Tunnell's Theorem, #P-Completeness, and the Birch–Swinnerton-Dyer Conjecture

1. Introduction

The P versus NP problem stands as one of the most fundamental open questions in computer science and mathematics [1,2]. Its counting analogue, the question whether $\#\mathrm{P}=\mathrm{FP}$, is at least as hard: $\#\mathrm{P}=\mathrm{FP}$ implies $\mathrm{P}=\mathrm{NP}$, while the converse implication is not known. It is therefore consistent with present knowledge that

$$\mathrm{P}=\mathrm{NP}\mathrm{and}\#\mathrm{P}\ne \mathrm{FP},$$

(1)

a situation in which every NP search problem is easy but exact counting remains hard. We call (1) the scenario. Neither of its two parts has been proved, and most researchers expect $\mathrm{P}\ne \mathrm{NP}$; the scenario is nevertheless a precise and non-contradictory hypothesis, and this paper asks what it would imply for the Birch–Swinnerton-Dyer conjecture (BSD) [3] for the congruent number curves. The bridge between the two worlds is Tunnell’s theorem [4].

1.1. Background on Complexity Classes

The complexity class #P, introduced by Valiant [5,6], consists of counting problems associated with NP decision problems. Formally, a function $f:{\{0,1\}}^{*}\to \mathbb{N}$ belongs to #P if there exist a polynomial-time verifier V and a polynomial p such that

$$f(x)=|\{y\in {\{0,1\}}^{p(|x|)}:V(x,y)=1\}|.$$

A function f is #P-complete if $f\in \#\mathrm{P}$ and every $g\in \#\mathrm{P}$ reduces to f. Several notions of reduction are in use: parsimonious reductions ($g(x)=f(\sigma (x))$ with $\sigma$ polynomial-time computable), many-one counting reductions in the sense of Zankó [7] ($g(x)=\tau (x,f(\sigma (x)))$ with $\sigma ,\tau$ polynomial-time computable), and polynomial-time Turing reductions. The Cook–Levin reduction shows that #SAT is #P-complete under parsimonious reductions, whereas Valiant’s proof that the permanent is #P-complete uses Turing reductions [5]. Reductions that preserve counts only up to a polynomial factor are not sufficient for exact counting (Remark 7).

The functional class FP consists of functions computable in deterministic polynomial time. Being able to count witnesses lets one decide whether at least one exists, so $\#\mathrm{P}=\mathrm{FP}\Rightarrow \mathrm{P}=\mathrm{NP}$. The converse is open: even if $\mathrm{P}=\mathrm{NP}$, the threshold predicate $[\#I\ge k]$ (with k in binary) is PP-complete [8], and PP is not known to collapse to P under $\mathrm{P}=\mathrm{NP}$. By Toda’s theorem [9], $\mathrm{PH}\subseteq {\mathrm{P}}^{\mathrm{PP}}={\mathrm{P}}^{\#\mathrm{P}}$ [10]. In terms of decision classes the scenario (1) reads $\mathrm{P}=\mathrm{NP}$ and $\mathrm{P}\ne \mathrm{PP}$.

1.2. Background on Congruent Numbers and Tunnell’s Theorem

A positive integer n is called a congruent number if it is the area of a right triangle with rational side lengths [11]. Equivalently, n is congruent if and only if the elliptic curve

$$E_n:y^2=x^3-n^{2}x$$

has positive rank. Since n is congruent if and only if $n{k}^2$ is congruent for every positive integer k, it suffices to treat square-free n.

Tunnell [4] established a computationally explicit criterion. For a positive integer n, define

$$\begin{array}{cc}\hfill C_n& =\#\{(x,y,z)\in {\mathbb{Z}}^3:n=8x^2+2y^2+64z^2\},\hfill \\ \hfill D_n& =\#\{(x,y,z)\in {\mathbb{Z}}^3:n=8x^2+2y^2+16z^2\}.\hfill \end{array}$$

Theorem 1 

(Tunnell [4]). Let n be an even square-free positive integer.

1.

If n is congruent, then $2C_n=D_n$.

2.

Conversely, if the Birch–Swinnerton-Dyer conjecture holds for the elliptic curve $E_n$, then $2C_n=D_n$ implies that n is congruent.

The first part is unconditional: Tunnell expressed $L(E_n,1)$ as a non-zero constant multiple of the square of a Fourier coefficient of a weight-$3/2$ cusp form (see Proposition 3), using the Shimura correspondence [12] and Waldspurger’s theorem [13]; the theorem of Coates and Wiles [14] then shows that positive rank forces $L(E_n,1)=0$. An analogous statement, with two other ternary forms, holds for odd n; we only use the even case.

The congruum construction, dating back to Fibonacci, provides an explicit family of congruent numbers [15]. For integers $a>b\ge 1$ the number $g=4ab(a^2-b^2)$ is the common difference of the arithmetic progression of squares ${(a^2-2ab-b^2)}^2,{(a^2+b^2)}^2,{(a^2+2ab-b^2)}^2$, and it is four times the area of the integral right triangle with legs $a^2-b^2$ and $2ab$.

1.3. The Scenario and the Main Theorem

Tunnell’s counts are natural candidates for carrying $\#\mathrm{P}$-hard information, because they are $\#\mathrm{P}$ functions of n whose arithmetic is controlled by BSD. We show that the two counts behave very differently. On square-free $n\equiv 2(mod8)$ the count $D_n$ is twice a class number (Proposition 1), and class numbers are computable in polynomial time once $\mathrm{P}=\mathrm{NP}$ (Theorem 5); thus $D_n$ cannot carry $\#\mathrm{P}$-hardness in the scenario, and in general an exact reduction to $D_n$ would collapse the polynomial hierarchy (Theorem 12). The count $C_n$, by contrast, equals the same class number plus the Fourier coefficient of Tunnell’s cusp form (Lemma 3), and under BSD this coefficient is determined, up to sign, by the order of the Tate–Shafarevich group of $E_n$ (Proposition 4). BSD therefore converts knowledge of $\mathrm{Sha}(E_n)$ into knowledge of $C_n$ up to two candidates, and two candidates are enough to count exactly by the theorem of Cai and Hemachandra [16]. This yields our main result, stated in full as Theorem 8 and Corollary 2:

Main Theorem. Assume $\mathrm{P}=\mathrm{NP}$ and $\#\mathrm{P}\ne \mathrm{FP}$. If the Cusp Reduction Conjecture (Conjecture 6) and the Sha-Tractability Hypothesis (Conjecture 7) hold, then the Birch–Swinnerton-Dyer conjecture fails for infinitely many of the curves $E_n$ with n square-free and $n\equiv 2(mod8)$, and the failure lies either in the rank statement or in the 2-primary part of the rank-zero formula.

The two additional hypotheses are indispensable to the argument and are not known to hold; we discuss their status in detail (Section 8.1). Logically, the Main Theorem says that the scenario is incompatible with the conjunction of BSD, the Cusp Reduction Conjecture and the Sha-Tractability Hypothesis. The emphasis of this paper is on the consequence for BSD, but we state the alternatives explicitly wherever they matter.

1.4. Main Contributions

• Arithmetic of Tunnell’s counts (Section 3). For square-free n: $D_n=C_n=0$ if $n\equiv 6(mod8)$ (Lemma 2); $D_n=2h(-4n)$ if $n\equiv 2(mod8)$ (Proposition 1, proved from the class-number-one theory of Bringmann and Kane [17]); and $C_n-h(-4n)$ is the $n/2$-th coefficient of $\eta (8z)\eta (16z)\theta (4z)$ (Lemma 3). We also prove the ceiling $D_n=O(n^{1/2+\epsilon })$ by elementary means (Lemma 1).
• Class numbers in the polynomial hierarchy (Theorem 5). The function $d\mapsto h(-d)$ lies in ${\mathrm{FP}}^{{\Sigma }_2^{\mathrm{P}}}$, hence in FP under $\mathrm{P}=\mathrm{NP}$; consequently so does $n\mapsto D_n$ on even square-free n (Corollary 1).
• The BSD bridge (Section 5). Under BSD for $E_n$, $C_n=h(-4n)\pm \tau (n/2)\sqrt{|\mathrm{Sha}(E_n)|}$ in rank zero and $C_n=h(-4n)$ in positive rank (Proposition 4).
• The Main Theorem (Theorem 8, Corollary 2). In the scenario, the Cusp Reduction Conjecture and the Sha-Tractability Hypothesis force BSD to fail for infinitely many $E_n$.
• The $D_n$-route is closed (Section 6). An exact Reduction Conjecture for $D_n$ (Conjecture 9) is false in the scenario (Corollary 3) and in general implies $\mathrm{PH}={\Delta }_3^{\mathrm{P}}$ (Theorem 12); its approximate form is vacuous under $\mathrm{P}=\mathrm{NP}$ (Remark 7). This explains why the cusp part, and hence BSD, must enter.
• The descent cascade (Section 7). We state a corrected Solution Density Conjecture, prove the size and termination properties of the descent cascade built on it, and show that the cascade is redundant for exact counting (Proposition 5).

1.5. Organization

Section 2 fixes notation and states the precise form of BSD used. Section 3 develops the arithmetic of $C_n$ and $D_n$. Section 4 treats counting under complexity assumptions and proves the class-number theorem. Section 5 contains the BSD bridge, the two hypotheses, and the Main Theorem. Section 6 shows that the route through $D_n$ is closed. Section 7 analyses the descent cascade. Section 8 discusses the status of the hypotheses, falsifiability and prior work. Section 9 and Section 10 contain extended proofs and further remarks, and Section 11 concludes. The appendices contain pseudocode and numerical data.

