Proof. We first show that the kernel \(b_p(x,y)=A_p(y-x)-1/2\) has operator norm at most \(\delta_p\). The characters \(x\mapsto e(kx/p)\), \(k\in\mathbb F_p\), are an orthonormal eigenbasis. The constant eigenvalue is \[\frac{|Q_p^*|}{p}-\frac12=-\frac1{2p}.\] For \(k\ne0\), put \(G_p(k)=\sum_{u\in\mathbb F_p}e(ku^2/p)\). The corresponding eigenvalue is \[\frac1p\sum_{t\in Q_p^*}e(kt/p) =\frac{G_p(k)-1}{2p}.\] Here the subtraction of \(1\) removes the zero square, and division by \(2\) removes the multiplicity of every nonzero square. Since \((u,v)\mapsto(u-v,u+v)\) is a bijection on \(\mathbb F_p^2\), \[|G_p(k)|^2 =\sum_{u,v\in\mathbb F_p}e\bigl(k(u^2-v^2)/p\bigr) =\sum_{a,b\in\mathbb F_p}e(kab/p) =p.\] Thus all eigenvalues have absolute value at most \(\delta_p\). In particular, \[ \left| \mathbb E_{x,y} f(x)g(y)\bigl(A_p(y-x)-\tfrac12\bigr) \right| \le\delta_p\|f\|_2\|g\|_2. \tag{1}\] The same bound holds with \(x-y\) in place of \(y-x\), since the transposed operator has the same norm.

Now replace the \(m\) edge indicators one at a time by \(1/2\). In a telescoping error for an edge \((u,v)\), fix every variable except \(z_u,z_v\). No other edge has both these endpoints. Consequently all the other factors separate as \(C f(z_u)g(z_v)\), where \(|C|,|f|,|g|\le1\). Equation (1) bounds the conditional error by \(\delta_p\). Averaging the fixed variables and summing over the edges proves the assertion. ◻

Proof. Put \(c=2^{-m}\) and \(B=K-c\). With respect to the normalized point-mass bases, \(T_B\) has matrix entries \(B(x,y)/\sqrt{|\mathbb F_p^I|\,|\mathbb F_p^J|}\). If \(s_r\) are its singular values, then \[\begin{align*} \|B\|_{\mathrm{op}}^4 &\le \sum_r s_r^4 =\operatorname{tr}\bigl((T_BT_B^*)^2\bigr) \\ &=\mathbb E_{x^0,x^1,y^0,y^1} B(x^0,y^0)B(x^0,y^1)B(x^1,y^0)B(x^1,y^1), \tag{3}\end{align*}\] where the four lists are independent and uniform. The kernel is real, so no conjugates appear in the last expression.

Let \(\Omega=\{0,1\}^2\). Expanding the last line gives \[\sum_{F\subseteq\Omega}(-c)^{4-|F|} \mathbb E\prod_{(a,b)\in F}K(x^a,y^b).\] For each \(F\), its product is the constraint indicator of a graph on \[(I\times\{0,1\})\sqcup(J\times\{0,1\}).\] Every base edge between \(i\in I\) and \(j\in J\) is copied, in its original direction, between \((i,a)\) and \((j,b)\) for every \((a,b)\in F\). The two endpoints determine the base unordered pair and the corner \((a,b)\). Hence this graph has no loops or repeated unordered edges, and has exactly \(m|F|\) edges. Lemma 3 therefore gives \[\mathbb E\prod_{(a,b)\in F}K(x^a,y^b) =c^{|F|}+E_F, \qquad |E_F|\le m|F|\delta_p.\] The main terms sum to \((c-c)^4=0\). The remaining terms have absolute value at most \[m\delta_p\sum_{t=0}^4\binom4t t c^{4-t} =4m(1+c)^3\delta_p \le32m p^{-1/2}.\] Combining this with (3) and taking fourth roots proves (2). ◻

Proof. Conditional square-sum bound. We establish a conditional square-sum bound before estimating moments. For every \(B\subseteq\mathcal P\) with \(q_B\le Q\), and every fixed value \(z_B\), we claim that \[ \sum_{\substack{U\in\mathcal F\\U\supseteq B}} \mathbb E\bigl(|f_U|^2\mid z_B\bigr) \le 4M^2 4^{|B|}. \tag{46}\] The conditional expectation here integrates the coordinates outside \(B\); those outside \(U\) are irrelevant to its summand.

To compute its coefficients, write \(U=B\sqcup A\) and uniquely decompose a frequency on \(U\) as \(\xi=\xi_B+\eta\), with exact supports \(B\) and \(A\), respectively. After fixing \(z_B\), the coefficient of the outside character \(e(z_A\eta)\) is \[ c_B(\eta;z_B)=\frac1L\sum_{n\in I}f(n)e(-n\eta) \prod_{p\in B}\bigl(p1_{n\equiv z_p\ (p)}-1\bigr). \tag{47}\] Indeed, the sum over the nonzero frequencies at \(p\) is \[\sum_{a=1}^{p-1}e\bigl(a(z_p-n)/p\bigr) =p1_{n\equiv z_p\ (p)}-1.\] Let \(\Omega_B\) denote the union of the outside-frequency sets arising from \(U\in\mathcal F\) with \(U\supseteq B\). Different outside supports give disjoint frequency sets, and all their denominators are at most \(Q/q_B\) and coprime to \(q_B\). Conditional Parseval therefore identifies the left side of (46) with \(\sum_{\eta\in\Omega_B}|c_B(\eta;z_B)|^2\).

Expand the product in (47) by subsets \(J\subseteq B\). Apart from its sign, the corresponding coefficient vector is \[ c_J(\eta)=\frac{q_J}{L} \sum_{\substack{n\in I\\n\equiv z_J\ (q_J)}}f(n)e(-n\eta), \qquad \eta\in\Omega_B. \tag{48}\] The congruence in this expression is the simultaneous congruence at the primes of \(J\), or equivalently its unique class modulo \(q_J\). For \(J=\varnothing\) it imposes no restriction.

