splitting
these coordinates between the $B$ and $D$ blocks shows that their
combined rank is at least $\rank K_R$.  Choose this many rows with
independent projections.  The $e$ pure valuation rows are independent
of them and of each other: their projections are zero and their
nonzero odd-prime coordinates are distinct.  Since deleting $e$
columns decreases rank by at most $e$, these rows give at least $k$
independent conditions.

There is one further, independent, real condition.  At least one
of the real Kummer images consists of positive classes.  Indeed,
if $B<0$, then $D>0$ and $x^2-2Ax+D$ is everywhere positive;
if $D<0$, then $x^2+Ax+B$ is everywhere positive.  If $B,D>0$,
the real quadratic roots show that positivity holds on the $D$
side when $A>0$, and on the $B$ side when $A<0$.  The resulting
row is nonzero only on one sign coordinate.  It is independent
of the selected rows, since their independent multiplicative
projections first force their coefficients to vanish, after which
the pure valuation rows have zero sign coordinates.  We have proved
that the two Selmer spaces have total codimension at least $k+1$.

If both blocks contain the dyadic coordinate, project onto it
as well. Let $\zeta_R$ be the restriction of $\zeta$ to the
regular columns, and let $K_{B,R}$ and $K_{D,R}$ be the row
restrictions of $K_R$ to multiplicative primes dividing $B$
and $D$, respectively. The regular local rows have dyadic
coefficient $[2/p]$ in each block. Their projections in the two
blocks have disjoint coordinate sets and combined rank
\[
 \rank\begin{pmatrix}K_{B,R}\\\zeta_R\end{pmatrix}
 +\rank\begin{pmatrix}K_{D,R}\\\zeta_R\end{pmatrix}
 \ge \rank\begin{pmatrix}K_R\\\zeta_R\end{pmatrix}.
\]
Choose regular rows with independent projections. The $e$
pure odd-valuation rows have zero projection and are independent
of these rows and of each other. Deleting the $e$ nonregular
columns gives
\[
 e+\rank\begin{pmatrix}K_R\\\zeta_R\end{pmatrix}
 \ge \rank\begin{pmatrix}K\\\zeta\end{pmatrix}.
\]
The real condition supplies one further independent row as
above. Thus the total codimension is at least
$1+\rank\left(\begin{smallmatrix}K\\\zeta\end{smallmatrix}\right)$.

\subsection{The imaginary self-twist condition}

Products of the discriminants $p^*$, $p\in S$, form an
$a$-dimensional space of quadratic characters.
Let $U=\Ker K^*$, and let $\kappa$ be $1$ if the newform of $E$
has a nontrivial quadratic self-twist in $U$, and $0$ otherwise.
The usual characterization of self-twists of elliptic newforms
says that the nontrivial self-twist, if present, is unique and is
the imaginary quadratic character of complex multiplication.
The endomorphism-algebra proof of this fact is given in
Lemma~\ref{lem:self-twists}.

\begin{lemma}\label{lem:cm-rank-row}
If $\kappa=1$, the codimension estimates above improve by one.
This also holds for the augmented projection whenever that projection
is used and the self-twist lies in its kernel.
\end{lemma}

\begin{proof}
At an odd prime, rational two-torsion excludes inertia of order
divisible by three.  At $p=3$ this includes wild inertia: its pro-$3$
image in $\GL_2(\Z_2)$ reduces into the stabilizer of a nonzero
vector in $\F_2^2$, a group of order two, while the reduction
kernel is pro-$2$.  Hence that wild image is trivial.  The usual
tame reduction calculation then gives, at odd additive primes,
conductor exponent two and types III, III*, $\mathrm I_0^*$, or
$\mathrm I_n^*$ with $n>0$.  Ramified quadratic twisting preserves
additive reduction in the first two cases and removes it in the
last two.  A self-twist cannot be supported at a removable prime,
since its conductor would change there.

At types III and III*, the two Tamagawa numbers are both two and
the distinguished classes $B,D$ both have odd valuation.  This
can also be read directly from the minimal equations: their
valuations are respectively $(1,1)$ or $(3,3)$, up to exchanging
the two isogenous curves.  Thus both local images are ramified
lines, by \eqref{eq:local-dimension-sum}; these primes are regular.
Let $v=(v_p)$ be the self-twist vector.  Since its discriminant is
negative,
\[
 \sum_{p\in S}v_p[-1/p]=1.
\]
The $v$-weighted sums of the regular rows in each block vanish
on the multiplicative coordinates because $Kv=0$, and have sign
coefficient one.  If the dyadic projection is used, they also
vanish there because $\zeta v=0$.  Choose the weighted row in
the block opposite to the real positivity row.  Its sign
coordinate proves its independence from that row and the pure
valuation rows; its zero projection proves independence from
the selected projected row basis.  This is the extra condition.
\end{proof}

\subsection{The dyadic coordinates}

We next specify the ambient dimensions at two.

Assume first that $E$ is optimal, $f=0$, and $a>0$.  Good
reduction at two together with rational two-torsion implies ordinary
reduction.  A connected rational order-two subgroup would give a
degree-two quotient whose dual has unit minimal differential
multiplier at every prime.  Proposition~\ref{prop:incoming-unit}
would place its nonzero kernel point in the identity component at
an odd additive prime, an impossibility.  Hence $T$ is \'etale at
two, and full rational two-torsion is impossible, since it would
contain the connected order-two subgroup.

More generally, whenever $E$ has good reduction at two and $T$ is
\'etale, translation of a minimal integral equation puts it in the form
\[
 y^2+a_1xy=x^3+a_2x^2+a_4x,
\]
with $a_1,a_4$ odd.  Completing the square with
$X=4x$, $Y=8y+4a_1x$ gives \eqref{eq:two-isogeny-models} with
\begin{equation}\label{eq:good-two-model}
 A=a_1^2+4a_2\equiv1\pmod4,\qquad B=16a_4,
 \qquad v_2(B)=4,\quad D\text{ odd}.
\end{equation}
The integral kernel of $\eta$ is the constant group $\Z/2$, and
that of its dual is $\mu_2$.  Finite flat Kummer theory over
$\Z_2$, and the vanishing of the first cohomology of the smooth
elliptic special fiber over $\F_2$, give
\begin{equation}\label{eq:good-two-kummer}
 L_{D,2}=H^1(\Z_2,\Z/2)=\{1,5\},\qquad
 L_{B,2}=H^1(\Z_2,\mu_2)
             =\Z_2^\times/\Z_2^{\times2}.
\end{equation}
Here $H^1$ denotes fppf cohomology. In particular neither block has
a dyadic valuation coordinate.
This also explains ordinary reduction in the case used above:
a supersingular elliptic curve over $\Z_2$ has no rational
order-two point, since its height-two formal group has nonzero
two-torsion parameter of valuation $1/3$, whereas an integral
point of order two cannot reduce to a nonzero point on its
supersingular special fiber.

If $f=1$ and $E$ is optimal, then
\begin{equation}\label{eq:optimal-multiplicative-kernel}
 E(\Q)[2]\cap E^0(\Q_2)=0.
\end{equation}
Indeed, a nonzero point in this intersection is $-1$ in a Tate
uniformization over an unramified splitting extension.  The quotient
and dual maps are
\[
 \overline{\Q}_2^\times/q^\Z\xrightarrow{z\mapsto z^2}
 \overline{\Q}_2^\times/q^{2\Z}\xrightarrow{z\mapsto z}
 \overline{\Q}_2^\times/q^\Z.
\]
The dual has globally unit differential multiplier, but its nonzero
kernel point, represented by $q$, is outside the identity component.
This contradicts Proposition~\ref{prop:incoming-unit}.  The component
group at a multiplicative prime is cyclic, so
\eqref{eq:optimal-multiplicative-kernel} also excludes full rational
two-torsion.  The point $T$ is integral and singular; the same
normalization as above now has $a_1$ odd and $a_4$ even.  Thus
$A,D$ are odd and exactly the $B$ block contains the coordinate $2$.
Writing $\mu=m+1$ for the number of all multiplicative primes, the
total ambient dimension is $2a+\mu+2$.  The local row argument
applies with the extra multiplicative row $q=2$, hence with $k^*$.

Suppose finally that $f\geq2$.  A reduced minimal equation at two
has $a_1,a_3$ even, and completing the square is integral.  The
integral additive formal logarithm of Lemma~\ref{lem:additive-log}
makes $E^1(\Q_2)$ torsion-free.  Thus $T$ is integral and can be
translated to zero without losing minimality.  In
\eqref{eq:two-isogeny-models} put
\begin{equation}\label{eq:dyadic-support}
 d=\boldsymbol1_{2\mid B}+\boldsymbol1_{2\mid D}\leq2,
\end{equation}
where $\boldsymbol1$ denotes the indicator of a condition.
The total ambient dimension is $2a+m+2+d$.

There is a sharper statement when $f=2$.  The prime-to-two Tate
module has invariant codimension two and Swan conductor zero.
Additive potentially multiplicative reduction would require a
ramified quadratic character at two and hence positive Swan
conductor.  The reduction is therefore potentially good, with
nontrivial tame inertia of odd order.  The odd part of the
automorphism group of a geometric elliptic curve in characteristic
two has order at most three.  Consequently, over a strict
unramified base, good reduction is attained in a tamely ramified
cubic extension.  Restriction followed by norm is multiplication
by three. More precisely, Weil restriction of the good elliptic
model from this totally ramified cubic extension has connected
special fiber. Its reduction to the elliptic special fiber has
a filtration whose two successive kernels are additive groups,
obtained from the two nilpotent layers of the ramified cubic
special fiber. Its generic norm map extends to the
original N\'eron model by smoothness and the N\'eron mapping
property, so its image lies in the identity component.
Thus the geometric component
group is killed by three. In particular its order is odd.
The same conclusions hold for $E'$ because its conductor is the same.

Both distinguished rational order-two points are consequently
nonsingular.  In their respective minimal translated short equations,
the linear coefficient is odd.  For such an equation, if $v_2(x)<0$
then $x^3$ dominates, while if $v_2(x)>0$ then $x^2+Ax+B$ is a unit.
In either case the square equation forces $v_2(x)$ to be even.
The Kummer value at the order-two point is the unit $B$ itself.
Changing between two translated models preserving this point changes
$x$ by a rational square.  The two local Kummer images therefore
have even valuation at two, even if the displayed equation for $E'$
is not minimal there.  Both dyadic coordinates disappear.
Moreover, full rational two-torsion is impossible: the odd component
group would place all of it in $E^0(\Q_2)$, whereas
Lemma~\ref{lem:additive-log} gives
$|E^0(\Q_2)[2^\infty]|\leq2$.

Combining these facts with Lemmas~\ref{lem:isogeny-descent}
and~\ref{lem:cm-rank-row} proves the estimates we shall use.

\begin{proposition}\label{prop:rank-bounds}
With the notation above, the following bounds hold.
\begin{enumerate}
\item If $f=0$, $a>0$, and $E$ is optimal, then
\[
 r\leq 2a+m-1-k-\kappa.
\]
The bound also holds for any $E$ whose chosen order-two point is
\'etale at two.
\item If $f=1$ and $E$ is optimal, with $\mu=m+1$, then
\[
 r\leq2a+\mu-1-k^*.
\]
There is no CM self-twist in this case, because a CM elliptic
curve cannot have multiplicative reduction. The inequality also
holds for any $E$ whose chosen point lies outside $E^0(\Q_2)$.
\item If $f\geq2$, then
\begin{equation}\label{eq:additive-rank-bound}
 r\leq2a+m+d-1-k-\kappa.
\end{equation}
If $d=2$, one also has
\begin{equation}\label{eq:augmented-rank-bound}
 r\leq2a+m+1-
 \rank\begin{pmatrix}K\\\zeta\end{pmatrix}-\kappa,
\end{equation}
provided, for the subtraction of $\kappa$, that the self-twist is
in the kernel of the augmented matrix.  This is the case when
$f$ is odd.
\item If $f=2$, the stronger bound is
\begin{equation}\label{eq:conductor-four-rank}
 r\leq2a+m-1-k-\kappa.
\end{equation}
\end{enumerate}
\end{proposition}

\subsection{The semistable extreme case}

\begin{lemma}\label{lem:semistable-rank}
If $E$ is semistable and has rational two-torsion, then
$r\leq\omega(N)-1$.
\end{lemma}

\begin{proof}
At good reduction at two, choose an \'etale rational order-two
kernel.  If the given kernel is connected, pass to its quotient;
the rational dual kernel is then \'etale.  At multiplicative reduction
at two, choose a rational order-two point outside the identity
component.  If the given point is inside it, the Tate calculation
above shows that the dual kernel on its quotient is outside it.
Isogeny preserves rank and conductor.  We may thus apply the
first or second ambient calculation with $a=0$, $K$ empty, and
the single real positivity condition.  Lemma~\ref{lem:isogeny-descent}
then gives $r\leq\omega(N)-1$.
\end{proof}

\begin{lemma}\label{lem:extremal-rows}
Suppose $N$ is odd and squarefree, $r=\omega(N)-1>0$, and a
nonzero point
\[
 T\in E(\Q)[2]\cap\bigcap_{p\mid N}E^0(\Q_p)
\]
is \'etale at two.  In the normalization
\eqref{eq:good-two-model} one has
\[
 B=\pm16,\qquad D>0,
 \qquad q\mid D\Longrightarrow q\equiv1\pmod4.
\]
If $B=16$, then $A>8$.  In these circumstances $E(\Q)[2]$ is
cyclic of order two.
\end{lemma}

\begin{proof}
An odd prime dividing $B$ would make $T$ singular at a
multiplicative prime.  Hence \eqref{eq:good-two-model} gives
$B=\pm16$.  Put $n=\omega(N)$.  The two ambient spaces have
total dimension $n+2$, whereas their Mordell--Weil images have
total dimension $r+2=n+1$.  The $D$-side condition in
\eqref{eq:good-two-kummer} contains the row with coefficient one
on $-1$ and on exactly those odd primes $q\equiv3\pmod4$.
The real positivity row must coincide with it: if the two rows
were independent, the total dimension would be at most $n$.
Thus positivity occurs on the $D$ side, all primes dividing $D$
are $1$ modulo four, and $D>0$.  For $B=16$ the real sign
calculation requires $A>0$; then $D=A^2-64>0$ gives $A>8$.

