Proof (Hamkins [Reference Hamkins7])

Suppose that M is a countable model of ${\mathrm {ZF}}$ set theory. Consider first the easier case, where M is $\omega $ -nonstandard. For any standard natural number k, the reflection theorem ensures that there are arbitrarily high $L_\alpha ^M$ satisfying the finite theory fragment ${\mathrm {ZFC}}_k$ , and so every countable transitive set $m\in L^M$ has an end-extension to a model of ${\mathrm {ZFC}}_k+V=L$ . By overspill, there must be some nonstandard k for which $L^M$ thinks that every countable transitive set m has an end-extension to a countable model of ${\mathrm {ZFC}}_k+V=L$ . This is a $\Pi ^1_2$ -statement about k, which will therefore also be true in M, by the Shoenfield absoluteness theorem. By the Keisler–Morley theorem, M has an elementary end-extension $M^+$ . Let $\theta $ be a new ordinal on top of M, and let $M^+[G]$ be a forcing extension in which $m=V_\theta ^{M^+}$ becomes countable. Since the $\Pi ^1_2$ -statement transfers to $M^+$ and then to $M^+[G]$ , there is in $M^+[G]$ an end-extension of $\langle m,\in ^{M^+}\rangle $ to a model $\langle N,\in ^N\rangle $ that $M^+[G]$ thinks satisfies ${\mathrm {ZFC}}_k+V=L$ . Since k is nonstandard, this theory includes all of the actual ${\mathrm {ZFC}}$ axioms, and since m end-extends M, we have found an end-extension of M to a model of ${\mathrm {ZFC}}+V=L$ , as desired.

Consider now the harder case, where M is $\omega $ -standard. Let $M^+$ be an elementary end-extension of M, and consider $m=V_\theta ^{M^+}$ , where $\theta $ is a new ordinal above M. If $\langle m,\in ^{M^+}\rangle $ has an end-extension to a model of ${\mathrm {ZFC}}+V=L$ , then we’re done, since such a model would also end-extend M. So assume toward contradiction that there is no such end-extension of m. Let $M^+[G]$ be a forcing extension in which m has become countable. The assertion that m has no end-extension to a model of ${\mathrm {ZFC}}+V=L$ is actually true and hence true in $M^+[G]$ . This is a $\Pi ^1_1$ -assertion there about the real coding m. Every such assertion has a canonically associated tree, which is well-founded exactly when the statement is true. Since the statement is true in $M^+[G]$ , this tree has some countable rank $\lambda $ there. Since these models have the standard $\omega $ , the tree associated with the statement is the same for us as inside the model, and since the statement is actually true, the tree is actually well-founded. So the rank $\lambda $ comes from the well-founded part of the model.

If $\lambda $ happens to be countable in $L^{M^+}$ , then consider the assertion, “there is a countable transitive set, such that the assertion that it has no end-extension to a model of ${\mathrm {ZFC}}+V=L$ has rank $\lambda $ .” This is a $\Sigma _1$ -assertion, since it is witnessed by the countable transitive set and the ranking function of the tree associated with the non-extension assertion. Since the parameters are countable in $L^{M^+}$ , it follows by Lévy reflection that the statement is true in $L^{M^+}$ . So $L^{M^+}$ has a countable transitive set, such that the assertion that it has no end-extension to a model of ${\mathrm {ZFC}}+V=L$ has rank $\lambda $ . But since $\lambda $ is actually well-founded, the statement would have to be actually true; but it isn’t, since $L^{M^+}$ itself is such an extension, a contradiction.

