Geometric quadratic Chabauty

Determining all rational points on a curve of genus at least 2 can be difficult. Chabauty's method (1941) is to intersect, for a prime number p, in the p-adic Lie group of p-adic points of the jacobian, the closure of the Mordell-Weil group with the p-adic points of the curve. If the Mordell-Weil rank is less than the genus then this method has never failed. Minhyong Kim's non-abelian Chabauty programme aims to remove the condition on the rank. The simplest case, called quadratic Chabauty, was developed by Balakrishnan, Dogra, Mueller, Tuitman and Vonk, and applied in a tour de force to the so-called cursed curve (rank and genus both 3). This article aims to make the quadratic Chabauty method small and geometric again, by describing it in terms of only `simple algebraic geometry' (line bundles over the jacobian and models over the integers).


Introduction
Faltings proved in 1983, see [16], that for every number field K and every curve C over K of genus at least 2, the set of K-rational points C(K) is finite. However, determining C(K), in individual cases, is still an unsolved problem. For simplicity, we restrict ourselves in this article to the case K = Q.
Chabauty's method (1941) for determining C(Q) is to intersect, for a prime number p, in the p-adic Lie group of p-adic points of the jacobian, the closure of the Mordell-Weil group with the p-adic points of the curve. There is a fair amount of evidence (mainly hyperelliptic curves of small genus, see [3]) that Chabauty's method, in combination with other methods such as the Mordell-Weil sieve, does determine all rational points when r < g, with r the Mordell-Weil rank and g the genus of C.
For a general introduction to Chabauty's method and Coleman's effective version of it, we highly recommend [24], and, for an implementation of it that is 'geometric' in the sense of this article, to [17], in which equations for the curve embedded in the Jacobian are pulled back via local parametrisations of the closure of the Mordell-Weil group.
Minhyong Kim's non-abelian Chabauty programme aims to remove the condition that r < g. The 'non-abelian' refers to fundamental groups; the fundamental group of the jacobian of a curve is the abelianised fundamental group of the curve. The most striking result in this direction is the so-called quadratic Chabauty method, applied in [5], a technical tour de force, to the so-called cursed curve (r = g = 3). For more details we recommend the introduction of [5].
This article aims to make the quadratic Chabauty method small and geometric again, by describing it in terms of only 'simple algebraic geometry' (line bundles over the jacobian, models over the integers, and biextension structures). The main result is Theorem 4.12. It gives a criterion for a given list of rational points to be complete, in terms of points with values in Z/p 2 Z only. Section 2 describes the geometric method in less than 3 pages, Sections 3-5 give the necessary theory, Sections 6-7 give descriptions that are suitable for computer calculations, and Section 8 treats an example with r = g = 2 and 14 rational points. As explained in the remarks following Theorem 4.12, we expect that this approach will make it possible to treat many more curves. Section 9.1 gives some remarks on the fundamental groups of the objects we use. They are subgroups of higher dimensional Heisenberg groups, where the commutator pairing is the intersection pairing of the first homology group of the curve. Section 9.2 reproves the finiteness of C(Q), for C with r < g + ρ − 1, with ρ the rank of the Z-module of symmetric endomorphisms of the jacobian of C. It also shows that a version of Theorem 4.12 that uses higher p-adic precision will always give a finite upper bound for C(Q). Section 9.3 gives, through an appropriate choice of coordinates that split the Poincaré biextension, the relation between our geometric approach and the p-adic heights used in the cohomological approach.
Already for the case of classical Chabauty (working with J instead of T , and under the assumption that r < g), where everything is linear, the criterion of Theorem 4.12 can be useful; this has been worked out and implemented in [30]. We recommend this work as a gentle introduction into the geometric approach taken in this article. A generalisation from Q to number fields is given in [13]. For a generalisation of the cohomological approach, see [2] (quadratic Chabauty) and [14] (non-abelian Chabauty).
Although this article is about geometry, it contains no pictures. Fortunately, many pictures can be found in [19], and some in [15].

Algebraic geometry
Let C be a scheme over Z, proper, flat, regular, with C Q of dimension one and geometrically connected. Let n be in Z ≥1 such that the restriction of C to Z[1/n] is smooth. Let g be the genus of C Q . We assume that g ≥ 2 and that we have a rational point b ∈ C(Q); it extends uniquely to a b ∈ C(Z). We let J be the Néron model over Z of the jacobian Pic 0 C Q /Q . We denote by J ∨ the Néron model over Z of the dual J ∨ Q of J Q , and λ : J → J ∨ the isomorphism extending the canonical principal polarisation of J Q . We let P Q be the Poincaré line bundle on J Q × J ∨ Q , trivialised on the union of {0} × J ∨ Q and J Q × {0}. Then the Poincaré torsor is the G m -torsor on J Q × J ∨ Q defined as For every scheme S over J Q × J ∨ Q , P × Q (S) is the set of isomorphisms from O S to (P Q ) S , with a free and transitive action of O S (S) × . Locally on S for the Zariski topology, (P × Q ) S is trivial, and P × Q is represented by a scheme over J Q × J ∨ Q . The theorem of the cube gives P × Q the structure of a biextension of J Q and J ∨ Q by G m , a notion for the details of which we recommend Section I.2.5 of [26], Grothendieck's Exposés VII and VIII [29], and references therein. This means the following. For S a Q-scheme, x 1 and x 2 in J Q (S), and y in J ∨ Q (S), the theorem of the cube gives a canonical isomorphism of O S -modules This induces a morphism of schemes as follows. For any S-scheme T , and z 1 in ((x 1 , y) * P × Q )(T ) and z 2 in ((x 2 , y) * P × Q )(T ), we view z 1 and z 2 as nowhere vanishing sections of the invertible O T -modules (x 1 , y) * P Q and (x 2 , y) * P Q . The tensor product of these two then gives an element of ((x 1 + x 2 , y) * P × Q )(T ). This gives P × Q → J ∨ Q the structure of a commutative group scheme, which is an extension of J Q by G m , over the base J ∨ Q . We denote this group law, and the one on J Q × J ∨ Q , as (2.4) (z 1 , z 2 ) z 1 + 1 z 2 ((x 1 , y), (x 2 , y)) (x 1 , y) + 1 (x 2 , y) (x 1 + x 2 , y) .
In the same way, P × Q → J Q has a group law + 2 that makes it an extension of J ∨ Q by G m over the base J Q . In this way, P × Q is both the universal extension of J Q by G m and the universal extension of J ∨ Q by G m . The final ingredient of the notion of biextension is that the two partial group laws are compatible in the following sense. For any Q-scheme S, for x 1 and x 2 in J Q (S), y 1 and y 2 in J ∨ Q (S), and, for all i and j in {1, 2}, z i,j in ((x i , y j ) * P × Q )(S), we have (2.5) (z 1,1 + 1 z 2,1 ) + 2 (z 1,2 + 1 z 2,2 ) (z 1,1 + 2 z 1,2 ) + 1 (z 2,1 + 2 z 2,2 ) (x 1 + x 2 , y 1 ) + 2 (x 1 + x 2 , y 2 ) (x 1 , y 1 + y 2 ) + 1 (x 2 , y 1 + y 2 ) with the equality in the upper line taking place in ((x 1 + x 2 , y 1 + y 2 ) * P × Q )(S). Now we extend the geometry above over Z. We denote by J 0 the fibrewise connected component of 0 in J, which is an open subgroup scheme of J, and by Φ the quotient J/J 0 , which is anétale (not necessarily separated) group scheme over Z, with finite fibres, supported on Z/nZ. Similarly, we let J ∨0 be the fibrewise connected component of J ∨ . Theorem 7.1, in Exposé VIII of [29] gives that P × Q extends uniquely to a G m -biextension (Grothendieck's pairing on component groups is the obstruction to the existence of such an extension). Note that in this case the existence and the uniqueness follow directly from the requirement of extending the rigidification on J Q × {0}. For details see Section 6.7. Our base point b ∈ C(Z) gives an embedding j b : C Q → J Q , which sends, functorially in Q-schemes S, an element c ∈ C Q (S) to the class of the invertible O C S -module O C S (c − b). Then j b extends uniquely to a morphism (2.7) where C sm is the open subscheme of C consisting of points at which C is smooth over Z. Note that C Q (Q) = C(Z) = C sm (Z). Our next step is to lift j b , at least on certain opens of C sm , to a morphism to a G ρ−1 m -torsor over J, where ρ is the rank of the free Z-module Hom(J Q , J ∨ Q ) + , the Z-module of self-dual morphisms from J Q to J ∨ Q . This torsor will be the product of pullbacks of P × via morphisms with f : J → J ∨ a morphism of group schemes, c ∈ J ∨ (Z), tr c the translation by c, m the least common multiple of the exponents of all Φ(F p ) with p ranging over all primes, and m· the multiplication by m map on J ∨ . For such a map m· • tr c • f , j b : C Q → J Q can be lifted to (id, m· • tr c • f ) * P × Q if and only if j * b (id, m· • tr c • f ) * P × Q is trivial. The degree of this G m -torsor on C Q is minus the trace of λ −1 • m· • (f + f ∨ ) acting on H 1 (J(C), Z). For example, for f = λ the degree is −4mg. Note that j b : C Q → J Q induces (2.9) j (see [25], Propositions 2.7.9 and 2.7.10). This implies that for f such that this degree is zero, there is a unique c such that j * b (id, tr c • f ) * P × Q is trivial on C Q , and hence also its mth power j * b (id, m· • tr c • f ) * P × Q . The map (2.10) Hom(J Q , J ∨ Q ) −→ Pic(J Q ) −→ NS J Q /Q (Q) = Hom(J Q , J ∨ Q ) + sending f to the class of (id, f ) * P Q sends f to f + f ∨ , hence its kernel is Hom(J Q , J ∨ Q ) − , the group of antisymmetric morphisms. But actually, for f antisymmetric, its image in Pic(J Q ) is already zero (see for example [6] and the references therein). Hence the image of Hom(J Q , J ∨ Q ) in Pic(J Q ) is free of rank ρ, and its subgroup of classes with degree zero on C Q is free of rank ρ−1. Let f 1 , . . . , f ρ−1 be elements of Hom(J Q , J ∨ Q ) whose images in Pic(J Q ) form a basis of this subgroup, and let c 1 , . . . , c ρ−1 be the corresponding elements of J ∨ (Z).
By construction, for each i, the morphism j b : C Q → J Q lifts to (id, m· • tr c i • f i ) * P × Q , unique up to Q × . Now we spread this out over Z, to open subschemes U of C sm obtained by removing, for each q dividing n, all but one irreducible components of C sm Fq , with the remaining irreducible component geometrically irreducible. For such a U, the morphism Pic(U) → Pic(C Q ) is an isomorphism, and O C (U) = Z, thus, for each i, there is a lift At this point we can explain the strategy of our approach to the quadratic Chabauty method. Let T be the G ρ−1 m -torsor on J obtained by taking the product of all Then each c ∈ C Q (Q) = C sm (Z) lies in one of the finitely many U(Z)'s. For each U, we have a lift j b : U → T , and, for each prime number p, j b (U(Z)) is contained in the intersection, in T (Z p ), of j b (U(Z p )) and the closure T (Z) of T (Z) in T (Z p ) with the p-adic topology. Of course, one expects this closure to be of dimension at most r := rank(J(Q)), and therefore one expects this method to be successful if r < g + ρ − 1, the dimension of T (Z p ). The next two sections make this strategy precise, giving first the necessary p-adic formal and analytic geometry, and then the description of T (Z) as a finite disjoint union of images of Z r p under maps constructed from the biextension structure.
3 From algebraic geometry to formal geometry Let p be a prime number. Given X a smooth scheme of relative dimension d over Z p and x ∈ X(F p ) let us describe the set X(Z p ) x of elements of X(Z p ) whose image in X(F p ) is x. The smoothness implies that the maximal ideal of O X,x is generated by p together with d other elements t 1 , . . . , t d . In this case we call p, t 1 , . . . , t d parameters at x; if moreover x l ∈ X(Z p ) x is a lift of x such that t 1 (x l ) = . . . t d (x l ) = 0 then we say that the t i 's are parameters at x l . The t i can be evaluated on all the points in X(Z p ) x , inducing a bijection t : We get a bijection This bijection can be interpreted geometrically as follows. Let π : X x → X denote the blow up of X in x. By shrinking X, X is affine and the t i are regular on X, t : With these definitions, we have The affine space ( X p x ) Fp is canonically a torsor under the tangent space of X Fp at x. This construction is functorial. Let Y be a smooth Z p -scheme, f : X → Y a morphism over Z p , and y : If this tangent map is injective, and d x and d y denote the dimensions of X Fp at x and of Y Fp at y, then there are t 1 , . . . , t dy in O Y,y such that p, t 1 , . . . , t dy are parameters at y, and such that . . ,t dx , with kernel generated byt dx+1 , . . . ,t dy .