Write its progression as \(n=a+q_Jt\), where \(t\) ranges over a consecutive interval \(T\) of length \(L_J\). Since \(q_J\le Q\) and \(L\ge10Q^6\), \[|L_J-L/q_J|\le1, \qquad L_J\ge0.9L/q_J, \qquad q_JL_J/L\le1.1.\] After removing the phase \(e(-a\eta)\), (48) is \(q_JL_J/L\) times the normalized Fourier analysis of \(t\mapsto f(a+q_Jt)\) at frequencies \(q_J\eta\).

These frequencies remain distinct. In fact the denominator of \(\eta-\eta'\) is coprime to \(q_J\), so \(q_J(\eta-\eta')\in\mathbb Z\) implies \(\eta=\eta'\pmod1\). Multiplication by \(q_J\) also preserves each reduced outside denominator. Thus all the resulting frequencies have denominators at most \(Q\), are pairwise separated in circle distance by at least \(Q^{-2}\), and number at most \(\sum_{q\le Q}\varphi(q)\le Q^2\), where \(\varphi(1)=1\) accounts for the zero frequency.

This is a separated-frequency estimate of large-sieve type; compare (Montgomery and Vaughan 1973, Theorem 1). The length hypothesis permits the following elementary Gram-matrix bound. Consider the Gram matrix of these normalized exponential vectors in \(L^2(T)\). Its diagonal is 1. For distinct frequencies \(\theta,\theta'\), geometric summation gives \[\left|\frac1{L_J}\sum_{t\in T}e\bigl(t(\theta-\theta')\bigr)\right| \le \frac1{2L_J\|\theta-\theta'\|_{\mathbb R/\mathbb Z}} \le\frac{Q^2}{2L_J}.\] Its operator norm is at most its maximum absolute row sum, hence at most \[1+\frac{Q^4}{2L_J} \le1+\frac{Q^4q_J}{1.8L} \le1+\frac1{18Q}\le\frac{19}{18}.\] The norm squared of the Fourier analysis map equals this Gram-matrix norm. Consequently \[\left(\sum_{\eta\in\Omega_B}|c_J(\eta)|^2\right)^{1/2} \le1.1\sqrt{19/18}\, \left(\frac1{L_J}\sum_{t\in T}|f(a+q_Jt)|^2\right)^{1/2} \le2M.\] The Euclidean triangle inequality over the \(2^{|B|}\) subsets \(J\) proves (46).

Square-function moments. We next use this bound to control \[S(z)=\left(\sum_{U\in\mathcal F}|f_U(z_U)|^2\right)^{1/2}.\] Put \(T_r=\mathbb E S^{2r}\) and \(T_0=1\). Expand the first \(r-1\) factors in this moment and fix their supports \(U_1,\ldots,U_{r-1}\). Their product depends only on coordinates in \(W=U_1\cup\cdots\cup U_{r-1}\), and \(|W|\le(r-1)k\). For a last support \(U\), let \(B=U\cap W\). Integrating outside \(W\) gives exactly \(\mathbb E(|f_U|^2\mid z_B)\), because the coordinates of \(f_U\) outside \(B\) are fresh. For each fixed intersection \(B\), its sum over \(U\cap W=B\) is bounded by (46). Only \(B\) with \(q_B\le Q\) can occur, and there are at most \(2^{(r-1)k}\) possible intersections. It follows that \[T_r\le4M^2 4^k2^{(r-1)k}T_{r-1}.\] Induction gives \[ T_r\le(4M^2)^r4^{kr}2^{kr(r-1)/2}, \qquad \|S\|_{2r}\le2M\,2^{k(r+3)/4}. \tag{49}\] This conditioning argument permits arbitrary overlaps among supports. The remaining task is to recover their sum from this square function.

Recovering the sum. Fix a size \(j\ge1\) and color the coordinates independently and uniformly with \(j\) colors. A support is called transversal if it contains exactly one coordinate of each color. Each support of size \(j\) is transversal with probability \(\pi_j=j!/j^j\). Fix one coloring \(c\), and let \(\mathcal T\) be its retained transversal supports in \(\mathcal F\).

Take independent copies \(X_p^0,X_p^1\) of every coordinate. Write \(\operatorname{swap}_p\) for interchanging that pair, and define \[D_U=\prod_{p\in U}(I-\operatorname{swap}_p)f_U(X^0).\] Coordinatewise centering gives \(\mathbb E_{X^1}D_U=f_U(X^0)\): in the expanded product, every term using at least one copied coordinate has zero conditional mean. Jensen’s inequality therefore gives \[\left\|\sum_{U\in\mathcal T}f_U\right\|_{2r} \le\left\|\sum_{U\in\mathcal T}D_U\right\|_{L^{2r}(X^0,X^1)}.\] Swapping independent copies coordinate by coordinate is a standard symmetrization device; see (Peña and Montgomery-Smith 1995, sec. 4 of the arXiv version). Independently swapping each coordinate pair preserves their joint law and multiplies \(D_U\) by the product of the associated signs. With independent random signs \((\epsilon_p)_{p\in\mathcal P}\), \[ \left\|\sum_{U\in\mathcal T}D_U\right\|_{L^{2r}(X^0,X^1)} =\left\|\sum_{U\in\mathcal T}D_U\prod_{p\in U}\epsilon_p \right\|_{L^{2r}(X^0,X^1,\epsilon)}. \tag{50}\] The signs here are indexed by individual coordinates, not merely by colors. Each monomial contains one coordinate sign from each color class.

For completeness, the scalar random-sign bound with the constant \(K_{2r}\) above is \[ \left\|\sum_i a_i\epsilon_i\right\|_{2r} \le K_{2r}\left(\sum_i|a_i|^2\right)^{1/2}. \tag{51}\] For nonnegative coefficients \(b_i\), expansion of the even moment retains only multiplicities \(2m_i\) with \(\sum_i m_i=r\). Since \((2m)!\ge2^m m!\), that moment is at most \[\frac{(2r)!}{2^r} \sum_{\sum m_i=r}\prod_i\frac{b_i^{2m_i}}{m_i!} =\frac{(2r)!}{2^r r!}\left(\sum_i b_i^2\right)^r.\] For complex \(a_i\), expand \((\sum a_i\epsilon_i)^r(\sum\overline{a_i}\epsilon_i)^r\) and take absolute values termwise; its surviving terms are bounded by the expansion with \(b_i=|a_i|\). This proves (51) in the required generality.

