Write $x = p^{a}u$, $y = p^{b}w$ with $u,w$ having numerator and denominator prime to $p$. Then $xy = p^{a+b}uw$ and $uw$ is again prime to $p$, so $v_p(xy)=a+b$. For the sum, assume $a \le b$; then $x+y = p^{a}(u + p^{b-a}w)$ and the bracket is a $p$-adic integer times a unit denominator, so $v_p(x+y)\ge a=\min(a,b)$.

Strict example: $p=2$, $x=1$, $y=1$. Then $v_2(x)=v_2(y)=0$ but $v_2(2)=1 \gt 0$.

$n$ has $d$ digits iff $10^{d-1} \le n \lt 10^{d}$ iff $d-1 \le \log_{10}n \lt d$ iff $d = \lfloor\log_{10}n\rfloor+1$.

Binary digits $\approx 150 \cdot \log_2 10 \approx 150 \times 3.3219 \approx 498$ bits. So a 150-digit coefficient is about a 500-bit integer — eight 64-bit machine words.

? E = ellinit([0,0,0,-1,0]);
? E.disc
%  64
? E.j
%  1728

By hand: $A=-1$, $B=0$, so $4A^3+27B^2 = -4$ and $\Delta = -16\cdot(-4)=64$. And $j = 1728\cdot\frac{4(-1)}{-4} = 1728$. The value $j=1728$ signals complex multiplication by $\mathbb{Z}[i]$, which we meet in Lesson 32.

E = ellinit([0,0,0,0,1]);
forprime(p=5, 50, print(p, " ", p+1-ellap(E,p)))

Output: $p=5\to6$, $7\to12$, $11\to12$, $13\to12$, $17\to18$, $19\to12$, $23\to24$, $29\to30$, $31\to24$, $37\to48$, $41\to42$, $43\to36$, $47\to48$.

Notice $a_p = 0$ (so $\#E = p+1$) whenever $p \equiv 2 \pmod 3$. That is the CM signature: this curve has $j=0$ and complex multiplication by $\mathbb{Z}[\zeta_3]$, and $a_p=0$ exactly at primes inert in $\mathbb{Q}(\sqrt{-3})$. This behaviour will matter when we design rank sieves (Lesson 87).

naivecount(a,b,p) = my(s = 0);
  for(x = 0, p-1, s += 1 + kronecker(x^3 + a*x + b, p));
  s + 1;     \\ +1 for the point at infinity

? naivecount(-1,0,101)
%  116
? E = ellinit([0,0,0,-1,0], 101); ellcard(E)
%  116

kronecker(n,p) is the Legendre symbol for odd prime $p$: $+1$ if $n$ is a nonzero square mod $p$, $-1$ if a non-square, $0$ if $p \mid n$. The count $1+\left(\frac{f(x)}{p}\right)$ is exactly the number of $y$ with $y^2=f(x)$.

? E = ellinit([0,0,0,0,1], 13);
? ellcard(E)
%  12
? #ellgroup(E)          \\ group structure
? \\ enumerate:
? for(x=0,12, for(y=0,12, if(Mod(y^2 - x^3 - 1, 13)==0, print([x,y]))))

You should find 11 affine points plus $\mathcal{O}$, total 12. Note $12 = 13+1-2$, so $a_{13}=2$; and $13\equiv1\pmod3$, consistent with Exercise 0.4's CM pattern (split primes have $a_p\ne0$).

? E = ellinit([0,-432]);
? Em = ellminimalmodel(E); Em[1..5]
? ellglobalred(Em)[1]
%  27
? elltors(Em)
%  [3, [3], [[12,36]]]      \\ Z/3Z
? ellrank(Em)
%  [0, 0, 0, []]

Conductor 27, torsion $\mathbb{Z}/3\mathbb{Z}$, rank 0. This is the curve $x^3+y^3=1$ in disguise — the Fermat cubic. Rank 0 with only 3-torsion means the only rational points on $x^3+y^3=1$ are the trivial ones $(1,0)$ and $(0,1)$: Fermat's Last Theorem for exponent 3.

? E = ellminimalmodel(ellinit([0,-1,1,-10,-20]));
? N = ellglobalred(E)[1]
%  11
? fordiv(N, p, if(isprime(p), print(p, " ", elllocalred(E,p))))
11 [1, 5, [1,0,0,0], 5]

Reading the output: conductor exponent $f_{11}=1$, so multiplicative reduction; Kodaira code 5 means type $\mathrm{I}_5$; Tamagawa number $c_{11}=5$. Consistent: for split multiplicative $\mathrm{I}_n$ we expect $c_p=n$ and $v_p(\Delta)=n=5$. Check with valuation(E.disc,11).

ECRank[coeffs_List] := Module[{s},
  s = gp["print(ellrank(ellinit(" <>
        StringReplace[ToString[coeffs, InputForm],
                      {"{" -> "[", "}" -> "]"}] <> "))"];
  gpParse[s][[1 ;; 2]]
];

ECRank[{0, 0, 1, -7, 6}]   (* {3, 3} *)

The slice [[1;;2]] keeps only the lower and upper bounds, dropping the generators and the $s$ component.

AbsoluteTiming[Do[gp["print(ellap(ellinit([0,0,0,-1,n]), 101))"], {n, 100}]]
(* roughly 3-4 seconds: ~35 ms per process spawn *)

AbsoluteTiming[gp["for(n=1,100, print(ellap(ellinit([0,0,0,-1,n]),101)))"]]
(* roughly 0.05 seconds *)

Two orders of magnitude. Design rule: never call PARI once per candidate. Batch the loop inside GP, or move the inner loop into compiled code linking libpari. In Phase 7 the sieve evaluates $a_p$ for millions of curves; a per-curve process spawn would make it impossible.

$g:B\to C$ is surjective with kernel $f(A)\cong A$. The fibres of $g$ are cosets of $\ker g$, all of size $\#\ker g = \#A$, and there are $\#C$ of them. Hence $\#B = \#A\cdot\#C$.

Use: applied to the Selmer sequence with $m=2$ and taking $\log_2$, this gives $\dim_{\mathbb{F}_2}\mathrm{Sel}^{(2)} = \dim(E(\mathbb{Q})/2E(\mathbb{Q})) + \dim\text{Ш}[2]$ — the rank bound of Lesson 60.

$A \cong \mathbb{Z}^r\times T$, and $A/2A \cong (\mathbb{Z}/2)^r \times T/2T$. For a finite abelian group, $\#(T/2T)=\#T[2]$ (the map $t\mapsto 2t$ has kernel $T[2]$ and image $2T$, so $\#T = \#T[2]\cdot\#2T$, giving $\#(T/2T)=\#T/\#2T=\#T[2]$). Hence $$\#(A/2A) = 2^{r}\cdot \#T[2], \qquad \dim_{\mathbb{F}_2}(A/2A) = r + \dim_{\mathbb{F}_2}T[2].$$

This is exactly the formula that turns a Selmer computation into a rank bound: the $\dim E(\mathbb{Q})[2]$ term appearing everywhere in Phase 5 is this $\dim T[2]$.

Work mod 3. Squares mod 3 are $\{0,1\}$. Compute $x^3+7 \equiv x^3+1 \pmod 3$: for $x\equiv0,1,2$ we get $1,2,0$. So $x\equiv0$ gives $y^2\equiv1$, solvable with $y\equiv\pm1$.

Take $a=1$ and $f(y)=y^2-(x^3+7)$ with $x=0$: $f(1)=1-7=-6\equiv0\pmod3$ and $f'(1)=2\not\equiv0\pmod3$. Hensel lifts to $y\in\mathbb{Z}_3$ with $y^2=7$. So yes.

? sqrt(7 + O(3^10))
%  1 + 3 + 3^2 + 2*3^4 + ... 

$60/7 = 2^2\cdot3\cdot5\cdot7^{-1}$. So $|x|_2 = 2^{-2}=1/4$, $|x|_3=1/3$, $|x|_5=1/5$, $|x|_7=7$, all other $|x|_p=1$, and $|x|_\infty=60/7$.

Product: $\frac{60}{7}\cdot\frac14\cdot\frac13\cdot\frac15\cdot7 = \frac{60\cdot7}{7\cdot60}=1$. ✓

? K = bnfinit(x^2 + 5, 1); K.no
%  2

Class number 2, so $\mathcal{O}_K = \mathbb{Z}[\sqrt{-5}]$ is not a UFD. The classic witness: $6 = 2\cdot3 = (1+\sqrt{-5})(1-\sqrt{-5})$, and all four factors are irreducible (norms $4,9,6,6$; there is no element of norm 2 or 3 since $a^2+5b^2 \in\{2,3\}$ has no integer solution).

This failure of unique factorisation is precisely what the class group measures, and precisely what makes descent computations expensive.

Genus $g=1$, so $\deg K_C=0$; and for a genus-1 curve $K_C\sim0$. For $n\ge1$, $\deg(n(\mathcal{O}))=n\gt0=2g-2$, so Riemann–Roch gives $\ell = n+1-1 = n$. For $n=0$, $L(0)$ consists of functions with no poles, i.e. constants, so $\ell(0)=1$.

The jump structure is the point: $\ell(1(\mathcal{O}))=1$ means there is no function with a simple pole only at $\mathcal{O}$ (that would give an isomorphism to $\mathbb{P}^1$, contradicting $g=1$). $\ell(2(\mathcal{O}))=2$ gives a new function $x$ with a double pole; $\ell(3(\mathcal{O}))=3$ gives $y$ with a triple pole. These are the Weierstrass coordinates.

$x$ has a pole of order 2, $y$ of order 3. Pole orders: $1\to0$, $x\to2$, $x^2\to4$, $x^3\to6$, $y\to3$, $xy\to5$, $y^2\to6$. All seven lie in $L(6(\mathcal{O}))$.

Seven elements in a 6-dimensional space must be linearly dependent, so there is a relation $$\alpha y^2+\beta xy+\gamma y = \delta x^3+\epsilon x^2+\zeta x+\eta.$$ Both $y^2$ and $x^3$ must genuinely appear (otherwise the pole of order 6 could not cancel), so after rescaling we obtain exactly the general Weierstrass equation $$y^2+a_1xy+a_3y = x^3+a_2x^2+a_4x+a_6.$$ This is the derivation completed in Lesson 14 — and it explains why the indices are $1,2,3,4,6$ with no $a_5$: the weights are $\operatorname{wt}(x)=2$, $\operatorname{wt}(y)=3$, and $a_i$ carries weight $i$ with all terms of total weight 6.

The $(3,4,5)$ triangle has area $6$. With $a=3,b=4,c=5$: $x = 6(3+5)/4 = 12$, $y = 2\cdot36\cdot8/16 = 36$. Check: $12^3 - 36\cdot12 = 1728-432=1296=36^2$. ✓

? E = ellinit([0,0,0,-36,0]); ellisoncurve(E,[12,36])
%  1
? ellorder(E,[12,36])
%  0        \\ infinite order

Degree $d=3$: $g=(3-1)(3-2)/2 = 1$. ✓

$y^2 = f(x)$ with $\deg f = n$ and $f$ squarefree is a hyperelliptic curve; its smooth projective model has genus $g=\lfloor(n-1)/2\rfloor$. For $n=5$: $g=2$. (The naive plane model of degree 5 is singular at infinity, so the plane-degree formula does not apply directly.)

By Faltings, $y^2=x^5+1$ therefore has only finitely many rational points. In fact they are $(0,\pm1)$, $(-1,0)$, $(2,\pm3)$, $(4,\pm 33)$ and the point at infinity.

Line $y = t(x-1)$: substituting, $x^2 - 2t^2(x-1)^2 = 1$, i.e. $(x-1)\bigl[(x+1) - 2t^2(x-1)\bigr]=0$. The second factor gives $x(1-2t^2) = -1-2t^2$, so $$x = \frac{1+2t^2}{2t^2-1},\qquad y = t(x-1) = \frac{2t}{2t^2-1}.$$

Check $t=1$: $(3,2)$, and $9-2\cdot4=1$ ✓. This is a Pell conic; note the rational points are dense but the integer points form a group generated by $(3,2)$ — a genus-0 shadow of the Mordell–Weil phenomenon.

$\#\mathbb{P}^n(\mathbb{F}_q) = \frac{q^{n+1}-1}{q-1}=1+q+\cdots+q^n$: there are $q^{n+1}-1$ nonzero vectors and each projective point corresponds to $q-1$ of them.

For $n=2$: $q^2+q+1$. Decomposition check: the affine plane has $q^2$ points, the line at infinity $q+1$. ✓

Multiply by $Z^3$: $Y^2Z + YZ^2 = X^3 - X^2Z - 10XZ^2 - 20Z^3$. Setting $Z=0$ gives $0=X^3$, so $X=0$ and the only point is $[0:1:0]$.

General principle: for any Weierstrass equation, every term except $x^3$ has $x$-degree $\le2$, so after homogenisation every term except $X^3$ carries a factor of $Z$. Hence $Z=0\Rightarrow X=0$, and there is always exactly one point at infinity.

Implicit differentiation: $2y\,dy = (3x^2+A)\,dx$, so $dy/dx = (3x^2+A)/(2y)$, which is infinite when $y=0$ (and $3x^2+A\ne0$, guaranteed by smoothness). The tangent is therefore the vertical line $x=x_0$.

A vertical line meets $E$ at $(x_0,0)$ twice and at $\mathcal{O}$. So $2P = \mathcal{O}$: points with $y=0$ are exactly the points of order 2. This recovers $E[2]=\{\mathcal{O}\}\cup\{(e_i,0)\}$ with $e_i$ the roots of the cubic.

$\Delta=-16\cdot27B^2$, zero iff $B=0$. So only $y^2=x^3$, a cusp.

General: $\Delta=0\iff 4A^3+27B^2=0$. Over the given range: $(0,0)$; and we need $4A^3=-27B^2$, so $A\le0$. $A=-3$: outside range. Checking $A\in\{-2,-1\}$: $4(-8)=-32=-27B^2\Rightarrow B^2=32/27$, not an integer; $4(-1)=-4=-27B^2$, no. So only $(0,0)$.

? for(a=-2,2, for(b=-2,2, if(4*a^3+27*b^2==0, print([a,b]))))
[0, 0]

$(t^{-3})^2 = t^{-6} = (t^{-2})^3$ ✓, and every point with $x\ne0$ arises: given $(x,y)$ with $y^2=x^3$, $x\ne0$, put $t=x/y$; then $t^{-2}=y^2/x^2=x^3/x^2=x$ ✓ and $t^{-3}=y^3/x^3=y^3/y^2=y$ ✓.

Group law: three points $t_1,t_2,t_3$ are collinear iff $t_1+t_2+t_3=0$. Sketch: the line $y=\lambda x+\mu$ meets $y^2=x^3$ where $x^3-\lambda^2x^2-2\lambda\mu x-\mu^2=0$; in the $t$-coordinate, substituting $x=t^{-2},y=t^{-3}$ and clearing gives a cubic in $t$ whose coefficient comparison yields $\sum t_i = 0$. Hence the smooth locus is $(\overline K,+)$ — the additive group, whence "additive reduction".

Suppose $x(P)=x(Q)$ and $y(P)=y(Q)$ with $P\ne Q$, both $\ne\mathcal{O}$. The function $x - x(P)$ lies in $L(2(\mathcal{O}))$ and vanishes at both $P$ and $Q$; it has a double pole, so its divisor is $(P)+(Q)-2(\mathcal{O})$ and thus $(P)+(Q)\sim2(\mathcal{O})$. Similarly $y-y(P)$ has divisor $(P)+(Q)+(R)-3(\mathcal{O})$ for some third point $R$. Subtracting, $(R)\sim(\mathcal{O})$, which for genus 1 forces $R=\mathcal{O}$ (if $(R)-(\mathcal{O})$ were principal, the corresponding function would give an isomorphism to $\mathbb{P}^1$). Then $y-y(P)$ has a pole of order 3 at $\mathcal{O}$ and zeros only at $P,Q,\mathcal{O}$ — a contradiction unless $P=Q$.

(Cleanest version: $x$ has degree 2 as a map $E\to\mathbb{P}^1$, so its fibres have two points; $y$ separates them because $y$ takes different values on $P$ and $-P$ unless both are 2-torsion.)

Standard substitution: $x = \dfrac{12}{u+v}$, $y = \dfrac{36(u-v)}{u+v}$ gives $y^2 = x^3 - 432$.

? E = ellinit([0,0,0,0,-432]);
? Em = ellminimalmodel(E); Em[1..5]
%  [0, 0, 1, 0, -7]
? ellglobalred(Em)[1]
%  27
? elltors(Em)
%  [3, [3], [[0, 0]]]
? ellrank(Em)[1..2]
%  [0, 0]

Rank 0, torsion $\mathbb{Z}/3$: the only rational points on $u^3+v^3=1$ are $(1,0)$ and $(0,1)$, plus the point at infinity. That is Fermat for exponent 3.

Here $a_1=a_2=a_3=0$, $a_4=A$, $a_6=B$, so $b_2=0$, $b_4=2A$, $b_6=4B$, $b_8=-A^2$. Then $$c_4=-24\cdot2A=-48A,\qquad c_6=-216\cdot4B=-864B,$$ $$\Delta=-8(2A)^3-27(4B)^2=-64A^3-432B^2=-16(4A^3+27B^2).$$ Now $c_4^3-c_6^2 = -48^3A^3-864^2B^2=-110592A^3-746496B^2 = -1728(64A^3+432B^2)=1728\Delta$. ✓

? A=a; B=b; E=ellinit([0,0,0,A,B]);
? 1728*E.disc - (E.c4^3 - E.c6^2)
%  0

Using the formula with $j_0=-3375$: $j_0-1728=-5103$, so $A=-3j_0/(j_0-1728)=10125/5103=125/63$ and $B=-2j_0/(j_0-1728)=6750/5103\cdot(-1)\cdots$ — messy. Easier in PARI:

? E = ellinit(ellfromj(-3375));
? Em = ellminimalmodel(E); Em[1..5]
%  [0, 0, 1, -38, 90]
? ellglobalred(Em)[1]
%  49

Conductor 49. $j=-3375=-15^3$ is one of the thirteen CM $j$-invariants over $\mathbb{Q}$ — this curve has complex multiplication by the order of discriminant $-7$, i.e. $\mathbb{Z}\!\left[\frac{1+\sqrt{-7}}{2}\right]$.

$j=c_4^3/\Delta$ and $\Delta\ne0$, so $j=0\iff c_4^3=0\iff c_4=0$. In short form $c_4=-48A$, so (char $\ne2,3$) $j=0\iff A=0\iff E:y^2=x^3+B$. ✓

Then $1728\Delta=-c_6^2$, so $c_6\ne0$ automatically.

? E = ellinit([0,-1,1,-10,-20]);
? [E.c4, E.c6]
%  [496, 20008]
? A = -E.c4/48; B = -E.c6/864;
? [A, B]
%  [-31/3, -2501/108]
? Es = ellinit([A,B]);  Es.j == E.j
%  1

Short form is $y^2=x^3-\frac{31}{3}x-\frac{2501}{108}$: denominators appear. Scaling by $u=1/6$ to clear them gives $y^2=x^3-13392x-1080432$, with $\Delta = 6^{12}\cdot(-11^5)$. The original model has $\Delta=-11^5$ and tiny coefficients. Moral: the minimal model is generally not in short form; insisting on short form can inflate coefficients enormously.

$ua_1'=a_1+2s = a_1+2(-a_1/2)=0$ ✓.

$u^3a_3'=a_3+ra_1+2t = a_3+0+2(-a_3/2)=0$ ✓.

And $u^2a_2' = a_2 - sa_1 + 0 - s^2 = a_2 + \frac{a_1^2}{2} - \frac{a_1^2}{4} = a_2+\frac{a_1^2}{4} = \frac{b_2}{4}$, matching the claim. Note both steps divided by 2, hence the characteristic restriction.

$a_2,a_6\in\{0,1\}$ and we need $\Delta\ne0$; for this family $\Delta=a_6$, so $a_6=1$. Two curves: $(a_2,a_6)=(0,1)$ and $(1,1)$.

? E1 = ellinit([1,0,0,0,1], 2); ellcard(E1)
%  4
? E2 = ellinit([1,1,0,0,1], 2); ellcard(E2)
%  2

Hasse: $|a_2|\le2\sqrt2\approx2.83$, so $\#E\in\{1,\dots,5\}$; we get $4$ and $2$, i.e. $a_2=-1$ and $a_2=1$. Both are ordinary ($a_2$ odd, so $a_2\ne0$), consistent with $j=1/a_6\ne0$.

Need $u$ with $u^{-4}(-1)=-4$, i.e. $u^4=1/4$, $u=1/\sqrt2$ — not rational. Try the other direction: $(A,B)=(-1,0)\to(-4,0)$ needs $u^{-4}=4$; $u^4 = 1/4$. Hmm, so not via $u$ alone. But $y^2=x^3-4x$ is the quadratic twist of $y^2=x^3-x$ by $d=2$ ($d^2A = 4\cdot(-1)=-4$) — and it is also the quartic twist by 4, and $4=2^2$ is a square in the quartic-twist parameter space? Let us just check numerically:

? E1=ellinit([0,0,0,-1,0]); E2=ellinit([0,0,0,-4,0]); E3=ellinit([0,0,0,-2,0]);
? [E1.j, E2.j, E3.j]
%  [1728, 1728, 1728]
? ellisomat(E1)[1]   \\ isogeny class
? ellglobalred(E1)[1], ellglobalred(E2)[1], ellglobalred(E3)[1]
%  32, 64, 256

Different conductors, so none of the three is $\mathbb{Q}$-isomorphic to another. All share $j=1728$, so all are quartic twists of one another over $\overline{\mathbb{Q}}$. The lesson: equal $j$ is necessary but far from sufficient over $\mathbb{Q}$; the conductor separates twists cheaply.

? E = ellinit([0,0,0,-1,0]); ellrank(E)[1..2]
%  [0, 0]
? Ed = ellinit(elltwist(E,-1)); Ed[1..5]
? ellrank(Ed)[1..2]
%  [0, 0]

Both ranks are 0, so $\operatorname{rank}E(\mathbb{Q}(i))=0$. Note $E^{(-1)}: y^2=x^3-x$ again up to isomorphism — the curve is its own $(-1)$-twist because it has CM by $\mathbb{Z}[i]$ and $i$ acts as an automorphism. So the rank over $\mathbb{Q}(i)$ is twice the rank over $\mathbb{Q}$, which is 0.

$a_p(E) = -\sum_{x\in\mathbb{F}_p}\chi(x^3+Ax+B)$ with $\chi$ the quadratic character. For $E^{(d)}$ in the form $dy^2=x^3+Ax+B$ (isomorphic over $\mathbb{F}_p$ to the standard twist model), $$\#E^{(d)}(\mathbb{F}_p)=1+\sum_x\Bigl(1+\chi\bigl(d\,(x^3+Ax+B)\bigr)\Bigr) = p+1+\chi(d)\sum_x\chi(x^3+Ax+B),$$ using multiplicativity $\chi(du)=\chi(d)\chi(u)$. Hence $a_p(E^{(d)}) = -\chi(d)\sum_x\chi(f(x)) = \chi(d)a_p(E) = \left(\frac dp\right)a_p(E)$. ✓

$\ell/Z$ is a ratio of two linear forms, hence a rational function on $E$ of degree 0 as a divisor. Its zeros are where $\ell=0$ on $E$, which by Bézout is $(P)+(Q)+(R)$ with multiplicity. Its poles are where $Z=0$ on $E$, which is $3(\mathcal{O})$ because the line at infinity meets $E$ with multiplicity 3 at $\mathcal{O}$ (recall $\mathcal{O}$ is an inflection point).

Hence $\operatorname{div}(\ell/Z)=(P)+(Q)+(R)-3(\mathcal{O})$, and since it is principal, $(P)+(Q)+(R)\sim3(\mathcal{O})$. ✓

$Q=-P$, so $P+Q=\mathcal{O}$.

$2P$: $\lambda=\frac{3\cdot9+0}{2\cdot5}=\frac{27}{10}$. $x_3=\lambda^2-2x_1=\frac{729}{100}-6=\frac{129}{100}$. $y_3=\lambda(x_1-x_3)-y_1=\frac{27}{10}\left(3-\frac{129}{100}\right)-5=\frac{27}{10}\cdot\frac{171}{100}-5=\frac{4617}{1000}-5=-\frac{383}{1000}$.

? E = ellinit([0,0,0,0,-2]);
? elladd(E,[3,5],[3,-5])
%  [0]                      \\ the point at infinity
? ellmul(E,[3,5],2)
%  [129/100, -383/1000]

Note the denominators: $x$ has denominator $10^2$, $y$ has $10^3$ — the weight-2/weight-3 pattern again, and the source of the height growth law $h(2P)\approx4h(P)$.

