Transcendental lattices and supersingular reduction lattices of a singular $K3$ surface

A (smooth) K3 surface X defined over a field k of characteristic 0 is called singular if the N\'eron-Severi lattice NS (X) of X over the algebraic closure of k is of rank 20. Let X be a singular K3 surface defined over a number field F. For each embedding \sigma of F into the complex number field, we denote by T(X^\sigma) the transcendental lattice of the complex K3 surface X^\sigma obtained from X by \sigma. For each prime ideal P of F at which X has a supersingular reduction X_P, we define L(X, P) to be the orthogonal complement of NS(X) in NS(X_P). We investigate the relation between these lattices T(X^\sigma) and L(X, P). As an application, we give a lower bound of the degree of a number field over which a singular K3 surface with a given transcendental lattice can be defined.


Introduction
For a smooth projective surface X defined over a field k, we denote by Pic(X) the Picard group of X, and by NS(X) the Néron-Severi lattice of X ⊗k, wherek is the algebraic closure of k. When X is a K3 surface, we have a natural isomorphism Pic(X ⊗k) ∼ = NS(X). We say that a K3 surface X in characteristic 0 is singular if NS(X) is of rank 20, while a K3 surface X in characteristic p > 0 is supersingular if NS(X) is of rank 22. It is known ( [17], [30], [31]) that every complex singular K3 surface is defined over a number field.
For a number field F , we denote by Emb(F ) the set of embeddings of F into C, by Z F the integer ring of F , and by π F : Spec Z F → Spec Z the natural projection. Let X be a singular K3 surface defined over a number field F , and let X → U be a smooth proper family of K3 surfaces over a non-empty open subset U of Spec Z F such that the generic fiber is isomorphic to X. We put d(X) := disc(NS(X)).
Remark that we have d(X) < 0 by Hodge index theorem. For σ ∈ Emb(F ), we denote by X σ the complex analytic K3 surface obtained from X by σ. The transcendental lattice T (X σ ) of X σ is defined to be the orthogonal complement of NS(X) ∼ = NS(X σ ) in the second Betti cohomology group H 2 (X σ , Z), which we regard as a lattice by the cup-product. Then T (X σ ) is an even positive-definite lattice of rank 2 with discriminant −d(X). For a closed point p of U , we denote by X p the reduction of X at p. Then X p is a K3 surface defined over the finite field κ p := Z F /p. For a prime integer p, we put which preserves the intersection pairing (see [2, Exp. X], [11, §4] or [12, §20.3]), and hence is injective. We denote by L(X , p) the orthogonal complement of NS(X) in NS(X p ), and call L(X , p) the supersingular reduction lattice of X at p. Then L(X , p) is an even negative-definite lattice of rank 2. We will see that, if p | 2d(X), then the discriminant of L(X , p) is −p 2 d(X).
For an odd prime integer p not dividing x ∈ Z, we denote by (1) If χ p (d(X)) = 1, then S p (X ) is empty.
(2) If p ∈ S p (X ), then the Artin invariant of X p is 1.
The first main result of this paper, which will be proved in §6.5, is as follows: There exists a finite set N of prime integers containing the prime divisors of 2d(X) such that the following holds: We put Z ∞ := R. Let R be Z or Z l , where l is a prime integer or ∞. An R-lattice is a free R-module Λ of finite rank with a non-degenerate symmetric bilinear form ( , ) : Λ × Λ → R.
A Z-lattice is simply called a lattice. For a lattice Λ and a non-zero integer n, we denote by Λ[n] the lattice obtained from Λ by multiplying the symmetric bilinear form ( , ) by n. A lattice Λ is said to be even if (v, v) ∈ 2Z holds for any v ∈ Λ. Let Λ and Λ ′ be lattices. We denote by Λ ⊥ Λ ′ the orthogonal direct-sum of Λ and Λ ′ . A homomorphism Λ → Λ ′ preserving the symmetric bilinear form is called an isometry. Note that an isometry is injective because of the non-degeneracy of the symmetric bilinear forms. An isometry Λ ֒→ Λ ′ (or a sublattice Λ of Λ ′ ) is said to be primitive if the cokernel Λ ′ /Λ is torsion-free. The primitive closure of a sublattice Λ ֒→ Λ ′ is the intersection of Λ ⊗ Q and Λ ′ in Λ ′ ⊗ Q. For an isometry Λ ֒→ Λ ′ , we put Note that (Λ ֒→ Λ ′ ) ⊥ is primitive in Λ ′ . Let r be a positive integer, and d a nonzero integer. We denote by L(r, d) the set of isomorphism classes of lattices of rank r with discriminant d, and by [Λ] ∈ L(r, d) the isomorphism class of a lattice Λ. If [Λ] ∈ L(r, d), then we have [Λ[n]] ∈ L(r, n r d), and the map L(r, d) → L(r, n r d) given by [Λ] → [Λ[n]] is injective. We denote by L even (r, d) (resp. L pos (r, d)) the set of isomorphism classes in L(r, d) of even lattices (resp. of positive-definite lattices).
We recall the notion of genera of lattices. See [4], for example, for details. Two lattices Λ and Λ ′ are said to be in the same genus if Λ ⊗ Z l and Λ ′ ⊗ Z l are isomorphic as Z l -lattices for any l (including ∞). If Λ and Λ ′ are in the same genus, then we have rank(Λ) = rank(Λ ′ ) and disc(Λ) = disc(Λ ′ ). Therefore the set L(r, d) is decomposed into the disjoint union of genera. For each non-zero integer n, Λ and Λ ′ are in the same genus if and only if Λ[n] and Λ ′ [n] are in the same genus. Moreover, if Λ ′′ is in the same genus as Λ[n], then there exists Λ ′ in the same genus as Λ such that [Λ ′′ ] = [Λ ′ [n]] holds. Therefore, for each genus G ⊂ L(r, d), we can define the genus G[n] ⊂ L(r, n r d) by The map from the set of genera in L(r, d) to the set of genera in L(r, n r d) given by G → G[n] is injective. Suppose that Λ and Λ ′ are in the same genus. If Λ is even (resp. positive-definite), then so is Λ ′ . Hence L even (r, d) and L pos (r, d) are also disjoint unions of genera. We say that a genus G ⊂ L(r, d) is even (resp. positivedefinite) if G ⊂ L even (r, d) (resp. G ⊂ L pos (r, d)) holds.
We review the theory of discriminant forms due to Nikulin [20]. Let Λ be an even lattice. We put Λ ∨ := Hom(Λ, Z). Then Λ is embedded into Λ ∨ naturally as a submodule of finite index, and there exists a unique Q-valued symmetric bilinear form on Λ ∨ that extends the Z-valued symmetric bilinear form on Λ. We put which is a finite abelian group of order | disc(Λ)|, and define a quadratic form by q Λ (x + Λ) := (x, x) + 2Z for x ∈ Λ ∨ . The finite quadratic form (D Λ , q Λ ) is called the discriminant form of Λ.
Theorem-Definition 1.0.2 (Corollary 1.9.4 in [20]). Let Λ and Λ ′ be even lattices. Then Λ and Λ ′ are in the same genus if and only if the following hold: (i) Λ ⊗ Z ∞ and Λ ′ ⊗ Z ∞ are isomorphic as Z ∞ -lattices, and (ii) the finite quadratic forms (D Λ , q Λ ) and (D Λ ′ , q Λ ′ ) are isomorphic. Therefore, for an even genus G, we can define the discriminant form (D G , q G ) of G.
