[proofplan] Write a generic element of $L = \mathbb{Q}(\sqrt{d})$ as $\alpha = x + y\sqrt{d}$ with $x, y \in \mathbb{Q}$. Use the [Integrality Criterion via Minimal Polynomial](/theorems/1570) together with [Integrality and the Characteristic Polynomial](/theorems/1574) to characterise algebraic integers via the trace and norm: $\alpha \in \mathcal{O}_L$ iff $\operatorname{tr}_{L/\mathbb{Q}}(\alpha) = 2x$ and $N_{L/\mathbb{Q}}(\alpha) = x^2 - dy^2$ both lie in $\mathbb{Z}$. Parametrise by $u = 2x$ and $v = 2y$ and reduce to the Diophantine congruence $u^2 - dv^2 \equiv 0 \pmod 4$. A case analysis on $d \pmod 4$, using that squares mod $4$ are only $0$ or $1$ and that $d$ is square-free (hence $d \not\equiv 0 \pmod 4$), identifies precisely which $(u, v)$ are admissible and produces the stated $\mathbb{Z}$-basis. [/proofplan] [step:Parametrise a general element of $L$ and compute its minimal polynomial] Since $\{1, \sqrt{d}\}$ is a $\mathbb{Q}$-basis of $L = \mathbb{Q}(\sqrt{d})$ (as $d$ is not a square in $\mathbb{Q}$ when $d$ is square-free and $d \neq 0, 1$), every $\alpha \in L$ can be written uniquely as \begin{align*} \alpha = x + y\sqrt{d}, \qquad x, y \in \mathbb{Q}. \end{align*} If $y = 0$ then $\alpha = x \in \mathbb{Q}$, and by [Algebraic Integers in Q](/theorems/1564) we have $\alpha \in \mathcal{O}_L \iff \alpha \in \mathbb{Z}$, which matches the classification (take $u = 2x$ even, $v = 0$ in either case below). Assume henceforth $y \neq 0$. Then $\alpha \notin \mathbb{Q}$, so $[\mathbb{Q}(\alpha):\mathbb{Q}] \geq 2$; since $\alpha \in L$ with $[L:\mathbb{Q}] = 2$, we have $[\mathbb{Q}(\alpha):\mathbb{Q}] = 2$. The minimal polynomial $p_\alpha \in \mathbb{Q}[x]$ is therefore monic of degree $2$. From $(\alpha - x)^2 = y^2 d$, i.e. $\alpha^2 - 2x \alpha + (x^2 - dy^2) = 0$, and since this polynomial has degree $2$ and annihilates $\alpha$, by minimality (the [Minimal Polynomial Divides Any Annihilating Polynomial](/theorems/1569) applied with $f(t) = t^2 - 2xt + (x^2 - dy^2)$), \begin{align*} p_\alpha(t) = t^2 - 2x\, t + (x^2 - d y^2). \tag{$\ast$} \end{align*} [guided] Let $\alpha \in L$. Because $d$ is square-free and $d \neq 0, 1$, the element $\sqrt{d}$ does not lie in $\mathbb{Q}$: otherwise $d = (p/q)^2$ for coprime $p, q$ gives $dq^2 = p^2$, forcing every prime in $q$ to divide $p$, i.e. $q = 1$ and $d = p^2$, contradicting square-freeness unless $d = 1$. Therefore $\{1, \sqrt{d}\}$ is a $\mathbb{Q}$-basis of $L$, and every $\alpha \in L$ decomposes uniquely as \begin{align*} \alpha = x + y\sqrt{d}, \qquad x, y \in \mathbb{Q}. \end{align*} To apply the integrality criterion, we need the minimal polynomial $p_\alpha \in \mathbb{Q}[x]$. We split cases based on $y$: - **Case $y = 0$**: then $\alpha = x \in \mathbb{Q}$. By [Algebraic Integers in Q](/theorems/1564), $\alpha \in \mathcal{O}_L$ iff $\alpha \in \mathbb{Z}$. This is consistent with both branches of the claimed classification (corresponding to $u = 2x$ even and $v = 0$, which we will see forces $x \in \mathbb{Z}$). So we may henceforth assume $y \neq 0$, which simplifies the analysis. - **Case $y \neq 0$**: then $\alpha = x + y\sqrt{d} \notin \mathbb{Q}$ (because $\sqrt{d} \notin \mathbb{Q}$). Hence $[\mathbb{Q}(\alpha):\mathbb{Q}] \geq 2$. But $\mathbb{Q}(\alpha) \subseteq L$ and $[L:\mathbb{Q}] = 2$, so $[\mathbb{Q}(\alpha):\mathbb{Q}] = 2$, forcing $\deg p_\alpha = 2$. To find $p_\alpha$ explicitly, we manufacture a monic degree-$2$ polynomial annihilating $\alpha$. Rearranging $\alpha - x = y\sqrt{d}$ and squaring gives $(\alpha - x)^2 = y^2 d$, i.e. \begin{align*} \alpha^2 - 2x\alpha + (x^2 - dy^2) = 0. \end{align*} The polynomial $f(t) = t^2 - 2xt + (x^2 - dy^2) \in \mathbb{Q}[t]$ is monic of degree $2$ and kills $\alpha$. By [Minimal Polynomial Divides Any Annihilating Polynomial](/theorems/1569), $p_\alpha \mid f$; since both are monic and $\deg f = 2 = \deg p_\alpha$, we conclude $p_\alpha = f$: \begin{align*} p_\alpha(t) = t^2 - 2x\, t + (x^2 - d y^2). \end{align*} In other words, $\operatorname{tr}_{L/\mathbb{Q}}(\alpha) = 2x$ (negative of the coefficient of $t$) and $N_{L/\mathbb{Q}}(\alpha) = x^2 - dy^2$ (constant term); these expressions will reappear below. [/guided] [/step] [step:Reduce integrality of $\alpha$ to the integrality of $2x$ and $x^2 - dy^2$] By the [Integrality Criterion via Minimal Polynomial](/theorems/1570), $\alpha \in \mathcal{O}_L$ if and only if $p_\alpha \in \mathbb{Z}[t]$. From $(\ast)$, this is equivalent to the two conditions \begin{align*} 2x \in \mathbb{Z}, \qquad x^2 - d y^2 \in \mathbb{Z}. \tag{$\dagger$} \end{align*} [guided] The equivalence (1) $\Leftrightarrow$ (2) in the [Integrality Criterion via Minimal Polynomial](/theorems/1570) says: \begin{align*} \alpha \in \mathcal{O}_L \iff p_\alpha \in \mathbb{Z}[t]. \end{align*} Its hypotheses are "$L$ is a number field" (which $\mathbb{Q}(\sqrt{d})$ is — a finite extension of $\mathbb{Q}$ of degree $2$) and "$p_\alpha$ is the minimal polynomial of $\alpha$ over $\mathbb{Q}$" (which we have just computed). Both hold. From the explicit form of $p_\alpha$ in $(\ast)$, "$p_\alpha \in \mathbb{Z}[t]$" is just the statement that each of its three coefficients is an integer. The leading coefficient $1$ is automatic, so the condition reduces to \begin{align*} 2x \in \mathbb{Z}, \qquad x^2 - d y^2 \in \mathbb{Z}. \end{align*} This is a purely arithmetic condition on the two rational parameters $x, y$. [/guided] [/step] [step:Reparametrise $x = u/2$, $y = v/2$ with $u, v \in \mathbb{Z}$ to obtain the congruence $u^2 \equiv d v^2 \pmod{4}$] [claim:Halving both coordinates is a valid reparametrisation] If $\alpha = x + y\sqrt{d} \in \mathcal{O}_L$ with $x, y \in \mathbb{Q}$, then there exist $u, v \in \mathbb{Z}$ with $x = u/2$ and $y = v/2$. [/claim] [proof] The first condition $2x \in \mathbb{Z}$ in $(\dagger)$ gives $u := 2x \in \mathbb{Z}$ directly. For $v := 2y$: we must show $2y \in \mathbb{Z}$. The second condition $x^2 - dy^2 \in \mathbb{Z}$, combined with $x \in \frac{1}{2}\mathbb{Z}$, gives $4(x^2 - dy^2) \in 4\mathbb{Z} \subseteq \mathbb{Z}$, i.e. \begin{align*} u^2 - d (2y)^2 = 4x^2 - 4dy^2 = 4(x^2 - dy^2) \in \mathbb{Z}. \end{align*} Since $u^2 \in \mathbb{Z}$, subtracting gives $d (2y)^2 \in \mathbb{Z}$. Write $2y = a/b$ in lowest terms with $a, b \in \mathbb{Z}$, $b \geq 1$, $\gcd(a, b) = 1$. Then \begin{align*} d (2y)^2 = \frac{d a^2}{b^2} \in \mathbb{Z} \iff b^2 \mid d a^2. \end{align*} Since $\gcd(a, b) = 1$, also $\gcd(a^2, b^2) = 1$, so $b^2 \mid d$. But $d$ is square-free, so $b^2 \mid d$ forces $b^2 = 1$, i.e. $b = 1$. Hence $2y = a \in \mathbb{Z}$, i.e. $v := 2y \in \mathbb{Z}$. [/proof] Substituting $x = u/2$, $y = v/2$ into the second condition of $(\dagger)$: \begin{align*} x^2 - d y^2 = \frac{u^2 - d v^2}{4} \in \mathbb{Z} \iff u^2 - d v^2 \equiv 0 \pmod{4}. \tag{$\ddagger$} \end{align*} Thus, modulo the identifications $u = 2x$, $v = 2y$, the integrality condition $(\dagger)$ is equivalent to: $u, v \in \mathbb{Z}$ with $u^2 \equiv d v^2 \pmod{4}$. [guided] We want to turn the two conditions $(\dagger)$ into a single congruence over $\mathbb{Z}$ by rescaling. The first condition gives $u := 2x \in \mathbb{Z}$ for free. The less obvious point is that $v := 2y$ is also in $\mathbb{Z}$ — this is where square-freeness of $d$ enters. We prove this in the claim. The idea: from $2x \in \mathbb{Z}$ we have $4x^2 \in \mathbb{Z}$. Combined with $4(x^2 - dy^2) \in \mathbb{Z}$ (which follows from $x^2 - dy^2 \in \mathbb{Z}$), we deduce $4 d y^2 \in \mathbb{Z}$, hence $d (2y)^2 \in \mathbb{Z}$. Writing $2y = a/b$ in lowest terms with $b \geq 1$, this gives $b^2 \mid d a^2$; since $\gcd(a^2, b^2) = 1$, we get $b^2 \mid d$. Square-freeness of $d$ (no prime divides $d$ with multiplicity $\geq 2$) forces $b = 1$, i.e. $2y \in \mathbb{Z}$. **Why the square-free hypothesis is essential**: if we allowed $d = 4$ (not square-free) then $L = \mathbb{Q}(\sqrt{4}) = \mathbb{Q}$ is degenerate. More illustratively, for $d' = 4d$ (with $d$ square-free), $\sqrt{d'} = 2\sqrt{d}$, and the "ring of integers" is the same subring of $L$ but indexed differently — square-freeness removes this ambiguity and guarantees that $\{1, \sqrt{d}\}$ is the "right" basis to describe integrality. Now substitute $x = u/2$, $y = v/2$ into the second condition of $(\dagger)$: \begin{align*} x^2 - d y^2 = \frac{u^2}{4} - \frac{d v^2}{4} = \frac{u^2 - d v^2}{4}. \end{align*} This is an integer iff $4 \mid u^2 - dv^2$, i.e. \begin{align*} u^2 \equiv d v^2 \pmod{4}. \end{align*} Our integrality condition on $\alpha$ has now been translated into: $\alpha = \tfrac{u}{2} + \tfrac{v}{2}\sqrt{d}$ with $u, v \in \mathbb{Z}$ satisfying $u^2 \equiv d v^2 \pmod{4}$. [/guided] [/step] [step:Solve the congruence $u^2 \equiv d v^2 \pmod{4}$ using that squares mod $4$ are $\{0, 1\}$] For any integer $m \in \mathbb{Z}$, $m^2 \pmod{4} \in \{0, 1\}$ depending on the parity of $m$: $m^2 \equiv 0 \pmod 4$ if $m$ is even and $m^2 \equiv 1 \pmod 4$ if $m$ is odd. Since $d$ is square-free and $d \neq 0$, we have $d \not\equiv 0 \pmod 4$ (if $4 \mid d$ then $2^2 \mid d$, violating square-freeness). Hence $d \pmod 4 \in \{1, 2, 3\}$. We analyse $u^2 \equiv d v^2 \pmod 4$ in each residue class. **Case A: $d \equiv 2 \pmod 4$.