For fixed copies \(X^0,X^1\), iterate (51) through the \(j\) color classes. At each stage one uses Minkowski in \(L^r\), in the form \[\left\|\left(\sum_i|B_i|^2\right)^{1/2}\right\|_{2r} \le\left(\sum_i\|B_i\|_{2r}^2\right)^{1/2}.\] Induction on the number of color classes therefore gives \[\left\|\sum_{U\in\mathcal T}D_U\prod_{p\in U}\epsilon_p \right\|_{L^{2r}(\epsilon)} \le K_{2r}^j\left(\sum_{U\in\mathcal T}|D_U|^2\right)^{1/2}.\]

To estimate this difference square function, index the choices of copies by \(\eta\in\{0,1\}^j\), one choice for each color. Since each \(U\in\mathcal T\) has one coordinate of every color, \[D_U=\sum_{\eta\in\{0,1\}^j}(-1)^{|\eta|} f_U\bigl((X_p^{\eta_{c(p)}})_{p\in U}\bigr).\] For each fixed \(\eta\), the selected full coordinate vector has the original product law. Minkowski in \(L^{2r}(\ell^2(\mathcal T))\) consequently yields \[\left\|\left(\sum_{U\in\mathcal T}|D_U|^2\right)^{1/2}\right\|_{2r} \le2^j\left\|\left(\sum_{U\in\mathcal T}|f_U|^2\right)^{1/2}\right\|_{2r} \le2^j\|S\|_{2r}.\] Together with (50), this proves the transversal bound \((2K_{2r})^j\|S\|_{2r}\).

Average over colorings. Since every support is retained with probability \(\pi_j\), another application of Minkowski gives \[\left\|\sum_{\substack{U\in\mathcal F\\|U|=j}}f_U\right\|_{2r} \le\frac{j^j}{j!}(2K_{2r})^j\|S\|_{2r} \le(2eK_{2r})^j\|S\|_{2r}.\] Here \(j!\ge(j/e)^j\), which also follows by integrating \(\log x\) from 1 to \(j\). The term of size zero is constant and bounded in absolute value by \(S\). Summing over \(0\le j\le k\) and using (49) proves (45).

Finally, the product of \(k\) distinct primes is at least \((k+1)!\), so \((k+1)!\le Q\). The bound \(\log(k!)\ge k\log k-k\) gives \(k=O(\log Q/\log\log Q)\). For fixed \(r\), the logarithm of the right side of (45), after removing \(M\), is therefore \(o(\log Q)\). Every bound used above was independent of the interval’s location, the ambient prime set, and the retained family. This proves the asserted uniformity. ◻

Proof. The specified fiber has uniform probability \(1/q_B\). Its contribution to \(\mathbb E|G|^p\) is \[q_B^{-1}\mathbb E_{z_{\mathcal P\setminus B}} |G(z_B,z_{\mathcal P\setminus B})|^p.\] Discarding all other nonnegative contributions proves (52). Apply Lemma 15 to each displayed family. Every character of \(f_U\), when specialized on \(B\), retains exactly the coordinate support \(U\setminus B\). Combining such characters can cancel coefficients but cannot create frequencies outside the asserted remaining-denominator ranges. This proves the last assertion. ◻

Proof. Put \(r=b-a\) modulo \(D\), and denote the frequency set in (55) by \(\Xi\). We first define the model and actual-square kernels. We then compare their Fourier transforms on minor and major arcs, and finish with the exact bilinear Fourier identity.

Proof. Write \(\chi_\xi(z)=e(z\xi)\) for a product-space character. Each original character has a unique decomposition \(\xi+\eta\), where \(\xi\) is supported on \(\mathcal S\) and \(\eta\) on \(B\). Their denominators are coprime, so \(q(\xi+\eta)=q(\xi)q(\eta)\). The hypothesis ensures that every character \(\eta\) on \(X_B\) is retained in the lift. Orthogonality over this entire character group gives \[\begin{align*} \widehat g_I(\xi) &=\sum_{\eta\ {\rm on}\ X_B} \frac1{|I|}\sum_{n\in I} f_s(n)e(-n(\xi+\eta))\chi_\eta(z_B)\\ &=\frac{q_B}{|I|} \sum_{\substack{n\in I\\ n\equiv z_p\pmod p\ (p\in B)}} f_s(n)e(-n\xi). \end{align*}\] Substituting (81) proves (82). ◻

Proof. We first record the parameter inequalities that make both lifts available. Since \(\tau<\beta/2\), \[Hq_B\le N^{\beta/2+\tau}\le Q.\] Also \[ N'\ge\frac{N}{D^2}\ge M_0^{-2}N^{1-2\tau}. \tag{86}\] Because \(1/2-2\tau>0\), this lower bound is at least \(N^{1/2}\) for sufficiently large \(N\). As \(D\ge8\), we have \(N'<N\) for every integer \(N\ge2\). Hence, with \(Q'=(N')^\beta\), \[ H\le Q'\le Q,\qquad N\ge10Q^6,\qquad N'\ge10(Q')^6 \tag{87}\] once \(N\) is sufficiently large. The length conditions follow from \(6\beta<1\) and the uniform growth of \(N'\) in (86).

Removing large remaining conductors. Split \(g=g_{\le H}+g_{>H}\) according to the denominator on the remaining prime coordinates \(\mathcal S\). Before specialization, these pieces retain exactly the denominator families \[\{U\subseteq\mathcal P_N:q_U\le Q,\ q_{U\setminus B}\le H\}, \qquad \{U\subseteq\mathcal P_N:q_U\le Q,\ q_{U\setminus B}>H\}.\] Thus Lemma 15 applies to both pieces. For a function \(u\) on \(X_B\times X_{\mathcal S}\), uniform counting gives the specialization bound \[\|u(z_B,\cdot)\|_r \le q_B^{1/r}\|u\|_r \qquad(r\ge1);\] this is also the estimate in Lemma 16. Since \(|f_s|\le M_0\), it follows that, for \(g_*\in\{g,g_{\le H},g_{>H}\}\) and every fixed even \(r\), \[ \|g_*\|_r\le M_0q_B^{1/r}N^{o(1)}. \tag{88}\] All subpower bounds in this proof are uniform over the indicated sets and fibers.