Full rational two-torsion would make $D=C^2$ for an odd integer
$C$.  If $B=-16$, the equation $C^2-A^2=64$, together with
$A\equiv1\pmod4$, gives $A=-15$, $C=17$.  The odd conductor
is then $17$, contradicting $r>0$ by Lemma~\ref{lem:semistable-rank}.
If $B=16$, $A>8$ and $A^2-C^2=64$ give $A=17$, $C=15$.
Then $3\mid D$, contrary to the established congruence condition.
\end{proof}

\subsection{The possible loss on a nonoptimal target}

For an isogeny $\nu:C\longrightarrow C'$ between elliptic curves
over $\Q$, write $\nu^*\omega_{C'}=c_\nu\omega_C$, using global
minimal differentials and choosing signs so that $c_\nu>0$.
The N\'eron mapping property makes $c_\nu$ an integer, and the
product of the multipliers of a degree-two isogeny and its dual
is $2$.

\begin{lemma}\label{lem:unique-nonunit}
If $C/\Q_2$ has additive reduction, at most one rational cyclic
two-isogeny from $C$ has nonunit minimal differential multiplier.
\end{lemma}

\begin{proof}
There is nothing to prove if the rational two-torsion is cyclic.
Otherwise complete the square in a minimal equation and write
$y^2=\prod_{i=1}^3(x-r_i)$.  The additive formal subgroup is
torsion-free, so $r_i\in\Z_2$.  The three difference valuations
are $n,n,m$ with $m>n$: after the common smallest power of two
is removed, three residues cannot be distinct in $\F_2$.
Also $n\leq1$.  If all roots were congruent modulo four,
translation by one root followed by $x=4X$, $y=8Y$ would lower
the discriminant by $2^{12}$ and still give an integral equation.

Translate either root of the close pair to zero.  In
\eqref{eq:two-isogeny-models} this gives
\[
 v_2(A)=n,\qquad v_2(B)=n+m,\qquad v_2(D)=2n.
\]
The displayed quotient has $c_4=16(A^2+12B)$ and differential
multiplier one before minimization.  A nonunit multiplier would
therefore require a scaling by two to a minimal target.  If
$n=0$, its minimal $c_4$ would be a unit, making the target
semistable, contrary to invariance of additive reduction under
isogeny.  If $n=1$, put the minimal target in integral
complete-square form.  The change of coordinates has
$x_{\rm naive}=4x_{\rm min}+r$.  The dual order-two point is
integral on the minimal additive target, so $r\in4\Z_2$.
The transformed linear coefficient would be
\[
 \frac{D-4Ar+3r^2}{16}.
\]
Its numerator has valuation exactly two, since $v_2(D)=2$
and the other terms are divisible by sixteen.  This contradicts
integrality.  Thus neither close-pair kernel is a nonunit
direction; only the third kernel can be one.
\end{proof}

\begin{proposition}\label{prop:orientation}
Let $F_0$ be the optimal curve in an isogeny class with rational
two-torsion, and let $F$ be any curve in that class.  If the
class has an odd additive prime, then the Manin constant of a
minimal parametrization to $F$ is odd and
\begin{equation}\label{eq:nonoptimal-zero-loss}
 v_2(m_F/c_F^2)\geq v_2(m_{F_0}).
\end{equation}
If the reduction at two is additive, then
\begin{equation}\label{eq:nonoptimal-one-loss}
 v_2(m_F/c_F^2)\geq v_2(m_{F_0})-1.
\end{equation}
\end{proposition}

\begin{proof}
Choose a rational isogeny $\nu:F_0\longrightarrow F$ of least
degree.  Its kernel is cyclic: otherwise it contains $F_0[\ell]$
for some prime $\ell$, and factoring out $[\ell]$ lowers the
degree.  Take the two-primary part first and write it as a
nonbacktracking chain of $k$ two-isogenies, with successive curves
$F_0,F_1,\ldots,F_k$. In good ordinary
reduction, the nonunit direction is the unique connected kernel;
in multiplicative reduction the same assertion follows from Tate
uniformization.  At additive reduction it is
Lemma~\ref{lem:unique-nonunit}.  Consequently, after a unit step
the dual is the only possible nonunit next step.  Cyclicity
excludes this backtracking.  All nonunit steps therefore form
an initial run, say of length $s$.

The dual of that initial composite is an incoming isogeny
$F_s\longrightarrow F_0$ whose minimal differential multiplier
is a unit at every prime.  Proposition~\ref{prop:incoming-unit}
makes its entire cyclic kernel rational and places it in
$F_s^0(\Q_p)$ at every bad prime.  An odd additive identity
component has no nonzero two-primary torsion, so $s=0$ if an
odd additive prime exists.  At additive reduction at two,
Lemma~\ref{lem:additive-log} gives
$|F_s^0(\Q_2)[2^\infty]|\leq2$, hence $s\leq1$.

Odd-degree isogeny factors have unit multiplier at two.  By
Proposition~\ref{prop:manin-odd}, $v_2(c_{F_0})=0$, and hence
\[
 v_2(c_F)=s,\qquad
 v_2(m_F/c_F^2)=v_2(m_{F_0})+k-2s.
\]
Here minimal modular degrees multiply by $\deg\nu$, by the
optimal factorization.  If $s=0$ this proves the first assertion.
If $s\leq1$, the inequality $k\geq s$ gives the second.
\end{proof}

\begin{lemma}\label{lem:torsion-eight}
Suppose $C/\Q$ has additive reduction at two and a rational
two-primary torsion subgroup of order at least eight.  Then it
has a rational nonzero point of order two in $C^0(\Q_2)$.
For this point the minimal translated short equation has $B$
odd.  The same is true for its image on any quadratic twist
unramified at two; in particular the dyadic support number
$d$ in \eqref{eq:dyadic-support} is at most one on that twist.
\end{lemma}

\begin{proof}
The component group of an additive elliptic curve has order
at most four, by the minimal regular reduction calculation.
The torsion subgroup therefore has a nontrivial kernel in the
component group.  Since the two-primary torsion of
$C^0(\Q_2)$ has order at most two, this kernel supplies the
asserted point.  It is integral and nonsingular.  On a minimal
complete-square equation translated by it, nonsingularity of
$(0,0)$ in characteristic two is exactly the condition that
the linear coefficient $B$ is odd.  An unramified quadratic
extension preserves the identity component, and an order-two
point is unchanged by the sign defining a quadratic twist.
The assertion thus persists after such a twist and unramified
descent.
\end{proof}

\section{The semistable case}\label{sec:semistable}

For squarefree conductor, the equality case in the rank bound is
settled by a parity argument on a quotient of the modular curve.

\begin{lemma}\label{lem:common-component}
Suppose that \(E/\Q\) is semistable, has positive rank, and has
conductor \(N\). Normalize \(\phi(\infty)=O\), and put
\(H=\ker(\varepsilon:W\to\{\pm1\})\). Then
\[
 \im(t|_H)\ \subset\
 L:=E(\Q)[2]\cap\bigcap_{p\mid N}E^0(\Q_p),
 \qquad \dim_{\F_2}L\le1.
\]
Consequently \(v_2(\deg\phi)\ge\omega(N)-2\).
\end{lemma}
\begin{proof}
At a bad prime \(p\), Lemma~\ref{lem:prime-to-component}
shows that \(t_d\in E^0(\Q_p)\) whenever \(p\nmid d\). If \(p\mid d\), use the
complementary divisor \(N/d\) and \eqref{eq:fricke-zero}; its
translation is \(\pm t_d\).
Thus the assertion holds for every \(d\) in \(H\). On \(H\) the
translation is killed by two.

Over an unramified splitting field at a multiplicative prime,
Tate uniformization identifies the two-torsion of the identity
component with a subgroup of \(\mu_2\). Hence \(\#L\le2\).
The actual kernel of \(t|_H\) has order at least \(|H|/2\), and
\(|H|\ge2^{\omega(N)-1}\). Factoring \(\phi\) through this kernel
gives the last assertion.
\end{proof}

\begin{lemma}\label{lem:good-specialization}
Assume that \(N\) is odd, \(r>0\), and all the translations \(t_h\),
\(h\in H\), specialize to \(O\) at two. Then
\(|H|\mid\deg\phi\).
\end{lemma}
\begin{proof}
Both \(X_0(N)\) and \(E\) have smooth proper models over \(\Z_2\),
and \(\phi\) extends to them. The degree of the pullback of
\(\OO_E(3O)\) is constant on the fibers. Its generic degree is
\(3\deg\phi>0\), so the special map is nonconstant and has degree
\(\deg\phi\).

The genus of \(X_0(N)\) is at least two in the present situation.
Genus zero is impossible for a nonconstant map to an elliptic
curve. If the genus were one, the Abel--Jacobi map
\(\iota:X_0(N)\to J_0(N)\) based at \(\infty\) would be an
isomorphism. Its invariant differential pulls back to a nonzero
multiple of \(f_E(q)dq/q\). Since \(L(E,1)=0\), integration from
\(\infty\) to \(0\) would give \(\iota(0)=\iota(\infty)\),
contrary to the distinctness of these cusps.
Automorphisms of a smooth curve of genus at least two specialize
faithfully: its relative automorphism scheme is unramified, so two
sections agreeing on the special fiber agree over the DVR.
Thus the special action of \(H\) is faithful. The special map is
\(H\)-invariant because its translations vanish. Artin's theorem
on fixed fields gives the factor \(|H|\) in its degree, including
when the remaining extension is inseparable.
\end{proof}

\begin{lemma}\label{lem:cm-residue}
Let \(N\) be odd and squarefree, with every prime divisor congruent
to \(1\pmod4\). Let \(d>1\) divide \(N\), let \(x\) be a geometric
fixed point of \(w_d\) on \(X_0(N)\), and let \(y\) be its image on
\(X_0(N)/J\), where \(J\) is any subgroup of \(W\). Then
\[
                         \Q(\sqrt d)\subseteq\Q(y).
\]
In particular, \(y\) has even residue degree over \(\Q\), and its
base changes have even residue degree over \(\Q(i)\).
\end{lemma}
\begin{proof}
An Atkin--Lehner involution \(w_d\ne1\) fixes no cusp at squarefree
level. Choose \(z\) in the upper half-plane above \(x\).
A representative of the Atkin--Lehner coset fixing \(z\) has the form
\[
 g=\begin{pmatrix}d a&b\\Nc&d e\end{pmatrix},
             \qquad\det g=d.
\]
Its trace is divisible by \(d\), and
\(|\Tr g|<2\sqrt d\). Since \(d\ge5\), its trace is zero.
On \(\Lambda=\Z z+\Z\), multiplication by
\(\lambda=Ncz+de\) sends \(1\) to \(Ncz+de\) and \(z\) to \(daz+b\).
It is an endomorphism of trace zero and norm \(d\).
Consequently \(\lambda^2=-d\), and the endomorphism order is
\(\OO_K=\Z[\sqrt{-d}]\), where \(K=\Q(\sqrt{-d})\) has discriminant
\(-4d\). The order is maximal, because \(d\) is squarefree and
\(d\equiv1\pmod4\).