So we may assume $\lambda $ is uncountable in $L^{M^+}$ . In this case, since $\lambda $ was actually well-ordered, it follows from the fact that $M \prec M^+$ that $L^M$ is well-founded beyond its $\omega _1$ . Consider the statement “there is a countable transitive set having no end-extension to a model of ${\mathrm {ZFC}}+V=L$ .” This is a $\Sigma ^1_2$ -sentence, which is true in $M^+[G]$ by our assumption about m, and so by Shoenfield absoluteness, it is true in $L^{M^+}$ and, because $M \prec M^+$ , hence also true in $L^M$ . So $L^M$ thinks there is a countable transitive set b having no end-extension to a model of ${\mathrm {ZFC}}+V=L$ . This is a $\Pi ^1_1$ -assertion about b, whose truth is witnessed in $L^M$ by a ranking of the associated tree. Since this rank would be countable in $L^M$ and this model is well-founded up to its $\omega _1$ , the tree must be actually well-founded. But this is impossible, since it is not actually true that b has no such end-extension, since $L^M$ itself is such an end-extension of b. Contradiction.

Main Theorem. For any computably axiomatizable theory $\overline {\mathrm {ZF}}$ extending ZF, there is a $\Sigma _1$ -definable finite sequence

$$ \begin{align*}a_0,\ a_1,\ \ldots,\ a_n\end{align*} $$

with the following properties:

1. (1) ${\mathrm {ZF}}$ proves that the sequence is finite.

2. (2) In any transitive model M of $\overline {\mathrm {ZF}}$ , the sequence is empty.

3. (3) If M is a countable model of $\overline {\mathrm {ZF}}$ in which the sequence is s and $t \in M$ is any finite sequence (in the sense of M) extending s, then there is a covering end-extension of M to a model $N \models \overline {\mathrm {ZF}}$ in which the sequence is exactly t, and in which every set of M is countable.

4. (4) Indeed, for statements (2) and (3), it suffices merely that $M\models {\mathrm {ZF}}$ and end-extends a submodel $W\models \overline {\mathrm {ZF}}$ of height at least $(\omega _1^L)^M$ .

Proof We undertake an analogue of the universal finite set construction of [Reference Hamkins and Woodin10], a construction which is itself a set-theoretic generalization of the universal algorithm [Reference Blanck2, Reference Blanck and Enayat3, Reference Hamkins8, Reference Woodin16], but combining it with the ideas of Hamkins’s proof of the Barwise extension theorem in section 2.

Fix a computable enumeration of the theory $\overline {\mathrm {ZF}}$ , to be used in all the models of set theory in which we refer to this theory, and let $\overline {\mathrm {ZF}}_k$ be the finite theory consisting of the first k-many axioms appearing in this enumeration.

As explained in [Reference Hamkins8], it will suffice for us to establish a weaker extension property, the adding-one extension property, which asserts that if s is the sequence defined in M then for any object a in M there is a covering end-extension N in which the defined sequence is $s^\smallfrown a$ . That is, the adding-one extension property allows one to extend the sequence by appending exactly one new object on the end, rather than a finite sequence. By iterating this property, of course, one can eventually append any standard-finite sequence, but such an inductive argument, it turns out, cannot establish the full extension property for nonstandard-finite extensions, for there are sequences with the adding-one extension property that do not have the full extension property.Footnote ¹ Nevertheless, from any sequence with the adding-one extension property, one can define a new sequence with the arbitrary extension property. For example, one could simply concatenate all the finite sequences that appear on the given adding-one sequence. In this way, by adding one object to the original sequence, we can add an arbitrary (possibly nonstandard) finite sequence to the derived concatenated sequence. Therefore, for the rest of this proof, we shall aim only for the adding-one extension property.

As in [Reference Hamkins and Woodin10], we shall describe two set-theoretic processes, A and B. These processes are intended to be run inside, respectively, $\omega $ -nonstandard models and $\omega $ -standard models and will then be merged in a way that provides a single definition fulfilling the desired properties.