Integral points, closure and finiteness
Let us now return to our original problem. The notation U, J, T , j b , j b , r, ρ etc., is as at the end of Section 2. We assume moreover that p does not divide n (n as in the start of Section 2) and that p > 2 (for p = 2 everything that follows can probably be adapted by working with residue polydiscs modulo 4).
Let u be in U(F p ), and t := j b (u). We want a description of the closure T (Z) t of T (Z) t in T (Z p ) t . Using the biextension structure of P × , we will produce, for each element of J(Z) j b (u) , an element of T (Z) over it. Not all of these points are in T (Z) t , but we will then produce a subset of T (Z) t whose closure is T (Z) t .
If T (Z) t is empty then T (Z) t is empty, too. So we assume that we have an element t ∈ T (Z) t and we define x t ∈ J(Z) to be the projection of t. Let f = (f 1 , . . . , f ρ−1 ) : J → J ∨,ρ−1 , let c = (c 1 , . . . , c ρ−1 ) ∈ J ∨,ρ−1 (Z). We denote by P ×,ρ−1 the product over J × (J ∨0 ) ρ−1 of the ρ−1 G m -torsors obtained by pullback of P × via the projections to J × J ∨0 ; it is a biextension of J and (J ∨0 ) ρ−1 by G ρ−1 m , and T = (id, m· • tr c • f ) * P ×,ρ−1 . We choose a basis x 1 , . . . , x r of the free Z-module J(Z) 0 , the kernel of J(Z) → J(F p ). For each i, j ∈ {1, . . . , r} we choose P i,j , R i, t , and S t,j in P ×,ρ−1 (Z) whose images in and (x t , f (mx j )): For each such choice there are 2 ρ−1 possibilities. For each n ∈ Z r we use the biextension structure on P ×,ρ−1 → J × (J ∨0 ) ρ−1 to define the following points in P ×,ρ−1 (Z), with specified images in (J × (J ∨0 ) ρ−1 )(Z): where 1 and · 1 denote iterations of the first partial group law + 1 as in (2.4), and analogously for the second group law. We define, for all n ∈ Z r , which is mapped to Hence D t (n) is in T (Z), and its image in J(F p ) is j b (u). We do not know its image in T (F p ). We claim that for n in (p−1)Z r , D t (n) is in T (Z) t . Let n ′ be in Z r and let n = (p−1)n ′ . Then, in the trivial F ×,ρ−1 p -torsor P ×,ρ−1 (j b (u), 0), on which + 2 is the group law, we have: Similarly, in P ×,ρ−1 (0, (m· • tr c • f )(j b (u))) = F ×,ρ−1 p , we have B t (n) = 1, and, similarly, in P ×,ρ−1 (0, 0) = F ×,ρ−1 p , we have C(n) = 1. So, with apologies for the mix of additive and multiplicative notations, in P ×,ρ−1 (F p ) we have mapping to the following element in (J × J ∨0,ρ−1 )(F p ): We have proved our claim that D t (n) ∈ T (Z) t . So we now have the map The following theorem will be proved in Section 5.

4.10
Theorem Let x 1 , . . . , x g be in O J,j b (u) such that together with p they form a system of parameters of O J,j b (u) , and let v 1 , . . . , v ρ−1 be in O T,t such that p, x 1 , . . . , x g , v 1 , . . . , v ρ−1 are parameters of O T,t . As in Section 3 these parameters, divided by p, give a bijection The composition of κ Z with the map (4.10.1) is given by uniquely determined κ 1 , . . . , κ g+ρ−1 in O(A r Zp ) ∧p = Z p z 1 , . . . , z r . The images in F p [z 1 , . . . , z r ] of κ 1 , . . . , κ g are of degree at most 1, and the images of κ g+1 , . . . , κ g+ρ−1 are of degree at most 2. The map κ Z extends uniquely to the continuous map and the image of κ is T (Z) t .
Now the moment has come to confront U(Z p ) u with T (Z) t . We have j b : U → T , whose tangent map (mod p) at u is injective (here we use that C Fp is smooth over F p ). Then, as at the end of Section 3, j b : U p u → T p t is, after reduction mod p, an affine linear embedding of codimension g+ρ−2, j b * : O( T p t ) ∧p → O( U p u ) ∧p is surjective and its kernel is generated by elements f 1 , . . . , f g+ρ−2 (we apologise for using the same letter as for the components of f : J → J ∨,ρ−1 ), whose images in F p ⊗O( T p t ) are of degree at most 1, and such that f 1 , . . . , f g−1 are in O( J p j b (u) ) ∧p . The pullbacks κ * f i are in Z p z 1 , . . . , z r ; let I be the ideal in Z p z 1 , . . . , z r generated by them, and let (4.11) A := Z p z 1 , . . . , z r /I .
Then the elements of Z r p whose image is in U(Z p ) u are zeros of I, hence morphisms of rings from A to Z p , and hence from the reduced quotient A red to Z p .

Theorem
For i ∈ {1, . . . , g+ρ−2}, let κ * f i be the image of κ * f i in F p [z 1 , . . . , z r ], and let I be the ideal of F p [z 1 , . . . , z r ] generated by them. Then κ * f 1 , . . . , κ * f g−1 are of degree at most 1, and κ * f g , . . . , κ * f g+ρ−2 are of degree at most 2. Assume that A := A/pA = F p [z 1 , . . . , z r ]/I is finite. Then A is the product of its localisations A m at its finitely many maximal ideals m. The sum of the dim Fp A m over the m such that A/m = F p is an upper bound for the number of elements of Z r p whose image under κ is in U(Z p ) u , and also an upper bound for the number of elements of U(Z) with image u in U(F p ).
Proof As every f i is of degree at most 1 in x 1 , . . . , x g , v 1 , . . . , v ρ−1 , every κ * f i is an F p -linear combination of κ 1 , . . . , κ g+ρ−1 , hence of degree at most 2. For i < g, f i is a linear combination of x 1 , . . . , x g , and therefore κ * f i is of degree at most 1.
We claim that A is p-adically complete. More generally, let R be a noetherian ring that is J-adically complete for an ideal J, and let I be an ideal in R. The map from R/I to its J-adic completion (R/I) ∧ is injective ([1, Thm.10.17]). As J-adic completion is exact on finitely generated R-modules ([1, Prop.10.12]), it sends the surjection R → R/I to a surjection R = R ∧ → (R/I) ∧ (see [1,Prop.10.5] for the equality R = R ∧ ). It follows that R/I → (R/I) ∧ is surjective. Now we assume that A is finite. As A is p-adically complete, A is the limit of the system of its quotients by powers of p. These quotients are finite: for every m ∈ Z ≥1 , A/p m+1 A is, as abelian group, an extension of A/pA by a quotient of A/p m A. As Z p -module, A is generated by any lift of an F p -basis of A. Hence A is finitely generated as Z p -module.
The set of elements of Z r p whose image under κ is in U(Z p ) is in bijection with the set of Z p -algebra morphisms Hom(A, Z p ). As A is the product of its localisations A m at its maximal ideals, Hom(A, Z p ) is the disjoint union of the Hom(A m , Z p ). For each m, Hom(A m , Z p ) has at most rank Zp (A m ) elements, and is empty if F p → A/m is not an isomorphism. This establishes the upper bound for the number of elements of Z r p whose image under κ is in U(Z p ). By Theorem 4.10, the elements of U(Z) with image u in U(F p ) are in T (Z) t , and therefore of the form κ(x) with x ∈ Z r p such that κ(x) is in U(Z p ) u . This establishes the upper bound for the number of elements of U(Z) with image u in U(F p ).
We include some remarks to explain how Theorem 4.12 can be used, and what we hope that it can do.

Remark
The κ * f i in Theorem 4.12 can be computed from the reduction F r p → T (Z/p 2 Z) of κ Z and (to get the f i ) from j b : U(Z/p 2 Z) u → T (Z/p 2 Z) t . For this, one does not need to treat T and J as schemes, one just computes with Z/p 2 Z-valued points. Now assume that r ≤ g + ρ − 2. If, for some prime p, the criterion in Theorem 4.12 fails (that is, A is not finite), then one can try the next prime. We hope (but also expect) that one quickly finds a prime p such that A is finite for every U and for every u in U(F p ) such that j b (u) is in the image of T (Z) → T (F p ). By the way, note that our notation in Theorem 4.12 does not show the dependence on U and u of j b , κ Z , κ and the f i . Instead of varying p, one could also increase the p-adic precision, and then the result of Section 9.2 proves that one gets an upper bound for the number of elements of U(Z).

Remark
If r < g + ρ − 2 then we think that it is likely (when varying p), for dimension reasons, unless something special happens as in [3] or Remark 8.9 of [4], that, for all u ∈ U(F p ), the upper bound in Theorem 4.12 for the number of elements of U(Z) with image u in U(F p ) is sharp. For a precise conjecture in the context of Chabauty's method, see the "Strong Chabauty" Conjecture in [31].