The full level subgroup is stable under this order: on its
generator \(1/N\),
\[
                     \lambda/N=cz+de/N.
\]
Each cyclic subgroup of order \(q\mid N\) is therefore the kernel
of an \(\OO_K\)-ideal of norm \(q\). In particular, all the
Atkin--Lehner isogenies from this point are horizontal, including
those at the level primes outside \(d\).

Let \(H_K\) be the Hilbert class field of \(K\).
The biquadratic field
\[
                  K(i)=\Q(i,\sqrt d)
\]
is unramified over \(K\): its three quadratic discriminants are
\(-4,d,-4d\), whose product is \(16d^2=\operatorname{disc}(K)^2\).
It is thus contained in \(H_K\).
For the real principal singular modulus
\(j_0=j(i\sqrt d)\), the main theorem of complex multiplication
gives \(H_K=K(j_0)\). Since \([\Q(j_0):\Q]=[H_K:K]\),
\(\Q(j_0)\) is the fixed field of complex conjugation.
It contains \(\sqrt d\). Every singular modulus for \(\OO_K\)
is a conjugate of \(j_0\), and \(\Q(\sqrt d)/\Q\) is Galois.
Therefore
\[
                       \Q(\sqrt d)\subseteq\Q(j(x)).
\]
The ideal-class description and reciprocity law for maximal CM
orders are given in \cite{CM,Galbraith}.

If \(\mathfrak q\) is one of the level ideals of norm \(q\mid N\),
its Artin automorphism in \(K(i)/K\) is trivial, since
\(q\equiv1\pmod4\). This remains true for a prime ramified in
\(K/\Q\), because \(K(i)/K\) is unramified and its Frobenius acts
on \(i\) by the \(q\)-power map. Hence the horizontal ideal action
associated with any \(w\in W\) fixes \(\sqrt d\).

If \(\sigma\in\Gal(\overline\Q/\Q)\) fixes \(y\), then
\(\sigma x=wx\) for some \(w\in J\). On the underlying
\(j\)-invariant this equals the action of an ideal-class
automorphism \(\sigma_{\mathfrak b}\) fixing \(\sqrt d\).
The automorphism \(\sigma_{\mathfrak b}^{-1}\sigma\) fixes \(j(x)\),
and hence \(\sqrt d\). Thus \(\sigma\) fixes \(\sqrt d\), proving
the asserted containment in the residue field of the quotient
point. Finally, the real quadratic field \(\Q(\sqrt d)\)
remains quadratic after adjoining \(i\).
\end{proof}

\begin{lemma}\label{lem:fixed-fiber}
Let \(u:C\to D\) be a finite map of smooth projective curves over
a characteristic-zero field \(k\), equivariant for involutions
\(j\) on \(C\) and \(a\) on \(D\). Suppose that \(a\) has a
\(k\)-rational fixed point and that every geometric fixed point
of \(j\) has even residue degree over \(k\). Then \(\deg u\) is even.
\end{lemma}
\begin{proof}
Pull back a rational fixed point to a \(j\)-invariant divisor.
Two-element orbits of closed points contribute even degree.
A stable closed point on which \(j\) acts nontrivially on the
residue field also has even degree, by the degree-two fixed-field
extension. If the residue-field action is trivial, its geometric
points are fixed and the hypothesis applies. These conclusions
include the ramification multiplicities in the pullback.
\end{proof}

\begin{lemma}\label{lem:semistable-parity}
Suppose that
\[
 E:\quad y^2=x(x^2+Ax+B),\qquad
 B=\pm16,\quad A\equiv1\pmod4,
\]
has odd squarefree conductor \(N\), unique nonzero rational
two-torsion point \(T=(0,0)\), and every prime divisor of \(N\)
congruent to \(1\pmod4\). In the case \(B=16\), suppose also
\(A>8\). If \(\varepsilon\ne1\) and
\(\im(t|_H)\subseteq\langle T\rangle\), then
\(|H|\mid\deg\phi\).
\end{lemma}
\begin{proof}
Let \(\eta:E\to E'=E/\langle T\rangle\). The map
\(\eta\phi\) descends to \(\psi:Y=X_0(N)/H\to E'\), and
\begin{equation}\label{eq:semistable-two-degree}
                    |H|\deg\psi=2\deg\phi.
\end{equation}
A negative Atkin--Lehner element induces an involution \(j\) on
\(Y\), and \(\psi j=a\psi\), where
\[
                  a(R)=-R+\eta(P)
\]
for a rational cuspidal torsion point \(P\in E(\Q)\).
Every geometric \(j\)-fixed point lifts to a point fixed by some
negative \(w_d\): if \(wx=hx\) with \(h\in H\), use \(wh^{-1}\).
Here \(d>1\). Lemma~\ref{lem:cm-residue} gives even residue
degree over both \(\Q\) and \(\Q(i)\).

It remains to find a fixed point of \(a\) over one of these fields.
The integral good model at two is
\[
            Y^2+XY=X^3+\frac{A-1}{4}X^2+\frac B{16}X.
\]
It has two or four points over \(\F_2\), and \(T\) reduces to
the nonidentity point \((0,0)\). Rational torsion injects under
reduction: its kernel is pro-two, and a nonzero torsion point
in the kernel would have a multiple of order two there,
contradicting uniqueness of \(T\).
The rational torsion is consequently cyclic of order two or four.
The duplication formula
\[
 x(2P)=\frac{(x(P)^2-B)^2}
                  {4x(P)(x(P)^2+Ax(P)+B)}
\]
shows that a point satisfying \(2P=T\) has \(x(P)^2=B\).
For \(B=-16\) this is impossible, so \(\eta(P)=O\) and
\(a\) fixes \(O\).

For \(B=16\), write \(u=A-8\), \(v=A+8\).
The standard two-isogenous equation is
\[
                    E':\quad y^2=x(x-u)(x-v),
                    \qquad v-u=16.
\]
If \(P\) has order at most two, again \(\eta(P)=O\).
Otherwise \(x(P)=4\) or \(-4\).
In the first case \(v=t^2\) for some \(t>0\) in \(\Q\),
\(\eta(P)=(v,0)\), and
\[
                R=(t^2+4t,-4t(t+4))\in E'(\Q)
                \quad\hbox{satisfies}\quad 2R=(v,0).
\]
In the second case \(u=s^2\), \(s>0\) rational,
\(\eta(P)=(u,0)\), and
\[
             R=(s^2+4is,\,16s-4is^2)\in E'(\Q(i)),
             \qquad 2R=(u,0).
\]
For the first point, the three cubic factors are
\(t(t+4),4(t+4),4t\); for the second they are
\(s(s+4i),4is,4i(s+4i)\). Their products equal the respective
squares of the displayed \(y\)-coordinates.
The tangent and duplication formulas on \(E'\) are
\[
 \lambda=\frac{3x^2-2(u+v)x+uv}{2y},\qquad
 x(2R)=\lambda^2+u+v-2x(R),
\]
\[
 y(2R)=-y(R)+\lambda\bigl(x(R)-x(2R)\bigr).
\]
The slopes are \(-t-4\) and \(-s-4i\), respectively.
Substitution gives \(2R=(v,0)\) and \(2R=(u,0)\).
The denominators are nonzero because \(t>4\) and \(s>0\).
Thus \(a\) has a fixed point over \(\Q(i)\).
Lemma~\ref{lem:fixed-fiber} now makes \(\deg\psi\) even.
Equation~\eqref{eq:semistable-two-degree} proves the assertion.
\end{proof}

\begin{proposition}\label{prop:semistable}
Theorem~\ref{thm:main} holds when \(N\) is squarefree.
\end{proposition}
\begin{proof}
By Lemma~\ref{lem:optimal-reduction}, take \(E\) optimal and
\(r>0\), and put \(n=\omega(N)\).
Lemma~\ref{lem:semistable-rank} gives \(r\le n-1\).
If \(2\mid N\), equation~\eqref{eq:optimal-multiplicative-kernel}
and Lemma~\ref{lem:common-component} make all translations on
\(H\) zero. Hence \(v_2(\deg\phi)\ge n-1\).

Assume \(N\) odd. Lemma~\ref{lem:common-component} settles
\(r\le n-2\). If \(\varepsilon=1\), its translation kernel
already has order at least \(2^{n-1}\). If \(t|_H=0\), the
same conclusion follows directly. The only remaining case is
\[
 r=n-1>0,\qquad \varepsilon\ne1,\qquad
 \im(t|_H)=\langle T\rangle\ne0.
\]
If \(T\) specializes to \(O\) at two, apply
Lemma~\ref{lem:good-specialization}. Otherwise \(T\) is
\'etale at two. The normalization and equality analysis in
Lemma~\ref{lem:extremal-rows} give
\[
 B=\pm16,\quad D=A^2-4B>0,\quad
 q\mid D\Longrightarrow q\equiv1\pmod4,
\]
and \(A>8\) for \(B=16\).

The same equality analysis excludes full rational two-torsion,
so \(T\) is the unique nonzero rational two-torsion point.
All primes of \(N\) divide \(D\), because \(B=\pm16\).
Lemma~\ref{lem:semistable-parity} supplies the last factor of
two, proving \(v_2(\deg\phi)\ge n-1=r\).
\end{proof}

\section{Quadratic twists and integral Fourier sums}\label{sec:twists}

Let \(E/\Q\) have nonzero rational two-torsion, and write \(N=N_E\).
Throughout this section, \(S\) is the set of odd additive primes of
\(E\), \(a=|S|\), and \(f=v_2(N)\). Put
\[
 D_v=\prod_{p\in S}(p^*)^{v_p}\quad(v\in\F_2^S).
\]
Every \(D_v\) is an odd fundamental discriminant, with \(D_0=1\).
Write \(\chi_v\) for its quadratic character and \(g_v\) for the
normalized newform of \(E^{(D_v)}\).  The extension generated by all
\(\sqrt{p^*}\) is unramified at \(2\).  Its ramification index at any
odd prime is at most two: over an odd local field there is only one
nontrivial quadratic character on inertia.

\subsection{Local conductors and signs}

The image of the mod-\(2\) representation fixes a nonzero vector and
therefore has order at most two.  The kernel of
\(\operatorname{GL}_2(\Z_2)\to\operatorname{GL}_2(\F_2)\) is pro-\(2\).
Consequently wild inertia acts trivially at every odd prime, including
\(3\).  At an odd additive prime the conductor exponent is therefore
two.  The tame potentially good inertia has order two or four;
the potentially multiplicative case is a ramified quadratic twist
of multiplicative reduction.  These are precisely the following
possibilities:
\[
\begin{array}{c|c|c}
 \text{reduction of }E & \text{reduction after a ramified quadratic twist}
       & \text{new conductor exponent}\\ \hline
 \mathrm{I}_0^* & \text{good} &0\\
 \mathrm{I}_n^*,\ n>0 & \text{multiplicative} &1\\
 \mathrm{III}\text{ or }\mathrm{III}^*
       &\mathrm{III}^*\text{ or }\mathrm{III}&2.
\end{array}
\]
Here and below an unramified quadratic twist is allowed in addition
to the indicated ramified twist.  Such a twist does not change these
conductor categories.  One can obtain the table either from the
tame inertia representation or directly from the minimal
discriminant valuations in Tate's algorithm.  In the order-four
case, tensoring the inertia characters by the quadratic character
interchanges the characters of order four; it cannot make the
representation unramified.

Call an odd additive prime \emph{removable} in the first two rows of
the table.  The remaining primes will be called primes of type
\(\mathrm{III}/\mathrm{III}^*\).  Thus \(N_{E^{(D_v)}}\mid N\).

The Atkin--Lehner sign at a prime of type
\(\mathrm{III}/\mathrm{III}^*\) is unchanged by a ramified quadratic twist.
Normalize the Weil representation to have determinant one.  If
\(p\equiv1\pmod4\), it is a sum \(\xi\oplus\xi^{-1}\) of tame
characters.  The product formula for local epsilon factors gives
root number \(\xi(-1)\).  A ramified quadratic twist multiplies this
by \(\chi(-1)=(-1/p)=1\).  If \(p\equiv-1\pmod4\), the representation
is induced from a character \(\xi\) of the unramified quadratic
extension.  Its restriction to units has order four and its value
on a uniformizer is \(-1\), by the determinant-one condition.
The restriction of a ramified quadratic character is its square on
units and is one on a uniformizer.  It therefore changes \(\xi\) to
\(\xi^{-1}\), giving an isomorphic induced representation.
The local epsilon-factor identities used here are the usual
one-dimensional product and induction identities; see
\cite[\S1]{Rohrlich}.