Process ${\boldsymbol {A}}$ . We start by describing process A, intended to be run inside $\omega $ -nonstandard models as an internal process, using whatever nonstandard natural numbers are to be found there. The process proceeds in a sequence of stages, placing one object onto the sequence at each successful stage. Stage n succeeds and $a_n$ is defined, if there is a transitive set $m_n$ , countable in L and containing as elements all earlier $m_i$ for stages $i<n$ , and a natural number $k_n$ , smaller than all earlier $k_i$ , such that $a_n \in m_n$ and the structure ${\left \langle m_n,\in \right \rangle }$ has no covering end-extension to a model ${\left \langle N,\in ^N \right \rangle }$ satisfying $\overline {\mathrm {ZF}}_{k_n}$ , making every set in $m_n$ countable, and placing this very object $a_n$ onto its own A sequence at stage n as the last element. In slogan form: we place an object onto the sequence, if we find a countable transitive set having no covering end-extension in which we would have done so as the next and last element. This is altogether a $\Delta _1$ -property of the data $(m_n,a_n,k_n)$ , since the non-existence of such a model N is a $\Pi ^1_1$ -assertion, whose truth can be verified by the ordinal ranking of the canonically associated well-founded tree. In particular, if there is such an end-extension, then there is one in L and countable in L. The process officially accepts and uses the triple $(m_n,a_n,k_n)$ , whose witnesses for this property are L-least. In other words, we accept the first triple to be verified in the L hierarchy, and use this triple to define $a_n$ . The map $n\mapsto (m_n,k_n,a_n)$ is accordingly $\Sigma _1$ -definable.

Although the definition may at first appear circular—we define $a_n$ , after all, by reference to the definition of the process A sequence inside N—one may use the Gödel–Carnap fixed point lemma to find a definition $\psi (n,a)$ for the map $n\mapsto a_n$ that solves this recursion, allowing $\psi $ as described to refer to its own Gödel code . The same method is used in [Reference Hamkins and Woodin10], and one should view this as analogous to the common use of the Kleene recursion theorem in computability-theoretic arguments, including its use in the universal algorithm [Reference Hamkins8, Reference Woodin16].

Since the natural numbers $k_n$ are descending, there will be only finitely many successful stages, and so the sequence will be finite.

We claim that in the relevant models, every $k_n$ arising from a successful stage is nonstandard; in particular, $\omega $ -standard models will have no successful process A stages. To see this, consider any countable model of set theory $M\models {\mathrm {ZF}}$ , which end-extends a submodel $W\models \overline {\mathrm {ZF}}$ of height at least $(\omega _1^L)^M$ , and let n be the last successful stage in M. Since the definition is $\Sigma _1$ , by Lévy reflection it is absolute between M and W. For any standard k, by reflection the theory $\overline {\mathrm {ZF}}_k$ is true in a transitive set $N\in W$ , large enough to include $m_n$ as a countable set and the witnesses for the successful stages. Consequently, ${\left \langle N,\in ^W \right \rangle }\models \overline {\mathrm {ZF}}_k$ and thinks object $a_n$ was added at stage n as the last object on the sequence. If $k_n \leq k$ , this would violate the success of stage n in M, since $m_n$ would have had such a covering end-extension after all. Therefore $k<k_n$ for every standard k, and so $k_n$ is nonstandard.

It remains to verify the extension property. Let M be a countable model of ZF set theory in which the sequence is s. (We don’t actually need the submodel W of $\overline {\mathrm {ZF}}$ for this part of the argument, provided that the earlier $k_i$ , if any, are nonstandard.) Let n be the first unsuccessful stage. Let k be nonstandard, but smaller than all previous $k_i$ . Since stage n did not succeed, it follows that for any transitive set m countable in $L^M$ and containing the earlier $m_i$ , and for any set $a\in m$ , the structure ${\left \langle m,\in \right \rangle }^M$ does have a covering end-extension in M to a model making every set in m countable and satisfying $\overline {\mathrm {ZF}}_k +$ “object a was placed onto the sequence at stage n, the last successful stage,” since otherwise stage n would have succeeded. Further, for a given m, the existence of such an end-extension is a $\Sigma _1$ -property of the data $(m,a,k)$ , and so we may find the extensions in $L^M$ . Therefore, $L^M$ thinks that for every countable set a and every countable transitive set m, there is a covering end-extension of ${\left \langle m,\in \right \rangle }$ to a model ${\left \langle N,\in ^N\right \rangle }$ making every set in m countable and satisfying $\overline {\mathrm {ZF}}_k+$ “object a is placed onto the sequence at stage n, the last successful stage.” This is a $\Pi ^1_2$ -assertion ( $\forall a,m\,\exists N\ldots $ ), which by Shoenfield is therefore also true in M itself. By the Keisler–Morley theorem, M has an elementary end-extension $M^+$ , and so the statement will also be true in $M^+$ , as well as in all its forcing extensions, by Shoenfield absoluteness. Let $\theta $ be an ordinal of $M^+$ above M, and let $M^+[G]$ be a forcing extension making $V_\theta ^{M^+}$ countable. Thus, for any object a in M, we have a countable transitive set $m=V_\theta ^{M^+}$ in $M^+[G]$ , which by our observations must therefore have a covering end-extension N in $M^+[G]$ making every set in m countable and in which $\overline {\mathrm {ZF}}_k$ holds, plus the assertion that process A places object a onto the sequence at stage n, the last successful stage. Since N end-extends $V_\theta ^{M^+}$ , which end-extends M, and since k is nonstandard, we have therefore found the desired covering end-extension of M to a model of $\overline {\mathrm {ZF}}$ making every set in M countable and placing a as the next and last element on the sequence.

