\documentclass[11pt,reqno]{amsart} \usepackage{jaswal} \newcommand{\Q}{\mathbb{Q}} \newcommand{\Z}{\mathbb{Z}} \newcommand{\cC}{\mathcal{C}} \newcommand{\cK}{\mathcal{K}} \newcommand{\Loc}{\mathsf{Loc}} \newcommand{\Ht}{\mathsf{Ht}} \newcommand{\Sc}{\mathsf{Sc}} \newcommand{\Int}{\mathsf{Int}} \newcommand{\F}{\mathbb{F}} \newcommand{\Sel}{\operatorname{Sel}} \newcommand{\one}{\mathbf{1}} \newcommand{\sym}[2]{\bigl[\tfrac{#1}{#2}\bigr]} \begin{document} \title[A proof that $\mathbb{Z}$ is Diophantine in $\mathbb{Q}$]{A proof that $\texorpdfstring{\boldsymbol{\mathbb{Z}}}{Z}$ is Diophantine in $\texorpdfstring{\boldsymbol{\mathbb{Q}}}{Q}$ through congruent-number twists} \author{Manvir Jaswal} \address{Toronto, Canada} \email{manvirjaswal@icloud.com} \urladdr{https://manvirjaswal.github.io} \date{November 11, 2026} \subjclass[2020]{Primary 11U05; Secondary 11G05, 11G18, 11F80, 11B30} \keywords{Hilbert's tenth problem, Diophantine sets, elliptic curves, congruent numbers, Shimura curves, Serre's conjecture} \hypersetup{pdftitle={A proof that Z is Diophantine in Q through congruent-number twists},pdfauthor={Manvir Jaswal},pdfkeywords={Hilbert's tenth problem, Diophantine sets, elliptic curves, congruent numbers, Shimura curves, Serre's conjecture}} \begin{abstract} We give a proof of Glazer and collaborators' theorem that $\Z$ is Diophantine in $\Q$, which builds on OpenAI's proof that Hilbert's tenth problem over $\Q$ has a negative answer. Integers are represented by multiples of a point on an elliptic curve of rank one over $\Q(\sqrt2)$. An existential condition on two congruent-number twists forbids poles of odd order at odd primes. A height bound at six rational points, from a quaternionic Shimura curve and Serre's conjecture (a theorem of Khare--Wintenberger and Kisin), and a prime pattern from the Green--Tao--Ziegler theorem turn congruences at chosen primes into identities between multiples, and the growth of a Lucas sequence forces integrality. Our contribution is the existence of the rational points that the condition on twists requires: for coprime squarefree integers $\beta>1$ and $\theta\ge1$ with $\beta\equiv\theta\equiv1\pmod8$, each a square modulo the primes of the other, there is an integer $e$ such that $y^2=x^3-e^2x$ and $y^2=x^3-e^2\theta^2x$ both have rank one and a rational point with abscissa in $\beta\Q^{\times2}$. Where Glazer and collaborators use a restricted $2$-converse theorem, this rests on published theorems: the genus criterion of Tian, Yuan and Zhang, with Gross--Zagier. \end{abstract} \maketitle \contents \section{Introduction}\label{sec:intro} The theorem is Glazer and collaborators' \cite{Glazer},\footnote{The manuscript \cite{Glazer} names no author. Its repository states that it was produced by Elliot Glazer with AI models, and that the project ``uses the collective agentic notes from'' Stefan Baranczuk, Jose Brox, Gabe Conant, Sohail Farhangi, James Freitag, Elliot Glazer, Jennifer Park and Caroline Terry.} and its proof builds on OpenAI's proof \cite{OpenAI}. \needspace{4\baselineskip} \begin{theorem}\label{thm:main} There are an integer $N\ge1$ and a polynomial $D\in\Z[X,Y_1,\dots,Y_N]$ such that, for every $x\in\Q$, \[ x\in\Z\quad\Longleftrightarrow\quad\text{there is }y\in\Q^N\text{ with }D(x,y)=0. \] \end{theorem} Robinson defined $\Z$ in $\Q$ by a first-order formula \cite{Robinson}, Poonen by a $\forall\exists$-formula \cite{Poonen}, and Koenigsmann by a universal one \cite{Koenigsmann}. An existential definition contradicts Mazur's conjecture that the closure of the rational points of a variety over $\Q$ in its real points has finitely many connected components \cite{MazurTopology}, \cite[Conjecture~3 and p.~166]{Mazur}, so \cref{thm:main} shows that this conjecture is false, as recorded in \cite[Corollary~13.1]{Glazer}. Koenigsmann states, in the arXiv versions of his paper, that a strong variant of the Bombieri--Lang conjecture, for varieties over $\Q$ with Zariski-dense rational points, would imply that no infinite subset of $\Z$ is Diophantine in $\Q$ \cite[\S4, Corollary~23]{KoenigsmannArXiv}; granting that implication, \cref{thm:main} shows that the variant is false. Denef suggested elliptic curves of rank one in place of Pell's equation \cite{Denef}; they were used for rings of integers by Poonen \cite{PoonenRankOne} and by Cornelissen, Pheidas and Zahidi \cite{CPZ}, and over $\Q$ an approach through rank-one curves and local divisibility conditions is due to Pheidas \cite{Pheidas}. On that strategy OpenAI proved that Hilbert's tenth problem over $\Q$ has a negative answer \cite[Theorem~1.1]{OpenAI}, by compactness from finite tests that do not define $\Z$, and Glazer and collaborators turned that proof into a definition. With Matiyasevich's theorem \cite{Matiyasevich}, \cref{thm:main} recovers the negative answer to Hilbert's tenth problem over $\Q$. \subsection*{How the formula works} Let $F=\Q(\sqrt2)$ and $E:y^2=x^3-c_0^2x$ with $c_0=3-\sqrt2$. The group $E(F)$ has rank one; fix a torsion-free subgroup $G=\Z P$ of finite index, and call $n$ the \emph{index} of $nP$. Points of $E(F)$ are tuples of rational numbers, so addition of indices is a polynomial condition over $\Q$; multiplication is not. The formula therefore attaches to each point a rational number, which we call its \emph{proxy}, and writes ring equations between proxies. The work is to make such an equation pass to the indices, and to force a given rational number to be an index. This takes five ideas. \begin{enumerate}[label=\textup{(\arabic*)}] \item \emph{A test for odd denominators.} An existential condition $\Phi(b)$ on two congruent-number twists forbids odd poles of $b$ at odd primes and holds at $b=qz^2$ for primes $q\equiv1\pmod8$ with $v_q(z)\ge0$. Asking for $\Phi$ at $r$ and at $w^2/r^{2L-1}$ then forces $v_q(w)\ge L$ at every odd prime where $r$ has odd valuation, so the formula never names a prime. \item \emph{Reading an index at a prime.} If $\lambda P$ and $\gamma P$ reduce to $O$ above $q$, the formal logarithm recovers $\lambda/\gamma$ modulo a power of $q$ from their coordinates, but not $\lambda$ itself; reading an index from coordinates through the formal group follows Poonen \cite[Lemmas~9 and~11]{PoonenRankOne}. A second reduction at the same place, on the conjugate $E^\sigma$ of $E$ under the nontrivial automorphism $\sigma$ of $F$, ties $\gamma$ to $1$ and $\lambda$ to the index modulo $q^{24}$. Imposed through (1), this makes a proxy agree with its index modulo $q^{24}$; the field $F$ is there so that a split prime gives two reductions at one place, whose orders can be made coprime up to $4$. \item \emph{A height bound.} For six fixed rational numbers $c$, the height of $t\in\Q$ is at most a constant times the $24$th power of the product of the primes where some $t-c$ has positive odd valuation. The exponent $24$ comes out of the proof of this bound, and the same number is then the precision in (2). Write the coordinates of a point as sums of three fractions and apply (2) at these primes. If a polynomial equation holds between proxies but not indices, its value at the indices is divisible by $q^{24}$ at each such prime, so it bounds the height of the point, which grows like the square of the index. Once $P$ is replaced by a large enough multiple, quadratic equations therefore pass from proxies to indices. \item \emph{Primes to test at.} For the formula to hold when proxies equal indices, every integer must be a sum of three fractions $u_j/v$ with each $u_j-cv$ a bounded multiple of a prime $q\equiv1\pmod8$ at which the reductions of $E$ and its conjugate have orders with greatest common divisor $4$. These come from Green--Tao--Ziegler and a sieve. \item \emph{Integrality.} Let $X$ be the rational number tested. Exact quadratic equations between indices, among them $s$ and $t$, encode a Pell equation whose solutions have $\log|t|\gg|s|\log|s|$, while a separate test bounds the height of $X^2+2$ linearly in $|s|$. By (3) this forces $X^2+2$ to be an index, so $X\in\Z$. \end{enumerate} \subsection*{What this paper adds} The proof of \cref{thm:main} given here uses only published theorems as outside input, with the authors' erratum \cite{GTZerratum} to one of them. One result here is ours: \cref{thm:pole} below, with its use in (1). Glazer and collaborators obtain the corresponding step, their pole completeness theorem \cite[Theorem~5.2]{Glazer}, from a restricted $2$-converse for $y^2=x(x-\ell)(x+3\ell)$, proved along the lines of OpenAI's \cite{OpenAIConverse} with Kato's Euler system at $2$; on congruent-number twists the genus criterion of Tian, Yuan and Zhang \cite{TYZ} replaces that converse. The same change of curves, from $y^2=x(x-\ell)(x+3\ell)$ to $y^2=x(x-\ell)(x+\ell)$, is made in J. McCarthy's Lean development and accompanying notes \cite{McCarthy}, with a different Selmer class and genus sum (\cref{rem:mccarthy}). The rest is Glazer and collaborators' development of OpenAI's proof (its local comparison, the contact framework of its height bound, its curve and its prime-pattern strategy \cite[\S\S2, 4--6]{OpenAI}), and is reproved here. The deduction of \cref{thm:main} from \cref{thm:pole,thm:contacts,thm:pattern} follows a note in their repository \cite{Note}, which has no named author and defines $\Z$ without compactness. The note takes a geometric hypothesis, at five contacts with one at infinity, and derives its height bound from it by a preprint of von K\"anel and Kret \cite[(7.19) and Theorem~7.1(ii)]{vKK}; \cref{thm:contacts}, at six finite contacts, stands in place of both. \Cref{thm:pattern,thm:pole} stand in place of its hypotheses on prime patterns and on rational points, and two further differences are named in \cref{sec:assembly}. The predicate $\Phi$ is a simplification of \cite[(3.2)]{OpenAI}: the curves are congruent-number twists, and the multiplier lists are dropped, since, as in \cite{Note}, completeness is needed only at $qz^2$ with $q\equiv1\pmod8$. \Cref{thm:contacts} is \cite[Theorem~4.1]{Glazer} in existence form, with modularity from Serre's conjecture at large primes of good reduction \cite{KW1,KW2,Kisin} in place of their route through Pan's theorem \cite{Pan}. \Cref{thm:pattern} follows \cite[Proposition~6.2]{Glazer} and its proof, restricted to the eighteen forms the formula uses. The polynomial $D$ is not explicit: $P$ is not computed, and the constant of \cref{thm:contacts} is only shown to exist; explicit polynomials of degree four, the least possible \cite[Theorem~18.1]{Glazer}, are constructed there. \subsection*{The three theorems} The proof rests on three theorems, which supply the points for (1), the bound of (3) and the primes of (4). Write $E_\ell:y^2=x^3-\ell^2x$ for $\ell\in\Q^\times$, and let $h$ be the absolute logarithmic height. \subsubsection*{The pole predicate} For $b\in\Q^\times$ and $t\in\Q$ with $1+bt^2\ne0$ put \begin{equation}\label{eq:U} U=b\,\frac{1-bt^2}{1+bt^2},\qquad\Theta=b(b-U^2). \end{equation} The \emph{pole predicate} $\Phi(b)$ is the condition that either $b=0$, or there are $t,e\in\Q$ with $1+bt^2\ne0$ and $e\Theta\ne0$ such that each of $E_e$ and $E_{e\Theta}$ has a rational point with abscissa in $b\Q^{\times2}$. If $\Phi(b)$ holds and $p$ is an odd prime, a count of valuations shows that $v_p(b)$ is not both negative and odd, since at such a pole $(1-bt^2)/(1+bt^2)$ is a $p$-adic unit, so $v_p(U)=v_p(b)$ and $v_p(\Theta)=3v_p(b)$. For the converse at $b=qz^2$, with $q\equiv1\pmod8$ prime and $v_q(z)\ge0$, take $t$ close to a root of $bt^2=1$ in $\mathbb{R}$ and in $\Q_2$; then every prime of odd valuation in $\Theta$ has $b$ locally a square, so $q$ and the squarefree part $\theta$ of $\Theta$ satisfy the hypotheses of the next theorem, and the integer $e$ it provides is a witness. \needspace{4\baselineskip} \begin{theorem}\label{thm:pole} Let $\beta>1$ and $\theta\ge1$ be coprime squarefree integers