2. Preliminaries

2.1. Notation and Conventions

For a function $f:\mathbb{N}\to \mathbb{N}$, we write $f(n)=poly(n)$ if there exist constants $c,k>0$ such that $f(n)\le c·n^k$ for all sufficiently large n. For an integer m, we denote by $|m|$ its bit length, $|m|=\lceil {log}_2(\mathrm{abs}(m)+1)\rceil$, where $\mathrm{abs}(\dots )$ is the absolute value; for a problem instance I, $|I|$ is the size of its encoding. For a positive integer g we write $squarefree(g)$ for its square-free kernel, the unique square-free s with $g=s{k}^2$ for some integer k, $v_2(g)$ for the exponent of 2 in g, $\tau (g)$ for the number of divisors of g, and $\omega (g)$ for the number of distinct prime divisors of g; for square-free g, $\tau (g)=2^{\omega (g)}$.

For $d>0$ with $-d\equiv 0,1(mod4)$ we write $h(-d)$ for the number of ${\mathrm{SL}}_2(\mathbb{Z})$-classes of primitive positive definite binary quadratic forms of discriminant $-d$; when $-d$ is a fundamental discriminant this is the class number of $\mathbb{Q}(\sqrt{-d})$. $H(d)$ denotes the Hurwitz class number, which counts all (not necessarily primitive) classes of discriminant $-d$, weighted by $1/2$ and $1/3$ for classes of forms equivalent to multiples of $x^2+y^2$ and $x^2+xy+y^2$ respectively, and which is zero unless $-d\equiv 0,1(mod4)$ [17]. For a fundamental discriminant $-d<-4$ one has $H(d)=h(-d)$.

We write $q=e^{2\pi iz}$, $\eta (z)=q^{1/24}{\prod }_{k\ge 1}(1-q^k)$ and $\theta (z)={\sum }_{x\in \mathbb{Z}}{q}^{x^2}$. We use the classes ${\Sigma }_2^{\mathrm{P}}={\mathrm{NP}}^{\mathrm{NP}}$ and ${\Delta }_3^{\mathrm{P}}={\mathrm{P}}^{{\Sigma }_2^{\mathrm{P}}}$ of the polynomial hierarchy PH; for a class $\mathcal{C}$ of languages, ${\mathrm{FP}}^{\mathcal{C}}$ is the class of functions computable in deterministic polynomial time with an oracle for a language in $\mathcal{C}$, and FBQP is the class of functions computable with bounded error in quantum polynomial time.

2.2. The Birch–Swinnerton-Dyer Conjecture for $E_n$

For an elliptic curve $E/\mathbb{Q}$ let $r(E)$ be the rank of $E(\mathbb{Q})$, $\mathrm{Sha}(E)$ its Tate–Shafarevich group, $\Omega (E)$ its real period (counted with the number of real components), $c_p(E)$ its Tamagawa numbers and $E{(\mathbb{Q})}_{\mathrm{tors}}$ its torsion subgroup.

Conjecture 2 

(BSD for E). The order of vanishing of $L(E,s)$ at $s=1$ equals $r(E)$; the group $\mathrm{Sha}(E)$ is finite; and if $r(E)=0$, then

$${\displaystyle \frac{L(E,1)}{\Omega (E)}}={\displaystyle \frac{|\mathrm{Sha}(E)|{\prod }_p{c}_p(E)}{{|E(\mathbb{Q})}_{\mathrm{tors}}{|}^2}}.$$

We say that BSD holds for $E_n$ if Conjecture 2 holds for $E=E_n$. Only the rank statement and the rank-zero formula are used in this paper; the leading-term formula in positive rank plays no role.

2.3. The Scenario and the Other Assumptions

The hypotheses used by each result are stated in that result. We use:

• P = NP. This implies $\mathrm{P}=\mathrm{NP}=\mathrm{coNP}$ and, by induction on the levels, $\mathrm{PH}=\mathrm{P}$; in particular ${\Sigma }_2^{\mathrm{P}}=\mathrm{P}$ and ${\mathrm{FP}}^{\mathrm{NP}}={\mathrm{FP}}^{{\Sigma }_2^{\mathrm{P}}}=\mathrm{FP}$.
• The scenario: $\mathrm{P}=\mathrm{NP}$ and $\#\mathrm{P}\ne \mathrm{FP}$.
• BSD for some or all of the curves $E_n$, as specified in each statement.
• GRH, the generalized Riemann hypothesis, used only in Corollary 4 and in the heuristic analysis of Section 7.

Under $\mathrm{P}=\mathrm{NP}$, integer factorization is computable in polynomial time: the decision problem “does m have a divisor in $[2,k]$?” is in $\mathrm{NP}\cap \mathrm{coNP}$, and prime factors are then found by binary search. Hence $squarefree(g)$, $v_2(g)$, $\omega (g)$ and $\tau (g)$ are computable in polynomial time, and so are all NP search problems by self-reducibility. We do not assume that exact counting becomes polynomial-time under $\mathrm{P}=\mathrm{NP}$; in the scenario it does not.

2.4. Diophantine Representations

Theorem 3 

(Matiyasevich [18]). For every recursively enumerable set $S\subseteq \mathbb{N}$ there is a polynomial $P(a,x_1,\dots ,x_k)$ with integer coefficients such that $a\in S$ if and only if $P(a,x_1,\dots ,x_k)=0$ has a solution $(x_1,\dots ,x_k)\in {\mathbb{N}}^k$.

The theorem, which completes work of Davis, Putnam and Robinson, applies to every language in NP, but it gives no bound on the size of the solutions in terms of $|a|$, and a single witness of an NP verifier typically corresponds to infinitely many solutions. Whether every NP set admits a Diophantine representation with polynomially bounded solutions is open; for restricted equations such as $\alpha x^2+\beta y=\gamma$, solvability in natural numbers is already NP-complete [19].

3. Arithmetic of Tunnell’s Counting Functions

3.1. An Elementary Ceiling

Lemma 1 

(Elementary ceiling). For every $\epsilon >0$ there is a constant $c_{\epsilon }$ such that $D_n\le c_{\epsilon }{n}^{1/2+\epsilon }$ and $C_n\le c_{\epsilon }{n}^{1/2+\epsilon }$ for all $n\ge 1$. In particular $D_n,C_n\le 2^{|n|/2+o(|n|)}$.

Proof. 

If $n=8x^2+2y^2+16z^2$, then $|z|\le \sqrt{n}/4$, so z takes at most $\sqrt{n}/2+1$ values. For fixed z, put $k=(n-16z^2)/2$; the pair $(x,y)$ satisfies $k={(2x)}^2+y^2$, so the number of such pairs is at most $r_2(k)$, the number of representations of k as a sum of two squares. By Jacobi’s formula $r_2(k)=4{\sum }_{d\mid k}{\chi }_{-4}(d)\le 4\tau (k)$, and $\tau (k)\le c_{\epsilon }^{\prime }{k}^{\epsilon }$. Hence $D_n\le (\sqrt{n}/2+1)·4c_{\epsilon }^{\prime }{n}^{\epsilon }$. The argument for $C_n$ is identical with $64z^2$ in place of $16z^2$, and the final statement follows from $n<2^{|n|}$.    □

3.2. Local Vanishing and the Class-Number Formula

Lemma 2 

(Local vanishing). Let n be an even square-free positive integer. If $n\equiv 6(mod8)$, then $C_n=D_n=0$; in particular Tunnell’s identity $2C_n=D_n$ holds trivially.

Proof. 

Write $n=2m$ with m odd; $n\equiv 6(mod8)$ means $m\equiv 3(mod4)$. A representation $n=8x^2+2y^2+16z^2$ gives $m=4x^2+y^2+8z^2\equiv y^2(mod4)$, while $y^2\equiv 0$ or $1(mod4)$, a contradiction. The same argument applies to $m=4x^2+y^2+32z^2$.    □

For $n\equiv 6(mod8)$ the root number of $E_n$ is $-1$, so BSD predicts that all such square-free n are congruent; unconditionally, $2p$ is congruent for every prime $p\equiv 3,7(mod8)$ (see [20]). Lemma 2 shows that in this residue class Tunnell’s counts carry no information. The informative even residue class is $n\equiv 2(mod8)$, and we set

$$\mathcal{N}:=\{n\in \mathbb{N}:n\mathrm{square}\text{-}\mathrm{free},n\equiv 2(mod8)\},\mathcal{A}:=\{n\in \mathcal{N}:n\mathrm{congruent}\}.$$

Proposition 1 

(Class-number formula). For every $n\in \mathcal{N}$,

$$D_n=2h(-4n),$$

where $h(-4n)$ is the class number of $\mathbb{Q}(\sqrt{-n})$. Consequently $D_n>0$, $D_n=O(\sqrt{n}logn)$, and for $n\in \mathcal{N}$ Tunnell’s identity $2C_n=D_n$ is equivalent to $C_n=h(-4n)$.

Proof. 