Telescope the \(d\) inputs in the diagonal integral from \(g\) to \(g_{\le H}\). Each difference has one input \(g_{>H}\). Lemma 13 and (88) imply, for every fixed \(\varepsilon>0\), \[ |Z_{\mathcal S}(g)-Z_{\mathcal S}(g_{\le H})| \le C_\varepsilon H^{-\gamma}q_BN^\varepsilon. \tag{89}\] Indeed the specialization powers in that lemma add to \[\frac12+\frac{d-1}{2(d-1)}=1.\] The factors \(d\) and \(M_0^d\) are fixed and are included in \(C_\varepsilon\). Applying the moment lemma with sufficiently small individual exponents makes the aggregate moment loss at most \(N^\varepsilon\).

Splitting the exact fiber into square-step progressions. Let \(a\bmod D\) combine \(s\) and \(z_B\). By Lemma 19, for every remaining \(\xi\) with \(q(\xi)\le H\), \[ \widehat g(\xi)=\frac D N \sum_{\substack{n\le N\\n\equiv a\pmod D}}1_A(n)e(-n\xi). \tag{90}\] Let \[\begin{gathered} J_a=\{j\in[D^2]:j\equiv a\pmod D\},\qquad c_j=j-D^2,\\ A'_j=\{n'\in[N']:D^2n'+c_j\in A\}. \end{gathered}\] There are exactly \(D\) elements of \(J_a\). The map \((n',j)\mapsto D^2(n'-1)+j\) bijects \([N']\times[D^2]\) with \([D^2N']\). Restricting \(j\) to \(J_a\) selects exactly the residue class \(a\bmod D\). The definition of \(A'_j\) assigns zero to all padded points greater than \(N\), so this decomposition incurs no additive error.

Each \(A'_j\) is square-difference-free: a difference \(m^2>0\) between its elements would give the difference \(D^2m^2=(Dm)^2\) between the corresponding elements of \(A\). This argument concerns actual integer squares.

For \(p\in\mathcal S\), the integer \(D\) is invertible modulo \(p\). Define \[T_j(z)_p=D^{-2}(z_p-c_j)\pmod p,\qquad h_j^H=\mathcal L_{[N'],\mathcal S,H}1_{A'_j}.\] Each \(T_j\) is a translation followed by multiplication by the nonzero square \((D^{-1})^2\). Multiplication of a remaining frequency by \(D^2\) preserves its exact denominator, so changing variables \(\eta=D^2\xi\) in the Fourier expansion of (90) gives the exact identity \[ g_{\le H}(z) =\frac{\lambda}{D}\sum_{j\in J_a}h_j^H(T_j(z)). \tag{91}\] For clarity, the coefficient of \(e(z\xi)\) on the right is \[\frac{DN'}N\sum_{j\in J_a}e(-c_j\xi) \left(\frac1{N'}\sum_{n'\le N'} 1_{A'_j}(n')e(-D^2n'\xi)\right),\] which is exactly (90).

The seminorm triangle inequality and affine invariance in Lemma 12 now imply \[Z_{\mathcal S}(g_{\le H})^{1/d} \le \frac{\lambda}{D} \sum_{j\in J_a}Z_{\mathcal S}(h_j^H)^{1/d} \le \lambda\max_{j\in J_a}Z_{\mathcal S}(h_j^H)^{1/d}.\] Consequently, \[ Z_{\mathcal S}(g_{\le H}) \le\lambda^d\max_{j\in J_a}Z_{\mathcal S}(h_j^H). \tag{92}\] The averaging by \(D\) is essential: the number of progressions causes no further loss.

Recovering the smaller-scale functional. Set \[h_j^{Q'}=\mathcal L_{[N'],\mathcal S,Q'}1_{A'_j}.\] The difference \(h_j^{Q'}-h_j^H\) has conductor greater than \(H\). By (87), the moment lemma applies at scale \(N'\) to these lifts and their pieces. A second telescoping application of Lemma 13, this time without specialization, gives \[ |Z_{\mathcal S}(h_j^H)-Z_{\mathcal S}(h_j^{Q'})| \le C_\varepsilon H^{-\gamma}(N')^\varepsilon \tag{93}\] uniformly in \(j\).

The lift \(h_j^{Q'}\) depends only on coordinates in \(\mathcal S'=\mathcal P_{N'}\setminus B\), because every prime in a denominator at most \(Q'\) is itself at most \(Q'\). On the other hand, the full lift \[u'_j=\mathcal L_{[N'],\mathcal P_{N'},Q'}1_{A'_j}\] becomes exactly \(h_j^{Q'}\) after uniform averaging over \(B\cap\mathcal P_{N'}\). Character orthogonality removes precisely the denominators containing one of those primes. By Lemma 12, coordinate averaging contracts the seminorm; unused probability factors integrate to one. Therefore \[ Z_{\mathcal S}(h_j^{Q'}) =Z_{\mathcal S'}(h_j^{Q'}) \le Z_{\mathcal P_{N'}}(u'_j) =Y(N',A'_j). \tag{94}\] This also covers primes of \(B\) larger than \(Q'\), which are absent from \(\mathcal P_{N'}\) already.