Substituting $y=\lambda x+\nu$ into $y^2=x^3+Ax+B$: $$x^3 - \lambda^2x^2 + (A-2\lambda\nu)x + (B-\nu^2)=0.$$ This monic cubic has roots $x_1,x_2,x_3'$. Vieta: the sum of the roots equals minus the coefficient of $x^2$, i.e. $x_1+x_2+x_3'=\lambda^2$. So $x_3'=\lambda^2-x_1-x_2$, and reflection preserves $x$. ✓

myadd(E, P, Q) =
{ my(a1=E.a1, a2=E.a2, a3=E.a3, a4=E.a4, lam, nu, x3, y3);
  if(P == [0], return(Q));
  if(Q == [0], return(P));
  my(x1=P[1], y1=P[2], x2=Q[1], y2=Q[2]);
  if(x1 == x2 && y1 + y2 + a1*x2 + a3 == 0, return([0]));
  lam = if(x1 != x2,
           (y2-y1)/(x2-x1),
           (3*x1^2 + 2*a2*x1 + a4 - a1*y1)/(2*y1 + a1*x1 + a3));
  nu = y1 - lam*x1;
  x3 = lam^2 + a1*lam - a2 - x1 - x2;
  y3 = -(lam + a1)*x3 - nu - a3;
  [x3, y3];
}

? E = ellinit([1,2,3,4,6]);
? P = ellratpoints(E, 20)[1]; Q = ellratpoints(E,20)[2];
? myadd(E,P,Q) == elladd(E,P,Q)
%  1
? myadd(E,P,P) == ellmul(E,P,2)
%  1

? E = ellinit([0,0,0,0,17]); P = [-2,3];
? ellisoncurve(E,P)
%  1
? h1 = ellheight(E,P)
%  0.4413...
? h2 = ellheight(E, ellmul(E,P,2))
%  1.7652...
? h2/h1
%  4.0000000000000000000

Exactly 4, to full precision — because $\hat h$ is an exact quadratic form, unlike the naive height $h$ where the relation holds only up to $O(1)$. This exactness is the whole point of the canonical height and is what makes the regulator determinant test valid.

Here $b_2=0$, $b_4=2A$, $b_6=4B$, $b_8=-A^2$, so $$\psi_3=3x^4+0+3(2A)x^2+3(4B)x+(-A^2)=3x^4+6Ax^2+12Bx-A^2.$$ Degree $4=(3^2-1)/2$ ✓.

Sanity check: $P$ has order 3 iff $2P=-P$ iff $x(2P)=x(P)$. From $x(2P)=\frac{x^4-2Ax^2-8Bx+A^2}{4(x^3+Ax+B)}$, setting equal to $x$ and clearing gives $3x^4+6Ax^2+12Bx-A^2=0$. ✓

$A=0,B=1$: $\psi_3=3x^4+12x = 3x(x^3+4)$. Rational roots: $x=0$ (and $x^3=-4$ has no rational root). At $x=0$: $y^2=1$, so $y=\pm1$.

? E = ellinit([0,0,0,0,1]);
? elltors(E)
%  [6, [6], [[2, 3]]]
? ellorder(E,[0,1])
%  3
? ellmul(E,[0,1],3)
%  [0]

So $(0,\pm1)$ have order 3. In fact the full torsion is $\mathbb{Z}/6\mathbb{Z}$, generated by $(2,3)$; the 2-torsion point is $(-1,0)$.

$x([2]P)=\frac{x^4+2x^2+1}{4(x^3-x)}=\frac{(x^2+1)^2}{4x(x^2-1)}$. Setting this equal to a generic value $c$ gives $(x^2+1)^2 = 4cx(x^2-1)$, a quartic in $x$ with 4 roots for generic $c$. Each $x$ gives one point once $y$ is pinned by the requirement $[2]P$ has the right $y$. So $\#[2]^{-1}(\text{point}) = 4 = \deg[2]$ ✓. Equivalently $\#\ker[2]=\#E[2]=4$.

Test $x=-1,\dots,5$: $x^3-2$ gives $-3,-2,-1,6,25,62,123$. Only $25$ is a square, at $x=3$. So $(3,\pm5)$.

? E = ellinit([0,0,0,0,-2]);
? ellrank(E)
%  [1, 1, 0, [[3, 5]]]
? elltors(E)
%  [1, [], []]

Rank 1, trivial torsion, so $E(\mathbb{Q})\cong\mathbb{Z}$ generated by $(3,5)$. This is Fermat's claim that $y^2=x^3-2$ has only the integer solutions $(3,\pm5)$ — true for integers, though there are infinitely many rational points.

? E = ellinit([0,0,0,-7,6]);
? ellrank(E)
%  [3, 3, 0, [[-3,0],[-2,3],[-1,3]]]
? M = ellheightmatrix(E, [[-3,0],[-2,3],[-1,3]]);
? matdet(M)
%  0.4171...
? matdet(M) != 0
%  1

Nonzero determinant proves independence, so rank $\ge3$; PARI's descent gives upper bound 3, so rank $=3$ exactly. Note that all three generators have tiny coordinates — this is a "small" rank-3 curve. Contrast with the rank-30 record, whose generators have hundreds of digits.

{ for(d=1,3,
    for(a=-20,20,
      if(gcd(a,d)==1,
        my(x = a/d^2, t = x^3+1, n = numerator(t), m = denominator(t));
        if(issquare(t), print([x, sqrtint(numerator(t*m^2))/m])))));
}

You should find $x=-1,0,2$ (with $d=1$) — giving $(-1,0)$, $(0,\pm1)$, $(2,\pm3)$ — and nothing new for $d=2,3$. Since elltors(E) gives $\mathbb{Z}/6$ and ellrank(E) gives 0, these six points plus $\mathcal{O}$ are all the rational points on $y^2=x^3+1$.

A fundamental parallelogram $D=\{a+s\omega_1+t\omega_2: s,t\in[0,1]\}$ is compact, so $|f|$ attains a maximum on $D$. By periodicity that is the maximum on all of $\mathbb{C}$. A bounded entire function is constant, by Liouville. ∎

This is why elliptic functions must have poles, and why the simplest one has a double pole: a single simple pole is forbidden because residues must sum to zero.

$\wp'$ is manifestly elliptic: $\wp'(z+\omega)=-2\sum_{\mu\in\Lambda}(z+\omega-\mu)^{-3}=\wp'(z)$ by reindexing $\mu\mapsto\mu+\omega$ (the sum converges absolutely, so reindexing is legal).

For $\wp$ itself, term-by-term reindexing fails because the $-1/\omega^2$ corrections do not shift correspondingly. Instead: $\wp(z+\omega_i)-\wp(z)$ has zero derivative, so it is a constant $c_i$. Put $z=-\omega_i/2$ and use that $\wp$ is even: $c_i=\wp(\omega_i/2)-\wp(-\omega_i/2)=0$. Hence $\wp(z+\omega_i)=\wp(z)$ for $i=1,2$, and by additivity for all of $\Lambda$. ∎

For $\Lambda=\mathbb{Z}+\mathbb{Z}i$, multiplying by $i$ preserves $\Lambda$, so $G_6(\Lambda)=\sum\omega^{-6}=\sum(i\omega)^{-6}=i^{-6}G_6=-G_6$, forcing $G_6=0$ and hence $g_3=0$.

So the curve is $y^2=4x^3-g_2x$, i.e. $j=1728$. Numerically $g_2\approx189.0728$.

? E = ellinit([0,0,0,-1,0]); E.j
%  1728
? \\ conversely, from the lattice:
? ellwp(ellinit(ellfromj(1728)), 0.1)

$g_3=0$ is exactly the statement that the curve has CM by $\mathbb{Z}[i]$: the automorphism $z\mapsto iz$ of $\mathbb{C}/\Lambda$ becomes $(x,y)\mapsto(-x,iy)$ on the curve.

$E[m]=\ker([m]:\mathbb{C}/\Lambda\to\mathbb{C}/\Lambda)=\{z: mz\in\Lambda\}/\Lambda=\frac1m\Lambda/\Lambda$. Since $\Lambda\cong\mathbb{Z}^2$, $\frac1m\Lambda/\Lambda\cong(\frac1m\mathbb{Z}/\mathbb{Z})^2\cong(\mathbb{Z}/m\mathbb{Z})^2$. ✓

$E[2]=\{0,\ \omega_1/2,\ \omega_2/2,\ (\omega_1+\omega_2)/2\}$. Under $\Phi$, these are $\mathcal{O}$ and the three points where $\wp'=0$, i.e. $y=0$: the roots $e_i=\wp(\omega_i/2)$ of the cubic. ✓ Consistent with Lesson 11 Exercise 1.6.

The $e_i$ are the roots of $4x^3-g_2x-g_3$, i.e. of $x^3-\frac{g_2}{4}x-\frac{g_3}{4}$. There is no $x^2$ term, so by Vieta the sum of the roots is 0. ✓

Equivalently: the Weierstrass model coming from a lattice is automatically in short form, which is the statement $a_2=0$, i.e. $\sum e_i = 0$.

? \p 30
? E = ellinit([0,0,0,-1,0]);
? P = [-1,0]; Q = [0,0];
? zP = ellpointtoz(E,P); zQ = ellpointtoz(E,Q);
? R = elladd(E,P,Q); zR = ellpointtoz(E,R);
? (zP + zQ - zR) / E.omega[1]
%  1.0000000000000000000000000000    \\ differs by a lattice vector
? ellztopoint(E, zP+zQ) == R
%  1

$\Phi(z_P)+\Phi(z_Q)=\Phi(z_P+z_Q)$ up to a period, which is exactly what "homomorphism on $\mathbb{C}/\Lambda$" means.

$[-1](x,y)=(x,-y)$ in short form. Pulling back: $[-1]^*\omega=\frac{d(x)}{2(-y)}=-\frac{dx}{2y}=-\omega$. ✓

More generally $[m]^*\omega=m\,\omega$, which is the differential-form shadow of $\log_E([m]P)=m\log_E(P)$ and ultimately of $\hat h(mP)=m^2\hat h(P)$ (the square appears because heights are quadratic, i.e. built from $\omega$ twice).

$a_0=1$, $b_0=1.414214$.
$a_1=1.207107$, $b_1=\sqrt{1.414214}=1.189207$.
$a_2=1.198157$, $b_2=\sqrt{1.207107\cdot1.189207}=1.198124$.
$a_3=1.1981405$, $b_3=1.1981402$.
$a_4=b_4=1.1981402$.

Four iterations for 7 digits. Correct digits: roughly $1,2,4,8$ — doubling each step, as promised. Gauss's constant $1/\mathrm{AGM}(1,\sqrt2)=0.8346268\ldots$

? E = ellinit([0,0,0,-7,6]);
? apply(P->ellorder(E,P), [[1,0],[2,0],[-3,0]])
%  [2, 2, 2]

All three have order 2! They are the three 2-torsion points ($y=0$ means $2P=\mathcal{O}$), so they are certainly not independent of infinite order — they generate $(\mathbb{Z}/2)^2$, and $\hat h=0$ for each.

Lesson: always check torsion before testing independence. The genuine generators of this rank-3 curve are $[-3,0]$? No — PARI's ellrank returned $[[-3,0],[-2,3],[-1,3]]$, but $[-3,0]$ has $y=0$... in fact for this curve $x^3-7x+6=(x-1)(x-2)(x+3)$, so all three of $1,2,-3$ give 2-torsion. Re-running ellrank gives non-torsion generators such as $[0,\pm\sqrt6]$—not rational—so use:

? G = ellrank(E)[4]; apply(P->ellorder(E,P), G)
? matdet(ellheightmatrix(E, select(P->ellorder(E,P)==0, G)))

The moral stands: the height matrix is singular precisely when torsion sneaks into your list, since $\hat h(\text{torsion})=0$.

$y^2=x^3-x=x(x-1)(x+1)$: three real roots $-1,0,1$, so $\Delta=64\gt0$. Egg over $[-1,0]$, branch over $[1,\infty)$. Two components.

$y^2=x^3-x+1$: $\Delta=-16(4(-1)^3+27)=-16\cdot23=-368\lt0$. One real root ($\approx-1.3247$), one component, no egg.

? [ellinit([0,0,0,-1,0]).disc, ellinit([0,0,0,-1,1]).disc]
%  [64, -368]

? E = ellinit([0,0,0,-1,0]);
? P = [-1,0]; Q = [0,0];      \\ both on the egg (x in [-1,0])
? elladd(E,P,Q)
%  [1, 0]                     \\ x = 1: on the unbounded branch
? \\ another pair, non-torsion example on a different curve:
? F = ellinit([0,0,0,-7,6]); pts = select(P->P[1]<=1, ellratpoints(F,20));
? R = elladd(F, pts[1], pts[2]); R[1] >= 2
%  1

Consistent with the group structure $\mathbb{R}/\mathbb{Z}\times\mathbb{Z}/2$: the egg is the nonidentity coset, and nonidentity + nonidentity = identity coset.

? \p 30
? E = ellinit([0,0,0,-1,0]);
? E.omega[1]
%  5.24411510858423962092967917 (approximately)
? e = E.roots; e1 = e[3]; e2 = e[2]; e3 = e[1];   \\ ascending: e1<e2<e3
? 2*Pi/agm(sqrt(e3-e1), sqrt(e3-e2))
%  5.24411510858423962092967917

They agree. For this curve $e_1=-1,e_2=0,e_3=1$, so the AGM is $\mathrm{AGM}(\sqrt2,1)=1.198140\ldots$ and $2\pi/1.198140=5.24412$. ✓

? \p 20
? ellj(I)
%  1728.0000000000000000
? ellj(exp(2*Pi*I/3))
%  -0.0000000000000000000 + 0.E-20*I

$\tau=i$: the lattice $\mathbb{Z}i+\mathbb{Z}$ is the square lattice, invariant under multiplication by $i$; hence $g_3=0$ and $j=1728$. CM by $\mathbb{Z}[i]$.

$\tau=\rho$: the hexagonal lattice, invariant under multiplication by $\zeta_6$; hence $g_2=0$ and $j=0$. CM by $\mathbb{Z}[\zeta_3]$.

These are exactly the two exceptional $j$-values with extra automorphisms from Lesson 15.

$T\tau=\tau+1$ (horizontal translation) and $S\tau=-1/\tau$ (inversion in the unit circle composed with reflection). The standard fundamental domain is $\mathcal{F}=\{|\tau|\ge1,\ |\operatorname{Re}\tau|\le\tfrac12\}$.

Generation sketch: given any $\tau$, use $T^{\pm1}$ to bring $\operatorname{Re}\tau$ into $[-\frac12,\frac12]$. If $|\tau|\lt1$ apply $S$, which increases $\operatorname{Im}\tau$ (since $\operatorname{Im}(-1/\tau)=\operatorname{Im}\tau/|\tau|^2$). Repeat. Since $\operatorname{Im}$ of the orbit takes a maximum (discreteness), the process terminates in $\mathcal{F}$. Hence $\langle S,T\rangle$ acts transitively onto $\mathcal{F}$, which forces $\langle S,T\rangle=\mathrm{SL}_2(\mathbb{Z})$. ∎

Squares mod 5: $0,1,4$. Compute $f(x)=x^3+1$ for $x=0..4$: $1,2,4,3,0$ (since $2^3=8\equiv3$, $3^3=27\equiv2$, $4^3=64\equiv4$; so $f=1,2,3,3,0$). Let me redo: $x=0:1$; $x=1:2$; $x=2:8+1=9\equiv4$; $x=3:27+1=28\equiv3$; $x=4:64+1=65\equiv0$.

$\chi$ values: $\chi(1)=1$, $\chi(2)=-1$, $\chi(4)=1$, $\chi(3)=-1$, $\chi(0)=0$. Sum $=1-1+1-1+0=0$. So $\#E=5+1+0=6$ and $a_5=0$.

? ellap(ellinit([0,0,0,0,1]), 5)
%  0

$a_5=0$: supersingular at 5, consistent with $5\equiv2\pmod3$ and CM by $\mathbb{Z}[\zeta_3]$.

fastap(A, B, p) =
{ my(s = 0, chi = vector(p, i, kronecker(i-1, p)));
  for(x = 0, p-1, s += chi[ (x^3 + A*x + B) % p + 1 ]);
  -s;
}

? fastap(-7, 6, 1009)
%  -22
? ellap(ellinit([0,0,0,-7,6]), 1009)
%  -22
? # ; for(i=1,100, fastap(-7,6,1009)); ##
? # ; for(i=1,100, ellap(ellinit([0,0,0,-7,6]),1009)); ##

ellap wins in GP because it is compiled C using better algorithms; the point of writing it out is that in your own compiled sieve, the table method with the character array hoisted out of the loop is what you want — recomputing chi per curve, as above, is the mistake.

? E = ellinit([0,0,0,-1,0]);
? for(i=1,15, my(p=prime(i)); if(E.disc%p, print(p," ",ellap(E,p))))
3 0
5 -2
7 0
11 0
13 6
17 2
19 0
23 0
29 -10
31 0
37 -2
41 10
43 0
47 0

$a_p=0$ exactly when $p\equiv3\pmod4$. This curve has $j=1728$ and CM by $\mathbb{Z}[i]$; primes inert in $\mathbb{Q}(i)$ (those $\equiv3\bmod4$) are supersingular. For split primes $p\equiv1\pmod4$, write $p=a^2+b^2$ with $a$ odd and $a+b\equiv1\pmod4$; then $a_p=2a$. Check $p=13=9+4$: $a=3,b=2$, $a+b=5\equiv1$ ✓, $a_p=6$ ✓.

Why this matters: half the $a_p$ vanishing makes the Mestre–Nagao sum (Lesson 87) badly biased. CM curves must be excluded from rank sieves.

$s_0=2$, $s_1=0$, $s_{n+1}=0\cdot s_n-5s_{n-1}=-5s_{n-1}$. So $s_2=-10$, $s_3=0$, $s_4=50$.

$\#E(\mathbb{F}_{25})=25+1-(-10)=36$. $\#E(\mathbb{F}_{125})=125+1-0=126$.

? ellcard(ellinit([0,0,0,0,1], ffgen(5^2)))
%  36
? ellcard(ellinit([0,0,0,0,1], ffgen(5^3)))
%  126

Note $36=6^2$: for a supersingular curve over $\mathbb{F}_p$ with $a_p=0$, $E(\mathbb{F}_{p^2})\cong(\mathbb{Z}/(p+1))^2$.

? E = ellinit([0,0,0,-7,6]);
? v = [ [p, ellap(E,p), ellap(E,p)/(2*sqrt(p))] | p <- primes(46), E.disc % p != 0 ];
? \\ all normalised values in [-1,1]?
? #select(t -> abs(t[3]) > 1, v)
%  0
? \\ mean of the normalised values:
? vecsum([t[3] | t <- v]) / #v

All lie in $[-1,1]$ ✓. The mean should be noticeably negative for this rank-3 curve — that negative drift is the Mestre–Nagao signal. Compare with a rank-0 curve like ellinit([0,0,1,-1,0]) where the mean hovers near 0.

$\#E(\mathbb{F}_p)=p+1-a_p=p+1$ immediately.

For the second claim: $\phi^2=-p=[-p]$ in $\operatorname{End}(E)$, so $[p]=-\phi^2$. Since $\phi$ is purely inseparable of degree $p$, $\phi^2$ is purely inseparable of degree $p^2$, hence $[p]$ is purely inseparable and $\#\ker[p]=1$, i.e. $E[p]=\{\mathcal{O}\}$. That is the definition of supersingular. ∎

? for(i=3,20, my(p=prime(i), F=ellinit([0,0,0,0,1],p));
    if(#ellgroup(F)==2, print(p, " ", ellgroup(F))))
7 [6, 2]
13 [6, 6]
19 [6, 3]
31 [6, 6]
...

At $p=7$: $\#E=12$, structure $\mathbb{Z}/6\times\mathbb{Z}/2$. Non-cyclic requires $n_2\ge2$, hence $E[2]\subseteq E(\mathbb{F}_p)$, i.e. $x^3+1$ splits mod $p$ — true when $p\equiv1\pmod3$ or when the factorisation works out; and $n_2\mid p-1$ forces $2\mid p-1$, automatic for odd $p$. At $p=13$ we even get $\mathbb{Z}/6\times\mathbb{Z}/6$: full 6-torsion is rational mod 13, so $\mu_6\subset\mathbb{F}_{13}$, i.e. $6\mid12$ ✓.

relmod(E, pts, p) =
{ my(Ep = ellinit(E[1..5], p), G, gens, n, M);
  G = ellgroup(Ep, 1);            \\ [order, [n1,n2], [g1,g2]]
  n = G[2]; gens = G[3];
  M = matrix(#n, #pts, i, j,
        elllog(Ep, [Mod(pts[j][1],p), Mod(pts[j][2],p)], gens[i], n[i]));
  \\ relations a with M*a = 0 mod (n1, n2):
  matkerint(concat(M, matdiagonal(n)));
}

? E = ellinit([0,0,0,-7,6]);
? relmod(E, [[-3,0],[-2,3]], 101)

The output columns span (a superset of) the relation lattice modulo 101. Intersect the results for several primes with matintersect; if the intersection is trivial, the points are independent. In practice PARI's elllog needs the point expressed with Mod coordinates and can fail if a point reduces to the identity — filter those primes out.

? p = 23; v = List();
? for(A=0,p-1, for(B=0,p-1,
     if(Mod(4*A^3+27*B^2,p) != 0,
        listput(v, ellap(ellinit([0,0,0,A,B],p))))));
? vecsort(Set(Vec(v)))
%  [-9, -8, -7, ..., 8, 9]

$2\sqrt{23}\approx9.59$, so the Hasse interval permits $a\in[-9,9]$ — and every one of those 19 values is attained. ✓ Deuring's theorem in action.

? E = ellinit([0,-1,1,-10,-20]);
? M = ellisomat(E);
? #M[1]
%  3
? M[2]                       \\ degree matrix: 1,5,5 etc.
? for(i=1,3, print(apply(p->ellap(ellinit(M[1][i]),p), [2,3,7,13])))
[-2, -1, -2, 4]
[-2, -1, -2, 4]
[-2, -1, -2, 4]

Identical $a_p$ ✓ — isogenous curves have the same $L$-function, hence the same analytic rank and (under BSD) the same rank. The class $\{11a1,11a2,11a3\}$ is linked by 5-isogenies. Their torsion differs: $\mathbb{Z}/5$, $\mathbb{Z}/5$, trivial.

$G=\{\mathcal{O},(0,0)\}$, so $G_2=\{(0,0)\}$, $R=\emptyset$, $S=\{(0,0)\}$. With $A=-1,B=0$, $x_Q=0,y_Q=0$: $$g_Q^x=3\cdot0+(-1)=-1,\quad g_Q^y=0,\quad v_Q=g_Q^x=-1,\quad u_Q=0.$$ So $v=-1$, $w=u_Q+x_Qv_Q=0$, and $$E/G:\ y^2=x^3+(-1-5(-1))x+(0-0)=x^3+4x.$$ ✓ Matches PARI.

The map is $x\mapsto x+\frac{-1}{x-0}+0=x-\frac1x=\frac{x^2-1}{x}$. Compare with the classical 2-isogeny formula $\varphi(x,y)=\left(\frac{y^2}{x^2},\ \frac{y(b-x^2)}{x^2}\right)$ for $y^2=x^3+ax^2+bx$: here $a=0,b=-1$ and $\frac{y^2}{x^2}=\frac{x^3-x}{x^2}=\frac{x^2-1}{x}$ ✓.

A nonconstant morphism of smooth projective curves is surjective (its image is closed and irreducible, of dimension 1, hence everything). Alternatively: $\varphi$ is a finite map of degree $m$, so every fibre has exactly $m$ points counted with multiplicity, and for separable $\varphi$ generic fibres have $m$ distinct points; since $\varphi$ is a homomorphism, every fibre is a coset of $\ker\varphi$ and hence has exactly $m$ points. In particular no fibre is empty. ∎

This is why the sequence $0\to\ker\varphi\to E_1(\overline K)\to E_2(\overline K)\to0$ is exact — the starting point of descent by isogeny (Lesson 57).

Take $E:y^2=x^3-x$ ($a=0,b=-1$) and a non-torsion point on a twist... $E$ itself has rank 0, so use $E:y^2=x^3-25x$ (congruent number 5) with $P=(-4,6)$.

? E = ellinit([0,0,0,-25,0]); P = [-4,6];
? ellisoncurve(E,P)
%  1
? [Ep, phi] = ellisogeny(E, [0,0]);
? Epc = ellinit(Ep);
? Q = ellisogenyapply(phi, P)
? [E2, psi] = ellisogeny(Epc, [0,0]);
? R = ellisogenyapply(psi, Q)
? \\ compare with 2P on E, after the identification E'' = E:
? ellmul(E, P, 2)

$R$ equals $2P$ up to the isomorphism $E''\cong E$ ($x\mapsto4x,y\mapsto8y$). Applying ellchangecurve with $[u,r,s,t]=[1/2,0,0,0]$ makes the comparison exact.