We denote by (D RS p,σ , q RS p,σ ) the discriminant form of the Rudakov-Shafarevich lattice Λ p,σ . The finite quadratic form (D RS p,σ , q RS p,σ ) has been calculated explicitly in our previous paper [26,Proof of Proposition 4.2].
Our second main result, which will be proved in §2, is as follows: Theorem 2. Let X be a singular K3 surface defined over a number field F , and let X → U be a smooth proper family of K3 surfaces over a non-empty open subset U of Spec Z F such that the generic fiber is isomorphic to X. We put d(X) := disc(NS(X)).
(T) There exists a unique genus G C (X) ⊂ L(2, −d(X)) such that [ T (X σ ) ] is contained in G C (X) for any σ ∈ Emb(F ). This genus G C (X) is determined by the properties that it is even, positive-definite, and that the discriminant form is isomorphic to (D NS(X) , −q NS(X) ).
(L) Let p be a prime integer not dividing 2d(X). Suppose that S p (X ) = ∅. Then there exists a unique genus G p (X ) ⊂ L(2, −d(X)) such that [L(X , p)] is contained in G p (X )[−p] for any p ∈ S p (X ). This genus G p (X ) is determined by the properties that it is even, positive-definite, and that the discriminant form of G p (X )[−p] is isomorphic to (D RS p,1 , q RS p,1 ) ⊕ (D NS(X) , −q NS(X) ). To ease notation, we put Let D be a negative integer. We then put The group GL 2 (Z) acts on Q D from right by (M, g) → g T M g for M ∈ Q D and g ∈ GL 2 (Z), and the subset Q * D of Q D is stable by this action. We put and L D is regarded as the set of isomorphism classes of even positive-definite oriented lattices of rank 2 with discriminant −D.
Let S be a complex K3 surface or a complex abelian surface. Suppose that the transcendental lattice T (S) := (NS(S) ֒→ H 2 (S, Z)) ⊥ of S is of rank 2. Then T (S) is even, positive-definite and of discriminant −d(S), where d(S) := disc(NS(S)). By the Hodge structure of T (S), we can define a canonical orientation on T (S) as follows. An ordered basis (e 1 , e 2 ) of T (S) is said to be positive if the imaginary part of (e 1 , ω S )/(e 2 , ω S ) ∈ C is positive, where ω S is a basis of H 2,0 (S). We denote by T (S) the oriented transcendental lattice of S, and by [ T (S) ] ∈ L d(S) the isomorphism class of T (S). We have the following important theorem due to Shioda and Inose [30]: gives rise to a bijection from the set of isomorphism classes of complex singular K3 surfaces S to the set of isomorphism classes of even positive-definite oriented lattices of rank 2.
If a genus G ⊂ L D satisfies G ∩ L * D = ∅, then G ⊂ L * D holds. Therefore L * D is a disjoint union of genera. For a genus G ⊂ L D , we denote by G the pull-back of G by the natural projection L D → L D , and call G ⊂ L D a lifted genus.
A negative integer D is called a fundamental discriminant if it is the discriminant of an imaginary quadratic field.
Our third main result, which will be proved in §6.6 and §6.7, is as follows: Theorem 3. Let S be a complex singular K3 surface. Suppose that D := disc(NS(S)) is a fundamental discriminant, and that [T (S)] is contained in L * D . (T) There exists a singular K3 surface X defined over a number field F such that In particular, there exists σ 0 ∈ Emb(F ) such that X σ0 is isomorphic to S over C.
(L) Suppose further that D is odd. Then there exists a smooth proper family X → U of K3 surfaces over a non-empty open subset U of Spec Z F , where F is a number field, such that the following hold: (i) the generic fiber X of X → U satisfies the property in (T) above, Suppose that D is a negative fundamental discriminant. The set L * D and its decomposition into lifted genera are very well understood by the work of Gauss. We review the theory briefly. We put K := Q( √ D), and denote by I D the multiplicative group of non-zero fractional ideals of K, by P D ⊂ I D the subgroup of non-zero principal fractional ideals, and by Cl D := I D /P D the ideal class group of K. Let I be an element of I D . We denote by [I] ∈ Cl D the ideal class of I. We put where n is an integer = 0 such that nI ⊂ Z K , and define a bilinear form on I by We say that an ordered basis (ω 1 , ω 2 ) of I as a Z-module is positive if In particular, every lifted genus in L * D consists of the same number of isomorphism classes, and the cardinality is equal to |Cl 2 D |. Using Theorems 1.0.5 and 3(T), we obtain the following: Corollary 4. Let S be a complex singular K3 surface such that D := disc(NS(S)) is a fundamental discriminant, and that [T (S)] is contained in L * D . Let Y be a K3 surface defined over a number field L such that Y τ0 is isomorphic to S over C for some τ 0 ∈ Emb(L). Then we have [L : Q] ≥ |Cl 2 D |. Proof. Let X be the K3 surface defined over a number field F given in Theorem 3(T). Then the complex K3 surfaces X σ0 and Y τ0 are isomorphic over C, and hence there exists a number field M ⊂ C containing both of σ 0 (F ) and τ 0 (L) such that X ⊗ M and Y ⊗ M are isomorphic over M . Therefore, for each σ ∈ Emb(F ), there exists τ ∈ Emb(L) such that X σ is isomorphic to Y τ over C. Since there exist exactly |Cl 2 D | isomorphism classes of complex K3 surfaces among X σ (σ ∈ Emb(F )), we have | Emb(L)| ≥ |Cl 2 D |. The proof of Theorem 2 is in fact an easy application of Nikulin's theory of discriminant forms, and is given in §2. The main tool of the proof of Theorems 1 and 3 is the Shioda-Inose-Kummer construction [30]. This construction makes a singular K3 surface Y from a pair of elliptic curves E ′ and E. Shioda and Inose [30] proved that, over C, the transcendental lattices of Y and E ′ ×E are isomorphic. We present their construction in our setting, and show that, over a number field, the supersingular reduction lattices of Y and E ′ × E are also isomorphic under certain assumptions. The supersingular reduction lattice of E ′ × E is calculated by the specialization homomorphism Hom(E ′ , E) → Hom(E ′ p , E p ). In §3, we investigate the Hom-lattices of elliptic curves. After examining the Kummer construction in §4 and the Shioda-Inose construction in §5, we prove Theorems 1 and 3 in §6. For Theorem 3(T), we use the Shioda-Mitani theory [33]. For Theorem 3(L), we need a description of embeddings of Z K into maximal orders of a quaternion algebra over Q. We use Dorman's description [9], which we expound in §7.
In [25], Shafarevich studied, by means of the Shioda-Inose-Kummer construction, number fields over which a singular K3 surface with a prescribed Néron-Severi lattice can be defined, and proved a certain finiteness theorem.
The supersingular reduction lattices and their relation to the transcendental lattice were first studied by Shioda [32] for certain K3 surfaces. Thanks are due to Professor Tetsuji Shioda for stimulating conversations and many comments.