Process ${\boldsymbol {B}}$ . We turn now to process B, intended to be run as an internal process inside $\omega $ -standard models, using whatever (possibly nonstandard) ordinals are to be found there. The process will proceed in a sequence of stages, just as before, with each successful stage adding one object $a_n$ to the sequence. Stage n is successful and $a_n$ is defined, if there is a transitive set $m_n$ countable in L and a countable ordinal $\lambda _n$ , with $m_i \in m_n$ and $\lambda _n < \lambda _i$ for all earlier stages $i<n$ , and with $\lambda _n \in m_n$ and a set $a_n\in m_n$ , such that the structure ${\left \langle m_n,\in \right \rangle }$ has no covering end-extension to a model ${\left \langle N,\in ^N\right \rangle }$ making every set in $m_n$ countable and satisfying $\overline {\mathrm {ZF}}+$ “process B places object $a_n$ on the sequence at stage n, the last successful stage,” and furthermore, this property about $(m_n,a_n,\lambda _n)$ , which has complexity $\Pi ^1_1$ , has rank $\lambda _n$ in the canonical representation of $\Pi ^1_1$ -assertions by well-founded trees. The acceptability of the data triple is a $\Sigma _1$ -property, witnessed by the ranking function, and we officially accept the triple whose witness appears least in the L order. So the map $n\mapsto a_n$ is $\Sigma _1$ -definable.

Once again, the circularity in the definition can be removed by the Gödel–Carnap fixed-point lemma. Since the ordinals $\lambda _n$ are descending, there will be only finitely many successful stages, and so the sequence is finite.

We claim that the ordinals $\lambda _n$ in the relevant models are nonstandard. Suppose that M is a countable model of ${\mathrm {ZF}}$ that end-extends a submodel W of $\overline {\mathrm {ZF}}$ of height at least $(\omega _1^L)^M$ , and let n be the last successful stage in M. Since the definition is $\Sigma _1$ , it is absolute between M and W, and so W satisfies $\overline {\mathrm {ZF}}$ plus the assertion that the object $a_n$ is placed onto the sequence at stage n, the last successful stage. So the statement asserting at stage n that $m_n$ has no covering end-extension and so on is actually false, since W itself is such an extension. So the tree representing the statement, which is determined the same in M as for us in the set-theoretic background because M is an $\omega $ -model, is not actually well-founded. But M thought it was well-founded with rank $\lambda _n$ , and so $\lambda _n$ must be nonstandard.

