[proofplan] By construction of the group law on $E$ via the bijection $\beta : E \to \mathrm{Jac}(E)$, $p \oplus_E q \oplus_E r = p_0$ is equivalent to a linear equivalence of divisors on $E$, namely $p + q + r \sim 3 p_0$. This in turn means the difference $p + q + r - 3 p_0$ is the divisor of a rational function $f$ on $E$. We use Riemann–Roch to identify $\mathcal{L}(3 p_0)$: it has dimension $3$. After a linear change of coordinates on $\mathbb{P}^2_k$ sending $p_0$ to $[0:1:0]$ with inflection tangent $\{X_2 = 0\}$, a basis of $\mathcal{L}(3 p_0)$ is $\{1, X_0/X_2, X_1/X_2\}$, where $X_0/X_2$ and $X_1/X_2$ are rational functions whose only poles on $E$ lie at $p_0$, of orders $2$ and $3$ respectively. Any nonzero $f \in \mathcal{L}(3 p_0)$ is then the restriction to $E$ of a quotient $G/X_2$ where $G$ is a homogeneous linear form. The condition that $\operatorname{div}(f) = p + q + r - 3 p_0$ becomes the condition that the line $\{G = 0\}$ cuts $E$ in exactly $p + q + r$, which by Bezout is equivalent to collinearity of $p, q, r$. [/proofplan] [step:Translate the group equation $p \oplus_E q \oplus_E r = p_0$ into a divisor linear equivalence] By [Elliptic Curve as Jacobian](/theorems/2190), the map \begin{align*} \beta : E &\to \mathrm{Jac}(E), \\ p &\mapsto [p - p_0] \end{align*} is a group isomorphism, where the group law on $E$ is defined precisely so that $\beta$ is a homomorphism. Hence $p \oplus_E q \oplus_E r = p_0$ holds iff \begin{align*} \beta(p) + \beta(q) + \beta(r) = \beta(p_0) = 0 \quad \text{in } \mathrm{Jac}(E), \end{align*} i.e., \begin{align*} [p - p_0] + [q - p_0] + [r - p_0] = 0 \quad \text{in } \mathrm{Pic}(E), \end{align*} which simplifies to \begin{align*} [(p + q + r) - 3 p_0] = 0, \end{align*} that is, $p + q + r - 3 p_0$ is principal, equivalently \begin{align*} p + q + r \sim 3 p_0 \quad \text{in } \mathrm{Div}(E). \end{align*} By definition of linear equivalence, this holds iff there exists $f \in k(E)^\times$ with \begin{align*} \operatorname{div}(f) = p + q + r - 3 p_0. \end{align*} [/step] [step:Identify the candidate $f$ as an element of $\mathcal{L}(3 p_0)$ and compute $\ell(3 p_0) = 3$] The condition $\operatorname{div}(f) = p + q + r - 3 p_0$ means $\operatorname{div}(f) + 3 p_0 = p + q + r$ is effective, so $f \in \mathcal{L}(3 p_0)$. Conversely, any nonzero $f \in \mathcal{L}(3 p_0)$ gives a divisor $\operatorname{div}(f) + 3 p_0 \geq 0$ of degree \begin{align*} \deg(\operatorname{div}(f) + 3 p_0) = 0 + 3 = 3, \end{align*} so $\operatorname{div}(f) + 3 p_0$ is an effective degree-$3$ divisor on $E$. We compute $\ell(3 p_0)$. Since $E$ has genus $g = 1$ and $\deg(3 p_0) = 3 \geq 2(1) - 1 = 1$, by [Riemann–Roch for Large Degree Divisors](/theorems/2188), \begin{align*} \ell(3 p_0) = \deg(3 p_0) - g + 1 = 3 - 1 + 1 = 3. \end{align*} [/step] [step:Change coordinates so that $p_0 = [0:1:0]$ and the inflection tangent is $\{X_2 = 0\}$] The statement fixes $p_0 = [0:0:1]$, but the coordinate choice is not intrinsic: the collinearity condition and the group law are invariant under linear changes of coordinates on $\mathbb{P}^2_k$. To compute a basis of $\mathcal{L}(3 p_0)$ cleanly, we apply a projective linear automorphism $\Phi \in \mathrm{PGL}_3(k)$ that moves $p_0$ to $[0:1:0]$ and takes the inflection tangent to $E$ at $p_0$ to the line $\{X_2 = 0\}$. (Such $\Phi$ exists: $\mathrm{PGL}_3(k)$ acts transitively on ordered triples $(\text{point}, \text{line through