Remark
Suppose that r = g + ρ − 2. Then we expect, for dimension reasons, that it is likely (when varying p) that, for some u ∈ U(F p ), the upper bound in Theorem 4.12 for the number of elements of U(Z) with image u in U(F p ) is not sharp. Then, as in the classical Chabauty method, one must combine the information gotten from several primes, analogous to 'Mordell-Weil sieving'; see [27]. In our situation, this amounts to the following. Suppose that we are given a subset B of U(Z) that we want to prove to be equal to U(Z). Let B ′ be the complement in U(Z) of B. For every prime p > 2 not dividing n, Theorem 4.12 gives, interpreting A as in the end of the proof of Theorem 4.12, a subset O p of J(Z), with O p a union of cosets for the subgroup p· ker(J(Z) → J(F p )), that contains j b (B ′ ). Then one hopes that, taking a large enough finite set S of primes, the intersection of the O p for p in S is empty.

Parametrisation of integral points, and power series
In this section we give a proof of Theorem 4.10. The main tools here are the formal logarithm and formal exponential of a commutative smooth group scheme over a Q-algebra ( [20], Theorem 1): they give us identities like n·g = exp(n· log g) that allow us to extend the multiplication to elements n of Z p .
The evaluation map from Z p z 1 , . . . , z n to the set of maps Z n p → Z p is injective (induction on n, non-zero elements of Z p z have only finitely many zeros in Z p ).
We say that a map f : Z n p → Z m p is given by integral convergent power series if its coordinate functions are in Z p z 1 , . . . , z n = O(A n Zp ) ∧p . This property is stable under composition: composition of polynomials over Z/p k Z gives polynomials.

Logarithm and exponential
Let p be a prime number, and let G be a commutative group scheme, smooth of relative dimension d over a scheme S smooth over Z p , with unit section e in G(S). For any s in S(F p ), G(Z p ) e(s) is a group fibred over S(Z p ) s . The fibres have a natural Z p -module structure: G(Z p ) e(s) is the limit of the G(Z/p n Z) e(s) (n ≥ 1), S(Z p ) s is the limit of the S(Z/p n Z) s , and for each n ≥ 1, the fibres of G(Z/p n Z) e(s) → S(Z/p n Z) s are commutative groups annihilated by p n−1 . Let T G/S be the relative (geometric) tangent bundle of G over S. Then its pullback T G/S (e) by e is a vector bundle on S of rank d.

Lemma
In this situation, and with n the relative dimension of S over Z p , the formal logarithm and exponential of G base changed to Q ⊗ O S,s converge to maps , that are each other's inverse and, after a choice of parameters for G → S at e(s) as in (3.1), are given by n + d elements of O( G p e(s) ) ∧p and n + d elements of O( T G/S (e) p 0(s) ) ∧p . For a in Z p and g in G(Z p ) e(s) we have a·g = exp(a· log g), and, after a choice of parameters for G → S at e(s), this map Z p × G(Z p ) e(s) → G(Z p ) e(s) is given by n + d elements of Zp × Zp G p e(s) ) ∧p . The induced morphism A 1 Fp × ( G p e(s) ) Fp → ( G p e(s) ) Fp , where ( G p e(s) ) Fp is viewed as the product of T S Fp (s) and T G/S (e(s)), is a morphism over T S Fp (s), bilinear in A 1 Fp and T G/S (e(s)).
Proof Let t 1 , . . . , t n be in O S,s such that p, t 1 , . . . , t n are parameters at s. Then we have a bijection (5.1.2)t : S(Z p ) s → Z n p , a → p −1 ·(t 1 (a), . . . , t n (a)) . Similarly, let x 1 , . . . , x d be generators for the ideal I e(s) of e in O G,e(s) . Then p, the t i and the x j together are parameters for O G,e(s) , and give the bijection The dx i form an O S,s -basis of Ω 1 G/S (e) s , and so give translation invariant differentials ω i on G O S,s . As G is commutative, for all i, dω i = 0 ( [20], Proposition 1.3). We also have the dual O S,s -basis ∂ i of T G/S (e) and the bijection Then log is given by elements log i in ( ]] whose constant term is 0, uniquely determined (Proposition 1.1 in [20]) by the equality Hence the formula from calculus, we have, for all i and J, with |J| denoting the total degree of x J , The claim about convergence and definition of log : G(Z p ) e(s) → (T G/S (e))(Z p ) 0(s) , is now equivalent to having an analytic bijection Z n+d p → Z n+d p given by We have, for each i, For each i, this expression is an element of Z p t 1 , . . . ,t n ,x 1 , . . . ,x d = O( G p e(s) ) ∧p , even when p = 2, because for each J, |J| log i,J is in O S,s , which is contained in Z p t 1 , . . . ,t n , and the function Z ≥1 → Q p , r → p r−1 /r has values in Z p and converges to 0. The existence and analyticity of log is now proved (even for p = 2). As p > 2, the image of (5.1.9) in F p ⊗O( G p e(s) ) ∧p isx i , and on the first n coordinates, log is the identity, so, by applying Hensel modulo powers of p, log is invertible, and the inverse is also given by n + d elements of O( T G/S (e) p 0(s) ) ∧p . The function Z p × G(Z p ) e(s) → G(Z p ) e(s) , (a, g) → exp(a· log g) is a composition of maps given by integral convergent power series, hence it is also of that form.

Parametrisation by power series
The notation and assumptions are as in the beginning of Section 4, in particular, p > 2 and T is as defined in (2.12). We have a t in T (F p ), with image j b (u) in J(F p ), and at in T (Z) lifting t. For every Q in T (Z) mapping to j b (u) in J(F p ) there are unique ε ∈ Z ×,ρ−1 and n ∈ Z r such that Q = ε·Dt(n): the image of Q in J(Z) is in J(Z) j b (u) , hence differs from the image xt in J(Z) oft by an element of J(Z) 0 (with here 0 ∈ J(F p )), i n i x i for a unique n ∈ Z r , hence Dt(n) and Q are in T (Z) and have the same image in J(Z), and that gives the unique ε. So we have a bijection But a problem that we are facing is that the map Z r → T (F p ) j b (u) sending n to the image of Dt(n) depends on the (unknown) images of the P i,j , R i,t and St ,j from (4.1) in P ×,ρ−1 (F p ), and so we do not know for which n and ε the point Then for all n in Z r , because Dt((p − 1)·n) maps to t in T (F p ). Moreover for every Q in T (Z) t there is a unique n ∈ Z r and a unique ε ∈ Z ×,ρ−1 such that Q = ε·Dt(n) = ξ(n)·Dt(n) = D ′ (n). Hence The following lemma proves the existence and uniqueness of the κ i of Theorem 4.10, and the claims on the degrees of the κ i .

Lemma
After any choice of parameters of O T,t as in Theorem 4.10, D ′ is given by For all i in {1, . . . , g + ρ − 1} we let κ ′ i be the reduction mod p of κ ′ j . Then κ ′ 1 , . . . , κ ′ g are of degree at most 1, and the remaining κ ′ j are of degree at most 2.
Proof In order to get a formula for D ′ (n), we introduce variants of the P i,j , R i, t , and S t,j as follows. The images in (J × (J ∨0 ) ρ−1 )(F p ) of these points are of the form (0, * ), (0, * ), and ( * , 0), respectively. Hence the fibers over them of P ×,ρ−1 are rigidified, that is, equal to F ×,ρ−1 p . We define their variants P ′ i,j , R ′ i, t , and S ′ t,j in P ×,ρ−1 (Z p ) to be the unique elements in their orbits under F ×,ρ−1 p whose images in P ×,ρ−1 (F p ) are equal to the element 1 in F ×,ρ−1 p . Replacing, in (4.2) and (4.3), these P i,j , R i, t , and S t,j by P ′ i,j , R ′ i, t , and S ′ t,j gives variants A ′ , B ′ and C ′ , and using these in (4.4) gives a variant D ′ t (n) of 5.2.2. Then, for all n in Z r , D ′ t (n) and D ′ (n) (as in (5.2.2)) are equal, because both are in P ×,ρ−1 (Z p ) t , and in the same F ×,ρ−1 p -orbit. Hence we have, for all n in Z r : This shows how the map n → D ′ (n) is built up from the two partial group laws + 1 and + 2 on P ×,ρ−1 , and the iterations · 1 and · 2 . Lemma 5.1.1 gives that the iterations are given by integral convergent power series. The functoriality in Section 3 gives that the maps induced by + 1 and + 2 on residue polydisks are given by integral convergent power series. Stability under composition then gives that n → D ′ (n) is given by elements (after choosing the necessary parameters) are all of degree at most 1. The same holds for B ′ . We define Then the mod p coordinate functions of C ′ 2 , elements of F p [x 1 , . . . , x r , y 1 , . . . , y r ], are linear in the x i , and in the y j . Hence of degree at most 2, and the same follows for the mod p coordinate functions of C ′ . However, as the first ρg parameters for P ×,ρ−1 come from J × J ∨ρ−1 , and the 1st and 2nd partial group laws there act on different factors, the first ρg mod p coordinate functions of C ′ are in fact linear. As D ′ is obtained by summing, using the partial group laws, the results of A ′ , B ′ and C ′ , we conclude that κ ′ 1 , . . . , κ ′ g are of degree at most 1, and the remaining κ j are of degree at most 2. The same holds then for all κ j .

The p-adic closure
. So together we have: We have extended D ′ to a continuous map Z r p → T (Z p ) t . As Z r p is compact, D ′ (Z r p ) is closed in T (Z p ) t . As Z r and (p − 1)Z r are dense in Z r p , the closures of their images under D ′ are both equal to D ′ (Z r p ), and equal to κ(Z r p ). This finishes the proof of Theorem 4.10.

Explicit description of the Poincaré torsor
The aim of this section is to give explicit descriptions of the Poincaré torsor P × on J × J ∨,0 and its partial group laws, to be used for doing computations when applying Theorem 4.12.
The main results are as follows. Proposition 6.3.2 describes the fibre of P over a point of J × J ∨,0 , say with values in Z/p 2 Z with p not dividing n or in Z[1/n], when the corresponding points of J and J ∨,0 are given by a line bundle on C (over Z/p 2 Z or Z[1/n], and rigidified at b) and an effective relative Cartier divisor on C (over Z/p 2 Z or Z[1/n]). It also translates the partial group laws of P × in terms of such data. Lemma 6.4.8 shows how to deal with linear equivalence of divisors. Lemma 6.5.4 makes the symmetry of P × explicit. Lemma 6.6.8 gives parametrisations of residue polydisks of P × (Z/p 2 Z), and Lemma 6.6.13 gives partial group laws on these residue polydisks. Proposition 6.8.7 describes the unique extension over J × J ∨,0 of the Poincaré torsor on (J × J ∨,0 ) Z[1/n] , in terms of line bundles and divisors on C. Finally, Proposition 6.9.3 describes the fibres of P over Z-points of J × J ∨,0 . In this article, we have chosen to use line bundles and divisors on curves for describing the jacobian and the Poincaré torsor. Another option is to use line bundles on curves and the determinant of coherent cohomology, as in Section 2 of [25]. We note that in Section 2, only the restriction of P to J 0 × J ∨,0 is treated, and moreover, under the assumption that C is nodal (that is, all fibres C Fp are reduced and have only the mildest possible singularities). Another choice we have made is to develop the basic theory of norms of G m -torsors under finite locally free morphisms in this article (Sections 6.1-6.2) and not to refer, for example, to EGA or SGA, because we think this is easier for the reader, and because this way we could adapt the definition directly to our use of it.