Let us now prove the extension property for process B in countable $\omega $ -standard models $M\models {\mathrm {ZF}}$ end-extending a submodel $W\models \overline {\mathrm {ZF}}$ of height at least $(\omega _1^L)^M$ . Suppose the sequence is s in M. Let n be the first unsuccessful stage, and consider any set a in M. By the Keisler–Morley theorem, we may find a countable elementary end-extension of M to a model $M^+$ . Let $\theta $ be an ordinal of $M^+$ above M, and let $M^+[G]$ be a forcing extension in which $m=V_\theta ^{M^+}$ is made countable. If $\langle m,\in ^{M^+}\rangle $ has a covering end-extension to a model of $\overline {\mathrm {ZF}}$ in which every set of m is made countable and object a is placed onto the sequence at stage n as the last successful stage, then we’d be done, since this would also serve as the desired end-extension of the original model M. So let us assume toward contradiction that there is no such end-extension of $\langle m,\in ^{M^+}\rangle $ . This is a $\Pi ^1_1$ -assertion about m in $M^+[G]$ , which therefore has some ordinal rank $\lambda $ there in the representation of $\Pi ^1_1$ -assertions by well-founded trees. Since the statement is really true (in the set-theoretic background of our universe), it follows that $\lambda $ must be in the well-founded part of $M^+[G]$ . In particular, $\lambda <\lambda _i$ for all $i<n$ , since those ordinals are nonstandard. So $M^+[G]$ thinks that “there is a countable transitive set m containing all the earlier $m_i$ and the witnesses for the success of the $\Sigma _1$ definition at those earlier stages and an element $a\in m$ , such that the assertion that ${\left \langle m,\in \right \rangle }$ has no covering end-extension to a model making every set in m countable and satisfying $\overline {\mathrm {ZF}} +$ ‘object a is placed onto the sequence at stage n, the last successful stage’ has ordinal rank $\lambda $ .” This is a $\Sigma _1$ -assertion about $\lambda $ and the countable set containing the data and witnesses for the earlier successful stages of the process, since it is witnessed by the countable transitive set m and $a\in m$ and the ranking function of the tree that is canonically associated with the non-extension assertion about m.

If $\lambda $ happens to be countable in $L^{M^+}$ , then all the parameters of the assertion are countable in $L^M$ , and so it follows by Lévy reflection that the statement is true in $L^{M^+}$ and hence in $L^M$ . So $L^M$ has a countable transitive set m, containing the witnesses for the earlier successful stages and an object $a\in m$ , such that the assertion that m has no covering end-extension to a model of $\overline {\mathrm {ZF}}$ making every set in m countable and in which a is placed at stage n, the last stage, has rank $\lambda $ . But in this case, stage n would have succeeded, contradicting our assumption that it was the first unsuccessful stage.

So we may assume $\lambda $ is uncountable in $L^{M^+}$ . In this case, since $\lambda $ was actually well-ordered, it follows that $L^M$ is well-founded beyond its $\omega _1$ . This implies that there could have been no earlier successful stages in M, since the $\lambda _i$ must be nonstandard countable ordinals in $L^M$ . Thus, $n=0$ , or in other words, there is nothing yet on the sequence. Consider the statement “there is a countable transitive set m with an element $a\in m$ , such that m has no covering end-extension to a model of $\overline {\mathrm {ZF}}$ making every set in m countable, in which the sequence is ${\left \langle a\right \rangle }$ , having exactly one successful stage.” This is a $\Sigma ^1_2$ sentence, which is true in $M^+[G]$ by our assumption about m, and so by Shoenfield absoluteness, it is true in $L^{M^+}$ and hence also in $L^M$ . So $L^M$ thinks there is a countable transitive set m with an element $a\in m$ , such that m has no covering end-extension to a model of $\overline {\mathrm {ZF}}$ in which every set in m is countable and the sequence is exactly ${\left \langle a \right \rangle }$ . But in this case, there would have been a successful stage after all, contrary to what we proved earlier.

Altogether, therefore, we conclude that $V_\theta ^{M^+}$ must have had the desired end-extension after all, and so we’ve verified the extension property of process B for the relevant countable $\omega $ -standard models of set theory.