Write $n=2m$, so $m\equiv 1(mod4)$ is odd and square-free. Dividing $n=8x^2+2y^2+16z^2$ by 2 shows that $D_n=r_{(1,4,8)}(m)$, the number of representations of m by $Q(y,x,z)=y^2+4x^2+8z^2$. The form $X^2+4Y^2+8Z^2$ has class number one (its genus consists of a single class), and for such forms the Siegel–Weil average collapses to the representation number itself; on this basis Bringmann and Kane proved [17] (Lemma 4.2) that, for every $m\ge 1$,

$$r_{(1,4,8)}(m)=c_{(1,4,8)}(m)\left(H(8m)-2H(2m)\right),$$

with the constant $c_{(1,4,8)}(m)$ tabulated in [17] (Appendix B): it equals 2 for $m\equiv 1(mod4)$, 4 for $m\equiv 4(mod8)$, 12 for $m\equiv 0(mod8)$, and 0 in the remaining classes. The proof in [17] is unconditional: both sides are modular forms of weight $3/2$ on an explicit congruence subgroup, and the identity is verified on the number of coefficients prescribed by the valence formula. For our $m\equiv 1(mod4)$ we obtain $r_{(1,4,8)}(m)=2(H(8m)-2H(2m))$. Since m is odd, $-2m\equiv 2(mod4)$ is not a discriminant, so $H(2m)=0$. Since m is odd and square-free, $-8m=-4n$ is a fundamental discriminant, and it is smaller than $-4$, so $H(8m)=h(-4n)$. Hence $D_n=2h(-4n)$. Dirichlet’s class number formula $h(-4n)={\pi }^{-1}\sqrt{4n}L(1,{\chi }_{-4n})$ and the elementary bound $L(1,{\chi }_{-4n})=O(logn)$ give $D_n=O(\sqrt{n}logn)$, and $h(-4n)\ge 1$ gives $D_n>0$. The last assertion is immediate.    □

The identity has also been confirmed by exhaustive computation for all $n\in \mathcal{N}$ with $n\le 3·{10}^4$ and for 1500 random $n\in \mathcal{N}$ with $n\le 2·{10}^5$ (Appendix B).

3.3. Tunnell’s Cusp Coefficient

Let

$$f(z):=\eta (8z)\eta (16z)\theta (4z)=\sum _{m\ge 1}a(m)q^m.$$

This is the weight-$3/2$ cusp form of level 128 attached by Tunnell to the even congruent number problem [4,11,21].

Lemma 3 

(Tunnell’s coefficient). For every odd $m\ge 1$ and $n=2m$,

$$a(m)=C_n-\frac{1}{2}{D}_n.$$

In particular, for $n\in \mathcal{N}$ one has $a(n/2)=C_n-h(-4n)$, and $a(m)=0$ for $m\equiv 3(mod4)$.

Proof. 

Write ${(a;q)}_{\infty }={\prod }_{k\ge 0}(1-a{q}^k)$. Gauss’s identities ${\sum }_{y\in \mathbb{Z}}{(-1)}^y{q}^{y^2}={(q;q)}_{\infty }^2/{(q^2;q^2)}_{\infty }$ and ${\sum }_{x\ge 0}{q}^{x(x+1)/2}={(q^2;q^2)}_{\infty }^2/{(q;q)}_{\infty }$, both special cases of Jacobi’s triple product identity [22] (Theorem 2.8), multiply to

$$\left(\sum _{y\in \mathbb{Z}}{(-1)}^y{q}^{y^2}\right)\left(\sum _{x\ge 0}{q}^{x(x+1)/2}\right)={(q;q)}_{\infty }{(q^2;q^2)}_{\infty }.$$

Replacing q by $q^8$, multiplying by q, and using ${(2x+1)}^2=8·x(x+1)/2+1$, we obtain

$$\eta (8z)\eta (16z)=q{(q^8;q^8)}_{\infty }{(q^{16};q^{16})}_{\infty }=\sum _{x\ge 0}\sum _{y\in \mathbb{Z}}{(-1)}^y{q}^{{(2x+1)}^2+8y^2}={\displaystyle \frac{1}{2}}\sum _{\begin{array}{c}t\in \mathbb{Z}\\ t\mathrm{odd}\end{array}}\sum _{y\in \mathbb{Z}}{(-1)}^y{q}^{t^2+8y^2}.$$

Multiplying by $\theta (4z)={\sum }_u{q}^{4u^2}$, the coefficient of $q^m$ is $a(m)={\displaystyle \frac{1}{2}}\sum {(-1)}^y$, the sum running over all $(t,u,y)\in {\mathbb{Z}}^3$ with t odd and $t^2+4u^2+8y^2=m$. Since m is odd, the parity condition on t is automatic. Splitting according to the parity of y: the triples with $y=2y^{\prime }$ even are in bijection with representations $m=t^2+4u^2+32y^{\prime 2}$, i.e., with the representations counted by $C_n$; all triples are in bijection with the representations counted by $D_n$ (Proposition 1). Hence $a(m)={\displaystyle \frac{1}{2}}\left(C_n-(D_n-C_n)\right)=C_n-{\displaystyle \frac{1}{2}}{D}_n$. The remaining statements follow from Proposition 1 and Lemma 2.    □

Remark 1 

(On the modular interpretation). The series ${\sum }_n{D}_n{q}^n$ and ${\sum }_n{C}_n{q}^n$ are theta series of positive definite ternary forms, hence modular forms of weight $3/2$, each an Eisenstein part (given by the Siegel–Weil formula [23] as a product of local densities) plus a cusp part. Proposition 1 and Lemma 3 say that, at $n\in \mathcal{N}$, $D_n$ coincides with a genus quantity while $C_n$ is that genus quantity plus the cusp coefficient $a(n/2)$. Deligne’s theorem [24] (the Ramanujan–Petersson conjecture) concerns integral weight and does not apply here; for weight $3/2$ the best known bounds for cusp-form coefficients at square-free arguments are of the shape $O(n^{1/2-\delta +\epsilon })$ with a fixed $\delta >0$ [25,26], and Duke and Schulze-Pillot [27] showed that a positive definite ternary form represents every sufficiently large square-free integer that it represents locally, apart from finitely many spinor-exceptional square classes, with $r(n){\gg }_{\epsilon }{n}^{1/2-\epsilon }$ (ineffectively).

3.4. Congruums and the Supply of Admissible Integers

Lemma 4 

(Congruums). Let $a>b\ge 1$ be integers and $g=4ab(a^2-b^2)$. Then $squarefree(g)$ is a square-free congruent number, and it is even if and only if $v_2(g)$ is odd. Moreover, the map $(a,b)\mapsto squarefree(g)$ has infinite fibres: $(ta,tb)$ and $(a,b)$ have the same image for every integer $t\ge 1$.

Proof. 

The triangle with legs $a^2-b^2$ and $2ab$ has area $g/4$, so $g/4$ is congruent, hence so are g and $squarefree(g)$, since congruence is invariant under multiplication by rational squares. Writing $g=squarefree(g)k^2$ gives $v_2(g)=v_2(squarefree(g))+2v_2(k)$ with $v_2(squarefree(g))\in \{0,1\}$, which proves the parity statement. Finally, $(ta,tb)$ yields $t^{4}g$, which has the same square-free kernel as g.    □

Remark 2 

(Supply). Because the fibres are infinite, counting pairs $(a,b)$ gives no lower bound on the number of distinct congruent numbers produced; and dividing g by $2^{v_2(g)}$ before taking the square-free kernel always produces an odd number, so that construction never reaches $\mathcal{A}$. The set $\mathcal{A}$ has natural density zero in $\mathcal{N}$: Smith [28] proved that $100\%$ of square-free $n\equiv 1,2,3(mod8)$ are not congruent. Numerically, among the 20260 elements of $\mathcal{N}$ below $2·{10}^5$, exactly 2455 satisfy $2C_n=D_n$ (Appendix B). No lower bound on $|\mathcal{A}\cap [1,X]|$ is used in any proof. The complement $\mathcal{N}\setminus \mathcal{A}$, which has density one, is where, under BSD, the cusp coefficient $a(n/2)$ of Lemma 3 is non-zero, and it is where Section 5 operates.

4. Counting Under Complexity Assumptions

4.1. Decision Versus Counting

Lemma 5 

(Decision versus counting). Assume $\mathrm{P}=\mathrm{NP}$.

1.

Square-freeness, the computation of $squarefree(g)$, $v_2(g)$, $\omega (g)$, $\tau (g)$, and every predicate in PH are decidable or computable in polynomial time.

2.

The threshold predicate $[\#I\ge k]$ for $\#\mathrm{SAT}$, with k in binary, is PP-complete; it is not known to be in P under $\mathrm{P}=\mathrm{NP}$, and in the scenario (1) it is not in P.

3.

Tunnell’s test $[2C_n=D_n]$, and under BSD the predicate $[n\in \mathcal{A}]$, are decidable in polynomial time with one query to a $\#\mathrm{P}$ oracle (for $C_n$).

4.

$C_n$ and $D_n$ are $\#\mathrm{P}$ functions of n.

Proof. 

(1) See Section 2. (2) PP-completeness of the threshold predicate is classical [8,10]. If it were in P, every PP language would be in P and hence ${\mathrm{P}}^{\#\mathrm{P}}={\mathrm{P}}^{\mathrm{PP}}=\mathrm{P}$, which gives $\#\mathrm{P}\subseteq \mathrm{FP}$ (each bit of a $\#\mathrm{P}$ value is decidable in ${\mathrm{P}}^{\#\mathrm{P}}$), contradicting the scenario. (3) $D_n$ is polynomial-time computable under $\mathrm{P}=\mathrm{NP}$ by Corollary 1 below; query the oracle for $C_n$ and compare. Square-freeness and $nmod8$ are decided by (1), and under BSD Theorem 1 makes the test equivalent to congruence. (4) A witness is a triple $(x,y,z)$ of bit length $O(|n|)$, checked in polynomial time.    □

Lemma 6 

(Small counts). Assume $\mathrm{P}=\mathrm{NP}$. Let $f\in \#\mathrm{P}$ with verifier V and let q be a polynomial. There is a polynomial-time algorithm that, on input x, either outputs $f(x)$ or correctly reports $f(x)>q(|x|)$.