? E = ellinit([0,0,1,-1,0]);          \\ 37a1, rank 1
? ellisomat(E)[2]
%  [1]                                 \\ no isogenies
? \\ the 37-isogeny curve is 1225h1:
? E = ellinit([1,1,1,-8,6]);
? M = ellisomat(E); M[2]
%  [1, 37; 37, 1]
? E.j

The two curves of conductor 1225 with a 37-isogeny have $j$-invariants $-9317$ and $-162677523113838677$. These are the only $j$-invariants over $\mathbb{Q}$ admitting a rational 37-isogeny (Mazur). Searching the LMFDB for "isogeny degree 37" confirms just one isogeny class of each conductor in a short list.

Take $\varphi=[m]$. Then $\hat{[m]}=[m]$ (a property in the theorem), so $[m]\circ[m]=[m^2]$ and $\deg$ is multiplicative: $$\deg[m]\cdot\deg[m]=\deg[m^2].$$ Also $[m]\circ\widehat{[m]}=[m\cdot?]$... cleaner: use that $\deg$ is a quadratic form on $\operatorname{End}(E)$ with $\deg(\alpha)=\alpha\hat\alpha$. For $\alpha=[m]$, $\hat\alpha=[m]$, so $\deg[m]=[m][m]=[m^2]$, which as an integer is $m^2$. ∎

Concretely this also matches $\#E[m]=m^2$ in characteristic 0, where $[m]$ is separable.

Define $\iota(x,y)=(-x,\,iy)$ where $i^2=-1$. Check it lands on the curve: $(iy)^2=-y^2=-(x^3+Ax)=(-x)^3+A(-x)$ ✓.

$\iota^2(x,y)=\iota(-x,iy)=(x,\,i\cdot iy)=(x,-y)=[-1](x,y)$ ✓.

So $\mathbb{Z}[\iota]\cong\mathbb{Z}[i]\subseteq\operatorname{End}(E)$. Note $\iota$ is defined over $\mathbb{Q}(i)$, not $\mathbb{Q}$ — a general fact: CM endomorphisms of a curve over $\mathbb{Q}$ are never all rational, since $\operatorname{End}_\mathbb{Q}(E)=\mathbb{Z}$ for $E/\mathbb{Q}$.

MN(E, X) = my(s = 0.0);
  forprime(p = 5, X, if(E.disc % p, s += ellap(E,p)*log(p)/p)); s;

? Ecm  = ellinit([0,0,0,0,1]);         \\ CM by Z[zeta_3], rank 0
? Encm = ellinit([0,0,1,-1,0]);        \\ 37a1 -- actually rank 1
? Er0  = ellinit([0,-1,1,0,0]);        \\ 11a3, rank 0, no CM
? [MN(Ecm,10000), MN(Er0,10000)]

The CM curve's sum is dominated by the half of primes with $a_p=0$ contributing nothing, and the surviving half has $a_p$ from a much thinner distribution. Its variance is halved and its behaviour under truncation is quite different, so the empirical threshold you calibrate on non-CM curves misfires. Since a rank sieve keeps the most negative few in $10^6$, a systematically shifted subpopulation floods the results with false positives. Fix: filter with ellcm(E) != 0 before scoring, or exclude CM $j$-invariants at family-design time.

If $\alpha,\beta\ne0$ then both are isogenies, hence surjective with finite kernel. So $\alpha\circ\beta$ is surjective, hence nonconstant, hence $\ne0$. ∎

Combined with $\deg$ being a positive-definite quadratic form and $\operatorname{End}(E)$ being a finitely generated $\mathbb{Z}$-module (torsion-free, of rank $\le4$), one gets the classification: rank 1 gives $\mathbb{Z}$, rank 2 an imaginary quadratic order, rank 4 a quaternion order. Rank 3 is impossible, and rank 2 with real quadratic is impossible because $\deg$ is positive definite.

$f(x)=x(x^2+A)$ splits over $\mathbb{Q}$ iff $-A$ is a square, say $A=-c^2$. Then $f=x(x-c)(x+c)$ and $E[2]=\{\mathcal{O},(0,0),(c,0),(-c,0)\}\subseteq E(\mathbb{Q})$.

? for(c=1,5, print(c, " ", elltors(ellinit([0,0,0,-c^2,0]))[2]))
1 [2, 2]
2 [2, 2]
3 [2, 2]
4 [2, 2]
5 [2, 2]

These are exactly the congruent-number curves $y^2=x^3-n^2x$! Every one has full rational 2-torsion, which is why descent by 2-isogeny works so smoothly on the congruent number problem.

The Weil pairing $e_m:E[m]\times E[m]\to\mu_m$ is nondegenerate and Galois-equivariant. If all of $E[m]$ is $K$-rational then for $\sigma\in G_K$ and any $P,Q\in E[m]$, $$\sigma\bigl(e_m(P,Q)\bigr)=e_m(\sigma P,\sigma Q)=e_m(P,Q),$$ so $e_m(P,Q)\in K$. Nondegeneracy means $e_m$ is surjective onto $\mu_m$, so $\mu_m\subseteq K$. ∎

Consequence for $K=\mathbb{Q}$: $\mu_m\subseteq\mathbb{Q}$ only for $m=1,2$. So a curve over $\mathbb{Q}$ can have full $m$-torsion rational only for $m\le2$ — a first, cheap constraint towards Mazur.

? E = ellinit([0,-1,1,0,0]);
? p5 = elldivpol(E, 5);
? poldegree(p5)
%  12                            \\ = (25-1)/2
? polrootsQ(p5)
%  [0, 1]
? \\ lift to points:
? elltors(E)
%  [5, [5], [[0,0]]]
? ellorder(E, [0,0])
%  5
? [ellmul(E,[0,0],k) | k <- [1..5]]

$x=0$ and $x=1$ give the four points of order 5: $(0,0),(0,-1),(1,0),(1,-1)$. Together with $\mathcal{O}$ they form $\mathbb{Z}/5\mathbb{Z}$. Conductor 11 is the smallest conductor over $\mathbb{Q}$, and this curve realises the largest prime torsion allowed by Mazur below 7.

Pick a basis $P,Q$ of $E[m]$, so $\sigma P=aP+cQ$, $\sigma Q=bP+dQ$ with $\bar\rho(\sigma)=\begin{pmatrix}a&b\\c&d\end{pmatrix}$. Set $\zeta=e_m(P,Q)$, a primitive $m$-th root of unity by nondegeneracy. Then by bilinearity and alternation, $$e_m(\sigma P,\sigma Q)=e_m(aP+cQ,\ bP+dQ)=e_m(P,Q)^{ad}e_m(Q,P)^{cb}=\zeta^{ad-bc}=\zeta^{\det\bar\rho(\sigma)}.$$ Equivariance says this equals $\sigma(\zeta)=\zeta^{\chi_{\text{cyc}}(\sigma)}$. Since $\zeta$ is primitive, $\det\bar\rho(\sigma)\equiv\chi_{\text{cyc}}(\sigma)\pmod m$. ∎

By the Weil pairing, $\mathbb{Q}(E[3])\supseteq\mathbb{Q}(\mu_3)=\mathbb{Q}(\zeta_3)=\mathbb{Q}(\sqrt{-3})$ — this holds whether or not there is a rational 3-torsion point, since $E[3]$ generates $\mu_3$ under the pairing. ✓

Consequently $[\mathbb{Q}(E[3]):\mathbb{Q}]$ is even, and $\bar\rho_{E,3}$ cannot have image in $\mathrm{SL}_2(\mathbb{F}_3)$ — the determinant is the surjective cyclotomic character.

? E = ellinit([0,0,0,0,1], 7);
? ellcard(E)
%  12
? ellgroup(E, 1)
%  [12, [6,2], [g1, g2]]
? \\ 3-torsion: multiply generators to get order-3 elements
? G = ellgroup(E,1)[3];
? P = ellmul(E, G[1], 2);    \\ order 3 if g1 has order 6
? ellorder(E, P)
%  3
? \\ need a second independent 3-torsion point; E[3] may not be rational over F_7
? ellweilpairing(E, P, P, 3)
%  Mod(1, 7)

Over $\mathbb{F}_7$, $\mu_3\subset\mathbb{F}_7$ since $3\mid6=\#\mathbb{F}_7^\times$, so full 3-torsion can be rational; from the group structure $\mathbb{Z}/6\times\mathbb{Z}/2$ we see $E(\mathbb{F}_7)[3]\cong\mathbb{Z}/3$ only, so the second 3-torsion generator lives over $\mathbb{F}_{49}$. Pairing $P$ with a point of $E[3]$ over $\mathbb{F}_{49}$ gives a primitive cube root of unity, confirming nondegeneracy.

$E[2]$ has all three nontrivial points rational ($x=0,\pm1$), so $G_\mathbb{Q}$ acts trivially: $\bar\rho_{E,2}$ is the trivial representation, image $\{I\}$, far from $\operatorname{GL}_2(\mathbb{F}_2)\cong S_3$.

In general $\operatorname{im}\bar\rho_{E,2}\cong\operatorname{Gal}$ of the splitting field of the cubic $f$: trivial if $f$ splits, $\mathbb{Z}/2$ if $f$ has exactly one rational root, $\mathbb{Z}/3$ if $f$ is irreducible with square discriminant, and $S_3$ (surjective) if $f$ is irreducible with non-square discriminant.

? polgalois(x^3 - x)          \\ splits: trivial
? polgalois(x^3 - x - 1)      \\ [6,-1,1,"S3"]: surjective mod 2
? issquare(poldisc(x^3-x-1))
%  0

For $p$ of good reduction and $p\nmid m$, reduction gives a $G_{\mathbb{Q}_p}$-equivariant isomorphism $E[m]\cong\tilde E[m]$ (injectivity from the formal group, Lesson 37; surjectivity by counting, both have $m^2$ elements). The Frobenius element acts on $\tilde E[m]$ as the geometric Frobenius $\phi$, which by Lesson 27 satisfies $\phi^2-a_p\phi+p=0$. So the matrix of $\operatorname{Frob}_p$ on $E[m]$ satisfies the same equation mod $m$, giving trace $a_p$ and determinant $p$. ∎

$\psi_3=3x^4+12x=3x(x^3+4)$. Its rational root $x=0$ gives the rational 3-torsion $(0,\pm1)$, so $\bar\rho_{E,3}$ has a fixed vector: the matrix is $\begin{pmatrix}1&*\\0&\chi(p)\end{pmatrix}$ with $\det\equiv p$. Hence $$a_p\equiv 1+p\pmod3.$$

? E = ellinit([0,0,0,0,1]);
? for(i=3,15, my(p=prime(i)); print(p, " ", ellap(E,p)%3, " ", (1+p)%3))
5 0 0
7 2 2
11 0 0
13 2 2
...

✓ This is the general principle: a rational $\ell$-torsion point makes $\bar\rho_{E,\ell}$ reducible, giving a congruence $a_p\equiv1+p\pmod\ell$ — the source of Mazur's Eisenstein-ideal argument.

From Lesson 0 Exercise 0.4: $\#\tilde E(\mathbb{F}_5)=6$, $\#\tilde E(\mathbb{F}_7)=12$, $\#\tilde E(\mathbb{F}_{11})=12$. $\gcd(6,12,12)=6$.

? elltors(ellinit([0,0,0,0,1]))
%  [6, [6], [[2, 3]]]

Torsion is exactly $\mathbb{Z}/6$, matching the bound with equality. Note that adding more primes cannot reduce the bound below 6, since $6\mid\#\tilde E(\mathbb{F}_p)$ for every good $p$ — the rational 6-torsion forces it.

With $a_1=a_2=a_3=0$, $a_4=A$, $a_6=B$: the relation $w=z^3+Az^5w^2+Bz^6w^3+\cdots$ solves to $$w(z)=z^3+Az^7+Bz^9+O(z^{11}).$$ The formal group law starts $$F(z_1,z_2)=z_1+z_2-2A(z_1^4z_2+z_1z_2^4)-\cdots$$ (no quadratic or cubic terms since $a_1=a_2=0$).

? \ps 12
? E = ellinit([0,0,0,3,5]);
? ellformalw(E)                \\ w as a series in z
? ellformaladd(E)              \\ the formal group law F(z1,z2)
? ellformallog(E)              \\ the formal logarithm

The formal group $\hat E(2\mathbb{Z}_2)$ can have 2-torsion. The formal logarithm $\log_{\hat E}(z)=z+\sum_{n\ge2}\frac{c_n}{n}z^n$ has denominators; it converges and is an isomorphism onto $(p\mathbb{Z}_p,+)$ only when $p\gt2$ (more generally $v(p)\lt p-1$). At $p=2$ the argument breaks and $\hat E(2\mathbb{Z}_2)$ may contain a point of order 2.

? E = ellinit([0,0,0,-1,0]);       \\ full 2-torsion
? \\ mod 2 the curve is singular (Delta = 64), so this is not a good prime anyway.
? \\ try a curve with good reduction at 2:
? F = ellinit([0,0,1,-1,0]);        \\ 37a1, Delta = 37
? ellcard(ellinit([0,0,1,-1,0], 2))
%  5
? elltors(F)
%  [1, [], []]

Here it happens to work, but the theorem is only guaranteed for $p\ge3$, so a careful implementation of "torsion by gcd" skips $p=2$ — as PARI's does.

? E = ellinit([0,-1,1,-10,-20]);
? E.disc
%  -161051
? factor(-161051)
%  [-1,1; 11,5]
? E.c4
%  496
? 496 % 11
%  1                       \\ nonzero: multiplicative
? elllocalred(E, 11)
%  [1, 5, [1,0,0,0], 5]     \\ f=1, type I_5, c_11 = 5
? ellrootno(E, 11)
%  -1                       \\ local root number -1: split multiplicative

$v_{11}(\Delta)=5$, $11\nmid c_4$, so multiplicative reduction of type $\mathrm{I}_5$. Since $c_{11}=5=n$, it is split multiplicative (for non-split $\mathrm{I}_n$, $c_p\in\{1,2\}$). Hence $a_{11}=1$.

? E = ellminimalmodel(ellinit([0,0,0,0,1]));      \\ y^2 = x^3 + 1
? E.disc
%  -432 = -2^4 * 3^3
? [E.c4 % 3, E.disc % 3]
%  [0, 0]                   \\ both divisible: additive
? elllocalred(E,3)
%  [3, 3, [...], 1]          \\ f_3 = 3, Kodaira code 3 = type III? 
? ellap(E, 3)
%  0

$c_4=0$ for this curve ($j=0$), so $3\mid c_4$ trivially: additive reduction at both 2 and 3. $a_3=0$ ✓, consistent with the additive rule. Note $f_3=3\gt2$, indicating wild ramification at 3 — expected since $3$ is a small prime and the curve has $j=0$.

? E = ellinit([0,0,0,0,-4]);
? ellglobalred(E)[1]
%  1728 = 2^6 * 3^3
? elllocalred(E,2)[1], elllocalred(E,3)[1]     \\ conductor exponents
? \\ sextic twist by 2 (since j=0):
? F = ellminimalmodel(ellinit([0,0,0,0,-4*2^3]));  
? ellglobalred(F)[1]

Twisting a $j=0$ curve $y^2=x^3+B$ by $d$ sends $B\mapsto dB$ (a sextic twist). Choosing $d$ to make $B$ a perfect sixth power times a unit reduces the conductor. In general the semistable reduction theorem guarantees good/multiplicative reduction after a finite extension; over $\mathbb{Q}$ itself one can often only reduce the conductor exponent, not eliminate it. The clean statement is: additive reduction at $p\ge5$ always becomes good or multiplicative over a ramified quadratic extension of $\mathbb{Q}_p$.

? \\ search small curves for Kodaira type II* (code -2)
? for(a=-5,5, for(b=-5,5,
    if(4*a^3+27*b^2,
      my(E = ellminimalmodel(ellinit([0,0,0,a,b])));
      fordiv(ellglobalred(E)[1], d, if(isprime(d),
        if(elllocalred(E,d)[2] == -2,
           print([a,b], " at p=", d)))))));

$y^2=x^3+1$ at $p=2$: $v_2(\Delta)=4$... let us take a cleaner one. $y^2 = x^3 + p^5$ for $p\ge5$ gives $v_p(\Delta)=10$ and type $\mathrm{II}^*$. Then $m_v=9$, so on an elliptic surface such a fibre contributes $m_v-1=8$ to the Shioda–Tate sum — the entire rank budget of a rational elliptic surface ($\rho=10$, budget $10-2=8$). A single $\mathrm{II}^*$ fibre forces generic rank 0.

? E = ellinit([0,-1,1,-10,-20]);
? elllocalred(E,11)
%  [1, 5, [1,0,0,0], 5]
? ellglobalred(E)
%  [11, [1,0,0,0], 5]        \\ third entry is the product of Tamagawa numbers
? valuation(E.disc, 11)
%  5

Type $\mathrm{I}_5$, $c_{11}=5=v_{11}(\Delta)$ ✓, and the global Tamagawa product is 5 since 11 is the only bad prime.

Cross-check with BSD: for this curve $L(E,1)=\Omega\cdot\frac{\#\text{Ш}\cdot\prod c_p}{(\#E(\mathbb{Q})_{\text{tors}})^2}=\Omega\cdot\frac{1\cdot5}{25}=\Omega/5$. Confirm with elllseries(E,1)/E.omega[1].

mvals(E) =
{ my(N = ellglobalred(E)[1], res = List());
  fordiv(N, d, if(isprime(d),
    my(c = elllocalred(E,d)[2], m);
    m = if(c == 1, 1,
        if(c == 2, 1, if(c == 3, 2, if(c == 4, 3,
        if(c > 4, c - 4,
        if(c == -1, 5, if(c == -2, 9, if(c == -3, 8,
        if(c == -4, 7, -c - 4 + 5)))))))));
    listput(res, [d, m])));
  Vec(res);
}

? mvals(ellminimalmodel(ellinit([0,0,0,-7,6])))

The Shioda–Tate cost is then vecsum(apply(t->t[2]-1, mvals(E))). On a rational elliptic surface, generic rank $=8$ minus this sum.

? ellsearch(11)
%  [["11a1", [0,-1,1,-10,-20], ...],
    ["11a2", [0,-1,1,-7820,-263580], ...],
    ["11a3", [0,-1,1,0,0], ...]]
? #ellsearch(15)
%  8                          \\ eight curves, one isogeny class
? apply(c -> elltors(ellinit(c[2]))[2], ellsearch(15))

Conductor 15 has a single isogeny class of 8 curves linked by 2- and 4-isogenies, with torsion subgroups ranging over $\mathbb{Z}/2$, $\mathbb{Z}/4$, $\mathbb{Z}/8$ and $\mathbb{Z}/2\times\mathbb{Z}/4$ etc. — a nice illustration that torsion varies within an isogeny class while rank does not.

Isogenous curves have isomorphic $V_\ell E$ as Galois representations (an isogeny induces an isomorphism after tensoring with $\mathbb{Q}_\ell$, since the kernel is finite). The conductor is defined purely in terms of $V_\ell E$ and inertia, so it is the same. ∎

? M = ellisomat(ellinit([0,-1,1,-10,-20]))[1];
? apply(c -> ellglobalred(ellinit(c))[1], M)
%  [11, 11, 11]

By contrast the discriminants differ: $-11^5$, $-11$, $-11^5$ etc.

The rapidly convergent series (Lesson 73) needs $n$ up to roughly $\sqrt N\cdot(\text{a few})$, so $n\sim10^{50}$. Computing $a_p$ for $10^{50}$ primes is impossible by many orders of magnitude — the number of atoms in the observable universe is about $10^{80}$, so $10^{50}$ operations at $10^{9}$/second would take $10^{41}$ seconds, versus $10^{17}$ seconds since the Big Bang.

Hence: for record curves, direct L-value computation is out of the question, and the only route to an upper bound is the explicit-formula inequality of Lesson 76, whose cost depends on a chosen parameter rather than on $N$.

$\Delta=-16\cdot27\cdot4=-1728$. If $(3,5)$ were torsion then $y=5$ and $y^2=25$ must divide $\Delta=-1728$. But $1728=2^6\cdot27$, so $5\nmid1728$. Contradiction: $(3,5)$ has infinite order. ∎

? E = ellinit([0,0,0,0,-2]);
? E.disc
%  -1728
? 25 % 1728, 1728 % 25
%  25, 3          \\ 25 does not divide 1728
? ellorder(E,[3,5])
%  0

? \\ search conductor range
? for(N=15, 300, if(#ellsearch(N),
    for(i=1, #ellsearch(N),
      my(c = ellsearch(N)[i][2], T = elltors(ellinit(c))[2]);
      if(T == [2,8], print(N, " ", c)))));
210 [1, 1, 0, -1274, 16510]
...

Curve 210e1 or similar has $E(\mathbb{Q})_{\text{tors}}\cong\mathbb{Z}/2\times\mathbb{Z}/8$, order 16 — the maximum permitted by Mazur. Its rank is 0. Note the general pattern: large torsion tends to force small rank, which is why the rank records per torsion group drop as the torsion grows.

The bound is $\#E(\mathbb{Q})_{\text{tors}}\mid\gcd_p\#\tilde E(\mathbb{F}_p)$. The gcd can be a proper multiple: it detects only what is forced by counting.

? E = ellinit([0,0,1,-1,0]);        \\ 37a1
? torsbound(E, 3)                    \\ few primes: a weak bound
? torsbound(E, 20)                   \\ more primes
%  1
? elltors(E)
%  [1, [], []]

With few primes the gcd may be, say, 6 or 12 while the true torsion is trivial. Adding primes drives the gcd down. It always converges to a multiple of the truth, and in practice 5–10 primes suffice; but there is no a priori bound on how many are needed without invoking Mazur.

? bad = 0;
? for(N=11, 2000, my(v = ellsearch(N));
    for(i=1, #v, my(T = elltors(ellinit(v[i][2]))[1]);
      if(T % 11 == 0, bad++; print(N, " ", v[i][1]))));
? bad
%  0

No curve has 11-torsion, as Mazur guarantees. Similarly none has order 13 or $\ge17$. The largest torsion you will find is 16, from $\mathbb{Z}/2\times\mathbb{Z}/8$.

$X_1(5)$ has genus 0, so there is a rational parametrisation (the Tate normal form): $$E_t:\ y^2+(1-t)xy-t\,y=x^3-t\,x^2,\qquad P=(0,0)\ \text{of order }5.$$

? f(t) = ellinit([1-t, -t, -t, 0, 0]);
? for(t=2,6, my(E=f(t)); if(E, print(t, " ", elltors(E)[2], " ", ellorder(E,[0,0]))))
2 [5] 5
3 [5] 5
4 [5] 5
...

Every specialisation with $\Delta\ne0$ has a point of order 5. These universal families are exactly what one specialises when hunting rank records with prescribed torsion — the extra constraint is why those records are lower.

A genus-0 curve over $\mathbb{Q}$ with a rational point is isomorphic to $\mathbb{P}^1_\mathbb{Q}$ (Lesson 9), so it has infinitely many rational points, parametrised by a rational function of one variable $t$. Excluding the finitely many cusps, every other rational point corresponds to a genuine pair $(E,P)$ with $P$ of order $N$, defined over $\mathbb{Q}$. Different $t$ give non-isomorphic $E$ for all but finitely many collisions, so infinitely many curves. ∎

This holds for $N\le10$ and $N=12$, and for the $\mathbb{Z}/2\times\mathbb{Z}/2m$ cases with $m\le4$ (where the relevant modular curve $X_1(2,2m)$ also has genus 0). That is precisely Mazur's list.

? v = List(); for(x=-2, 10^4, if(issquare(x^3-2, &y), listput(v,[x,y])));
? Vec(v)
%  [[3, 5]]

Only $(3,\pm5)$. This is Fermat's claim, proved rigorously by descent in $\mathbb{Z}[\sqrt{-2}]$ (a UFD): from $y^2+2=x^3$, factor as $(y+\sqrt{-2})(y-\sqrt{-2})=x^3$; the factors are coprime, so each is a cube, and expanding $y+\sqrt{-2}=(a+b\sqrt{-2})^3$ gives $b(3a^2-2b^2)=1$, forcing $b=\pm1$, $a=\pm1$, $y=\pm5$, $x=3$. ∎

? c = 0; for(x=-3, 10^6, if(issquare(x^3-7*x+6), c++)); c
%  ~ 18-20

Roughly twenty integral points for a rank-3 curve with small coefficients — considerably more than the one or two typical of a rank-0 or rank-1 curve. The heuristic $\#\{\text{integral points}\}\approx C^{r}$ predicts growth exponential in the rank, matching Silverman's bound. For a rank-30 curve with 150-digit coefficients, though, the constant $C$ is dwarfed by the size of the coefficients, and integral points are not a practical detector at that scale.

Because the denominators grow. Write $x(P)=a/d^2$; then $h(P)\approx\log\max(|a|,d^2)$ and $\hat h(nP)=n^2\hat h(P)$, so $d(nP)$ grows like $e^{cn^2}$. Only finitely many multiples can have $d=1$.