After the first version of this paper appeared on the e-print archive, Schütt [24] has succeeded in removing the assumptions in Theorem 3(T) and Corollary 4 that D = disc(NS(S)) be a fundamental discriminant, and that [T (S)] be in L * D . Interesting examples of singular K3 surfaces defined over number fields are also given in [24, §7].
The author expresses gratitude to the referee for many comments and suggestions improving the exposition. Let of finite quadratic forms. In particular, we have disc(N ) = disc(L) disc(M ).
Proof. We put d L := | disc(L)| = |D L |. The multiplication by d L induces an automorphism δ L : D M → ∼ D M of D M by the assumption. We regard L, M , N and Since M is primitive in L, we have L ∩ M ∨ = M , and hence δ L (x + M ) = 0 holds in D M . Because δ L is an automorphism of D M , we have x ∈ M . Next we show that the composite of natural homomorphisms is surjective. Let ξ ∈ D M be given. There exists η ∈ D M such that δ L (η) = ξ.
Since L ∨ → M ∨ is surjective by the primitivity of M ֒→ L, there exists y ∈ L ∨ that is mapped to η. Then x := d L y is in L and is mapped to ξ. We define a homomorphism τ : D N → D L ⊕ D M as follows. Let x ∈ N ∨ be given. Since L ∨ → N ∨ is surjective by the primitivity of N ֒→ L, there exists z ∈ L ∨ that is mapped to x. Let y ∈ M ∨ be the image of z by L ∨ → M ∨ . We put The well-definedness of τ follows from the formula (2.1.1). Since z = (y, x) in The infectivity of τ follows from L ∩ N ∨ = N . Since the homomorphism (2.1.2) is surjective, the homomorphism τ is also surjective.

2.2.
The cokernel of the specialization isometry. Let W be a Dedekind domain with the quotient field F being a number field, and let X → U := Spec W be a smooth proper family of K3 surfaces. We put X := X ⊗ F . In this subsection, we do not assume that rank(NS(X)) = 20. Let p be a closed point of U such that X 0 := X ⊗ κ p is supersingular. We consider the specialization isometry ρ : NS(X) = Pic(X ⊗ F ) ֒→ NS(X 0 ) = Pic(X 0 ⊗κ p ), whose definition is given in [2, Exp. X] or [11, §4]. We put p := char κ p . Proposition 2.2.1. Every torsion element of Coker(ρ) has order a power of p.
Proof. We denote byF the completion of F at p, and byÂ the valuation ring of F with the maximal idealp. LetL be a finite extension ofF with the valuation ringB, the maximal idealm, and the residue field κm such that there exist natural isomorphisms Pic(X⊗L) ∼ = NS(X) and Pic(X 0 ⊗κm) ∼ = NS(X 0 ). Then ρ is obtained from the restriction isomorphism to the generic fiber, whose inverse is given by taking the closure of divisors, and the restriction homomorphism In particular, the projective limit of Pic(Y n ) is equal to ∩ n Pic(Y n ). Since every nonzero element of H 2 (Y 0 , O 0 ) is of order p, every torsion element of Pic(Y 0 )/∩ n Pic(Y n ) is of order a power of p.
Let NS(X) be the primitive closure of NS(X) in NS(X 0 ). Then the index of NS(X) in NS(X) is a divisor of disc(NS(X)). Therefore we obtain the following: 2.3. Proof of Theorem 2. Let X → Spec F and X → U be as in the statement of Theorem 2. Note that NS(X) is of signature (1,19), while the lattice H 2 (X σ , Z) is even, unimodular and of signature (3,19) for any σ ∈ Emb(F ). Hence T (X σ ) is even, positive-definite of rank 2, and its discriminant form is isomorphic to (D NS(X) , −q NS(X) ) by Proposition 2.1.1. Therefore [T (X σ )] is contained in the genus G ⊂ L d(X) characterized by (D G , q G ) ∼ = (D NS(X) , −q NS(X) ).
Let p be a point of S p (X ) with p | 2d(X). Since the Artin invariant of X p is 1 by Proposition 1.0.1, we have NS(X p ) ∼ = Λ p,1 by Theorem 1.0.4. Therefore L(X , p) is even, negative-definite of rank 2. On the other hand, Corollary 2.2.2 implies that the specialization isometry ρ is primitive, and hence the discriminant form of L(X , p) is isomorphic to (D RS p,1 , q RS p,1 ) ⊕ (D NS(X) , −q NS(X) ) by Proposition 2.1.1. It remains to show that there exists [M ] ∈ L d(X) such that L(X , p) ∼ = M [−p], or equivalently, we have (x, y) ∈ pZ for any x, y ∈ L(X , p). This follows from the following lemma, whose proof was given in [29]. Lemma 2.3.1. Let p be an odd prime integer, and L an even lattice of rank 2. If the p-part of D L is isomorphic to (Z/pZ) ⊕2 , then (x, y) ∈ pZ holds for any x, y ∈ L.
3. Hom-lattice 3.1. Preliminaries. Let E ′ and E be elliptic curves defined over a field k. We denote by Hom k (E ′ , E) the Z-module of homomorphisms from E ′ to E defined over k, and put The Zariski tangent space T O (E) of E at the origin O is a one-dimensional k-vector space, and hence End k (T O (E)) is canonically isomorphic to k. By the action of According to [34, §6 in Chap. III], we define a lattice structure on Hom(E ′ , E) by We consider the product abelian surface Let O ′ ∈ E ′ and O ∈ E be the origins. We put and denote by U (A) the sublattice of NS(A) spanned by ξ and η, which is even, unimodular and of signature (1, 1). The following is classical. See [37], for example.
In particular, the lattice Hom(E ′ , E) is even and positive-definite.
One can easily prove the following propositions by means of, for example, the results in [  3.2. The elliptic curve E J . To the end of §3.4, we work over an algebraically closed field k. For an elliptic curve E, we denote by k(E) the function field of E.
Definition 3.2.1. Two non-zero isogenies φ 1 : E → E 1 and φ 2 : E → E 2 are isomorphic if there exists an isomorphism ψ : E 1 → ∼ E 2 such that ψ • φ 1 = φ 2 holds, or equivalently, if the subfields φ * 1 k(E 1 ) and φ * 2 k(E 2 ) of k(E) are equal. For a non-zero endomorphism a ∈ End(E), we denote by E a the image of a, that is, E a is an elliptic curve isomorphic to E with an isogeny a : E → E a . The function field k(E a ) is canonically identified with the subfield a * k( Definition 3.2.2. Let J ⊂ End(E) be a non-zero left-ideal of End(E). We denote by k(E J ) ⊂ k(E) the composite of the subfields k(E a ) for all non-zero a ∈ J. Then k(E J ) is a function field of an elliptic curve E J . We denote by Remark 3.2.3. Let a, b ∈ End(E) be non-zero. Since ba(x) = b(a(x)), we have canonical inclusions k(E ba ) ⊂ k(E a ) ⊂ k(E). Hence, if the left-ideal J is generated by non-zero elements a 1 , . . . , a t , then k(E J ) is the composite of k(E a1 ), . . . , k(E at ). Remark 3.2.4. The isogeny φ J : E → E J is characterized by the following properties: (i) every a ∈ J factors through φ J , and (ii) if every a ∈ J factors through an isogeny ψ : E → E ′ , then φ J factors through ψ.