with $\beta\equiv\theta\equiv1\pmod8$, such that $\theta$ is a square modulo every prime dividing $\beta$ and $\beta$ is a square modulo every prime dividing $\theta$ \textup{(}we call such a pair \emph{admissible}\textup{)}. Then there is a positive squarefree integer $e$ such that $E_e$ and $E_{e\theta}$ both have analytic rank one and Mordell--Weil rank one, and each has a rational point of infinite order with abscissa in $\beta\Q^{\times2}$. \end{theorem} The integer $e$ is built by prescribing quadratic symbols, so that both twists have a $2$-Selmer group of dimension three containing a prescribed class. Since the prescribed class makes a bordered Monsky determinant equal to $1$ (\cref{lem:row5}), Smith's identity \cite[Theorem~2.2, Table~2, row~5(a)]{Smith}, reproved here from R\'edei's theorem \cite{Redei}, makes the first genus sum of \cite[Theorem~1.4]{TYZ} odd, which gives analytic rank one, and Gross--Zagier \cite{GrossZagier} with Bump--Friedberg--Hoffstein \cite{BFH} gives the point. \subsubsection*{Six contacts} Let $\cC=\{0,-15,-20,-24,-30,-60\}$; these six numbers are the branch points of the cover used in \cref{sec:height}, an orbit of a dihedral group of order $12$ acting on $\mathbf P^1$, and their differences have only the prime factors $2$, $3$ and $5$. For a finite set $S$ of primes and $t\in\Q\setminus\cC$, the \emph{contact primes} of $t$ are the primes $p\notin S$ with $v_p(t-c)$ positive and odd for some $c\in\cC$, and $M_S(t)$ is their product. \begin{theorem}\label{thm:contacts} There is a finite set $S_0$ of primes such that for every finite set $S\supseteq S_0$ there is a constant $H(S)\ge1$ with \[ h(t)\le H(S)\,M_S(t)^{24}\qquad\text{for every }t\in\Q\setminus\cC. \] \end{theorem} If $S\supseteq\{2,3,5\}$ and $t\in\Q\setminus\cC$, then $M_S(t)$ is the product of the primes outside $S$ dividing the squarefree integer $d$ with $t(t+15)(t+20)(t+24)(t+30)(t+60)\in d\,\Q^{\times2}$; so, with $S=S_0\cup\{2,3,5\}$, every rational point $(t,y)$ with $y\ne0$ on $dy^2=t(t+15)(t+20)(t+24)(t+30)(t+60)$, for a squarefree integer $d$, has $h(t)\le H(S)\,|d|^{24}$. A cover of $\mathbf{P}^1$ branched with index two exactly above $\cC$ carries a family of abelian surfaces with multiplication by the quaternion algebra of discriminant $6$. The fiber over $t$ is defined over a field of bounded degree unramified outside $S$ and the contact primes of $t$, and it has good reduction at places not above $S$; $M_S(t)$ enters through the ramification of that field. Fibers with complex multiplication have bounded Faltings height. For any other fiber, a twist descends the two-dimensional piece of its $\ell$-adic Tate module to an odd representation of $G_{\Q}$ with prime-to-$\ell$ conductor $O_S(M_S(t)^2)$, uniformly in $\ell$. At each large good $\ell$ its reduction has weight $2$ and comes from a newform of that level by Serre's conjecture \cite{KW1,KW2,Kisin}. There are finitely many such newforms, so one serves infinitely many $\ell$, and Faltings's theorem then makes the fiber an isogeny factor of $J_1(N)$ with $N$ of that size. The bounds of Javanpeykar \cite{Javanpeykar} and of Gaudron and R\'emond \cite{GaudronRemond} give $O_S(M_S(t)^{24})$ for its Faltings height, and Pazuki's comparison \cite{Pazuki} turns this into the bound on $h(t)$. Bounding the Faltings height in this way is von K\"anel's method for abelian schemes of $\mathrm{GL}_2$-type \cite[Theorem~A]{vonKanel}. \subsubsection*{The prime pattern} As in Koymans and Pagano's work on rings of integers \cite{KoymansPagano}, additive combinatorics supplies the primes. \needspace{4\baselineskip} \begin{theorem}\label{thm:pattern} There is a finite set $\cK$ of positive integers with the following property. For every $A\in\Z$ and every real $B_0$ there are integers $u_1,u_2,u_3,v$ with $v\ne0$ and $u_1+u_2+u_3=Av$ such that each of the eighteen numbers $u_j-cv$ $(1\le j\le3,\ c\in\cC)$ equals $\varepsilon\kappa q$ with $\varepsilon=\pm1$, $\kappa\in\cK$ and $q>B_0$ a prime such that $q\equiv1\pmod8$, $E$ and $E^\sigma$ have good reduction above $q$, and their reductions at a place above $q$ have orders $d_1,d_2$ with $\gcd(d_1,d_2)=4$ and $q\nmid d_1d_2$. \end{theorem} The lower bound for such patterns is Green and Tao's theorem on linear equations in primes \cite{GreenTao}, with \cite{GreenTaoMobius,GTZ}, and a Selberg sieve removes the primes with a larger common factor. \subsection*{Plan} \Cref{sec:data,sec:predicate,sec:local,sec:assembly} prove \cref{thm:main} from \cref{thm:pole,thm:contacts,thm:pattern}. \Cref{sec:polestep,sec:height,sec:primes} prove those three theorems and depend on each other only through the notation of \cref{sec:data}. What was computed, and with which software, is in \cref{sec:computations}. \section{The curve and the order of choices}\label{sec:data} \subsection{Notation} Throughout, $F=\Q(\sqrt2)$ and $\sigma$ is its nontrivial automorphism. We write $c_0=3-\sqrt2$, $E:y^2=x^3-c_0^2x$, and $E^\sigma:y^2=x^3-(c_0^\sigma)^2x$; a point $Q$ of $E(F)$ has a conjugate $Q^\sigma\in E^\sigma(F)$. The discriminant of $E$ is $64c_0^6$ and $c_0$ has norm $7$, so $E$ and $E^\sigma$ have good reduction at every place of $F$ above a prime other than $2$ and $7$. For a point $Q\ne O$ with $xy\ne0$ on $E$ or $E^\sigma$ put \[ \varpi(Q)=\frac1{x(Q)},\qquad z(Q)=-\frac{x(Q)}{y(Q)},\qquad\text{and}\quad\varpi(O)=z(O)=0. \] Then $\varpi(Q^\sigma)=\varpi(Q)^\sigma$ and $z(Q^\sigma)=z(Q)^\sigma$. Let $\log_{24}\in F[Z]$ be the truncation to degree at most $24$ of the formal logarithm of $E$ in the parameter $z$; its coefficients are $b_{j-1}/j$ with $b_{j-1}\in\Z[\sqrt2]$ \cite[IV.5.5]{Silverman}. The height $h$ is the absolute logarithmic height. We use $h(ab)\le h(a)+h(b)$, $h(a+b)\le h(a)+h(b)+\log2$, $h(a+b+c)\le h(a)+h(b)+h(c)+\log3$, $h(\sqrt2)=\tfrac12\log2$, and $h(u/v)=\log\max(|u|,|v|)$ for coprime integers $u,v$. Let $\hat h$ be the canonical height of $E$ \cite[VIII.9.3]{Silverman}: $\hat h(nQ)=n^2\hat h(Q)$, $\hat h(Q)>0$ for $Q$ of infinite order, and there is a constant $C_E\ge0$ with $|h(x(Q))-2\hat h(Q)|\le C_E$ for all $Q\ne O$ in $E(\overline F)$. \subsection{Rank one} \begin{proposition}\label{prop:rank} The group $E(F)$ has rank one. \end{proposition} \begin{proof} The ring $\Z[\sqrt2]$ is principal, its units are $\pm(1+\sqrt2)^{\Z}$, and the units $-1$ and $1+\sqrt2$ have real signs $(-,-)$ and $(+,-)$, so a totally positive unit is a square. The element $c_0$ is totally positive of norm $7$, so it generates a prime with residue field $\mathbb{F}_7$. Let $E':y^2=x^3+4c_0^2x$, and let $\alpha:E(F)\to F^\times/F^{\times2}$ and $\alpha':E'(F)\to F^\times/F^{\times2}$ be the descent maps of the $2$-isogeny, given by the abscissa away from $O$ and $(0,0)$, with $\alpha(0,0)=-c_0^2$, $\alpha'(0,0)=4c_0^2$ \cite[X.4.8, X.4.9]{Silverman}. Since $E[2]\subset E(F)$, the isogeny carries $E[2]$ onto the kernel of its dual, and the exact sequence of \cite[X.4.7]{Silverman} gives $2^{\operatorname{rank}E(F)+2}=|\operatorname{im}\alpha|\cdot|\operatorname{im}\alpha'|$. On $E$, a prime $\mathfrak p\ne(c_0)$ cannot have $v_{\mathfrak p}(x)$ odd: the right side of the equation would have valuation $3v_{\mathfrak p}(x)$ if $v_{\mathfrak p}(x)<0$ and $v_{\mathfrak p}(x)$ if $v_{\mathfrak p}(x)>0$. So $\operatorname{im}\alpha$ lies in the group of order $8$ generated by $-1$, $1+\sqrt2$ and $c_0$. It contains the classes $1,-1,c_0,-c_0$ of the $2$-torsion, which have equal signs at the two real places. Since $(1+\sqrt2)^3-c_0^2(1+\sqrt2)=8$, the point $(1+\sqrt2,2\sqrt2)$ lies on $E$, and its abscissa has signs $(+,-)$. So $|\operatorname{im}\alpha|=8$. On $E'$, write the equation as $y^2=x(x^2+4c_0^2)$. A nonzero abscissa is totally positive, since $x^2+4c_0^2>0$ at each real place. Suppose $v_{\mathfrak p}(x)$ is odd. If $\mathfrak p\nmid2c_0$ the valuation of the right side is odd as before. If $\mathfrak p=(\sqrt2)$, where $v_{\mathfrak p}(4c_0^2)=4$, it is $3v_{\mathfrak p}(x)$ or $4+v_{\mathfrak p}(x)$, again odd. If $\mathfrak p=(c_0)$, where $v_{\mathfrak p}(4c_0^2)=2$, it is odd unless $v_{\mathfrak p}(x)=1$; in that case $x=c_0w$ with $w$ a unit at $\mathfrak p$, and $y^2=c_0^3w(w^2+4)$ forces $w^2\equiv-4\pmod{c_0}$, which is impossible because $-4\equiv3$ is not a square in $\mathbb{F}_7$. So $x$ is a totally positive unit times a square, hence a square, and $\operatorname{im}\alpha'$ is trivial. Therefore $2^{\operatorname{rank}E(F)+2}=8$. \end{proof} \subsection{The order of choices}\label{ssec:choices} The following objects are fixed once, in this order. None depends on a variable of the formula. \begin{enumerate}[label=\textup{(\arabic*)}] \item The set $S_0$ of \cref{thm:contacts} and the set $\cK$ of \cref{thm:pattern}. Then $S=S_0\cup\{p\le31\}\cup\{p:p\mid\kappa\text{ for some }\kappa\in\cK\}$, a finite set of primes. Every prime $q\notin S$ is at least $37$; for such $q$ and a place $\mathfrak q\mid q$ of $F$, the place is unramified and $E$, $E^\sigma$ have good reduction at $\mathfrak q$. \item The constant $H=H(S)\ge1$ of \cref{thm:contacts}. \item An even integer $m_0\ge1$ killing the torsion of $E(F)$, and a generator $P_0$ of the infinite cyclic group $m_0E(F)$ (\cref{prop:rank}, and the Mordell--Weil theorem \cite[VIII.6.7]{Silverman}). \item An integer $m_1\ge1$ such that \begin{equation}\label{eq:C} C:=\frac{C_E+9H+3\log3+\tfrac32\log2}{2m_1^2\hat h(P_0)}<\frac14. \end{equation} Then $P=m_1P_0$, $m=m_0m_1$, and $G=mE(F)=\Z P$. The group $G$ is torsion-free, every point of $G\setminus\{O\}$ has $xy\ne0$, and $P\in2E(F)$ because $m_0$ is even. Moreover $\hat h(P)=m_1^2\hat h(P_0)$. \item An integer $m_2\ge9$ with $\log(m_2-1)>8H$. \end{enumerate} Only $P$, $m$, $m_2$, $\cK$ and $\cC$ occur in the formula; $S$ and $H$ enter only through the sizes of $m_1$ and $m_2$, and no coordinate of $P$ needs to be known. Since finite conjunctions and disjunctions, inequations and graphs of rational functions over $\Q$ reduce to one polynomial equation in more variables, the formula may quantify over points of $E(F)$, given by their coordinates in the basis $1,\sqrt2$ of $F$, and use the group law; in particular $Q\in G$ is $\exists R\in E(F)\ [m]R=Q$, and $Q\in[m_2]G$ is $\exists R\in E(F)\ [mm_2]R=Q$. \section{The pole predicate}\label{sec:predicate} We prove the two properties of the predicate $\Phi$ of \eqref{eq:U} and combine them into a test at a place of $F$. \begin{lemma}\label{lem:valU} Let $p$ be an odd prime, $b\in\Q^\times$ with $v_p(b)$ odd, and $t\in\Q$ with $1+bt^2\ne0$. Then $v_p(U)=v_p(b)$. \end{lemma} \begin{proof} If $t\ne0$ then $v_p(bt^2)$ is odd, hence nonzero, so $(1-bt^2)/(1+bt^2)$ is a $p$-adic unit. If $t=0$ then $U=b$. \end{proof} \needspace{4\baselineskip} \begin{lemma}\label{lem:pole-predicate} \begin{enumerate}[label=\textup{(\alph*)}] \item If $\Phi(b)$ holds and $p$ is an odd prime with $v_p(b)<0$, then $v_p(b)$ is even. \item If $q\equiv1\pmod8$ is prime and $z\in\Q^\times$ has $v_q(z)\ge0$, then $\Phi(qz^2)$ holds. \end{enumerate} \end{lemma} \begin{proof} (a) Suppose $k=v_p(b)<0$ is odd, and let $t,e$ be witnesses. By \cref{lem:valU}, $v_p(U^2)=2k0$, which is odd. This is a contradiction. (b) Put $b=qz^2$, so $b>0$, $k=v_q(b)\ge1$ is odd, and $b$ is a square in $\Q_2$. By weak approximation choose $t\in\Q$ close to a root of $bt^2=1$ in $\mathbb{R}$ and in $\Q_2$. Then $U$ is close to $0$ at both places, so $\Theta=b^2(1-U^2/b)$ is positive and lies in $\Q_2^{\times2}$. Write $\Theta=\theta c_1^2$ with $\theta\ge1$ a squarefree integer and $c_1\in\Q^\times$. We check that $(q,\theta)$ is admissible. Since $\theta$ is a square in $\Q_2$, it is odd and $\theta\equiv1\pmod8$. By \cref{lem:valU}, $v_q(U)=k$, so $v_q(U^2/b)=k>0$ and $\Theta\in\Q_q^{\times2}$; thus $q\nmid\theta$ and $\theta$ is a square modulo $q$. Let $p\mid\theta$, so that $p$ is odd and $p\ne q$. Then $v_p(b)=2v_p(z)$ is