diff --git a/protocol/protocol.tex b/protocol/protocol.tex
index a756bdb2..200c0776 100644
--- a/protocol/protocol.tex
+++ b/protocol/protocol.tex
@@ -7859,7 +7859,7 @@ This differs from the specification above:
 Define $\SubgroupJ$ as the order-$\ParamJ{r}$ subgroup of $\GroupJ$. Note that this includes $\ZeroJ$.
 For the set of points of order $\ParamJ{r}$ (which excludes $\ZeroJ$), we write $\SubgroupJstar$.
 
-Define $\SubgroupReprJ := \setof{\reprJ(P) \typecolon \ReprJ \suchthat P \in \SubgroupJ}$.
+Define $\SubgroupReprJ := \bigsetof{\reprJ(P) \typecolon \ReprJ \suchthat P \in \SubgroupJ}$.
 
 \begin{nnotes}
   \item The \defining{\ctEdwardsCompressedEncoding} used here is
@@ -7976,8 +7976,6 @@ The hash $\GroupJHash{\URS}(D, M) \typecolon \SubgroupJstar$ is calculated as fo
 
 \vspace{-1ex}
 \begin{pnotes}
-\vspace{-0.5ex}
-  \item The $\BlakeTwos{256}$ chaining variable after processing $\URS$ may be precomputed.
 \vspace{-0.5ex}
   \item The use of $\GroupJHash{\URS}$ for $\DiversifyHash$ and to generate independent bases
         needs a random oracle (for inputs on which $\GroupJHash{\URS}$ does not return $\bot$);
@@ -7996,6 +7994,7 @@ The hash $\GroupJHash{\URS}(D, M) \typecolon \SubgroupJstar$ is calculated as fo
           {\BlakeTwosOf{256}{D,\, \URS \bconcat\, M}\! \typecolon \byteseq{32}}$
         is modelled as a random oracle, $\exclusivefun{\big(D \typecolon \byteseq{8}, M \typecolon \byteseqs\big)}
           {\GroupJHash{\URS}\big(D, M\big) \typecolon \SubgroupJstar}{\setof{\bot}}$ also acts as a random oracle.
+  \item The $\BlakeTwos{256}$ chaining variable after processing $\URS$ may be precomputed.
 \end{pnotes}
 
 \vspace{0.5ex}