Combining (89), (92), (93), and (94) proves (83) with error \[ C_\varepsilon\left( H^{-\gamma}q_BN^\varepsilon+ \lambda^dH^{-\gamma}(N')^\varepsilon\right). \tag{95}\]

Uniform error bounds and mixed inputs. The definition of \(N'\) gives \(1\le\lambda<1+D^2/N\), and \[D^2/N\le M_0^2N^{-1+2\tau}=o(1).\] Since \(d\) is fixed, these inequalities prove (85) and show that \(\lambda^d\) is bounded for large \(N\). Choose \(\varepsilon=\beta\gamma/8\) in (95). Its two terms, before the bounded factor \(\lambda^d\), are at most \[N^{-3\beta\gamma/8+\tau} \quad\hbox{and}\quad N^{-3\beta\gamma/8},\] respectively. As \(\tau\le\beta\gamma/1000\) and \(\sigma_0=\gamma\tau/4\le\tau/4\), they are \(O(N^{-\sigma_0})\). This establishes the diagonal bound with constants independent of any inductive estimate for \(Y\).

Every \(g_v\) in the mixed statement is real and satisfies the same diagonal bound. Its right-hand side is nonnegative and independent of \(v\). Proposition 11 therefore gives (84). ◻

Proof. We construct a length-\(24\) sequence of admissible increments with sum zero at each factor of \(M_0\). Modulo \(8\), take all the increments equal to \(1\); their sum is \(24\equiv0\pmod8\).

Let \(p<P\) be an odd prime. If \(-1\) is a square modulo \(p\), repeat the pair \((1,-1)\) twelve times. Both entries are nonzero squares and each pair has sum zero. If \(-1\) is not a square, put \[S=\{x^2:x\in\mathbb F_p\}.\] The sets \(S\) and \(-1-S\) each have \((p+1)/2\) elements, so they intersect. Thus \(-1=a+b\) for some \(a,b\in S\). Neither \(a\) nor \(b\) is zero, since otherwise \(-1\) would be a square. The triple \((a,b,1)\) consists of nonzero squares and has sum zero. Repeat this triple eight times. This also covers \(p=3\), where the triple is \((1,1,1)\).

The Chinese remainder theorem now gives increments \(\Delta_0,\ldots,\Delta_{23}\pmod{M_0}\), each a strict square class, with \(\sum_{j=0}^{23}\Delta_j=0\). For each initial residue \(a\pmod{M_0}\), prescribe \[s_{v_0}=a,\qquad s_{v_j}=a+\sum_{i=0}^{j-1}\Delta_i\quad(1\le j<24).\] The last edge has increment \(\Delta_{23}\) because the sum of all the increments is zero. The slots \(v_0,\ldots,v_{23}\) are distinct, since their block words are the distinct cyclic shifts of the identity word. Repetition of residue values at nonadjacent slots causes no difficulty. The other \(d-24\) residues are unrestricted. We have therefore exhibited at least \(M_0\cdot M_0^{d-24}\) good assignments among the \(M_0^d\) possible assignments, which proves the bound. ◻

Proof. Write \(\eta_p\) for the total mass of \(\varepsilon_p\), and set \[\mu_p^\circ=\frac{\mu_p-\varepsilon_p}{1-\eta_p}, \qquad \Lambda^\circ=\bigotimes_{p\in\mathcal P_N}\mu_p^\circ.\] It suffices to prove the assertion with \(\Lambda^\circ\) in place of the measure in (97), since the latter is \(\prod_p(1-\eta_p)\Lambda^\circ\) and \(0\le\prod_p(1-\eta_p)\le1\). The single-slot marginals of \(\Lambda^\circ\) are uniform. Moreover, at each prime its marginal on any directed cycle edge is uniform on strict square pairs. We use conductor decay for \(\Lambda^\circ\), without any claim that this normalized measure is reflection positive.

Selecting an ordered pair. Put \(K=\lfloor N^\tau\rfloor\), and partition \([N]\) into ordered consecutive intervals \(I_1,\ldots,I_K\) of sizes differing by at most one. Writing \(w_i=|I_i|/N\), we have the exact identity \[\mathcal L_{[N],\mathcal P_N,Q}f_s =\sum_{i=1}^K w_i\mathcal L_{I_i,\mathcal P_N,Q}f_s.\] Thus the integral is an average over independent interval choices in all slots, with probabilities \(w_i\). For large \(N\), every interval has length at least \(\tfrac12N^{1-\tau}\). Since \(1-\tau>6\beta\), this length is at least \(10Q^6\). Lemma 15 therefore applies uniformly to every interval lift and every exact-denominator truncation used below. Its application to \(f_s\), which is bounded by the fixed constant \(M_0\), changes only the constants. All occurrences of \(N^{o(1)}\) in this proof are uniform over these interval choices, residues and sets.

First consider assignments for which all 24 cycle slots choose the same interval. Their total probability is \[\sum_{i=1}^K w_i^{24} \le(\max_i w_i)^{23}\ll N^{-23\tau}.\] For every assignment, ordinary Hölder and the uniform single-slot marginals give \[\left|\int\prod_v G_v(z_v)\,d\Lambda^\circ\right| \le\prod_v\|G_v\|_d=N^{o(1)}, \qquad G_v=\mathcal L_{I(v),\mathcal P_N,Q}f_{s_v}.\] Here \(d\) is even, so the required moment is supplied directly by Lemma 15. The contribution of these assignments is therefore \(O(N^{-23\tau+o(1)})\); there is no restriction on the interval choices in the other slots.

In every remaining assignment there is a directed cycle edge \(u\to v\) whose first interval precedes its second. Indeed, if the cyclic sequence of interval indices had no ascent, it would be nonincreasing all the way around the cycle, and hence constant. Fix one ascending edge, and denote its two intervals by \(I_1,I_2\) for the rest of this argument. All integers in \(I_1\) precede all integers in \(I_2\).

Eliminating the other slots. Retain these two lifts in full. In each of the other \(d-2\) slots, truncate the lift to exact conductors at most \(T=N^\tau\). Lemma 13, applied during a telescoping replacement of these slots, bounds the total error by \[ O(T^{-\gamma}N^{o(1)})=O(N^{-\gamma\tau+o(1)}). \tag{98}\] Every norm used here is controlled by Lemma 15: the retained and discarded pieces are subfamilies of complete exact denominator pieces. This error is estimated before the Fourier expansion that follows.