even and $v_p(\Theta)$ is odd, so $v_p(b-U^2)$ is odd. This forces $U\ne0$, $v_p(b)=v_p(U^2)$, and $b/U^2\in1+p\Z_p$. So $b$, and hence $q=b/z^2$, is a square in $\Q_p$, and $q$ is a square modulo $p$. \Cref{thm:pole} gives a positive squarefree integer $e$ and rational points with abscissa in $q\Q^{\times2}=b\Q^{\times2}$ on $E_e$ and on $E_{e\theta}$. The map $(x,y)\mapsto(c_1^2x,c_1^3y)$ carries $E_{e\theta}$ to $E_{e\Theta}$ and keeps the square class of the abscissa. Since $1+bt^2>0$ and $e\Theta\ne0$, the pair $t,e$ is a witness for $\Phi(b)$. \end{proof} For $L\ge1$, $r\in\Q^\times$ and $w\in\Q$, write $\Phi_L(r,w)$ for $\Phi(r)\wedge\Phi(w^2/r^{2L-1})$. \begin{lemma}\label{lem:parity-test} If $\Phi_L(r,w)$ holds and $q$ is an odd prime with $v_q(r)$ odd, then $v_q(r)>0$ and $v_q(w)\ge L$. Conversely, if $q\equiv1\pmod8$ is prime and $v_q(w)\ge L$, then $\Phi_L(q,w)$ holds. \end{lemma} \begin{proof} \Cref{lem:pole-predicate}(a) applied to $r$ gives $v_q(r)>0$. If $w\ne0$, the number $2v_q(w)-(2L-1)v_q(r)$ is odd, so it is positive by the same lemma, and $v_q(w)\ge L$ because $v_q(r)\ge1$. Conversely, $\Phi(q)$ is \cref{lem:pole-predicate}(b) with $z=1$, and if $w\ne0$ then $w^2/q^{2L-1}=q(w/q^L)^2$ with $v_q(w/q^L)\ge0$. \end{proof} The next device makes all tests at a prime $q$ happen at one place above it. For $D=A+B\sqrt2\in F$ with $A,B\in\Q$, and $\rho\in\Q$, write \[ \Phi_L^\rho(r;D)\ :\ \Phi_L\bigl(r,(\rho^2-2)B\bigr)\wedge\Phi_L(r,A+B\rho). \] \begin{lemma}\label{lem:one-place} Let $D_1,\dots,D_l\in F$ and $L_1,\dots,L_l\ge1$. \begin{enumerate}[label=\textup{(\alph*)}] \item If $\Phi_1(r,\rho^2-2)$ and all $\Phi_{L_i}^\rho(r;D_i)$ hold and $q$ is an odd prime with $v_q(r)$ odd, then $q$ splits in $F$ and, at the place $\mathfrak q\mid q$ with $\sqrt2\equiv\rho$, one has $v_{\mathfrak q}(D_i)\ge L_i$ for all $i$. \item If $q\equiv1\pmod8$ is prime and $\mathfrak q\mid q$ is a place with $v_{\mathfrak q}(D_i)\ge L_i$ for all $i$, then there is $\rho\in\Q$ such that $\Phi_1(q,\rho^2-2)$ and all $\Phi_{L_i}^\rho(q;D_i)$ hold. \end{enumerate} \end{lemma} \begin{proof} (a) By \cref{lem:parity-test}, $v_q(\rho^2-2)\ge1$. So $2$ is a square modulo $q$, and $\rho$ is a $q$-adic unit. Let $\eta\in\Z_q$ be the root of $\eta^2=2$ with $\eta\equiv\rho\pmod q$. Since $\eta+\rho$ is a unit, $v_q(\eta-\rho)=v_q(\rho^2-2)$. At the place $\sqrt2\mapsto\eta$, write $D_i=A_i+B_i\sqrt2$; then $A_i+B_i\eta=(A_i+B_i\rho)+B_i(\eta-\rho)$, and both summands have valuation at least $L_i$ by \cref{lem:parity-test}. (b) Let $\eta\in\Z_q$ be the image of $\sqrt2$ at $\mathfrak q$, and choose $\rho\in\Q$ with $v_q(\rho-\eta)\ge\max(\{1\}\cup\{L_i-v_q(B_i):B_i\ne0\})$. Then $v_q(\rho^2-2)=v_q(\rho-\eta)\ge1$, the numbers $(\rho^2-2)B_i$ have valuation at least $L_i$, and so does $A_i+B_i\rho=D_i(\mathfrak q)+B_i(\rho-\eta)$. \Cref{lem:parity-test} gives the assertions. \end{proof} \section{Reading an index at a prime}\label{sec:local} This section defines the local condition and proves its two properties (\cref{prop:local}). Throughout, $q\notin S$ is a prime, $\mathfrak q\mid q$ a place of $F$, and $v=v_{\mathfrak q}$ with $v(q)=1$. By \cref{ssec:choices}, $q\ge37$, the place is unramified, and $E$, $E^\sigma$ have good reduction at $\mathfrak q$. \begin{lemma}\label{lem:formal} Let $(\mathcal E,W)$ be $(E,P)$ or $(E^\sigma,P^\sigma)$. Let $U=uW$ and $V=u_0W$ with $u,u_0\in\Z$, $u_0\ne0$, reduce to the origin at $\mathfrak q$. Then: \begin{enumerate}[label=\textup{(\alph*)}] \item $v(z(U)/z(V))=v_q(u/u_0)$. \item If $\mathcal E=E$ and $v_q(u/u_0)\ge0$, then $\log_{24}(z(V))\ne0$ and \[ v\bigl(\log_{24}(z(U))/\log_{24}(z(V))-u/u_0\bigr)\ge24. \] \end{enumerate} \end{lemma} \begin{proof} Let $\log$ be the formal logarithm of $\mathcal E$ at $\mathfrak q$. Its coefficient of $Z^j$ has valuation at least $-v_q(j)$ \cite[IV.5.5]{Silverman}, and it is a homomorphism on the kernel of reduction, which $z$ identifies with the formal group \cite[IV.6.3, IV.6.4, VII.2.2]{Silverman}. Since $q$ is odd, $j-1>v_q(j)$ for $j\ge2$, so $v(\log Z)=v(Z)$ when $v(Z)\ge1$. From $u_0U=uV$ we get $u_0\log z(U)=u\log z(V)$, which proves (a) when $u\ne0$; if $u=0$ then $U=O$ and both sides are infinite. For (b), a prime $q\ge37$ has $j-1-v_q(j)\ge24$ for every $j>24$. So the tail $\mathcal R_{24}=\log-\log_{24}$ satisfies $v(\mathcal R_{24}(Z))\ge v(Z)+24$ when $v(Z)\ge1$, while $v(\log_{24}(Z))=v(Z)$. With $a=u/u_0$, \[ \log_{24} z(U)-a\log_{24} z(V)=a\mathcal R_{24}(z(V))-\mathcal R_{24}(z(U)). \] The right side has valuation at least $v(z(V))+24$: the first term because $v(a)\ge0$, the second because $v(z(U))\ge v(z(V))$. Divide by $\log_{24} z(V)$, which has valuation exactly $v(z(V))$. \end{proof} \begin{lemma}\label{lem:crt} Let $q\equiv1\pmod8$ be a prime outside $S$, with a place $\mathfrak q\mid q$ at which the reductions of $E$ and $E^\sigma$ have orders $d_1,d_2$ with $\gcd(d_1,d_2)=4$ and $q\nmid d_1d_2$. There are integers $\gamma>1$ and $j\ne0$ such that $\gamma P$ reduces to the origin on $E$ at $\mathfrak q$, $jP^\sigma$ and $(\gamma-1)P^\sigma$ reduce to the origin on $E^\sigma$ at $\mathfrak q$, $q^{24}\mid\gamma-1$, and $q\nmid j$. \end{lemma} \begin{proof} The residue field is $\mathbb{F}_q$. Each reduced curve has full rational $2$-torsion, so doubling has image of index $4$ in its group of points. Since $P\in2E(F)$, the orders $e_1,e_2$ of the reductions of $P$ and $P^\sigma$ divide $d_1/4$ and $d_2/4$. So $\gcd(e_1,e_2)=1$ and $q\nmid e_1e_2$. Take $\gamma>1$ with $\gamma\equiv0\pmod{e_1}$ and $\gamma\equiv1\pmod{e_2q^{24}}$, and $j=e_2$. \end{proof} \begin{definition}\label{def:local} Let $k\ge1$, $Q=(Q_1,\dots,Q_k)$ with $Q_i\in G\setminus\{O\}$, $a\in\Q^k$ and $r\in\Q^\times$. Put $Q_0=P$. The \emph{local condition} $\Loc(r;Q;a)$ is the existence of $V_0,J\in G\setminus\{O\}$, $V_1,\dots,V_k\in G$ and $\rho\in\Q$ such that, with $Y_i=V_i-Q_i$ $(0\le i\le k)$, the number $\log_{24}(z(V_0))$ is nonzero, $\Phi_1(r,\rho^2-2)$ holds, and the following hold: \[ \begin{aligned} &\Phi_1^\rho\bigl(r;\varpi(V_i)\bigr),\quad \Phi_1^\rho\bigl(r;\varpi(Y_i)^\sigma\bigr),\quad \Phi_{24}^\rho\bigl(r;z(Y_i)^\sigma/z(J)^\sigma\bigr)&&(0\le i\le k),\\ &\Phi_1^\rho\bigl(r;\varpi(J)^\sigma\bigr),\quad \Phi_{24}^\rho\bigl(r;\log_{24}(z(V_i))/\log_{24}(z(V_0))-a_i\bigr)&&(1\le i\le k). \end{aligned} \] \end{definition} Here $V_0$ and $V_i$ are multiples $\gamma P$ and $\lambda_iP$ of $P$. The tests on $\varpi(V_i)$ make them reduce to the origin on $E$ at one place above each prime $q$ with $v_q(r)$ odd, and the last test compares $a_i$ with $\lambda_i/\gamma$ through the logarithm. The tests on $Y_i^\sigma$ and $J^\sigma$, on $E^\sigma$ at the same place, give $\lambda_i\equiv n_i$ and $\gamma\equiv1$ modulo $q^{24}$, where $Q_i=n_iP$. \needspace{4\baselineskip} \begin{proposition}\label{prop:local} Write $Q_i=n_iP$. \begin{enumerate}[label=\textup{(\alph*)}] \item If $\Loc(r;Q;a)$ holds and $q\notin S$ is a prime with $v_q(r)$ odd, then for every $i$ the number $a_i$ is $q$-integral and $v_q(a_i-n_i)\ge24$. \item If $q\notin S$ is a prime as in \cref{lem:crt} and $a\in\Q^k$ has $v_q(a_i-n_i)\ge24$ for all $i$, then $\Loc(q;Q;a)$ holds. \end{enumerate} \end{proposition} \begin{proof} A point $V\ne O$ reduces to the origin at $\mathfrak q$ exactly when $v(\varpi(V))\ge1$. (a) By \cref{lem:one-place}(a), $q$ splits in $F$ and there is one place $\mathfrak q\mid q$ at which all the quantities in \cref{def:local} have the prescribed valuations. Write $V_0=\gamma P$, $J=jP$, $V_i=\lambda_iP$, with $\lambda_0=\gamma$ and $n_0=1$. The points $J^\sigma$ and $Y_i^\sigma$ reduce to the origin on $E^\sigma$, so \cref{lem:formal}(a) gives $v_q((\lambda_i-n_i)/j)\ge24$, and since $j$ is an integer, $v_q(\lambda_i-n_i)\ge24$ for $0\le i\le k$. In particular $\gamma\equiv1\pmod{q^{24}}$, so $\gamma$ is a unit and \[ \frac{\lambda_i}\gamma-n_i=\frac{(\lambda_i-n_i)-n_i(\gamma-1)}\gamma \] has valuation at least $24$. The points $V_i$ and $V_0$ reduce to the origin on $E$, so \cref{lem:formal}(b) applies with $U=V_i$, $V=V_0$. With the last test of \cref{def:local} this gives $v_q(a_i-\lambda_i/\gamma)\ge24$, hence $v_q(a_i-n_i)\ge24$. As $n_i\in\Z$, the number $a_i$ is $q$-integral. (b) Choose $\mathfrak q$ and $\gamma,j$ as in \cref{lem:crt}, and put $V_0=\gamma P$, $J=jP$, $V_i=\gamma n_iP$. Then $Y_0=(\gamma-1)P$ and $Y_i=(\gamma-1)n_iP$. Every $V_i$ reduces to the origin on $E$, and $J^\sigma$ and every $Y_i^\sigma$ on $E^\sigma$, at $\mathfrak q$. By \cref{lem:formal}, $\log_{24}(z(V_0))\ne0$, $v(\log_{24}(z(V_i))/\log_{24}(z(V_0))-n_i)\ge24$, and $v(z(Y_i^\sigma)/z(J^\sigma))=v_q((\gamma-1)n_i/j)\ge24$. Since $v(a_i-n_i)\ge24$, the ultrametric inequality gives $v(\log_{24}(z(V_i))/\log_{24}(z(V_0))-a_i)\ge24$. \Cref{lem:one-place}(b) produces $\rho$. \end{proof} \section{The formula}\label{sec:assembly} We define the height and scalar conditions, prove their properties, and show that the formula \eqref{eq:formula} holds exactly at the integers. The set $\cC$, the contact primes and $M_S(t)$ are those of the Introduction. \begin{lemma}\label{lem:contact-lift} Let $u,v\in\Q$ with $v\ne0$ and $t=u/v\notin\cC$. If a prime $q\notin S$ divides $M_S(t)$, then $v_q(u-c'v)$ is odd for some $c'\in\cC$. \end{lemma} \begin{proof} Let $c\in\cC$ with $a=v_q(t-c)>0$ odd, so $v_q(u-cv)=a+v_q(v)$. If $v_q(v)$ is even, take $c'=c$. If $v_q(v)$ is odd, take any $c'\in\cC\setminus\{c\}$: the difference $c-c'$ has only the prime factors $2,3,5$, so it is a $q$-adic unit, $v_q(t-c')=0$, and $v_q(u-c'v)=v_q(v)$. \end{proof} \begin{definition}\label{def:height} Let $k\ge1$, $Q\in(G\setminus\{O\})^k$, $a\in\Q^k$. The \emph{height condition} $\Ht(Q;a)$ is the existence of $\delta\in\Q^\times$ and $b_i,b_i'\in\Q$ with $\delta\,x(Q_i)=b_i+b_i'\sqrt2$ $(1\le i\le k)$ such that the following holds. Let $(A_\iota)_{0\le\iota\le2k}$ be the list $\delta,b_1,\dots,b_k,b_1',\dots,b_k'$. For each $\iota$ there are $u_{\iota1},u_{\iota2},u_{\iota3},v_\iota\in\Q$ with $v_\iota\ne0$ and $u_{\iota1}+u_{\iota2}+u_{\iota3}=A_\iota v_\iota$, and for each $\iota$, $j\in\{1,2,3\}$ and $c\in\cC$ there are $r_{\iota jc}\in\Q^\times$, $\varepsilon\in\{\pm1\}$ and $\kappa\in\cK$ with $u_{\iota j}-cv_\iota=\varepsilon\kappa r_{\iota jc}$ and $\Loc(r_{\iota jc};Q;a)$, with its own witnesses for each $(\iota,j,c)$. \end{definition} The choice of $\varepsilon,\kappa$ is a finite disjunction. The numbers $u_{\iota j}-cv_\iota$ are nonzero, so each slope $u_{\iota j}/v_\iota$ lies outside $\cC$. Three fractions are used, and not two, so that $\cK$ does not depend on the number written (\cref{rem:slopes}). \needspace{4\baselineskip} \begin{proposition}\label{prop:height} Let $Q_i=n_iP$, $B=\max|n_i|$, and let $C$ be as in \eqref{eq:C}. \begin{enumerate}[label=\textup{(\alph*)}] \item If $\Ht(Q;a)$ holds with witnesses $u_{\iota j},v_\iota$, and $D_0$ is a nonzero integer divisible by $q^{24}$ for every prime $q\notin S$ at which some $u_{\iota j}-cv_\iota$ has odd valuation, then $B^2\le C|D_0|$. \item If $\Ht(Q;a)$ holds and $R\in\Z[T_1,\dots,T_k]$ has $R(a)=0\ne R(n)$, then $B^2\le C|R(n)|$. If $a_i\ne n_i$, then $B^2\le C|D_0|$ for the reduced numerator $D_0$ of $a_i-n_i$. \item If $a_i=n_i$ for all $i$, then $\Ht(Q;a)$ holds. \end{enumerate} \end{proposition} \begin{proof} (a) Fix a slope $t=u_{\iota j}/v_\iota$. If $q\notin S$ divides $M_S(t)$, then by \cref{lem:contact-lift} some $u_{\iota j}-c'v_\iota$ has odd valuation at $q$, so $q^{24}\mid D_0$. As $M_S(t)$ is squarefree, $M_S(t)^{24}$ divides $D_0$, and \cref{thm:contacts} gives $h(t)\le H|D_0|$. Each $A_\iota$ is a sum of three slopes, so $h(A_\iota)\le3H|D_0|+\log3$. Since $x(Q_i)=(b_i+b_i'\sqrt2)/\delta$, \[ h(x(Q_i))\le h(b_i)+h(b_i')+h(\delta)+h(\sqrt2)+\log2\le9H|D_0|+3\log3+\tfrac32\log2. \] Using $2\hat h(Q_i)\le h(x(Q_i))+C_E$ and $|D_0|\ge1$, we