** Then $dv^2 \equiv 2 v^2 \pmod 4 \in \{0, 2\}$ (equal to $0$ if $v$ is even, and $2$ if $v$ is odd). We need $u^2 \equiv 2v^2 \pmod 4$. - If $v$ odd, $2v^2 \equiv 2 \pmod 4$; but $u^2 \in \{0, 1\}$, no solution. - If $v$ even, $2v^2 \equiv 0 \pmod 4$; require $u^2 \equiv 0$, so $u$ even. Hence, in this case, $u^2 \equiv dv^2 \pmod 4 \iff u, v$ are both even. **Case B: $d \equiv 3 \pmod 4$.** Then $dv^2 \equiv 3 v^2 \pmod 4 \in \{0, 3\}$. - If $v$ odd, $3v^2 \equiv 3$; $u^2 \in \{0, 1\}$, no solution. - If $v$ even, $3v^2 \equiv 0$; $u^2 \equiv 0$, so $u$ even. Hence, in this case, $u^2 \equiv dv^2 \pmod 4 \iff u, v$ both even. **Case C: $d \equiv 1 \pmod 4$.** Then $dv^2 \equiv v^2 \pmod 4$, so \begin{align*} u^2 \equiv d v^2 \pmod 4 \iff u^2 \equiv v^2 \pmod 4 \iff u \equiv v \pmod 2, \end{align*} i.e. $u, v$ have the same parity. [guided] Squares modulo $4$ form a small set: \begin{align*} m \text{ even} &\Rightarrow m = 2k, \quad m^2 = 4k^2 \equiv 0 \pmod 4, \\ m \text{ odd} &\Rightarrow m = 2k+1, \quad m^2 = 4k^2 + 4k + 1 \equiv 1 \pmod 4. \end{align*} So $\{m^2 \pmod 4\} = \{0, 1\}$. This is the fundamental arithmetic fact driving the case analysis. Also, the residue class of $d$ mod $4$ cannot be $0$: if $d \equiv 0 \pmod 4$ then $4 \mid d$ so $2^2 \mid d$, contradicting square-freeness. Thus $d \pmod 4 \in \{1, 2, 3\}$. We check each case of $u^2 \equiv dv^2 \pmod 4$: **Case A ($d \equiv 2$).** $dv^2 \equiv 2v^2 \pmod 4$. If $v$ is odd, $v^2 \equiv 1$, so $2v^2 \equiv 2$; but $u^2 \in \{0, 1\}$ and $2 \notin \{0, 1\}$, so no $u$ satisfies the congruence. If $v$ is even, $v^2 \equiv 0$, so $2v^2 \equiv 0$; we need $u^2 \equiv 0$, i.e. $u$ even. Result: $u \equiv 0 \pmod 2$ and $v \equiv 0 \pmod 2$ (both even). **Case B ($d \equiv 3$).** $dv^2 \equiv 3v^2 \pmod 4$. If $v$ is odd, $3v^2 \equiv 3$; no $u^2 \in \{0, 1\}$ equals $3$, so no solution. If $v$ is even, $3v^2 \equiv 0$; need $u^2 \equiv 0$, i.e. $u$ even. Result: again both $u, v$ even. **Case C ($d \equiv 1$).** $dv^2 \equiv v^2 \pmod 4$, so the congruence becomes $u^2 \equiv v^2 \pmod 4$. Since squares depend only on parity, $u^2 \equiv v^2 \pmod 4 \iff u, v$ have the same parity ($u \equiv v \pmod 2$). **Summary.** - Cases A, B: both $u, v$ are forced even. - Case C: $u \equiv v \pmod 2$. [/guided] [/step] [step:Translate the congruence conditions back to the element $\alpha$ and identify $\mathcal{O}_L$] **Cases $d \equiv 2, 3 \pmod 4$.** The condition "$u, v$ both even" rewrites as $u = 2x'$, $v = 2y'$ for some $x', y' \in \mathbb{Z}$, i.e. $x = u/2 = x' \in \mathbb{Z}$ and $y = v/2 = y' \in \mathbb{Z}$. Therefore \begin{align*} \mathcal{O}_L = \{x + y\sqrt{d} : x, y \in \mathbb{Z}\} = \mathbb{Z}[\sqrt{d}], \end{align*} by definition of the ring $\mathbb{Z}[\sqrt{d}]$. **Case $d \equiv 1 \pmod 4$.