Proof. 

Let ⪰ be the lexicographic order on ${\{0,1\}}^{p(|x|)}$. The language $\{(x,u,w):\exists y⪰u\mathrm{with}\mathrm{prefix}w,V(x,y)=1\}$ is in NP, hence in P. By prefix search one finds the lexicographically least witness $y⪰u$, or learns that none exists, in polynomial time. Starting from $u=0^{p(|x|)}$ and replacing u by the successor of the witness just found, at most $q(|x|)+1$ rounds enumerate all witnesses if there are at most $q(|x|)$ of them, and otherwise exhibit $q(|x|)+1$ distinct witnesses.    □

Proposition 2 

(Approximate counting, Stockmeyer). For every $f\in \#\mathrm{P}$ and every polynomial q, there is a function $g\in {\mathrm{FP}}^{{\Sigma }_2^{\mathrm{P}}}$ with $f(x)/(1+1/q(|x|))\le g(x)\le (1+1/q(|x|))f(x)$ for all x [29]. In particular, under $\mathrm{P}=\mathrm{NP}$, $(1+1/q)$-approximations of all $\#\mathrm{P}$ functions are computable in polynomial time.

Remark 3 

(Why approximation does not suffice). Stockmeyer’s algorithm runs in time polynomial in $|x|$ and $q(|x|)$, so any inverse-polynomial relative error is affordable. What approximation cannot deliver is exactness: when $f(x)$ may be as large as $2^{poly(|x|)}$, a relative error of $1/q(|x|)$ leaves exponentially many candidate values. This is why the scenario (1) is consistent with Proposition 2.

Theorem 4 

(Enumerative counting, Cai and Hemachandra [16]). Suppose there is a polynomial-time computable function that maps every Boolean formula φ to a list of at most ${|\phi |}^{1-\epsilon }$ integers, for some fixed $\epsilon >0$, one of which is $\#\phi$. Then $\mathrm{P}={\mathrm{P}}^{\#\mathrm{P}}$, and consequently $\#\mathrm{P}=\mathrm{FP}$.

The consequence $\#\mathrm{P}=\mathrm{FP}$ follows from $\mathrm{P}={\mathrm{P}}^{\#\mathrm{P}}$ because every bit of a $\#\mathrm{P}$ value is decidable in ${\mathrm{P}}^{\#\mathrm{P}}$. We shall only need lists of length at most 2.

4.2. Class Numbers in the Polynomial Hierarchy

We use the standard facts [30] that every class of primitive positive definite forms of discriminant $-d$ contains exactly one reduced form $(a,b,c)$, with $|b|\le a\le c$, $b\ge 0$ if $|b|=a$ or $a=c$, and $a\le \sqrt{d/3}$; that reduced forms have encoding length $O(logd)$; and that composition followed by reduction, the group operation of the form class group $\mathrm{Cl}(-d)$, is computable in time polynomial in $logd$. Consequently ${\prod }_i{f}_i^{v_i}$ can be computed by repeated squaring in time polynomial in $logd$ and in the bit lengths of the exponents. We also use the crude bound

$$h(-d)\le \#\{(a,b):1\le a\le \sqrt{d/3},|b|\le a\}\le \frac{d}{3}+2\sqrt{d/3}\le d(d\ge 3),$$

(2)

and the polynomial-time computability of Hermite normal forms of integer matrices [31].

Theorem 5 

(Class numbers in ${\mathrm{FP}}^{{\Sigma }_2^{\mathrm{P}}}$). The function $d\mapsto h(-d)$, defined for $d\ge 3$ with $-d\equiv 0,1(mod4)$, lies in ${\mathrm{FP}}^{{\Sigma }_2^{\mathrm{P}}}$. In particular, if $\mathrm{P}=\mathrm{NP}$, then $d\mapsto h(-d)$ is computable in deterministic polynomial time.

Proof. 

Let $G=\mathrm{Cl}(-d)$, write $1_G$ for the class of the principal form, and put $h=|G|\le d$ by (2). If $h=1$ the procedure below terminates immediately with the empty generating set and outputs 1.

Step 1: a small generating set. For a list $S=(s_1,\dots ,s_t)$ of reduced forms, every element of $\langle S\rangle$ has the form ${\prod }_i{s}_i^{v_i}$ with $0\le v_i<h\le d$. Hence the language

$$L_1=\left\{(d,S,w):\exists f\mathrm{reduced},\mathrm{with}\mathrm{prefix}w,\forall v\in {\{0,\dots ,d\}}^t:{\prod }_i{s}_i^{v_i}\ne f\right\}$$

is in ${\Sigma }_2^{\mathrm{P}}$, because t never exceeds ${log}_{2}d+1$ and all quantified objects have polynomial length. Starting from $S=()$, we use $L_1$ with prefix search to find a reduced form $f\notin \langle S\rangle$, append it to S, and repeat until no such f exists. Each step at least doubles $|\langle S\rangle |$ by Lagrange’s theorem, so the loop stops after $t\le {log}_{2}h\le {log}_{2}d$ steps with $\langle S\rangle =G$.

Step 2: the relation lattice. Let $\phi :{\mathbb{Z}}^t\to G$, $\phi (v)={\prod }_i{s}_i^{v_i}$, and $\Lambda =ker\phi$. Since $\phi$ is surjective, $[{\mathbb{Z}}^t:\Lambda ]=h$, and $h{\mathbb{Z}}^t\subseteq \Lambda$. The Hermite normal form basis of $\Lambda$ is triangular with positive diagonal entries whose product is h and with off-diagonal entries bounded by the diagonal ones; hence all its entries lie in $[0,h]\subseteq [0,d]$.

Step 3: lattice completion. For a finite list B of integer vectors, membership in the lattice $\mathcal{L}(B)$ spanned by B is decidable in polynomial time via Hermite normal forms [31]. Hence

$$L_2=\left\{(d,S,B,w):\exists v\in {[-d,d]}^t\mathrm{with}\mathrm{prefix}w,\phi (v)=1_G,v\notin \mathcal{L}(B)\right\}$$

is in NP. Starting from $B=()$, we use $L_2$ with prefix search to find such v, append it to B, and repeat until none exists. Each appended vector strictly enlarges $\mathcal{L}(B)\subseteq \Lambda$. At most t additions increase the rank. Between two rank increases, while $\mathcal{L}(B)$ has rank r and spans the rational subspace V, the index $[\Lambda \cap V:\mathcal{L}(B)]$ is a positive integer bounded by the determinant of $\mathcal{L}(B)$, which is at most ${(d\sqrt{t})}^r$ by Hadamard’s inequality applied to r independent vectors of B; each addition that does not increase the rank replaces this index by a proper divisor. Hence the loop stops after at most $t+t^2{log}_2(d\sqrt{t})=O({log}^{3}d)$ additions. Full rank is reached because the vectors $h{e}_i\in \Lambda \cap {[-d,d]}^t$ are available to the search. When the loop stops, every vector of $\Lambda \cap {[-d,d]}^t$, in particular every vector of the Hermite normal form basis of $\Lambda$, lies in $\mathcal{L}(B)$, so $\mathcal{L}(B)=\Lambda$. We output $|detH|$, where H is the Hermite normal form basis of $\mathcal{L}(B)$; this equals $[{\mathbb{Z}}^t:\Lambda ]=h$.

All steps run in time polynomial in $logd$ with queries to $L_1\in {\Sigma }_2^{\mathrm{P}}$ and $L_2\in \mathrm{NP}\subseteq {\Sigma }_2^{\mathrm{P}}$. Under $\mathrm{P}=\mathrm{NP}$ both languages are in P.    □

Corollary 1 

(Complexity of $D_n$). Let TunnellCount denote the function $n\mapsto D_n$ on even square-free n. Then $\mathrm{TunnellCount}\in {\mathrm{FP}}^{{\Sigma }_2^{\mathrm{P}}}$. In particular, if $\mathrm{P}=\mathrm{NP}$, then $D_n$ is computable in deterministic polynomial time for every even square-free n.

Proof. 

An even square-free n satisfies $n\equiv 2$ or $6(mod8)$. If $n\equiv 6(mod8)$ output 0 (Lemma 2); if $n\equiv 2(mod8)$ output $2h(-4n)$ (Proposition 1), computed by Theorem 5.    □

By Lemma 3, the same algorithm computes $C_n$ on every $n\in \mathcal{A}$, where $a(n/2)=0$. All the arithmetic difficulty of Tunnell’s counts is therefore concentrated in the cusp coefficient $a(n/2)$ at non-congruent $n\in \mathcal{N}$.

5. The Birch–Swinnerton-Dyer Bridge and the Main Theorem

5.1. Tunnell’s L-Value Formula and Ono’s Evaluation

Proposition 3 

(Tunnell, Ono). Let $n=2m\in \mathcal{N}$. Then:

1.

$L(E_n,1)={\displaystyle \frac{2\Omega a{(m)}^2}{4\sqrt{2m}}}$, where $\Omega ={\int }_1^{\infty }{(x^3-x)}^{-1/2}dx$ is an absolute constant; in particular $L(E_n,1)\ne 0$ if and only if $a(m)\ne 0$.

2.

If BSD holds for $E_n$ and $a(m)\ne 0$, then $r(E_n)=0$ and $\sqrt{|\mathrm{Sha}(E_n)|}=|a(m)|/\tau (m)$.

3.