get $2n_i^2\hat h(P)\le|D_0|(C_E+9H+3\log3+\tfrac32\log2)$, which is $n_i^2\le C|D_0|$ by \eqref{eq:C}. (b) Let $q\notin S$ be a prime where a number $u_{\iota j}-cv_\iota=\varepsilon\kappa r_{\iota jc}$ has odd valuation. Since $\kappa$ is a $q$-adic unit, $v_q(r_{\iota jc})$ is odd, and \cref{prop:local}(a) makes every $a_i$ $q$-integral with $a_i\equiv n_i\pmod{q^{24}}$. Hence $R(n)\equiv R(a)=0\pmod{q^{24}}$, and $q^{24}$ divides the reduced numerator of $a_i-n_i$. Apply (a). (c) Take $\delta$ a positive integer clearing the denominators of the coefficients of every $x(Q_i)$, so that all $A_\iota$ are integers. Apply \cref{thm:pattern} to each $A_\iota$ with $B_0>\max S$. For a number $\varepsilon\kappa q$ of the pattern put $r=q$; then $q\notin S$, and $\Loc(q;Q;a)$ holds by \cref{prop:local}(b). \end{proof} \needspace{4\baselineskip} \begin{definition}\label{def:scalar} For $\beta\in\Q$ and $Q_s\in G\setminus\{O\}$, the \emph{scalar condition} $\Sc(\beta,Q_s)$ is the existence of $u_1,u_2,u_3,v\in\Q$ with $v\ne0$, $u_1+u_2+u_3=\beta v$, and, for each $j\in\{1,2,3\}$ and $c\in\cC$, of $r_{jc}\in\Q^\times$, $\varepsilon\in\{\pm1\}$ and $\kappa\in\cK$ with $u_j-cv=\varepsilon\kappa r_{jc}$ and $\Loc(r_{jc};(Q_s);0)$. \end{definition} \begin{lemma}\label{lem:scalar} If $\Sc(\beta,sP)$ holds then $h(\beta)\le3H|s|+\log3$. For every $\beta\in\Z$ and every integer $m'\ge1$, $\Sc(\beta,sP)$ holds for infinitely many positive multiples $s$ of $m'$. \end{lemma} \begin{proof} Let $q\notin S$ with $v_q(r_{jc})$ odd. \Cref{prop:local}(a) with $Q=(sP)$ and $a=(0)$ gives $q^{24}\mid s$. By \cref{lem:contact-lift} and the fact that $\kappa$ is a $q$-adic unit, every prime of $M_S(u_j/v)$ is such a prime. So $M_S(u_j/v)^{24}\le|s|$, $h(u_j/v)\le H|s|$ by \cref{thm:contacts}, and $h(\beta)\le3H|s|+\log3$. For the second assertion, apply \cref{thm:pattern} with $A=\beta$ and $B_0>\max S$, with $r_{jc}=q_{jc}$ the primes obtained; they depend on $\beta$ only. Let $s$ be any positive common multiple of $m'$ and all $q_{jc}^{24}$. Each $q_{jc}$ is a prime outside $S$ as in \cref{lem:crt}, so \cref{prop:local}(b) with $Q=(sP)$ and $a=(0)$ gives $\Loc(q_{jc};(sP);0)$. \end{proof} The equation in (a) below is Matiyasevich's form of the Pell equation \cite[Lemma~18]{Matiyasevich}, and reading a divisibility of $j$ from the congruence $f_j\equiv j\pmod{\alpha-2}$ is his device \cite[Lemma~22]{Matiyasevich}. \begin{lemma}\label{lem:lucas} Let $\alpha\ge7$ be an integer and define $f_0=0$, $f_1=1$, $f_{j+1}=\alpha f_j-f_{j-1}$. Then: \begin{enumerate}[label=\textup{(\alph*)}] \item Every integer solution $(t,y)$ of $t^2-\alpha ty+y^2=1$ with $y\ne0$ has $|y|=f_k$ and $|t|\in\{f_{k-1},f_{k+1}\}$ for some $k\ge1$. \item If $s,t,w$ are integers with $|s|=\alpha$, $w\ne0$, and $t^2-s(s-2)tw+(s-2)^2w^2=1$, then $|t|\ge(\alpha-1)^{\alpha-4}$. \item For $s=\alpha$ there are positive integers $t,w$ satisfying the equation of \textup{(b)}. \end{enumerate} \end{lemma} \begin{proof} By induction, $f_{j+1}\ge(\alpha-1)f_j$, so $f_j\ge(\alpha-1)^{j-1}$ for $j\ge1$. Modulo $\alpha-2$ the recurrence gives $f_j\equiv j$, and modulo $\alpha+2$ it gives $f_j\equiv(-1)^{j-1}j$. Also $f_{j+1}^2-\alpha f_{j+1}f_j+f_j^2=f_j^2-f_{j-1}f_{j+1}$ for $j\ge1$, and this equals the same expression with $j-1$ in place of $j$, so its value is $1$. (a) If $t=0$ then $y^2=1$ and $k=1$. Otherwise $\alpha ty=t^2+y^2-1>0$, so we may take $t,y>0$; and $t\ne y$ since $t^2(2-\alpha)\ne1$. By symmetry it suffices to show that a solution with $t>y>0$ is $(f_{k+1},f_k)$ for some $k\ge1$. Argue by induction on $y$. If $y=1$ then $t=\alpha=f_2$. If $y\ge2$, then $t'=\alpha y-t=(y^2-1)/t$ satisfies $00$ then $(\alpha-2)\mid f_k$, so $(\alpha-2)\mid k$; if $s<0$ then $(\alpha+2)\mid f_k$, so $(\alpha+2)\mid k$. Either way $k\ge\alpha-2$ and $|t|\ge f_{k-1}\ge(\alpha-1)^{\alpha-4}$. (c) Take $k=\alpha-2$, $w=f_k/(\alpha-2)$, and $t=f_{k+1}$. \end{proof} With $m_2$ as in \cref{ssec:choices}, let $\Int(X)$ be the condition that, with $\beta=X^2+2$, there are points $Q_n,Q_s,Q_t,Q_w,Q_g,Q_{g'}\in G\setminus\{O\}$ with $Q_s\in[m_2]G$ and $\xi,\tau,\omega,\nu,\mu\in\Q$ such that \begin{equation}\label{eq:formula} \begin{gathered} \nu=(\xi-2)\omega,\qquad\mu=\xi\nu,\qquad\tau^2-\mu\tau+\nu^2=1,\\ \Ht\bigl((Q_n,Q_s,Q_t,Q_w,Q_g,Q_{g'});(\beta,\xi,\tau,\omega,\nu,\mu)\bigr),\qquad\Sc(\beta,Q_s). \end{gathered} \end{equation} Two further points differ from \cite{Note}: $\Sc$ uses the local condition with proxy $0$ in place of a separate test on auxiliary points, and the guard $Q_s\in[m_2]G$ replaces a finite list of excluded multiples of $P$. \begin{theorem}\label{thm:formula} For $X\in\Q$, $\Int(X)$ holds if and only if $X\in\Z$. \end{theorem} \begin{proof} Suppose $\Int(X)$. Write the six points as $nP,sP,tP,wP,gP,g'P$ and let $B\ge1$ be the largest absolute value of the six indices. Since $Q_s\in[m_2]G\setminus\{O\}$, we have $\alpha:=|s|\ge m_2\ge9$. The polynomials \[ R_1=T_5-(T_2-2)T_4,\qquad R_2=T_6-T_2T_5,\qquad R_3=T_3^2-T_6T_3+T_5^2-1 \] vanish at the proxies and are at most $4B^2$ in absolute value at the indices. If one of them were nonzero at the indices, \cref{prop:height}(b) would give $B^2\le4CB^24H\alpha. \end{equation} Suppose $\beta\ne n$, and let $D_0$ be the reduced numerator of $\beta-n$. Writing $\beta$ in lowest terms gives $|D_0|\le(1+B)e^{h(\beta)}\le2Be^{h(\beta)}$. By \cref{prop:height}(b), $B^2\le2CBe^{h(\beta)}$. With \cref{lem:scalar} and $C<\tfrac14$ this gives \begin{equation}\label{eq:upper} \log B\le\log(2C)+h(\beta)<3H\alpha+\log\tfrac32. \end{equation} Since $H\alpha\ge9$, the inequalities \eqref{eq:lower} and \eqref{eq:upper} contradict each other. So $X^2+2=n\in\Z$, and $X\in\Z$ because $X$ is rational. Conversely let $X\in\Z$ and $n=X^2+2$. By \cref{lem:scalar}, choose a positive multiple $s$ of $m_2$ with $\Sc(n,sP)$; then $s\ge9$. Choose positive $t,w$ by \cref{lem:lucas}(c), and put $g=(s-2)w$, $g'=sg$. These six integers are positive, the proxies $(\beta,\xi,\tau,\omega,\nu,\mu)=(n,s,t,w,g,g')$ satisfy the three equations of \eqref{eq:formula}, and $\Ht$ holds by \cref{prop:height}(c). \end{proof} \begin{proof}[Proof of \cref{thm:main}] By \cref{ssec:choices}, $\Int(X)$ is a finite positive existential formula over $\Q$ in the single free variable $X$, so it is equivalent to $\exists y\in\Q^N\ D(X,y)=0$ for a polynomial $D$ over $\Z$. Apply \cref{thm:formula}. \end{proof} \section{Two twists with a prescribed point}\label{sec:polestep} By \cref{prop:onetwist}, \cref{thm:pole} follows once each of $\ell=e$ and $\ell=e\theta$, both $\equiv5\pmod8$, satisfies three conditions: a class $(\beta,d)$ with $d\equiv5\pmod8$ lies in the $2$-Selmer group of $E_\ell$, that group has dimension three, and the first genus sum is odd. The Selmer group is the solution space of a linear system over $\F_2$ whose coefficients are quadratic symbols at the primes of $\ell$ (\cref{lem:system}), so the first condition is met by prescribing symbols. The class then gives a vector $k$ in the kernel of a symmetric matrix $M$ whose corank is the dimension of the Selmer group less two (\cref{lem:dictionary,lem:row5}). So the second condition says that $k$ spans the kernel, and this holds exactly when the matrix $M^{(c)}$, which is $M$ with the row and column of a coordinate $c$ with $k_c=1$ deleted, is invertible (\cref{lem:deletion}). The third condition then follows from the first two: the genus sum is, modulo $2$, the determinant of $M$ bordered by a fixed vector $b$ (\cref{thm:sigma}), and $b\cdot k=1$ for this class, so that determinant is $1$ when $k$ spans the kernel (\cref{lem:row5}). It remains to make $M^{(c)}$ invertible for $e$ and for $e\theta$ at once. For $e$, auxiliary primes merge the primes of $\beta$ into one index (\cref{lem:pinning}), which leaves a configuration on five indices where the system is solved by hand (\cref{lem:core}). For $e\theta$, the symbols between one prime of $e$ and the primes of $\theta$ are not constrained by the class, and $\det M^{(c)}$ is a multilinear function of them whose top coefficient is the determinant for $e$; so some choice of these symbols keeps it nonzero (\cref{lem:toggles}). \Cref{ssec:system} sets up the system and $M$, \cref{ssec:genus} proves the identity with the genus sum, and \cref{ssec:construction} builds $e$. For a positive squarefree integer $\ell$ the curve $\ell y^2=x^3-x$ of \cite{TYZ} is isomorphic over $\Q$ to $E_\ell$, by $(x,y)\mapsto(\ell x,\ell^2y)$. The $2$-torsion of $E_\ell$ is rational, and $2$-descent is the injection \cite[X.1.4]{Silverman} \[ \partial:E_\ell(\Q)/2E_\ell(\Q)\hookrightarrow(\Q^\times/\Q^{\times2})^2,\qquad\partial(x,y)=(x,x-\ell)\quad(x\ne0,\ell), \] with $\partial(0,0)=(-1,-\ell)$, $\partial(\ell,0)=(\ell,2)$, $\partial(-\ell,0)=(-\ell,-2\ell)$ and $\partial(O)$ trivial. We write $\Sel(\ell)$ for the $2$-Selmer group of $E_\ell$ in these coordinates. For a positive squarefree $d$ let $g(d)=\#2\operatorname{Cl}(\Q(\sqrt{-d}))$, as in \cite[p.~722]{TYZ}. For $\ell\equiv5\pmod8$ the first genus sum of \cite[Theorem~1.4]{TYZ} is \[ \Sigma_1(\ell)=\sum_{\ell=d_0d_1\cdots d_k}\ \prod_{i=0}^kg(d_i), \] over unordered factorizations with all $d_i>1$ and $d_i\equiv1\pmod8$ for $i>0$, with $k=0$ allowed. \Cref{thm:pole} follows from the next two statements, applied to $\ell=e$ and $\ell=e\theta$. \begin{theorem}\label{thm:construction} Let $(\beta,\theta)$ be admissible. There are a positive squarefree integer $e=\beta m$ with $m$ prime to $2\beta\theta$, and a divisor $d\equiv5\pmod8$ of $m$, such that for $\ell=e$ and for $\ell=e\theta$\textup{:} $\ell\equiv5\pmod8$, $\dim_{\F_2}\Sel(\ell)=3$, $(\beta,d)\in\Sel(\ell)$, and $\Sigma_1(\ell)$ is odd. \end{theorem} \begin{proposition}\label{prop:onetwist} Let $\ell$ be positive and squarefree with $\ell\equiv5\pmod8$ and $\Sigma_1(\ell)$ odd. Suppose that $\dim_{\F_2}\Sel(\ell)=3$ and that $\Sel(\ell)$ contains a class $(\beta,d)$. Then $E_\ell$ has analytic rank one and Mordell--Weil rank one, and the class is $\partial(Q)$ for a point $Q$ of infinite order. In particular $x(Q)\in\beta\Q^{\times2}$. \end{proposition} \begin{proof} Tian, Yuan and Zhang attach to $\ell y^2=x^3-x$ a number $L(\ell)$, defined up to sign, which vanishes if the order of vanishing at $s=1$ exceeds one \cite[p.~722]{TYZ}. Their Theorem~1.4 \cite[pp.~723--724]{TYZ} states that $L(\ell)$ is an integer and, for $\ell\equiv5\pmod8$, that $\Sigma_1(\ell)$ is even whenever $2^{-\rho(\ell)}L(\ell)$ is, where $\rho(\ell)\ge0$ is the integer defined in \cite[p.~723]{TYZ}: for such $\ell$ the first of the two sums printed there is $\Sigma_1(\ell)$. So $\Sigma_1(\ell)$ odd gives $L(\ell)\ne0$ and order at most one, and the root number is $-1$ \cite[p.~722]{TYZ}, so the order is exactly one. The curve $E_\ell$ has complex multiplication by $\Z[i]$, so it is modular \cite[p.~200]{Shimura}, and Gross and Zagier's theorem \cite[Ch.~I, (7.3)(1), p.~231]{GrossZagier}, that a modular elliptic curve $E$ over $\Q$ with $L(E,1)=0$ and $L'(E,1)\ne0$ has a rational point of infinite order, gives $r=\operatorname{rank}E_\ell(\Q)\ge1$; the imaginary quadratic field that its proof takes from Waldspurger's theorem \cite[Ch.~V, \S2, p.~312]{GrossZagier} is also supplied by \cite[Theorem~(ii), p.