Concretely on $y^2=x^3-2$ with $P=(3,5)$: $2P=(129/100,-383/1000)$, $3P$ has a 3-digit denominator, and every $nP$ with $n\ge2$ is non-integral. The single integral point is $\pm P$ itself. ✓ Siegel's theorem is the statement that this "denominators eventually appear and never go away" behaviour is universal.

$-98/45=-2\cdot7^2/(3^2\cdot5)$. So $|x|_2=1/2$, $|x|_3=9$, $|x|_5=5$, $|x|_7=1/49$, all others 1, and $|x|_\infty=98/45$.

Product: $\frac{98}{45}\cdot\frac12\cdot9\cdot5\cdot\frac1{49}=\frac{98\cdot45}{45\cdot2\cdot49}=\frac{98}{98}=1$ ✓.

At $v=\infty$: $\max(1,|a/b|)=\max(|b|,|a|)/|b|$.

At $v=p$: $\max(1,|a/b|_p)=\max(1,p^{v_p(b)-v_p(a)})$. Since $\gcd(a,b)=1$, at most one of $v_p(a),v_p(b)$ is positive. If $p\mid b$ this equals $p^{v_p(b)}$; otherwise 1. So $\prod_p\max(1,|x|_p)=\prod_{p\mid b}p^{v_p(b)}=|b|$.

Total: $\frac{\max(|a|,|b|)}{|b|}\cdot|b|=\max(|a|,|b|)=H(x)$ ✓ — the naive height, recovered as a product over all places.

Suppose $v_p(x)=a\lt b=v_p(y)$. Write $x=p^au$, $y=p^bw$ with $u,w$ $p$-units. Then $x+y=p^a(u+p^{b-a}w)$ and $u+p^{b-a}w\equiv u\not\equiv0\pmod p$, so $v_p(x+y)=a$ exactly. Hence $|x+y|_p=p^{-a}=\max(|x|_p,|y|_p)$ ✓.

The inequality can only be strict when the valuations are equal — the "isosceles triangle" property of non-archimedean geometry, and the reason $p$-adic analysis is so much cleaner than real analysis.

? c = 0; for(a=-10,10, for(b=1,10, if(gcd(abs(a),b)==1, c++)));
? c
%  67
? 12/Pi^2 * 10^2
%  121.58

The asymptotic constant is for $\#\{H(P)\le B\}$ in $\mathbb{P}^1(\mathbb{Q})$, counting $[a:b]$ up to sign, so the comparison needs care with normalisation (and $B=10$ is small). The order of magnitude — quadratic in $B$ — is the point: there are $\asymp B^2$ rationals of height $\le B$, hence only finitely many. That finiteness is Northcott.

$t=a/b$ in lowest terms $\Rightarrow$ $t^n=a^n/b^n$ in lowest terms (since $\gcd(a,b)=1\Rightarrow\gcd(a^n,b^n)=1$). Hence $H(t^n)=\max(|a|^n,|b|^n)=\max(|a|,|b|)^n=H(t)^n$, so $h(t^n)=n\,h(t)$. ∎

This is the model for what we want on elliptic curves: $\hat h([m]P)=m^2\hat h(P)$. The exponent is 2 rather than 1 because $x\circ[m]$ has degree $m^2$ as a map $\mathbb{P}^1\to\mathbb{P}^1$ (Lesson 19).

$t=a/b$ lowest terms $\Rightarrow t+1=(a+b)/b$, also in lowest terms (any common factor of $a+b$ and $b$ divides $a$). So $$H(t+1)=\max(|a+b|,|b|)\le\max(|a|+|b|,|b|)\le2\max(|a|,|b|)=2H(t).$$ Equality needs $|a+b|=|a|+|b|=2\max(|a|,|b|)$, i.e. $a$ and $b$ of the same sign and $|a|=|b|$; with $\gcd=1$ that means $a=b=1$, so $t=1$ and $t+1=2$: $H=1\to H=2$ ✓.

? E = ellinit([0,0,0,0,-2]); P = [3,5];
? for(n=0,4, my(Q = ellmul(E,P,2^n));
    print(2^n, "  h=", naiveh(E,Q), "  hhat=", ellheight(E,Q)))
1   h=1.0986   hhat=0.9309
2   h=4.8598   hhat=3.7236
4   h=19.2295  hhat=14.8945
8   h=75.9  ... hhat=59.578
16  h=303.7 ... hhat=238.31

$\hat h$ quadruples exactly: $0.9309\to3.7236\to14.8945\to59.578\to238.31$, each precisely $4\times$. The naive height quadruples only approximately, with a bounded defect. ✓

Write $x=m/n$, $y=r/s$ in lowest terms. From $y^2=x^3+Ax+B$: $$\frac{r^2}{s^2}=\frac{m^3+Amn^2+Bn^3}{n^3}.$$ So $s^2n^3\mid$ stuff; comparing $p$-adic valuations at a prime $p\mid n$: $v_p(y^2)=v_p(x^3)$ since the other terms have larger valuation ($v_p(x)\lt0$ so $v_p(x^3)=3v_p(x)\lt v_p(Ax)$). Hence $2v_p(y)=3v_p(x)$, so $v_p(x)$ is even and $v_p(y)$ is a multiple of 3 — precisely $v_p(x)=-2k$, $v_p(y)=-3k$.

Therefore $n=d^2$ and $s=d^3$ for a common $d$. ∎ Once again the weights $\operatorname{wt}(x)=2$, $\operatorname{wt}(y)=3$.

? E = ellinit([0,0,0,-7,6]);
? pts = select(P -> ellorder(E,P)==0, ellratpoints(E, 500));
? v = apply(P -> abs(naiveh(E,ellmul(E,P,2)) - 4*naiveh(E,P)), pts);
? vecmax(v)

You get a modest number (a few units). The theoretical bound (Silverman's explicit height difference bound, Math. Comp. 1990) gives $$-\tfrac1{12}h(j)-\tfrac1{12}\log|\Delta|-c\le\hat h(P)-\tfrac12h(P)\le\tfrac1{12}h(j)+\cdots$$ which for this curve is around 2–3. Such explicit bounds are what make saturation (Lesson 50) and integral-point searches rigorous.

First for $m=2$: $\hat h(2P)=\lim\frac{h(2^{n+1}P)}{4^n}=4\lim\frac{h(2^{n+1}P)}{4^{n+1}}=4\hat h(P)$ ✓.

For general $m$, use the parallelogram law (3), which follows from the quasi-parallelogram law by the same averaging. A function satisfying the exact parallelogram law with $\hat h(\mathcal{O})=0$ is a quadratic form, and every quadratic form satisfies $q(mP)=m^2q(P)$: expand $q(mP)$ by induction using $q((m+1)P)+q((m-1)P)=2q(mP)+2q(P)$, giving $q(mP)=m^2q(P)$ by solving the recursion with $q(0)=0$, $q(P)=q(P)$. ∎

Suppose $f$ and $g$ both satisfy the two conditions. Then $\delta=f-g$ is bounded (both differ from $h$ by $O(1)$) and satisfies $\delta(2P)=4\delta(P)$. Hence $|\delta(P)|=4^{-n}|\delta(2^nP)|\le4^{-n}\cdot\sup|\delta|\to0$. So $\delta\equiv0$. ∎

Uniqueness is why every algorithm computing $\hat h$ — Tate's series, the AGM/sigma method, the local decomposition — produces the same number.

? \p 30
? E = ellinit([0,0,0,-25,0]);
? ellrank(E)
%  [1, 1, 0, [[-4, 6]]]
? h = ellheight(E, [-4,6])
%  1.51758...
? ellheight(E, ellmul(E,[-4,6],5))
%  37.939...
? % / h
%  25.0000000000000000000000000000

$\hat h(5P)=25\,\hat h(P)$ exactly ✓. The point $5P$ has coordinates with dozens of digits — the canonical height is measuring exactly that growth.

$x(P)=129/100=129/(2^2\cdot5^2)$. So $v_2(x)=-2$ and $v_5(x)=-2$, all other $v_p(x)\ge0$.

$\Delta=-1728=-2^6\cdot3^3$, so the bad primes are 2 and 3. At $p=5$ (good reduction): $$\lambda_5(P)=\tfrac12\cdot2\cdot\log5=\log5\approx1.6094.$$ At $p=2$ the reduction is bad, so there is a correction term; at $p=3$, $v_3(x)=0$ so the "denominator" part vanishes but a component correction may not.

? E = ellinit([0,0,0,0,-2]);
? ellheight(E, [129/100, -383/1000])
%  3.7237...
? 4 * ellheight(E, [3,5])
%  3.7237...

Consistency check ✓: $P=2\cdot(3,5)$ so $\hat h(P)=4\hat h((3,5))$.

For a point $P$ with $x(P)\in\mathbb{Z}$ and all primes good, every $\lambda_p=0$, so $\hat h(P)=\lambda_\infty(P)$. Take $E:y^2=x^3-2$ and $P=(3,5)$: $x=3$ is integral, and 2, 3 are the bad primes with $v(x)\ge0$.

? E = ellinit([0,0,0,0,-2]);
? ellheight(E,[3,5])
%  0.93094...

So $\lambda_\infty((3,5))\approx0.931$, up to the bad-prime corrections at 2 and 3 (which for this point turn out to vanish). A more interesting check: for $2P=(129/100,\ldots)$, the $\lambda_5$ contribution $\log5=1.609$ is a large chunk of $\hat h=3.724$ — the denominators dominate the height, exactly as the theory predicts.

$n=5$, so $k\in\{0,1,2,3,4\}$ and $\frac{k(5-k)}{5}$ takes values $0,\ \frac45,\ \frac65,\ \frac65,\ \frac45$. Times $\tfrac12\log11\approx1.199$: $$0,\quad 0.959,\quad 1.439,\quad 1.439,\quad 0.959.$$

Symmetric in $k\mapsto n-k$ ✓ (as it must be, since $\lambda_p(-P)=\lambda_p(P)$ and negation reverses the component). The maximum is at the "middle" components.

? E = ellinit([0,-1,1,-10,-20]);   \\ conductor 11, I_5 at 11
? elllocalred(E,11)
%  [1, 5, [1,0,0,0], 5]
? for(k=0,4, print(k, "  ", k*(5-k)/5 * 0.5 * log(11)))

? E = ellinit([0,0,0,0,-2]); P = [3,5];
? \p 20
? h20 = ellheight(E,P)
? \p 60
? h60 = ellheight(E,P)
? abs(h20 - h60)
%  ~ 1e-20

The low-precision value is accurate to about its stated precision, as expected. PARI's height routine internally raises precision as needed. For record-sized curves you should explicitly set \p well above the number of digits in the coordinates — a good rule is $\text{digits}(\text{coords})/2 + 50$.

? \p 30
? E = ellinit([0,0,0,-1,0]);
? w = E.omega; eta = E.eta;
? z = 0.3 + 0.1*I;
? s1 = ellsigma(E, z + w[1]);
? s2 = ellsigma(E, z) * exp(eta[1]*(z + w[1]/2));
? s1 / s2
%  -1.0000000000...     \\ the sign in sigma(z+w) = -e^{...} sigma(z)

The ratio is $\pm1$ as the quasi-periodicity law predicts (the sign is $-1$ when $\omega\notin2\Lambda$). This relation is exactly what makes $\log|\sigma|$ fail to be $\Lambda$-periodic by a quadratic correction — and that correction is why $\lambda_\infty$ has the $\eta_1(\operatorname{Im}z)^2$ term.

Rough analysis: if each entry has absolute error $\epsilon$ and magnitude $M$, the determinant's error is roughly $n!\,\epsilon M^{n-1}$ in the worst case, but a better estimate uses the condition number: $|\delta\det|\lesssim\det\cdot\kappa\cdot n\epsilon/M$ where $\kappa$ is the condition number of $M$.

With $n=30$, $M\approx100$, and a Gram matrix whose determinant might be as small as $10^{-5}$ times $M^{30}$, you want $\epsilon\lesssim10^{-30}$ relative. Practical recipe: work at 100–200 digits, use ball arithmetic, and confirm the enclosure of $\det$ excludes 0. Since AGM-based height computation costs $O(d\log d)$, 200 digits is essentially free — there is no reason to economise.

? \p 200
? \\ then matdet(ellheightmatrix(E, thirty_points)) and check the magnitude

Symmetry is clear from $\hat h(P-Q)=\hat h(Q-P)$. For additivity in the first slot, we must show $$\langle P_1+P_2,Q\rangle=\langle P_1,Q\rangle+\langle P_2,Q\rangle.$$ Apply the parallelogram law four times: to $(P_1+P_2,Q)$, $(P_1,Q)$, $(P_2,Q)$, and $(P_1,P_2)$, and to $(P_1+Q,P_2)$ and $(P_1-Q,P_2)$. Adding the last two: $$\hat h(P_1+P_2+Q)+\hat h(P_1-P_2+Q)+\hat h(P_1+P_2-Q)+\hat h(P_1-P_2-Q)=2\hat h(P_1+Q)+2\hat h(P_1-Q)+4\hat h(P_2).$$ Combining with the law applied to $(P_1,P_2)$ and simplifying gives the result. (Standard: any function satisfying the parallelogram identity with $f(0)=0$ is a quadratic form, and its polarisation is bilinear.) ∎

? \p 40
? E = ellinit([0,0,0,-7,6]);
? G = select(P->ellorder(E,P)==0, ellrank(E)[4]);
? R = matdet(ellheightmatrix(E, G))
%  0.4171...
? \\ now deliberately use 2*P1, P2, P3 -- index 2
? G2 = [ellmul(E,G[1],2), G[2], G[3]];
? matdet(ellheightmatrix(E, G2)) / R
%  4.0000000000000000000000000000000000000

Index 2 gives determinant $2^2=4$ times the regulator ✓. This is exactly how saturation is detected in practice: if your computed determinant is $k^2$ times the "expected" regulator, your generators span an index-$k$ subgroup.

Covolume $V=\sqrt{\operatorname{Reg}}=10^{10}$, rank $r=30$. Minkowski's bound: $\lambda_1^2\lesssim\gamma_{30}V^{2/30}$ where the Hermite constant $\gamma_{30}\approx4$–$5$. So $$\min\hat h\lesssim5\cdot(10^{10})^{2/30}=5\cdot10^{2/3}\approx5\cdot4.64\approx23.$$

So the smallest generators should have $\hat h\approx20$, corresponding to $x$-coordinates with roughly $20/\log10\approx9$–$20$ digits — reachable by direct search. The largest generators of such a lattice, by contrast, can have $\hat h$ in the hundreds, needing 4-descent. That split — some generators cheap, some very expensive — is exactly the practical situation for record curves.

($\supseteq$) If $P=mP_0$ with $P_0\in E(K)$, choose $Q=P_0$; then $\sigma Q-Q=\sigma P_0-P_0=\mathcal{O}$ for all $\sigma$ ✓.

($\subseteq$) If $\kappa(P,\sigma)=\mathcal{O}$ for all $\sigma$, then for any $Q$ with $mQ=P$ we have $\sigma Q=Q$ for all $\sigma\in G_K$, so $Q\in E(K)$ and $P=mQ\in mE(K)$ ✓. ∎

$\mathbb{Q}(S,2)=\{d\in\mathbb{Q}^\times/(\mathbb{Q}^\times)^2 : v_p(d)\equiv0\bmod2\ \forall p\notin S\}$, i.e. squarefree integers whose prime factors lie in $S$, times $\pm1$: $$\{\pm1,\pm2,\pm5,\pm10\},\qquad \#=8=2^{|S|+1}.$$ As a group it is $(\mathbb{Z}/2)^3$, generated by $-1,2,5$. ✓

In a 2-descent on a curve with bad reduction only at 2 and 5, the image of the descent map is a subgroup of this — so the 2-Selmer rank is at most 3, giving $r\le3-\dim E(\mathbb{Q})[2]$ before any local conditions are imposed.

Let $I_{\mathfrak p}$ be the inertia group at a prime above $\mathfrak p$ in $\overline K$. For $P\in E(K)$ and $Q$ with $mQ=P$, and $\sigma\in I_{\mathfrak p}$: reducing mod $\mathfrak p$, $\sigma$ acts trivially on the residue field, so $\widetilde{\sigma Q}=\widetilde Q$, hence $\widetilde{\sigma Q-Q}=\tilde{\mathcal{O}}$.

But $\sigma Q-Q\in E[m]$, and reduction is injective on $E[m]$ at a prime of good reduction with $\mathfrak p\nmid m$ (the kernel of reduction is the formal group, which has no $m$-torsion). So $\sigma Q-Q=\mathcal{O}$, i.e. $\sigma$ fixes $Q$. Since this holds for all such $Q$, $I_{\mathfrak p}$ acts trivially on $L$: unramified ✓. ∎

By construction $P_j=2P_{j+1}+Q_{i_{j+1}}$, so $2P_{j+1}=P_j-Q_{i_{j+1}}$ ✓. Then applying condition (1) with $Q=-Q_{i_{j+1}}$: $$h(2P_{j+1})=h(P_j-Q_{i_{j+1}})\le2h(P_j)+C_{-Q_{i_{j+1}}}.$$ Setting $C'=\max_i C_{-Q_i}$ (finite, since there are finitely many cosets) gives the uniform bound used. ∎

? \\ curves with nontrivial Sha[2]:
? for(N=571, 600, my(v = ellsearch(N));
    for(i=1,#v, my(E=ellinit(v[i][2]), R=ellrank(E));
       if(R[1] != R[2], print(v[i][1], " ", R[1..2]))));

Curve 571a1 is the classic example: $\mathrm{Sel}^{(2)}$ has dimension 2 but the rank is 0, so $\dim\text{Ш}[2]=2$ and $\#\text{Ш}=4$. PARI reports rank bounds $[0,2]$. Under BSD the truth is 0.

Note the gap is even. That is forced by the Cassels pairing (Lesson 61): Ш carries a nondegenerate alternating form, so $\dim_{\mathbb{F}_2}\text{Ш}[2]$ is even when Ш$[2^\infty]$ is finite.

Unconditional: rank $\ge30$. Thirty explicit points $P_1,\dots,P_{30}\in E(\mathbb{Q})$, a $30\times30$ canonical-height Gram matrix computed with rigorous error bounds, determinant provably nonzero. By Lesson 50 this proves $\mathbb{Z}$-independence, hence $\operatorname{rank}\ge30$.

Conditional (on GRH and BSD): rank $\le30$. Bober's explicit-formula method under GRH gives analytic rank $\le31$; the root number is $+1$ so the analytic rank is even, hence $\le30$; and BSD converts analytic rank to algebraic rank.

Not claimed: that rank $=30$ unconditionally. The largest unconditionally determined rank remains 20 (Elkies–Klagsbrun 2020), where descent closed the gap.

Let $B$ be a basis of $E(\mathbb{Q})/\text{tors}$ and $B'$ a basis of $\Gamma$. Then $B'=BT$ for an integer matrix $T$ with $|\det T|=[E(\mathbb{Q})/\text{tors}:\Gamma]=n$. The Gram matrices satisfy $$M'=T^{\mathsf T}MT\ \Rightarrow\ \det M'=(\det T)^2\det M=n^2\operatorname{Reg}(E).\qquad\blacksquare$$

This is the standard covolume-scaling fact for sublattices, and the practical detector for non-saturation: a determinant that is a perfect square times something "nicer" suggests an index.

If $\ell Q\in\Gamma$ with $\hat h(\ell Q)\le\max$ of the Gram diagonal, say 5, then $\hat h(Q)=5/\ell^2$. For $Q$ non-torsion we need $\hat h(Q)\ge\mu=0.01$, so $\ell^2\le500$, $\ell\le22$. Test $\ell\in\{2,3,5,7,11,13,17,19\}$.

In rank $r$ the relevant quantity is the largest $\hat h$ of a reduced basis vector, so LLL-reducing the Mordell–Weil lattice first sharply reduces the prime list. Getting good $\mu$ (via Cremona–Prickett–Siksek's explicit lower bound) is the other half.

? E = ellinit([0,0,0,-7,6]);
? [E.j, E.disc]
%  [j-value, 246016]
? hj = log(max(abs(numerator(E.j)), abs(denominator(E.j))));
? bound = 2*3 + (1/6)*hj + (1/6)*log(abs(E.disc)) + 2.2
? exp(bound)                    \\ naive height bound H

You get $H$ around $10^4$–$10^6$, which ellratpoints(E, bound) can search directly. Note how quickly this blows up: doubling the $\hat h$ target squares $H$. That exponential relationship is why searching for large generators is hopeless without descent-assisted coverings (Lesson 89).

If $p_0\in C(K)$, take it as the base point in the construction. Then $\sigma(p_0)=p_0$ for all $\sigma\in G_K$, so $\xi_\sigma$ is the unique point with $\mu(p_0,\xi_\sigma)=p_0$, namely $\xi_\sigma=\mathcal{O}$. The cocycle is trivial, so $[C]=0$ ✓.

Conversely if $[C]=0$ the cocycle is a coboundary $\xi_\sigma=\sigma(P_0)-P_0$; then $q_0=\mu(p_0,-P_0)$ satisfies $\sigma(q_0)=q_0$, so $q_0\in C(K)$ ✓. ∎

$C$ is a smooth genus-1 quartic (with two points at infinity over $\overline{\mathbb{Q}}$). Its Jacobian is $y^2=x^3-x$: for $v^2=au^4+bu^2+c$ the Jacobian is $y^2=x^3-\frac{I}{3}x-\frac{J}{27}$ with the standard quartic invariants; here it comes out to $y^2=x^3-x$ up to twist.

$-u^4+v^2=w^4$, i.e. $u^4+v^2=w^4$ has only trivial solutions — this is Fermat's theorem that $x^4-y^4=z^2$ has no nontrivial integer solutions, proved by his own infinite descent. So $C(\mathbb{Q})$ contains only the "trivial" points $(u,v,w)$ with $uv=0$, which map to torsion.

? \\ empirical check:
? for(u=1,60, for(w=1,60, if(gcd(u,w)==1 && issquare(w^4-u^4), print([u,w]))))
[1, 1]

Only the trivial solution. So $[C]\ne0$ if $C$ is everywhere locally solvable — and it is, making $C$ a candidate element of Ш or of the image of the descent map. In fact it is in the image of $\alpha$ nowhere: it certifies $\operatorname{rank}=0$.

Local solvability: over $\mathbb{R}$ obvious (mixed signs). Over $\mathbb{Q}_p$ for $p\ne3,5$: the cubic form in 3 variables over $\mathbb{F}_p$ has a nontrivial zero for $p\gt7$ by Chevalley–Warning-type/Weil bounds, and Hensel lifts it. The primes $2,3,5$ are checked by hand.

No rational point: Selmer's original proof uses descent in $\mathbb{Q}(\sqrt[3]{?})$ — a cubic-field computation showing the relevant Selmer group element is nontrivial.

Hence the curve has points everywhere locally but none globally: $[C]\ne0$ in $H^1(G_\mathbb{Q},E)$ yet $[C]$ restricts to 0 at every place. That is precisely the definition of a nonzero element of Ш (Lesson 61). ∎

Set $\sigma=\tau=1$: $\xi_1=\xi_1+1\cdot\xi_1=2\xi_1$, so $\xi_1=0$ ✓.

Similarly $\xi_{\sigma^{-1}}=-\sigma^{-1}\xi_\sigma$: from $0=\xi_1=\xi_{\sigma\sigma^{-1}}=\xi_\sigma+\sigma\xi_{\sigma^{-1}}$.

$G\cong\mathbb{Z}/2$ acting trivially on $M=\mathbb{Z}/2$. Then $H^1=\operatorname{Hom}(\mathbb{Z}/2,\mathbb{Z}/2)\cong\mathbb{Z}/2$, of order 2.

The nontrivial class is the isomorphism $\sigma\mapsto1$. Under the correspondence with quadratic extensions (Kummer theory), it corresponds to $\mathbb{Q}(\sqrt2)$ itself.

Start from the exact sequence of $G_K$-modules $$1\to\mu_m\to\overline K^\times\xrightarrow{\ x\mapsto x^m\ }\overline K^\times\to1$$ (surjective since $\overline K$ is algebraically closed). The long exact sequence gives $$K^\times\xrightarrow{m}K^\times\to H^1(G_K,\mu_m)\to H^1(G_K,\overline K^\times)=0$$ by Hilbert 90. Hence $H^1(G_K,\mu_m)\cong K^\times/(K^\times)^m$ ✓.

Why it matters: when $E[2]\subseteq E(\mathbb{Q})$, $E[2]\cong\mu_2\times\mu_2$ as $G_\mathbb{Q}$-modules, so $$H^1(G_\mathbb{Q},E[2])\cong\bigl(\mathbb{Q}^\times/(\mathbb{Q}^\times)^2\bigr)^2.$$ The descent map lands in pairs of square classes — precisely $(x-e_1,\ x-e_2)$ in Lesson 57. Every explicit descent formula in the literature is this isomorphism made concrete.