Process ${\boldsymbol {C}}$ . We shall now merge processes A and B into a single process C, providing a single uniform $\Sigma _1$ -definition that will work in all the relevant countable models of set theory. Process C proceeds in stages. At each successful stage, it will place one new object onto the sequence, either for an A-reason or for a B-reason. The A-reasons will involve data $(m_n,a_n,k_n)$ , and the B-reasons will involve data $(m_n,a_n,\lambda _n)$ , where we insist that $m_n$ is a transitive set countable in L and $m_i \in m_n$ for the $m_i$ used for either reason at earlier stages $i<n$ , that $a_n\in m_n$ , and that $k_n<k_i$ for the earlier A-reason stages $i<n$ , if this is an A-reason stage, and $\lambda _n<\lambda _i$ for the earlier B-reason stages, if this is a B-reason stage; once there has been a successful A-reason stage, then we proceed only with the A-reason stages, but the $m_i$ for the A-reasons must see all the data for the previously successful B-reason stages. In particular, each B-reason $\lambda _j$ should be an element of any later A-reason $m_i$ . As before, the data is acceptable if $m_n$ has no covering end-extension to a model ${\left \langle N,\in ^N\right \rangle }$ making every set in $m_n$ countable and satisfying the relevant theory (using $\overline {\mathrm {ZF}}_{k_n}$ at A-reason stages and full $\overline {\mathrm {ZF}}$ at B-reason stages) plus the assertion that this new process C has exactly one new successful stage, placing object $a_n$ onto the process C sequence, and furthermore, in the B-reason case, the assertion that there is no such N has rank $\lambda _n$ . The acceptability of such a data triple is a $\Sigma _1$ -property, since it is verified for each reason type by the rankings of certain trees, as with processes A and B above. A stage is successful if any data is verified as acceptable for it, and we use the data and the reason type whose witness appears first in the L-order. This defines the process C sequence $n\mapsto a_n$ , which has complexity $\Sigma _1$ .

We complete the argument by observing that our process A and B analysis goes through for process C. The sequence is finite since the $k_n$ and $\lambda _n$ can go down only finitely many times. At any A-reason stage, the number $k_n$ must be nonstandard, and at any B-reason stage, the ordinal $\lambda _n$ must be nonstandard. In any $\omega $ -nonstandard model, we achieve the extension property for process C for the same reasons as process A; and in any $\omega $ -standard model, we achieve the extension property for process C just as with process B.

Proof This follows from the main theorem using $\overline {\mathrm {ZF}} = {\mathrm {ZFC}}+V=L$ and the observation that, by the absoluteness of the $L_\alpha $ -hierarchy, among models of $V=L$ being an end-extension is equivalent to being an L-extension.

Question 5. Does the main theorem generalize to the case of uncountable models of set theory, whose well-founded part does not include the true $\omega _1$ ?

Question 8. Are there more generous notions of suitability, for which the conclusions of the main theorem can still be established?

Proof The point is, the universal finite sequence for end-extensions is also a universal finite sequence for this potentialist system. The universal finite sequence for end-extensions gives us the needed $\Delta _0$ -elementary extensions satisfying the new facts. And if M is a $\Delta _0$ -elementary submodel of N then N agrees with the $\Sigma _1$ -theory of M, so the universal finite sequence as defined in N must end-extend the sequence as defined in M.

Proof $(1 \Rightarrow 2)$ This is immediate, since every end-extension is $\Delta _0$ -elementary.

$(2 \Rightarrow 3)$ Suppose toward a contradiction that $(2)$ holds and $(3)$ fails. Fix k witnessing the failure and fix countable transitive $m \in M$ so that M thinks m has no end-extension to a model of $T_k + \varphi (a)$ . This is a $\Pi ^1_1$ -fact about m and a, so M has a ranking function witnessing that the tree corresponding to the $\Pi ^1_1$ -fact is well-founded. This ranking function will remain a ranking function in any $\Delta _0$ -elementary extension, so any such extension must agree that m has no such end-extension. By $(2)$ , let N be a $\Delta _0$ -elementary extension of M in which $T+\varphi (a)$ holds. Since the Keisler–Morley theorem holds for T, we may assume without loss that N is a covering extension, with $c \in N$ so that $N \models x \in c$ for each $x \in M$ . By the very suitable reflection schema, c has an end-extension in N to a model of $T_k + \varphi (a)$ . This end-extension of c is also an end-extension of m, and so N thinks that m has an end-extension to a model of $T_k + \varphi (a)$ , a contradiction.