~544]{BFH}. Since $E_\ell[2]$ is rational, $\dim E_\ell(\Q)/2E_\ell(\Q)=2+r$, and $\partial$ embeds this group in $\Sel(\ell)$, of dimension $3$. Hence $r=1$ and $\partial$ is onto. So the class is $\partial(Q)$ for some $Q$; if $Q$ has finite order, replace it by $Q+2Q'$ with $Q'$ of infinite order. Then $x(Q)\notin\{0,\pm\ell\}$, so the first coordinate of $\partial(Q)$ is the class of $x(Q)$. \end{proof} \begin{remark}\label{rem:mccarthy} In McCarthy's notes \cite{McCarthy} the $2$-Selmer class has first coordinate of absolute value $\equiv7\pmod 8$ and the criterion is the part of Tian--Yuan--Zhang's second genus sum with factors $d_0\equiv7$, $d_1\equiv3\pmod 8$, which is $L_{5b}$ in \cite[Table~2]{Smith}, whereas here the class is $(\beta,d)$ with $\beta\equiv1$, $d\equiv5\pmod 8$ and the criterion is their first sum $\Sigma_1$. \end{remark} \subsection{The Selmer group as a linear system}\label{ssec:system} Let $\ell=p_1\cdots p_r$ be odd and squarefree. For an odd prime $p$ and a $p$-adic unit $a$, let $\sym ap\in\F_2$ be $0$ exactly when $a$ is a square modulo $p$. Put $y_i=\sym{-1}{p_i}$, $z_i=\sym2{p_i}$, and $a_{ij}=\sym{p_j}{p_i}$ for $i\ne j$. Thus $p_i\equiv1,3,5,7\pmod8$ according as $(y_i,z_i)=(0,0),(1,1),(0,1),(1,0)$, and reciprocity reads $a_{ij}+a_{ji}=y_iy_j$. The \emph{R\'edei matrix} $A$ has entries $A_{ij}=a_{ij}$ for $i\ne j$ and $A_{ii}=\sum_{j\ne i}a_{ij}$, so $A\one=0$. We write $D_v$ for the diagonal matrix of a vector $v$. Any data $(y,z,(a_{ij}))$ on a finite index set $I$ with $a_{ij}+a_{ji}=y_iy_j$ will be called a configuration on $I$; apart from \cref{lem:system,prop:redei}, everything below is linear algebra over $\F_2$ valid for all configurations. For $T\subseteq I$ put $Y_T=\sum_Ty_i$, $Z_T=\sum_Tz_i$, and say that $T$ has \emph{type} $1,5,3,7$ when $(Y_T,Z_T)=(0,0),(0,1),(1,1),(1,0)$, which for primes is $\prod_Tp_i$ modulo $8$. The $j$-th column sum of $A$ is $y_j(Y_I+1)$, so if $Y_I=0$, \begin{equation}\label{eq:facts} A+A^{\top}=yy^{\top}+D_y,\qquad A\one=0,\qquad A^{\top}\one=y. \end{equation} \begin{lemma}\label{lem:system} Let $\ell\equiv5\pmod8$. Then $\Sel(\ell)$ consists of the classes \[ \Bigl((-1)^\varepsilon\prod_ip_i^{u_i},\ (-1)^\varepsilon2^{z\cdot u}\prod_ip_i^{w_i}\Bigr) \] for the solutions $(\varepsilon,u,w)\in\F_2\times\F_2^r\times\F_2^r$ of the system \[ \textup{(S1) }Au+D_yw=\varepsilon y,\qquad\textup{(S2) }(A+D_y)w+D_zu+(z\cdot u)z=\varepsilon y,\qquad\textup{(S3) }y\cdot w=y\cdot u. \] \end{lemma} \begin{proof} We compute the local images, using $|E_\ell(\Q_p)/2E_\ell(\Q_p)|=4|2|_p^{-1}$. At $\infty$, the image is generated by $\partial(0,0)$: the two coordinates have the same sign. At odd $p\nmid\ell$ it is the group of unramified classes. At $p_i$, the classes $\partial(0,0)$ and $\partial(\ell,0)$ have valuation vectors $(0,1)$ and $(1,0)$, so they span the image. At $2$, since $\ell/5\in\Q_2^{\times2}$ we may take $\ell=5$; the classes $\partial(0,0)=(-1,-5)$, $\partial(5,0)=(5,2)$ and $\partial(-4,6)=(-1,-9)$ are independent, so they span the image, of order $8$. Writing $a=2^va'\in\Q_2^\times$ with $a'$ a unit, $s(a)=[a'\equiv3\bmod4]$ and $t(a)=[a'\equiv\pm3\bmod8]$, this image is $\{v(d_1)=0,\ v(d_2)=t(d_1),\ s(d_2)=s(d_1)\}$. A Selmer class is supported on $-1,2,p_1,\dots,p_r$. The real condition equates the signs, and the condition at $2$ gives no $2$ in the first coordinate, the exponent $z\cdot u$ in the second, and (S3). At $p_i$ the valuations $(u_i,w_i)$ force the local class to be $\partial(0,0)^{w_i}\partial(\ell,0)^{u_i}$, and comparing unit parts of the two coordinates modulo squares gives row $i$ of (S1) and of (S2). \end{proof} Let $M$ be the $2r\times2r$ symmetric matrix on coordinates $(U,W)\in\F_2^r\times\F_2^r$, \[ M=\begin{pmatrix}A+A^{\top}&A^{\top}\\A&D_z\end{pmatrix},\qquad M_{5}=\begin{pmatrix}M&b\\b^{\top}&0\end{pmatrix},\quad b=\begin{pmatrix}y+z\\0\end{pmatrix}. \] For $\ell\equiv5\pmod8$, $M$ and $M_5$ appear in \cite[Table~2]{Smith}, whose notation $y,z,A,D_v$ we use, and the next lemma is Monsky's matrix description \cite[pp.~366--367]{Monsky} in these coordinates. Smith notes that $M$ has corank one exactly when some bordered determinant of this shape is nonzero \cite[p.~3]{Smith}; \cref{lem:row5} proves the direction used here for the border $b$ and the class $(\beta,d)$. \needspace{4\baselineskip} \begin{lemma}\label{lem:dictionary} For a configuration of type $5$, the map $\Xi(u,w)=(u+w+(1+y\cdot u)\one,\ u+\one)$ is a bijection from the solutions of \textup{(S1)--(S3)} with $\varepsilon=0$ and $z\cdot u=1$ onto $\ker M$. The space of all solutions of \textup{(S1)--(S3)} has dimension $2+\operatorname{corank}M$; in particular $\dim\Sel(\ell)=2+\operatorname{corank}M$ for $\ell\equiv5\pmod8$. \end{lemma} \begin{proof} Put $c=1+y\cdot u$, $U=u+w+c\one$, $W=u+\one$. Using \eqref{eq:facts}, (S1) and (S2) with $\varepsilon=0$ and $z\cdot u=1$, \[ AU+D_zW=Au+Aw+D_zu+z=D_yw+(D_yw+D_zu+z)+D_zu+z=0, \] and, with $A^\top w=y(y\cdot w)+D_yw+Aw$, \[ (A+A^\top)U+A^\top W=y(y\cdot w+c+1)=y(y\cdot(u+w))=0 \] by (S3). Conversely, for $(U,W)\in\ker M$, summing the two block equations gives $y\cdot U=0$ and $z\cdot W=0$; then $u=W+\one$, $w=U+u+(1+y\cdot W)\one$ solves (S1)--(S3) with $z\cdot u=1$, and the two maps are inverse. The solutions with $\varepsilon=0$ have index two, since $(1,0,\one)$, the class $\partial(0,0)$, has $\varepsilon=1$. The condition $z\cdot u=1$ cuts out the nontrivial coset of an index-two subgroup, since $(0,\one,0)$, the class $\partial(\ell,0)$, has $z\cdot\one=1$. So the number of solutions is $4|\ker M|$. \end{proof} \begin{lemma}\label{lem:row5} Let $\ell\equiv5\pmod8$, $\beta\mid\ell$ with $\beta\equiv1\pmod8$ and prime set $B$, and $d\mid\ell$ with $d\equiv5\pmod8$ and indicator vector $w$. If $(\beta,d)\in\Sel(\ell)$, then $k=(\one_B+w,\one_B)\in\ker M$ and $b\cdot k=1$. If moreover $\dim\Sel(\ell)=3$, then $\det M_5=1$. \end{lemma} \begin{proof} The class is the solution $(0,\one_B,w)$; adding $(0,\one,0)$ gives $u=\one_B+\one$ with $z\cdot u=1$ and $y\cdot u=0$, and $\Xi$ of it is $k$. Then $b\cdot k=(y+z)\cdot\one_B+(y+z)\cdot w=1$, as $Y_B=Z_B=0$, $y\cdot w=y\cdot\one_B=0$ by (S3), and $z\cdot w=1$. If $\operatorname{corank}M=1$ then $\ker M=\langle k\rangle$; if $Mx+tb=0$ and $b\cdot x=0$, then $0=k^\top(Mx+tb)=t$, so $x\in\langle k\rangle$ and $b\cdot x=0$ force $x=0$. \end{proof} \subsection{The genus sum as a determinant}\label{ssec:genus} Smith \cite[Theorem~2.2, Table~2]{Smith} proves that the sums of Tian, Yuan and Zhang are determinants of such matrices. We prove the case we need following his recursion, so that this section depends only on R\'edei's theorem; the spanning forests of \cref{lem:forest} and the parity lemma, \cref{lem:parity}, replace his induction on monomials. For $T\subseteq I$ let $A_T$ be the R\'edei matrix of the restricted configuration, and \[ \mathsf G(T)=\det(A_T\text{ with one column replaced by }z_T), \] which does not depend on the column because $A_T\one=0$. Put \[ \mathsf L(T)=\sum_\pi\prod_{T'\in\pi}\mathsf G(T'),\qquad\Sigma_1(I)=\sum_{\pi'}\prod_{T'\in\pi'}\mathsf G(T'), \] where $\pi$ runs over the partitions of $T$ into blocks of type $1$ ($\mathsf L(\emptyset)=1$), and $\pi'$ over the partitions of $I$ with exactly one block of type $5$ and all others of type $1$. \needspace{4\baselineskip} \begin{proposition}\label{prop:redei} Let $d>1$ be squarefree with $d\equiv1\pmod4$ and prime set $T$. Then $g(d)$ is odd if and only if $\mathsf G(T)=1$. Consequently, for $\ell\equiv5\pmod8$ with prime set $I$, $\Sigma_1(\ell)\equiv\Sigma_1(I)\pmod2$. \end{proposition} \begin{proof} This is R\'edei's criterion \cite{Redei}; here is the form we need. Let $k=\Q(\sqrt{-d})$ with conjugation $\tau$; its discriminant is $-4d$. The number $g(d)$ is odd if and only if $\operatorname{Cl}(k)[2]\cap2\operatorname{Cl}(k)=1$. Since $\tau$ acts on $\operatorname{Cl}(k)$ by inversion, $\operatorname{Cl}(k)[2]$ is the group of $\tau$-invariant classes. If $\mathfrak a^\tau=\alpha\mathfrak a$ then $N(\alpha)=1$, so $\alpha=\delta/\delta^\tau$ by Hilbert's Theorem~90, and $\mathfrak a\delta$ is a $\tau$-stable ideal in the class of $\mathfrak a$. So $\operatorname{Cl}(k)[2]$ consists of the classes of the ideals $\mathfrak a_m$, products of ramified primes of norm $m\mid2d$, and, since $k$ has only the units $\pm1$, such an ideal is principal only for $m\in\{1,d\}$. A class $[\mathfrak a]$ is a square if and only if $N\mathfrak a$ is the norm of an element of $k$: if $\mathfrak a=\mathfrak b^2(\gamma)$ then $\mathfrak b^2=(N\mathfrak b)\mathfrak b/\mathfrak b^\tau$ gives $N\mathfrak a=N(\gamma N\mathfrak b)$; conversely if $N\mathfrak a=N(\alpha)$, then $\mathfrak a\alpha^{-1}$ has norm $(1)$, so it equals $\mathfrak c/\mathfrak c^\tau=\mathfrak c^2/(N\mathfrak c)$. By Hasse--Minkowski \cite[Ch.~IV, \S3.2]{SerreCourse}, $m>0$ is a norm if and only if $(m,-d)_v=1$ at every place. This is automatic at $\infty$ and at odd $p\nmid d$, and at $2$ it follows from the others by the product formula \cite[Ch.~III, \S2.1]{SerreCourse}. At $p_i\in T$, with $m=2^{e'}\prod_{j\in T}p_j^{x_j}$, the formula for the Hilbert symbol \cite[Ch.~III, \S1.2, Theorem~1]{SerreCourse} gives, additively, $(A_Tx)_i+e'z_i$. So $m\mapsto[\mathfrak a_m]$ identifies $\operatorname{Cl}(k)[2]\cap2\operatorname{Cl}(k)$ with $\ker[A_T\mid z_T]/\langle(\one,0)\rangle$. This is trivial if and only if $[A_T\mid z_T]$ has rank $|T|$, which, as $A_T\one=0$, is $\mathsf G(T)=1$. For the consequence: every $d_i$ in $\Sigma_1(\ell)$ is $\equiv1\pmod4$, and a factorization is a partition of $I$ with one block of type $5$. \end{proof} \begin{lemma}\label{lem:inv} For a symmetric matrix $N$ over $\F_2$, $\det N=\sum_\iota\prod_{\iota(x)=x}N_{xx}\prod_{\{x,x'\}}N_{xx'}$, the sum over the involutions $\iota$ of the index set and the second product over the $2$-cycles of $\iota$. \end{lemma} \begin{proof} In the permutation expansion pair each $\varsigma$ with $\varsigma^{-1}$ when $\varsigma^2\ne1$; the two products agree by symmetry. \end{proof} The next lemma is the case of $\F_2$ of the all-minors matrix-tree theorem of Chaiken \cite{Chaiken}. \begin{lemma}\label{lem:forest} Let $A$ be the R\'edei matrix of a configuration on $I$, and $R,P\subseteq I$ with $|R|=|P|$. Then $\det A[I\setminus R,I\setminus P]$ (rows $I\setminus R$, columns $I\setminus P$) is the sum, weighted by $\prod_{i\notin R}a_{i\varphi(i)}$, over the maps $\varphi:I\setminus R\to I$ with $\varphi(i)\ne i$ whose functional graph is a forest with root set $R$ in which each tree contains exactly one element of $P$. \end{lemma} \begin{proof} Expand over bijections $\varsigma:I\setminus R\to I\setminus P$, and expand each diagonal entry $A_{ii}=\sum_{j\ne i}a_{ij}$. The terms correspond to pairs $(\varphi,Z)$ with $Z=\{i:\varsigma(i)\ne i\}$, $\varphi=\varsigma$ on $Z$, for which $\varsigma_Z$ (equal to $\varphi$ on $Z$ and the identity off $Z$) is a bijection onto $I\setminus P$. Fix $\varphi$. If $\varphi$ has a cycle, a valid $Z$ contains all of it or none of it; adding or removing the cycle through the least vertex lying on a cycle is then an involution on the valid $Z$ without fixed points, so these terms cancel in pairs. If $\varphi$ is a forest with root set $R$, then $\varsigma_Z$ maps each tree $T$ into itself, so it maps $T$ minus its root bijectively onto $T\setminus P$, which forces $|T\cap P|=1$; and if $T\cap P=\{p\}$, the only valid choice of $Z\cap T$ is the path from $p$ up to, but excluding, the root. \end{proof} Two consequences. Expanding along the replaced column, $\mathsf G(T)=\sum_{k\in T}z_kc_k(T)$, where $c_k(T)$ is the weighted number of spanning trees of $T$ oriented to the root $k$. And if $Y_T=1$, then also $\one^\top A_T=0$, so all cofactors of $A_T$ are equal, $c_k(T)=c(T)$ for all $k$, and $\mathsf G(T)=c(T)Z_T$; in particular $\mathsf G(T)=0$ for $T$ of type $7$. \needspace{4\baselineskip} \begin{lemma}\label{lem:expansions} Let $I$ be a configuration and $1\in I$. Let $M^{(U_1)}$ denote $M$ with the row and column of $U_1$ deleted. Let $\mathsf E(V)$ be the sum, over partitions of $V$ into blocks of type $3$, of $\prod\mathsf G(T)$. Then: \begin{enumerate}[label=\textup{(\arabic*)}] \item $\det M(I)=\mathsf E(I)$ if $Y_I=0$, and $\det M(I)=0$ if $Y_I=1$. In particular $\det M(I)=0$ if $I$ has type $5$. \item If $Y_I=Z_I=0$, then $\det M^{(U_1)}(I)=\sum_{1\in T\subseteq I,\ T\text{ of type }1}\mathsf G(T)\det M(I\setminus