Each Fourier coefficient in a truncated slot has modulus at most \(M_0\), and there are at most \(\sum_{q\le T}\varphi(q)\ll T^2\) frequencies. The product expansion of all other slots consequently has total coefficient absolute sum at most \[ C_{d,M_0}T^{2(d-2)}\ll N^{2d\tau}. \tag{99}\] For one term in this expansion, let \(B\subseteq\mathcal P_N\) be the union of the prime supports of its characters, and put \[R=\prod_{p\in B}p.\] The conductors are squarefree, so their least common multiple satisfies \[ R\le T^{d-2}\le N^{d\tau}. \tag{100}\]

Condition on all slot labels at the primes in \(B\). The expanded characters become constants of modulus one. Since \(\Lambda^\circ\) is a product over primes, the tuple laws at the remaining primes are unchanged and independent. The two selected labels now have fixed coordinates \(a_{1,B},a_{2,B}\) at \(B\), whose difference is a nonzero square at each prime in \(B\). At every remaining prime their pair marginal is still uniform on strict square pairs.

Let \(\mathcal S=\mathcal P_N\setminus B\), let \(s_1=s_u\) and \(s_2=s_v\), and define functions on \(X_{\mathcal S}\) by \[g_i(z)=\bigl(\mathcal L_{I_i,\mathcal P_N,Q}f_{s_i}\bigr)(a_{i,B},z), \qquad i=1,2.\] With Fourier coefficients normalized for uniform measure on \(X_{\mathcal S}\), their conditional pair integral is exactly \[ \sum_{\xi\text{ on }X_{\mathcal S}} \widehat g_1(-\xi)\widehat g_2(\xi)\mathfrak g(\xi). \tag{101}\] To see this, simultaneous translation kills character pairs whose frequencies do not sum to zero. For a matching pair, the multiplier is the character average of the difference of the labels. At every odd prime a uniform nonzero square is the square of a uniform nonzero unit. The Chinese remainder theorem therefore identifies this average with the unit-square multiplier \(\mathfrak g(\xi)\) used in Proposition 17.

Estimating the selected pair. Specialization on a uniform coordinate block of size \(R\) costs at most \(R^{1/2}\) in \(L^2\): for every function \(G\), \[\|G(a_B,\cdot)\|_2^2\le R\|G\|_2^2.\] This inequality holds at every specified fiber, independently of the law under which that fiber was selected. Hence \(\|g_i\|_2\le R^{1/2}N^{o(1)}\). By the bound \(|\mathfrak g(\xi)|\le q(\xi)^{-1/3}\), Parseval and Cauchy–Schwarz, the part of (101) with conductor exceeding \(H\) has modulus at most \[ H^{-1/3}\|g_1\|_2\|g_2\|_2 \le H^{-1/3}R N^{o(1)}. \tag{102}\]

We next identify the remaining coefficients with actual integer fibers. Put \(D=M_0R\). The parameter inequalities \[ d\tau<\frac{\beta\gamma}{1000}<\frac\beta2 \tag{103}\] imply \(RH\le Q\) and, for sufficiently large \(N\), \(D\le N^\beta\). For a remaining frequency \(\xi\) with \(q(\xi)\le H\), all frequencies \(\xi+\eta\), where \(\eta\) ranges over the character group on \(B\), therefore occur in the original lift. Summing this entire character group gives \[\begin{align*} \widehat g_i(\xi) &=\sum_{\eta\text{ on }B}\frac1{|I_i|} \sum_{n\in I_i}f_{s_i}(n)e(-n(\xi+\eta))e(a_{i,B}\eta)\\ &=\frac{D}{|I_i|} \sum_{\substack{n\in I_i\\n\equiv a_i\pmod D}} 1_A(n)e(-n\xi), \tag{104}\end{align*}\] where \(a_i\pmod D\) combines \(s_i\pmod {M_0}\) and the coordinates \(a_{i,B}\) by the Chinese remainder theorem. Character orthogonality supplies the factor \(R\), while the definition of \(f_{s_i}\) supplies \(M_0\). Goodness of \(\boldsymbol s\) and the constraints at the conditioned primes show that \(a_2-a_1\) is a strict square class modulo \(D\).

The remaining frequencies of conductor at most \(H\) are precisely the frequencies with squarefree conductor at most \(H\) coprime to \(D\). Indeed, \(D\) contains every prime less than \(P\); every prime divisor of such a conductor is consequently an available prime at least \(P\), at most \(H\le Q\), and outside \(B\). This includes the zero frequency under the convention \(q(0)=1\).

Define functions on \([N]\) by \[F_i(n)=1_A(n)1_{I_i}(n)1_{n\equiv a_i\pmod D}.\] They are bounded by one, their supports are ordered, and there is no positive square difference from the first support to the second. Moreover, \(D\) is eight times an odd squarefree number and \(D\le N^\beta\). All hypotheses of Proposition 17 hold. If the Fourier coefficients of \(F_i\) use normalization \(N^{-1}\), then (104) gives \(\widehat g_i(\xi)=DN\widehat F_i(\xi)/|I_i|\). Thus the part of (101) of conductor at most \(H\) is bounded in modulus by \[\begin{align*} &\frac{D^2N^2}{|I_1||I_2|} \left|\sum_{\substack{q(\xi)\le H,\ q(\xi)\text{ squarefree}\\ (q(\xi),D)=1}} \mathfrak g(\xi)\widehat F_1(-\xi)\widehat F_2(\xi)\right| \\ &\hspace{2cm}\ll H^{-1/3}D\frac{N^2}{|I_1||I_2|} \ll H^{-1/3}D N^{2\tau}. \tag{105}\end{align*}\] The factor \(D\) in Proposition 17 has canceled one of the two fiber-normalization factors.