If BSD holds for $E_n$ and $a(m)=0$, then $r(E_n)>0$, i.e., $n\in \mathcal{A}$.

Proof. 

With $N=m$ odd and square-free, the curve $y^2=x^3-4N^{2}x$ is $E_{2N}=E_n$, and $f=\eta (8z)\eta (16z)\theta (4z)$ is the form $f_2$ of [21]. Part (1) is Tunnell’s formula [4] in the normalization of [21] (Eq. (3)). Part (2) is [21] (Eq. (4)), which Ono derives by inserting (1) and the local invariants of $E_n$ (periods, Tamagawa numbers, and $E_n{(\mathbb{Q})}_{\mathrm{tors}}\cong {(\mathbb{Z}/2\mathbb{Z})}^2$) into the rank-zero formula of Conjecture 2; the result is $\sqrt{|\mathrm{Sha}(E_n)|}=|a(m)|/\tau (m)$; the statement $r(E_n)=0$ follows from $L(E_n,1)\ne 0$ by [14]. Part (3) follows from (1) and the rank statement of Conjecture 2.    □

We have checked the analytic content of Proposition 3(2), namely $L(E_n,1){|E_n{(\mathbb{Q})}_{\mathrm{tors}}|}^2/(\Omega (E_n){\prod }_p{c}_p(E_n))={(a(m)/\tau (m))}^2$, numerically in PARI/GP for the first 60 elements of $\mathcal{N}$ and for 25 random elements of $\mathcal{N}$ below 6000, computing $a(m)$ from $C_n$ and $D_n$ via Lemma 3 (Appendix B).

Proposition 4 

(The BSD bridge). Let $n=2m\in \mathcal{N}$ and assume that BSD holds for $E_n$. Define

$$\sigma (n):=\left\{\begin{array}{cc}\sqrt{|\mathrm{Sha}(E_n)|}\hfill & \mathrm{if}r(E_n)=0,\hfill \\ 0\hfill & \mathrm{if}r(E_n)>0.\hfill \end{array}\right.$$

Then $\sigma (n)$ is a non-negative integer and

$$C_n\in \left\{h(-4n)+\tau (m)\sigma (n),h(-4n)-\tau (m)\sigma (n)\right\}.$$

Proof. 

By Lemma 3, $C_n=h(-4n)+a(m)$. If $r(E_n)>0$, then $L(E_n,1)=0$ unconditionally [14], so $a(m)=0$ by Proposition 3(1), and $C_n=h(-4n)$. If $r(E_n)=0$, then $L(E_n,1)\ne 0$ by BSD, so $a(m)\ne 0$ and Proposition 3(2) gives $|a(m)|=\tau (m)\sigma (n)$; since $a(m)$ is an integer and $\tau (m)\ge 1$, $\sigma (n)=|a(m)|/\tau (m)$ is a non-negative rational whose square is an integer, hence an integer.    □

Proposition 4 is the precise sense in which BSD carries computational content: it expresses the $\#\mathrm{P}$ function $C_n$, up to a sign, through the class number $h(-4n)$, the elementary quantity $\tau (m)$, and the algebraic invariants $r(E_n)$ and $|\mathrm{Sha}(E_n)|$. Part of this relation is known unconditionally. Since $E_n$ has complex multiplication by $\mathbb{Z}[i]$, Rubin’s theorems apply: if $L(E_n,1)\ne 0$, then $\mathrm{Sha}(E_n)$ is finite [32], and for every prime p not dividing the number of roots of unity of $\mathbb{Q}(i)$, i.e., for every odd p, the p-part of the rank-zero formula of Conjecture 2 holds [33]. Hence, when $a(m)\ne 0$, the odd part of $|\mathrm{Sha}(E_n)|$ equals the odd part of ${(a(m)/\tau (m))}^2$ unconditionally. What BSD adds, and what Proposition 4 needs, is the 2-primary part of the rank-zero formula and the implication $L(E_n,1)=0\Rightarrow r(E_n)>0$.

5.2. The Two Hypotheses

Conjecture 6 

(Cusp Reduction Conjecture). There exist functions R, α, β, computable in polynomial time with an NP oracle, such that for every Boolean formula φ: $R(\phi )\in \mathcal{N}$, $\alpha (\phi )\ge 1$ and $\beta (\phi )$ are integers, and

$$C_{R(\phi )}=\alpha (\phi )·\#\phi +\beta (\phi ).$$

Conjecture 6 is a many-one counting reduction in the sense of Zankó [7] from $\#\mathrm{SAT}$ to $n\mapsto C_n$ on $\mathcal{N}$. By Lemma 3 and Corollary 1, it is equivalent under $\mathrm{P}=\mathrm{NP}$ to the same statement with $C_n$ replaced by the cusp coefficient $a(n/2)$, suitably shifted. Unlike its analogue for $D_n$ (Conjecture 9), it is not refuted by the results of Section 6: no algorithm in the polynomial hierarchy is known for $a(n/2)$.

Conjecture 7 

(Sha-Tractability Hypothesis). There is a function S, computable in polynomial time with an NP oracle, such that for every $n\in \mathcal{N}$:

$$S(n)=\left\{\begin{array}{cc}|\mathrm{Sha}(E_n)|\hfill & \mathrm{if}r(E_n)=0\mathrm{and}\mathrm{Sha}(E_n)\mathrm{is}\mathrm{finite},\hfill \\ 0\hfill & \mathrm{if}r(E_n)>0,\hfill \end{array}\right.$$

with no requirement on $S(n)$ in the remaining case ($r(E_n)=0$ and $\mathrm{Sha}(E_n)$ infinite).

Conjecture 7 is a statement about the algebraic groups $E_n(\mathbb{Q})$ and $\mathrm{Sha}(E_n)$; it does not mention L-functions or theta series, and BSD is not assumed in its formulation.

5.3. The Main Theorem

Theorem 8 

(Main Theorem). Assume $\mathrm{P}=\mathrm{NP}$, the Cusp Reduction Conjecture (Conjecture 6) and the Sha-Tractability Hypothesis (Conjecture 7). Assume further that BSD holds for $E_n$ for all but finitely many $n\in \mathcal{N}$. Then $\#\mathrm{P}=\mathrm{FP}$.

Proof. 

Let $F\subset \mathcal{N}$ be the finite set of n for which BSD fails for $E_n$, and fix the finite table $\{(n,C_n):n\in F\}$. Under $\mathrm{P}=\mathrm{NP}$ the functions R, $\alpha$, $\beta$, S are computable in polynomial time (Section 2). Consider the following procedure (Algorithm A1 in Appendix A) on input $\phi$ with v variables:

• Compute $n=R(\phi )$, $a=\alpha (\phi )$, $b=\beta (\phi )$ and $m=n/2$.
• If $n\in F$, output the single value $(C_n-b)/a$ read from the table.
• Otherwise compute $h=h(-4n)$ (Theorem 5), $\tau (m)$ (by factoring m) and $s=S(n)$. If s is not a perfect square, output the empty list; otherwise let $\sigma =\sqrt{s}$.
• Output the list of those values among $(h+\tau (m)\sigma -b)/a$ and $(h-\tau (m)\sigma -b)/a$ that are integers in $[0,2^v]$.

All steps take polynomial time. We claim that the output list always contains $\#\phi$. If $n\in F$ this holds by Conjecture 6. If $n\notin F$, BSD holds for $E_n$, so $\mathrm{Sha}(E_n)$ is finite and, by Conjecture 7, $S(n)=\sigma {(n)}^2$ with $\sigma (n)$ as in Proposition 4 (both when $r(E_n)=0$ and when $r(E_n)>0$). In particular s is a perfect square and $\sigma =\sigma (n)$. By Proposition 4, $C_n=h\pm \tau (m)\sigma$ for one choice of sign, and by Conjecture 6, $\#\phi =(C_n-b)/a$, which is an integer in $[0,2^v]$. Hence $\#\phi$ is in the list. The list has at most two elements, which is $O(|\phi {|}^{1-\epsilon })$ for any $\epsilon \in (0,1)$, so Theorem 4 applies and yields $\#\mathrm{P}=\mathrm{FP}$.    □

Corollary 2 

(Principal consequence). Assume $\mathrm{P}=\mathrm{NP}$ and $\#\mathrm{P}\ne \mathrm{FP}$. If the Cusp Reduction Conjecture and the Sha-Tractability Hypothesis hold, then the Birch–Swinnerton-Dyer conjecture is false for infinitely many of the curves $E_n:y^2=x^3-n^{2}x$ with n square-free and $n\equiv 2(mod8)$. More precisely (Remark 4), for infinitely many such n either $L(E_n,1)=0$ while $r(E_n)=0$, or $L(E_n,1)\ne 0$ and the 2-primary part of $|\mathrm{Sha}(E_n)|$ differs from the BSD prediction.

Proof. 

If BSD failed for only finitely many $E_n$ with $n\in \mathcal{N}$, Theorem 8 would give $\#\mathrm{P}=\mathrm{FP}$, contradicting the hypothesis.    □

Remark 4 

(Which part of BSD fails). The proof of Theorem 8 uses, for $n\notin F$, exactly three consequences of BSD for $E_n$: that $L(E_n,1)=0$ implies $r(E_n)>0$; that $\mathrm{Sha}(E_n)$ is finite when $r(E_n)=0$; and the rank-zero formula in the form of Proposition 3(2). (The implication $r(E_n)>0\Rightarrow L(E_n,1)=0$ is unconditional [14].) When $L(E_n,1)\ne 0$, the second consequence and the odd part of the third are theorems of Rubin [32,33] (see the discussion after Proposition 4). Hence, under the hypotheses of Corollary 2, for infinitely many $n\in \mathcal{N}$ one of the following holds: $E_n$ has rank zero although $L(E_n,1)=0$ (so n satisfies Tunnell’s criterion without being congruent); or $L(E_n,1)\ne 0$ and the 2-part of $|\mathrm{Sha}(E_n)|$ differs from the 2-part of ${(a(n/2)/\tau (n/2))}^2$. The possibility that $\mathrm{Sha}(E_n)$ is infinite in rank zero with $L(E_n,1)\ne 0$ is excluded by [32].