T)$. \item If $I$ has type $5$, then $\det M_5(I)=\sum_{T\subseteq I,\ T\text{ of type }5}\mathsf G(T)\det M(I\setminus T)$. \end{enumerate} \end{lemma} \begin{proof} The entries of $M$ are $M_{U_iU_j}=y_iy_j$ $(i\ne j)$, $M_{U_iU_i}=0$, $M_{U_iW_j}=A_{ji}$, $M_{W_iW_j}=0$ $(i\ne j)$, $M_{W_iW_i}=z_i$. In \cref{lem:inv}, an involution pairs each $U_i$ with some $U_j$ or $W_j$, and fixes or pairs each $W_j$. Let $P$ be the set of $i$ with $U_i$ paired to a $U$, and $R$ the set of $j$ with $W_j$ fixed. The $U$--$W$ pairs form a bijection $I\setminus R\to I\setminus P$ contributing $\det A[I\setminus R,I\setminus P]$, and the perfect matchings of $P$ are odd in number, each of weight $\prod_Py_i$. So \[ \det M=\sum_{|P|=|R|\text{ even}}y^Pz^R\det A[I\setminus R,I\setminus P]. \] Similarly $\det M^{(U_1)}=\sum_{1\in P,\ |P|=|R|\text{ odd}}y^{P\setminus1}z^R\det A[\dots]$, and, the border vertex pairing with some $U_i$, $i\in P$, with weight $b_i=y_i+z_i$, $\det M_5=\sum_{|P|=|R|\text{ odd}}\bigl(\sum_{i\in P}b_iy^{P\setminus i}\bigr)z^R\det A[\dots]$. By \cref{lem:forest}, each is a sum over spanning forests in which every tree carries the weight $z_{\mathrm{root}}\prod a_e$ and one marked vertex. Summing over the marks, an ordinary tree contributes $Y_T$, the tree marked by the border contributes $Y_T+Z_T$, and the tree containing $1$ in $M^{(U_1)}$ contributes $1$; the number of trees is even for $M$ and odd for the other two. Group the forests by their vertex partitions and use the two consequences above. In (1) every tree has $Y_T=1$, hence type $3$, and the number of trees is $\equiv Y_I$. In (2) and (3) the other trees have type $3$ and are even in number, so the special tree has $Y_T=Y_I=0$, and $\mathsf E(I\setminus T)=\det M(I\setminus T)$ by (1). In (2), $T$ of type $5$ would leave $I\setminus T$ of type $5$, where $\mathsf E=0$. In (3) the weight $Y_T+Z_T=Z_T$ forces type $5$. \end{proof} \begin{lemma}\label{lem:parity} If $Y_I=Z_I=0$, then $\operatorname{corank}M(I)$ is even, and $\det M^{(U_i)}(I)=\det M(I)$ for every $i$. \end{lemma} \begin{proof} Let $N=M(I)$ and let $\delta=(0,z)$ be its diagonal. With $c=(\one,\one)$, \eqref{eq:facts} gives $Nc=\delta$. For the form $\mathsf b(x,x')=x^\top Nx'$ we have $\mathsf b(x,x)=\delta\cdot x=\mathsf b(c,x)$ and $\mathsf b(c,c)=Z_I=0$. If $\delta=0$ then $\mathsf b$ is alternating and has even rank. Otherwise $H=\{x:\mathsf b(c,x)=0\}$ is a hyperplane containing $c$ and $\ker N$, $\mathsf b$ is alternating on $H$, and its radical there is $\ker N+\langle c\rangle$; so $\dim\ker N$ is even. Now $\det N^{(x)}=\operatorname{adj}(N)_{xx}$. If $\operatorname{corank}N\ge2$ the adjugate vanishes. If $N$ is invertible then $\operatorname{diag}(N^{-1})=N^{-1}\delta=c$, so $\operatorname{adj}(N)_{U_iU_i}=1=\det N$. \end{proof} \begin{theorem}[Smith]\label{thm:sigma} If $T$ has type $1$ then $\det M(T)=\mathsf L(T)$. If $I$ has type $5$ then $\det M_5(I)=\Sigma_1(I)$. Hence $\Sigma_1(\ell)\equiv\det M_5(\ell)\pmod2$ for $\ell\equiv5\pmod8$. \end{theorem} \begin{proof} For type $1$ use induction on $|T|$: by \cref{lem:parity,lem:expansions}(2), $\det M(T)=\det M^{(U_1)}(T)=\sum_{1\in T'}\mathsf G(T')\mathsf L(T\setminus T')=\mathsf L(T)$, sorting partitions by the block containing $1$. The second assertion is \cref{lem:expansions}(3) with the first; the last is \cref{prop:redei}. \end{proof} \subsection{The construction}\label{ssec:construction} By \cref{lem:dictionary,lem:row5,thm:sigma}, \cref{thm:construction} asks for $e$ such that on both supports the class $(\beta,d)$ satisfies (S1)--(S3) and $\operatorname{corank}M=1$. The primes of $\Pi$ in \cref{lem:pinning} and the free bits of \cref{lem:toggles} adapt devices in \cite[\S5]{Glazer} and \cite[Lemma~3.6]{OpenAI}. \needspace{4\baselineskip} \begin{lemma}\label{lem:deletion} Let $N$ be symmetric over $\F_2$ with $Nk=0$ and $k_c=1$. Then $\operatorname{corank}N=1$ if and only if $N^{(c)}$ \textup{(}row and column $c$ deleted\textup{)} is invertible. \end{lemma} \begin{proof} If $N^{(c)}$ is invertible and $Nx=0$, then $x-x_ck\in\ker N$ vanishes at $c$, so $x\in\langle k\rangle$. Conversely, if $N^{(c)}x'=0$, extend $x'$ by $x_c=0$; then $(Nx)_i=0$ for $i\ne c$, and $(Nx)_c=\sum_{i\ne c}k_i(Nx)_i=0$ as $k^\top N=0$. So $x\in\langle k\rangle$ with $x_c=0$, that is, $x=0$. \end{proof} For $\beta$ prime the set $\Pi$ below is empty and the next lemma is trivial; the formula uses only primes. \needspace{4\baselineskip} \begin{lemma}\label{lem:pinning} Let a configuration on $I=B\sqcup\Pi\sqcup R$ satisfy $Y_B=Z_B=0$, $|\Pi|=|B|-1$, and for $\pi\in\Pi$\textup{:} $y_\pi=z_\pi=0$; $a_{b\pi}=a_{\pi b}=C_{b\pi}$ for $b\in B$, where the columns of $C$ form a basis of the even-weight vectors in $\F_2^B$; and $a_{\pi x}=a_{x\pi}=0$ for every other $x$. Let $I'$ be the configuration on $\{\hat\beta\}\sqcup R$ with $y_{\hat\beta}=z_{\hat\beta}=0$, $a_{x\hat\beta}=a_{\hat\beta x}=\varsigma_x:=\sum_{b\in B}a_{bx}$ for $x\in R$, and the same data on $R$. Then $\det M(I)^{(c)}=\det M(I')^{(c)}$ for every coordinate $c$ of $R$. \end{lemma} \begin{proof} Use the basis consisting of $L=(\one_B,0)$, $L'=(0,\one_B)$, the vectors $(h,0),(0,h)$ for $h$ in a basis of a complement $\mathsf H$ of $\langle\one_B\rangle$ in $\F_2^B$, and the coordinate vectors of $\Pi$ and of $R$. The row of $U_\pi$ in $M$ is $\sum_bC_{b\pi}\mathbf e_{W_b}$ and that of $W_\pi$ is $\sum_bC_{b\pi}\mathbf e_{U_b}$. So $\Pi$ pairs only with the $\mathsf H$-part, through $C^\top|_{\mathsf H}$, which is invertible because $\ker C^\top=\langle\one_B\rangle$. The Gram matrix has the shape \[ \begin{pmatrix}G_{11}&G_{12}&0\\G_{21}&G_{22}&\mathsf Y\\0&\mathsf Y^\top&0\end{pmatrix} \] with $\mathsf Y$ invertible, so its determinant is $\det(\mathsf Y)^2\det G_{11}$, also after deleting a coordinate of $R$. Finally $G_{11}$ is $M(I')$: $\mathsf b(L,L)=Y_B^2+Y_B=0$, $\mathsf b(L',L')=Z_B=0$, $\mathsf b(L,L')=\sum_{b,b'\in B}A_{b'b}=\sum_{x\in R}\varsigma_x$, $\mathsf b(L,U_x)=y_xY_B=0$, $\mathsf b(L,W_x)=\sum_ba_{xb}=\varsigma_x$, $\mathsf b(L',U_x)=\varsigma_x$, $\mathsf b(L',W_x)=0$, and the diagonal entry $A_{xx}$ for $x\in R$ receives $\varsigma_x$ from $B$ and $0$ from $\Pi$. \end{proof} \begin{lemma}\label{lem:core} Let $I'=\{\hat\beta,r_1,r_2,r_3,r_4\}$ with $(y,z)=(0,0)$ at $\hat\beta$, $(1,1)$ at $r_1,r_2,r_3$, and $(1,0)$ at $r_4$; $a_{r_ir_j}=0$ for $i0$. Taking degrees shows that $\epsilon(\varsigma,\tau)=c(\varsigma,\tau)b_\varsigma b_\tau/b_{\varsigma\tau}$ is $\pm1$, a $2$-cocycle inflated from $\operatorname{Gal}(L/\Q)$. The class of $\epsilon$ lies in $\operatorname{Br}(\Q)[2]$, and its invariant at $p\notin T$ vanishes, because it is inflated from the unramified quotient, of cohomological dimension one. For a Dirichlet character $\chi$ let $\delta\chi\in\operatorname{Br}(\Q)[2]$ be the image under the connecting map of $1\to\pm1\to\mu_{2m}\to\mu_m\to1$. A character of $\Q_v^\times$ is a square if and only if it is trivial on $\pm1$, so $\delta\chi$ has invariant $\tfrac12$ at $v$ exactly when $\chi_v(-1)=-1$. Choose $\chi$ with $\chi_p(-1)=-1$ exactly at the finite primes $p$ where $[\epsilon]$ is nonzero, using a character modulo $p$ at odd $p$ and modulo $4$ at $p=2$. Then $\chi_\infty(-1)$ is also correct, by the product formula, and $\delta\chi=[\epsilon]$ by the local-global principle for $\operatorname{Br}(\Q)$ \cite[Theorem~(8.1.17)]{NSW}. The order $m$ of $\chi$ divides $2\prod_{p\in T,\,p\ne2}(p-1)$, so $m\le C(S)M$. Hence there is a continuous $\eta:G_{\Q}\to\mu_{2m}$ with $\eta^2=\chi$ and $\eta(\varsigma)\eta(\tau)/\eta(\varsigma\tau)=\epsilon(\varsigma,\tau)$. At $p\notin T$, $\eta|_{I_p}$ is a quadratic character. Multiplying $\eta$ by the quadratic Dirichlet character that removes these finitely many ramifications (at odd $p$, the group $I_p$ has a unique nontrivial quadratic character, and $2\in T$), we may assume $\eta|_{I_p}=1$ for $p\notin T$. On $G_L$ the map $\eta$ is a homomorphism, normalized by $G_{\Q}$. Let $L'$ be its kernel field. Then $L'/\Q$ is normal, $[L':\Q]\le C(S)M$, and $L'/\Q$ is unramified outside $T$. Fix a prime $\ell$ and an embedding $\overline\Q\hookrightarrow\overline\Q_\ell$. On $V_\ell(A)\otimes\overline\Q_\ell$ put \[ \rho_\ell(\varsigma)=\eta(\varsigma)^{-1}b_\varsigma\,\mu_\varsigma\circ\varsigma. \] The cocycle relation makes this a representation of $G_{\Q}$. It commutes with $\mathbf B\otimes\overline\Q_\ell\cong M_2(\overline\Q_\ell)$, so $\rho_\ell\cong r_\ell\oplus r_\ell$ with $\dim r_\ell=2$, and on $G_{L'}$ it is the Tate action. \needspace{4\baselineskip} \begin{proposition}\label{prop:rep} Suppose $\operatorname{End}^0(A_{\overline\Q})=\mathbf B$, and let $\eta$, $L'$ and $r_\ell$ be as above, so that $L'/\Q$ is normal, of degree at most $C(S)M$, and unramified outside $T$. \begin{enumerate}[label=\textup{(\alph*)}] \item For every $\ell$, the restriction $r_\ell|_{G_{L'}}$ is irreducible. \item For every $\ell$, $r_\ell$ is odd: for a complex conjugation $\mathsf c$, $r_\ell(\mathsf c)$ has eigenvalues $1,-1$. \item For every prime $p\notin T$ there is an algebraic number $a_p$ such that $\operatorname{tr}r_\ell(\mathrm{Frob}_p)=a_p$ for every $\ell\ne p$, under the chosen embedding. \item For $\ell\notin T$, the prime-to-$\ell$ Artin conductor of $r_\ell$ is divisible only by primes of $T$ and is at most $C(S)M^2$, with $C(S)$ independent of $\ell$. \end{enumerate} \end{proposition} \begin{proof} \emph{Irreducibility.} By Faltings \cite[Satz~3 and Satz~4]{Faltings} the commutant of $V_\ell(A)$ on $G_{L'}$ is $\mathbf B\otimes\overline\Q_\ell=M_2(\overline\Q_\ell)$ and $V_\ell(A)$ is semisimple, so $r_\ell|_{G_{L'}}$ is irreducible. \emph{Oddness.} Fix a complex embedding of $L'$ and let $\mathsf c$ be complex conjugation. Then $\rho_\ell(\mathsf c)$ comes from an operator $\mathsf R$ on $H_1(A(\mathbb C),\overline\Q)$ of square $1$, commuting with $\mathbf B$, which is a scalar multiple of the composite of an antiholomorphic map and a holomorphic isogeny. So on $H_1(A(\mathbb C),\mathbb C)$ the operator $\mathsf R$ exchanges the two Hodge summands. Each summand is $\mathbf B$-stable of dimension two, so each corresponds to a line in the two-dimensional space on which $\mathsf R$ acts through $r$. An involution exchanging two complementary lines has eigenvalues $1,-1$. \emph{Traces.} Let $p\notin T$, $\ell\ne p$, and let $\varsigma$ be a Frobenius at a place of $L'$ above $p$ at which $A$ reduces to $\bar A$. Then $\mu_\varsigma\circ\varsigma$ acts on $V_\ell(A)=V_\ell(\bar A)$ as the endomorphism $\bar\mu_\varsigma\circ\mathrm{Frob}$ of $\bar A$, with $\mathrm{Frob}:\bar A\to\bar A^{(p)}$ the $p$-power Frobenius onto the reduction of ${}^\varsigma A$, so its trace is a rational number independent of $\ell$. Hence $a_p:=\tfrac12\eta(\varsigma)^{-1}b_\varsigma\operatorname{Tr}(\bar\mu_\varsigma\mathrm{Frob})$ is an algebraic number independent of $\ell$, with $\operatorname{tr}r_\ell(\mathrm{Frob}_p)=a_p$ under the chosen embedding. \emph{Conductor.} Let $\ell\notin T$. For $p\ne\ell$ let $n_p$ be the exponent at $p$ of the Artin conductor of $r_\ell$. \begin{itemize} \item If $p\notin T$ then $n_p=0$, since $I_p\subset G_{L'}$ and $A$ has good reduction above $p$. \item If $p\mid M$, $p\notin S$, then $A$ has good reduction above $p$, the ramification of $L/\Q$ at $p$ is tame because $p>D$, and $\eta$ is tame at $p$ because $\eta^2=\chi$ is tame and $p$ is odd. So wild inertia acts trivially and $n_p\le2$. \item Let $p\in S$. Fix a prime $\ell_0\notin S$. Over $\mathbb F=L_v(A[\ell_0])$, of degree over $\Q_p$ bounded in terms of $S$, $A$ has semistable reduction by Raynaud's criterion \cite[Theorem~3.5]{SilverbergZarhin}, so the wild inertia of $\mathbb F$ acts trivially on $V_\ell(A)$. Since $\chi|_{I_p}$ has conductor dividing $p$ or $4$, the character $\eta$ is tame on $I_{\mathbb F}$ at odd $p$ and has order at most $4$ on $I_{\mathbb F}$ at $p=2$. So there is a finite Galois extension $\mathbb F'$ of $\Q_p^{\mathrm{nr}}$, of degree $e'$ bounded in terms of $S$, whose wild inertia acts trivially on $r_\ell$. By the different formula, $\sum_{i\ge0}(|\mathrm G_i|-1)\le e'-1+e'v_p(e')$ for the lower ramification groups $\mathrm G_i$ of $\mathbb F'$, so the Swan conductor of $r_\ell$ is at most $4(1+v_p(e'))$ \cite[Ch.