the point}, \text{a second line through the point})$, so any point-and-tangent-line pair can be moved to any other.) Replacing $E$ by $\Phi(E)$ and $p_0$ by $\Phi(p_0)$, we may assume throughout the remainder of the proof: \begin{align*} p_0 = [0:1:0] \in \mathbb{P}^2_k, \qquad T_{p_0} E = \{X_2 = 0\}, \end{align*} where $T_{p_0} E$ denotes the projective tangent line to $E$ at $p_0$. Since $p_0$ is a flex, this tangent line meets $E$ with intersection multiplicity $3$ at $p_0$. [/step] [step:Exhibit the explicit basis $\{1, X_0/X_2, X_1/X_2\}$ for $\mathcal{L}(3 p_0)$ with pole orders $0, 2, 3$ at $p_0$] Work in the projective coordinates with $p_0 = [0:1:0]$ and inflection tangent $\{X_2 = 0\}$ fixed by the previous step. We compute the divisors on $E$ of the three homogeneous linear forms $X_0, X_1, X_2$, each viewed as a section of $\mathcal{O}_E(1)$, and hence the divisors of the ratios $X_0/X_2$ and $X_1/X_2 \in k(E)^\times$. \textbf{Divisor of $X_2$ on $E$.} The line $\{X_2 = 0\}$ is the inflection tangent at $p_0$, so by the flex hypothesis the intersection $E \cap \{X_2 = 0\}$ consists of $p_0$ with multiplicity $3$, i.e., \begin{align*} \operatorname{div}_E(X_2) = 3 p_0. \end{align*} (By [Bezout's Theorem for Smooth Curves](/theorems/2179), the total degree of $E \cap \{X_2 = 0\}$ is $\deg E \cdot \deg\{X_2 = 0\} = 3 \cdot 1 = 3$, and the flex condition concentrates all of this multiplicity at $p_0$.) \textbf{Divisor of $X_0$ on $E$.} At $p_0 = [0:1:0]$ we have $X_0 = 0$, so the line $\{X_0 = 0\}$ passes through $p_0$. Its intersection with $E$ is a divisor of degree $3$ on $E$ (by Bezout's theorem as above), containing $p_0$ with some multiplicity $m_0 \geq 1$. Since $E$ is smooth at $p_0$, the line $\{X_0 = 0\}$ is either the tangent line at $p_0$ (giving $m_0 \geq 2$, and $= 3$ at a flex) or a non-tangent line (giving $m_0 = 1$). Here $\{X_0 = 0\} \neq \{X_2 = 0\}$ is distinct from the inflection tangent, so $\{X_0 = 0\}$ is not tangent to $E$ at $p_0$, and $m_0 = 1$: \begin{align*} \operatorname{div}_E(X_0) = p_0 + a + b \end{align*} for two (not necessarily distinct) points $a, b \in E \setminus \{p_0\}$. \textbf{Divisor of $X_1$ on $E$.} At $p_0 = [0:1:0]$ we have $X_1 = 1 \neq 0$, so the line $\{X_1 = 0\}$ does not pass through $p_0$. Again by Bezout, $E \cap \{X_1 = 0\}$ has total degree $3$, supported on three points (with multiplicity) of $E \setminus \{p_0\}$: \begin{align*} \operatorname{div}_E(X_1) = c_1 + c_2 + c_3, \qquad c_i \in E \setminus \{p_0\}. \end{align*} \textbf{Divisors of the ratios.} Subtracting: \begin{align*} \operatorname{div}_E(X_0 / X_2) &= \operatorname{div}_E(X_0) - \operatorname{div}_E(X_2) = (p_0 + a + b) - 3 p_0 = a + b - 2 p_0, \\ \operatorname{div}_E(X_1 / X_2) &= \operatorname{div}_E(X_1) - \operatorname{div}_E(X_2) = (c_1 + c_2 + c_3) - 3 p_0. \end{align*} Hence both ratios have poles concentrated only at $p_0$: \begin{align*} \operatorname{ord}_{p_0}(X_0 / X_2) = -2, \qquad \operatorname{ord}_{p_0}(X_1 / X_2) = -3, \end{align*} and neither has any pole away from $p_0$ (the divisors $a + b - 2 p_0$ and $c_1 + c_2 + c_3 - 3 p_0$ are supported at $p_0$ with negative coefficient only there). In particular, \begin{align*} \operatorname{div}_E(X_0/X_2) + 3 p_0 = a + b + p_0 \geq 0, \qquad \operatorname{div}_E(X_1/X_2) + 3 p_0 = c_1 + c_2 + c_3 \geq 0, \end{align*} so $X_0/X_2, X_1/X_2 \in \mathcal{L}(3 p_0)$. The constant function $1$ has $\operatorname{div}(1) = 0$, so $\operatorname{div}(1) + 3 p_0 = 3 p_0 \geq 0$, and hence $1 \in \mathcal{L}(3 p_0)$. \textbf{Linear independence.