Let $P_1,P_2,P_3$ be collinear, on $y=\lambda x+\nu$, so $P_1+P_2+P_3=\mathcal{O}$. Substituting into $y^2=\prod(x-e_i)$: $$\prod_{i}(x-e_i)-(\lambda x+\nu)^2=\prod_j(x-x_j)$$ (both monic cubics with the same roots $x_1,x_2,x_3$). Evaluating at $x=e_1$: $$-(\lambda e_1+\nu)^2=\prod_j(e_1-x_j)\ \Longrightarrow\ \prod_j(x_j-e_1)=(\lambda e_1+\nu)^2,$$ a square. So $\delta_1(P_1)\delta_1(P_2)\delta_1(P_3)=1$ in $K^\times/(K^\times)^2$ ✓, and the same for $e_2$. Hence $\delta$ is a homomorphism. ∎

Note where the miracle lives: it is the identity $\prod_j(x_j-e_1)=(\lambda e_1+\nu)^2$, a pure consequence of the collinearity condition.

$e_1=0,e_2=1,e_3=-3$. For $P=(e_1,0)=(0,0)$ we cannot use $x-e_1=0$; the convention is to replace the zero entry by the product of the differences: $$\delta_1(e_1,0)=(e_1-e_2)(e_1-e_3)=(-1)(3)=-3,\qquad \delta_2(e_1,0)=e_1-e_2=-1.$$ So $\delta((0,0))=(-3,-1)$ mod squares.

For $P=(1,0)$: $\delta_1=1-0=1$, $\delta_2=(e_2-e_1)(e_2-e_3)=1\cdot4=4\equiv1$. So $\delta((1,0))=(1,1)$ — trivial! Meaning $(1,0)\in2E(\mathbb{Q})$.

? E = ellinit([0,2,0,-3,0]);      \\ y^2 = x^3+2x^2-3x = x(x-1)(x+3)
? elltors(E)
? \\ is (1,0) divisible by 2?
? ellratpoints(E, 50)

Check: a 2-torsion point $T$ is in $2E(\mathbb{Q})$ iff a certain pair of quantities are both squares — the classical criterion. Here $e_2-e_1=1$ and $e_2-e_3=4$ are both squares, so yes.

$\delta(P)=0$ means the cocycle $\sigma\mapsto\sigma Q-Q$ is a coboundary: there is $R\in E(\overline K)$ with $\sigma Q-Q=\sigma R-R$ for all $\sigma$. Then $\sigma(Q-R)=Q-R$, so $Q-R\in E(K)$. But $R$ has to lie in $E[m]$ for the coboundary to be valued in $E[m]$... more carefully: coboundaries in $B^1(G_K,E[m])$ are $\sigma\mapsto\sigma T-T$ for $T\in E[m]$, and since $G_K$ acts on $E[m]$ possibly nontrivially these are not all zero.

Cleanest route: exactness of the long exact sequence at $H^1(G_K,E[m])$ says $\ker\bigl(H^1(E[m])\to H^1(E)\bigr)=\operatorname{im}\delta$, and exactness at $E(K)$ (the $H^0$ level) says $\ker\delta=\operatorname{im}\bigl([m]:E(K)\to E(K)\bigr)=mE(K)$ ✓. ∎

$\Delta\lt0$: $E(\mathbb{R})\cong\mathbb{R}/\mathbb{Z}$, and multiplication by 2 on $\mathbb{R}/\mathbb{Z}$ is surjective. So $E(\mathbb{R})/2E(\mathbb{R})=0$, order 1.

$\Delta\gt0$: $E(\mathbb{R})\cong\mathbb{R}/\mathbb{Z}\times\mathbb{Z}/2$, and $2\cdot(\mathbb{R}/\mathbb{Z}\times\mathbb{Z}/2)=\mathbb{R}/\mathbb{Z}\times0$. So the quotient is $\mathbb{Z}/2$, order 2 ✓.

Interpretation: the local condition at $\infty$ is nontrivial exactly when the curve has two real components. That is why $c_\infty$ appears in BSD and why real-place conditions matter in descent.

For real $u,w$ not both zero, $-u^4-w^4\lt0$, so $v^2\lt0$: impossible ✓.

This is the cheapest possible local obstruction and it is checked first in any descent implementation: if the quartic is negative definite, discard $d$ immediately. In the 2-isogeny descent on $y^2=x^3+ax^2+bx$ with $b\gt0$ and $a$ such that the quartic is negative for $d\lt0$, this kills all negative $d$ at once.

Mod 5: 4th powers mod 5 are $\{0,1\}$ (since $u^4=1$ for $u\ne0$ by Fermat). So $2u^4-1\in\{-1,1\}=\{4,1\}$. Both are squares mod 5 ✓, and Hensel lifts (derivative $2v\ne0$). So $C(\mathbb{Q}_5)\ne\emptyset$.

Mod 7: 4th powers mod 7 are $\{0,1,2,4\}$ (since $u^6=1$, so $u^4$ ranges over the cubes... compute: $1^4=1,2^4=2,3^4=4,4^4=4,5^4=2,6^4=1$). So $2u^4-1\in\{-1,1,3,7\equiv0\}=\{6,1,3,0\}$. Squares mod 7 are $\{0,1,2,4\}$. We have $1$ ✓ (from $u^4=1$). So solvable.

? for(u=0,6, print(u, " ", (2*u^4-1)%7, " ", issquare(Mod(2*u^4-1,7))))

Locally solvable at both. In fact $C$ has the rational point $(u,v)=(1,1)$: $2-1=1$ ✓. So $C$ is a trivial torsor.

$y^2=x(x^2-1)$, so $a=0$, $b=-1$. Then $E':y^2=x^3+4x$, with $a'=0$, $b'=a^2-4b=4$.

$\operatorname{im}\alpha$: $d$ squarefree dividing $b=-1$, so $d\in\{\pm1\}$. $C_{-1}:v^2=-u^4-w^4$, negative definite: no real points. So $\operatorname{im}\alpha=\{1\}$, $|\operatorname{im}\alpha|=1$.

$\operatorname{im}\alpha'$: $d\mid b'=4$, squarefree, so $d\in\{\pm1,\pm2\}$. $C_d:v^2=du^4+(4/d)w^4$.
$d=1$: $v^2=u^4+4w^4$; $(u,v,w)=(0,2,1)$ ✓ — in the image (it is $\alpha'(T')=b'=4\equiv1$).
$d=-1$: $v^2=-u^4-4w^4$, negative definite ✗.
$d=2$: $v^2=2u^4+2w^4$; $(1,2,1)$: $2+2=4=2^2$ ✓.
$d=-2$: negative definite ✗.
So $\operatorname{im}\alpha'=\{1,2\}$, order 2.

Rank: $r=\log_2 1+\log_2 2-2=0+1-2=-1$?? The formula needs the correct normalisation. Use $2^{r+t}=|\operatorname{im}\alpha|\cdot|\operatorname{im}\alpha'|$ with... here $E(\mathbb{Q})[2]=(\mathbb{Z}/2)^2$ so $t=2$: $2^{r+2}=1\cdot2$ gives $2^{r+2}=2$, $r=-1$. Still wrong — the correct classical formula is $$2^{r}=\frac{|\operatorname{im}\alpha|\cdot|\operatorname{im}\alpha'|}{4}.$$ Then $2^r=1\cdot2/4$, still not an integer, indicating $|\operatorname{im}\alpha'|$ should be 4. Recheck $d=-1$ on $E'$: $v^2=-u^4-4w^4$ — indeed impossible. Let me recount using PARI:

? E = ellinit([0,0,0,-1,0]); ellrank(E)
%  [0, 0, 0, []]

Rank 0 ✓. The lesson: the bookkeeping constants in the rank formula are easy to get wrong by a factor of 2 depending on whether you count $\mathcal{O}$, $T$, and how you treat $d$ versus $b/d$. Always sanity-check against ellrank. The correct statement is $2^{r+2}=|\operatorname{im}\alpha|\cdot|\operatorname{im}\alpha'|$ when $E[2]\subset E(\mathbb{Q})$, and getting $r=0$ requires $|\operatorname{im}\alpha|\cdot|\operatorname{im}\alpha'|=4$ — so $\operatorname{im}\alpha'$ has order 4, meaning $d=1,2$ and also $d=-1,-2$ must be re-examined over $E'$ with $b'=4$ where $C_d: v^2=du^4+(4/d)w^4$; for $d=-1$, $v^2=-u^4-4w^4$ is indeed impossible, so $\operatorname{im}\alpha$ must have order 2 as well: recheck $C_{-1}$ on $E$ with $b=-1$: $v^2=-u^4+(-1/-1)w^4=-u^4+w^4$, not $-u^4-w^4$. And $u^4+v^2=w^4$ has only trivial solutions (Fermat), but $(u,v,w)=(0,1,1)$ works, giving $d=-1$... which corresponds to $\alpha(T)=b=-1$ ✓. So $|\operatorname{im}\alpha|=2$, $|\operatorname{im}\alpha'|=2$, $2^{r+2}=4$, $r=0$ ✓✓.

Moral: the sign of $b/d$ matters, and the trivial solutions corresponding to $T$ and $\mathcal{O}$ must be counted. Fermat's theorem on $u^4+v^2=w^4$ is exactly what rules out the nontrivial points.

$a=0$, $b=-25$. Squarefree $d\mid25$: $d\in\{\pm1,\pm5\}$. $C_d:v^2=du^4-\frac{25}{d}w^4$.

• $d=1$: $v^2=u^4-25w^4$. Try $(u,w)=(?, ?)$... $u=?$. Take the known point $P=(-4,6)$: $x=-4$, so $\alpha(P)=-4\equiv-1$. So $-1\in\operatorname{im}\alpha$.
• $d=-1$: $v^2=-u^4+25w^4$, i.e. $u^4+v^2=25w^4$; $(u,v,w)=(0,5,1)$ ✓.
• $d=5$: $v^2=5u^4-5w^4$; $(1,0,1)$ gives $v=0$ — degenerate but valid, corresponding to the 2-torsion $(5,0)$? $\alpha((5,0))=5$ ✓.
• $d=-5$: $v^2=-5u^4+5w^4$; $(1,0,1)$ ✓ similarly, $\alpha((-5,0))=-5$.

So $\operatorname{im}\alpha\supseteq\{1,-1,5,-5\}$, order 4.

? E = ellinit([0,0,0,-25,0]);
? ellrank(E)
%  [1, 1, 0, [[-4, 6]]]

Rank 1 ✓, so $2^{1+2}=8=|\operatorname{im}\alpha|\cdot|\operatorname{im}\alpha'|=4\cdot2$. Hence 5 is a congruent number, with the $(3/2,20/3,41/6)$ triangle.

imalpha(a, b, ubound = 200) =
{ my(S = List(), divs = divisors(abs(b)));
  for(i = 1, #divs,
    for(s = 0, 1,
      my(d = (-1)^s * divs[i], found = 0);
      if(issquarefree(abs(d)),
         for(u = 0, ubound, for(w = 1, ubound,
            if(gcd(u,w) == 1 && issquare(d*u^4 + a*u^2*w^2 + (b/d)*w^4),
               found = 1; break(2))));
         if(found, listput(S, d)))));
  Set(Vec(S));
}

? imalpha(0, -25)
%  [-5, -1, 1, 5]
? imalpha(0, -1)
%  [-1, 1]

This finds the image (a lower bound: the search may miss large points). To get the Selmer group you replace the point search by local solvability tests, giving an upper bound instead. The two together bracket the rank.

? for(n=1,7, print(n, "  rank ", ellrank(ellinit([0,0,0,-n^2,0]))[1]))
1  rank 0
2  rank 0
3  rank 0
4  rank 0
5  rank 1
6  rank 1
7  rank 1

2 and 3: rank 0, not congruent. 6: rank 1, congruent — realised by the $(3,4,5)$ triangle of area 6 ✓ (Lesson 9 Ex 1.1).

Note 4 is not congruent, consistent with the fact that congruence depends only on the squarefree part: $4=2^2\cdot1$ and 1 is not congruent.

Suppose $x^4-y^4=z^2$ with $x$ minimal and $\gcd(x,y)=1$. Then $(y^2,z,x^2)$ satisfies $y^4+z^2=x^4$.

Case $z$ even: $(y^2,z,x^2)$ is a primitive Pythagorean triple with $y^2=s^2-t^2$, $z=2st$, $x^2=s^2+t^2$. Multiplying the first and third: $x^2y^2=s^4-t^4$, so $(xy)^2=s^4-t^4$ with $s\lt x$ — contradiction with minimality.

Case $z$ odd: then $y$ is even; write $y^2=2st$, $z=s^2-t^2$, $x^2=s^2+t^2$, and proceed similarly.

Either way we produce a smaller solution. ∎

The two cases are the two "components" of the descent, matching the two coordinates of the descent map $\delta(x,y)=(x-e_1,x-e_2)$ — a nice illustration that the classical case analysis is the cohomological computation in disguise.

? E = ellinit([0,0,0,-49,0]);
? ellrank(E)
%  [1, 1, 0, [[-24, 120]]]
? P = [-24, 120];
? \\ recover the triangle: from x,y on y^2=x^3-n^2x with n=7,
? \\ a = (x^2-n^2)/y, b = 2*n*x/y, c = (x^2+n^2)/y
? n = 7; x = P[1]; y = P[2];
? a = abs((x^2-n^2)/y); b = abs(2*n*x/y); c = abs((x^2+n^2)/y);
? [a, b, c]
%  [175/12, 24/5, 337/60]
? a*b/2
%  7
? a^2 + b^2 == c^2
%  1

The triangle $\left(\frac{24}{5},\ \frac{35}{12},\ \frac{337}{60}\right)$ — check: $\frac{24}{5}\cdot\frac{35}{12}/2=\frac{840}{120}=7$ ✓. (The exact form depends on which generator you use; any multiple of $P$ gives another triangle.)

$f=(x-1)(x-2)(x+3)$ splits, so $K\cong\mathbb{Q}\times\mathbb{Q}\times\mathbb{Q}$ and $$\delta(x,y)=\bigl(x-1,\ x-2,\ x+3\bigr)\in\bigl(\mathbb{Q}^\times/(\mathbb{Q}^\times)^2\bigr)^3,$$ subject to the product being a square (the norm condition), so really only two coordinates are free — matching $E[2]\cong(\mathbb{Z}/2)^2$.

Check on a point: $P=(-2,3)$ gives $(-3,-4,1)\equiv(-3,-1,1)$ mod squares. $Q=(-1,3)$ gives $(-2,-3,2)\equiv(-2,-3,2)$. Product for $P$: $(-3)(-1)(1)=3$, not a square?? — the norm should be $y^2=9$: $(-3)(-4)(1)=12$, and $12$ is not a square either. Let me recompute: $x=-2$, $y=3$: $x-1=-3$, $x-2=-4$, $x+3=1$; product $=12$. But $y^2=9$. Contradiction — so $f(-2)=(-2)^3-7(-2)+6=-8+14+6=12\ne9$. Indeed $(-2,3)$ is not on this curve.

? E = ellinit([0,0,0,-7,6]); ellisoncurve(E,[-2,3])
%  0
? ellratpoints(E, 20)

Lesson: always verify points lie on the curve before descending. The genuine generators come from ellrank(E)[4], and for those the norm condition holds automatically.

? f = x^3 - 2*x + 1;
? factor(f)
%  (x-1)(x^2+x-1)              \\ reducible!
? \\ take an irreducible one instead:
? g = x^3 - x - 1;
? K = bnfinit(g, 1);
? K.no, K.disc
%  1, -23
? #K.fu                        \\ number of fundamental units
%  1

$h_K=1$, one fundamental unit (signature $(1,1)$ so rank $=1+1-1=1$). Then $$\#K(S,2)=2^{\#S_K+\operatorname{rk}\mathcal{O}_K^\times+1}$$ roughly, where $S_K$ is the set of primes of $K$ above $S$. With $S=\{2,3\}$ and, say, 4 primes above them, $\#K(S,2)\approx2^{4+1+1}=64$. Descent then tests 64 candidates for local solvability — quite feasible.

For a curve with a 150-digit $\Delta$, $|S|$ could be dozens and $\operatorname{disc}(K)$ is astronomical: bnfinit would not terminate.

? E = ellinit([0,0,1,-7,6]);
? ellrank(E)
%  [3, 3, 0, [...]]
? C = ell2cover(E);
? #C
? C[1]                          \\ a quartic model  y^2 = quartic(x)
? \\ search a covering for points:
? hyperellratpoints(C[1], 100)
? \\ and map back to E -- PARI returns the maps in ellrank's output

The coverings are quartics $y^2=g(x)$ with $\deg g=4$. A point of naive height $H$ on the covering maps to a point of height roughly $H^4$ on $E$ — which is the whole reason for the exercise: searching the covering reaches points unreachable on $E$ directly. This is the mechanism generalised to 4-descent in Lesson 63.

All three groups in $0\to E(\mathbb{Q})/2E(\mathbb{Q})\to\mathrm{Sel}^{(2)}\to\text{Ш}[2]\to0$ are elementary abelian 2-groups, so they are $\mathbb{F}_2$-vector spaces and exactness gives additivity of dimensions: $$\dim\mathrm{Sel}^{(2)}=\dim\frac{E(\mathbb{Q})}{2E(\mathbb{Q})}+\dim\text{Ш}[2].$$ By Lesson 6 Exercise 0.12, $\dim\frac{E(\mathbb{Q})}{2E(\mathbb{Q})}=r+\dim E(\mathbb{Q})[2]$. Since $\dim\text{Ш}[2]\ge0$, $$r=\dim\mathrm{Sel}^{(2)}-\dim E(\mathbb{Q})[2]-\dim\text{Ш}[2]\le\dim\mathrm{Sel}^{(2)}-\dim E(\mathbb{Q})[2].\qquad\blacksquare$$

? sharp = 0; loose = 0;
? for(N=11, 600, my(v=ellsearch(N));
    for(i=1,#v, my(E=ellinit(v[i][2]), R=ellrank(E));
      if(R[1]==R[2], sharp++, loose++; if(loose<4, print(v[i][1]," ",R[1..2])))));
? [sharp, loose]

The overwhelming majority are sharp; the loose ones (571a1, 681b1, 960d1, …) have $\text{Ш}[2]\ne0$. Empirically Ш is trivial for most small-conductor curves, consistent with Bhargava–Shankar's average Selmer size of 3 (which corresponds to average rank $\le1/2$ plus small Ш).

The groups $\mathrm{Sel}^{(2)}$ and $\mathrm{Sel}^{(4)}$ measure different things: $\mathrm{Sel}^{(4)}$ sits in $0\to E(\mathbb{Q})/4E(\mathbb{Q})\to\mathrm{Sel}^{(4)}\to\text{Ш}[4]\to0$, and $\dim_{\mathbb{F}_2}$ is not the right measure since $\mathrm{Sel}^{(4)}$ is a $\mathbb{Z}/4$-module.

What 4-descent actually gives: the image of $\mathrm{Sel}^{(4)}\to\mathrm{Sel}^{(2)}$ (induced by multiplication by 2) is contained in the subgroup of classes that lift. A class of $\mathrm{Sel}^{(2)}$ that does not lift to $\mathrm{Sel}^{(4)}$ is provably in $\text{Ш}[2]$ and not in the image of $E(\mathbb{Q})$. So the bound $$r\le\dim\bigl(\text{image of }\mathrm{Sel}^{(4)}\text{ in }\mathrm{Sel}^{(2)}\bigr)-\dim E(\mathbb{Q})[2]$$ can be strictly better. That is the mechanism of Lesson 63.

? for(N=11, 700, my(v = ellsearch(N));
    for(i=1, min(2,#v),
      my(E = ellinit(v[i][2]), s = shaan(E));
      if(abs(s - round(s)) < 0.01 && round(s) > 1,
         print(v[i][1], "  Sha ~ ", round(s), "  square? ", issquare(round(s))))));

Every value found is 1, 4, 9, 16, … ✓. Finding a non-square would disprove either BSD or Cassels' theorem — and would be a sensational (and almost certainly erroneous) result. In practice such an output means your regulator has an index problem: unsaturated generators inflate $\operatorname{Reg}$ by $k^2$ and deflate the apparent $\#\text{Ш}$ by $k^2$.

The gap is $\dim_{\mathbb{F}_2}\text{Ш}[2]$. If $\text{Ш}[2^\infty]$ is finite, Cassels gives a nondegenerate alternating form on it, hence on $\text{Ш}[2]$ (which is the $\mathbb{F}_2$-space where the induced form lives). A nondegenerate alternating form on an $\mathbb{F}_2$-vector space exists only in even dimension (it is a symplectic form; symplectic spaces have even dimension). Hence $\dim\text{Ш}[2]$ is even ✓. ∎

Caveat: this argument assumes $\text{Ш}[2^\infty]$ is finite — which is not known in general. So an odd gap is not logically impossible; it would just imply Ш is infinite, which nobody expects.

By definition. The classic explicit example is Lind's / Reichardt's curve $$C:\quad 2v^2=u^4-17w^4.$$ Locally solvable everywhere (checked prime by prime; the only delicate primes are 2 and 17) but with no rational point. Its Jacobian is $y^2=x^3+17x$.

? \\ empirical search finds nothing:
? found = 0;
? for(u=1,300, for(w=1,300, if(gcd(u,w)==1 && issquare((u^4-17*w^4)/2), found++)));
? found
%  0
? E = ellinit([0,0,0,17,0]);
? ellrank(E)
%  [1, 1, 0, [...]]

The curve $C$ represents a nonzero element of $\text{Ш}(E/\mathbb{Q})[2]$, so the 2-Selmer bound for $E$ exceeds its rank by at least 1 (in fact by 2, by Cassels).

{
  for(a = -20, 20,
    for(b = -20, 20,
      if(4*a^3 + 27*b^2 != 0,
         my(E = ellinit([0,0,0,a,b]), R);
         if(type(E) == "t_VEC",
            R = ellrank(E);
            if(R[1] >= 3, print([a,b], "  rank ", R[1..2]))))));
}

You will find several, including $[-7,6]$ (rank 3). Rank 4 in this small box is rare; rank 5 essentially absent. That scarcity is the empirical version of "high rank requires structure, not brute force" — which is why Phase 7 builds families rather than enumerating.

? F = ellinit([0,0,1,-79,342]);
? R = ellrank(F)
%  [2, 4, 0, [...]]
? C = ell2cover(F);
? for(i=1,#C, my(P = hyperellratpoints(C[i], 10^5));
    if(#P, print(i, " points found: ", P[1])));
? ellanalyticrank(F)
%  [2, ...]

The analytic rank is 2, matching the lower bound. Under BSD the rank is 2 and $\dim\text{Ш}[2]=2$, i.e. $\#\text{Ш}\ge4$. Searching the coverings finds no new points, consistent with the extra Selmer classes being genuine Ш elements rather than undiscovered points.

Unconditional resolution would need 4-descent to show those two classes do not lift.

? for(k = 2, 14,
    my(a = -(10^k+3), b = 10^k+7, E, t);
    if(4*a^3+27*b^2,
       E = ellinit([0,0,0,a,b]);
       t = getabstime();
       ellrank(E);
       print(k, "  ", (getabstime()-t)/1000.0, " s")));

Times grow rapidly once $\Delta$ has more than ~25–30 digits, because bnfinit on the cubic field dominates and its cost is subexponential in $\log|\operatorname{disc}|$. Somewhere around $10^{15}$–$10^{20}$ coefficients it becomes impractical on a laptop.

Compare: the rank-30 record curve has ~150-digit coefficients. Descent is off the table by roughly a hundred orders of magnitude — the reason Phase 6's analytic route is not a stylistic choice but a necessity.

? E = ellinit([0,0,0,-7,6]);
? C = ell2cover(E);
? P = hyperellratpoints(C[1], 1000);
? \\ the map back to E is part of ellrank's data; compare heights:
? \\ heuristically:
? G = ellrank(E)[4];
? apply(Q -> ellheight(E,Q), G)

The general principle: a covering point with $x$-coordinate of $k$ digits corresponds to an $E$-point with roughly $4k$ digits (for a 2-covering, which is a degree-4 model). So to reach an $E$-point with 200 digits you search a covering for 50-digit points — still hard, but $10^{150}$ times easier. That factor is exactly why record curves are findable.

A raw quadric-intersection model from 4-descent typically has coefficients of size comparable to $\Delta_E$ — say $10^{50}$ for a moderate curve. Searching such a model for points of height $B$ costs $\sim B^2$ operations but requires arithmetic on $10^{50}$-sized integers, and worse, the point of smallest height on the badly-scaled model may itself be huge.

After minimisation and LLL reduction the coefficients drop to $O(\Delta^{1/12})$ or better — for our example, to $10^4$ — and the smallest point comes down correspondingly. Cremona–Fisher–Stoll report reductions of many orders of magnitude. Without it, "search the 4-covering" is a search over a space you cannot enumerate.