~III, \S6; Ch.~IV, \S1; Ch.~VI, \S2]{SerreLocal}. Hence $n_p\le 6+4v_p(e')$, which is bounded in terms of $S$. \end{itemize} Therefore the prime-to-$\ell$ Artin conductor of $r_\ell$ is at most $C(S)M^2$, with $C(S)$ independent of $\ell$. \end{proof} \subsection{Modularity at large primes}\label{ssec:modularity} \begin{proof}[Proof of \cref{prop:fiber} in the case $\mathbf B$] Let $\mathcal L$ be the set of primes $\ell\ge5$ with $\ell\notin T$, $\ell\nmid6\deg\mu_\varsigma$ for every $\varsigma$, and $\ell\ge\ell_1$, the constant of the paragraph on irreducibility below. The set $\mathcal L$ is infinite. It depends on the fiber, which is fixed. \emph{The reduction.} The ring $\mathcal O_A:=\operatorname{End}_{L'}(A)$ is an order of $\mathbf B$ containing $\mathcal O$, which acts on $\mathcal A$, so $\mathcal O_A=\mathcal O$, and $\mathcal O_A\otimes\Z_\ell\cong M_2(\Z_\ell)$ for $\ell\in\mathcal L$, as $\ell\nmid6$. Let $e_\ell$ be an idempotent of rank one, and $\mathcal O_\ell$ the ring of integers of a finite extension of $\Q_\ell$ containing the $b_\varsigma$ and the values of $\eta$. Each $\mu_\varsigma$ is an isomorphism on $T_\ell$ and $b_\varsigma$ is an $\ell$-adic unit, so $\rho_\ell$ preserves $T_\ell(A)\otimes\mathcal O_\ell$, and $\Lambda=e_\ell(T_\ell(A)\otimes\mathcal O_\ell)$ is a lattice for $r_\ell$. Let $\bar r_\ell$ be its reduction. On $G_{L'}$ it is $e_\ell A[\ell]$ with coefficients extended. \emph{Irreducibility.} By Faltings and Zarhin, as stated in \cite[Theorem~3.2]{ArReynaGajdaPetersen} for the finitely generated field $L'$: there is $\ell_1$ such that for $\ell\ge\ell_1$ the $\F_\ell[G_{L'}]$-module $A[\ell]$ is semisimple with endomorphism ring $\operatorname{End}_{L'}(A)\otimes\F_\ell$. Here this ring is $M_2(\F_\ell)$, so $A[\ell]\cong W\oplus W$ with $W$ simple of dimension two and $\operatorname{End}(W)=\F_\ell$. Hence $W$ is absolutely irreducible, and $\bar r_\ell|_{G_{L'}}$ is absolutely irreducible. Since $r_\ell(\mathsf c)$ has eigenvalues $1,-1$ and $\ell$ is odd, $\bar r_\ell$ is odd. \emph{The weight.} Let $v\mid\ell$ be the place of $L'$ induced by the embedding, $K_v=L'_v$ and $R_v$ its ring of integers. As $\ell\notin T$, $K_v/\Q_\ell$ is unramified, so $I_\ell\subset G_{L'}$ and $\bar r_\ell|_{I_\ell}$ is $W|_{I_\ell}$ with coefficients extended; and $A$ has good reduction at $v$, with $\mathcal O_A$ acting on the N\'eron model $\mathcal N$. Thus $\mathcal F=e_\ell\mathcal N[\ell]$ is a finite flat $R_v$-group scheme of order $\ell^2$ with generic fiber $W$. Let $\phi,\phi'$ be the two characters of tame inertia on the semisimplification of $\bar r_\ell|_{G_{\Q_\ell}}$ \cite[\S2.1]{SerreDuke}. By \cite[Corollaire~3.4.4]{Raynaud}, each is a product of distinct fundamental characters, so $\phi,\phi'\in\{1,\chi_\ell,\psi,\psi'\}$, with $\psi,\psi'$ the fundamental characters of level $2$ and $\chi_\ell$ the cyclotomic character modulo $\ell$. If one has level $2$ then $\{\phi,\phi'\}=\{\psi,\psi'\}$ \cite[\S2.1, Proposition~1]{SerreDuke}. The Weil pairing gives $\det A[\ell]=\chi_\ell^2$ on $G_{L'}$, and $A[\ell]=W^2$, so $(\phi\phi')^2=\chi_\ell^2$ on inertia. Since $\ell\ge5$ this excludes $\{1,1\}$ and $\{\chi_\ell,\chi_\ell\}$, so $\{\phi,\phi'\}$ is $\{\psi,\psi'\}$ or $\{1,\chi_\ell\}$. If $\{\phi,\phi'\}=\{\psi,\psi'\}$, then $\bar r_\ell|_{I_\ell}$ has type (2.8.1) of \cite{SerreDuke}, and $k(\bar r_\ell)=2$ by \cite[Proposition~3]{SerreDuke}. Suppose $\{\phi,\phi'\}=\{1,\chi_\ell\}$. The two characters are distinct and Frobenius-invariant, so by Clifford theory $W|_{G_{K_v}}$ is reducible, and the closure of a stable line gives an exact sequence of finite flat $R_v$-group schemes of order $\ell$. A finite flat prolongation over $R_v$ is unique, as the absolute ramification is $1<\ell-1$ \cite[Proposition~3.3.2]{Raynaud}, so the factor with trivial inertia action is \'etale and the other is of multiplicative type. Over a finite \'etale extension $R'$ of $R_v$ the sequence is $0\to\Z/\ell\to \mathcal F\to\mu_\ell\to0$ or $0\to\mu_\ell\to \mathcal F\to\Z/\ell\to0$. In the first case the connected component splits the sequence, so wild inertia acts trivially. In the second the class of the extension is a unit of $R'$ modulo $\ell$-th powers, so the wild extension is peu ramifi\'e in the sense of \cite[\S2.4]{SerreDuke}. Either way $\bar r_\ell|_{I_\ell}$ has type (2.8.2), and again $k(\bar r_\ell)=2$ \cite[Proposition~3]{SerreDuke}. The argument is that of the proof of \cite[Proposition~4]{SerreDuke}, given there over $\Z_\ell$. \emph{The level.} Let $N(\bar r_\ell)$ be the prime-to-$\ell$ Artin conductor of $\bar r_\ell$. For $p\ne\ell$ its exponent at $p$ is at most that of the conductor of $r_\ell$: the wild image is a finite $p$-group, on which reduction is injective and semisimple, so the Swan conductors agree, and the invariants of inertia can only grow under reduction, since $\Lambda^{I_p}$ is saturated. Hence, by \cref{prop:rep}(d), $N(\bar r_\ell)\le C(S)M^2$, and $N(\bar r_\ell)$ is divisible only by primes of $T$. \emph{Serre's conjecture.} The representation $\bar r_\ell$ is continuous, absolutely irreducible, two-dimensional and odd, so by \cite[Theorem~9.1]{KW1}, whose lifting theorems are proved in \cite{KW2} and whose hypothesis (H) is proved in \cite{Kisin}, it arises from a newform of some weight and level. If that weight is one, multiplying by the Eisenstein series $E_{\ell-1}$, a lift of the Hasse invariant, gives a form of weight $\ell$ with the same reduction, and the lifting lemma \cite[Lemme~6.11]{DeligneSerre} gives an eigenform in characteristic zero. So $\bar r_\ell$ arises from a form of weight at least $2$. By the refinement of Edixhoven \cite[Theorem~4.5]{Edixhoven} for the weight and Diamond \cite[Theorems~1.1, 5.1]{Diamond} for the level, recorded in \cite[Theorem~2.1]{Wintenberger} and in weight two in \cite[Theorem~3.15]{DDT}, $\bar r_\ell$ arises from a newform $g_\ell$ of weight $k(\bar r_\ell)=2$ and level $N(\bar r_\ell)$ on $\Gamma_1(N(\bar r_\ell))$, with respect to the chosen embedding. For $\bar r_\ell$ of dihedral projective image this is \cite[Lemma~6.2(i)]{KW1}. The normalization is that of \cite[(3.1.7)--(3.1.9)]{SerreDuke}: arithmetic Frobenius has trace the Hecke eigenvalue. \emph{Finiteness.} There are finitely many newforms of weight $2$ and level at most $C(S)M^2$, so one newform $f$ equals $g_\ell$ for infinitely many $\ell\in\mathcal L$. Let $N_f\le C(S)M^2$ be its level. For $p\notin T$ and such $\ell\ne p$, the reductions of $a_p$ and of the Hecke eigenvalue $a_p(f)$ at $\ell$ agree, so $a_p-a_p(f)$ lies in a prime above $\ell$ for infinitely many $\ell$, whence $a_p=a_p(f)$. This is the argument of the proof of \cite[Theorem~10.1]{KW1}, using only the traces outside $T$. \emph{The transfer.} Let $J=J_1(N_f)$, of dimension $\mathsf g\le N_f^2$. There is a quotient $A_f$ of $J$ over $\Q$ on whose Tate module the representation $\rho_{f,\ell}$ of $f$ occurs, with arithmetic Frobenius of trace $a_p(f)$ \cite[Definition~1.44, Lemma~1.48, Theorem~3.1(a)]{DDT}. So $\rho_{f,\ell}$ is a constituent of $V_\ell(J)$. Fix $\ell\in\mathcal L$ with $g_\ell=f$. By Chebotarev and Brauer--Nesbitt, $r_\ell\cong\rho_{f,\ell}$. So $V_\ell(A)$ and $V_\ell(J)$ have a common constituent over $L'$, and by Faltings \cite[Satz~3 and Satz~4]{Faltings} there is a nonzero $L'$-homomorphism $A\to J$. As $A$ is absolutely simple, Poincar\'e reducibility gives an $L'$-isogeny $A\times Z\to J$ with $Z/L'$ an abelian variety. \emph{The height.} The curve $X_1(N_f)$ has a Belyi map of degree at most $N_f^2$, so \cite[Theorem~1.1.1]{Javanpeykar} gives $h_F(J)\le13\cdot10^6\,\mathsf g\,N_f^{10}\le13\cdot10^6\,N_f^{12}\le C(S)M^{24}$. By \cite[Theorem~1.4]{GaudronRemond} over $L'$ there is an isogeny $J\to A\times Z$ of degree at most \[ \kappa_J=\bigl((14\mathsf g)^{64\mathsf g^2}[L':\Q]\max(h_F(J),\log[L':\Q],1)^2\bigr)^{1024\mathsf g^3}. \] With the variation under isogeny \cite[Lemma~5]{Faltings}, additivity, and Bost's lower bound $h_F(Z)\ge-\tfrac32\dim Z$ \cite[\S9]{GaudronRemond}, \[ h_F(A)\le h_F(J)+\tfrac12\log\kappa_J+\tfrac32\dim Z\le C(S)M^{24}, \] because $\mathsf g\ll_SM^4$, $[L':\Q]\ll_SM$, and so $\log\kappa_J\ll_SM^{20}\log(2M)$. \end{proof} \begin{remark}\label{rem:vkk} The bound of \cref{prop:fiber} in the case $\mathbf B$ also follows from \cite[Proposition~7.13]{vKK}, applied to $A$ over the ring of $S$-integers of $L$, with $g=2$, $\Q(\mathrm i)\subset\mathbf B$ as its quadratic field and the isogenies $\mu_\varsigma$: since $L/\Q$ is normal of degree at most $D$ and unramified outside $T$, and all homomorphisms between conjugates of $A$ are defined over $L$, it gives $h_F(A)\le(8D)^{288D}\bigl(M\prod_{p\in S}p\bigr)^{24}$. \end{remark} \subsection{From the Faltings height to the height of the base point} There is a constant $C'$ with $h(u)\le C'(1+\max(0,h_F(\mathcal A_{y'})))$ for every $u\in\Q\setminus\cC$ and $y'\in Y'(\overline\Q)$ above $u$. Indeed, over a finite cover $Y''$ of $Y'$ choose a symmetric theta structure of level $r^2=4$ ($r=2$ in Pazuki's notation) on each component, giving the map $\vartheta:Y''\to\mathbf P^{15}$ of theta constants. It is nonconstant on each component, since the moduli map is nonconstant and theta constants determine the principally polarized surface up to finite ambiguity \cite[\S2.3.3]{Pazuki}. So $\vartheta^*\mathcal O(1)$ is ample, and $h(\pi''(z))\le a\,h(\vartheta(z))+O(1)$ for the composite $\pi'':Y''\to\mathbf P^1_u$, by the height machine on a curve. On a nonempty open subset, $h(\vartheta(z))$ agrees up to a bounded term with the theta height $h_\Theta$ of the fiber \cite[Definition~2.6]{Pazuki}; on the finite complement $h\circ\pi''$ takes finitely many values. Finally \cite[Corollary~1.3(2)]{Pazuki} bounds $\max(h_\Theta,1)$ by a constant times $\max(h_F,1)$. \begin{proof}[Proof of \cref{thm:contacts}] Let $S\supseteq S_0$, $u\in\Q\setminus\cC$, and $A$ a fiber above $u$. By \cref{prop:fiber}, $h_F(A)$ is bounded in terms of $D$ or $h_F(A)\le C(S)M_S(u)^{24}$. The last subsection gives $h(u)\le H(S)M_S(u)^{24}$. \end{proof} \section{The prime pattern}\label{sec:primes} \Cref{thm:pattern} is \cite[Proposition~6.2]{Glazer} on the eighteen forms the formula uses, with $q\equiv1\pmod8$ from its proof; their curve $y^2=x^3-(75-53\sqrt2)^2x$ is isomorphic to $E$ over $F$, since $75-53\sqrt2=c_0(1-\sqrt2)^4$. The strategy is OpenAI's, on thirteen linear forms \cite[\S6]{OpenAI}: the congruences $p\equiv1\pmod8$, $p\equiv3\pmod7$ giving the orders $p+1\mp2\mathsf a$ for $p=\mathsf a^2+\mathsf b^2$ \cite[\S6.1]{OpenAI}, and the comparison at a fixed cutoff $L$ of a lower bound with a sieve bound for common factors above $L$ \cite[\S\S6.3--6.7]{OpenAI}. Sun runs the same comparison on the quadratic patterns $u+c_jw^2$ \cite[\S\S4 and~6.1]{Sun}. An odd prime dividing both orders divides $p+1$, and the congruences imposed below exclude $p\equiv-1$ modulo the odd primes up to $L$; so a common odd factor exceeds $L$, and the patterns with one are the bad ones. Here the lower bound loses $(\log L)^{36}$ and the bad patterns save $L$, so for a large fixed $L$ some pattern is not bad. Let $P_s=\prod_{p\le31}p$ and $W=4P_s$; let $\mathcal G$ be the set of the first eighteen primes above $31$ in each unit residue class modulo $W$ (Dirichlet's theorem), and \[ \cK=\{mg:\ m\mid P_s^4,\ m>0,\ g\in\mathcal G\}. \] Fix $A\in\Z$ and $B_0\in\mathbb R$. Constants with subscript $A$ may