} The three elements $1, X_0/X_2, X_1/X_2 \in \mathcal{L}(3 p_0)$ have pole orders at $p_0$ equal to $0, 2, 3$ respectively (where "pole order" means $-\operatorname{ord}_{p_0}$). Suppose \begin{align*} \alpha \cdot 1 + \beta \cdot (X_0/X_2) + \gamma \cdot (X_1/X_2) = 0 \quad \text{in } k(E), \end{align*} for some $\alpha, \beta, \gamma \in k$ not all zero. Taking $\operatorname{ord}_{p_0}$ of both sides, the left-hand side is a sum of elements with distinct valuations $0, -2, -3$ at $p_0$ (for the terms with nonzero coefficient). The valuation of a sum is the minimum of the summand valuations when those valuations are distinct. Hence the valuation of the left-hand side equals the minimum over $\{0, -2, -3\}$ of those summands with nonzero coefficient, which is finite and hence the left-hand side is not the zero element of $k(E)$. Contradiction. Hence $\{1, X_0/X_2, X_1/X_2\}$ is $k$-linearly independent. Combined with $\dim_k \mathcal{L}(3 p_0) = 3$ from Step 2, it is a $k$-basis of $\mathcal{L}(3 p_0)$. \textbf{Every $f \in \mathcal{L}(3 p_0)$ is the restriction of $G/X_2$.} Writing $f = a_0 \cdot 1 + a_1 \cdot (X_0/X_2) + a_2 \cdot (X_1/X_2)$ with $a_0, a_1, a_2 \in k$: \begin{align*} f = \frac{a_0 X_2 + a_1 X_0 + a_2 X_1}{X_2} = \frac{G(X_0, X_1, X_2)}{X_2}, \end{align*} where $G(X_0, X_1, X_2) := a_1 X_0 + a_2 X_1 + a_0 X_2$ is a homogeneous linear form. Conversely, any such ratio $G/X_2$ with $G \in k[X_0, X_1, X_2]_1$ lies in $\mathcal{L}(3 p_0)$ by the same computation. [guided] \textbf{Why are these the right basis functions?} Riemann–Roch has given us $\ell(3 p_0) = 3$; the work is to write down three linearly independent elements. On a genus-$1$ curve with flex base point $p_0$, the pole orders achievable by elements of $\bigcup_{n \geq 0} \mathcal{L}(n p_0)$ at $p_0$ form a numerical semigroup $\{0, 2, 3, 4, 5, \ldots\}$ — the "Weierstrass semigroup" — with the unique gap $\{1\}$ (there is no function with a simple pole at $p_0$ and no other poles; this is the obstruction that reflects $g = 1$). So the smallest three pole orders available inside $\mathcal{L}(3 p_0)$ are $0, 2, 3$, and a function realising each of these gives a basis by distinct-valuation independence. \textbf{Why does the normalisation $p_0 = [0:1:0]$, tangent $\{X_2 = 0\}$ make this explicit?} The inflection condition says the tangent meets $E$ at $p_0$ with multiplicity $3$, i.e., $\operatorname{div}_E(\text{tangent}) = 3 p_0$. Choosing this tangent to be a coordinate line — $\{X_2 = 0\}$ — realises $X_2$ as a regular section of $\mathcal{O}_E(1)$ whose zero divisor is exactly $3 p_0$. Then for any other linear form $L$, the rational function $L/X_2$ has divisor $\operatorname{div}_E(L) - 3 p_0$: its poles are concentrated at $p_0$ (the zero locus of the denominator $X_2$), and of order at most $3$ (the multiplicity of $X_2$ at $p_0$). Choosing $L = X_0$ (passes through $p_0$, transverse to the tangent) cancels one copy of $p_0$ in the denominator and gives a pole of order $2$; choosing $L = X_1$ (does not pass through $p_0$) leaves all three copies in the denominator and gives a pole of order $3$. This is the geometric source of the pole orders $-2$ and $-3$. \textbf{Why does the coordinate choice $p_0 = [0:1:0]$ differ from the statement's $p_0 = [0:0:1]$?