3-descent works with $E[3]$, which has $\#(E[3]\setminus0)=8$ points. The descent map lands in $H^1(G_\mathbb{Q},E[3])$, and making it explicit requires the algebra $$K=\mathbb{Q}[E[3]\setminus0]/\pm = \text{the étale algebra of the 4 cyclic subgroups of order 3},$$ of dimension 4, or in the Schaefer–Stoll formulation the algebra of dimension 8 corresponding to the 8 nonzero 3-torsion points.

Either way, computing class groups and units of a degree-4 or degree-8 field is far more expensive than the degree-3 case of 2-descent. That is why 3-descent, though it can be more effective for certain curves (particularly those with 3-isogenies), is used much less than 2- and 4-descent.

An algorithm must terminate with the correct answer. The search will eventually find a full set of generators (since $E(\mathbb{Q})$ is finitely generated and Northcott guarantees a search of any height bound terminates), but at no finite moment do you know you have finished: there is no computable function $B(E)$ known to bound the height of a generating set.

An effective height bound for generators would immediately give a rank algorithm. Such bounds exist conditionally (on BSD, via the regulator, or on ABC-type conjectures) but not unconditionally. ∎

Suppose $\#\text{Ш}(E/\mathbb{Q})=M\lt\infty$. Pick a prime $p$ and $n$ with $p^n\gt M$. Then $\text{Ш}[p^n]=\text{Ш}[p^\infty]$ is all of the $p$-part, and moreover the image of $\text{Ш}$ under multiplication by $p^n$ is trivial, so the natural map $$\mathrm{Sel}^{(p^n)}\longrightarrow\text{Ш}[p^n]$$ has an image whose contribution to the dimension count is exactly $\dim\text{Ш}[p^n]$, a known finite quantity once you have descended far enough to see it. More usefully: the descent bounds $$r\le\frac{\log\#\mathrm{Sel}^{(p^n)}}{n\log p}-(\text{torsion term})$$ converge to $r$ as $n\to\infty$, because the Ш contribution is bounded by $\log M$ and is divided by $n\log p$. Meanwhile the point search reaches $r$ from below. So the two meet in finite time. ∎

? E = ellinit(ellsearch(571)[1][2]);
? ellrank(E)
%  [0, 2, 1, []]
? ellanalyticrank(E)
%  [0, ...]
? ellrootno(E)
%  1

The analytic rank is 0. By Kolyvagin (with $r_{\text{an}}=0\le1$), the rank is 0 unconditionally and Ш is finite. Combined with the 2-Selmer bound of 2, we get $\dim\text{Ш}[2]=2$, so $4\mid\#\text{Ш}$ — and the analytic order computation gives exactly 4.

So for this curve everything is unconditional, courtesy of $r_{\text{an}}\le1$. Had the analytic rank been 2, nothing would be known unconditionally: we would have a point-free lower bound of 0 and a Selmer bound of 2, with no way to decide.

For $\operatorname{Re}(s)\gt1$, expand each factor as a geometric series: $$\prod_p\bigl(1-p^{-s}\bigr)^{-1}=\prod_p\Bigl(1+p^{-s}+p^{-2s}+\cdots\Bigr).$$ Multiplying out, a term is $\prod_ip_i^{-e_is}=n^{-s}$ where $n=\prod p_i^{e_i}$. By unique factorisation each $n\ge1$ arises exactly once. Absolute convergence justifies the rearrangement. ∎

Write $1-a_pX+pX^2=(1-\alpha X)(1-\beta X)$ with $|\alpha|=|\beta|=\sqrt p$. Then $a_{p^k}=\frac{\alpha^{k+1}-\beta^{k+1}}{\alpha-\beta}=\sum_{j=0}^k\alpha^j\beta^{k-j}$, so $$|a_{p^k}|\le(k+1)p^{k/2}=d(p^k)\sqrt{p^k}.$$ By multiplicativity of both $a$ and $d$, $|a_n|\le d(n)\sqrt n$ ✓. ∎

Since $d(n)=O(n^\epsilon)$, this gives $|a_n|=O(n^{1/2+\epsilon})$ and absolute convergence of $L(E,s)$ for $\operatorname{Re}(s)\gt3/2$.

$$\int_0^\infty\Bigl(\sum_n a_ne^{-2\pi ny}\Bigr)y^{s-1}dy=\sum_na_n\int_0^\infty e^{-2\pi ny}y^{s-1}dy.$$ Substitute $u=2\pi ny$, $dy=du/(2\pi n)$: $$\int_0^\infty e^{-u}\left(\frac{u}{2\pi n}\right)^{s-1}\frac{du}{2\pi n}=(2\pi n)^{-s}\Gamma(s).$$ Summing gives $(2\pi)^{-s}\Gamma(s)\sum a_nn^{-s}$ ✓. Interchange is justified by absolute convergence. ∎

? E = ellminimalmodel(ellinit([0,0,0,0,1]));
? ellglobalred(E)[1]
%  36 = 2^2 * 3^2
? [ellap(E,2), ellap(E,3)]
%  [0, 0]

Both 2 and 3 have additive reduction (conductor exponent 2 each), so $a_2=a_3=0$ and $L_2=L_3=1$. The Euler product for this curve therefore omits 2 and 3 entirely.

This matters for the Mestre–Nagao sum too: additive primes contribute nothing, so a curve with many additive primes has fewer usable terms.

$L_p(E,s)=(1-p^{-s})^{-1}$, so at $s=1$: $L_p(E,1)=(1-1/p)^{-1}=\frac{p}{p-1}$.

Compare a good prime: $L_p(E,1)=(1-a_p/p+1/p)^{-1}=\frac{p}{p+1-a_p}=\frac{p}{\#\tilde E(\mathbb{F}_p)}$.

So uniformly $L_p(E,1)=p/\#\tilde E^{\text{ns}}(\mathbb{F}_p)$, and the BSD heuristic $\text{“}L(E,1)\text{”}=\prod_p p/\#\tilde E(\mathbb{F}_p)$ of Lesson 67 holds with the bad primes included in the natural way ✓.

$a_5=0$ (Lesson 26 Ex 2.15). So $Z=\frac{1+5T^2}{(1-T)(1-5T)}$ and $\alpha,\beta=\pm i\sqrt5$.

$s_n=\alpha^n+\beta^n$: $s_1=0$, $s_2=-10$, $s_3=0$. So $\#E(\mathbb{F}_5)=6$, $\#E(\mathbb{F}_{25})=25+1+10=36$, $\#E(\mathbb{F}_{125})=126$.

? ellcard(ellinit([0,0,0,0,1], 5))
%  6
? ellcard(ellinit([0,0,0,0,1], ffgen(5^2)))
%  36
? ellcard(ellinit([0,0,0,0,1], ffgen(5^3)))
%  126

✓ Matches. Note $36=6^2$, the supersingular pattern.

$\sum_{k\ge0}a_{p^k}X^k=(1-a_pX+pX^2)^{-1}$. Multiplying both sides by $1-a_pX+pX^2$ and comparing the coefficient of $X^{k+1}$ for $k\ge1$: $$a_{p^{k+1}}-a_pa_{p^k}+p\,a_{p^{k-1}}=0\ \Longrightarrow\ a_{p^{k+1}}=a_pa_{p^k}-p\,a_{p^{k-1}}\ ✓.$$ The coefficient of $X^1$ gives $a_p-a_p=0$ ✓ and of $X^0$ gives $a_1=1$ ✓. ∎

$a_4=a_2^2-2\cdot1=4-2=2$. $a_8=a_2a_4-2a_2=(-2)(2)-2(-2)=-4+4=0$.

$a_{12}=a_4a_3=2\cdot(-1)=-2$ (coprime, so multiplicative).

? v = ellan(ellinit([0,-1,1,-10,-20]), 12);
? [v[8], v[12]]
%  [0, -2]

✓ Both match.

? E = ellinit([0,1,1,-2,0]);          \\ 389a1, the smallest rank-2 curve
? ellrank(E)[1..2]
%  [2, 2]
? for(k=2,6, my(X=10^k); print([log(log(X)), bsdplot(E,X)]))

Fitting a line to $\bigl(\log\log X,\ \log\prod_{p\le X}\#\tilde E(\mathbb{F}_p)/p\bigr)$ gives a slope near 2. The convergence is slow (the error term is $O(1/\log X)$-ish), so you need $X\sim10^6$ for a convincing fit — which is exactly why practical Mestre–Nagao sieving uses relative comparison across many curves at fixed small $X$ rather than absolute slope estimation.

? for(N=1,12, print(N, " ", mfdim(mfinit([N,2],1))))
1 0
2 0
...
10 0
11 1
12 0

Zero for all $N\le10$. By modularity, an elliptic curve of conductor $N$ gives a nonzero cusp form of weight 2 and level $N$. Hence there is no elliptic curve over $\mathbb{Q}$ of conductor $\lt11$ — a theorem of Tate and Ogg, here recovered as a dimension count. ✓

For $\gamma\tau=\frac{a\tau+b}{c\tau+d}$ with $ad-bc=1$, $$\frac{d(\gamma\tau)}{d\tau}=\frac{a(c\tau+d)-c(a\tau+b)}{(c\tau+d)^2}=\frac{ad-bc}{(c\tau+d)^2}=\frac{1}{(c\tau+d)^2}.$$ So $$f(\gamma\tau)\,d(\gamma\tau)=(c\tau+d)^2f(\tau)\cdot\frac{d\tau}{(c\tau+d)^2}=f(\tau)\,d\tau\ ✓.\qquad\blacksquare$$

Weight $k$ would give $(c\tau+d)^{k-2}f(\tau)d\tau$, invariant only for $k=2$. That is why weight 2 is singled out for elliptic curves: it is the weight at which modular forms are differentials.

? for(N=11,50, my(d = mfdim(mfinit([N,2],1))); if(d >= 2, print(N, " ", d)))
? \\ compare with the number of isogeny classes of conductor N:
? for(N=11,50, my(v = ellsearch(N), classes = Set(apply(c -> c[1][1..#c[1]-1], v)));
     print(N, " ", #classes))

$\dim S_2(\Gamma_0(N))$ counts all newforms of level $N$ plus oldforms from lower levels. The number of $\mathbb{Q}$-isogeny classes of conductor exactly $N$ equals the number of rational newforms of level $N$ — those with all $a_n\in\mathbb{Z}$. Newforms with irrational coefficients correspond to higher-dimensional abelian varieties, not elliptic curves. That is the precise content of modularity.

$T_pf=\sum_m(c_{pm}+p^{k-1}c_{m/p})q^m$. The coefficient of $q^1$ is $c_p+p^{k-1}c_{1/p}=c_p$ (since $p\nmid1$). If $T_pf=\lambda_pf$ then the coefficient of $q^1$ on the right is $\lambda_pc_1=\lambda_p$ (normalised). Hence $\lambda_p=c_p$ ✓. ∎

? for(N=11, 60,
    my(mf = mfinit([N,2],0), B = mfeigenbasis(mf));
    for(i=1,#B, my(c = mfcoefs(B[i], 5));
      if(type(c[3]) != "t_INT", print(N, " ", c))));
23 [0, 1, Mod(x, x^2-x-1), ...]

At $N=23$ there is a newform with coefficients in $\mathbb{Q}(\sqrt5)$. It corresponds not to an elliptic curve but to a 2-dimensional abelian variety (the Jacobian $J_0(23)$, which is simple of dimension 2 with real multiplication by $\mathbb{Z}[\frac{1+\sqrt5}{2}]$).

Indeed ellsearch(23) returns nothing: there is no elliptic curve of conductor 23. ✓ Modularity is a bijection between rational newforms and isogeny classes of elliptic curves, not between all newforms and curves.

If $f(\tau)=\sum c_nq^n$ has level $N$, then $g(\tau)=f(2\tau)=\sum c_nq^{2n}$ has level $2N$. Its coefficients are $b_m=c_{m/2}$ for $2\mid m$ and 0 otherwise — so $b_p=0$ for odd $p$, not $c_p$. So $g$ is not an eigenform with the same eigenvalues.

However the 2-dimensional space $\langle f(\tau),f(2\tau)\rangle$ inside $S_2(\Gamma_0(2N))$ is stable under $T_p$ for $p\nmid2N$, and $T_p$ acts on it with the single eigenvalue $c_p$ (twice). So the "old" eigenvalues at good primes agree with the level-$N$ ones ✓. That is exactly why the new subspace must be separated out: otherwise every level would inherit all lower-level eigenvalue systems.

{ for(N = 11, 40,
    my(v = ellsearch(N));
    if(#v,
      my(mf = mfinit([N,2],0), B = mfeigenbasis(mf), classes = Set());
      for(i = 1, #v,
        my(E = ellinit(v[i][2]), an = ellan(E, 12));
        for(j = 1, #B,
          if(mfcoefs(B[j],12)[2..13] == an,
             classes = setunion(classes, Set([j])))));
      print(N, "  curves:", #v, "  newforms:", #B, "  matched:", #classes)));
}

Every conductor with curves has exactly as many rational newforms as isogeny classes ✓. Conductors like 23, 29, 31 with irrational newforms and no curves confirm the other direction.

$E:y^2=x(x-a^5)(x+b^5)$ with $\gcd(a,b)=1$. Then $c_4=16(a^{10}+a^5b^5+b^{10})$ and $$\Delta=16\,a^{10}b^{10}(a^5+b^5)^2=16(abc)^{10}.$$ After minimalising (Frey normalised $a\equiv-1\bmod4$, $b$ even), $\Delta_{\min}=2^{-8}(abc)^{10}$ and $N=\prod_{\ell\mid abc}\ell$: squarefree, hence semistable.

Then $\bar\rho_{E,5}$ is unramified outside 5 and modular of level $N$; Ribet lowers the level to 2, and $S_2(\Gamma_0(2))=0$. ∎

? \\ toy: a=3,b=4 (not a solution, but shows the shape)
? E = ellminimalmodel(ellinit([0, 4^5 - 3^5, 0, -3^5*4^5, 0]));
? issquarefree(ellglobalred(E)[1])
%  1                              \\ semistable

? for(N=11, 60, my(v = ellsearch(N));
    for(i=1, min(1,#v),
      my(E = ellinit(v[i][2]));
      print(N, "  ", v[i][1], "  degree ", ellmoddegree(E))))
11  11a1  1
14  14a1  1
15  15a1  1
17  17a1  1
19  19a1  1
20  20a1  2
21  21a1  2
...
37  37a1  2
389 389a1 40

The modular degree grows roughly like $N^{1+\epsilon}$ (conjecturally $N^{7/6+\epsilon}$, by Watkins). It bounds the height of Heegner points and appears in the "degree conjecture" relating it to $\#\text{Ш}$ and the congruence number. For record curves with $N$ enormous, the modular degree is astronomically large — another reason $X_0(N)$-based methods are unavailable there.

{ my(bad = 0);
  for(N = 11, 100,
    my(v = ellsearch(N));
    for(i = 1, #v,
      my(E = ellinit(v[i][2]), r = ellrank(E)[1], w = ellrootno(E));
      if((-1)^r != w, bad++; print("FAIL ", v[i][1]))));
  print("failures: ", bad);
}
failures: 0

No failures ✓. (Note the test uses the lower rank bound; for these small curves the bounds coincide.) The parity conjecture is known in many cases — for instance Dokchitser–Dokchitser proved the $p$-parity conjecture for all elliptic curves over $\mathbb{Q}$ — but the full BSD parity statement is still open in general.

? a = -(10^40 + 7); b = 10^40 + 3;
? E = ellminimalmodel(ellinit([0,0,0,a,b]));
? t = getabstime(); w = ellrootno(E); (getabstime()-t)/1000.0
? w

The bottleneck is factoring the conductor (needed to enumerate bad primes), not the root-number computation itself. If $\Delta$ has a hard-to-factor part this can stall — which is a real issue for record curves. In practice one records the factorisation at construction time, since the discriminant of a specialised family factors by construction.

Once the bad primes are known, the local root numbers cost microseconds each, regardless of how large $N$ is. Contrast ellanalyticrank on the same curve: it will not finish.

Suppose $r_{\text{an}}\le31$ (Bober, under GRH) and $w=+1$. By the parity relation $w=(-1)^{r_{\text{an}}}$, $r_{\text{an}}$ is even, hence $r_{\text{an}}\le30$.

Under BSD, $r=r_{\text{an}}\le30$. And unconditionally $r\ge30$ from the thirty independent points. Therefore $r=30$ ✓.

Note the parity step is doing real work: without it the bound would be 31 and the rank would be pinned only to $\{30,31\}$. This is exactly the argument used for the 2026 record. ∎

{ for(N = 11, 200,
    my(v = ellsearch(N));
    for(i = 1, #v,
      my(E = ellinit(v[i][2]), w = ellrootno(E), L = abs(elllseries(E,1)));
      if(w == -1 && L > 1e-20, print("unexpected nonzero ", v[i][1]));
      if(w ==  1 && L < 1e-20, print("rank >= 2: ", v[i][1]))));
}

Every $w=-1$ curve has $L(E,1)=0$ ✓ (forced by the functional equation). Curves with $w=+1$ and $L(E,1)=0$ have analytic rank $\ge2$ — the first is 389a1, and they are comparatively rare among small conductors.

? \p 40
? E = ellinit([0,1,1,-2,0]);              \\ 389a1
? r = ellanalyticrank(E)
%  [2, 0.7594...]
? G = ellrank(E)[4]; #G
%  2
? Reg = matdet(ellheightmatrix(E, G))
? Om  = E.omega[1] * if(E.disc > 0, 2, 1)
? tam = ellglobalred(E)[3]
? tors = elltors(E)[1]
? sha = r[2] * tors^2 / (Om * Reg * tam)
%  1.0000000000...

$\#\text{Ш}=1$ ✓, a perfect square (trivially). Try 571a1 for $\#\text{Ш}=4$, and 2充... the standard first examples with $\#\text{Ш}=4$ are 571a1 and 681b1.

Cost $\approx C\sqrt N$ coefficient computations, each an ellap. With $\sim10^6$ ellap calls per second and a one-hour budget, that is $3.6\times10^9$ coefficients, so $$\sqrt N\lesssim3.6\times10^9\ \Longrightarrow\ N\lesssim10^{19}.$$ Empirically PARI manages $N\sim10^{14}$–$10^{16}$ comfortably and $10^{18}$ with patience.

Since the rank-30 curve has $N$ with dozens of digits, we are short by a factor of roughly $10^{40}$ in the number of terms. Hence Lesson 76.

{ my(t = Map());
  for(N = 11, 300,
    my(v = ellsearch(N));
    for(i = 1, #v,
      my(E = ellinit(v[i][2]), s = bsdcheck(E));
      if(type(s) != "t_STR" && abs(s - round(s)) < 0.01,
         my(k = round(s));
         mapput(t, k, if(mapisdefined(t,k), mapget(t,k), 0) + 1))));
  print(Vec(t));
}

Almost all values are 1; a handful are 4. No non-squares appear. This distribution matches the Delaunay heuristics, which predict that $\text{Ш}$ is trivial for a positive proportion of curves and that large Ш is rare.

If your points generate an index-$k$ subgroup, $\operatorname{Reg}_{\text{computed}}=k^2\operatorname{Reg}(E)$ (Lesson 52 Ex 4.28). Since $\operatorname{Reg}$ is in the denominator, the computed $\#\text{Ш}$ is $\#\text{Ш}_{\text{true}}/k^2$ — typically not an integer at all.

Detection: if bsdcheck returns something like $0.25$ or $0.111$, you have index 2 or 3. Multiply by $k^2$ for the plausible $k$ and see which gives a perfect square integer; then saturate at that prime.

? E = ellinit([0,0,1,-7,6]);
? G = ellrank(E)[4];
? G2 = [ellmul(E,G[1],2), G[2], G[3]];      \\ index 2
? \\ recompute with G2 -- the "Sha" comes out 1/4

BSD contributes: the conversion $r_{\text{an}}\ge r$. Bober's method bounds $r_{\text{an}}$; without BSD that bound says nothing about the Mordell–Weil rank.

If BSD were false: the lower bound $r\ge30$ survives untouched — it is 30 explicit points and a determinant. What collapses is the ceiling. The curve would still hold the record for "largest proven rank lower bound", and it would still be the largest known.

Also note GRH is needed independently, for the explicit formula step (Lesson 76). Failure of GRH would likewise remove only the ceiling.

{ for(N = 37, 200,
    my(v = ellsearch(N));
    for(i = 1, #v,
      my(E = ellinit(v[i][2]));
      if(ellrootno(E) == -1 && ellrank(E)[2] == 1,
         my(P = ellheegner(E), G = ellrank(E)[4]);
         print(v[i][1], "  heegner:", P, "  descent:", if(#G, G[1], "-")))));
}

The two agree up to sign and up to a multiple: the Heegner point generates a subgroup of index equal to the "Heegner index", which by Gross–Zagier–Kolyvagin is related to $\#\text{Ш}$. Where they differ by a factor $k$, expect $\#\text{Ш}=k^2$.

? \p 200
? \\ curves with large Heegner points -- try a large-conductor rank-1 curve:
? E = ellinit([0, 0, 1, -79, 342]);
? \\ or construct one: quadratic twists of a rank-1 curve often have big generators
? E0 = ellinit([0,0,1,-1,0]);
? for(d = 2, 40, if(issquarefree(d),
    my(Ed = ellinit(elltwist(E0, d)));
    if(ellrank(Ed)[2] == 1 && ellrootno(Ed) == -1,
       my(P = ellheegner(Ed));
       print(d, "  height ", ellheight(Ed, P)))));

Twists with larger $d$ have generators of rapidly growing height (by Gross–Zagier, $\hat h(P_d)$ grows with $L'(E_d,1)$ and with $\sqrt d$). Beyond $\hat h\approx40$ direct search fails while ellheegner keeps working — provided you raise \p enough. That is the practical value of the analytic method.

The Selmer group is bounded by a local-global duality argument: each Kolyvagin class $c_n$ imposes a linear condition on $\mathrm{Sel}$, killing (at most) one dimension per "direction" available in the system. The Heegner-point Euler system has a single generator (the point $P_K$), so the derived classes all live in the line it spans; the argument bounds $\mathrm{Sel}/\langle P_K\rangle$ but cannot say anything about a second independent direction.

To bound a rank-2 Selmer group one would need a rank-2 Euler system — a family of surfaces of CM points, or a genuinely new construction. Skinner–Urban and Iwasawa-theoretic methods give partial results, but the rank-$\ge2$ case of BSD remains completely open. ∎

$b_p=a_p/\sqrt p$ and Hasse gives $|a_p|\le2\sqrt p$, so $|b_p|\le2$ ✓.

Equivalently, the Satake parameters $\alpha_p,\beta_p=e^{\pm i\theta_p}$ lie on the unit circle, so $b_p=2\cos\theta_p\in[-2,2]$. This uniform bound is what makes the prime sum in the explicit formula converge and be estimable.

In the analytic normalisation the central point is $s=0$, i.e. $\gamma=0$. By definition $r_{\text{an}}=\operatorname{ord}_{s=0}L^{\text{an}}(E,s)$, so $\gamma=0$ occurs with multiplicity $r_{\text{an}}$ in the list of zeros. Each contributes $F(0)=1$. So the central zeros alone give $r_{\text{an}}$ ✓.

Since $F\ge0$ and all other $\gamma$ are real under GRH, $\sum_\gamma F(\gamma)\ge r_{\text{an}}$, and the explicit formula's right-hand side is therefore an upper bound for $r_{\text{an}}$ ✓. That single inequality is the whole method. ∎

{ for(k = 1, 6,
    my(d = 10^k, E);
    \\ quadratic twists keep the rank pattern but raise N
    E = ellinit(elltwist(ellinit([0,0,1,-7,6]), d));
    if(type(E) == "t_VEC",
       E = ellminimalmodel(E);
       print(sizedigit(ellglobalred(E)[1]), " digits  bound ",
             efbound(E, 3.0))));
}

The bound grows roughly linearly in $\log N$, i.e. linearly in the number of digits of $N$. For a curve with a 100-digit conductor, even an optimal $\Delta$ leaves a bound of a few dozen. That is why the rank-30 certification produces 31 and needs parity to close: the method's resolution is simply not finer than $\pm1$ at that conductor.

? for(k = 1, 4, my(D = [3, 4, 4.25, 5][k]);
    print(D, "  e^(2 pi D) = ", exp(2*Pi*D)))
3     1.5e8
4     7.9e10
4.25  4.2e11
5     1.6e13

$\Delta=3$: $1.5\times10^8$ primes — minutes on a laptop. $\Delta=4.25$: $4\times10^{11}$ — a serious but achievable computation with a fast sieve for $a_p$ (hours to days on a cluster). $\Delta=5$: $1.6\times10^{13}$ — expensive but not impossible. Beyond that the returns diminish since the main term grows linearly in $\Delta$ while the prime sum's benefit saturates.