depend on $A$ and on the choices made below before the parameter $L$, but not on $L$, $X$, or a varying prime. \subsection{The forms and the fixed progression} Write $T=(u_1,u_2,v)$ and let $\Lambda_\nu$ $(1\le\nu\le18)$ be the forms $u_1-cv$, $u_2-cv$, $-u_1-u_2+(A-c)v$ for $c\in\cC$, so that the third is $u_3-cv$ when $u_3=Av-u_1-u_2$. Each has a coefficient $\pm1$. Two forms from the same family have a $2\times2$ minor equal to a difference of contacts, and two from different families have a minor $\pm1$ in the first two coordinates. So every pair is linearly independent over $\Q$ and over $\F_q$ for every prime $q>5$, and the relevant minors do not involve $A$. \needspace{4\baselineskip} \begin{remark}\label{rem:slopes} Three slopes are what makes $\cK$ independent of $A$. With two slopes $u_1/v$ and $(Av-u_1)/v$, the forms $u_1-cv$ and $-u_1+(A-c')v$ have only the minor $A-c-c'$, which vanishes modulo a given prime for some $A$, and the choice of $g_\nu$ below then fails. \end{remark} Fix a bounded open box $\Omega\subset\mathbb R^3$ whose closure avoids the eighteen zero planes and lies in $\{v>0\}$, and signs $\varepsilon_\nu$ with $\varepsilon_\nu\Lambda_\nu>0$ on $\overline\Omega$. There are $0<\alpha_A<\alpha_A'$ with $\alpha_AX\le\varepsilon_\nu\Lambda_\nu(T)\le\alpha_A'X$ for $T\in X\Omega$. At each prime $q\le31$, the proportion of $T$ modulo $q^5$ with $\Lambda_\nu(T)\equiv0\pmod{q^5}$ for some $\nu$ is at most $18/q^5<1$. Choose a residue outside this set and lift it modulo $q^8$. On this residue each $\Lambda_\nu$ has a fixed valuation $e_{\nu,q}\le4$; put $m_\nu=\prod_{q\le31}q^{e_{\nu,q}}$. The unit $\varepsilon_\nu\Lambda_\nu/m_\nu$ is then fixed modulo $8$ and modulo each odd $q\le31$. Choose $g_\nu\in\mathcal G$, pairwise distinct, such that $\varepsilon_\nu\Lambda_\nu/(m_\nu g_\nu)$ is $\equiv1\pmod8$, $\equiv3\pmod7$, and $\equiv1\pmod q$ for the other $q\le31$; there are at most eighteen demands in any class. Put $\kappa_\nu=m_\nu g_\nu\in\cK$. At $g=g_\nu$ impose $\Lambda_\nu(T)\equiv0\pmod g$. This plane has $g^2$ points. For $\mu\ne\nu$ the restriction of $\Lambda_\mu$ is nonconstant, so excluding $\Lambda_\mu\equiv0$ and $\varepsilon_\mu\Lambda_\mu\equiv-\kappa_\mu$ removes at most $34g\max(Q_*,B_0,3)$. At each prime $q\le L$ with $q\nmid W_0$, exclude the $36$ planes $\Lambda_\nu\equiv0$ and $\varepsilon_\nu\Lambda_\nu\equiv-\kappa_\nu$; such $q$ are at least $37$. Let $W_L=W_0\prod_{q\le L,\,q\nmid W_0}q$, and let $\mathcal R_L$ be the resulting set of residues modulo $W_L$ reducing to $r_0$. Then \begin{equation}\label{eq:density} \frac{|\mathcal R_L|}{W_L^3}\ge W_0^{-3}\prod_{\substack{q\le L\\q\nmid W_0}}\Bigl(1-\frac{36}q\Bigr)\ge c_A(\log L)^{-36},\qquad c_A>0, \end{equation} by $\log(1-36/q)=-36/q+O(q^{-2})$ and Mertens' second theorem \cite{Mertens}. Fix $L$. For $r\in\mathcal R_L$ apply \cite[Main Theorem]{GreenTao} to the forms $n\mapsto\varepsilon_\nu\Lambda_\nu(r+W_Ln)/\kappa_\nu$ on the convex set $\{n:r+W_Ln\in X\Omega\}$. These are integral affine forms with pairwise independent linear parts. Taking singleton classes in \cite[Definition~1.5]{GreenTao} gives complexity at most $16$, and the inputs $\mathrm{GI}(16)$ and $\mathrm{MN}(16)$ of that theorem are \cite[Theorem~1.3]{GTZ}, with its erratum \cite{GTZerratum}, and \cite[Theorem~1.1]{GreenTaoMobius}. Coefficients and moduli are fixed before $X\to\infty$. The Archimedean factor is $\operatorname{vol}(\Omega)X^3/W_L^3$. At a prime $q\mid W_L$ the local factor is $(1-1/q)^{-18}\ge1$. At $q\nmid W_L$ the substitution $n\mapsto r+W_Ln$ is a bijection modulo $q$, so the local factor is $\beta_q=(1-1/q)^{-18}\mathbb P(\Lambda_\nu\ne0\text{ for all }\nu)$, and this probability is at least $1-18/q$. For $q\ge37$ and $x=1/q$, \[ \log\beta_q\ge\log(1-18x)-18\log(1-x)\ge9x^2-\frac{162x^2}{1-18x}\ge-324x^2. \] So the singular product is at least a positive absolute constant. There are finitely many $r$, so one threshold on $X$ makes each error at most half its main term. Sum over $r$ with \eqref{eq:density}. Proper prime powers contribute $O_A(X^{5/2}(\log X)^{19})$: a value of one form is fixed in $O_A(X^{1/2}\log X)$ ways, each with $O_A(X^2)$ solutions, each of weight $O_A((\log X)^{18})$. Hence, for $X$ large in terms of $A$ and $L$, \begin{equation}\label{eq:lowerpattern} \#\bigl\{T\in X\Omega\cap\Z^3:\ T\bmod W_L\in\mathcal R_L,\ \Psi_\nu(T)\text{ all prime}\bigr\}\ge a_A\frac{X^3}{(\log L)^{36}(\log X)^{18}},\quad a_A>0. \end{equation} \subsection{A Selberg sieve} Let $\mathcal P$ be a set of primes $q>Q_*$, and for $q\in\mathcal P$ let $\Omega_q\subset\F_q^2$ have $\rho(q)\le17q$ elements, $\rho(q)>0$. Put $\delta(q)=\rho(q)/q^2$, $\delta^*(q)=\delta(q)/(1-\delta(q))$, extended multiplicatively to squarefree integers supported on $\mathcal P$, and $\mathfrak G(Z)=\sum_{d\le Z}\delta^*(d)$. Note $(1-\delta(q))^{-1}\le q$, as $17/q\le1-1/q$. \needspace{4\baselineskip} \begin{lemma}\label{lem:selberg} The number of integer points in an axis-parallel square of side $N\ge1$ that avoid $\Omega_q$ for all $q\in\mathcal P$, $q\le Z$, is $\ll N^2/\mathfrak G(Z)+NZ^6+Z^8$, with an absolute implied constant. \end{lemma} \begin{proof} For squarefree $d$ supported on $\mathcal P$, the Chinese remainder theorem gives \[ \#\{\text{points in the square lying in }\Omega_q\text{ for all }q\mid d\}=N^2\delta(d)+R_d,\qquad|R_d|\ll Nd+d^2. \] For $d\le Z$ define Selberg's weights \[ \lambda_d=\frac{\mu(d)}{\mathfrak G(Z)\prod_{q\mid d}(1-\delta(q))}\sum_{\substack{m\le Z/d\\(m,d)=1}}\delta^*(m), \] so $\lambda_1=1$ and $|\lambda_d|\le d$. Squaring $\sum\lambda_d$ majorizes the indicator of the sifted set. With $y_r=\sum_{r\mid d}\lambda_d\delta(d)$ and $1/\delta(m)=\sum_{r\mid m}1/\delta^*(r)$, one has \[ \sum_{e,f}\lambda_e\lambda_f\delta([e,f])=\sum_ry_r^2/\delta^*(r),\qquad y_r=\mu(r)\delta^*(r)/\mathfrak G(Z), \] and the sum equals $\mathfrak G(Z)^{-1}$. There are at most $Z^2$ pairs $(e,f)$, each with $|\lambda_e\lambda_f|\le Z^2$ and $[e,f]\le Z^2$, which gives the remainder. \end{proof} To bound $\mathfrak G(Z)$ from below, let $z=Z^{1/100}$ and $\mathfrak H(z)=\prod_{q\le z,\,q\in\mathcal P}(1+\delta^*(q))$. Give each squarefree divisor $d$ of $\prod_{q\le z,\,q\in\mathcal P}q$ the probability $\delta^*(d)/\mathfrak H(z)$. The events $q\mid d$ are independent with probability $\delta(q)$, so $\mathbb E\log d=\sum\delta(q)\log q\le17\sum_{q\le z}(\log q)/q\le34\log z$ for large $z$; here $\sum_{q\le z}(\log q)/q=\log z+O(1)$ by Mertens' first theorem \cite{Mertens}. Markov's inequality gives $\mathbb P(d\le Z)\ge\tfrac12$, so \begin{equation}\label{eq:truncation} \mathfrak G(Z)\ge\tfrac12\mathfrak H(Z^{1/100}). \end{equation} We use two cases. If $\mathcal P$ consists of the primes $q>Q_*$ with $q\equiv1\pmod4$, with at most one prime omitted, and $\delta(q)=2/q-1/q^2$, then Mertens in the progression $1\bmod4$ \cite[Theorem~1]{Williams} gives $\log\mathfrak H(z)=\log\log z+O_{Q_*}(1)$, uniformly in the omitted prime, so $\mathfrak G(Z)\gg_{Q_*}\log Z$. If $\mathcal P$ is the set of all primes $q>Q_*$ and $17/q-136/q^2\le\delta(q)\le17/q$, then $\log\mathfrak H(z)=17\log\log z+O_{Q_*}(1)$, independently of the sets $\Omega_q$, so $\mathfrak G(Z)\gg_{Q_*}(\log Z)^{17}$. \subsection{The two reduced curves} Let $p$ be a prime value counted in \eqref{eq:lowerpattern}, so $p\equiv1\pmod8$, $p\equiv3\pmod7$ and $p$ is large. Then $p$ splits in $F$, and $(7/p)=(p/7)=-1$. The two reductions of $c_0$ have product $7$, so they have opposite quadratic characters. The curves $E$ and $E^\sigma$ have good reduction at the place $\mathfrak p\mid p$, where they are the quadratic twists of $y^2=x^3-x$ by these two classes. So their Frobenius traces are opposite. As $p\equiv1\pmod4$, the automorphism $(x,y)\mapsto(-x,\mathrm iy)$ of the reduced curve $\bar E$ is defined over $\F_p$, so the Frobenius of $\bar E$ lies in $\Z[\mathrm i]$ and is $\mathsf a+\mathsf b\mathrm i$ with $\mathsf a,\mathsf b\in\Z$. By \cite[III.8.6]{Silverman}, \[ \mathsf a^2+\mathsf b^2=p,\qquad d_1=p+1-2\mathsf a,\qquad d_2=p+1+2\mathsf a, \] for the orders of the two reduced groups, and $\mathsf a\ne0$ since $p$ is not a square. Both orders are divisible by $4$, and $d_1+d_2=2(p+1)$ has $2$-adic valuation $2$, so the $2$-part of $\gcd(d_1,d_2)$ is $4$. By Hasse's bound \cite[V.1.1]{Silverman}, $0L$; call such a $p$ \emph{bad}. \subsection{Counting bad values} Fix $\nu$. A bad prime value $p$ of $\Psi_\nu$ lies in $[\alpha_AX,\alpha_A'X]$, with $\kappa_\nu$ absorbed into the constants, and gives $(\mathsf a,\mathsf b)$ in a square of side $O_A(\sqrt X)$. If $L<\ell\le X^{1/8}$, write $\mathsf a=\ell U$ and $\mathsf b=b_0+\ell V$ for one of the at most two roots $b_0$ of $b_0^2\equiv-1\pmod\ell$. The pair $(U,V)$ lies in a square of side $N\asymp_A\sqrt X/\ell$. For $q>Q_*$, $q\equiv1\pmod4$, $q\ne\ell$, the condition $\mathsf a^2+\mathsf b^2\equiv0\pmod q$ is a union of two lines of $2q-1$ points, and the substitution is bijective modulo $q$. Since $p>Z=X^{1/100}$, every pair avoids these points, so \cref{lem:selberg} and the first case of \eqref{eq:truncation} give $\ll_AX/(\ell^2\log X)$ pairs. Summing over $\ell$ gives $O_A(X/(L\log X))$. If $\ell>X^{1/8}$, then $\ell\mid\mathsf a\ne0$ leaves $O_A(\sqrt X/\ell)$ values of $\mathsf a$ and $O_A(\sqrt X/\ell+1)$ values of $\mathsf b$ in each class, and $\ell\ll_A\sqrt X$; summing gives $O_A(X^{7/8}+\sqrt X\log X)$. Therefore, uniformly in $L$, \begin{equation}\label{eq:bad} \#\{\text{bad prime values of }\Psi_\nu\}\ll_A\frac X{L\log X}+X^{7/8}+\sqrt X\log X. \end{equation} For a prime $p$ in this range, with $c_p=\varepsilon_\nu\kappa_\nu p$, consider the integer points of $X\Omega$ on $\Lambda_\nu=c_p$. Solving for a coordinate with coefficient $\pm1$ parametrizes them by a square of side $O_A(X)$, also modulo every prime. For $Q_*0$, and with $u_3=Av-u_1-u_2$ each of the eighteen numbers $u_j-cv$ is $\varepsilon_\nu\kappa_\nu p$ with $p>B_0$ prime and $\kappa_\nu\in\cK$, and $p$ is not bad. Since $\cK$ was fixed before $A$, the theorem follows. \end{proof} \appendix \section{Computations}\label{sec:computations} One computation in the proofs is not done by hand: the identity $\Delta^6-97200\,\Pi^2=\Psi^2$ of \cref{sec:height}, with the squarefreeness and pairwise coprimality of $\Pi$, $\Delta$, $\Psi$. It is exact, in Python~3.12 with integer and rational arithmetic. The programs deposited at \cite{Record}, with their outputs, also recompute the elementary identities the text states: $(1+\sqrt2)^3-c_0^2(1+\sqrt2)=8$ and the signs in the descent (\cref{sec:data}); the system of \cref{lem:core}; the discriminant of $\mathcal O$, from the form $\operatorname{Trd}(x\bar y)$ on the basis $1,\mathrm i,(1+\mathrm j)/2,(\mathrm i+\mathrm i\mathrm j)/2$, of determinant $36$, and the Hilbert symbols of $(2,-3)$ (\cref{sec:height}); and the $2\times2$ minors of the eighteen forms that do not involve $A$, whose prime factors are $2,3,5$ (\cref{sec:primes}). \section*{Declarations}\phantomsection\label{sec:declarations} \subsection*{Use of AI} This paper and its results were produced by an AI research system that the author designed, built and directs, running on Anthropic's Claude Opus~5.5 in Claude Code. The author chooses the problems and prioritizes the work. Separate AI agents checked each result, and a second program confirmed the computations the proofs use, with any exceptions listed in the public deposit. The system also searched the literature and checked the citations against reliable sources. The author read the paper, reran the computations from the deposit and takes full responsibility for all of the paper's contents. \subsection*{Data availability} The programs and data used in this paper, with instructions for rerunning them, are deposited at Zenodo~\cite{Record}. \bibliographystyle{amsplain} \bibliography{refs} \end{document}