Norms
Let S be a scheme, f : S ′ → S be finite and locally free, say of rank n.
. Then the norm morphism is the composition . This is functorial in T : a morphism ϕ : T 1 → T 2 induces an isomorphism Norm S ′ /S (ϕ). It is also functorial for cartesian diagrams ( The norm functor (6.1.2) is multiplicative: such that, if U ⊂ S is open and t 1 and t 2 are in T 1 (U) and T 2 (U), then This construction is functorial for isomorphisms of invertible O S ′ -modules.

Norms along finite relative Cartier divisors
This part is inspired by [21], section 1.1. Let S be a scheme, let f : X → S be an S-scheme of finite presentation. A finite effective relative Cartier divisor on f : X → S is a closed subscheme D of X that is finite and locally free over S, and whose ideal sheaf I D is locally generated by a non-zero divisor (equivalently, I D is locally free of rank 1 as O X -module). For such a D and an invertible O X -module L, the norm of L along D is defined, using (6.1.5), as Then Norm D/S (L) is functorial for cartesian diagrams (X ′ → S ′ , L ′ ) → (X → S, L).

Lemma
Let f : X → S be a morphism of schemes that is of finite presentation. For D a finite effective relative Cartier divisor on f , the norm functor Norm D/S in (6.2.1) is multiplicative in L: Let D 1 and D 2 be finite effective relative Cartier divisors on f . Then the ideal sheaf I D 1 I D 2 ⊂ O X is locally free of rank 1, the closed subscheme D 1 + D 2 defined by it is a finite effective relative Cartier divisor on f . The norm functor in (6.2.1) is additive in D: Proof Let D 1 and D 2 be as stated. If V ⊂ X is open, and f i generates is not a zero-divisor because f 1 and f 2 are not. To show that D 1 + D 2 is finite over S, we replace S by an affine open of it, and then reduce to the noetherian case, using the assumption that f is of finite presentation. Then, (D 1 + D 2 ) red is the image of D 1,red D 2,red → X, and therefore is proper. Hence D 1 + D 2 is proper over S, and quasi-finite over S, hence finite over S. The short exact sequence (6.2.7) We prove (6.2.5), by proving the required statement about sheaves of groups. The diagram commutes, because multiplication by u on O D 1 +D 2 preserves the short exact sequence (6.2.7), multiplying on the sub and quotient by its images in O × D 1 and in O × D 2 ; note that the sub is an invertible O D 1 -module.

Explicit description of the Poincaré torsor of a smooth curve
Let g be in Z ≥1 , let S be a scheme, and π : C → S be a proper smooth curve, with geometrically connected fibres of genus g, with a section b ∈ C(S). Let J → S be its jacobian. On C × S J we have L univ , the universal invertible O-module of degree zero on C, rigidified at b.
Let d ≥ 0, and C (d) the dth symmetric power of C → S (we note that the quotient C d → C (d) is finite, locally free of rank d!, and commutes with base change on S). Then on C × S C (d) we have D, the universal effective relative Cartier divisor on C of degree d. Hence, on C × S J × S C (d) we have their pullbacks D J and L univ C (d) , giving us .
, rigidified at the zero-section of J, gives us a morphism of S-schemes C (d) to Pic J/S . The point db (the divisor d times the base point b) in C (d) (S) is mapped to 0, precisely because L univ is rigidified at b, and 6.2.5. Hence there is a unique morphism : with its rigidifications, is the same as N d . The following proposition tells us what the morphism is, and the next section tells us what the induced isomorphism is between the fibres of N d at points of J × C (d) with the same image in J × S J.

Proposition The pullback of
For c 1 and c 2 in C(S), we have and, as invertible O-modules on C × S C, with ∆ the diagonal and pr ∅ : C × S C → S the structure morphism, we have using Lemma 6.2.2.
For T an S-scheme and x 1 and x 2 in J(T ) given by O-modules L 1 and L 2 on C T , rigidified at b, and D in C (d) (T ), the isomorphism using Lemma 6.2.2.
Proof Let T be an S-scheme, and x be in J(T ). Then x corresponds to the invertible O- meaning that the pullback of (id × z) * P on J T rigidified at 0 by j b equals (id × x) * L univ on C T rigidified at b. Taking T := J and x the tautological point gives the first claim of the proposition.
The symmetry of M with its rigidifications follows from [25], (2.7.1) and Lemma 2.7.5, and (2.7.7), using 2.9. Now we prove (6.3.4). So let T and x be as above, and y = Σ(D) in J(T ) given by a relative divisor D of degree d on C T . As C d → C (d) is finite and locally free of rank d!, we may and do suppose that D is a sum of sections, say Then we have, functorially: Identities (6.3.5) and (6.3.6) follow directly from (6.3.4). Now we prove the claimed compatibility between (6.3.9) and (6.3.10). We do this by considering the case where L is universal, that is, base changing to J T and x the universal point. Then, on J T , we have 2 isomorphisms from Norm ( Hence it suffices to check that this element equals 1 at 0 ∈ J(T ). This amounts to checking that the 2 isomorphisms are equal for L = O C T with the standard rigidification at b. Then, both isomorphisms are the multiplication The compatibility between (6.3.7) and (6.3.8) is proved analogously.
6.3.12 Remark From Proposition 6.3.2 one easily deduces, in that situation, for T an Sscheme, x in J(T ) given by an invertible O-module L on C T , and D 1 and D 2 effective relative Cartier divisors on C T , of the same degree, a canonical isomorphism satisfying the analogous compatibilities as in Proposition 6.3.2. No rigidification of L at b is needed. In fact, for L 0 an invertible O T -module, we have Norm D 1 /T (π * L 0 ) = L ⊗d 0 , where π : C T → T is the structure morphism and d is the degree of D 1 . Hence the right hand side of (6.3.13) is independent of the choice of L, given x.

Explicit isomorphism for norms along equivalent divisors
Let g be in Z ≥1 , let S be a scheme, and p : C → S be a proper smooth curve, with geometrically connected fibres of genus g, with a section b ∈ C(S). Let D 1 , D 2 be effective relative Cartier divisors of degree d on C, that we also view as elements of C (d) (S). Recall from Proposition 6.3.2 the morphism Σ : C (d) → J. Then Σ(D 1 ) = Σ(D 2 ) if and only if D 1 , D 2 are linearly equivalent in the following sense: locally on S, there exists an . In this case, we define div(f ) = D 2 − D 1 . Proposition 6.3.2 gives us, for each invertible O-module L of degree 0 on C rigidified at b (viewed as an element of J(S)) specific isomorphisms

Now we describe explicitly this isomorphism Norm
and then we prove that this isomorphism is the one in (6.4.1).
We construct ϕ L,D 1 ,D 2 locally on S and the functoriality of the construction takes care of making it global. So, suppose that f is as above: . Let n ∈ Z with n > 2g − 2 + 2d. Then p * (L(nb)) → p * L(nb)| D 1 +D 2 and p * (O C (nb)) → p * O C (nb)| D 1 +D 2 are surjective, and (still localising on S) p * (L(nb)) and p * (O C (nb)) are free O S -modules and L(nb)| D 1 +D 2 and O C (nb)| D 1 +D 2 are free O D 1 +D 2 -modules of rank 1. Then we have l 0 in (L(nb))(C) and l 1 in (O C (nb))(C) restricting to generators on D 1 + D 2 . Let D − := div(l 1 ) and D + := div(l 0 ), and let V := C \ (D + + D − ). Note that V contains D 1 + D 2 and that U contains D + + D − . Then, on V , l := l 0 /l 1 is in L(V ), generates L| D 1 +D 2 , and multiplication by l is an isomorphism ·l : and let ϕ L,l,f be the isomorphism, given in terms of generators Now suppose that we made other choices n ′ , l ′ 0 , l ′ 1 . Then we get D − ′ , D + ′ , V ′ , l ′ and ϕ L,l ′ ,f .
Then there is a unique function g ∈ O C (V ∩ V ′ ) × such that l ′ = gl in L(V ∩ V ′ ). Then where, in the last step, we used Weil reciprocity, in a generality for which we do not know a reference. The truth in this generality is clear from the classical case by reduction to the universal case, in which the base scheme is integral: take a suitable level structure on J, then consider the universal curve with this level structure, and the universal 4-tuple of effective divisors with the necessary conditions. We conclude that ϕ L,l, Then there is a unique u ∈ O S (S) × such that f ′ = u·f , and since L has degree 0 on C Hence ϕ L,l,f ′ = ϕ L,l,f . We define

Symmetry of the Norm for divisors on smooth curves
Let C → S be a proper and smooth curve with geometrically connected fibres. For D 1 , D 2 effective relative Cartier divisors on C we define an isomorphism that is functorial for cartesian diagrams (C ′ /S ′ , D ′ 1 , D ′ 2 ) → (C/S, D 1 , D 2 ). If suffices to define this isomorphism in the universal case, that is, over the scheme that parametrises all D 1 and D 2 . Let d 1 and d 2 be in Z ≥0 , and let U := C (d 1 ) × S C (d 2 ) , and let D 1 and D 2 be the universal divisors on C U . Then we have the invertible O U -modules Norm D 1 /U (O C (D 2 )) and Norm D 2 /U (O C (D 1 )). The image of D 1 ∩ D 2 in U is closed, let U 0 be its complement. Then, over U 0 , D 1 and D 2 are disjoint, and the restrictions of Norm D 1 /U (O C (D 2 )) and Norm D 2 /U (O C (D 1 )) are generated by Norm D 1 /U (1) and Norm D 2 /U (1), and there is a unique isomorphism (ϕ D 1 ,D 2 ) U 0 that sends Norm D 1 /U (1) to Norm D 2 /U (1).
We claim that this isomorphism extends to an isomorphism over U. To see it, we base change by U ′ → U, where U ′ = C d 1 × S C d 2 , then U ′ → U is finite, locally free of rank d 1 !·d 2 !. Then D 1 = P 1 +· · ·+P d 1 and D 2 = Q 1 +· · ·+Q d 2 with the P i and Q j in C(U ′ ). The complement of the inverse image U ′0 in U ′ of U 0 is the union of the pullbacks D i,j under pr i,j : U ′ → C × S C of the diagonal, that is, the locus where P i = Q j . Each D i,j is an effective relative Cartier divisor on U ′ , isomorphic as S-scheme to C d 1 +d 2 −1 , hence smooth over S. Now and, on U ′0 , The divisor on U ′ of the tensor-factor 1 at (i, j), both in Norm D 1 /U ′ (1) and in Norm D 2 /U ′ (1), is D i,j . Therefore, the isomorphism (ϕ D 1 ,D 2 ) U 0 extends, uniquely, to an isomorphism ϕ D 1 ,D 2 over U ′ , which descends uniquely to U. Our description of ϕ D 1 ,D 2 allows us to compute it in the trivial case where D 1 and D 2 are disjoint. One should be a bit careful in other cases. For example, when d 1 = d 2 = 1 and P = Q, we have P * O C (Q) = P * O C (P ) is the tangent space of C → S at P , and hence also at Q, but ϕ P,Q is multiplication by −1 on that tangent space. The reason for that is that the switch automorphism on C × S C induces −1 on the normal bundle of the diagonal.
. Moreover the isomorphisms ϕ D 1 ,D 2 , and consequently ψ D 1 ,D 2 , are compatible with addition of divisors, that is, under (6.3.10) and (6.3.8), for every triple D 1 , D 2 , D 3 of relative Cartier divisors on C we have Proof It is enough to prove it in the universal case, that is, when D 1 and D 2 are the universal divisors on C U , and there we know that there exists a u in O U (U) × = O S (S) × such that Since the symmetry in Proposition 6.3.2 is compatible with the rigidification at (0, 0) ∈ (J×J)(S) then ψ d 1 b,d 2 b is the identity on O U , as well as the right hand side of (6.5.5) when D i = d i b. Hence u = u(d 1 b, d 2 b) = 1, proving (6.5.5). Now we prove (6.5.6). As for (6.5.5), it is enough to prove it in the universal case and then we can reduce to the case where