3.3. The Hom-lattice in characteristic 0. In this subsection, we assume that k =k is of characteristic 0, and that the conditions in Proposition 3.1.2 are satisfied. We denote by D the discriminant of the imaginary quadratic field K in the condition (iii) of Proposition 3.1.2. Note that End(E) is isomorphic to a Z-subalgebra of Z K with Z-rank 2, and that there exist two embeddings of End(E) into Z K as a Z-subalgebra that are conjugate over Q. Each embedding End(E) ֒→ Z K is an isometry of lattices, where Z K is considered as a lattice by the formula (1.0.4), because the dual endomorphism corresponds to the conjugate element over Q.
Proof. There exists a non-zero isogeny α : Definition 3.3.3. Suppose that k = C, and that End(E) ∼ = Z K . We fix an embedding K ֒→ C. Let Λ ⊂ C be a Z-submodule of rank 2 such that E ∼ = C/Λ as a Riemann surface. For an ideal class [I] of Z K represented by a fractional ideal I ⊂ K ⊂ C, we denote by [I] * E the complex elliptic curve C/I −1 Λ, where I −1 Λ is the Z-submodule of C generated by xλ (x ∈ I −1 , λ ∈ Λ). When I ⊆ Z K , we have I −1 Λ ⊃ Λ, and the identity map id C of C induces an isogeny From this analytic description of φ J : E → E J , we obtain the following, which holds in any field of characteristic 0.
given by g → g • φ J coincides with J.

3.4.
The Hom-lattice of supersingular elliptic curves. In this subsection, we assume that k =k is of characteristic p > 0, and that the conditions in Proposition 3.1.3 are satisfied. In particular, E is a supersingular elliptic curve.
We denote by B the quaternion algebra over Q that ramifies exactly at p and ∞. It is well-known that B is unique up to isomorphism. We denote by x → x * the canonical involution of B. Then B is equipped with a positive-definite Q-valued symmetric bilinear form defined by A subalgebra of B is called an order if its Z-rank is 4. An order is said to be maximal if it is maximal among orders with respect to the inclusion. If R is an order of B, then the bilinear form (3.4.1) takes values in Z on R, and R becomes an even lattice. It is known that R is maximal if and only if the discriminant of R is p 2 . The following are the classical results due to Deuring [8]. (See also [18, Chapter 13, Theorem 9]): Conversely, we have the following: We fix an isomorphism End(E) ⊗ Q ∼ = B such that End(E) is mapped to a maximal order R of B. Let J be a non-zero left-ideal of End(E). Consider the leftand right-orders is also maximal by [22,Theorem (21.2)]. In other words, J is a normal ideal of B. We denote by nr(J) the greatest common divisor of the integers (See [22,Corollary (24.12)].) Then, by [22,Theorem (24.11)], we have On the other hand, Deuring [8, (2.3)] proved the following: Proof. By Remark 3.2.4, we have J ⊆ Im Φ J . Suppose that there exists a ∈ Im Φ J such that a / ∈ J. Let J ′ be the left-ideal of End(E) generated by J and a. Then we have nr(J ′ ) < nr(J) by the formula (3.4.2). On the other hand, since a factors through φ J , we have k(E a ) ⊂ k(E J ) and hence k(E J ′ ) = k(E J ). This contradicts Deuring's formula (3.4.3).

Proposition 3.4.4. Let ψ : E → E ′′ be a non-zero isogeny, and let
The greatest common divisor of the degrees of g ∈ Hom(E ′′ , E) is 1 by Proposition 3.6.1 in the next subsection. Hence we have nr(J ψ ) = deg ψ by the definition of nr.
3.5. The specialization isometry of Hom-lattices. Let E be an elliptic curve defined over a finite extension L ⊂ Q p of Q p such that the j-invariant j(E) ∈ L is integral over Z p . This condition is satisfied, for example, if rank(End(E)) = 2. Then E has potentially good reduction, that is, there exist a finite extension M ⊂ Q p of L and a smooth proper morphism Then we have a specialization isometry Replacing L by a finite extension if necessary, we assume that , where E ′ 0 is the central fiber of a Néron model of E ′ . Replacing L ′ by a finite extension, we assume that End(E ′ ) = End L ′ (E ′ ). The following is easy to prove.
induced from g such that the following diagram is commutative: . Suppose that End(E) ⊗ Q is isomorphic to an imaginary quadratic field K. The following result is again due to Deuring [8]. (See also [18,Chapter 13,Theorem 12]). We now work over Q p , and assume that End(E) is isomorphic to Z K . Suppose that E 0 is supersingular. We put R := End(E 0 ). Let J be an ideal of End(E), and consider the elliptic curve E J . Since End(E J ) is also isomorphic to Z K by Proposition 3.3.5, the reduction (E J ) 0 of E J is supersingular by Proposition 3.5.3, and we have a reduction On the other hand, we have the left-ideal R · ρ(J) of R generated by ρ(J) ⊂ R, and the associated isogeny Proof. We choose a 1 , . . . , a t ∈ J such that J is generated by a 1 , . . . , a t , and that , we see that deg φ RJ is a common divisor of deg ρ(a i ) = deg a i for i = 1, . . . , t, and hence deg φ RJ divides deg ρ(φ J ). On the other hand, the left-ideal R · ρ(J) is generated by ρ(a 1 ), . . . , ρ(a t ), and hence, by Remarks 3.2.3 and 3.2.4, we see that φ RJ factors through ρ(φ J ). Therefore we obtain ρ(φ J ) = φ RJ . By Proposition 3.5.4, the following diagram is commutative: where the horizontal arrows are the specialization isometries. By Propositions 3.3.5 and 3.4.3, we obtain the following: where, in the right-hand side, J and R·ρ(J) are regarded as sublattices of the lattices End(E) ∼ = Z K and End(E 0 ) = R, respectively, and J ֒→ R · ρ(J) is given by the specialization isometry ρ : End(E) ֒→ R.
Finally, we state the lifting theorem of Deuring [8]. See also [ 3.6. Application of Tate's theorem [36]. In this subsection, we prove the following result, which was used in the proof of Proposition 3.4.4.
Proposition 3.6.1. Let E ′ and E be supersingular elliptic curves. Then the greatest common divisor of the degrees of g ∈ Hom(E ′ , E) is 1.
Proof. Without loss of generality, we can assume that E ′ and E are defined over a finite field F q of characteristic p. Replacing F q by a finite extension, we can assume hold. Let l be a prime integer = p, and consider the l-adic Tate module T l (E ′ ) of E ′ . By the famous theorem of Tate [36], we see that is of rank 4, and hence we can assume that the q-th power Frobenius morphism Frob E ′ acts on T l (E ′ ) as a scalar multiplication by √ q. In the same way, we can assume that Frob E acts on T l (E) as a scalar multiplication by √ q. Then, by the theorem of Tate [36] again, we have a natural isomorphism . Hence there exists g ∈ Hom(E ′ , E) such that deg g is not divisible by l. Therefore the greatest common divisor of the degrees of g ∈ Hom(E ′ , E) is a power of p. Let F : E ′ → E ′(p) be the p-th power Frobenius morphism of E ′ . If the degree of g : E ′ → E is divisible by p, then g factors as g ′ • F with deg g ′ = deg g/p. Therefore it is enough to show the following: Claim. For any supersingular elliptic curve E in characteristic p, there exists g ∈ Hom(E, E (p) ) such that deg g is prime to p.