} With $p_0 = [0:0:1]$, the coordinate $X_2$ does not vanish at $p_0$, so $X_2$ cannot be the inflection tangent and $X_0/X_2, X_1/X_2$ are \emph{regular} at $p_0$ rather than having poles there. The theorem is invariant under projective linear changes of coordinates, so we freely apply $\Phi \in \mathrm{PGL}_3(k)$ (see the preceding step on changing coordinates) to move $p_0$ into a position where the inflection tangent aligns with a coordinate axis. This is a purely book-keeping normalisation, not a substantive hypothesis. \textbf{The linear-independence argument via valuations.} Given $\alpha, \beta, \gamma \in k$, the expression $\alpha + \beta \cdot (X_0/X_2) + \gamma \cdot (X_1/X_2) \in k(E)$ has $\operatorname{ord}_{p_0}$ equal to the minimum of $\{0, -2, -3\}$ over the summands with nonzero coefficient. (Strict inequality would require a "coincidence cancellation" between summands of equal valuation — but no two of $\{0, -2, -3\}$ are equal, so no cancellation can happen at leading order.) Hence the sum has finite valuation, hence is nonzero in $k(E)$. So the only way $\alpha + \beta(X_0/X_2) + \gamma(X_1/X_2) = 0$ is if $\alpha = \beta = \gamma = 0$. [/guided] [/step] [step:Reformulate $\operatorname{div}(f) = p + q + r - 3 p_0$ as a Bezout statement on $E$] By Step 1, the existence of $f \in k(E)^\times$ with $\operatorname{div}(f) = p + q + r - 3 p_0$ is equivalent to $p \oplus_E q \oplus_E r = p_0$. By the previous step, any candidate $f \in \mathcal{L}(3 p_0)$ is the restriction to $E$ of $G/X_2$ for some linear form $G \in k[X_0, X_1, X_2]_1$ (working in the normalised coordinates where $p_0 = [0:1:0]$ and the inflection tangent is $\{X_2 = 0\}$). We compute $\operatorname{div}_E(G/X_2)$: \begin{align*} \operatorname{div}_E(G/X_2) = \operatorname{div}_E(G) - \operatorname{div}_E(X_2). \end{align*} By [Bezout's Theorem for Smooth Curves](/theorems/2179) applied to the line $L := \{G = 0\} \subset \mathbb{P}^2_k$ (degree $1$) and the smooth cubic $E$ (degree $3$), the scheme-theoretic intersection $L \cap E$ is an effective divisor of degree $\deg L \cdot \deg E = 1 \cdot 3 = 3$ on $E$. We denote this divisor $\operatorname{div}_E(G) = \mathrm{Cyc}(L \cap E)$. Similarly, applying the same theorem to the line $\{X_2 = 0\}$ and $E$ gives a degree-$3$ effective divisor, and by the flex normalisation chosen in the previous step, \begin{align*} \operatorname{div}_E(X_2) = 3 p_0. \end{align*} Hence \begin{align*} \operatorname{div}_E(G/X_2) = \mathrm{Cyc}(L \cap E) - 3 p_0. \end{align*} The condition $\operatorname{div}(f) = p + q + r - 3 p_0$ becomes \begin{align*} \mathrm{Cyc}(L \cap E) - 3 p_0 = p + q + r - 3 p_0, \end{align*} i.e., \begin{align*} \mathrm{Cyc}(L \cap E) = p + q + r. \end{align*} This says: \emph{the line $L = \{G = 0\}$ meets $E$ in the divisor $p + q + r$}. By definition this is what it means for $p$, $q$, $r$ to be collinear (with appropriate multiplicities, if any of $p, q, r$ coincide). Conversely, if $p, q, r$ are collinear via a line $L = \{G = 0\}$ with $\mathrm{Cyc}(L \cap E) = p + q + r$, then $f := G/X_2 \in \mathcal{L}(3 p_0)$ has $\operatorname{div}(f) = p + q + r - 3 p_0$, so by Step 1, $p \oplus_E q \oplus_E r = p_0$. This establishes both directions of the equivalence. Because the collinearity condition and the group law are preserved under the projective linear change of coordinates applied in Step 3, the conclusion holds in the original coordinates of the statement, completing the proof. [/step]