Explicit residue disks and partial group laws
Let C be a smooth, proper, geometrically connected curve over Z/p 2 , with a b ∈ C(Z/p 2 ), let g be the genus, and let M be as in Proposition 6.3.
is given by (D, E) we parametrise M × (Z/p 2 ) α , under the assumption that there exists a nonspecial split reduced divisor of degree g on C Fp . Let b 1 , . . . , b g in C(Z/p 2 ) have distinct images b i in C(F p ) such that h 0 (C Fp , b 1 +· · ·+b g ) = 1, and let b g+1 , . . . , b 2g in C(Z/p 2 ) be such that the b g+i are distinct and h 0 (C Fp , b g+1 +· · ·+b 2g ) = 1. Then the maps (6.6.1) areétale respectively in the points (b 1 , . . . , b g ) ∈ C g (F p ) and (b g+1 , . . . , b 2g ) ∈ C g (F p ) and consequently give bijections such that p and x c generate the maximal ideal of O C,c . For each i = 1, . . . , 2g we choose x b i so that x b i (b i ) = 0. For each (Z/p 2 )-point c ∈ C(Z/p 2 ) with image c in C(F p ) and for each λ ∈ F p let c λ be the unique point in C(Z/p 2 ) c with x c (c λ ) = λp. Then the map λ → c λ is a bijection F p → C(Z/p 2 ) c hence the maps f 1 , f 2 induce bijections Hence M × (Z/p 2 ) D,E is the union of M × (D λ , E µ ) as λ and µ vary in F g p and by Proposition 6.3.2 and Remark 6.3.12 we have (6.6.4) For each i ∈ {1, . . . , g}, c ∈ C(Z/p 2 ) and λ ∈ F p we define . Then, for each c ∈ C(Z/p 2 ) and each λ ∈ F g p , (6.6.5) We write E ± = E 0,± + · · · + E g,± so that E 0,± is disjoint from {b 1 , . . . , b g }, and E i,± , restricted to C Fp , is supported on Then, for each λ in F g p , (6.6.6) ). By (6.6.4), (6.6.5) and (6.6.6) we see that, for λ and µ in F g p , (6.6.7) generates the free rank one Z/p 2 -module M(D λ , E µ ). The fibre M × (D, E) over (D, E) in (J × J)(F p ) is an F × p -torsor, containing s D,E (0, 0), hence in bijection with F × p by sending ξ in F × p to ξ·s D,E (0, 0). Using that (Z/p 2 ) × = F × p × (1 + pF p ), we conclude the following lemma.
6.6.8 Lemma With the assumptions and definitions from the start of Section 6.6, we have, for each ξ ∈ F × p , a parametrisation of the mod p 2 residue polydisk of M × at ξ·s D,E (0, 0) by the bijection Using this parametrization it easy to describe the two partial group laws on M × (Z/p 2 ) when one of the two points we are summing lies over (D, E) and the other lies over (D, 0) or (0, E).
To compute the group law in J(Z/p 2 ) we notice that for each c ∈ C(Z/p 2 ) such that x c (c) = 0 and for each λ, µ ∈ F p we have (6.6.9) x c x c − (λ+µ)p and since these rational functions generate O C (c λ −c+c µ −c) and O C (c λ+µ −c) in a neighborhood of c, we have the equality of relative Cartier divisors on C (6.6.10) Hence, under the definition for λ ∈ F g p of (6.6.11) D 0 we have, for all λ, µ ∈ F g p , that D λ + D 0 µ = D λ+µ and E λ + E 0 µ = E λ+µ . Definition 6.6.7, applied with (D, 0) and (0, E), with x 0,E = 1 and, for every c ∈ C(F p ), with x 0,c = 1, gives, for all λ, µ in F g p , the elements (6.6.12) With these definitions, we have the following lemma for the partial group laws of M.
We end this section with one more lemma.

Lemma
The parametrization in Lemma 6.6.8 is the inverse of a bijection given by parameters on M × analogously to (3.1).
Proof Let Q be the pullback of M by f 1 ×f 2 with f 1 and f 2 as in (6.6.1). Then the lift f 1 ×f 2 : Q × → M × isétale at any point β ∈ Q(F p ) lying over b = (b 1 , . . . , b 2g ) ∈ (C 2g )(F p ) and induces a bijection between Q × (Z/p 2 ) b and M × (Z/p 2 ) (D,E) . In particular we can interpret s D,E (λ, µ) as a section of Q(b 1,λ 1 , . . . b 2g,µg ) and we can interpret the parametrization in Lemma 6.6.8 as a parametrization of Q × (Z/p 2 ) ξs D,E (0,0) . It is then enough to prove that the parametrization in Lemma 6.6.8 is the inverse of a bijection given by parameters on Q × . It comes from the definition of c ν for c ∈ C(Z/p 2 ) and ν ∈ F p , that the maps λ i µ i : C 2g (Z/p 2 ) b → F p are given by parameters in O C 2g ,b divided by p. In order to see that also the coordinate τ : Q × (Z/p 2 ) ξs D,E (0,0) → F p is given by a parameter divided by p it is enough to prove that there is an open subset U ⊂ C 2g containing b and a section s trivializing Q| U such that s D,E (λ, µ) = s(b 1,λ 1 , . . . , b 2g,µg ). Remark 6.3.12 and (6.5.1) give that (6.6.16) where ∆ ⊂ C×C is the diagonal and π i is the i-th projection C g × C g → C. We can prove that there is an open subset U ⊂ C g ×C g containing b and a section s trivializing Q| U such that s D,E (λ, µ) = s(b 1,λ 1 , . . . , b 2g,µg ), by trivializing each factor of the above tensor product in a neighborhood of b. Let us see it, for example, for the pieces of the form (π i , π g+j ) * O C×C (∆). Let π 1 , π 2 be the two projections C × C → C and let us consider the divisor ∆: for each pair of points c 1 , c 2 ∈ C(F p ) the invertible O-module O C×C (−∆) is generated by the section x ∆,c 1 ,c 2 := 1 in a neighborhood of (c 1 , c 2 ) if c 1 = c 2 , while it is generated by the section x ∆,c 1 , which is a factor in (6.6.7). This gives a section s i,j trivializing (π i , π g+j ) * O C×C (∆) in a neighborhood of b. With similar choices we can find sections trivializing the other factors in (6.6.16) in a neighborhood of b and tensoring all such sections we get a section s such that s D,E (λ, µ) = s(b 1,λ 1 , . . . , b 2g,µg ).

Extension of the Poincaré biextension over Néron models
Let C over Z be a curve as in Section 2. Let q be a prime number that divides n. We also write C for C Zq . Let J be the Néron model over Z q of Pic 0 C/Qq , and J 0 its fibre-wise connected component of 0. On (J × Zq J) Qq we have M as in Proposition 6.3.2, rigidified at 0 × J Qq and at J Qq × 0. Let us now prove that the G m -torsor M × on J × Zq J 0 has a unique biextension structure, extending that of M × . Over J × Zq J × Zq J 0 we have the invertible O-modules whose fibres, at a point (x, y, z) (with values in some Z q -scheme) are M(x + y, z) and M(x, z) ⊗ M(y, z). The biextension structure of M × gives an isomorphism between the restrictions of these over Q q , that differs from an isomorphism over Z q by a divisor with support over F q . The compatibility with the rigidification of M over J × Zq 0 proves that this divisor is zero. The other partial group law, and the required properties of them follow in the same way. We have now shown that M × extends the biextension M × .

Explicit description of the extended Poincaré bundle
Let C over Z be a curve as in Section 2. Let q be a prime number that divides n. We also write C for C Zq . By [22], Corollary 9.1.24, C is cohomologically flat over Z q , which means that for all Z q -algebras A, O(C A ) = A. Another reference for this is [28], (6.1.4), (6.1.6) and (7.2.1).
The relative Picard functor Pic C/Zq sends a Z q -scheme T to the set of isomorphism classes of (L, rig) with L an invertible O-module on C T and rig a rigidification at b. By cohomological flatness, such objects are rigid. But if the action of Gal(F q /F q ) on the set of irreducible components of C Fq is non-trivial, then Pic C/Zq is not representable by a Z q -scheme, only by an algebraic space over Z q (see [28], Proposition 5.5). Therefore, to not be annoyed by such inconveniences, we pass to S := Spec(Z unr q ), the maximal unramified extension of Z q . Then Pic C/S is represented by a smooth S-scheme, and on C × S Pic C/S there is a universal pair (L univ , rig) ( [28], Proposition 5.5, and Section 8.0). We note that Pic C/S → S is separated if and only if C Fq is irreducible.

Let Pic
[0] C/S be the open part of Pic C/S where L univ is of total degree zero on the fibres of C → S. It contains the open part Pic 0 C/S where L univ has degree zero on all irreducible components of C F q .
Let E be the closure of the 0-section of Pic C/S , as in [28]. It is contained in Pic C/S . By [28], Proposition 5.2, E is represented by an S-group scheme,étale.
By [28], Theorem 8.1.4, or [9], Theorem 9.5.4, the tautological morphism Pic [0] C/S → J is surjective (for theétale topology) and its kernel is E, and so J = Pic  C/S → J induces an isomorphism Pic 0 C/S → J 0 . Let C i , i ∈ I, be the irreducible components of C F q . Then, as divisors on C, we have For L an invertible O-module on C F q , its multidegree is defined as and its total degree is then The multidegree induces a surjective morphism of groups (6.8.4) mdeg : Pic C/S (S) → Z I . Now let d ∈ Z I be a sufficiently large multidegree so that every invertible O-module L on C Fq with mdeg(L) = d satisfies H 1 (C F q , L) = 0 and has a global section whose divisor is finite. Let L 0 be an invertible O-module on C, rigidified at b, with mdeg(L 0 ) = d. Then over C × S J 0 we have the invertible O-module L univ ⊗ L 0 , and its pushforward E to J 0 . Then E is a locally free O-module on J 0 . Let E be the geometric vector bundle over J 0 corresponding to E. Then over E, E has its universal section. Let U ⊂ E be the open subscheme where the divisor of this universal section is finite over J 0 . The J 0 -group scheme G m acts freely on U. We define V := U/G m . As the G m -action preserves the invertible O-module and its rigidification, the morphism U → J 0 factors through U → V and gives a morphism Σ L 0 : V → J 0 . Then on C × S V we have the universal effective relative Cartier divisor D univ on C × S V → V of multidegree d, and L univ ⊗ L 0 together with its rigidification at b is (uniquely) isomorphic to Then Σ L 0 sends, for T an S-scheme, a T -point D on with its rigidification at b. Let s 0 be in L 0 (C) such that its divisor D 0 is finite over S, and let v 0 ∈ V (S) be the corresponding point.