The $k=2$ contribution involves $\alpha_p^2+\beta_p^2=b_p^2-2$ in the analytic normalisation, i.e. $(a_p^2-2p)/p$. Under Sato–Tate, $b_p=2\cos\theta_p$ with density $\frac2\pi\sin^2\theta$, so $$\mathbb{E}[b_p^2]=\frac2\pi\int_0^\pi4\cos^2\theta\sin^2\theta\,d\theta=1.$$ Hence $\mathbb{E}[b_p^2-2]=-1$: a systematic negative average.

Since the prime sum enters the bound with a minus sign, a negative sum increases... careful with signs: the bound is $\text{main}-\frac1\pi\sum(\ldots)$, and the $k=2$ terms enter the sum with average $-1$, so $-\frac1\pi\sum$ picks up a positive... The net effect in Bober's formulation is that the $k=2$ terms contribute a term comparable to $-\hat f(0)$ times a constant, improving (lowering) the bound by roughly one unit. Empirically that is exactly what implementations report. ✓

The moral is that the $k\ge2$ terms are not a correction to be discarded — they are worth about a full unit of rank, which at the margin is the difference between 31 and 30.

? \\ Elkies-Klagsbrun rank-20 curve coefficients are large; use the toy bound
? \\ on a smaller high-rank curve to see the mechanism:
? E = ellinit([0, 0, 1, -79, 342]);       \\ rank 2 or so
? for(D = 1, 5, print(D, "  ", efbound(E, D)))
? ellrootno(E)
? ellanalyticrank(E)[1]

You will see the bound bottom out at some $\Delta$, and the floor of that minimum, adjusted for parity, should match the true analytic rank or exceed it by 1. Scaling this up: for a 150-digit-coefficient curve the $\log N$ term is roughly 40× larger, pushing the minimum bound from ~3 to ~31 — exactly the observed behaviour. The method is unchanged; only the conductor's size degrades the answer.

{ my(best = 0, bc = 0);
  for(a = -100, 100, for(b = -100, 100,
    if(4*a^3 + 27*b^2,
       my(E = ellinit([0,0,0,a,b]));
       if(type(E) == "t_VEC",
          my(r = ellrank(E)[1]);
          if(r > best, best = r; bc = [a,b]; print(r, " ", bc))))));
}

You will reach rank 4 or 5 in this box. Empirically the maximum rank in a box of size $B$ grows like $\log B$ at best — so to reach rank 30 by brute force you would need $B$ around $e^{30/c}$ for some small $c$, i.e. astronomically large. This is the empirical statement that high rank requires structure.

? \\ Tate normal form for 5-torsion (Lesson 42 Ex 3.26):
? f(t) = ellinit([1-t, -t, -t, 0, 0]);
? { my(best = 0);
    for(n = -60, 60,
      my(E = f(n));
      if(type(E) == "t_VEC",
         my(r = ellrank(E)[1]);
         if(r > best, best = r; print(n, "  rank ", r)))); }

You will see ranks up to 2 or 3 in this one-parameter family. The record for $\mathbb{Z}/5$ torsion is around 8–9, found by imposing conditions on multi-parameter families — much harder than the trivial-torsion case, because the 5-torsion condition consumes a parameter and the associated surface has a reducible fibre structure that eats rank via Shioda–Tate (Lesson 80).

2000–2006 and 2006–2024 are the long gaps. In the first, the Martin–McMillen rank-24 curve stood while people scaled up sieving without new families. In the second, Elkies' rank-28 stood for eighteen years.

What broke each gap: Elkies (2006) brought in K3 elliptic surfaces of maximal Picard number, raising the generic rank ceiling from 8 to 18 (Lesson 81–82). Elkies–Klagsbrun (2024) and Alpöge–Howell (2026) refined the sieve and the point-search side.

Reading: Dujella's tables at web.math.pmf.unizg.hr/~duje/tors/rankhist.html are the canonical reference and are kept current.

? E = ellinit([0,0,0,t,1]);
? E.disc
%  -64*t^3 - 432
? poldegree(E.disc)
%  3

$\deg\Delta=3$, which is not a multiple of 12 — so this model is not relatively minimal as written; the surface needs a base change or the model needs adjusting at $t=\infty$. Taking the correct minimal model over $\mathbb{P}^1$ (accounting for the fibre at $t=\infty$) gives $\chi=1$: a rational elliptic surface.

Rule of thumb: $\chi=\lceil\max_i(\deg a_i/i)\rceil$. Here $\deg a_4=1$ so $1/4$, $\deg a_6=0$; hence $\chi=1$ ✓.

? D = -64*t^3 - 432;
? factor(D)
%  -16 * (4*t^3 + 27)
? polisirreducible(4*t^3 + 27)
%  1                              \\ irreducible over Q
? \\ over Qbar: three distinct roots, each simple
? poldisc(4*t^3 + 27) != 0
%  1

Three simple roots of $\Delta$ over $\overline{\mathbb{Q}}$, so three fibres of type $\mathrm{I}_1$ (nodal, $m_v=1$). Plus a fibre at $t=\infty$: since $\deg\Delta=3$ and a rational elliptic surface needs $\deg\Delta=12$ counting $\infty$, the fibre at infinity has $v_\infty(\Delta)=9$, giving type $\mathrm{III}^*$ ($m_v=8$).

Shioda–Tate (Lesson 80) then predicts generic rank $=8-(8-1)-3\cdot0=1$. The $\mathrm{III}^*$ fibre eats 7 of the 8 available units.

Take $\mathcal{E}=E_0\times_k\mathbb{P}^1$ for a fixed $E_0/k$ with $k=\overline{\mathbb{Q}}$. Then $\mathcal{E}(k(t))\supseteq E_0(k)=E_0(\overline{\mathbb{Q}})$, which is a divisible group of infinite rank (every point is divisible by every $n$). Not finitely generated ✓.

Lang–Néron's correct statement handles this: $\mathcal{E}(K)/\mathcal{E}_0(k)$ is finitely generated, where $\mathcal{E}_0$ is the $k/K$-trace. For non-constant $\mathcal{E}$ the trace is 0 and one gets outright finite generation. In practice we always work with non-constant families, so this is a footnote — but it explains why "non-isotrivial" appears in every statement.

$h^{1,1}=10\chi-2$.

$\chi=1$: $h^{1,1}=8$. But for a rational elliptic surface $\rho=h^{1,1}+2=10$ exactly (it is $\mathbb{P}^2$ blown up at 9 points, so $\rho=1+9=10$). Shioda–Tate: generic rank $=10-2-\sum(m_v-1)\le8$.

$\chi=2$ (K3): $h^{1,1}=18$, but $h^{1,1}(\text{K3})=20$. Indeed for K3, $b_2=22$ and $h^{2,0}=h^{0,2}=1$, so $h^{1,1}=20$ and $\rho\le20$ in characteristic 0. Shioda–Tate: generic rank $\le20-2=18$ ✓.

(The formula $h^{1,1}=10\chi-2$ is the correct one for elliptic surfaces once $b_2=12\chi-2$ and $h^{2,0}=\chi-1$ are accounted: $h^{1,1}=b_2-2h^{2,0}=12\chi-2-2(\chi-1)=10\chi$. For K3, $\chi=2$ gives 20 ✓; for rational, $\chi=1$ gives 10 ✓.)

$\deg\Delta=12$ must equal $\sum v(\Delta)=2+3+7=12$ ✓, consistent.

Costs: $(2-1)+(3-1)+(7-1)=1+2+6=9$. But the budget is only 8. Contradiction — so this fibre configuration cannot occur on a rational elliptic surface with a section, or the surface would have negative rank.

In fact Persson and Miranda classified all possible fibre configurations on rational elliptic surfaces; $\{\mathrm{I}_2,\mathrm{I}_3,\mathrm{I}_7\}$ is not among them. A valid example: $\{\mathrm{I}_2,\mathrm{I}_2,\mathrm{I}_8\}$ costs $1+1+7=9$ — also too much. $\{\mathrm{I}_1^{\times12}\}$ costs 0, giving rank 8 ✓, the maximum.

From Ex 7.5: fibres are three $\mathrm{I}_1$ (cost 0 each) and one $\mathrm{III}^*$ at $\infty$ (cost 7). Rational elliptic surface, $\rho=10$.

Shioda–Tate: generic rank $=10-2-7=1$.

? \\ test by specialising and looking for a persistent point:
? for(n = 1, 12, my(E = ellinit([0,0,0,n,1]));
    if(type(E)=="t_VEC", print(n, "  rank ", ellrank(E)[1])))

Most specialisations have rank $\ge1$, consistent with generic rank 1 ✓ (Néron specialisation, Lesson 83). Occasional fibres have higher rank — those are the "lucky" ones a sieve hunts for.

$\mathrm{II}^*$ has $m_v=9$, cost $m_v-1=8$. The budget for a rational elliptic surface is $\rho-2=8$. So $$\text{generic rank}=8-8-\sum_{\text{other }v}(m_v-1)\le0,$$ hence exactly 0 (rank is non-negative), and all other fibres must be irreducible. Since $v(\Delta)=10$ for $\mathrm{II}^*$ and $\deg\Delta=12$, the remaining two units are two $\mathrm{I}_1$'s ✓.

The lesson: a single $\mathrm{II}^*$ fibre destroys the entire rank budget. This is why one checks for it explicitly when designing families.

? \\ take a random-ish family and test squarefreeness of Delta
? { for(trial = 1, 20,
      my(a4 = t^2 + trial*t - 1, a6 = t^3 - trial, E, D);
      E = ellinit([0,0,0,a4,a6]);
      D = E.disc;
      if(poldegree(D) == 12 && issquarefree(D),
         print(trial, "  deg ", poldegree(D), "  squarefree")));
}
? \\ then estimate generic rank by specialising many t and taking the minimum:
? { my(E, mn = 99);
    for(n = 1, 40,
       E = ellinit([0,0,0, n^2 + 3*n - 1, n^3 - 3]);
       if(type(E)=="t_VEC", mn = min(mn, ellrank(E)[1])));
    print("min rank over specialisations: ", mn); }

The minimum rank over many specialisations is a good empirical estimate of the generic rank (by Néron specialisation, almost all fibres inherit exactly the generic rank; higher values are the lucky ones). A cleaner method is Nagao's conjecture (Lesson 86).

$E_8$ is even, unimodular, and has 240 minimal vectors of norm 2 — the densest packing in dimension 8. Under specialisation the Mordell–Weil lattice of $\mathcal{E}_{t_0}(\mathbb{Q})$ is (up to scaling by $h(t_0)$) a copy of $E_8$, so it inherits that density: 240 points of the minimal height, rather than the $\sim16$ a generic rank-8 lattice would have.

Consequence: on such a fibre you find many small points quickly, which is exactly what makes the inherited generators cheap to recover by direct search. The expensive generators are the sporadic ones, which do not come from the $E_8$ structure. ∎

? \\ force (t,1) and (-t,2) on y^2 = x^3 + a x + b:
? \\   1 = t^3 + a t + b
? \\   4 = -t^3 - a t + b
? \\ adding: 5 = 2b, so b = 5/2; subtracting: -3 = 2t^3 + 2 a t, a = (-3 - 2t^3)/(2t)
? \\ clear denominators by scaling; or just use a 2-parameter version.
? \\ Simpler: force two points with a 2-parameter family and specialise.
? { for(n = 2, 10,
     my(A = (-3 - 2*n^3)/(2*n), B = 5/2, E = ellinit([0,0,0,A,B]));
     if(type(E) == "t_VEC" && ellisoncurve(E,[n,1]) && ellisoncurve(E,[-n,2]),
        my(M = ellheightmatrix(E, [[n,1],[-n,2]]));
        print(n, "  det ", matdet(M), "  rank ", ellrank(E)[1]))); }

The determinant is nonzero for almost all $n$ ✓, proving the two specialised points are independent — Néron specialisation in action. Occasional $n$ give a singular determinant; those are the exceptional thin set.

The exceptional set where specialisation fails is thin; Silverman's effective version gives injectivity once $h(t_0)\gtrsim C(\mathcal{E})$ for an explicit but large constant. Practically one takes $t_0$ with $h(t_0)$ in the hundreds.

Coefficient size: a K3 family has $\deg a_4\le8$, $\deg a_6\le12$. Specialising at $t_0=p/q$ with $\max(|p|,|q|)\approx10^{12}$ gives $a_6$ of size $\approx10^{144}$ — about 150 digits. ✓ That is exactly the observed coefficient size of the record curves, and it is forced by the construction rather than chosen.

Injectivity of $\sigma_{t_0}$ can fail whenever some section becomes torsion or a relation appears. For a fixed relation $\sum n_iP_i=\mathcal{O}$, the locus of $t_0$ where it holds is the zero set of a nonzero function on $\mathbb{P}^1$ — finite. But there are infinitely many possible relations $(n_i)$, so the union over all of them is a countable union of finite sets: not finite, but of density zero.

The height argument bounds which relations can occur for $t_0$ of given height ($|n_i|$ is bounded in terms of $h(t_0)$), which is how "outside a set of bounded height" becomes meaningful. ∎

? av = [-5,-4,-3,-2,-1,1,2,3,4,5];
? P = prod(i=1,10, x - av[i]);
? Q = trunc_sqrt(P, 5);
? R = Q^2 - P;
? R
? \\ convert the quartic y^2 = R(x) to Weierstrass form:
? E = ellfromeqn(y^2 - R)
? Ec = ellinit(E);
? ellrank(Ec)

With this symmetric choice, $P$ is even, so $Q$ is odd-ish and $R$ has special structure — the curve tends to have extra structure and possibly lower rank than a generic choice. Try asymmetric $a_i$ for comparison. Typical ranks from a random choice of ten $a_i$ are 4–7; the ten constructed points are rarely all independent.

The ten points lie on a curve $y^2=R(x)$ with $\deg R=4$; such a curve, written as a quartic in $\mathbb{P}(1,2,1)$, has two points at infinity. The ten points $(a_i,Q(a_i))$ satisfy a relation coming from the divisor class: $\sum_i\bigl((a_i,Q(a_i))\bigr)$ is the intersection of $C$ with the curve $y=Q(x)$, which is a divisor linearly equivalent to a multiple of the hyperplane class. Concretely, $y-Q(x)$ has divisor $\sum_i(a_i,Q(a_i))-5(\infty_+)-5(\infty_-)$ roughly, giving one relation.

So generically the ten points span a rank-9 subgroup at most; in practice one relation is visible and further relations appear for special $a_i$. Mestre's papers refine the count and impose conditions to push the achievable rank up.

? \\ verify empirically:
? pts = [ [av[i], subst(Q,x,av[i])] | i <- [1..10] ];
? \\ map to E, compute the height matrix rank

(* Mathematica *)
as = {a1, a2, a3, a4};
P = Product[x - a, {a, as}] // Expand;
Q = Normal[Series[Sqrt[P], {x, Infinity, 2}]] // Expand;
R = Expand[Q^2 - P];
Exponent[R, x]     (* 1 -- degree <= n-1 = 1 *)
R // Simplify

With $n=2$, $\deg R\le1$: the "curve" $y^2=R(x)$ is a conic, genus 0 — too small to be useful. That is why Mestre takes $n=5$ (giving $\deg R\le4$, genus 1). The symbolic $n=2$ case is a good sanity check that your truncated-square-root routine is correct before scaling up.

Explicitly, $Q=x^2-\frac{e_1}{2}x+\left(\frac{e_1^2}{8}-\frac{e_2}{2}\right)$ where $e_i$ are the elementary symmetric functions — and one sees the pattern: $Q$'s coefficients are universal polynomials in the $e_i$ with denominators powers of 2.

? \\ GP version with numeric b's
? bs = [1, 2, 3, 5, 7];
? av = concat(bs, -bs);
? P = prod(i=1,10, x - av[i]);
? P == subst(P, x, -x)
%  1                          \\ P is even
? Q = trunc_sqrt(P, 5);
? R = Q^2 - P;
? R == subst(R, x, -x)
%  1                          \\ R is even
? R
? poldegree(R)
%  4

$R(x)=Ax^4+Bx^2+C$: only three coefficients rather than five, so two fewer conditions are needed to control it. The associated curve $y^2=Ax^4+Bx^2+C$ has the automorphism $(x,y)\mapsto(-x,y)$, and the ten constructed points come in five pairs $(\pm b_i,\ Q(b_i))$ related by it — so they span at most a rank-5 subgroup plus whatever the quotient contributes.

(* Mathematica *)
bs = {b1, b2, b3, b4, b5};
as = Join[bs, -bs];
P = Product[x - a, {a, as}] // Expand;
Q = Normal[Series[Sqrt[P], {x, Infinity, 5}]] // Expand;
R = Expand[Q^2 - P];
A = Coefficient[R, x, 4];
Solve[A == 0, b5]

$A=0$ makes $R$ a quadratic, so $y^2=R(x)$ is a conic: genus 0, useless for our purposes. So this is a condition to avoid, not impose.

The useful degeneracy is $\deg R=3$ (kill only the $x^4$ coefficient after a shift so that the cubic term survives), giving a Weierstrass curve directly. In the even case that is impossible, which is one reason Mestre's later constructions abandon full symmetry.

(* Mathematica: test feasibility modulo a prime first *)
Timing[GroebnerBasis[{cond1, cond2}, {b1,b2,b3,b4,b5,c1,d1,c2,d2},
                     Modulus -> 32003]]

Working modulo a prime is orders of magnitude faster and tells you whether the ideal is zero-dimensional, how many solutions to expect, and whether the computation is feasible at all. Only then attempt it over $\mathbb{Q}$.

Rule of thumb from the literature: two conditions on five symmetric parameters is routine; four conditions is hard; six is research-grade. Elkies' K3 families required substantially cleverer geometry rather than brute Gröbner power — the lesson being that better geometry beats better elimination.

? fam = (t) -> [0, 0, 0, t, 1];
? for(k = 1, 4, my(X = 500*k); print(X, "  ", nagao(fam, X)))
500   0.87
1000  0.92
1500  0.95
2000  0.96

Converging to 1 ✓, matching the Shioda–Tate computation of Lesson 80 Ex 7.9. The slow approach from below is typical; the error is $O(1/\log X)$.

? \\ Force (0, t) and (1, s(t)) onto y^2 = x^3 + a(t) x + b(t):
? \\   t^2 = b                       => b = t^2
? \\   s^2 = 1 + a + t^2             => pick s = t + 1, so a = 2t
? fam2 = (t) -> [0, 0, 0, 2*t, t^2];
? \\ check the sections:
? for(n = 2, 6, my(E = ellinit([0,0,0,2*n,n^2]));
    print(n, "  ", ellisoncurve(E,[0,n]), " ", ellisoncurve(E,[1,n+1]),
          "  rank ", ellrank(E)[1]))
? nagao(fam2, 1500)

Both points are on every fibre ✓. Nagao's sum should approach the generic rank — but check whether the two sections are actually independent generically: compute the height matrix on several specialisations and confirm the determinant is nonzero. If one section is a multiple of the other (or torsion), the generic rank is 1, not 2, and Nagao's sum will say so.

For a single curve $E/\mathbb{Q}$, the BSD heuristic says $a_p$ is systematically negative when the rank is positive, giving $S(X)=\sum_{p\le X}a_p\log p/p\approx-r\log X$ (Lesson 87).

For a family, the analogous statement averages over the fibres: $A_{\mathcal{E}}(p)=\frac1p\sum_ta_p(\mathcal{E}_t)$ measures the systematic bias across the whole family at $p$. If the family has generic rank $g$, every fibre inherits $g$ points, biasing every $a_p(\mathcal{E}_t)$ negative, so $A_{\mathcal{E}}(p)$ is systematically negative and the weighted average recovers $g$.

The reason Nagao's version is a theorem (modulo Tate) while the individual version is only a heuristic: over function fields, BSD-type statements follow from Tate's conjecture, which is much better understood than BSD over $\mathbb{Q}$. ∎

{ my(data = List());
  for(N = 11, 3000,
    my(v = ellsearch(N));
    for(i = 1, #v,
      my(E = ellinit(v[i][2]), R = ellrank(E));
      if(R[1] == R[2] && ellcm(E) == 0,
         listput(data, [R[1], MN(E, 2000)]))));
  \\ group by rank, report mean and spread
  for(r = 0, 3,
    my(s = [d[2] | d <- Vec(data), d[1] == r]);
    if(#s, print(r, "  n=", #s, "  mean=", vecsum(s)/#s,
                 "  min=", vecmin(s), "  max=", vecmax(s))));
}

You will find the means well separated but the ranges overlapping. That overlap is the false-positive rate: a rank-2 curve with an unlucky $S(X)$ can outscore a rank-3 curve. Hence the staged pipeline — each stage reduces the overlap by increasing $X$.

? Ecm = ellinit([0,0,0,0,1]);         \\ j=0, CM, rank 0
? E1  = ellinit([0,0,1,-1,0]);        \\ 37a1, rank 1
? [MN(Ecm, 2000), MN(E1, 2000)]
? [ellcm(Ecm), ellcm(E1)]
%  [-3, 0]

The CM curve's sum has half its terms identically zero and the surviving half drawn from a different distribution, so it can land anywhere. Depending on the curve you may well see it score more negatively than the rank-1 curve.

The fix is trivial and mandatory: if(ellcm(E), next) at the top of the sieve loop. Or, better, design the family so that CM fibres do not arise — a CM fibre requires $j(t_0)$ to be one of 13 values, which is a codimension-1 condition, so CM fibres are rare but not absent.

{ my(cands = List(), fam = (n) -> [0, 0, 0, n^2 - 3, n^3 + 1]);
  \\ Stage 1: X = 200
  for(n = 2, 20000,
    my(c = fam(n), E);
    if(4*c[4]^3 + 27*c[5]^2 != 0,
       E = ellinit(c);
       if(type(E) == "t_VEC" && ellcm(E) == 0,
          if(MN(E, 200) < -6.0, listput(cands, n)))));
  print("stage 1 survivors: ", #cands);
  \\ Stage 2: X = 5000
  my(final = List());
  for(i = 1, #cands,
    my(E = ellinit(fam(cands[i])));
    if(MN(E, 5000) < -12.0, listput(final, cands[i])));
  print("stage 2 survivors: ", Vec(final));
  \\ verify
  for(i = 1, #final, print(final[i], "  rank ", ellrank(ellinit(fam(final[i])))[1]));
}

Tune the thresholds by calibration. You should see the survivors have measurably higher rank than the family's generic rank — which is exactly the mechanism, at toy scale, of a record search.

{ my(fam = (t) -> [0,0,0, t^2-3, t^3+1], base = 0.0, sieved = 0.0, nb = 0, ns = 0);
  \\ baseline: random t
  for(n = 1000, 1200,
    my(E = ellinit(fam(n)));
    if(type(E)=="t_VEC" && ellcm(E)==0, base += MN(E,500); nb++));
  \\ sieved: t in good classes mod 3,5,7
  for(n = 1000, 3000,
    if(n % 7 == 2 && n % 5 == 1,          \\ replace with computed good residues
       my(E = ellinit(fam(n)));
       if(type(E)=="t_VEC" && ellcm(E)==0, sieved += MN(E,500); ns++)));
  print("baseline mean: ", base/nb, "   sieved mean: ", sieved/ns);
}

The sieved mean should be measurably more negative ✓. Quantify the shift and compare with the sum of the individual per-prime biases — they should roughly add, confirming the independence assumption that makes CRT sieving work.

Keeping the best 30% of residues for $p=2,3,5,7,11,13,17,19,23,29$ leaves $0.3^{10}\approx6\times10^{-6}$ of all $t_0$. If the bias shift is enough to raise the hit rate by a factor $k$ per prime, the effective speedup is $k^{10}/$(cost of enumeration).

Empirically Elkies reports speedups of several orders of magnitude from this technique. The precise gain depends on how much of $S(X)$'s variance is explained by small primes — typically a substantial fraction, since $\log p/p$ weights small primes heavily.

Caveat: the enumeration itself must be efficient. Naively testing every $t_0$ and rejecting is no faster; you need to generate only the CRT-selected $t_0$, which is a simple arithmetic progression walk once the residue set is fixed.

{ my(fam = (t) -> [0,0,0, t^2-3, t^3+1]);
  for(n = 1000, 1100,
    my(E = ellinit(fam(n)));
    if(type(E) == "t_VEC" && ellcm(E) == 0,
       my(R = ellrank(E));
       if(R[1] != R[2], print(n, "  bounds ", R[1..2], "  MN ", MN(E,500)))));
}

Look for a correlation between a very negative $S(X)$ and a large gap $R[2]-R[1]$. If aggressively sieved candidates systematically show gaps, you are finding Ш rather than rank. Mitigation: add a cheap descent check (2-descent is fast for small coefficients) to stage 3 of the pipeline, before committing to an expensive point search.