More generally, an unramified quadratic twist changes the sign at
a prime \(q\) by \(\chi(q)^{v_q(N)}\)
\cite[Proposition~8(ii)]{Rohrlich}. Thus the signs at odd
additive primes do not change under an unramified twist, the sign
at an odd multiplicative prime \(q\) changes by \(\chi_v(q)\),
and the sign at \(2\), when \(2\mid N\), changes by
\(\chi_v(2)^f\).

\subsection{Oldforms with prescribed signs}

The level can drop at a removable prime.  We now raise the resulting
newform to level \(N\), keeping both integrality and the original
Atkin--Lehner signs.  Write
\[
 V_pg(z)=g(pz).
\]
This convention is for forms: the corresponding pullback of
differentials under the degeneracy map \(z\mapsto pz\) is
\(pV_pg(q)\,dq/q\).

\begin{lemma}\label{lem:oldvectors}
Suppose \(p\) is an odd prime at which twisting has lowered the
conductor exponent from two.  Let \(g\) be the resulting normalized
newform, let \(a_p=a_p(g)\), and let \(\epsilon_p\) be the
Atkin--Lehner sign of the original newform at \(p^2\).
There is a normalized integral oldform of sign \(\epsilon_p\)
given by
\begin{equation}\label{eq:oldvectors}
\begin{cases}
 g-\epsilon_p a_p pV_pg,
       &\text{if \(g\) has conductor exponent one at \(p\)},\\
 g-a_pV_pg+p^2V_p^2g,
       &\text{if \(g\) is unramified at \(p\) and \(\epsilon_p=1\)},\\
 g-p^2V_p^2g,
       &\text{if \(g\) is unramified at \(p\) and \(\epsilon_p=-1\)}.
\end{cases}
\end{equation}
Every coefficient at \(p^j\), \(j\geq1\), is even.
Under a further unramified quadratic twist \(\chi\) at \(p\),
the coefficient at \(p^j\) is multiplied by \(\chi(p)^j\).
\end{lemma}

\begin{proof}
With the weight-two slash normalization, the Atkin--Lehner
matrices on the ordered old bases \((g,V_pg)\) and
\((g,V_pg,V_p^2g)\), respectively, are
\begin{equation}\label{eq:old-matrices}
 \begin{pmatrix}0&-a_p/p\\-a_pp&0\end{pmatrix},
 \qquad
 \begin{pmatrix}0&0&p^{-2}\\0&1&0\\p^2&0&0\end{pmatrix}.
\end{equation}
For the first matrix, use the lower-level identity
\(w_pg=-a_pg\), where \(a_p=\pm1\), followed by the
degree-\(p\) degeneracy map.  For the second, the two extreme
degeneracy maps are interchanged and the middle one is fixed.
These identities also follow by multiplying representatives for
the Atkin--Lehner operators with the matrices
\(\left(\begin{smallmatrix}p^j&0\\0&1\end{smallmatrix}\right)\);
the determinant factors in weight two give \(p\) and \(p^2\)
in \eqref{eq:old-matrices}.  This is the oldform normalization
of \cite{AL,Li}.  Multiplication of the displayed matrices by the
coefficient vectors in \eqref{eq:oldvectors} proves the required
signs.  Their first Fourier coefficient is one.

In the multiplicative case, \(a_{p^j}(g)=a_p^j\), so the coefficient
in the first line of \eqref{eq:oldvectors} is
\[
 a_p^j(1-\epsilon_pp)\qquad(j\geq1).
\]
It is even because \(p\) is odd.  Replacing \(a_p\) by
\(\chi(p)a_p\) proves the asserted covariance in this case.

In the good case put \(A_j=a_{p^j}(g)\), with \(A_{-1}=A_{-2}=0\).
Reduction of rational two-torsion at the odd good prime gives
\(a_p\equiv0\pmod2\).  The recurrence is
\[
 A_0=1,\qquad A_1=a_p,\qquad
 A_j=a_pA_{j-1}-pA_{j-2}\quad(j\geq2).
\]
For the plus vector the coefficient at \(p\) is zero, and for
\(j\geq2\) it is
\[
 A_j-a_pA_{j-1}+p^2A_{j-2}
       =p(p-1)A_{j-2}.
\]
For the minus vector it is \(A_j-p^2A_{j-2}\).
Modulo two the recurrence gives \(A_j=0\) for odd \(j\) and
\(A_j=1\) for even \(j\); hence the latter coefficient is also
even, including \(j=1\).
Finally the same recurrence shows that replacing \(a_p\) by
\(\chi(p)a_p\) replaces \(A_j\) by \(\chi(p)^jA_j\).
Since \(\chi(p)^{j-2}=\chi(p)^j\), both oldvectors have the
claimed covariance.
\end{proof}

Apply Lemma~\ref{lem:oldvectors} at every removable prime where
the conductor of \(g_v\) drops.  Operators at distinct primes
commute.  Denote the resulting level-\(N\) form by \(F_v\).
Then
\[
 F_0=f_E,\qquad a_1(F_v)=1,\qquad F_v\in\Z[[q]].
\]
The coefficients remain multiplicative, with the modified local
factors in \eqref{eq:oldvectors}.  At an additive prime that has
not been removed, all positive prime-power coefficients vanish.
If \(f\geq2\), every \(F_v\) has zero even-index coefficients;
in particular the half-translation \(z\mapsto z+1/2\) acts on
every \(F_v\) by \(-1\).

Let \(K\) be the matrix of Section~\ref{sec:descent}, with rows
indexed by the odd multiplicative primes \(q\), columns indexed by
\(p\in S\), and
\[
 K_{q,p}=[q/p]\in\F_2.
\]
Put
\begin{equation}\label{eq:packet-matrix}
 \zeta_p=[2/p],\qquad
 K^*=\begin{cases}K,&f\text{ even},\\
                 \left(\begin{smallmatrix}K\\\zeta\end{smallmatrix}\right),
                       &f\text{ odd},\end{cases}
 \qquad U=\Ker K^*.
\end{equation}
Write \(k^*=\rank_{\F_2}K^*\), so \(\dim U=a-k^*\).
For \(f=1\), the additional row is precisely the row belonging
to the multiplicative prime \(2\).
Quadratic reciprocity gives
\(\chi_{p^*}(q)=(q/p)\), also for \(q=2\).
The preceding sign calculations show that all \(F_v\), \(v\in U\),
have the same full Atkin--Lehner character as \(f_E\).

\subsection{Divisibility at every Fourier index}

We require a statement for affine subspaces, since those appear
when the twist field is nonsplit at \(2\).
An affine sign character on an affine \(\F_2\)-space \(A\) is a
function \(\rho:A\to\{\pm1\}\) whose restriction after choosing
any origin is a constant sign times a group character.

\begin{lemma}\label{lem:fourier}
Let \(A\subseteq\F_2^S\) be any nonempty affine subspace of
dimension \(b\), and let \(\rho\) be an affine sign character.
Then
\begin{equation}\label{eq:affine-fourier}
 G_{A,\rho}:=\sum_{v\in A}\rho(v)F_v
       \in 2^b\Z[[q]].
\end{equation}
\end{lemma}

\begin{proof}
Fix an integer \(n\geq1\).  If a prime of type
\(\mathrm{III}/\mathrm{III}^*\) divides \(n\), every
\(a_n(F_v)\) is zero.  Otherwise let \(I\) be the set of
removable primes dividing \(n\).  The coefficient can be
nonzero only on the affine slice
\[
 A_I=\{v\in A:v_p=1\text{ for all }p\in I\},
\]
since an unremoved additive prime has zero positive
prime-power coefficients.  If the slice is empty there is
nothing to prove.  Otherwise choose \(v_0\in A_I\), and let
\(L\) be the translation space of \(A\).  The translation space
of \(A_I\) is
\[
 L_I=\Ker(L\longrightarrow\F_2^I),
 \qquad
 \dim L_I=b-\rank(L\longrightarrow\F_2^I).
\]
Lemma~\ref{lem:oldvectors} and multiplicativity give
\[
 2^{|I|}\mid a_n(F_{v_0}).
\]
For \(t\in L_I\), the character \(\chi_t\) is unramified at
every prime dividing \(n\).  At primes in \(I\) use the exact
prime-power covariance in Lemma~\ref{lem:oldvectors}; at the
other primes use the ordinary unramified twist identity.
Together they give the equality
\[
 a_n(F_{v_0+t})=\chi_t(n)\,a_n(F_{v_0}).
\]
Thus the signed sum over \(A_I\) is either zero or, up to a
sign, \(2^{\dim L_I}a_n(F_{v_0})\).  Its valuation is at least
\[
 |I|+b-\rank(L\longrightarrow\F_2^I)\geq b.
\]
This also covers \(n=1\), for which \(I=\varnothing\).
If \(2\mid n\) and \(f\geq2\), the coefficients vanish.
If \(f\leq1\), the twist at \(2\) is unramified and the same
covariance applies.
\end{proof}

\begin{lemma}\label{lem:self-twists}
The subgroup of quadratic characters \(\chi\) for which
\(f_E\otimes\chi=f_E\) has order at most two.  If it is
nontrivial, its nontrivial element is the character of the
imaginary quadratic field of complex multiplication of \(E\).
If its vector belongs to \(\F_2^S\), it is supported only at
primes of type \(\mathrm{III}/\mathrm{III}^*\).

Let \(\kappa\in\{0,1\}\) be the dimension of the self-twist
subgroup contained in \(U\), and put \(h=a-k^*-\kappa\).
There is a subspace \(U'\subseteq U\) of dimension \(h\) such that the
\(F_v\), \(v\in U'\), have pairwise distinct prime-to-\(N\)
Hecke eigensystems.  For any character \(\rho:U'\to\{\pm1\}\),
\begin{equation}\label{eq:isolate-eigensystem}
 G_{U',\rho}=f_E+g_\rho,\qquad
 \langle f_E,g_\rho\rangle_N=0.
\end{equation}
\end{lemma}

\begin{proof}
A rational isogeny from \(E\) to a quadratic twist \(E^{(D)}\),
transported back to \(E\) over \(\overline{\Q}\), gives a
nonzero element of
\(\operatorname{End}_{\overline{\Q}}(E)\otimes\Q\)
on which Galois acts through \(\chi_D\).
Without complex multiplication this algebra is \(\Q\), so
only the trivial character occurs.  With complex
multiplication it is an imaginary quadratic field, whose
Galois representation is the sum of the trivial line and
its trace-zero line.  The character on the latter is exactly
the character of that quadratic field.  The equivalence
between equality of the newform eigensystems and rational
isogeny gives the first assertion.

A self-twist cannot involve a removable prime: twisting at
that prime would lower the conductor exponent from two.
Consequently a self-twist supported on \(S\) is supported
on the last row of the local table.  Its fundamental
discriminant is negative.

Choose \(U'\) complementary to the self-twist subgroup of
\(U\).  Equality of two eigensystems in \(U'\) would give a
nonzero self-twist in that complement, which is impossible.
Distinct prime-to-\(N\) eigensystems are orthogonal for the
Petersson inner product, since the operators \(T_\ell\),
\(\ell\nmid N\), are self-adjoint and distinguish them.
The term \(v=0\) is \(f_E\) with coefficient
\(\rho(0)=1\), which proves \eqref{eq:isolate-eigensystem}.
\end{proof}

Lemma~\ref{lem:fourier} therefore supplies
\[
 2^{-h}(f_E+g_\rho)\in\Z[[q]].
\]
The passage from this Fourier statement to a lattice on an
actual quotient of \(X_0(N)\) will be made in the following
sections.