On Pic
[0] C/S × S V × S C we have the universal L univ from Pic [0] C/S with rigidification at b, and the universal divisor D univ . Then on Pic C/S × S v 0 : (6.8.6) N q,d : Pic

Any global regular function on the integral scheme Pic
[0] C/S × S V is constant on the generic fibre, hence in Q unr q , and restricting it to (0, v 0 ) shows that it is in Z unr q , and if it is 1 on Pic C/S × S v 0 , it is equal to 1. Therefore trivialisations on Pic  C/S × S V . The next proposition generalises [25], Corollary 2.8.6 and Lemma 2.7.11.2: there, C → S is nodal (but not necessarily regular), and the restriction of M to J 0 × S J 0 is described.

Proposition
In the situation of Section 6.8, the pullback of the invertible O-module M on J × Z unr q J 0 to Pic In a diagram: For T any Z unr q -scheme, for x in J(T ) given by an invertible O-module L on C T rigidified at b, and y in J 0 (T ) = Pic 0 C/Z unr q (T ) given by the difference D = D + − D − of effective relative Cartier divisors on C T of the same multidegree, we have Proof The scheme Pic q , hence regular, it is connected, hence integral, and since V Fq is irreducible, the irreducible components of (Pic which, by the way, equals the kernel of Z I → Z, x → j∈I m j x j .
We prove the first claim. Both N q,d and the pullback of M are rigidified on Pic [0] C/Z unr q × v 0 . Below we will give, after inverting q, an isomorphism α from N q,d to the pullback of M that is compatible with the rigidifications. Then there is a unique divisor D α on Pic

and let x be in Pic
[0] C/Z unr q (Z unr q ) specialising to an F q -point of P i , then restricting α to (x i , v 0 ) and using the compatibility of α (over Q unr q ) with the rigidifications, gives that the multiplicity of P i × V Fq in D α is zero. Hence D α is zero.
Let us now give, over (Pic  C/Z unr q ) Q unr q = J Q unr q , and that V Q unr q = C (|d|) Q unr q , where |d| = i m i d i is the total degree given by the multidgree d. For T a Q unr q -scheme, x ∈ J(T ) given by L an invertible O C T -module rigidified at b, and v ∈ V (T ) given by a relative Cartier divisor D of degree |d| on C T , we have, using Proposition 6.3.2 and (6.8.6), the following isomorphisms (functorial in T ), respecting the rigidifications at v = v 0 : This finishes the proof of the first claim of the Proposition. The second claim follows directly from the definition of N q,d , plus the compatibility at the end of Proposition 6.3.2.

Integral points of the extended Poincaré torsor
Let C over Z be a curve as in Section 2. Given a point (x, y) ∈ (J × J 0 )(Z) we want to describe explicitly the free Z-module M(x, y) when x is given by an invertible O-module L of total degree 0 on C rigidified at b and y is given as a relative Cartier divisor D on C of total degree 0 with the property that there exists a unique divisor V whose support is disjoint from b and contained in the bad fibres of C → Spec(Z) such that O(D+V ) has degree zero when restricted We write V = q|n V q where V q is a divisor supported on C Fq . For every prime q dividing n let C i,q , i ∈ I q the irreducible components of C Fq with multiplicity m i,q and let V i,q be the integers so that V q = i∈Iq V i,q C i,q .

Proposition
The integers in (6.9.2) are given by Proof For every q dividing n let H q be an effective relative Cartier divisor on C Zq whose complement U q is affine (recall that C is projective over Z, take a high degree embedding and a hyperplane section that avoids chosen closed points c i,q on the C i,q ). The Chinese remainder theorem, applied to the O C (U q )-module (O C (D + V ))(U q ) and the (distinct) closed points c i,q , provides an element f q of (O C (D + V ))(U q ) that generates O C (D + V ) at all c i,q . Let D q = D + q − D − q be the divisor of f q as rational section of O C (D + V ). Then D + q and D − q are finite over Z q , and f q is a rational function on C Zq with This linear equivalence, restricted to Q q , gives, via the definition in (6.4.7), the isomorphism (6.9.5) ϕ : Tensoring with Norm (D − +D − q )/Qq (L) −1 we obtain the isomorphism (6.9.6) ϕ ⊗ id : using the identifications (6.9.7) Using the same method as for getting the rational section f q of O C (D + V ), we get a rational section l of L with the support of div(l) finite over Z q and disjoint from the supports of D and D q , and from the intersections of different C i,q and C j,q . By Proposition 6.8.7, and the choice of l, and (6.9.9) By (6.4.4), we have that ϕ ⊗ id maps Comparing with (6.9.2), we conclude that (6.9.11) e q = v q (f q (div(l))) .
We write div(l) = j n j D j as a sum of prime divisors. These D j are finite over Z q , disjoint from the support of the horizontal part of div(f q ), that is of D q − D, and each of them meets only one of the C i,q , say C s(j),q . Then, for each j, f m s(j),q q and q −V s(j),q have the same multiplicity along C s(j),q , and consequently they differ multiplicatively by a unit on a neighborhood of D j . Then we have We get (6.9.13)

Description of the map from the curve to the torsor
The situation is as in Section 2. The aim of this section is to give descriptions of all morphisms in the diagram (2.12), in terms of invertible O-modules on (C × C) Q and extensions of them over C × U, to be used for doing computations when applying Theorem 4.12. The main point is that each tr c i • f i is described in (7.4) as a morphism (of schemes) α L i : J Q → J Q with L i an invertible O-module on C × U, and that Proposition 7.8 describes ( j b ) i : C Z[1/n] → T i . For finding the line required line bundles, see [12]. We describe the morphism j b : U → T in terms of invertible O-modules on C ×C sm . Since T is the product, over J, of the G m -torsors T i := (id, m· • tr c i • f i ) * P × this amounts to describing, for each i, the morphism ( j b ) i : U → T i . Note that tr c i • f i : J Q → J Q is a morphism of groupschemes composed with a translation, and that all morphisms of schemes α : J Q → J Q are of this form. From now on we fix one such i and omit it from our notation.
Let α : J Q → J Q be a morphism of schemes, let L α be the pullback of M (see (6.3.3)) to , and let T α := (id, α) * M × on J Q : Then (b, id) * L α = O C Q , L α is of degree zero on the fibres of pr 2 : (C × C) Q → C Q , and: j * b T α is trivial if and only if diag * L α is trivial. Note that diagram (7.1) without the G m -torsors is commutative.
Conversely, let L be an invertible O-module on (C × C) Q , rigidified on {b} × C Q , and of degree 0 on the fibres of pr 2 : (C × C) Q → C Q . The universal property of L univ gives a unique β L : C Q → J Q such that (id × β L ) * L univ = L (compatible with rigidification at b). The Albanese property of j b : C Q → J Q then gives that β L extends to a unique α L : J Q → J Q such that α L • j b = β L . Then j * b T α L is trivial if and only if diag * L is trivial. We have proved the following proposition.

Proposition
In the situation of Section 2, the above maps α → L α and L → α L are inverse maps between the sets correspond to 1. Then m· • α L extends over Z to m· • α L : J → J 0 , and the restriction of j * b (m· • α L ) * M on C sm to U is trivial, giving a lift j b , unique up to sign: The invertible O-module L on (C × C) Q with its rigidification of (b, id) * L, extends uniquely to an invertible O-module on (C × C) Z[1/n] , still denoted L.

Proposition
Let S be a Z[1/n]-scheme, let d and e be in Z ≥0 , and let D ∈ C (d) (S) and E ∈ C (e) (S). Then we have: .
Proof We may and do assume (finite locally free base change on S) that we have x i and y j in C(S), such that D = i x i and E = j y j . Recall that, for c ∈ C(S), β L (c) in J(S) is (id, c) * L on C S , with its rigidification at b. Then we have: from which the desired equality follows. Now we prove the second claim. Let x be in C(S). The first equality holds by definition. Taking D = E = x in what we just proved, gives the second equality, and the third comes from the rigidification at b. Now let L be any extension of L with its rigidification of (b, id) * L from (C × C) Z[1/n] to C × U. For q dividing n, let W q be the valuation along U Fq of the rational section ℓ of diag * L on U. Then ℓ, multiplied by the product, over the primes q dividing n, of q −Wq , generates diag * L on U: There is a unique divisor V on C × U with support disjoint from (b, id)U and contained in the (C × U) Fq with q dividing n, such that has multidegree 0 on the fibres of pr 2 : C × U → U. Then L m is the pullback of L univ via id , because on C sm × J 0 the restriction of L univ and (j b × id) * M are equal (both are rigidified after (b, id) * and equal over Z[1/n]; here we use that, for all q|n, J 0 Fq is geometrically connected). Hence, on U we have j * b T m·•α L = diag * (L ⊗m (V ) × ), compatible with rigidifications at b ∈ U(Z[1/n]). Our trivialisation j b on U of T m·•α L is therefore a generating section of L ⊗m , multiplied by the product over the q dividing n, of the factors q −Vq , where V q is the multiplicity in V of the prime divisor (U × U) Fq . This means that we have proved the following proposition.