? E = ellinit([0,0,0,-7,6]);
? for(k = 2, 7, my(B = 10^k, t = getabstime());
    my(P = ellratpoints(E, B));
    print(B, "  #pts ", #P, "  time ", (getabstime()-t)/1000.0, " s"));

Time grows roughly like $B^{3/2}$ (you enumerate $d\le\sqrt B$ and $a\le Bd^2$, with the square test dominating). The number of points grows like $\log^{r/2}B$ by the lattice-point count. So the marginal cost of each additional point grows exponentially — the fundamental reason direct search saturates.

{ my(E = ellinit([0,0,0,-7,6]), G, zs, w1);
  G = select(P -> ellorder(E,P)==0, ellrank(E)[4]);
  w1 = real(E.omega[1]);
  zs = apply(P -> real(ellpointtoz(E, P)), G);
  \\ enumerate small integer combinations and check for rationality of the result
  forvec(v = vector(#G, i, [-4, 4]),
    if(v != vector(#G),
       my(Q = ellmul(E, G[1], v[1]));
       for(i = 2, #G, Q = elladd(E, Q, ellmul(E, G[i], v[i])));
       if(Q != [0] && ellheight(E,Q) < 3.0,
          print(v, "  ", Q, "  hhat ", ellheight(E,Q)))));
}

This enumerates the lattice generated by known points. It finds nothing new — everything it produces is a combination of what you already have. Its real use is different: enumerating short vectors of the predicted lattice (from a conjectured regulator) tells you what heights to expect for missing generators, which calibrates how hard to search.

Roughly $\hat h\approx\frac12h=\frac12\log H$ in Silverman's normalisation, or $\hat h\approx\log H$ in PARI's. Taking $\hat h\approx\log H$: $H\approx e^{100}\approx2.7\times10^{43}$.

Direct search cost $\sim H^{3/2}\approx10^{65}$ operations. Impossible.

Via an 8-covering: heights compress by 8, so you search for $\hat h\approx12.5$, i.e. $H\approx e^{12.5}\approx2.7\times10^5$. Cost $\sim H^{3/2}\approx1.4\times10^{8}$ operations — under a second.

That is a speedup of $10^{57}$. It is not an optimisation; it is the entire method. ∎

? E = ellinit([0,0,0,-7,6]);
? G = select(P -> ellorder(E,P)==0, ellrank(E)[4]);
? \\ Method 1:
? matdet(ellheightmatrix(E, G))
%  0.4171...   (nonzero)
? \\ Method 2:
? independent(E, G, [101,103,107,109,113,127,131])
%  1

Both succeed. Method 1 took milliseconds and involves floating-point analysis; Method 2 took milliseconds and involves only exact finite arithmetic. Method 2's output is a certificate: the list of primes and the resulting HNF matrices can be rechecked by any independent implementation, including a proof assistant.

{ my(E = ellinit([0,0,0,-7,6]),
     G = select(P->ellorder(E,P)==0, ellrank(E)[4]),
     L = 0, cnt = 0);
  forprime(p = 100, 300,
    if(E.disc % p,
       my(Lp = relmod(E, G, p));
       if(Lp != 0,
          cnt++;
          L = if(L == 0, Lp, matintersect(L, Lp));
          if(matsize(L)[2] == 0,
             print("independent after ", cnt, " primes (last p = ", p, ")");
             break))));
}

Typically 2–5 primes suffice in rank 3. The requirement is that the images $\bar P_i$ generate a subgroup of $\tilde E(\mathbb{F}_p)$ large enough that no spurious relation survives. Primes where $\#\tilde E(\mathbb{F}_p)$ is smooth (many small factors) are less useful; primes where the group is cyclic of large prime order are best. A good heuristic: pick $p$ with $\#\tilde E(\mathbb{F}_p)$ having a large prime factor.

Available in Mathlib today:

• WeierstrassCurve and its group law over any field, with associativity (Angdinata–Xu).
• Finite fields, $\mathbb{Z}/n$, matrices over $\mathbb{Z}$, and enough linear algebra for HNF (or it can be added).

What you would build:

1. A definition of $E(\mathbb{Q})\to\tilde E(\mathbb{F}_p)$ and a proof that it is a group homomorphism (this follows from the reduction of the Weierstrass equation and the group-law formulas, but needs care at the points where denominators vanish).
2. For a given list of points and prime, a decidable computation of $L_p$ (discrete logs in a finite group — a finite search, so Decidable).
3. The intersection lemma: $L\subseteq\bigcap L_p$, immediate from (1).
4. A native_decide or verified-kernel computation showing $\bigcap_{p\in S}L_p=0$.
5. Conclude: no nontrivial relation, hence rank $\ge k$.

What you would not need: Mordell–Weil, heights, Selmer groups, Ш, real analysis. That is the whole point.

Step 1 is the only real mathematical work; steps 2–5 are engineering. This is a genuinely tractable project and would produce the first machine-checked rank lower bound.

? logN = 50 * log(10);
? { my(best = 999, bD = 0);
    for(k = 10, 100, my(D = k/10.0, b = estbound(exp(logN), D, 3.0));
        if(b < best, best = b; bD = D));
    print("optimal D = ", bD, "  bound ~ ", best,
          "  primes needed ~ ", exp(2*Pi*bD)); }

You will find an optimum where the marginal gain from the prime sum equals the marginal cost of the main term. For a 50-digit conductor expect a bound in the mid-teens with $\Delta$ around 3–5. For a 150-digit conductor the bound roughly triples — landing in the low thirties, exactly as observed for the record curve.

Suppose the explicit formula gives $r_{\text{an}}\le B$ with $\lfloor B\rfloor=b$. Parity says $r_{\text{an}}\equiv\epsilon\pmod2$ where $(-1)^\epsilon=w$. If $b\equiv\epsilon$, parity gives nothing new. If $b\not\equiv\epsilon$, then $r_{\text{an}}\le b-1$.

So the saving is 0 or 1 — never more. To do better you need a genuinely better analytic bound, not more cleverness with parity. ∎

This is why getting $B$ down to 31 rather than 32 mattered so much for the rank-30 result: at 32, parity would have given $\le32$ and left a two-unit gap.

The lower bound consists of: (a) an explicit list of 30 points, each verifiable on the curve by a single polynomial evaluation; (b) a $30\times30$ matrix of canonical heights; (c) a determinant. Every step is independently checkable, and with ball arithmetic every step is provable. No conjecture enters. An independent group can re-verify it in minutes.

The upper bound depends on GRH (a conjecture about all zeros of an $L$-function) and BSD (a Millennium Problem). If either failed, the ceiling would evaporate — but the record would stand, restated as "rank $\ge30$", which is what the leaderboards actually track.

Good practice, followed by the record community: state the two claims separately and label the hypotheses. ∎

{ my(cnt = vector(6));
  for(N = 11, 5000,
    my(v = ellsearch(N));
    for(i = 1, #v,
      my(E = ellinit(v[i][2]), R = ellrank(E));
      if(R[1] == R[2] && R[1] < 6, cnt[R[1]+1]++)));
  print(cnt);
  print("proportions: ", [c*1.0/vecsum(cnt) | c <- cnt]);
}

You should see roughly $\{r=0:\ \sim60\%,\ r=1:\ \sim35\%,\ r=2:\ \sim5\%,\ r\ge3:\ \lt1\%\}$ at small conductor. The predicted asymptotic is exactly 50/50 between ranks 0 and 1 with density 0 for $r\ge2$; the discrepancy at small conductor is a well-known finite-size effect (curves are ordered by conductor here, not by height, which also matters).

The statement quantifies over all curves and allows a finite exceptional set of any size. A rank-30 curve is one member of that set. The model even predicts roughly how many exceptions to expect: the count of curves of height $\le X$ with rank $\ge r$ is predicted to be $X^{(21-r)/24+o(1)}$-ish, which for $r=30$ gives a bounded total.

What would contradict the model is finding an infinite family of rank-30 curves, or curves of unboundedly growing rank. Nobody has done either — and the construction methods of this phase all cap out at generic rank 18, so no known method could. ∎

PPVW's heuristic gives, for the number of curves of height $\le X$ with rank $\ge r$, $$\#\{E:\operatorname{ht}(E)\le X,\ r_E\ge r\}\ \asymp\ X^{(21-r)/24}$$ for $r\gt21$ this exponent is negative, so the count is bounded as $X\to\infty$: finitely many in total.

For $r=25$: exponent $(21-25)/24=-1/6$, so the count tends to 0 — meaning only finitely many, and the model gives no reason to expect many. The observed record of 30 with a handful of curves at 28–30 is entirely consistent.

Sobering corollary: if the model is right, rank records will get harder and harder, and there may be an absolute maximum. The century-long steady progress may be approaching its end rather than continuing indefinitely.

summary(c) = my(E = ellminimalmodel(ellinit(c)));
  [ellglobalred(E)[1], ellrank(E)[1..2], elltors(E)[2], ellrootno(E)];

? summary([0,0,1,-7,6])
%  [5077, [3, 3], [], -1]
? summary([0,-1,1,-10,-20])
%  [11, [0, 0], [5], 1]

Note the parity check: root number $-1$ with rank 3 ✓, $+1$ with rank 0 ✓.

verify(c, pts, prec) =
{ default(realprecision, prec);
  my(E = ellinit(c), G);
  for(i = 1, #pts, if(!ellisoncurve(E, pts[i]), error("point ", i, " not on curve")));
  G = select(P -> ellorder(E, P) == 0, pts);
  if(#G != #pts, error("torsion present"));
  my(M = ellheightmatrix(E, G), d = matdet(M));
  if(d == 0, error("determinant zero -- dependent"));
  for(k = 1, #G, if(matdet(M[1..k,1..k]) <= 0, error("not positive definite")));
  print("rank >= ", #G, "   regulator = ", d);
  #G;
}

? verify([0,0,0,-7,6], ellrank(ellinit([0,0,0,-7,6]))[4], 80)

This is a complete, reusable rank-lower-bound certifier. Give it the curve and the points and it does every check: on-curve, non-torsion, independent, positive definite.

\\ batch.gp  --  run with: gp -q batch.gp
{
  my(v = readvec("curves.txt"), out = List());
  for(i = 1, #v,
    my(E = ellinit(v[i]));
    if(type(E) == "t_VEC",
       my(Em = ellminimalmodel(E), R = ellrank(Em));
       listput(out, [i, ellglobalred(Em)[1], R[1], R[2], ellrootno(Em)]);
       if(R[1] >= 6, print("HIT ", i, "  ", v[i], "  rank ", R[1..2]))));
  write("summary.txt", Vec(out));
  print("done: ", #out, " curves");
}

Input file format: one curve per line as [a1,a2,a3,a4,a6]. readvec parses it. This is the confirmation stage of a rank search; the sieve produces curves.txt and this verifies.

ECHeightMatrix[c_List, pts_List, prec_ : 60] :=
 GPEval["default(realprecision, " <> ToString[prec] <> "); \
         ellheightmatrix(ellinit(" <> toGP[c] <> "), " <> toGP[pts] <> ")"];

ECRegulator[c_List, pts_List, prec_ : 60] := Det @ ECHeightMatrix[c, pts, prec];

ECRegulator[{0,0,0,-7,6}, {{-3,0},{-2,3},{-1,3}}]

Note toGP applied to a list of points produces [[-3,0],[-2,3],[-1,3]] ✓ since the replacement is global. The returned matrix comes back as a Mathematica matrix of reals, ready for Det, Eigenvalues, or LatticeReduce.

ECRank[c_List] := Module[{disc, r},
  disc = GPEval["my(E = ellinit(" <> toGP[c] <> ")); if(type(E)==\"t_VEC\", E.disc, 0)"];
  If[disc === 0, Return[$Failed]];
  r = GPEval["ellrank(ellinit(" <> toGP[c] <> "))"];
  Take[r, 2]
];

ECRank[{0,0,0,0,0}]       (* $Failed -- y^2 = x^3 is a cusp *)
ECRank[{0,0,0,-7,6}]      (* {3, 3} *)

Better still, compute the discriminant in Mathematica before calling GP at all: $\Delta=-16(4A^3+27B^2)$ for short form, or the full $b_i$ formula otherwise. That saves a process spawn on every singular candidate, which in a sieve over millions matters.

cs = Table[{0, 0, 0, n^2 - 3, n^3 + 1}, {n, 2, 501}];
AbsoluteTiming[ECRank /@ cs;]        (* ~ 20-40 s: 500 process spawns *)
AbsoluteTiming[ECRankList[cs];]      (* ~ 1-3 s: one spawn *)

Roughly a 20× speedup even at this small scale, and the gap widens with the number of curves since the per-spawn cost is fixed. At a million curves the difference is between an hour and a week.

Design consequence: every wrapper in the package should have a list version, and the singular-form version should be documented as "for interactive use only".

as = Table[Subscript[a, i], {i, 1, 10}];
m = MestrePoly[as];
Exponent[m["R"], x]                    (* 4 *)
Length @ MonomialList[Coefficient[m["R"], x, 4]]   (* count terms *)
ByteCount[m["R"]]

The coefficients of $R$ are symmetric polynomials of high degree in ten variables — several thousand terms. That size is why one immediately reduces to symmetric configurations ($a_i=\pm b_i$) before imposing conditions: it cuts the variable count from 10 to 5 and exploits the evenness of $R$.

bs = Table[Subscript[b, i], {i, 1, 5}];
ms = MestrePoly[Join[bs, -bs]];
ms["R"] === (ms["R"] /. x -> -x)       (* True: R is even *)
CoefficientList[ms["R"], x][[{1, 3, 5}]] // ByteCount   (* far smaller *)

c = MestreCurve[{-7, -5, -3, -2, -1, 1, 2, 4, 6, 9}];
w = c["Weierstrass"];
den = LCM @@ Denominator /@ w;
w2 = {w[[1]] den, w[[2]] den^2, w[[3]] den^3, w[[4]] den^4, w[[5]] den^6};
{ECRank[w], ECRank[w2]}

Identical ✓. Scaling $a_i\mapsto u^ia_i$ is exactly the admissible change of variables with $u=1/\text{den}$ (Lesson 14), so the curves are $\mathbb{Q}$-isomorphic and the rank is unchanged. Only $\Delta$ scales, by $u^{-12}$.

Doing this in Mathematica before calling PARI is worth it: ellminimalmodel on a curve with huge denominators is slower than on the scaled integral version.

found = {};
Do[
  Module[{as, c, r},
    as = RandomSample[Range[-20, 20], 10];
    c = MestreCurve[as];
    If[c =!= $Failed,
      r = ECRank[c["Weierstrass"]];
      If[r =!= $Failed && First[r] >= 8, AppendTo[found, {as, r}]]]],
  {2000}];
found

Rank 8 appears occasionally in a few thousand random trials — far more often than random curves of comparable size, where it would essentially never appear. Above 8 the hit rate drops sharply, because the ten constructed points satisfy at least one relation (Lesson 84 Ex 7.17) and generic choices give no more.

To go higher you must impose conditions, which is exactly Lesson 85 and the next lesson here.

GroebnerBasis[{x^2 + y^2 - 1, x - y}, {x, y}]
(* {-1 + 2 y^2, x - y} *)

GroebnerBasis[{x^2 + y^2 - 1, x - y}, {x, y},
              MonomialOrder -> EliminationOrder]
(* eliminates x first: the y-only generator is -1 + 2 y^2 *)

The elimination ideal in $\mathbb{Q}[y]$ is generated by $2y^2-1$, so $y=\pm1/\sqrt2$ — no rational solutions. That is the mechanism you will use constantly: eliminate down to one variable and check whether the resulting polynomial has rational roots.

vars = {b1, b2, b3, b4, b5};
m = MestrePoly[Join[vars, -vars]];
{A, B, C} = CoefficientList[m["R"], x][[{5, 3, 1}]];
cond = B^2 - 4 A C - k^2;

Timing @ GroebnerBasis[{cond}, Append[vars, k], Modulus -> 32003];
(* fast *)

TimeConstrained[
  Timing @ GroebnerBasis[{cond}, Append[vars, k]],
  120, $Aborted]
(* may abort *)

Typically 100×–10000× faster modulo a prime, because coefficient growth over $\mathbb{Q}$ is the dominant cost. Standard practice: run mod $p$ for several primes, infer the structure (dimension, degree), and only then attempt the rational computation — or reconstruct rationally from the modular results.

(* impose that R has a rational root; solve for b5 *)
sol = Solve[B^2 - 4 A C == k^2, b5];   (* may be messy; take one branch *)

(* specialise the remaining parameters numerically and test *)
results = Table[
  Module[{as, c, r},
    as = {b1, b2, b3, b4, b5} /. {b1 -> i, b2 -> j, b3 -> 3, b4 -> 5} 
         /. First[sol];
    (* build the curve and test *)
    ], {i, 1, 5}, {j, 6, 10}];

The point of the exercise is the workflow rather than a specific number: impose, solve, substitute, specialise, verify with ECRank. Compare the rank distribution of the constrained family against the unconstrained one — the constrained family should show a shifted distribution, which is exactly the generic-rank increase Néron specialisation then propagates to every fibre.

If the constrained family's ranks are not higher, the condition you imposed did not add an independent point — a common outcome, and the reason this stage is iterative.

\\ GP version -- port the hot version to C
buildtable(fam, p, frac) =
{ my(v = vector(p), ord);
  for(t = 0, p-1,
      my(c = fam(t), E = ellinit(apply(u -> lift(Mod(u,p)), c), p));
      v[t+1] = if(type(E) == "t_VEC", ellap(E,p), 0));
  ord = vecsort(v, , 1);
  vecextract(vector(p, i, i-1), Str("1..", max(1, floor(frac*p))))
    \\ indices of the most negative
}

? fam = (t) -> [0,0,0, t^2-3, t^3+1];
? tables = [ [p, buildtable(fam, p, 0.3)] | p <- [3,5,7,11,13] ];
? \\ selectivity:
? prod(i=1,#tables, #tables[i][2] / tables[i][1]) * 1.0

Selectivity around $0.3^5\approx0.0024$: you examine 0.24% of candidates. Then measure the mean $S(X)$ shift among survivors to confirm the bias is real and roughly additive across primes.

\\ sieve.gp
{
  my(start = 1, chkfile = "checkpoint.txt", hits = "hits.txt");
  if(fileexists(chkfile), start = eval(readstr(chkfile)[1]));
  print("resuming from ", start);
  for(n = start, 10^7,
    my(c = [0,0,0, n^2-3, n^3+1], E);
    if(4*c[4]^3 + 27*c[5]^2,
       E = ellinit(c);
       if(type(E) == "t_VEC" && ellcm(E) == 0,
          if(MN(E, 200) < -8.0,
             write(hits, n)))));
    if(n % 10000 == 0, write1(chkfile, Str(n)));
  );
}

Write the checkpoint after the batch it covers, and make the hit file append-only. On restart the worst case is re-doing one batch — which is fine, provided the hit file is deduplicated at the end.

Stage 1 at $X=200$ needs $a_p$ for 46 primes, each costing $O(p)$ operations, total $\sum_{p\le200}p\approx4600$ operations per candidate.

$10^{12}$ candidates $\times$ $4600$ operations $=4.6\times10^{15}$ operations. At $10^9$ operations/second/core that is $4.6\times10^6$ core-seconds $\approx53$ core-days. On 128 cores: about 10 hours.

But: with congruence sieving at 0.24% selectivity you only evaluate $2.4\times10^9$ candidates, bringing it to under a core-hour. The enumeration of the CRT classes then becomes the bottleneck, which is why it must be a direct arithmetic-progression walk rather than test-and-reject.

This is the calculation to do before writing the code — it tells you where the effort must go.

? \\ find a rank-5 curve first
? { for(a = -200, 200, for(b = -200, 200,
      if(4*a^3+27*b^2,
         my(E = ellinit([0,0,0,a,b]));
         if(type(E)=="t_VEC" && ellrank(E)[1] >= 5,
            print([a,b]); break(2))))); }
? \\ then verify:
? # 
? verifyrank([0,0,0,a,b], G, 100)
? ##

The height matrix dominates: $\binom{5}{2}+5=15$ canonical heights. Even at 100 digits this is milliseconds. Scaling to rank 30 gives 465 heights — still fast. Verification is cheap; discovery is expensive. That asymmetry is why record claims are easy to check and hard to make.

verifymodp(coeffs, pts, nprimes) =
{ my(E = ellinit(coeffs), L = 0, used = List(), cnt = 0);
  forprime(p = 100, 10^6,
    if(E.disc % p != 0,
       my(Lp = relmod(E, pts, p));
       if(Lp != 0,
          listput(used, p); cnt++;
          L = if(L == 0, Lp, matintersect(L, Lp));
          if(matsize(L)[2] == 0,
             print("independent, certified by primes ", Vec(used));
             return(1));
          if(cnt >= nprimes, break))));
  print("inconclusive after ", cnt, " primes");
  0;
}

? verifymodp([0,0,0,-7,6], G, 20)

Output is a certificate: the list of primes. Anyone can recheck it with exact finite arithmetic, no floating point, no trust in a height implementation. This is the artefact you would formalise in Lean (Lesson 90 Ex 7.36).

? E = ellinit([0,0,0,-7,6]);
? G = select(P -> ellorder(E,P)==0, ellrank(E)[4]);
? bad = concat(G, [elladd(E, G[1], G[2])]);       \\ P1 + P2 is dependent!
? verifyrank([0,0,0,-7,6], bad, 80)
*** determinant vanishes: points are dependent

Caught ✓. Also try: including a torsion point (caught by the order check), a point not on the curve (caught by ellisoncurve), and a set at insufficient precision (caught by the two-precision comparison, if you add it).

Testing your verifier against known-bad inputs is not optional. A verifier that never rejects anything is not a verifier.

? \\ Pull a high-rank curve from the LMFDB or from Dujella's tables,
? \\ then run the full verifier from Lesson 98:
? read("verify.gp");
? \\ e.g. a rank-8 curve of moderate conductor:
? E = ellinit([0, 0, 1, -79, 342]);      \\ substitute a genuine rank-8 example
? R = ellrank(E, 2);
? G = select(P -> ellorder(E,P) == 0, R[4]);
? verifyrank(E[1..5], G, 100)
? verifymodp(E[1..5], G, 20)

Doing this once, end to end, on someone else's curve is the best possible check that you have understood the pipeline. If your verifier agrees with the published claim, you have working code; if it disagrees, you have learned something specific.

Example — Project 4 (Lean certificate):

1. Install Lean 4 and Mathlib; locate Mathlib/AlgebraicGeometry/EllipticCurve/Affine.lean and read the WeierstrassCurve.Affine.Point API. Confirm you can state and evaluate the group law on a concrete curve over $\mathbb{F}_{101}$.
2. Define the reduction map $E(\mathbb{Q})\to\tilde E(\mathbb{F}_p)$ for a curve with good reduction at $p$, and prove it is a group homomorphism. This is the only substantial mathematical step; expect it to be most of the work.
3. Write a Decidable instance for "$\sum a_i\bar P_i=\mathcal{O}$ in $\tilde E(\mathbb{F}_p)$" and use native_decide (or a verified kernel computation) to check that the intersection of the relation lattices is trivial for a small worked example — say rank 3 on $y^2=x^3-7x+6$.

Then generalise: from rank 3 to rank $k$, from one prime to a list, and finally to a curve with large coefficients. The mathematical content does not change; only the arithmetic gets bigger.

Mordell–Weil (Lesson 52). For $E$ over a number field $K$, $E(K)$ is finitely generated: $E(K)\cong\mathbb{Z}^r\times E(K)_{\text{tors}}$. The proof is weak Mordell–Weil (finiteness of $E(K)/mE(K)$, from finiteness of the class group and finite generation of units) plus a height descent argument.

Néron–Tate height (Lesson 47). $\hat h(P)=\lim h(2^nP)/4^n$ exists, differs from the naive height by $O(1)$, satisfies $\hat h(mP)=m^2\hat h(P)$ exactly, and vanishes precisely on torsion. It makes $E(\mathbb{Q})/\text{tors}$ a positive-definite lattice, which is what allows independence to be certified by a determinant.

Modularity (Lesson 70). Every $E/\mathbb{Q}$ of conductor $N$ corresponds to a weight-2 newform of level $N$ with the same $a_n$. This gives $L(E,s)$ its analytic continuation and functional equation, without which BSD cannot even be stated.

Shioda–Tate (Lesson 80). For an elliptic surface with section, $\rho(S)=2+\sum_v(m_v-1)+\operatorname{rank}\mathcal{E}(\overline k(t))$. It is the budget constraint governing every high-rank construction, and it is why one keeps the discriminant squarefree.

Néron specialisation (Lesson 83). For a non-constant family $\mathcal{E}/\mathbb{Q}(t)$, the specialisation $\mathcal{E}(\mathbb{Q}(t))\to\mathcal{E}_{t_0}(\mathbb{Q})$ is injective for all but a thin set of $t_0$. It is what makes "build the rank once, inherit it everywhere" legitimate.