** The condition is $u \equiv v \pmod 2$. Set $\omega := \frac{1 + \sqrt{d}}{2}$. We claim \begin{align*} \mathcal{O}_L = \mathbb{Z}[\omega] = \{a + b\omega : a, b \in \mathbb{Z}\}. \end{align*} Write $\alpha = \frac{u}{2} + \frac{v}{2}\sqrt{d}$ with $u, v \in \mathbb{Z}$ and $u \equiv v \pmod 2$, so $u - v \in 2\mathbb{Z}$. Set \begin{align*} a := \frac{u - v}{2} \in \mathbb{Z}, \qquad b := v \in \mathbb{Z}. \end{align*} Then \begin{align*} a + b\omega &= \frac{u - v}{2} + v \cdot \frac{1 + \sqrt{d}}{2} = \frac{u - v}{2} + \frac{v}{2} + \frac{v}{2}\sqrt{d} = \frac{u}{2} + \frac{v}{2}\sqrt{d} = \alpha. \end{align*} Hence $\alpha \in \mathbb{Z}[\omega]$, giving $\mathcal{O}_L \subseteq \mathbb{Z}[\omega]$. Conversely, we must check $\mathbb{Z}[\omega] \subseteq \mathcal{O}_L$. Because $\mathcal{O}_L$ is a ring (by [Ring of Integers is a Ring](/theorems/1567)), it suffices to show $1 \in \mathcal{O}_L$ and $\omega \in \mathcal{O}_L$. - $1 \in \mathcal{O}_L$: $1 \in \mathbb{Z} \subseteq \mathcal{O}_L$ since $1$ satisfies $t - 1 = 0$. - $\omega \in \mathcal{O}_L$: compute the minimal polynomial. From $\omega = \frac{1 + \sqrt{d}}{2}$, we have $2\omega - 1 = \sqrt{d}$, so $(2\omega - 1)^2 = d$, i.e. $4\omega^2 - 4\omega + 1 - d = 0$, i.e. \begin{align*} \omega^2 - \omega + \frac{1 - d}{4} = 0. \end{align*} Since $d \equiv 1 \pmod 4$, we have $4 \mid 1 - d$, so $\frac{1 - d}{4} \in \mathbb{Z}$. The polynomial \begin{align*} q(t) = t^2 - t + \frac{1 - d}{4} \in \mathbb{Z}[t] \end{align*} is monic of degree $2$ with $q(\omega) = 0$; by [Minimal Polynomial Divides Any Annihilating Polynomial](/theorems/1569) and degree matching ($[\mathbb{Q}(\omega):\mathbb{Q}] = 2$ since $\omega \notin \mathbb{Q}$), this is the minimal polynomial of $\omega$ over $\mathbb{Q}$. It lies in $\mathbb{Z}[t]$, so by the [Integrality Criterion via Minimal Polynomial](/theorems/1570), $\omega \in \mathcal{O}_L$. Hence $\mathbb{Z}[\omega] \subseteq \mathcal{O}_L$, and combining with the reverse inclusion, $\mathcal{O}_L = \mathbb{Z}[\omega] = \mathbb{Z}\left[\tfrac{1 + \sqrt{d}}{2}\right]$. [guided] We now translate the arithmetic conditions on $(u, v)$ back into the element $\alpha = \frac{u}{2} + \frac{v}{2}\sqrt{d}$ and identify the corresponding ring. **Cases A, B ($d \equiv 2, 3 \pmod 4$).** The condition "$u, v$ both even" is equivalent to "$u/2, v/2 \in \mathbb{Z}$" which, since $x = u/2$ and $y = v/2$, is "$x, y \in \mathbb{Z}$". Therefore \begin{align*} \mathcal{O}_L = \{x + y\sqrt{d} : x, y \in \mathbb{Z}\}. \end{align*} The right-hand side is by definition the subring $\mathbb{Z}[\sqrt{d}]$ of $L$ generated over $\mathbb{Z}$ by $\sqrt{d}$ — indeed, any $\mathbb{Z}$-linear combination of powers of $\sqrt{d}$ collapses to $x + y\sqrt{d}$ since $(\sqrt{d})^2 = d \in \mathbb{Z}$ reduces higher powers. So \begin{align*} \mathcal{O}_L = \mathbb{Z}[\sqrt{d}]. \end{align*} **Case C ($d \equiv 1 \pmod 4$).** The condition "$u \equiv v \pmod 2$" is more subtle: it allows both coordinates odd, not just both even. Concretely, it allows $\alpha = \frac{1}{2} + \frac{1}{2}\sqrt{d} = \frac{1 + \sqrt{d}}{2}$, which we will call $\omega$. We claim $\mathcal{O}_L = \mathbb{Z}[\omega]$ where $\omega := \frac{1 + \sqrt{d}}{2}$. **Inclusion $\mathcal{O}_L \subseteq \mathbb{Z}[\omega]$.