7.8
Proposition For x and S as in Proposition 7.5, we have the following description of j b : 8 An example with genus 2, rank 2, and 14 points The example that we are going to treat is the quotient of the modular curve X 0 (129) by the action of the group of order 4 generated by the Atkin-Lehner involutions w 3 and w 43 . An equation for this quotient is given in the table in [18], and Magma has shown that that equation and the equations below give isomorphic curves over Q.
Let C 0 be the curve over Z obtained from the following closed subschemes of A 2 by glueing the open subset of V 1 where x is invertible with the open subset of V 2 where z is invertible using the identifications z = 1/x, w = y/x 3 . The scheme C 0 can be also described as a subscheme of the line bundle L 3 associated to the invertible O-module O P 1 Z (3) on P 1 Z with homogeneous coordinates X, Z: the map O P 1 Z (3) → O P 1 Z (6) sending a section Y to Y ⊗Y +Z 3 ⊗Y induces a map ϕ from L 3 to the line bundle L 6 associated to O(6); then C 0 is isomorphic to the inverse image by ϕ of the section s := X 6 −3X 5 Z+X 4 Z 2 +3X 3 Z 3 −X 2 Z 4 −XZ 5 of L 6 and since the map ϕ is finite of degree 2 then C 0 is finite of degree 2 over P 1 Z . Hence C 0 is proper over Z and it is moreover smooth over Z[1/n] with n = 3 · 43. The generic fiber of C 0 is a curve of genus g = 2, labeled 5547.b.16641.1 on www.lmfdb.org. The only point where C 0 is not regular is the point P 0 = (3, x − 2, y − 1) contained in V 1 and the blow up C of C 0 in P 0 is regular.
In the rest of this section we apply our geometric method to the curve C and we prove that C(Z) contains exactly 14 elements. We use the same notation as in Sections 2 and 4.
The fiber C F 43 is absolutely irreducible while C F 3 is the union of two geometrically irreducible curves, a curve of genus 0 that lies above the point P 0 and that we call K 0 , and a curve of genus 1 that we call K 1 . We define U 0 := C \ K 1 and U 1 := C \ K 0 so that C(Z) = C sm (Z) = U 0 (Z) ∪ U 1 (Z) and both U 0 and U 1 satisfy the hypothesis on U in Section 2.
We have K 0 · K 1 = 2 and consequently the self-intersections of K 0 and K 1 are both equal to −2. We deduce that all the fibers of J over Z are connected except for J F 3 which has group of connected components equal to Z/2Z. Hence, The automorphism group of C is isomorphic to (Z/2Z) 2 , generated by the automorphisms ι and η lifting the extension to C 0 of ι, η : The quotients E 1 := C Q /η and E 2 := C Q /(ι • η) are curves of genus 1 and the two projections C → E i induce an isogeny J → Pic 0 (E 1 ) × Pic 0 (E 2 ). The elliptic curves Pic 0 (E i ) are not isogenous and ρ = 2.

The torsor on the jacobian
Let ∞, ∞ − ∈ C(Z) be the lifts of (0, 1), (0, −1) ∈ V 2 (Z) ⊂ C 0 (Z) and let us fix the base point b = ∞ in C(Z). Following Section 7 we describe a G m -torsor T → J and maps j b,i : U i → T using invertible O-modules on C × C sm . The torsor T = (id, m· • α) * M × only depends on the scheme morphism α : J Q → J Q , which, by Proposition 7.2, is uniquely determined by an invertible O-module L on (C × C) Q , rigidified on {b} × C Q , of degree 0 on the fibres of pr 2 : (C × C) Q → C Q , and such that diag * L is trivial. We now look for a non-trivial O-module L with these properties using the homomorphism η * : J Q → J Q , which does not belong to Z ⊂ End(J Q ). We can take α of the form tr c • (n 1 ·η * + n 2 ·id), where id : J Q → J Q is the identity map, n i are integers and c lies in J(Q). Using the map α → L α : where D is a divisor on C Q representing c, the maps pr i are the projections C Q × C Q → C Q and Γ η is the graph of the map η : C → C. Hence, we can take L of the form O C Q ×C Q (n 1 Γ η,Q + n 2 diag(C Q ) + pr * 1 D 1 + pr * 2 D 2 ) for some integers n i and some divisors D i on C Q . Among the O-modules of this form satisfying the needed properties, we choose When restricted to the diagonal L is trivial since, compatibly with the trivialisation at (b, b), In particular, the global section l := 1 of O C Q gives a rigidification of diag * L that we write as Following Proposition 7.8 and the discussion preceding it, we choose the extension of L over Using Proposition 7.8 we now compute j b,0 and j b,1 . Since l generates diag * (L) on the whole C sm , we have W 3 = W 43 = 0. The invertible O-module L ⊗m has multidegree 0 over all the fibers C × U 1 → U 1 , hence in order to compute j b,1 we must take V = 0 in (7.7), giving V 3 = V 43 = 0.
Hence for S and x as in (8.2.1), assuming moreover that 2 is invertible on S, where the last equality in (8.2.2) makes sense if the image of x is disjoint from ∞, ∞ − in C S . The restriction L ⊗m to C × U 0 has multidegree 0 over all the fibers C × U 0 → U 0 of characteristic not 3, while if we consider a fiber of characteristic 3 it has degree 2 over K 0 and degree −2 over K 1 . Hence for computing j b,0 we take V = K 0 × (K 0 ∩ U 0 ) in (7.7) giving V 43 = 0, V 3 = 1. Hence for S and x as in (8.2.1), assuming moreover that 2 is invertible on S, where the last equality in (8.2.3) makes sense if the image of x is disjoint from ∞, ∞ − in C S .

Some integral points on the biextension
On C 0 we have the following integral points that lift uniquely to elements of C(Z) Computations in Magma confirm that J(Z) is a free Z-module of rank r = 2 generated by The points in T (Z) are a subset of points of M × (Z) that can be constructed, using the two group laws, from the points in M × (G i , m·f (G j ))(Z) and M × (G i , m·D 0 )(Z) for i, j ∈ {1, 2}. Let us compute in detail M × (G 1 , m · f (G 1 ))(Z). As explained in Proposition 6.9.3, we have where, given a scheme S, an invertible O-module L on C S and a divisor D Since C F 43 is irreducible then 2f (G 1 ) has already multidegree 0 over 43, hence e 43 = 0. If we look at C F 3 then 2f (G 1 ) does not have multidegree 0, while 2f (G 1 ) + K 0 has multidegree 0; hence, by Proposition 6.9.3, Notice that over Z[ 1 2 ] the divisor G 1 is disjoint from β and δ (to see that it is disjoint from δ = (−1, −2, 1) over the prime 3 one needs to look at local equations of the blow up) thus β * O C (γ − α) and δ * O C (γ − α) are generated by β * 1 and δ * 1 over Z[ 1 2 ]. Thus there are integers e β , e δ such that β * O C (γ −α) and δ * O C (γ −α) are generated by β * 2 e β and δ * 2 e δ over Z. Looking at the intersections between β, γ, α and δ we compute that e β = −1 and e δ = 1, hence With analogous computations we see that

Some residue disks of the biextension
Let p be a prime of good reduction for C. Given the divisors we use Lemma 6.6.8 to give parameters on the residue disks in M × (Z/p 2 ) D,E and T (Z/p 2 ) D , with D, E the images of D, E in Div(C Fp ). We choose the "base points x β = x and x D,β = x D,∞ − = 1, x D,∞ = z −1 . For Q in {∞, β, α} and a ∈ F p let Q a be the unique Z/p 2 -point of C that is congruent to Q modulo p and such that x Q (Q a ) = ap ∈ Z/p 2 . We have the bijections 8.5 Geometry mod p 2 of integral points From now on p = 5. Let α ∈ C(Z/p 2 ) be the image of α ∈ C(Z). In this subsection we compute the composition κ : Z 2 → T (Z/p 2 ) j b,1 (α) of the map κ Z : Z 2 → T (Z p ) j b,1 (α) in (4.9) and the reduction map T (Z p ) j b,1 (α) → T (Z/p 2 ) j b,1 (α) . With a suitable choice of parameters in O T, j b,1 (α) , the map κ Z is described by integral convergent power series κ 1 , κ 2 , κ 3 ∈ Z p z 1 , z 2 and κ, composed with the inverse of the parametrization (8.4.1), is given by the images The divisor j b (α) is equal to the image of G t := e 0,1 G 1 + e 0,2 G 2 with e 0,1 := 6 , e 0,2 := 3 in J(F p ) and is a lift of j b,1 (α). The kernel of J(Z) → J(F p ) is a free Z-module generated by G 1 := e 1,1 G 1 + e 1,2 G 2 , G 2 := e 2,1 G 1 + e 2,2 G 2 , with e 1,1 := 16 , e 1,2 := 2 , e 2,1 := 0 , e 2,2 := 5 .
. We now show these computations in the cases of G t andt. The Riemann-Roch space relative described in Equation (6.4.1) sends

8.6
The rational points with a specific image mod 5.

Determination of all rational points
Using that for any point Q in C(F p ) the condition Applying our method to ∞ we discover that U 1 (Z) ∞ contains at most 2 points and the same holds for U 1 (Z) ∞ − . Moreover the action of η, ι on C(Z) tells that U 1 (Z) ι(α) , U 1 (Z) η(α) and U 1 (Z) ηι(α) are sets containing exactly 2 elements. Hence contains at most 12 elements. Looking at the orbits of the action of η, ι on U 1 (Z) we see that #U 1 (Z) ≡ 2 (mod 4), hence #U 1 (Z) ≤ 10. Since U 1 (Z) contains ∞, ∞ − and all the images by η, ι of U 1 (Z) α we conclude that #U 1 (Z) = 10. Applying our method to the point γ we see that U 0 (Z) γ contains at most two points, one of them being γ. Moreover solving the equations κ * f i = 0 we see that if there is another point γ ′ in U 0 (Z) γ then there exist n 1 , n 2 ∈ Z such that Using the Mordell-Weil sieve (see [27]) we derive a contradiction: for all integers n 1 , n 2 , the image in J(F 7 ) of 39G 1 +17G 2 +5n 1 G 1 +5n 2 G 2 is not contained in j b (C(F 7 )). We deduce that Applying our method to to ε we see that U 0 (Z) ε contains at most 2 points corresponding to two different solutions to the equations κ * f i = 0. We can see that one of the two solutions does not lift to a point in U 0 (Z) ε in the same way we excluded the existence of γ ′ ∈ U 0 (Z) γ . Hence U 0 (Z) ε has cardinality at most 1. Using that for every Q ∈ C(F p ) and every automorphism ω of C we have #U 0 (Z) Q = #U 0 (Z) ω(Q) , we deduce that contains at most 6 points. Looking at the orbits of the action of η, ι on U 0 (Z) we see that #U 0 (Z) ≡ 0 (mod 4), hence #U 4 (Z) ≤ 4, and since U 0 (Z) contains the orbit of γ we conclude that #U 0 (Z) = 4. Finally #C(Z) = #U 0 (Z) + #U 1 (Z) = 4 + 10 = 14 .
The fundamental group π 1 (P × (C), 1) is also known as a Heisenberg group. Its action on D τ is given in [6, (4.5.3)]. Now recall the definition of T in (2.12). As M 2g,1 (Z) is the lattice of J(C), and M 1,2g (Z) the lattice of J ∨ (C), each f i is given by an antisymmetric matrix f i,Z in M 2g,2g (Z) such that for all y in M 2g,1 (Z) we have f i (y) = y t ·f i,Z , and by a complex matrix f i,C in M g,g (C) such that for all v in M g,1 (C), for each i we have f i (v) = v t ·f i,C in M 1,g (C). For more details about this description of the f i see the beginning of [6, §4.7]. Then we have with m·f (y) ∈ M ρ−1,2g (Z) with rows the m·y t ·f i,Z . So, π 1 (T (C)) is a central extension of M 2g,1 (Z) by M ρ−1,1 (Z), with commutator pairing sending (y, y ′ ) to (2my t ·f i,Z ·y ′ ) i . The universal covering T (C) is given by with m·(c + f (v)) ∈ M ρ−1,g (C) with rows the m·( c i + v t ·f i,C ) with c i a lift of c i in M 1,g (C). The action of π 1 (T (C), 1) on T (C) is given again, with the necessary changes, by [6, (4.5.3)]. Now that we know π 1 (T (C), 1) we investigate which quotient of π 1 (C(C), b) it is, via j b : C(C) → T (C). We consider the long exact sequence of homotopy groups induced by the C ×,ρ−1 -torsor T (C) → J(C), taking into account that C ×,ρ−1 is connected and that π 2 (J(C)) = 0: Again we see that π 1 (T (C), 1) is a central extension of the free abelian group π 1 (J(C), 0) by Z ρ−1 , and from the matrix description we know that the ith coordinate of the commutator pairing is given by mf Dually, this means that π 1 (T (C), 1) arises as the pushout (9.1.12) where the subscript (0, 0) means the largest quotient of type (0, 0), where the subscript Gal(Q/Q) means co-invariants modulo torsion, and where the left vertical map is m times the quotient map. We repeat that the morphism from π 1 (C(C)) = G to π 1 (T (C), 1) given by the middle vertical map is induced by j b : C(C) → T (C).