Combining (102) and (105) bounds each conditional pair integral by \(O(N^{-\beta/6+(d+2)\tau+o(1)})\). This is uniform over all conditionings of positive probability. Averaging them, and then summing the Fourier expansion using (99), bounds the truncated integral for each unequal-cycle interval assignment by \[O\bigl(N^{-\beta/6+(3d+2)\tau+o(1)}\bigr).\] Averaging interval assignments incurs no further loss. Including the equal-cycle contribution and (98), the original integral has modulus at most \[ C\left(N^{-23\tau+o(1)}+N^{-\gamma\tau+o(1)} +N^{-\beta/6+(3d+2)\tau+o(1)}\right). \tag{106}\] Finally, \(23\tau=5888\sigma_0\), \(\gamma\tau=4\sigma_0\), and \[\frac\beta6-(3d+2)\tau >\beta\left(\frac16-\frac3{64000}\right) >\frac\beta7>2\sigma_0.\] The finitely many uniform moment losses in each term can be bounded by \(N^{\sigma_0}\), after increasing the absolute threshold in \(N\). Equation (106) is consequently \(O(N^{-\sigma_0})\), as required. All estimates used absolute values of signed Fourier lifts; no pointwise positivity of a lift was needed. ◻

Proof. Fix a square-difference-free set \(A\subseteq[N]\). Write \[G_s=\mathcal L_{[N],\mathcal P_N,Q}f_s, \qquad \Phi_{\mathbf s}((z_v)_{v\in V})=\prod_{v\in V}G_{s_v}(z_v),\] where \(\mathbf s=(s_v)_{v\in V}\) is a small-residue assignment. By (81), \(1_A=\mathbb E_s f_s\). The lift is linear, and the product-space integral is multilinear, so \[ Y(N,A)=\mathbb E_{\mathbf s} \int\Phi_{\mathbf s}\,d\bigotimes_{p\in\mathcal P_N}\mu_p. \tag{112}\]

For \(B\subseteq\mathcal P_N\), define the nonnegative finite measure \[\kappa_B= \bigotimes_{p\in B}\varepsilon_p \otimes\bigotimes_{p\in\mathcal P_N\setminus B}\mu_p.\] Its mass is \(\eta_B\). The finite product expansion gives the following identity of signed measures: \[ \bigotimes_{p\in\mathcal P_N}\mu_p -\bigotimes_{p\in\mathcal P_N}(\mu_p-\varepsilon_p) =\sum_{\varnothing\ne B\subseteq\mathcal P_N} (-1)^{|B|+1}\kappa_B. \tag{113}\] For any real integrand \(\Phi\), integration followed by the triangle inequality therefore yields \[ \int\Phi\,d\bigotimes_p\mu_p \le \left|\int\Phi\,d\bigotimes_p(\mu_p-\varepsilon_p)\right| +\sum_{B\ne\varnothing}\left|\int\Phi\,d\kappa_B\right|. \tag{114}\] This step makes no sign assumption on \(\Phi\). Notice also that the measure outside \(B\) in each summand is the full measure \(\mu_p\).

We first bound the summands with \(q_B>N^\tau\). A summand of zero mass is zero, so assume \(\eta_B>0\). Each normalized exceptional measure \(\varepsilon_p/\eta_p\) has uniform single-label marginals: its invariance under simultaneous translation implies that any one label is uniformly distributed on \(\mathbb F_p\). The same uniformity holds for \(\mu_p\). Consequently every single-slot marginal of \(\kappa_B/\eta_B\) is uniform on \(X_{\mathcal P_N}\). No independence between different slots is needed. Ordinary Hölder’s inequality gives \[ \left|\int\Phi_{\mathbf s}\,d\kappa_B\right| \le\eta_B\prod_{v\in V}\|G_{s_v}\|_{L^d(X_{\mathcal P_N})} \le C_\epsilon\eta_BN^\epsilon \qquad(\epsilon>0). \tag{115}\] The last inequality is Lemma 15, applied at the fixed even order \(d\) and with the loss in each factor chosen sufficiently small. The bound \(|f_s|\le M_0\) only introduces a fixed factor. The constant \(C_\epsilon\) is independent of \(B\), \(A\), \(N\), and \(\mathbf s\).

The exceptional masses are summable with the extra factor \(q_B\): \[ \sum_{\varnothing\ne B\subseteq\mathcal P_N}q_B\eta_B =\prod_{p\in\mathcal P_N}(1+p\eta_p)-1 \le\prod_{p\ge P}(1+p^{-3})-1\le\frac14. \tag{116}\] It follows from (115) that \[\sum_{\substack{\varnothing\ne B\subseteq\mathcal P_N\\q_B>N^\tau}} \left|\int\Phi_{\mathbf s}\,d\kappa_B\right| \le\frac{C_\epsilon}{4}N^{-\tau+\epsilon}.\] Choose \(\epsilon=\tau/2\). Since \(\sigma_0=\gamma\tau/4<\tau/2\), we obtain \[ \sum_{q_B>N^\tau} \left|\int\Phi_{\mathbf s}\,d\kappa_B\right| \le K_1N^{-\sigma_0}, \tag{117}\] uniformly in the residue assignment. Thus the number of exceptional subsets has already been accounted for by the convergent product (116).

Now suppose \(q_B\le N^\tau\) and \(\eta_B>0\). Condition on all the labels at primes in \(B\) under \(\kappa_B/\eta_B\). The remaining prime law is exactly \(\bigotimes_{p\in\mathcal P_N\setminus B}\mu_p\). For each realization, the function in slot \(v\) is \(G_{s_v}\) specialized at its prescribed labels in \(B\). The mixed assertion of Proposition 20 applies to these arbitrary slotwise residues and labels. With \[D_B=M_0q_B,\qquad \lambda_B=\frac{D_B^2n_B}{N},\] it gives \[ \left|\int\Phi_{\mathbf s}\,d\kappa_B\right| \le\eta_B\left(\lambda_B^d\mathcal Y(n_B)+K_2N^{-\sigma_0}\right). \tag{118}\] The same inequality is trivially true when \(\eta_B=0\). Crucially, the error and its lower threshold for \(N\) are uniform in \(B\) and in every conditioned tuple. No induction hypothesis has been used.

The ceiling in the smaller scale produces a uniform multiplicative error. For \(q_B\le N^\tau\), \[1\le\lambda_B\le1+\frac{D_B^2}{N} \le1+M_0^2N^{2\tau-1},\] and hence \(\lambda_B^d\le1+u_N\). Moreover, \(\sum_{B\ne\varnothing}\eta_B\le1/4\) by (116). Summing the errors in (118) is therefore harmless.