** Let $\alpha = \frac{u}{2} + \frac{v}{2}\sqrt{d} \in \mathcal{O}_L$, so $u \equiv v \pmod 2$ by our analysis. Since $u - v$ is then even, $a := (u-v)/2 \in \mathbb{Z}$. Set $b := v \in \mathbb{Z}$. Compute: \begin{align*} a + b\omega = \frac{u - v}{2} + v \cdot \frac{1 + \sqrt{d}}{2} = \frac{u - v}{2} + \frac{v}{2} + \frac{v}{2}\sqrt{d} = \frac{u}{2} + \frac{v}{2}\sqrt{d} = \alpha. \end{align*} So $\alpha = a + b\omega \in \mathbb{Z} + \mathbb{Z}\omega \subseteq \mathbb{Z}[\omega]$. **Inclusion $\mathbb{Z}[\omega] \subseteq \mathcal{O}_L$.** We will show $1, \omega \in \mathcal{O}_L$; since $\mathcal{O}_L$ is a ring (by [Ring of Integers is a Ring](/theorems/1567)), every $\mathbb{Z}$-combination $a + b\omega$ lies in $\mathcal{O}_L$, and in fact every polynomial in $\omega$ with $\mathbb{Z}$-coefficients does. - $1 \in \mathcal{O}_L$: $1$ satisfies the monic integer polynomial $t - 1$, so $1 \in \mathcal{O}_L$. - $\omega \in \mathcal{O}_L$: compute the minimal polynomial of $\omega$. From the definition $\omega = \frac{1 + \sqrt{d}}{2}$, rearrange to $2\omega = 1 + \sqrt{d}$, so $\sqrt{d} = 2\omega - 1$. Squaring and using $\sqrt{d}^2 = d$: \begin{align*} d = (2\omega - 1)^2 = 4\omega^2 - 4\omega + 1, \qquad \text{so} \qquad 4\omega^2 - 4\omega + (1 - d) = 0. \end{align*} Dividing by $4$ (which is valid in $\mathbb{Q}$): \begin{align*} \omega^2 - \omega + \frac{1 - d}{4} = 0. \end{align*} The crucial check: $\frac{1 - d}{4} \in \mathbb{Z}$? This requires $4 \mid 1 - d$, i.e. $d \equiv 1 \pmod 4$, which is exactly the hypothesis of Case C. So \begin{align*} q(t) := t^2 - t + \frac{1 - d}{4} \in \mathbb{Z}[t] \end{align*} is a monic integer polynomial of degree $2$ with $q(\omega) = 0$. Since $\omega \notin \mathbb{Q}$ (as $\sqrt{d} = 2\omega - 1$ would then be in $\mathbb{Q}$, contradiction), the minimal polynomial of $\omega$ over $\mathbb{Q}$ has degree at least $2$. By [Minimal Polynomial Divides Any Annihilating Polynomial](/theorems/1569), $p_\omega \mid q$; since both are monic and $\deg q = 2 \leq \deg p_\omega$, we get $p_\omega = q \in \mathbb{Z}[t]$. By the [Integrality Criterion via Minimal Polynomial](/theorems/1570), $\omega \in \mathcal{O}_L$. Combining both inclusions, $\mathcal{O}_L = \mathbb{Z}[\omega] = \mathbb{Z}\left[\tfrac{1 + \sqrt{d}}{2}\right]$, completing Case C. **Summary of the three cases.** \begin{align*} \mathcal{O}_L = \begin{cases} \mathbb{Z}[\sqrt{d}] & \text{if } d \equiv 2 \text{ or } 3 \pmod 4, \\ \mathbb{Z}\!\left[\tfrac{1}{2}(1 + \sqrt{d})\right] & \text{if } d \equiv 1 \pmod 4. \end{cases} \end{align*} **Final sanity check for Case C**: the element $\omega$ has minimal polynomial $t^2 - t + (1-d)/4$, whose coefficients lie in $\mathbb{Z}$ iff $d \equiv 1 \pmod 4$. So the integrality of $\omega$ — and hence the validity of enlarging the ring from $\mathbb{Z}[\sqrt{d}]$ to $\mathbb{Z}[\omega]$ — is precisely conditioned on the residue class of $d$ modulo $4$. This is the hallmark of ramification at $2$: for $d \equiv 1 \pmod 4$, the prime $2$ is unramified in $\mathcal{O}_L$, which manifests as the presence of the "half-integer" element $\omega$; for $d \equiv 2, 3 \pmod 4$, the prime $2$ is ramified or inert, and $\mathcal{O}_L = \mathbb{Z}[\sqrt{d}]$ remains "simple". [/guided] [/step]