Note that j(E) ∈ F p 2 and j(E (p) ) = j(E) p . By Proposition 3.5.6, there exists an elliptic curve E ♯ defined over a finite extension L of Q p such that End(E ♯ ) is of rank 2, and that E ♯ has a reduction isomorphic to E at the closed point p of Z L . We assume that L is Galois over Q p , and fix an embedding L ֒→ C. Then End(E ♯ ) is an order O of an imaginary quadratic field, and E ♯ ⊗ C is isomorphic to C/I as a Riemann surface for some invertible O-ideal I ([7, Corollary 10.20]). Note that j(E ♯ ) is a root of the Hilbert class polynomial of the order O ([7, Proposition 13.2]). There exists an element γ ∈ Gal(L/Q p ) such that We put E ♭ := (E ♯ ) γ . Then E ♭ has a reduction isomorphic to E (p) at p, and we have E ♭ ⊗ C ∼ = C/J as a Riemann surface for some invertible O-ideal J. The degree of homomorphisms in Hom(E ♯ , E ♭ ) = Hom(C/I, C/J) is given by a primitive binary form corresponding to the ideal class of the proper O-ideal I −1 J by [7,Theorem 7.7]. By [7, Lemma 2.25], we see that Hom(E ♯ , E ♭ ) has an element whose degree is prime to p. Since the specialization homomorphism Hom(E ♯ , E ♭ ) → Hom(E, E (p) ) preserves the degree, we obtain the proof.

Kummer construction
We denote by k an algebraically closed field of characteristic = 2.
4.1. Double coverings. We work over k. Let W and Z be smooth projective surfaces, and φ : W → Z a finite double covering. Let ι : W → ∼ W be the decktransformation of W over Z. Then we have homomorphisms When the base field k is C, we assume that H 2 (W, Z) and H 2 (Z, Z) are torsion-free, so that they can be regarded as lattices. We have homomorphisms Note that φ * preserves the Hodge structure. We define H 2 (W, Z) + := H 2 (W, Z) ∩ H 2 (W, Q) + in the same way as NS(W ) + . Proof. The proof follows immediately from the following: The inverse of the isomorphism φ + * ⊗ Q is given by (1/2)φ * ⊗ Q. 4.2. Disjoint (−2)-curves. We continue to work over k. Let C 1 , . . . , C m be (−2)-curves on a K3 surface X that are disjoint to each other, ∆ ⊂ NS(X) the sublattice generated by [C 1 ], . . . , [C m ], and ∆ ⊂ NS(X) the primitive closure of ∆. The discriminant group D ∆ of ∆ is isomorphic to F ⊕m 2 with basis Proof. Since H ∆ is totally isotropic with respect to q ∆ , we have wt(x) ≡ 0 mod 4 for any x ∈ H ∆ . Let γ : X → Y be the contraction of C 1 , . . . , C m , and L Y a very ample line bundle on the normal K3 surface Y . Then {[C 1 ], . . . , [C m ]} is a fundamental system of roots in the the root system         In this subsection, we consider the case where W is a Dedekind domain. Suppose that the Kummer diagram (K) over U of E ′ and E is given. Then, at every point P of U (closed or generic, see the definition (1.0.6)), the diagram (K) ⊗κ P is the Kummer diagram of the elliptic curves E ′ ⊗κ P and E ⊗κ P .
Let p be a closed point of U with κ := κ p being of characteristic p. Note that p = 2 by the assumption 1/2 ∈ W . We put (4.5.1) We use the following lemma, whose proof is quite elementary and is omitted:  Hence the isometry (4.5.4) is an isomorphism.

Shioda-Inose construction
We continue to denote by k an algebraically closed field of characteristic = 2.

Shioda-Inose configuration.
Let Z be a K3 surface defined over k.
Definition 5.1.1. We say that a pair (C, Θ) of reduced effective divisors on Z is a Shioda-Inose configuration if the following hold: (i) C and Θ are disjoint, (ii) C = C 1 + · · · + C 8 is an ADE-configuration of (−2)-curves of type E 8 , (iii) Θ = Θ 1 + · · · + Θ 8 is an ADE-configuration of (−2)-curves of type 8A 1 , Let (C, Θ) be a Shioda-Inose configuration on Z. Then there exists a finite double covering ϕ Y : Y → Z that branches exactly along Θ by the condition (iv). Let T i ⊂ Y be the reduced part of the pull-back of Θ i by ϕ Y , which is a (−1)-curve on Y , and let β Y : Y → Y be the contraction of T 1 , . . . , T 8 . Then Y is a K3 surface. Letι Y be the deck-transformation of Y over Z. Thenι Y is the lift of an involution ι Y : Y → ∼ Y of Y , which has eight fixed points. Next we define several sublattices of NS( Y ) and NS(Y ). Since ϕ Y isétale in a neighborhood of C ⊂ Z and C is simply-connected, the pull-back of C by ϕ Y consists of two connected components C [1] and C [2] . Let Γ [1] and Γ [2] be the sublattices of NS( Y ) generated by the classes of the irreducible components of C [1] and C [2] , respectively. We put Γ := Γ [1] ⊥ Γ [2] .
The sublattice Γ is mapped by β Y isomorphically to a sublattice of NS(Y ), which we will denote by the same letter Γ. We denote by The action ofι Y on NS( Y ) and the action of ι Y on NS(Y ) preserve the orthogonal direct-sum decompositions (5.1.4), and the action ofι Y is trivial on B 8 . We put is the eigenspace of (ι Y ) * on Γ ⊗ Q (resp. Π(Y ) ⊗ Q) with the eigenvalue 1. Sinceι Y acts on Γ by interchanging Γ [1] and Γ [2] , we have rank( Γ + ) = 8. By Lemma 4.1.1, we see that ϕ Y induces an isometry   [30]. We need the diagram (5.2.1) for the proof of Proposition 5.3.2.

5.3.
The supersingular reduction lattice of the Shioda-Inose surface. Let W be either a number field, or a Dedekind domain with the quotient field F being a number field such that 1/2 ∈ W . Let Z be a smooth proper family of K3 surfaces over U := Spec W . In this subsection, we consider the case where W is a Dedekind domain. Suppose that a Shioda-Inose diagram (SI) over U is given. Then, at every point P of U , the diagram (SI) ⊗κ P is a Shioda-Inose diagram of Z ⊗κ P .
Let p be a closed point of U with κ := κ p being of characteristic p. Note that p = 2 by the assumption 1/2 ∈ W . We put We assume that Z is singular and Z 0 is supersingular. Then Y is singular and We choose an embedding σ of F into C, and consider the transcendental lattices T (Y σ ) and T (Z σ ). We have where R(Y σ ) and S(Z σ ) are the lattices defined in the previous subsection. Since the analytic Shioda-Inose diagram (SI) σ induces the commutative diagram (5.2.1) for Y σ and Z σ , we see that the first isometry of (5.3.2) is an isomorphism.