\subsection{The exact degree change at removable primes}

The following identity compares a curve with its quadratic twist.

\begin{proposition}\label{prop:twist-norm}
Let \(F/\Q\) have nonzero rational two-torsion, let \(D\) be
an odd fundamental discriminant supported at odd primes
where \(F\) is semistable, and put \(E=F^{(D)}\).
For a curve \(C\), define
\[
 V(C)=v_2(m_C/c_C^2),
\]
using a minimal-degree parametrization to that particular
curve and its Manin constant.  Then
\begin{align}
 V(E)-V(F)
 ={}&\sum_{\substack{p\mid D\\F\text{ good at }p}}
  v_2\bigl((p-1)((p+1)^2-a_p(F)^2)\bigr)\notag\\
 &+\sum_{\substack{p\mid D\\F\text{ multiplicative at }p}}
  v_2(p^2-1).\label{eq:exact-twist-gain}
\end{align}
Every summand is at least three.
If \(F_0/\Q\) is isogenous to \(F\) and \(F_0(\Q)\) contains a
subgroup of order \(2^\ell\), then at a good prime the summand is at least
\(3,5,7\) for \(\ell=1,2,3\), respectively.
\end{proposition}

\begin{proof}
For a global minimal invariant differential \(\omega_C\), set
\[
 A(C)=\frac{i}{2}\int_{C(\C)}
                 \omega_C\wedge\overline{\omega_C},
 \qquad
 \|f_C\|_{N_C}^2=\langle f_C,f_C\rangle_{N_C}.
\]
Integrating the identity
\(\phi_C^*\omega_C=2\pi i c_C f_C(z)\,dz\) gives
\begin{equation}\label{eq:degree-period}
 \frac{m_C}{c_C^2}
       =\frac{4\pi^2\|f_C\|_{N_C}^2}{A(C)}.
\end{equation}
Compare \cite[(2.4)]{ELP}. Curves \(E\) and \(F\) have the
same complex \(j\)-invariant.  The weight-twelve scaling of
the discriminant and the weight-two scaling of the area give
\[
 \frac{A(F)}{A(E)}
          =\left|\frac{\Delta_E}{\Delta_F}\right|^{1/6}.
\]
A quadratic-twist isomorphism scales minimal differentials by a
rational multiple of \(\sqrt D\), so this area ratio is rational.
Since the quadratic twist is unramified at \(2\), the curves
become isomorphic over an unramified extension of \(\Q_2\);
minimal discriminant valuations are unchanged under such
an extension.  Thus \(v_2(\Delta_E)=v_2(\Delta_F)\) and
the area ratio has two-adic valuation zero.

It remains to compare Petersson norms.  Put
\(I_M=[\operatorname{SL}_2(\Z):\Gamma_0(M)]\).
Rankin--Selberg unfolding gives
\[
 \|g\|_M^2
   =\frac{I_M}{48\pi}
       \mathop{\rm Res}_{s=2}\sum_{n\geq1}
                                    \frac{|a_n(g)|^2}{n^s}
\]
for a normalized weight-two newform with trivial character.
Indeed the Eisenstein series at the width-one cusp has
residue \(3/(\pi I_M)\), whereas unfolding contributes
\(\Gamma(s)/(4\pi)^s\) to the coefficient Dirichlet series.
Only the local squared-coefficient factors at primes
dividing \(D\) change; all other coefficients are multiplied
locally by unramified signs.

At a good prime \(p\mid D\), the recurrence for \(A_j=a_{p^j}(F)\)
gives
\begin{equation}\label{eq:square-series}
 R_p(X):=\sum_{j\geq0}A_j^2X^j
  =\frac{1+pX}
         {(1-pX)((1+pX)^2-a_p(F)^2X)}.
\end{equation}
To obtain this identity, write
\(A_j=(\alpha^{j+1}-\beta^{j+1})/(\alpha-\beta)\),
where \(\alpha+\beta=a_p(F)\) and \(\alpha\beta=p\),
and sum three geometric series. The roots are distinct since
\(a_p(F)^2\ne4p\). After the twist the local squared-coefficient
series is one.  The level-index ratio is \(p(p+1)\).
Consequently the local norm ratio is
\[
 \frac{p(p+1)}{R_p(p^{-2})}
     =\frac{(p-1)((p+1)^2-a_p(F)^2)}{p}.
\]
At a multiplicative prime,
\(a_{p^j}(F)^2=1\), so \(R_p(X)=(1-X)^{-1}\);
the level-index ratio is \(p\), giving
\[
 \frac{p}{R_p(p^{-2})}=\frac{p^2-1}{p}.
\]
Multiplying these local ratios and using
\eqref{eq:degree-period} proves
\eqref{eq:exact-twist-gain}, since all the denominators \(p\)
are odd.

At an odd good prime the rational point of order two
reduces injectively, so \(a_p(F)\) is even.  Each of
\(p-1,p+1-a_p(F),p+1+a_p(F)\) is then even.  At a
multiplicative prime \(p^2-1\) is divisible by eight.
This proves the lower bound three.

For the refinement, isogenous curves have the same \(a_p\).
The rational \(2\)-primary subgroup of \(F_0\) injects under
reduction at the odd good prime, so
\[
 2^\ell\mid A:=p+1-a_p(F),\qquad
 B:=p+1+a_p(F)=2(p+1)-A.
\]
For \(\ell=2\), if \(p\equiv3\pmod4\), both \(A\) and \(B\)
are divisible by four and \(v_2(p-1)=1\), giving at least
five.  If \(p\equiv1\pmod4\), both are again divisible by
four and \(v_2(p-1)\geq2\), which is more than required.
For \(\ell=3\), if \(p\equiv3\pmod4\), both \(A,B\) are
divisible by eight, giving at least seven.  If
\(p\equiv1\pmod4\), then \(v_2(2(p+1))=2\), so
\(v_2(B)=2\); together with \(v_2(A)\geq3\) and
\(v_2(p-1)\geq2\) this again gives seven.
\end{proof}

\section{Integral differentials on quotients at two}\label{sec:quotients}

We now treat curves with an odd additive prime and \(v_2(N)\le1\).
Throughout, the target \(E\) is optimal and has positive rank.
Let \(a\) be the number of odd additive primes, let \(\mu\) be
the total number of multiplicative primes. Use the matrix \(K^*\)
of Section~\ref{sec:descent}, and put \(k^*=\rank K^*\).
For odd \(N\) this is \(K\); when \(2\parallel N\), the
extra row is the multiplicative prime two.

\begin{lemma}\label{lem:additive-AL-descent}
For any conductor \(N\), let \(E/\Q\) have positive rank and
an odd additive prime, and let \(\phi\) be a normalized modular
parametrization. The positive Atkin--Lehner group
\(H=\ker\varepsilon\) acts on \(\phi\) without translations.
Thus
\[
 \phi=\psi\pi,\qquad
 \pi:X_0(N)\longrightarrow Y=X_0(N)/H,\qquad
                  \deg\phi=|H|\deg\psi.
\]
In particular, for \(v_2(N)\le1\),
\(v_2(|H|)\ge a+\mu-1\).
\end{lemma}
\begin{proof}
Fix an odd additive prime \(p\).
Lemma~\ref{lem:prime-to-component} puts \(t_d\) in
\(E^0(\Q_p)\) whenever \(p\nmid d\).
If \(d\) belongs to \(H\) and \(p\mid d\), use the complementary
exact divisor and \eqref{eq:fricke-zero} to reach the same
conclusion. On \(H\), the translation is two-torsion.
At an odd additive prime, the formal subgroup is pro-\(p\) and
the smooth reduction is additive, so \(E^0(\Q_p)[2]=0\).
Every translation is consequently zero. The quotient factorization
and degree formula follow. There are \(a+\mu\) bad primes when
\(v_2(N)\le1\), and \(\varepsilon\) has image of order at most two.
\end{proof}

\begin{lemma}\label{lem:wild-quotient-local}
Let \(R\) be a complete DVR of characteristic zero with
algebraically closed residue field of characteristic two.
Let a finite group act over \(R\) on a semistable relative curve
with smooth generic fiber.
The quotient is smooth at the image of a smooth point. At
a node its completed local ring is either a node or a smooth
ring.
\end{lemma}
\begin{proof}
Let \(\pi\) be a uniformizer of \(R\), and put \(k=R/(\pi)\).
It is enough to consider the stabilizer of a geometric special
point, replacing it by its effective image on the local ring.
At a smooth point its complete local ring is \(B=R[[t]]\).
For a stabilizer \(G\) of order \(n\), set
\(u=\prod_{\sigma\in G}\sigma(t)\), subtracting its constant
term. Modulo \(\pi\), this has order \(n\) in \(t\).
Weierstrass preparation makes \(B\) finite free of rank \(n\)
over \(A=R[[u]]\). Artin's fixed-field theorem gives
\([\operatorname{Frac}B:(\operatorname{Frac}B)^G]=n\).
Thus the fixed field is \(\operatorname{Frac}A\).
Since \(A\) is normal and \(B\) is integral over it,
\(B^G=A\).

At a node write
\[
                 B=R[[x,y]]/(xy-\pi^e).
\]
First let \(G\), of order \(n\), preserve both branches.
The equality of the Weil divisors of \(x\) and \(\sigma(x)\)
gives \(\sigma(x)=x u_\sigma\) for a unit \(u_\sigma\);
similarly \(\sigma(y)=y u_\sigma^{-1}\).
For the norms \(X=\prod_\sigma\sigma(x)\) and
\(Y=\prod_\sigma\sigma(y)\) one has \(XY=\pi^{en}\).
The ideal \((\pi,X,Y)\) is primary to the maximal ideal of \(B\),
so \(B\) is finite over
\[
                     A=R[[X,Y]]/(XY-\pi^{en}).
\]
At the vertical prime \((\pi,X)\) there is just one prime of
\(B\) above it. The ramification index is one because \(\pi\)
is a uniformizer in both localized DVRs. The residue extension
\(k((y))/k((Y))\) has degree \(n\): the reduction of \(Y\)
has order \(n\) in \(y\), and Weierstrass preparation applies.
Since \(B\) is normal and finite over \(A\), it is the integral
closure of \(A\) in \(\operatorname{Frac}B\).
The finite extension of the localized DVRs has rank equal to
the product of the ramification index and residue degree.
The field degree is therefore \(n\). As above, Artin's theorem
and normality give \(B^G=A\).

If the stabilizer exchanges the branches, first divide by its
branch-preserving subgroup. The remaining involution \(\tau\)
exchanges the branches of a node \(B_0\).
The invariant \(t=X+\tau(X)\) has order one on each branch,
so \(B_0/(\pi,t)\) has length two.
It follows that \(B_0\) is finite over \(R[[t]]\).
It is Cohen--Macaulay, and hence is free over this regular
local ring; the displayed length makes its rank two.
Artin's theorem and normality now give
\(B_0^\tau=R[[t]]\).
These arguments prove the assertions, including inseparable
residue-field extensions in the branch-preserving case.
\end{proof}

\begin{proposition}\label{prop:quotient-integral}
Assume \(v_2(N)\le1\). Let \(\alpha\) be a holomorphic
characteristic-zero differential on \(X_0(N)\) with the full
Atkin--Lehner character \(\varepsilon\). If its \(q\)-expansion
at \(\infty\) is integral over \(\Z_2\), its descent to \(Y\)
belongs to the N\'eron cotangent lattice of \(J_Y\).
\end{proposition}
\begin{proof}
The local model assertions can be checked after base change to the
completion of the maximal unramified extension of \(\Q_2\).
Its residue field is algebraically closed, and integrality descends
faithfully to \(\Z_2\).
If \(N\) is odd, \(X_0(N)\) is smooth and proper over \(\Z_2\).
The quotient is smooth by Lemma~\ref{lem:wild-quotient-local},
and its special fiber is geometrically integral, being a finite
image of the geometrically integral special fiber upstairs.
The distinct Atkin--Lehner translates of \(\infty\) have distinct
exact-divisor cusp types modulo two. Thus \(H\) acts freely at
this special cusp, and the quotient is \'etale there.
The integral \(q\)-expansion is therefore an integral expansion
on \(Y\). A possible denominator of a holomorphic differential
is a vertical pole; on a smooth proper model with one special
component it is detected at any smooth point of that component.
There is no such pole. Hence the descended differential is
integral, and it belongs to the cotangent lattice of the
good-reduction Jacobian.

Suppose \(N=2M\), \(M\) odd. The regular semistable modular
model has two principal components \(X_0(M)_{\F_2}\), containing
\(\infty\) and \(w_2\infty\), joined at supersingular points by
chains of rational components. Each exceptional component has
at most two nodal branches. This description and the
identification of relative dualizing differentials with the
N\'eron cotangent lattice hold also at \(p=2\); see
\cite[\S5.2 and the proofs of Lemmas~5.19--5.20]{ARS}.
The group action extends to the regular model. Its quotient
is semistable by Lemma~\ref{lem:wild-quotient-local}; resolving
thick nodes inserts further rational chains.

On the resulting regular semistable model \(Z\) of \(Y\), call
the images of the original two principal components principal,
allowing the images to coincide. All remaining components are
rational and have at most two nodal branches. Indeed, the
normalization of the image of a rational component is rational,
and a quotient node lies under a source node by
Lemma~\ref{lem:wild-quotient-local}. Its incident branches are
images of the at most two incident branches upstairs.
The special fiber is connected. The quotient is \'etale at the two
distinguished cusps: odd Atkin--Lehner elements change their
prime-to-two cusp type, and \(w_2\) interchanges the principal
components. The full eigencharacter hypothesis implies that
the expansion at \(w_2\infty\) is the same integral series up
to sign. Thus the descended differential \(\beta\) is integral
at a smooth point of every principal component.