Remark 5 

(Logical status). Corollary 2 is a theorem; its hypotheses are not. Stated symmetrically, Theorem 8 shows that the scenario (1) is incompatible with the conjunction of three statements: BSD for almost all $E_n$ with $n\in \mathcal{N}$, the Cusp Reduction Conjecture, and the Sha-Tractability Hypothesis. The present paper explores the branch of this trichotomy in which the two computational hypotheses hold, where BSD must fail; the other branches, in which BSD holds and one of the hypotheses fails, are equally compatible with the scenario as far as is presently known. Concretely, under BSD and the Sha-Tractability Hypothesis the value $|a(n/2)|$ is easy, so all the hardness demanded by the Cusp Reduction Conjecture would have to be carried by the single sign bit of $a(n/2)$; Theorem 4 is precisely the statement that one bit per instance cannot carry $\#\mathrm{P}$-hardness unless $\#\mathrm{P}=\mathrm{FP}$. Section 8.1 discusses the evidence for each branch.

Remark 6 

(Without the scenario). Without the assumption $\mathrm{P}=\mathrm{NP}$, the proof of Theorem 8 still shows that BSD for almost all $E_n$ with $n\in \mathcal{N}$, the Cusp Reduction Conjecture and the Sha-Tractability Hypothesis together give a two-valued enumerator for $\#\mathrm{SAT}$ computable in polynomial time with a ${\Sigma }_2^{\mathrm{P}}$ oracle. We draw no further conclusion from this, because Theorem 4 is stated in [16] for unrelativized polynomial time.

6. The Route Through ${\mathit{D}}_{\mathit{n}}$ Is Closed

This section explains why the Main Theorem must involve $C_n$ and BSD: the analogous route through $D_n$ is closed, in the scenario and in general.

6.1. The Reduction Conjecture for $D_n$

Conjecture 9 

(Reduction Conjecture for $D_n$). There exist functions R, α, β, computable in polynomial time with an NP oracle, such that for every Boolean formula φ: $R(\phi )=n\in \mathcal{A}$, $\alpha (\phi )\ge 1$ and $\beta (\phi )$ are integers, and $D_{R(\phi )}=\alpha (\phi )·\#\phi +\beta (\phi )$.

Remark 7 

(The approximate form is vacuous). A weaker formulation would only require $D_{R(\phi )}=\Theta (poly(|\phi |)·\#\phi )$. This does not determine $\#\phi$ exactly, so it cannot support an exact counting algorithm; moreover, under $\mathrm{P}=\mathrm{NP}$ the information it provides is already available, since by Proposition 2 $\#\phi$ can be approximated within a factor $1+1/q(|\phi |)$ in polynomial time for every polynomial q. The same remark applies to Conjecture 6.

Remark 8 

(Size constraint). By Proposition 1, $\#\phi \le D_n=O(\sqrt{n}logn)$ for $n=R(\phi )$, so $|n|\ge 2{log}_2\#\phi -O(log|n|)$; by Lemma 1 the same bound holds for Conjecture 6. For a formula with v variables and $2^v$ satisfying assignments, any valid R must output n of bit length at least $2v-O(logv)$.

Remark 9 

(The parsimony obstruction). A natural construction pathway runs as follows: (Step 1) encode φ as a Diophantine polynomial Φ via Theorem 3; (Step 2) aggregate Φ into an integer $m_{\phi }$ of polynomial bit length; (Step 3) form the congruum $g_{\phi }=4m_{\phi }(m_{\phi }^2-1)$, i.e., take $a=m_{\phi }$, $b=1$; (Step 4) set $n_{\phi }=squarefree(g_{\phi })$ and require $n_{\phi }\equiv 2(mod8)$, which by Lemma 4 forces $v_2(g_{\phi })$ odd. Each step is polynomial-time given factorization, but the step that should supply the counting identity is missing. (i) Matiyasevich’s theorem is not parsimonious: the number of integer zeros of Φ is not controlled by $\#\phi$ and is typically infinite. (ii) Nothing links $m_{\phi }$ to the Tunnell count of $n_{\phi }$, which by Proposition 1 is a class number of $\mathbb{Q}(\sqrt{-n_{\phi }})$. (iii) For a positive definite ternary form with one class in its genus, representation numbers at square-free integers are class numbers times explicit local factors [17,23]; for the Tunnell form this is Proposition 1, and Theorem 12 below shows that exact reductions to such counts collapse the polynomial hierarchy. Obstructions (i) and (ii) apply equally to Conjecture 6; obstruction (iii) does not, because $C_n$ has a non-trivial cusp part.

6.2. Single-Query Algorithm and Structural Equivalence

Theorem 10 

(Correctness of Algorithm 1). Assume Conjecture 9. Then Algorithm 1 computes $\#\phi$ in deterministic polynomial time using polynomially many NP-oracle queries and a single query to $\mathcal{O}$. If $\mathcal{O}$ is implemented by the algorithm of Corollary 1, Algorithm 1 runs in ${\mathrm{FP}}^{{\Sigma }_2^{\mathrm{P}}}$; if $\mathrm{P}=\mathrm{NP}$, it runs in FP.

Algorithm 1 CountViaTunnell (conditional on Conjecture 9)

Require:  Boolean formula $\phi$; NP oracle; oracle $\mathcal{O}$ for $n\mapsto D_n$ Ensure:  $\#\phi$ 1: $n\leftarrow R(\phi )$ {Conjecture 9; NP oracle} 2: $a\leftarrow \alpha (\phi )$, $b\leftarrow \beta (\phi )$ {Conjecture 9; NP oracle} 3: $D\leftarrow \mathcal{O}(n)$ {one query} 4: return $(D-b)/a$

Proof. 

Correctness is the identity $(D_n-\beta (\phi ))/\alpha (\phi )=\#\phi$ of Conjecture 9. The running time is that of R, $\alpha$, $\beta$ plus one evaluation of $\mathcal{O}$. With Corollary 1 every oracle used is in ${\Sigma }_2^{\mathrm{P}}$, and under $\mathrm{P}=\mathrm{NP}$ every oracle is in P.    □

Theorem 11 

(Structural equivalence). Assume Conjecture 9, and assume in addition that R, α, β are computable in polynomial time without oracle (or assume $\mathrm{P}=\mathrm{NP}$). Then $\#\mathrm{P}\subseteq \mathrm{FP}$ if and only if ${\mathrm{TunnellCount}|}_{\mathcal{A}}\in \mathrm{FP}$.

Proof. 

$(\Rightarrow )$$D_n\in \#\mathrm{P}$ (Lemma 5(4)). $(\Leftarrow )$ By Theorem 10 with $\mathcal{O}$ the assumed polynomial-time evaluator, $\#\mathrm{SAT}\in \mathrm{FP}$; every $f\in \#\mathrm{P}$ reduces parsimoniously to $\#\mathrm{SAT}$.    □

Corollary 3 

(The $D_n$-route in the scenario). Assume $\mathrm{P}=\mathrm{NP}$. Then Conjecture 9 implies $\#\mathrm{P}=\mathrm{FP}$. Consequently, in the scenario (1), Conjecture 9 is false.

Proof. 

By Corollary 1, $\mathrm{TunnellCount}\in \mathrm{FP}$ under $\mathrm{P}=\mathrm{NP}$; apply Theorem 11.    □

6.3. The No-Go Theorem

Theorem 12 

(No-go theorem). If Conjecture 9 holds, then $\#\mathrm{P}\subseteq {\mathrm{FP}}^{{\Sigma }_2^{\mathrm{P}}}$, and consequently $\mathrm{PH}={\Delta }_3^{\mathrm{P}}$.

Proof. 

By Theorem 10 with Corollary 1, $\#\mathrm{SAT}\in {\mathrm{FP}}^{{\Sigma }_2^{\mathrm{P}}}$ (the NP oracle used by R, $\alpha$, $\beta$ is subsumed). By parsimonious completeness, $\#\mathrm{P}\subseteq {\mathrm{FP}}^{{\Sigma }_2^{\mathrm{P}}}$, hence ${\mathrm{P}}^{\#\mathrm{P}}\subseteq {\mathrm{P}}^{{\Sigma }_2^{\mathrm{P}}}={\Delta }_3^{\mathrm{P}}$. By Toda’s theorem [9], $\mathrm{PH}\subseteq {\mathrm{P}}^{\#\mathrm{P}}\subseteq {\Delta }_3^{\mathrm{P}}\subseteq \mathrm{PH}$.    □

Corollary 4 

(Quantum consequence). Assume GRH and Conjecture 9 with R, α, β computable in polynomial time without oracle. Then $\#\mathrm{P}\subseteq \mathrm{FBQP}$ and $\mathrm{PP}=\mathrm{BQP}$.

Proof. 