Let S be a noetherian scheme, and let W and Z be schemes flat and projective over S. We denote by Mor S (W, Z) the functor from the category Sch S of locally noetherian schemes over S to the category of sets such that, for an object T of Sch S , we have Let F be a number field, and let X and Y be smooth projective varieties defined over F . By the flattening stratification ([10, Theorem 5.12], [19,Lecture 8]), we have a non-empty open subset U of Spec Z F and smooth projective U -schemes X and Y such that the generic fibers X × U F and Y × U F are isomorphic to X and Y , respectively. We will consider the schemes Proof. We denote by [ϕ] : Spec F → Mor U (X , Y) the U -morphism corresponding to ϕ : X → Y . Let Φ be the Hilbert polynomial of the graph Γ(ϕ) ⊂ X × F Y of ϕ with respect to a relatively ample invertible sheaf X ×U Y/U is the Hilbert scheme parameterizing closed subschemes of X × U Y flat over U with the Hilbert polynomial of fibers with respect to O(1) being equal to Φ. Since H Φ is projective over U , the morphism [ϕ] extends to a morphism [ϕ] ∼ U : We call ϕ V the extension of ϕ over V . By the uniqueness of the extension, we obtain the following: Applying Corollary 6.1.3 to an F -isomorphism and its inverse, we obtain the following, which plays a key role in the proof of Theorem 1: We give three applications that will be used in the proof of Proposition 6.3.2.
Example 6.1.5. Let Q be an F -rational point of Y , and ϕ : X → Y the blowingup of Y at Q, which is defined over F . By shrinking U if necessary, we can assume that Q is the generic fiber of a closed subscheme Q ⊂ Y that is smooth over U . Let β U : X ′ → Y be the blowing-up of Y along Q, which is defined over U . Then the restriction β η : X ′ → Y of β U to the generic fiber X ′ of X ′ → U is isomorphic to ϕ, that is, there exists an F -isomorphism τ : X ′ → ∼ X such that β η = φ • τ . Hence, by Corollaries 6.1.3 and 6.1.4, there exists a non-empty open subset V ⊂ U such that the restriction β V : Let D be a reduced smooth divisor of Y such that every irreducible component D i of D is defined over F . By shrinking U if necessary, we can assume that each D i is the generic fiber of a closed subscheme D i ⊂ Y that is smooth over U . We can also assume that these D i are mutually disjoint. Then D := D i is smooth over U .
Hence, by shrinking V = Spec R, we have elements f ∈ H 0 (Y V , M) and g ∈ H 0 (Y V , M −1 ) that restrict to ρ and ρ −1 , respectively. Then the composites f • g and g • f , considered as elements of H 0 (Y V , M ⊗ M −1 ) = R, are mapped to the 1 ∈ H 0 (Y, M ⊗ M −1 ) = F . Since R ֒→ F , we see that f and g are isomorphisms. Thus ρ extends to an isomorphism By means of ρ, a double covering δ V : X ′ V → Y V that branches exactly along D V is constructed as a closed subscheme of the line bundle on Y V corresponding to the invertible sheaf L. By construction, the restriction δ η : X ′ → Y of δ V to the generic fiber is isomorphic to ϕ : X → Y . By Corollaries 6.1.3 and 6.1.4, it follows that, making V smaller if necessary, we have a V -isomorphism X ′ V ∼ = X V under which δ V coincides with the extension ϕ V of ϕ over V . Example 6.1.8. In this example, we assume 1/2 ∈ R := Γ(U, O U ). Let ι : X → ∼ X be an involution defined over F , and ϕ : X → Y the quotient morphism by the group ι . Suppose that the extension ι U : X → ∼ X of ι over U exists. Then ι U is an involution over U by Corollary 6.1.3. Let q U : X → Y ′ be the quotient morphism by the group ι U , which is defined over U by 1/2 ∈ R. Then, by Corollaries 6.1.3, 6.1.4 and Lemma 6.1.9 below, we have a non-empty open subset

. Let A be an R-algebra on which an involution i acts. Then we have
Proof. Since 1/2 ∈ R, we see that the R-module A is the direct-sum of A i = {(a + i(a))/2 | a ∈ A} and {(a − i(a))/2 | a ∈ A}.
6.2. Shioda-Inose configuration on Km(E ′ × E). The following result is due to Shioda and Inose [30]. We briefly recall the proof. Proof. Let E ij , F j and G i (1 ≤ i, j ≤ 4) be the (−2)-curves in the double Kummer pencil (Figure 4.3.1) on Km(E ′ × E). We consider the divisor and let C be the reduced part of H − E 12 : which is an ADE-configuration of (−2)-curves of type E 8 . The complete linear system |H| defines an elliptic pencil with a section G 1 . Since HE 13 = 0 and HE 14 = 0, each of E 13 and E 14 is contained in a fiber of Φ. We put t 0 := Φ(H), t 1 := Φ(E 13 ) and t 2 := Φ(E 14 ). Note that t 0 = t 1 = t 2 = t 0 , because H, E 13 and E 14 intersect G 1 at distinct points. By [30,Theorem 1], the fibers of Φ over t 1 and t 2 are either (a) of type I * b1 and I * b2 with b 1 + b 2 ≤ 2, or (b) of type I * 0 and IV * . Hence there exist exactly eight (−2)-curves Θ 1 , . . . , Θ 8 in Φ −1 (t 1 ) and Φ −1 (t 2 ) that appear in the fiber with odd multiplicity. We denote by Θ the sum of Θ 1 , . . . , Θ 8 . Let ∆ be a projective line, and f : ∆ → P 1 the double covering that branches exactly at t 1 and t 2 . Let Y be the normalization of Km(E ′ × E) × P 1 ∆. Then Y → Km(E ′ × E) is a finite double covering that branches exactly along Θ. Hence (C, Θ) is a Shioda-Inose configuration.