If \(\beta\) were not integral on \(Z\), choose \(b>0\) minimal
such that \(\gamma=2^b\beta\) is a global relative dualizing
differential. Its reduction is nonzero, since the kernel of
reduction of this lattice is twice the lattice. Its reduction
vanishes on each principal component, by the integral expansion
of \(\beta\) at the corresponding cusp. On a semistable fiber a
dualizing differential has at most simple poles at the nodal
branches, with opposite residues on the two branches of a node.
A rational component adjacent to a zero component has a zero
residue there. It has at most two branches, so the residue
theorem makes all its residues zero. Its differential is then
holomorphic on \(\mathbf P^1\), hence zero.
Connectivity propagates the vanishing along every rational
chain and tail, contradicting the nonzero reduction of
\(\gamma\). Therefore \(\beta\) is integral on \(Z\).
The N\'eron/dualizing identification for a semistable Jacobian
finishes the proof.
\end{proof}

\begin{proposition}\label{prop:semistable-at-two}
Theorem~\ref{thm:main} holds when \(v_2(N)\le1\).
\end{proposition}
\begin{proof}
The semistable case is
Proposition~\ref{prop:semistable}. Otherwise \(a\ge1\).
Let \(\kappa\in\{0,1\}\) be the dimension of the self-twist
subgroup in \(U=\ker K^*\). When \(2\parallel N\), multiplicative
reduction excludes complex multiplication and \(\kappa=0\).
Choose a linear complement to this subgroup in \(U\), of
dimension \(h=a-k^*-\kappa\).
By Lemma~\ref{lem:fourier}, a signed sum of the corresponding
forms has the shape
\[
                  G=f_E+g_\perp,\qquad
             G/2^h\in\Z_2[[q]]\,dq/q,
\]
where \(g_\perp\) is orthogonal to \(f_E\), and every summand
has the full Atkin--Lehner character \(\varepsilon\).
This remains valid for \(h=0\), with \(G=f_E\).
Let \(G_Y\) be the descent of \(G\) to \(Y\).
Proposition~\ref{prop:quotient-integral} puts \(G_Y/2^h\)
in the N\'eron cotangent lattice of \(J_Y\).
Equation~\eqref{eq:orthogonal-degree} and
Proposition~\ref{prop:manin-odd} give
\(v_2(\deg\psi)\ge h\).
Combining with Lemma~\ref{lem:additive-AL-descent}, we obtain
\[
 v_2(\deg\phi)\ge a+\mu-1+a-k^*-\kappa
                     =2a+\mu-1-k^*-\kappa.
\]
This is the rank bound in Proposition~\ref{prop:rank-bounds}
for good or multiplicative reduction at two.
\end{proof}

\section{Additive reduction at two}\label{sec:additive}

Assume from now on that \(f=v_2(N)\ge2\). Let \(a\) and \(m\)
count the odd additive and odd multiplicative primes, respectively.
The argument in this section applies a family of twists directly
to the original curve when at least one odd prime has type
\(\mathrm{III}\) or \(\mathrm{III}^*\). The case where every odd
additive prime is removable is treated separately in
Section~\ref{sec:completion}.

\subsection{The normalizer quotient}

\begin{lemma}\label{lem:dyadic-group}
If \(8\mid N\), put \(s_2:z\mapsto z+\tfrac12\) and
\(W_2=w_{2^f}\). Together with the odd Atkin--Lehner involutions
they generate a group
\[
                 G=D_8\times(\Z/2\Z)^{\omega(N)-1}.
\]
The group \(D_8\) is dihedral of order eight. The character of \(G\) on
\(f_E\) is nontrivial, with
\(\varepsilon(s_2)=-1\), and its positive kernel has order
\(2^{\omega(N)+1}\).
\end{lemma}
\begin{proof}
The matrix \(s_2\) normalizes \(\Gamma_0(N)\), has square one
on \(X_0(N)\), and acts on \(q\) by \(q\mapsto-q\).
It is defined over \(\Q\). It commutes, modulo \(\Gamma_0(N)\),
with every odd Atkin--Lehner operator. These statements also
follow by choosing the usual integral representatives; see
\cite{Bars}. To check the dyadic relation, replace \(W_2\)
temporarily by \(w_N\), differing by the commuting odd
involution \(w_{N/2^f}\). With
\[
 s_2=\begin{pmatrix}1&1/2\\0&1\end{pmatrix},
 \qquad
 w_N=\begin{pmatrix}0&-1\\N&0\end{pmatrix},
\]
the determinant-one representative of \((s_2w_N)^2\) is
\[
 C=\begin{pmatrix}N/4-1&-1/2\\N/2&-1\end{pmatrix}.
\]
It is not in \(\Gamma_0(N)\), whereas
\[
 C^2=
 \begin{pmatrix}
 N^2/16-3N/4+1&1-N/8\\
 N(N/8-1)&1-N/4
 \end{pmatrix}\in\Gamma_0(N).
\]
Thus the product of \(s_2\) and \(W_2\) has exact order four,
and the two involutions generate \(D_8\).

The intersection with the odd Atkin--Lehner group is trivial.
The images of \(\infty\) under the eight dihedral elements
have two-primary cusp-denominator valuations \(f,0,1,f-1\),
each occurring twice. These four valuations are distinct
for \(f\ge3\).
Only \(1,s_2\) preserve the two-primary type of \(\infty\);
a nonidentity odd Atkin--Lehner operator moves its odd cusp
type, while \(s_2\) fixes \(\infty\) itself.
This proves the product decomposition.
Finally \(a_{2n}=0\), since \(4\mid N\), so
\(f_E|s_2=-f_E\). Its character is nontrivial, and the stated
order of the positive kernel follows.
\end{proof}

\begin{proposition}\label{prop:normalizer-degree}
Let \(E/\Q\) have positive rank.
If \(8\mid N\), a normalized modular parametrization satisfies
\[
                       v_2(\deg\phi)\ge\omega(N).
\]
If \(8\mid N\) and an odd additive prime exists, the full positive kernel
\(H\) of Lemma~\ref{lem:dyadic-group} acts without translations,
and
\begin{equation}\label{eq:dyadic-quotient-degree}
 \phi=\psi\pi,\quad Y=X_0(N)/H,\quad
 v_2(\deg\pi)=a+m+2.
\end{equation}
If \(4\parallel N\) and \(a>0\), the ordinary Atkin--Lehner
positive kernel gives a quotient with
\begin{equation}\label{eq:four-quotient-degree}
                         v_2(\deg\pi)\ge a+m.
\end{equation}
\end{proposition}
\begin{proof}
First suppose \(8\mid N\).
Since \(s_2\) fixes \(\infty\), one has \(\phi s_2=-\phi\).
For an odd Atkin--Lehner operator \(w\), comparison of
\(\phi s_2w\) and \(\phi ws_2\) gives \(2t_w=0\), regardless
of the sign of \(w\). Lemma~\ref{lem:prime-to-component}
at two gives \(t_w\in E^0(\Q_2)\).
The integral additive logarithm in Lemma~\ref{lem:additive-log}
shows \(\#E^0(\Q_2)[2^\infty]\le2\).
By \eqref{eq:fricke-zero}, \(t_{w_N}=0\).
Writing \(w_N=W_2w_{N/2^f}\) therefore puts \(t_{W_2}\) in
the same group \(E^0(\Q_2)[2]\). The translation image of
the positive kernel has order at most two. Its kernel
has order at least \(2^{\omega(N)}\), proving the first bound.

Suppose that an odd additive prime \(p\) exists. The relations
\(W_2^2=1\) and \((s_2W_2)^4=1\) show that \(t_{W_2}\) is
killed by four; if \(\varepsilon(W_2)=1\), it is killed by two.
The exact divisor of \(W_2\) is prime to \(p\), so
Lemma~\ref{lem:prime-to-component} puts \(t_{W_2}\) in
\(E^0(\Q_p)\).
This group has no two-primary torsion, and \(t_{W_2}=0\).
Hence all dyadic generators act with zero translation.

Choose \(h_0=w_N\) or \(s_2w_N\), whichever belongs to \(H\).
It has zero translation and its odd label contains all the
odd bad primes. For \(h\in H\), write \(h=u w_d\), with
\(u\in D_8\) and \(d\) odd.
The vanishing of dyadic translations gives
\(t_h=\varepsilon(u)t_d\). If \(p\nmid d\),
Lemma~\ref{lem:prime-to-component} puts \(t_h\) in
\(E^0(\Q_p)\), and it is zero. If the label contains \(p\),
apply the same argument to \(hh_0\); its odd label is
complementary and its translation is still \(t_h\).
Thus the whole of \(H\) acts without translations.
Its order is \(2^{a+m+2}\), giving
\eqref{eq:dyadic-quotient-degree}.
For \(f=2\), Lemma~\ref{lem:additive-AL-descent} applies
to the ordinary Atkin--Lehner group, whose positive kernel
has order at least \(2^{a+m}\).
\end{proof}

\subsection{Realizing the forms by maps}

Suppose some odd additive prime \(p_0\) has type
\(\mathrm{III}\) or \(\mathrm{III}^*\).
Let \(S\) be the set of odd additive primes and \(V=\F_2^S\).
Use the discriminants \(D_v\) defined in Section~\ref{sec:twists}, and put
\[
                L=\Q(\sqrt{D_v}:v\in V).
\]
Every completion of \(L\) at two is unramified.
At \(p_0\) the ramification index is at most two: all the
other generators are unramified there. Tame inertia of
type \(\mathrm{III}\) or \(\mathrm{III}^*\) has order four.
It has order two after this ramification. Thus \(E_L\) remains
additive at \(p_0\).

Let \(U=\ker K^*\), with \(K^*\) and \(k^*\) as in
\eqref{eq:rank-matrices}.
The forms \(F_v\), \(v\in U\), of
Section~\ref{sec:twists} have the same full character as \(f_E\).
All their even-index coefficients vanish.
When \(8\mid N\), they also have the same character for \(G\),
because \(s_2\) acts by minus one.

\begin{lemma}\label{lem:actual-twist-maps}
For every \(v\in V\), the normalized old/new form \(F_v\)
can be realized by a map
\(\Phi_v:X_0(N)_L\to E_L\), normalized at \(\infty\), with
\[
                \Phi_v^*\omega_E=\lambda_v F_v,
       \qquad \lambda_v=r_v\sqrt{D_v},\quad
              r_v\in\Q^\times,\quad v_2(r_v)=0.
\]
\end{lemma}
\begin{proof}
The curve \(E^{(D_v)}\), and its optimal representative,
retain an odd additive prime. Proposition~\ref{prop:orientation}
therefore rules out nonunit two-isogeny steps from its optimal
representative. Proposition~\ref{prop:manin-odd} then gives an odd
Manin constant for its minimal parametrization.
The oldvectors in Lemma~\ref{lem:oldvectors} are realized by
integer linear combinations of degeneracy maps after clearing
only odd denominators: the pullback under \(z\mapsto dz\)
of \(g(q)dq/q\) is \(d\,g(q^d)dq/q\), and every such \(d\)
is odd. The sum of these maps to the elliptic curve is again
a map. Translate its value at \(\infty\) to zero.
The twist isomorphism \(E^{(D_v)}_L\to E_L\) changes minimal
differentials by a rational multiple of \(\sqrt{D_v}\), which
is a unit at every place over two. This proves the assertion.
\end{proof}

\begin{lemma}\label{lem:twice-descends}
Let \(P:X_0(N)_L\to E_L\) be any normalized map whose
differential has the common character above. For the quotient
\(Y\) in Proposition~\ref{prop:normalizer-degree}, the
differential of \([2]P\) descends to an integral N\'eron
cotangent differential on \(J_Y\) at every place over two.
\end{lemma}
\begin{proof}
If \(f\ge3\), the relation \(Ps_2=-P\) makes all odd
Atkin--Lehner translations two-torsion. The dyadic relation
makes \(t_{W_2}\) killed by four. At the surviving additive
prime \(p_0\), choose a place \(w\mid p_0\) of \(L\) and
apply Lemma~\ref{lem:prime-to-component} over \(L_w\). It puts
\(t_{W_2}\) in \(E_L^0(L_w)\), where there is no
two-primary torsion. Thus this translation is zero.
All translations on \(H\) are consequently killed by two,
and \([2]P\) is a map from \(Y_L\) to \(E_L\).

For \(f=2\), we chose only the ordinary Atkin--Lehner positive
kernel. Every one of its elements is an involution with
positive character, so its translation is killed by two
directly. Thus \([2]P\) again descends.