Under GRH, $\mathrm{Cl}(-d)$ is generated by the classes of prime forms of norm less than $6{log}^{2}d$ [34], which can be listed in polynomial time. Reduced forms give a unique encoding of group elements and the group operation is polynomial-time, so Watrous’s quantum algorithm for the order of a solvable black-box group [35] computes $h(-d)$ with bounded error in polynomial time. Hence $\mathrm{TunnellCount}\in \mathrm{FBQP}$ and, by Algorithm 1, $\#\mathrm{P}\subseteq \mathrm{FBQP}$. Every PP language is decided by comparing a $\#\mathrm{P}$ value with a threshold, so $\mathrm{PP}\subseteq \mathrm{BQP}$; conversely $\mathrm{BQP}\subseteq \mathrm{PP}$ [36].    □

The proofs of Theorem 12 and Corollary 3 use neither BSD nor the Solution Density Conjecture of Section 7: every even square-free n has $D_n\in \{0,2h(-4n)\}$ regardless of congruence. This is the reason why, in the scenario, a counting reduction through Tunnell’s theorem can only work through $C_n$, and why BSD enters through Proposition 4.

7. The Descent Cascade and the Solution Density Conjecture

An earlier form of the framework proposed to compute $\#\phi$ by a descent cascade: starting from $n_0=R(\phi )$, repeatedly replace the current instance by an element of $\mathcal{A}$ whose Tunnell count is polynomially smaller. This section states the density hypothesis the cascade needs, proves its size and termination properties, and shows that it is redundant for exact counting.

Conjecture 13 

(Solution Density Conjecture). There is a polynomial $w\ge 2$ with the following property. Let N be a size parameter and $B=poly(N)$ a budget. For every integer T with $1\le T\le 2^{B/2}$ there exists $n\in \mathcal{A}$ with $|n|\le B+O(logB)$ and $T/w(N)\le D_n\le T·w(N)$. Moreover, such an n can be found in deterministic polynomial time in N with a $\#\mathrm{P}$ oracle.

Remark 10 

(The shape of the conjecture). The upper bound on T is forced by Lemma 1. By Proposition 1, $D_n=2h(-4n)=(4/\pi )\sqrt{n}L(1,{\chi }_{-4n})$ on $\mathcal{A}$, and under GRH Littlewood’s bounds [37] give ${(loglogn)}^{-1}\ll L(1,{\chi }_{-4n})\ll loglogn$. Hence, under GRH, the existence part of Conjecture 13 follows, for a suitable w, from the gap hypothesis that for every $Y\ge 2$ the interval $[Y,Y{(logY)}^c]$ contains an element of $\mathcal{A}$, for a suitable absolute constant c (take $Y\asymp T^2$). Since $\mathcal{A}$ has density zero (Remark 2), this is not implied by any known counting result, but it is falsifiable by computation.

Remark 11 

(Findability). Membership in $\mathcal{A}$ requires, under BSD, the test $C_n=h(-4n)$, which uses a $\#\mathrm{P}$ query. An existential search over n with a $\#\mathrm{P}$-oracle predicate is of type ${\mathrm{NP}}^{\#\mathrm{P}}$, and $\mathrm{P}=\mathrm{NP}$ does not relativize to give ${\mathrm{NP}}^{\#\mathrm{P}}={\mathrm{P}}^{\#\mathrm{P}}$. The findability clause is therefore an additional hypothesis.

Theorem 14 

(Instance size control). Assume Conjectures 9 and 13, and let $n_0,\dots ,n_k$ be the integers produced by Algorithm 2 on input φ, with $N=|\phi |$ and $w=w(N)$. Then: (1) $|n_j|\le |n_0|+O(log|n_0|)=poly(N)$ for all j; (2) each transition $n_j\to n_{j+1}$ takes $poly(N)$ time and $poly(N)$ queries to ${\mathcal{O}}_{\#\mathrm{P}}$; (3) $D_{n_{j+1}}\le D_{n_j}/(2w)$ for all $j<k$, and $k\le {log}_4{D}_{n_0}\le |n_0|/2+O(log|n_0|)$.

Proof. 

Put $B=|n_0|$. In iteration j the loop condition gives $D_{n_j}>2w^2$, so $c_j>w^2$ and $T_j\ge 1$. By induction $D_{n_j}\le D_{n_0}\le 2^{B/2+O(logB)}$ (Proposition 1); enlarging B by $O(logB)$ if necessary, $T_j\le 2^{B/2}$. Conjecture 13 furnishes $n_{j+1}\in \mathcal{A}$ with $|n_{j+1}|\le B+O(logB)$ and $D_{n_{j+1}}\le T_{j}w\le c_j/w=D_{n_j}/(2w)$, found within the stated resources. Since $w\ge 2$, $D_{n_{j+1}}\le D_{n_j}/4$, and $D_{n_k}\ge 1$ by Proposition 1; hence $4^k\le D_{n_0}$.    □

Proposition 5 

(Redundancy of the cascade). Under Conjectures 9 and 13, Algorithm 2 returns $\#\phi$, and its output depends on the oracle answers only through $d_0=D_{n_0}$; line 3 is exactly the query of Algorithm 1. Conjecture 13 plays no role in the correctness or complexity of exact counting.

Algorithm 2 DescentCascade (conditional, with $\#\mathrm{P}$ oracle)

Require:  Boolean formula $\phi$; oracle ${\mathcal{O}}_{\#\mathrm{P}}$; window polynomial w Ensure:  $\#\phi$ 1: $n_0\leftarrow R(\phi )$ {Conjecture 9} 2: $B\leftarrow |n_0|$; $j\leftarrow 0$ 3: $d_0\leftarrow {\mathcal{O}}_{\#\mathrm{P}}(D_{n_0})$ 4: while $d_j>2w{(|\phi |)}^2$  do 5:    $c_j\leftarrow d_j/2$ {$C_{n_j}=D_{n_j}/2$ since $n_j\in \mathcal{A}$ (Theorem 1(1))} 6:    $T_j\leftarrow \lfloor c_j/w{(|\phi |)}^2\rfloor$ 7:    $n_{j+1}\leftarrow \mathrm{FindCongruentNumber}(T_j,B)$ {Conjecture 13} 8:    $d_{j+1}\leftarrow {\mathcal{O}}_{\#\mathrm{P}}(D_{n_{j+1}})$ 9:    $r_j\leftarrow d_j/d_{j+1}$ {a rational number} 10:    $j\leftarrow j+1$ 11: end while 12: $\mathrm{total}\leftarrow d_j·{\prod }_{i<j}{r}_i$ {equals $d_0$ by telescoping} 13: return $(\mathrm{total}-\beta (\phi ))/\alpha (\phi )$

Proof. 

By construction $r_i=d_i/d_{i+1}$, so $d_j{\prod }_{i<j}{r}_i=d_0$ by telescoping, and the returned value is $(D_{n_0}-\beta (\phi ))/\alpha (\phi )=\#\phi$.    □

Remark 12. 

The reconstruction factor ${\prod }_{i<k}{r}_i=D_{n_0}/D_{n_k}$ can be as large as $2^{B/2}$; the product of $k=poly(N)$ factors, each at least $2w$, is in general super-polynomial and cannot be recovered from $D_{n_k}$ alone. The descent does not trade a large count for a small one.

8. Discussion

8.1. Status of the Hypotheses

The Sha-Tractability Hypothesis. Conjecture 7 asks for two things: to decide whether $r(E_n)>0$, and in rank zero to compute $|\mathrm{Sha}(E_n)|$. Partial information is accessible: the 2-Selmer group of $E_n$, which contains $E_n(\mathbb{Q})/2E_n(\mathbb{Q})$ and surjects onto $\mathrm{Sha}(E_n)[2]$, is determined by an explicit matrix of Legendre symbols of the prime factors of n [38], hence is polynomial-time computable under $\mathrm{P}=\mathrm{NP}$. For the odd part of $\mathrm{Sha}(E_n)$, and for the rank itself, no algorithm in the polynomial hierarchy is known: a generator of $E_n(\mathbb{Q})$ may have height exponential in $|n|$, so points are not polynomial-size certificates of positive rank, and non-trivial elements of Sha are genus-one curves without rational points, for which no short certificates are known. Conjecture 7 would in particular place the congruent number problem for $n\in \mathcal{N}$ in ${\mathrm{P}}^{\mathrm{NP}}$ without assuming the analytic part of BSD, provided only that $\mathrm{Sha}(E_n)$ is finite whenever $r(E_n)=0$: then $S(n)=0$ if and only if $r(E_n)>0$.

The Cusp Reduction Conjecture. Conjecture 6 asks for an exact encoding of $\#\mathrm{SAT}$ into the coefficients of Tunnell’s cusp form at the arguments $n/2$, $n\in \mathcal{N}$. By Remark 8 the output n must have at least about $2v$ bits for formulas with v variables, and by Lemma 3 the relevant quantity is $a(n/2)=C_n-h(-4n)$, whose square is proportional to $\sqrt{n}L(E_n,1)$ (Proposition 3). No construction is known, and obstructions (i) and (ii) of Remark 9 apply. On the other hand, no algorithm in the polynomial hierarchy is known for $a(n/2)$, so nothing in the present paper refutes the conjecture, in contrast with Conjecture 9.

BSD. BSD for $E_n$ is supported by extensive numerical evidence [39] and by deep theoretical results [14,28,32,33,40]; in particular, for $L(E_n,1)\ne 0$ only the 2-part of the rank-zero formula remains open, and partial results on 2-parts for CM curves are available [41]. The branch of Corollary 2 in which BSD fails is therefore confined to the 2-primary part of $\mathrm{Sha}(E_n)$ or to curves with $L(E_n,1)=0$ and rank zero. Corollary 2 shows that, in the scenario, this evidence bears on the two computational hypotheses as much as the hypotheses bear on BSD (Remark 5).