6.3. The SIK diagram. Let W be either a number field, or a Dedekind domain with the quotient field F being a number field such that 1/2 ∈ W . (1) There exist a finite extension F of L, and an SIK diagram Proof. Our argument for the proof of the assertion (1) is similar to [30, §6]. We use the notation in the proof of Proposition 6.2.1. Let F be a finite extension of L such that every 2-torsion point Q ij := (u ′ i , u j ) of A := (E ′ × E) ⊗ F is rational over F . Then the blowing-up A → A and the involutionι A of A are defined over F . Therefore the quotient morphism A → Km(A) is defined over F , and every irreducible component of the double Kummer pencil on Km(A) is rational over F . Since the divisor H is defined over F , the elliptic pencil Φ on Km(A) is defined over F . Moreover, the points t 1 , t 2 ∈ P 1 are F -rational. Replacing F by a finite extension, we can assume that Y is defined over F , and that Θ 1 , . . . , Θ 8 are rational over F . Then the (−1)-curves T 1 , . . . , T 8 on Y are rational over F , and the contraction Y → Y is defined over F . Moreover, the image R i ∈ Y of T i ⊂ Y is an F -rational point of Y . Thus we have obtained an SIK diagram (SIK) F of E ′ and E over F , and the assertion (1) is proved. Moreover, (SIK) F has the following properties: (i) Each of the center Q ij of the blowing-up A → A is rational over F , and each of the center R i of the blowing-up Y ← Y is rational over F . We choose a non-empty open subset U of Spec Z F [1/2], construct smooth proper families E ′ and E of elliptic curves over U with the generic fibers being isomorphic to E ′ ⊗ F and E ⊗ F , respectively, and make a diagram (SIK) U of schemes and morphisms over U such that each scheme is smooth and projective over U , and that (SIK) U ⊗ F is equal to the SIK diagram (SIK) F over F . We will show that, after deleting finitely many closed points from U , the diagram (SIK) U becomes an SIK diagram over U . Note that, since E ′ and E are families of elliptic curves (that is, with a section over U ), the inversion automorphism ι A of A is defined over U . We can make U so small that the following hold: • Each Q ij ∈ A is the generic fiber of a closed subscheme Q ij of A that is smooth over U , and these Q ij are mutually disjoint. Then ∪Q ij is the fixed locus of ι A , and A → A is the blowing-up along ∪Q ij by Example 6.1.5. • The involutionι A of A extends to an involution (ι A ) ∼ U of A over U , which is a lift of ι A by Corollary 6.1.3. By Example 6.1.8, the morphism Km(A) ← A is the quotient morphism by (ι A ) ∼ U . • Each Θ i ⊂ Km(A) is the generic fiber of a closed subscheme Θ i of Km(A) that is smooth over U . By the specialization isometry from NS(Km(A)) to NS(Km(A)⊗ κ p ) for closed points p of U , we see that these Θ i are mutually disjoint. By Example 6.1.6, the morphism Y → Km(A) is a double covering branching exactly along Θ := Θ i . • Each irreducible component C i of C is the generic fiber of a closed subscheme C i of Km(A) that is smooth over U . We put C := C i . Considering the specialization isometry NS(Km(A)) ֒→ NS(Km(A) ⊗ κ p ) for closed points p of U , we see that C is a flat family of E 8 -configurations of (−2)-curves over U , and that Θ and C are disjoint. Hence (C, Θ) ⊗ κ P is a Shioda-Inose configuration on Km(A) ⊗ κ P for every point P of U .
• Each R i ∈ Y is the generic fiber of a closed subscheme R i of Y that is smooth over U , and these R i are mutually disjoint. The morphism Y ← Y is the blowing-up along ∪R i by Example 6.1.5.
Hence (SIK) U is an SIK diagram over U .
We consider the SIK diagram (SIK) U over a non-empty open subset U ⊂ Spec Z F [1/2], and the SIK diagram (SIK) F = (SIK) U ⊗ F over F , as in Proposition 6.3.2. (Remark that we have changed the notation from (4.5.1) and (5.3.1) to Y := Y ⊗ F , E ′ := E ′ ⊗ F and E := E ⊗ F .) By the isomorphisms of Propositions 4.4.1 and 5.2.1, we obtain the following: We assume the following, which are equivalent by Proposition 4.3.2 and Corollary 5.  Y )). There exists a finite set N of prime integers containing the prime divisors of 2d(Y ) such that the following holds: be the natural projections. By deleting finitely many closed points from V , we can assume that π M,F (V ) ⊂ U and π M,L (V ) ⊂ U L . Then we have We choose a finite set N of prime integers in such a way that the following hold: (i) N contains all the prime divisors of 2d(X) = 2d(Y ), (ii) if p / ∈ N , then π −1 M (p) ⊂ V , and hence π −1 F (p) ⊂ U and π −1 L (p) ⊂ U L hold, (iii) N satisfies the condition (6.3.1) for Y. Then N satisfies the condition (1.0.1) for X . Hence Theorem 1 is proved. 6.6. Proof of Theorem 3(T). Let S be as in the statement of Theorem 3. Since D = disc(NS(S)) is assumed to be a fundamental discriminant, there exists an imaginary quadratic field K with discriminant D. We fix an embedding K ֒→ C once and for all. For a finite extension L of K, we denote by Emb(L/K) the set of embeddings of L into C whose restrictions to K are the fixed one.
We recall the theory of complex multiplications. See [35,Chap. II], for example, for detail. Let Q ⊂ C be the algebraic closure of Q in C, and let ELL(Z K ) be the set of Q-isomorphism classes [E] of elliptic curves E defined over Q such that End(E) ∼ = Z K . Then ELL(Z K ) consists of h elements, where h is the class number |Cl D | of Z K . We denote by There exist a finite extension F of H and a non-empty open subset U of Spec Z F [1/2] such that, for each γ ∈ Gal(H/K), there exist smooth proper families of elliptic curves E γ α and E α over U whose generic fibers are isomorphic to E γ α ⊗ F and E α ⊗ F , respectively, and an SIK diagram α and E α over U . We then put Y γ := Y γ ⊗ F and A γ := A γ ⊗ F . Let σ be an element of Emb(F/K). If the restriction of σ to H is equal to σ i , then we have the following equalities in L * D : by Corollary 6.4.3.
Note that the restriction map Emb(F/K) → Emb(H/K) is surjective. Therefore, by Proposition 1.0.6 and the equalities (6.6.1), we see that the subset Then X has the property required in Theorem 3(T). 6.7. Proof of Theorem 3(L). We continue to use the notation fixed in the previous subsection. We consider E α as being defined over F . Replacing F by a finite extension if necessary, we can assume that F is Galois over Q, and that holds so that Lie : End(E α ) → F is defined. Since j(E α ) = α is a root of Φ D and F contains K, we have the Lie-normalized isomorphism Making the base space U of the SIK diagram (SIK) γ(S) smaller if necessary, we can assume the following: (i) U = π −1 F (π F (U )), and p | 2D for any p ∈ π F (U ), (ii) if p ∈ π F (U ), then Φ D (t) mod p has no multiple roots in F p , and (iii) for p ∈ π F (U ), we have the following equivalence: . Let p be a prime integer in π F (U ) such that χ p (D) = −1, so that S p (X ) = π −1 F (p). We show that, under the assumption that D is odd, the set of isomorphism classes of supersingular reduction lattices {[L(X , p)] | p ∈ π −1 F (p)} coincides with a genus. Let B denote the quaternion algebra over Q that ramifies exactly at p and ∞. We consider pairs (R, Z) of a Z-algebra R and a subalgebra Z ⊂ R such that R is isomorphic to a maximal order of B, and that Z is isomorphic to Z K . We say that two such pairs (R, Z) and (R ′ , Z ′ ) are isomorphic if there exists an isomorphism ϕ : R → ∼ R ′ satisfying ϕ(Z) = Z ′ . We denote by R the set of isomorphism classes [R, Z] of these pairs. Next we consider pairs (R, ρ) of a Z-algebra R isomorphic to a maximal order of B and an embedding ρ : Z K ֒→ R as a Z-subalgebra. We say that two such pairs (R, ρ) and (R ′ , ρ ′ ) are isomorphic if there exists an isomorphism ϕ : R → ∼ R ′ satisfying ϕ • ρ = ρ ′ . We denote by R the set of isomorphism classes [R, ρ] of these pairs. For an embedding ρ : Z K ֒→ R, we denote byρ the composite of the non-trivial automorphism of Z K and ρ. The natural map Proof. First we show that the map r := Π R • r from S p (X ) to R is surjective. Let [R, Z] be an element of R. By Proposition 3.4.2, there exists a supersingular elliptic curve C 0 in characteristic p with an isomorphism ψ : End(C 0 ) → ∼ R. Let α 0 ∈ End(C 0 ) be an element such that the subalgebra Z + Z α 0 corresponds to Z ⊂ R by ψ. By Proposition 3.5.6, there exists a lift (C, α) of (C 0 , α 0 ), where C is an elliptic curve defined over a finite extension of Q p . Since Z + Z α ⊆ End(C) is isomorphic to Z K , we have End(C) ∼ = Z K , and hence the j-invariant of C is a root of the Hilbert class polynomial Φ D in Q p . Since the set of roots of Φ D in Q p is in one-to-one correspondence with π −1 H (p) by the assumption (ii) on U , and U contains π −1 F (p) by the assumption (i) on U , there exists p ∈ π −1 F (p) ⊂ U such that j(E [p] ) = j(C).