The induced homomorphism \(J_Y\to E_L\) extends to N\'eron
models. Pullback of a minimal differential is therefore
integral, as asserted.
\end{proof}

\subsection{An affine induction on the quotient lattice}

\begin{proposition}\label{prop:additive-packet}
Let \(A=v_0+U_0\) be any affine subspace of the common-character
twist space, of dimension \(h\), and let \(\rho:A\to\{\pm1\}\)
be an affine sign character. Put
\[
                       G_A=\sum_{v\in A}\rho(v)F_v.
\]
The descended differential satisfies
\begin{equation}\label{eq:additive-packet-lattice}
                 \frac{G_A}{2^{h-1}}\in\Omega(J_Y)\otimes\Z_2.
\end{equation}
For \(h=0\), the assertion means that \(2F_{v_0}\) is integral.
\end{proposition}
\begin{proof}
Work first at a fixed embedding \(L\hookrightarrow\overline\Q_2\)
with unramified valuation ring \(R\). Minimal differentials
remain minimal under this base change.
By Lemmas~\ref{lem:actual-twist-maps} and
\ref{lem:twice-descends}, \(2\lambda_vF_v\) is integral
on \(Y\). Since \(\lambda_v\) is a unit, this proves the
dimension-zero assertion.

Induct simultaneously on all affine spaces and characters.
Normalize by the unit \(\lambda_{v_0}\), and put
\(\beta_v=\lambda_v/\lambda_{v_0}\).
If \(v=v_0+t\), its Galois conjugates satisfy
\begin{equation}\label{eq:relative-weights}
       \sigma(\beta_v)=\chi_t(\sigma)\beta_v.
\end{equation}
Here \(\chi_t(\sigma)\) denotes the sign of the quadratic
Galois character associated with the relative twist.
For \(\sigma\in\Gal(L/\Q)\), the function
\[
                 \rho_\sigma(v)=\rho(v)\chi_{v-v_0}(\sigma)
\]
is again an affine sign character on \(A\).

First suppose that all relative twists split at two.
Then \(\beta_v\in\Z_2^\times\) in the chosen embedding.
Choose integers \(n_v\) such that
\(n_v\beta_v\equiv\rho(v)\pmod{2^hR}\).
Put \(e_v=(n_v\beta_v-\rho(v))/2^h\in R\) and
\(E_A=\sum_{v\in A}e_vF_v\).
For the sum of maps \(P=\sum_v[n_v]\Phi_v\),
\begin{equation}\label{eq:split-map-sum}
       \frac{P^*\omega_E}{\lambda_{v_0}}
               =G_A+2^h E_A,\qquad
               E_A\in\sum_{v\in A}R F_v.
\end{equation}
Lemma~\ref{lem:fourier} makes this differential divisible
coefficientwise by \(2^h\).
For every \(\sigma\in\Gal(L/\Q)\),
\eqref{eq:relative-weights} gives the equality in the fixed embedding
\[
 \sigma\!\left(\frac{P^*\omega_E}{\lambda_{v_0}}\right)
 =\sum_{v\in A}\rho_\sigma(v)F_v
   +2^h\sum_{v\in A}\chi_{v-v_0}(\sigma)e_vF_v.
\]
The first sum is divisible by \(2^h\) by
Lemma~\ref{lem:fourier}; the second sum has coefficients in \(R\).
Every conjugate of \(\lambda_{v_0}\) is a unit. Thus
\(P^*\omega_E\) is divisible coefficientwise by \(2^h\)
at every place above two. Its even-index coefficients vanish.
Proposition~\ref{prop:map-division} supplies an actual
normalized map \(\Psi\) with \([2^h]\Psi=P\).
Its differential still has the common character, so the
descent argument applies anew to this divided map.
Lemma~\ref{lem:twice-descends} makes
\[
                    \frac{P^*\omega_E}
                         {\lambda_{v_0}2^{h-1}}
\]
integral on \(Y\). Each \(2F_v\) is integral by the base
case, so \(2E_A\) is integral too.
Subtracting it in \eqref{eq:split-map-sum} proves the claim.

If the relative character at two is nontrivial, put
\(A_0=\{v_0+t:t\in U_0,\ D_t\in\Q_2^{\times2}\}\)
and \(A_1=A\setminus A_0\). These are parallel affine
hyperplanes of \(A\), with \(v_0\in A_0\). Write
\[
 G_i=\sum_{v\in A_i}\rho(v)F_v,\qquad G_A=G_0+G_1.
\]
Choose \(t_1\in U_0\) such that \(D_{t_1}\) is nonsquare
in \(\Q_2\), and put \(\delta=D_{t_1}\),
\(s=\sqrt{D_{t_1}}\in L\). Since every \(p^*\) is congruent
to one modulo four, \(\delta\in1+4\Z_2\).
Then \(u=(s-1)/2\) satisfies
\[
                 u^2+u+\frac{1-\delta}{4}=0.
\]
This monic equation has coefficients in \(\Z_2\), so \(u\in R\)
and \(s=1+2u\).
For \(v\in A_i\), \(\beta_v/s^i\in\Z_2^\times\).
Choose integers \(n_v\) with
\(n_v\beta_v/s^i\equiv\rho(v)\pmod{2^hR}\), and put
\[
 e_v=\frac{n_v\beta_v-\rho(v)s^i}{2^h}\in R
 \quad(v\in A_i),\qquad E_A=\sum_{v\in A}e_vF_v.
\]
For \(P=\sum_v[n_v]\Phi_v\),
\begin{equation}\label{eq:nonsplit-map-sum}
 B:=\frac{P^*\omega_E}{\lambda_{v_0}}
    =G_0+sG_1+2^hE_A
    =G_A+2uG_1+2^hE_A.
\end{equation}
The full affine Fourier sum is divisible by \(2^h\), and
the half sum \(G_1\) by \(2^{h-1}\).
Thus \(B\) is divisible by \(2^h\). The same holds at
every place over two. Indeed, for each \(\sigma\in\Gal(L/\Q)\),
put
\[
 E_\sigma=\sum_{v\in A}\chi_{v-v_0}(\sigma)e_vF_v.
\]
Its coefficients lie in \(R\), and
\eqref{eq:relative-weights} gives
\begin{align*}
 \sigma(B)
 &=\sum_{v\in A_0}\rho_\sigma(v)F_v
    +s\sum_{v\in A_1}\rho_\sigma(v)F_v+2^hE_\sigma\\
 &=\sum_{v\in A}\rho_\sigma(v)F_v
    +2u\sum_{v\in A_1}\rho_\sigma(v)F_v+2^hE_\sigma.
\end{align*}
The full and half sums are divisible by \(2^h\) and
\(2^{h-1}\), respectively. Since \(u\in R\) and
\(\sigma(\lambda_{v_0})\in R^\times\), the required
divisibility holds for every conjugate of \(P^*\omega_E\).

Apply map division and Lemma~\ref{lem:twice-descends} again.
The divided map is normalized and has the same differential
character.
Then \(B/2^{h-1}\) is integral on \(Y\). The induction
hypothesis on \(A_1\) gives
\(G_1/2^{h-2}\) integral on \(Y\), including \(h=1\),
when this is precisely the base case \(2G_1\).
Equation~\eqref{eq:nonsplit-map-sum} now yields
\[
 \frac{G_A}{2^{h-1}}
    =\frac B{2^{h-1}}-
         u\,\frac{G_1}{2^{h-2}}-2E_A,
\]
which is integral. This proves the induction.
It proves the assertion at every unramified completion
above two. Since the differential in
\eqref{eq:additive-packet-lattice} is rational, integrality
descends faithfully to the lattice over \(\Z_2\).
\end{proof}

\begin{proposition}\label{prop:surviving-prime}
Theorem~\ref{thm:main} holds if \(E\) is additive at two
and has an odd prime of type \(\mathrm{III}\) or
\(\mathrm{III}^*\).
\end{proposition}
\begin{proof}
Use the optimal positive-rank reduction and the quotient in
Proposition~\ref{prop:normalizer-degree}.
The common-character space has dimension \(a-k^*\).
If its unique possible imaginary self-twist is present,
remove that line by choosing a complement, and write
\(\kappa=1\); otherwise put \(\kappa=0\).
The remaining dimension is \(h=a-k^*-\kappa\).
By Lemma~\ref{lem:self-twists}, the forms now have
pairwise distinct eigensystems, and a character sum is
\(f_E+g_\perp\), with \(g_\perp\) orthogonal to \(f_E\).
Proposition~\ref{prop:additive-packet},
\eqref{eq:orthogonal-degree}, and the oddness of \(c_E\)
give
\[
                v_2(\deg\psi)\ge\max(0,a-k^*-\kappa-1).
\]

For \(f\ge3\), the resulting valuation bound is
\begin{align*}
 v_2(\deg\phi)
 &\ge a+m+2+\max(0,a-k^*-\kappa-1)\\
 &\ge 2a+m+1-k^*-\kappa.
\end{align*}
For even \(f\), \(k^*=k\), and the rank bound
\(2a+m+d-1-k-\kappa\), \(d\le2\), is no larger.
For odd \(f\) and \(d=2\), use the augmented rank
bound \(2a+m+1-k^*-\kappa\).
For odd \(f\) and \(d\le1\), use
\[
 r\le2a+m-k-\kappa
           \le2a+m+1-k^*-\kappa,
\]
since \(k^*\le k+1\).
For \(f=2\), the ordinary quotient gives instead
\[
 v_2(\deg\phi)\ge
 a+m+\max(0,a-k-\kappa-1)
              \ge2a+m-1-k-\kappa.
\]
The last expression is the rank bound after both
dyadic valuation coordinates have been removed.
\end{proof}

\section{Removal of the remaining additive primes and completion}
\label{sec:completion}

It remains to treat additive reduction at two with no odd prime
of type \(\mathrm{III}\) or \(\mathrm{III}^*\).
We first record a degree bound for the untwisted curve.

\begin{lemma}\label{lem:rank-zero-baseline}
Let \(F_0/\Q\) be optimal, have nonzero rational two-torsion,
be additive at two, and be semistable at every odd prime.
Let \(b\) be the number of its odd multiplicative primes.
If \(v_2(N_{F_0})\ge3\), there is an integer
\(0\le\ell\le3\) such that
\[
     2^\ell\mid\#F_0(\Q)_{\rm tors},
       \qquad v_2(m_{F_0})\ge b+2-\ell.
\]
If \(v_2(N_{F_0})=2\), then
\[
                         v_2(m_{F_0})\ge b-1.
\]
\end{lemma}
\begin{proof}
For \(v_2(N_{F_0})\ge3\), the normalizer positive kernel has order
\(2^{b+2}\), by Lemma~\ref{lem:dyadic-group}.
All odd Atkin--Lehner translations are in the common
group \(F_0^0(\Q_2)[2]\), of order at most two:
Lemma~\ref{lem:prime-to-component} applies at two, and
their commutation with \(s_2\) kills the translations by two.
The relation \((s_2W_2)^4=1\) kills the dyadic translation
by four. Thus the translation image on the positive
kernel is a subgroup of \(F_0(\Q)\) of order \(2^\ell\)
with \(\ell\le3\). Factoring through its actual
kernel gives \(v_2(m_{F_0})\ge b+2-\ell\).

For \(v_2(N_{F_0})=2\), the ordinary Atkin--Lehner positive kernel
has order at least \(2^b\). Its translation image is
contained in \(F_0(\Q)[2]\). The conductor-two-exponent
argument of Section~\ref{sec:descent} gives an odd
component group at two; together with
Lemma~\ref{lem:additive-log}, this excludes full rational
two-torsion. Its translation image therefore has order
at most two, which gives the stated bound.
\end{proof}

\begin{proposition}\label{prop:removable}
Theorem~\ref{thm:main} holds if \(E\) is additive at two
and all its odd additive primes are removable by quadratic
twisting.
\end{proposition}
\begin{proof}
Take \(E\) optimal and of positive rank.
Let \(m\) count its odd multiplicative primes and put \(f=v_2(N)\).
First assume that there are no odd additive primes. If \(f\ge3\),
Proposition~\ref{prop:normalizer-degree} gives
\[
 v_2(m_E)\ge m+1,\qquad
 r\le m+d-1\le m+1
\]
by Proposition~\ref{prop:rank-bounds}.
If \(f=2\), the same rank proposition gives \(r\le m-1\),
and the ordinary positive Atkin--Lehner kernel loses at
most one translation factor, as in
Lemma~\ref{lem:rank-zero-baseline}. This also suffices.