8.2. The Role of Each Assumption

• P = NP makes factorization, NP search, class numbers (Theorem 5) and hence $D_n$ polynomial-time, and turns the NP-oracle functions of Conjectures 6 and 7 into polynomial-time functions.
• $\#\mathrm{P}\ne \mathrm{FP}$ is the hypothesis that is contradicted in Theorem 8; it is what makes the failure of BSD a consequence rather than a mere possibility.
• BSD is used only through Proposition 4, which converts the algebraic invariants $r(E_n)$ and $|\mathrm{Sha}(E_n)|$ into the analytic count $C_n$ up to sign. It is not used in Section 4 or Section 6.
• GRH is used only in Corollary 4 and in the analysis of Conjecture 13.

8.3. Falsifiability and Routes to Partial Progress

• Testing Proposition 4. For every $n\in \mathcal{N}$ for which $|\mathrm{Sha}(E_n)|$ can be determined algebraically (for instance by descent), the proposition predicts $C_n=h(-4n)\pm \tau (n/2)\sqrt{|\mathrm{Sha}(E_n)|}$. A single counterexample would disprove BSD for $E_n$.
• Complexity of Tunnell’s cusp coefficient. Any algorithm in the polynomial hierarchy for $n\mapsto a(n/2)$ on $\mathcal{N}$ would refute Conjecture 6 unless PH collapses, by the argument of Theorem 12. Conversely, a proof that $a(n/2)$ is $\#\mathrm{P}$-hard under exact reductions would establish Conjecture 6.
• Complexity of Sha. Any proof that deciding $r(E_n)>0$ for $n\in \mathcal{N}$ is hard for a class beyond PH would refute Conjecture 7; conversely, polynomial-time certificates for the rank and for the order of $\mathrm{Sha}(E_n)$ would establish it under $\mathrm{P}=\mathrm{NP}$.
• Gap statistics of $\mathcal{A}$. Tabulating $\mathcal{A}\cap [1,X]$ for X up to ${10}^{12}$ [39] and measuring maximal multiplicative gaps would test the gap hypothesis underlying Conjecture 13.

What this paper is not. We do not claim that $\mathrm{P}=\mathrm{NP}$, that $\#\mathrm{P}\ne \mathrm{FP}$, or that BSD is false. We prove that, in the scenario (1), BSD fails infinitely often unless the Cusp Reduction Conjecture or the Sha-Tractability Hypothesis fails, and we prove that the route through $D_n$ is closed.

8.4. Toda’s Theorem and the Scenario

Under $\mathrm{P}=\mathrm{NP}$ the polynomial hierarchy equals P, so Toda’s theorem yields no additional information inside the scenario. It becomes informative when $\mathrm{P}=\mathrm{NP}$ is dropped, as in Theorem 12, where it converts $\#\mathrm{P}\subseteq {\mathrm{FP}}^{{\Sigma }_2^{\mathrm{P}}}$ into $\mathrm{PH}={\Delta }_3^{\mathrm{P}}$.

8.5. Relationship to Prior Work

Connections between number theory and complexity theory have been explored in many contexts, including the complexity of Diophantine problems [19,42], number-theoretic algorithms [43,44], and class group computation, which is subexponential under GRH [45] and quantum polynomial-time given a generating set [35]. Tunnell’s criterion has been studied computationally on a large scale [39], and Ono [21] used Tunnell’s forms to study the Tate–Shafarevich groups of the congruent number curves. The class-number structure of $D_n$ is an instance of the theory of ternary forms with one class in their genus [17,23]. The enumerative counting theorem of Cai and Hemachandra [16] is the complexity-theoretic tool that converts the two-fold sign ambiguity of Proposition 4 into exact counting. The complexity consequences drawn here appear to be new.

8.6. Comparison with Known Complexity Results

Table 1 summarizes the landscape. The row for $C_n$ on $\mathcal{A}$ uses $C_n=h(-4n)$ there, which is unconditional by Theorem 1(1) and Proposition 1; membership of a given n in $\mathcal{A}$ is, of course, not assumed to be decidable.

9. Extended Proofs

9.1. Solution Count Tracking

Lemma 7 

(Solution count tracking). Let $n_0,\dots ,n_k$ be produced by Algorithm 2 and $r_j=D_{n_j}/D_{n_{j+1}}$. Under Conjectures 9 and 13,

$$\#\phi ={\displaystyle \frac{D_{n_0}-\beta (\phi )}{\alpha (\phi )}}={\displaystyle \frac{D_{n_k}·{\prod }_{j=0}^{k-1}{r}_j-\beta (\phi )}{\alpha (\phi )}},$$

and each $r_j$ is a rational number with $r_j\ge 2w(|\phi |)$.

Proof. 

The first equality is Conjecture 9, the second is telescoping, and $r_j\ge 2w$ is Theorem 14(3). The window of Conjecture 13 determines $D_{n_{j+1}}$ only up to a factor $w^2$, so $r_j$ is not a function of $D_{n_j}$ alone, and ${\prod }_{j<k}{r}_j\ge {(2w)}^k$ is not bounded by any fixed polynomial when k grows polynomially.    □

9.2. Verification of the Cascade

Lemma 8 

(Cascade verification). Assume $\mathrm{P}=\mathrm{NP}$ and BSD. Given $n_0,\dots ,n_k$ with $k=poly(|\phi |)$, the statements “$n_j\in \mathcal{A}$” and “$D_{n_{j+1}}\in [T_j/w,T_{j}w]$” can be verified for all j in deterministic polynomial time with $k+1$ queries to a $\#\mathrm{P}$ oracle.

Proof. 

For each j: square-freeness and $n_{j}mod8$ are decided in polynomial time (Lemma 5(1)); $D_{n_j}$ is computed in polynomial time (Corollary 1); congruence is decided under BSD by comparing $C_{n_j}$, obtained with one oracle query, with $h(-4n_j)$ (Proposition 1). The window tests compare polynomial-time computable integers.    □

10. Additional Remarks

10.1. Other Families of Twists

Tunnell-type criteria exist for other families of quadratic twists via Waldspurger’s theorem [13]. The mechanism of this paper suggests, without proof in general, the following heuristic: when a criterion compares two theta series, one of whose representation numbers are class numbers (for instance because its genus contains a single class), then on the vanishing locus of $L(E,1)$ the relevant counts are class-number quantities and are easy under $\mathrm{P}=\mathrm{NP}$, while off that locus they equal a class-number quantity plus a cusp coefficient that BSD ties to $|\mathrm{Sha}|$. An analogue of Theorem 8 should then hold for each such family.

10.2. Quantum Computation

Factorization is in quantum polynomial time by Shor’s algorithm [46], and $\mathrm{BQP}\subseteq \mathrm{PP}$ [36], so no quantum polynomial-time algorithm for $\#\mathrm{P}$-hard counting is expected. Corollary 4 shows that, under GRH, $D_n$ on even square-free n is computable in quantum polynomial time. No such statement is known for the cusp coefficient $a(n/2)$.

10.3. Average-Case Complexity

Our results concern worst-case complexity. An interesting question is whether average-case hardness of #P problems relates to the distribution of $a(n/2)$, equivalently of $L(E_n,1)$ and, under BSD, of $|\mathrm{Sha}(E_n)|$, along $\mathcal{N}$, for which Goldfeld’s conjecture [47] and its partial resolutions [28] are natural starting points.

11. Conclusion

We explored the scenario in which $\mathrm{P}=\mathrm{NP}$ but $\#\mathrm{P}\ne \mathrm{FP}$ and asked what it implies for the Birch–Swinnerton-Dyer conjecture for the congruent number curves. The analysis rests on four unconditional results: on square-free $n\equiv 2(mod8)$, Tunnell’s count $D_n$ equals $2h(-4n)$; class numbers are computable in ${\mathrm{FP}}^{{\Sigma }_2^{\mathrm{P}}}$, hence in FP under $\mathrm{P}=\mathrm{NP}$; the count $C_n$ equals $h(-4n)$ plus the $n/2$-th coefficient of Tunnell’s cusp form $\eta (8z)\eta (16z)\theta (4z)$; and exact reductions to $D_n$ collapse the polynomial hierarchy. Through Tunnell’s L-value formula and Ono’s evaluation of the BSD prediction, BSD turns the order of the Tate–Shafarevich group into the value of $C_n$ up to sign, and the theorem of Cai and Hemachandra turns two candidates into an exact count. The principal conclusion is Corollary 2: if $\mathrm{P}=\mathrm{NP}$ and $\#\mathrm{P}\ne \mathrm{FP}$, and if $\#\mathrm{SAT}$ reduces exactly to $C_n$ and $|\mathrm{Sha}(E_n)|$ is tractable, then BSD fails for infinitely many congruent number curves $E_n$, in its rank statement or in the 2-part of its rank-zero formula.

The conclusion is only as strong as its two computational hypotheses, and the same theorem can be read as saying that, in the scenario, BSD forces the failure of one of them. The most actionable open questions are therefore: (i) Is Tunnell’s cusp coefficient $a(n/2)$$\#\mathrm{P}$-hard under exact reductions, or does it lie in the polynomial hierarchy? (ii) Is the rank and the order of $\mathrm{Sha}(E_n)$ computable with polynomial-size certificates? (iii) Does an analogue of the BSD bridge exist for other families of twists with class-number-one Tunnell forms? A resolution of (i) or (ii) would decide which branch of the trichotomy of Remark 5 can occur in the scenario.