By applying Proposition 3.5.2 with g = id, we have r(p) = [R, Z]. To prove that r is surjective, therefore, it is enough to show that, for each p ∈ π −1 F (p), there exists p ′ ∈ π −1 F (p) such that [R p ′ , ρ p ′ ] = [R p , ρ p ] holds in R. We choose an element g ∈ Gal(F/Q) such that the restriction of g to K is the non-trivial element of Gal(K/Q), and let p ′ be the image of p by the action of g on π −1 F (p). Consider the diagram where λ and λ ′ are the canonical isomorphisms (6.7.3), and the vertical isomorphisms f g , e g and E g are given by the action of g. Then we have e g • λ = λ ′ , where λ ′ is the composite of the nontrivial automorphism of End(E α ) ∼ = Z K and λ ′ . By Suppose that the ideal class [I γ(S) ] ∈ Cl D is represented by an ideal J ⊂ Z K . We can regard J as an ideal of End(E α ) by the Lie-normalized isomorphism (6.7.2). By [7,Corollary 7.17], we can choose J ⊂ Z K in such a way that Hence we have We then consider J as an ideal of End(E [p] ) by the canonical isomorphisms (6.7.3), and consider the left-ideal R p ρ p (J) of R p generated by ρ p (J). From the isomorphism (6.7.4), we obtain an isomorphism Then, by Proposition 3.5.4, we have Therefore we have the following equalities in the set L p 2 d 2 J D : ] by Proposition 6.3.5 = [ (J ֒→ R p ρ p (J)) ⊥ ] by Proposition 3.5.5.
By the surjectivity of the map r, we complete the proof of Theorem 3(L) by the following proposition, which will be proved in the next section.

The maximal orders of a quaternion algebra
Let K, D, p, B and R be as in the previous section. We assume that D is odd. We describe the set R following Dorman [9], and prove Proposition 6.7.2. 7.1. Dorman's description of R. Note that D is a square-free negative integer satisfying D ≡ 1 mod 4. We choose a prime integer q that satisfies Then the Q-algebra is a quaternion algebra that ramifies exactly at p and ∞. For simplicity, we use the following notation:  where n is a non-zero integer such that nΛ ⊂ [Z K , Z K ]. An order R of B is maximal if and only if R is of discriminant p 2 as a lattice. Since the discriminant of [Z K , Z K ] is p 2 q 2 |D| 2 , we obtain the following: From the condition (7.1.1) on q, χ p (D) = −1 and D ≡ 1 mod 4, we deduce that q splits completely in K. We choose an ideal Q ⊂ Z K such that (q) = QQ. We also denote by D the principal ideal ( √ D) ⊂ Z K . Let R be an element of R. By Lemma 7.1.2, the fractional ideal  Proof. Since |M R /DM R | = |D −1 /Z K | = |D|, it is enough to show that f R is injective. Let F be the fractional ideal such that Ker(f R ) = F DM R = F Q −1 I R . Suppose that β, β ′ ∈ Ker(f R ). Then [0, β] ∈ R and [0, β ′ ] ∈ R hold, and hence [0, β]·[0, β ′ ] = [−pqββ ′ , 0] is also in R. From [K, 0]∩R = [Z K , 0], we have −pqββ ′ ∈ Z K . Since N (I R ) = 1, we have Since gcd(p, D) = 1 and Z K ⊆ F ⊆ D −1 , we have F = Z K .
Since f R is an isomorphism, there exists a unique element from which the desired description of f R follows.
By the definition of µ R , we have f R (µ R ) = pq √ Dµ R µ R + Z K = (1/ √ D) + Z K . Therefore we have pqD|µ R | 2 − 1 ∈ D ∩ Q = DZ, where the second equality follows from the assumption that D is odd.
Proof. Since II = Z K , we have We put x ′ = x + y with y ∈ Q −1 I. Then we have q|y| 2 ∈ Z K ∩ Q = Z. Since D is odd, we have D −1 ∩ Q = Z, and hence q(xy + yx) ∈ D −1 ∩ Q = Z holds.
We define T to be the set of all pairs (I, µ + Q −1 I), where I is a fractional ideal of K such that N (I) = 1, and µ + Q −1 I is an element of D −1 Q −1 I/Q −1 I such that pqD|µ| 2 ≡ 1 mod D. Then we have a map τ : R → T given by τ (R) := (I R , µ R + Q −1 I R ) ∈ T . Proposition 7.1.6. The map τ is a bijection.
Proof. The maximal order R is uniquely recovered from (I R , µ R + Q −1 I R ) by Hence τ is injective. Let an element t := (I, µ + Q −1 I) of T be given. We put M t := D −1 Q −1 I, and define f t : M t → D −1 /Z K by f t (β) := pq √ Dµβ + Z K .
Note that the definition of f t does not depend on the choice of the representative µ of µ + Q −1 I. Since M t M t = (1/Dq), we see that µβ − µβ is contained in D(1/Dq) = D −1 (1/q) for any β ∈ M t . (Note that γ − γ ∈ D for any γ ∈ Z K .) Therefore we have for any β ∈ M t . We put We prove that τ is surjective by showing that R t ∈ R. It is obvious that R t is a Z-module of rank 4 satisfying R t ∩[K, 0] = [Z K , 0]. We show that R t is closed under the product. Since f t is a homomorphism of Z K -modules, we have [Z K , 0]R t = R t . By the formula (7.1.4), we have R t [Z K , 0] = R t . Hence it is enough to prove that is in R t for any β, β ′ ∈ M t . Because pqββ ′ ∈ pqM t M t = (p/D) and 1 − pqD|µ| 2 ≡ 0 mod D, we have a congruence pqββ ′ ≡ p 2 q 2 D|µ| 2 ββ ′ mod Z K . Hence Therefore R t R t = R t is proved, and hence R t is an order. Because N (M t ) = 1/q|D|, we see that R t is maximal by Lemma 7.1.1. Hence R t ∈ R.
We define an orientation of the Z-module Q −1 I R J ⊂ K by (1.0.5). Then, for each R ∈ R, we obtain an oriented lattice [0, Q −1 I R J] of discriminant (pq) 2 · N (Q −1 I R J) 2 · disc(Z K ) = −p 2 d 2 J D. On the other hand, recall that Ψ([Q −1 I R J]) ∈ L * D is represented by an oriented lattice such that the underlying Z-module is Q −1 I R J ⊂ K, and that the bilinear form is given by is also a lifted genus in L p 2 d 2 J D . Thus Proposition 6.7.2 is proved.