Now suppose that at least one odd additive prime occurs.
Twist by the product \(D\) of \(p^*\) over all these
primes, and call the resulting particular curve \(F=E^{(D)}\).
Let \(g\) count those primes where \(F\) is good, and \(t\)
those where it is multiplicative; thus \(g+t\ge1\).
Let \(F_0\) be the optimal curve in the isogeny class of
\(F\). It has \(m+t\) odd multiplicative primes and no
odd additive primes. The twist is unramified at two,
so \(f\) is unchanged. We compare the degree of the
original optimal target with the rank of \(F_0^{(D)}\);
the latter has the same rank as \(E\).

Put \(V(C)=v_2(m_C/c_C^2)\).
The nonoptimal comparison of Proposition~\ref{prop:orientation}
and the exact twist formula of Proposition~\ref{prop:twist-norm}
give
\begin{equation}\label{eq:removal-comparison}
 v_2(m_E)=V(E)
 \ge v_2(m_{F_0})-1+
  \sum_{\text{good }p}v_2\bigl((p-1)((p+1)^2-a_p(F)^2)\bigr)
  +\sum_{\text{mult }p}v_2(p^2-1).
\end{equation}
The sums are over \(p\mid D\), grouped by the reduction of \(F\).
Each local gain is at least three.
At a good prime, \(a_p(F)=a_p(F_0)\) by isogeny invariance;
thus rational torsion on \(F_0\) supplies the refined gains
in this same formula.
The term \(-1\) is the loss in passing from \(F_0\) to \(F\).

First take \(f\ge3\).
Lemma~\ref{lem:rank-zero-baseline}, with \(b=m+t\), gives
\[
                  v_2(m_{F_0})\ge m+t+2-\ell,
                     \qquad 0\le\ell\le3.
\]
The elementary descent bound on \(F_0^{(D)}\), discarding
the nonnegative matrix-rank defect, is
\begin{equation}\label{eq:removed-rank}
                       r\le m+2g+2t+d-1,\qquad d\le2.
\end{equation}
If \(\ell\le1\), the difference between the degree bound
in \eqref{eq:removal-comparison} and the right side of
\eqref{eq:removed-rank} is at least
\[
                         g+2t+2-\ell-d\ge0.
\]
If \(\ell=2\), rational torsion of order at least four
improves each good-prime gain from three to five.
The difference is then at least
\[
                              3g+2t-d\ge0.
\]
If \(\ell=3\), there are at least eight rational
two-primary torsion points on \(F_0\).
Lemma~\ref{lem:torsion-eight} permits the descent point
to be chosen in the identity component at two, and
gives \(d\le1\) on the unramified twist \(F_0^{(D)}\).
Each good-prime gain is at least seven, so the
difference is at least
\[
                              5g+2t-2\ge0.
\]
All three inequalities hold for every \(g,t\ge0\) with
\(g+t\ge1\).

Finally, let \(f=2\). The untwist bound is
\(v_2(m_{F_0})\ge m+t-1\).
Allowing the loss one and the gains three gives
\[
                         v_2(m_E)\ge m+3g+4t-2.
\]
Both dyadic valuation coordinates are absent from descent,
so
\[
                           r\le m+2g+2t-1.
\]
Their difference is \(g+2t-1\ge0\).
\end{proof}

\begin{proof}[Proof of Theorem~\ref{thm:main}]
Lemma~\ref{lem:optimal-reduction} reduces the theorem to
an optimal positive-rank target. If \(v_2(N)\le1\),
apply Proposition~\ref{prop:semistable-at-two}.
If \(v_2(N)\ge2\), every odd additive prime has one of
the types classified in Section~\ref{sec:twists}.
If a type \(\mathrm{III}\) or \(\mathrm{III}^*\) prime
occurs, Proposition~\ref{prop:surviving-prime} applies.
Otherwise all odd additive primes are removable, including
the possibility that none occurs, and
Proposition~\ref{prop:removable} applies.
These alternatives exhaust the reduction types and give
\(r\le v_2(m_E)\) for the optimal curve.
Lemma~\ref{lem:optimal-reduction} gives the assertion for every
rational isogeny target and every parametrization.
\end{proof}

\begin{thebibliography}{99}

\bibitem{ARS}
A. Agashe, K. A. Ribet, and W. A. Stein,
\emph{The modular degree, congruence primes, and multiplicity one},
in \emph{Number Theory, Analysis and Geometry: In Memory of Serge Lang},
Springer, New York, 2012, 19--49.
\href{https://doi.org/10.1007/978-1-4614-1260-1_2}{doi:10.1007/978-1-4614-1260-1\_2}.

\bibitem{Allen}
P. B. Allen,
\emph{Powers of \(2\) in the modular degree via \(2\)-adic \(R=T\)},
preprint, \url{https://patrick-allen.github.io/research/watkins.pdf},
accessed November 10, 2026.

\bibitem{AL}
A. O. L. Atkin and W.-C. W. Li,
\emph{Twists of newforms and pseudo-eigenvalues of \(W\)-operators},
Invent. Math. \textbf{48} (1978), no. 3, 221--243.

\bibitem{Bars}
F. Bars,
\emph{The group structure of the normalizer of \(\Gamma_0(N)\)
after Atkin--Lehner},
preprint, 2007,
\href{https://arxiv.org/abs/math/0701636}{arXiv:math/0701636}.

\bibitem{BK}
S. Bhakta and S. Krishnamoorthy,
\emph{Watkins's conjecture for elliptic curves with a rational torsion},
preprint, 2024,
\href{https://arxiv.org/abs/2407.17680}{arXiv:2407.17680}.

\bibitem{BKP}
S. Bhakta, S. Krishnamoorthy, and S. K. Pasupulati,
\emph{Modular degree and a conjecture of Watkins},
preprint, 2023, revised 2025,
\href{https://arxiv.org/abs/2308.13708v3}{arXiv:2308.13708v3}.

\bibitem{BLR}
S. Bosch, W. L\"utkebohmert, and M. Raynaud,
\emph{N\'eron Models},
Ergebnisse der Mathematik und ihrer Grenzgebiete (3), vol. 21,
Springer-Verlag, Berlin, 1990.

\bibitem{Modularity}
C. Breuil, B. Conrad, F. Diamond, and R. Taylor,
\emph{On the modularity of elliptic curves over \(\Q\):
wild \(3\)-adic exercises},
J. Amer. Math. Soc. \textbf{14} (2001), no. 4, 843--939.

\bibitem{CDT}
F. Calegari, V. Dimitrov, and Y. Tang,
\emph{The unbounded denominators conjecture},
J. Amer. Math. Soc. \textbf{38} (2025), no. 3, 627--702.
\href{https://doi.org/10.1090/jams/1053}{doi:10.1090/jams/1053}.

\bibitem{CE}
F. Calegari and M. Emerton,
\emph{Elliptic curves of odd modular degree},
Israel J. Math. \textbf{169} (2009), 417--444.

\bibitem{Caro}
J. Caro,
\emph{Watkins's conjecture for quadratic twists of elliptic curves
with prime power conductor},
J. Th\'eor. Nombres Bordeaux \textbf{37} (2025), no. 2, 647--663.
\href{https://doi.org/10.5802/jtnb.1335}{doi:10.5802/jtnb.1335}.

\bibitem{CP}
J. Caro and H. Pasten,
\emph{Watkins's conjecture for elliptic curves with non-split
multiplicative reduction},
Proc. Amer. Math. Soc. \textbf{150} (2022), no. 8, 3245--3251.
\href{https://doi.org/10.1090/proc/15942}{doi:10.1090/proc/15942}.

\bibitem{Ces}
K. \v{C}esnavi\v{c}ius,
\emph{The Manin constant in the semistable case},
Compos. Math. \textbf{154} (2018), no. 9, 1889--1920.

\bibitem{CLN}
Z. Chi, S. Liu, and P. Nie,
\emph{On the Manin constant},
preprint, 2026,
\href{https://arxiv.org/abs/2610.25672v1}{arXiv:2610.25672v1}.

\bibitem{CM}
D. A. Cox,
\emph{Primes of the Form \(x^2+ny^2\):
Fermat, Class Field Theory, and Complex Multiplication},
2nd ed., John Wiley \& Sons, Hoboken, NJ, 2013.

\bibitem{Drinfeld}
V. G. Drinfeld,
\emph{Two theorems on modular curves},
Funct. Anal. Appl. \textbf{7} (1973), 155--156.

\bibitem{Dummigan}
N. Dummigan,
\emph{On a conjecture of Watkins},
J. Th\'eor. Nombres Bordeaux \textbf{18} (2006), no. 2, 345--355.

\bibitem{DK}
N. Dummigan and S. Krishnamoorthy,
\emph{Powers of \(2\) in modular degrees of modular abelian varieties},
J. Number Theory \textbf{133} (2013), no. 2, 501--522.

\bibitem{ELP}
J. A. Esparza-Lozano and H. Pasten,
\emph{A conjecture of Watkins for quadratic twists},
Proc. Amer. Math. Soc. \textbf{149} (2021), no. 6, 2381--2385.
\href{https://doi.org/10.1090/proc/15376}{doi:10.1090/proc/15376}.

\bibitem{Galbraith}
S. D. Galbraith,
\emph{Rational points on \(X_0^+(N)\) and quadratic \(\Q\)-curves},
J. Th\'eor. Nombres Bordeaux \textbf{14} (2002), no. 1, 205--219;
expanded author version, February 1, 2011,
\url{https://www.math.auckland.ac.nz/~sgal018/x0n.pdf}.

\bibitem{HK}
J. Hatley and D. Kundu,
\emph{Elliptic curves of conductor \(2^m p\), quadratic twists,
and Watkins' conjecture},
Ann. Math. Qu\'e. \textbf{50} (2026), 143--165.
\href{https://doi.org/10.1007/s40316-025-00249-8}{doi:10.1007/s40316-025-00249-8}.

\bibitem{KM}
N. M. Katz and B. Mazur,
\emph{Arithmetic Moduli of Elliptic Curves},
Annals of Mathematics Studies, vol. 108,
Princeton University Press, Princeton, NJ, 1985.

\bibitem{KK}
M. Kazalicki and D. Kohen,
\emph{On a special case of Watkins' conjecture},
Proc. Amer. Math. Soc. \textbf{146} (2018), no. 2, 541--545.

\bibitem{KKcorr}
M. Kazalicki and D. Kohen,
\emph{Corrigendum to ``On a special case of Watkins' conjecture''},
Proc. Amer. Math. Soc. \textbf{147} (2019), no. 10, 4563.

\bibitem{KS}
M. Kazalicki and S. Slijep\v{c}evi\'c,
\emph{Gross vectors modulo \(2\) and elliptic curves of prime conductor},
preprint, 2026,
\href{https://arxiv.org/abs/2608.13371}{arXiv:2608.13371}.

\bibitem{Kolyvagin}
V. A. Kolyvagin,
\emph{Finiteness of \(E(\Q)\) and \(\mathrm{Sha}(E,\Q)\)
for a subclass of Weil curves},
Math. USSR-Izv. \textbf{32} (1989), no. 3, 523--541.

\bibitem{Li}
W.-C. W. Li,
\emph{Newforms and functional equations},
Math. Ann. \textbf{212} (1975), no. 4, 285--315.

\bibitem{Manin}
Yu. I. Manin,
\emph{Parabolic points and zeta-functions of modular curves},
Math. USSR-Izv. \textbf{6} (1972), 19--64.

\bibitem{CFT}
J. S. Milne,
\emph{Class Field Theory}, version 4.03, August 6, 2020,
\url{https://www.jmilne.org/math/CourseNotes/CFT.pdf}.

\bibitem{Rohrlich}
D. E. Rohrlich,
\emph{Galois theory, elliptic curves, and root numbers},
Compos. Math. \textbf{100} (1996), no. 3, 311--349.

\bibitem{Silverman}
J. H. Silverman,
\emph{The Arithmetic of Elliptic Curves},
2nd ed., Graduate Texts in Mathematics, vol. 106,
Springer, Dordrecht, 2009.

\bibitem{SW}
W. A. Stein and M. Watkins,
\emph{Modular parametrizations of Neumann--Setzer elliptic curves},
Int. Math. Res. Not. \textbf{2004} (2004), no. 27, 1395--1405.
\href{https://doi.org/10.1155/S1073792804133916}{doi:10.1155/S1073792804133916}.

\bibitem{Watkins}
M. Watkins,
\emph{Computing the modular degree of an elliptic curve},
Experiment. Math. \textbf{11} (2002), no. 4, 487--502.

\bibitem{Wohlfahrt}
K. Wohlfahrt,
\emph{An extension of F. Klein's level concept},
Illinois J. Math. \textbf{8} (1964), 529--535.

\bibitem{Yazdani}
S. Yazdani,
\emph{Modular abelian varieties of odd modular degree},
Algebra Number Theory \textbf{5} (2011), no. 1, 37--62.

\end{thebibliography}

\end{document}