$(3 \Rightarrow 1)$ By overspill there is a nonstandard k so that M thinks every countable transitive set end-extends to a model of $T_k + \varphi (a)$ . By the Keisler–Morley theorem for T, let $M^+$ be a countable elementary end-extension of M with a covering set m, and let $M^+[G]$ be a forcing extension which collapses m to be countable. The assertion that every countable transitive set end-extends to a model of $T_k + \varphi (a)$ is $\Pi ^1_2$ , and thus by Shoenfield absoluteness we can transfer its truth in $M^+$ to $M^+[G]$ . So $M^+[G]$ sees an end-extension of m satisfying $T_k + \varphi (a)$ . This end-extension witnesses that M satisfies .

$(3 \Leftrightarrow 4)$ This is a standard fact, using the Mostowski collapse lemma to know that an arbitrary countable transitive set can be coded by a real. Note that this equivalence does not need M to be $\omega $ -nonstandard nor most of the assumptions on T.

$(1 \Rightarrow 5)$ The $\Sigma _1$ -theory of a model is preserved by going to end-extensions, so if $\varphi $ holds in some end-extension of M then it must be consistent with the $\Sigma _1$ -theory of M.

$(5 \Rightarrow 3)$ Let N be a model of $T + \varphi $ plus the $\Sigma _1$ -theory of M. By the reflection principle satisfied by T we get that N thinks that every countable transitive set is contained in a model of $T_k + \varphi $ , for any standard k. Suppose toward a contradiction that $(3)$ fails, so for some standard k, the model M thinks there is a countable transitive set m with no end-extension to a model of $T_k + \varphi $ . As in the argument for $(1 \Rightarrow 2)$ , this is a $\Pi ^1_1$ -fact about m and so its truth in M is witnessed by a certain well-founded tree with a ranking function to the ordinals. The assertion that there is such m thus appears in the $\Sigma _1$ -theory of M. So N must think there is a countable transitive set with no end-extension to a model of $T_k + \varphi $ , a contradiction.

Proof $(1 \Leftrightarrow 2)$ This holds because M satisfies in one potentialist system if and only if it does in the other, by Theorem 14.

$(1 \Rightarrow 3)$ Suppose $\varphi $ is a $\Sigma _1$ -sentence consistent with the $\Sigma _1$ -theory of M. By Theorem 14 we get that holds at M. Because $\Sigma _1$ -assertions must be necessary, holds at M, and so by the end-extensional maximality principle we get that $\varphi $ holds at M.

$(3 \Rightarrow 1)$ Suppose that holds at M, so there is an end-extension . By Theorem 14, there is a standard natural number k so that N thinks there is a real x which is not contained in any $\omega $ -model of $T_k + \neg \varphi $ . The assertion that there is no model of $T_k + \neg \varphi $ containing x is $\Pi ^1_1$ in the parameter x, and so its truth in N is witnessed by the existence of a certain canonically-associated well-founded tree. This is equivalent to a $\Sigma _1$ -assertion. Because the $\Sigma _1$ -theory of M is maximal we therefore get that this is already true in M. So holds at M, and in particular $\varphi $ holds at M.

Proof Let M be a countable model of T and let $S_0$ be T plus the $\Delta _0$ -elementary diagram of M. Extend $S_0$ to a maximal $\Sigma _1$ -theory S. Then S has a countable model, which must be a $\Delta _0$ -elementary extension of M. And by Theorem 15 any countable model of S must satisfy the two maximality principles.

Question 17. Does every countable $\omega $ -nonstandard model of ZF end-extend to a model satisfying the end-extensional maximality principle? By Theorem 15 this is equivalent to asking whether every countable $\omega $ -nonstandard model of ZF end-extends to a model with a maximal $\Sigma _1$ -theory.