If \(\mathbf s\) is good, Proposition 22 bounds the first term on the right of (114) by \(K_3N^{-\sigma_0}\). Combining this with (117) and (118), we obtain \[\int\Phi_{\mathbf s}\,d\bigotimes_p\mu_p \le K_4N^{-\sigma_0} +(1+u_N) \sum_{\substack{\varnothing\ne B\subseteq\mathcal P_N\\q_B\le N^\tau}} \eta_B\mathcal Y(n_B).\] For a nongood \(\mathbf s\), apply the mixed scale comparison directly with \(B=\varnothing\): \[\left|\int\Phi_{\mathbf s}\,d\bigotimes_p\mu_p\right| \le(1+u_N)\mathcal Y(n_\varnothing)+K_2N^{-\sigma_0}.\] Averaging these two estimates in (112) gives (110), since the good assignments have probability \(\rho\). The estimate is uniform in \(A\), so we may take its maximum. Finally, \(2\tau<1\) by the fixed parameter choice, and \(M_0,d\) are fixed, so \(u_N\to0\). All constants in the proof came from the preceding estimates and fixed parameters; none depended on an induction constant. ◻

Proof. We make all remaining parameter choices before starting the induction. The finite construction fixes \(h,t_0,\ell,d\); the conditional and kernel estimates fix \(\gamma\) and \(\beta\). The threshold \(P\) was then chosen, and with it \(M_0\), \(\tau\), and \(\sigma_0\). In particular the probability \(\rho\) of Lemma 21 is already a fixed positive number. We shall not enlarge \(P\) after choosing the exponent below.

Put \(r=1-3\rho/4\), so \(1/4\le r<1\), and choose \[ a_0=\min\left\{\frac14,\frac{\sigma_0}{2}, \frac{\log(1/r)}{4\log M_0}\right\}. \tag{119}\] Table 1 summarizes the roles of the parameters; among the listed quantities, only those in the last row vary with the interval length.

Every quantity in (119) is fixed and positive. Thus \(0<a_0<\min(1/2,\sigma_0)\), and \[ \theta:=M_0^{2a_0}(1-\rho+\rho/4) =M_0^{2a_0}r\le\sqrt r<1. \tag{120}\] There is no requirement that \(a_0\) be numerically useful.

For every finite \(\mathcal P_N\), the bound \(\eta_p\le p^{-4}\) and \(2a_0\le1\) give \[ \sum_{\varnothing\ne B\subseteq\mathcal P_N}\eta_Bq_B^{2a_0} =\prod_{p\in\mathcal P_N}(1+\eta_p p^{2a_0})-1 \le\prod_{p\ge P}(1+p^{-3})-1\le\frac14. \tag{121}\]

Let \(\kappa=(1-\theta)/2>0\). Choose an integer \(N_*\ge N_1\) so large that, for every \(N\ge N_*\), \[ \theta u_N\le\kappa,\qquad K N^{a_0-\sigma_0}\le\kappa, \tag{122}\] where \(K,N_1\) are supplied by Proposition 23. This is possible because \(u_N\to0\) and \(a_0<\sigma_0\). The choice of \(N_*\) is independent of \(C_0\). Choose \(C_0\ge1\) large enough that \[ \mathcal Y(n)\le C_0 n^{-a_0}\qquad(1\le n<N_*). \tag{123}\] Only finitely many values are involved, so such a finite constant exists. For an elementary bound, the lift in \(Y(n,A)\) has at most \(2n^{2\beta}\) frequencies and each coefficient has modulus at most \(1\). Since its tuple law is a probability measure, \(0\le Y(n,A)\le(2n^{2\beta})^d\). Thus, for example, \(C_0=\max\{1,2^dN_*^{2\beta d+a_0}\}\) suffices in (123). This also covers \(n=1\) and the cases of an empty prime set.

Suppose now that \(N\ge N_*\) and \(\mathcal Y(n)\le C_0n^{-a_0}\) for every positive integer \(n<N\). Every smaller scale appearing in (110) lies in this range. Indeed, \(M_0q_B\ge8\) gives \[1\le n_B\le N/64+1<N\qquad(N\ge2).\] The ceiling goes in the favorable direction for a negative exponent: \[n_B^{-a_0} \le N^{-a_0}M_0^{2a_0}q_B^{2a_0}.\] Apply the induction hypothesis at every such scale in (110), and then use (121). Extending the positive subset sum to all nonempty \(B\) can only increase the bound, and therefore \[\begin{align*} \mathcal Y(N) &\le K N^{-\sigma_0} +(1+u_N)C_0N^{-a_0}M_0^{2a_0} \left(1-\rho+\rho \sum_{B\ne\varnothing}\eta_Bq_B^{2a_0}\right)\\ &\le K N^{-\sigma_0}+(1+u_N)\theta C_0N^{-a_0}\\ &\le \kappa N^{-a_0}+(1-\kappa)C_0N^{-a_0} \le C_0N^{-a_0}. \end{align*}\] In the third line we used (122) and \(\theta+\kappa=1-\kappa\); in the last line we used \(C_0\ge1\). This closes strong induction. In particular, increasing \(C_0\) to cover the finite base range does not change the validity of the large-scale step. ◻

Proof of Theorem 1. Let \(N\ge1\) and let \(A\subseteq[N]\) have no positive integer-square difference. Put \(G=\mathcal L_{[N],\mathcal P_N,Q}1_A\). Its constant Fourier coefficient is \(|A|/N\), and every nonconstant character on \(X_{\mathcal P_N}\) has uniform mean zero. The mean inequality in Lemma 12 and Theorem 24 yield \[\frac{|A|}{N}=|\mathbb EG| \le Z_{\mathcal P_N}(G)^{1/d} =Y(N,A)^{1/d} \le C_0^{1/d}N^{-a_0/d}.\] Thus \(C=C_0^{1/d}<\infty\) and \(c=a_0/d>0\) are absolute constants for which \(|A|\le CN^{1-c}\) for every such \(N\) and \(A\). ◻