Finiteness of rational points
In this section we reprove Faltings's finiteness result [16] in the special case where r < g + ρ − 1. This was already done in [4], Lemma 3.2 (where the base field is either Q or imaginary quadratic). We begin by collecting some ingredients on good formal coordinates of the G mbiextension P ×,ρ−1 → J × J ∨,ρ−1 over Q, and on what C looks like in such coordinates.

Formal trivialisations
Let A, B and G be connected smooth commutative group schemes over a field k ⊃ Q, and let E → A × B be a commutative G-biextension. Let a be in A(k), b ∈ B(k) and e ∈ E(k). For n ∈ N, let A a,n be the nth infinitesimal neighborhood of a in A, hence its coordinate ring is O A,a /m n+1 a . We use similar notation for B with b, and E with e, and also for the points 0 of A, B and E, and, similarly, the formal completion of A at a is denoted by A a,∞ , etc. We also use such notation in a relative context, for example, for the group schemes E → B and E → A. We view completions as A a,∞ as set-valued functors on the category of local k-algebras with residue field k such that every element of the maximal ideal is nilpotent. For such a k-algebra R, A a,∞ (R) is the inverse image of a under A(R) → A(k). Then A 0,∞ is the formal group of A.
We now want to show that the formal G 0,∞ -biextension E 0,∞ → A 0,∞ × B 0,∞ is isomorphic to the trivial biextension (the object G 0,∞ × A 0,∞ × B 0,∞ with + 1 given by addition on the 1st and 2nd coordinate, and + 2 by addition on the 1st and 3rd coordinate). As exp for A 0,∞ gives a functorial isomorphism T A/k (0) ⊗ k G a 0,∞ k → A 0,∞ , and similarly for B and G, it suffices to prove this triviality for G 0,∞ a -biextensions of G 0,∞ a × G 0,∞ a over k. One easily checks that the group of automorphisms of the trivial G 0,∞ a -biextension of G 0,∞ a × G 0,∞ a over k that induce the identity on all three G 0,∞ a 's is (k, +), with c ∈ k acting as (g, a, b) → (g + cab, a, b). As this group is commutative, it then follows that the group of automorphisms of the G 0,∞ -biextension E 0,∞ → A 0,∞ × B 0,∞ that induce identity on G 0,∞ , A 0,∞ ,and B 0,∞ , is equal to the k-vector space of k-bilinear maps T A/k (0) × T B/k (0) → T G/k (0). This indicates how to trivialise E 0,∞ . We choose a sectionẽ of the G-torsor E → A × B over the closed subscheme A 0,1 × B 0,1 of A × B: withẽ(0, 0) = e in E(k).
There are unique such linear maps such that the adjustedẽ is compatible with the given trivialisations of E → A × B over A 0,1 × B 0,0 and over A 0,0 × B 0,1 . In geometric terms,ẽ, assumed to be adjusted, is then a splitting of T G (0) B ֒→ T E/B (0) ։ T A (0) B over B 0,1 that is compatible with the already given splitting over 0 ∈ B(k), and it is also a splitting of T G (0) A ֒→ T E/A (0) ։ T B (0) A over A 0,1 that is compatible with the already given splitting over 0 ∈ A(k). The splitting over B 0,1 gives an isomorphism from (T G (0) ⊕ T A (0)) B 0,1 to (T E/B ) B 0,1 . So the exponential map, for + 1 , for the pullback to B 0,1 of E → B, gives an isomorphism of formal groups over B 0,1 : Viewing E 0,∞ B 0,1 as the tangent space at the zero section of the pullback to A 0,∞ of E → A, this isomorphism gives a splitting of T G (0) A ֒→ T E/A (0) ։ T B (0) A over A 0,∞ . The exponential map for + 2 for the pulback to A 0,∞ of E → A then gives an isomorphism of formal groups over A 0,∞ : where E 0,∞ A 0,∞ /A 0,∞ denotes the completion along the zero section of the pullback via A 0,∞ → A of E → A. The compatibility between + 1 and + 2 on E ensures that this isomorphism is an isomorphism of biextensions, with the trivial biextension structure on the left. Now that we know what good formal coordinates at 0 in E(k) are, we look at the point e in E(k), over (a, b) in (A × B)(k). We produce an isomorphism E 0,∞ → E e,∞ , using the partial group laws. Let E b be the fibre over b of E → B. We choose a section The exponentials for the group laws of E b and A then give a section that we view as an A a,∞ -valued point of E b , and as a section of the group scheme E A a,∞ → A a,∞ , with group law + 2 . The translation byẽ ∞ 1 on this group scheme induces translation by b on B A a,∞ , and maps (a, 0), the 0 element of E a , to e. Hence it induces an isomorphism of formal schemes E (a,0),∞ → E e,∞ . In order to get an isomorphism E 0,∞ → E (a,0),∞ , we repeat the process above, but with the roles of A and B exchanged. We choose a section0 2 : {a} × B 0,1 → E a of E a → {a} × B. Then the exponential for + 2 gives us a section0 ∞ 2 : {a} × B 0,∞ → E a of E a → {a}×B. This0 ∞ 2 is a section of the group scheme E B 0,∞ → B 0,∞ , and the translation on it by0 ∞ 2 sends 0 in E(k) to (a, 0), hence gives an isomorphism of formal schemes E 0,∞ → E (a,0),∞ . Composition then gives us an isomorphism E 0,∞ → E e,∞ , and the good formal coordinates on E at 0 ∈ E(k) give what we call good formal coordinates at e. Similarly, we get a section 0 ∞ 1 of E A 0,∞ → A 0,∞ and a section e ∞ 2 of E B b,∞ → B b,∞ giving isomorphisms E 0,∞ → E (0,b),∞ and E (0,b),∞ → E e,∞ , hence by composition a 2nd isomorphism E 0,∞ → E e,∞ . These isomorphisms are equal for a unique choice of0 1 andẽ 2 (given the choices of0 2 andẽ 1 ).
In Section 9.2.3 we will use that these isomorphisms transport all additions that occur in (4.4) to additions in E 0,∞ and therefore to additions in the trivial formal biextension.

Zariski density of the curve in formally trivial coordinates
Let C be as in the beginning of Section 2. Let C(C) be the inverse image of C(C) under the universal cover T (C) → T (C). Then C(C) is connected since j b : C → T gives a surjection on complex fundamental groups. Now we consider the complex analytic variety T (C) as a complex algebraic variety via the bijection T (C) = C g+ρ−1 as given in (9.1.4). The analytic subset C(C) contains the orbit of 0 under π 1 (T (C), 1). This orbit surjects to the lattice of J(C) in M g,1 (C), and over each lattice point, its fibre in M ρ−1,1 (C) contains a translate of 2πiM ρ−1,1 (Z). Hence this orbit is Zariski dense in C g+ρ−1 . It follows that the formal completion of C(C) at any of its points is Zariski dense in C g+ρ−1 : if a polynomial function on C g+ρ−1 is zero on such a completion, then it vanishes on the connected component of C(C) of that point, hence on C(C) and consequently on T (C).
We express our conclusion in more algebraic terms: for c ∈ C(C), with images t ∈ T (C) and in P ×,ρ−1 (C), each polynomial in good formal coordinates at t of the biextension P ×,ρ−1 → J×J ∨ over C that vanishes on j b (C c,∞ C ), vanishes on T t,∞ C . This statement then also holds with C replaced by any subfield, or even any subring of the form Z (p) with p a prime number, or the localisation of Z (the integral closure of Z in C) at a maximal ideal.

The p-adic closure in good formal coordinates
We stay in the situation of Section 2, but we denote G := G ρ−1 m , A := J and B := J ∨,0ρ−1 , and E := P ×,ρ−1 . Let d G , d A , and d B be their dimensions: d G = ρ − 1, d A = g and d B = (ρ − 1)g.
Let p > 2 be a prime number. From Section 9.2.1 and Lemma 5.1.1 we conclude that we can choose formal parameters for E at 0, over Z (p) , such that they converge on the residue polydisk E(Z p ) 0 , and such that they induce the trivial biextension structure on Z d G p × Z d A p × Z d B p . We keep the notation of Section 9.2.1, for e in E(Z p ), lying over (a, b) in (A × B)(Z p ). This e plays the role that t has at the beginning of Section 4. As explained at the end of Section 9.2.1, we Let p > 2 be a prime number of good reduction for C. We consider the Poincaré torsor as l b and l. Choosing a section that trivializes L on an open subset of (C × C) Zp containing (b, b), (c, b), and (c, c) in (C × C)(F p ) we get a divisor D on (C × C) Zp whose support is disjoint from (c, b) and (c, c), and an isomorphism between L and O(D) on (C × C) Zp . After modifying D with a principal horizontal divisor and a principal vertical divisor D| C×{b} and diag * D are both equal to the the zero divisor on C Zp , hence l b and l are the extensions of elements of Q p , interpreted as rational sections of O(D) on (C × C) Zp . By Propositions 7.5 and 7.8, there exists a unique λ ∈ Q × p such that, for each d ∈ C(Z p ) c , Since x j is the j-th coordinate of log J and since z is the pullback of ψ, we deduce that It should now be easy to exactly interpret geometrically the cohomological approach, showing that in the coordinates used here, the equations for C(Q p ) 2 are precisely equations for the intersection of C(Q p ) and the p-adic closure of T (Z). For doing computations, one can do them in the geometric context of this article, or, as in [5], in terms of theétale fundamental group of C. The connection between these is then given by p-adic local systems on T .
Author contributions This project started with an idea of Edixhoven in December 2017. From then on Edixhoven and Lido worked together on the project. Section 8 is due entirely to Lido. Section 9 was written in July and August 2020.