MODEL THEORY AND PROOF THEORY OF THE GLOBAL REFLECTION PRINCIPLE

Abstract The current paper studies the formal properties of the Global Reflection Principle, to wit the assertion “All theorems of 
$\mathrm {Th}$
 are true,” where 
$\mathrm {Th}$
 is a theory in the language of arithmetic and the truth predicate satisfies the usual Tarskian inductive conditions for formulae in the language of arithmetic. We fix the gap in Kotlarski’s proof from [15], showing that the Global Reflection Principle for Peano Arithmetic is provable in the theory of compositional truth with bounded induction only ( 
$\mathrm {CT}_0$
 ). Furthermore, we extend the above result showing that 
$\Sigma _1$
 -uniform reflection over a theory of uniform Tarski biconditionals ( 
$\mathrm {UTB}^-$
 ) is provable in 
$\mathrm {CT}_0$
 , thus answering the question of Beklemishev and Pakhomov [2]. Finally, we introduce the notion of a prolongable satisfaction class and use it to study the structure of models of 
$\mathrm {CT}_0$
 . In particular, we provide a new model-theoretical characterization of theories of finite iterations of uniform reflection and present a new proof characterizing the arithmetical consequences of 
$\mathrm {CT}_0$
 .

§1. Introduction. The Global Reflection Principle (GRP) for a theory Th is the assertion that all theorems of Th are true. As the statement involves the notion of truth for the language of Th, to uncover its meaning adequately one shall pass to a proper extension of Th in a richer language. Minimal such extensions are called axiomatic theories of truth for Th. Each such theory arises by enriching the language of Th with a single fresh predicate T (x) and adding a bunch of axioms characterizing T (x) as a truth predicate for the language of Th. In the paper we focus on one of the most natural such extensions, which comprises straightforward formalizations of the usual inductive Tarski's conditions in the language of Th together with the predicate T (x). Let us denote this theory with CT -. 1 The GRP lies at the intersection of at least three, to some extent independent, areas of research. The first, which was the starting point for the current paper, is the Tarski Boundary project, that seeks to characterize the extensions of CT -+ Th which are conservative over Th. This is non-trivial for two reasons: on the one hand, if Th can develop enough coding apparatus, 2 CT -+ Th does not prove any new sentences from the language of Th. On the other hand, it is an immediate consequence of second Gödels Incompleteness theorem, that CT -+ Th+GRP is a nonconservative extension of Th. Moreover, the "natural" extensions of CT -+ Th that are nonconservative over Th all prove GRP for Th. Hence, in a sense, GRP is the source of nonconservativity in the realm of truth theories and it seems highly desirable to know what are the minimal resources needed to prove it.
The second area is proof theory, especially ordinal analysis as initiated in [21] and further developed, e.g., in [2]. In this approach natural truth-free counterparts of GRP, Uniform Reflection Principles (REF), play central roles in determining the quantitative information about the consequences of theories of predicative strength. To get things right, one adds stratified truth predicates to the picture and studies (partial) uniform reflection principles over axiomatic theories of truth (this is the method used in [2]). This is how the GRP enters the scene.
Last but not least, axiomatic theories of truth play an important role in the field of model theory of Peano Arithmetic (cf. [12,14]). Any subset S ⊆ M such that (M, S) |= CTis essentially a full satisfaction class. If (M, S) additionally satisfies GRP, then S contains all the theorems of Th, in the sense of M. Satisfaction classes provide a very powerful tool in constructing interesting models of PA and investigating their structure. 3 The current paper contributes to all the three areas. More specifically: 1. We prove that Δ 0 -induction for the truth predicate is enough to prove GRP for PA. Coupled with the earlier results by Kotlarski [15], this shows that, over CT -+ EA, Δ 0 induction for the truth predicate is equivalent to GRP for PA (we denote this theory with CT 0 ). This improves on earlier results from [25] and provides a direct fix to Kotlarski's argument in [15]. 4 Additionally, coupled with various developments from the literature, our result shows that the Global Reflection Principle for PA is a very robust notion, being equivalent to various others, apparently very different, truth-theoretic principles, as witnessed by the Many Faces Theorem (Corollary 3.18). 2. We extend the above result, answering the open problem posed by Beklemishev and Pakhomov in [2]. We show that not only GRP is provable in CT 0 but also Σ 1 -Uniform Reflection over a weak truth extension of EA, called UTB -+ EA (which adds to the arithmetical part uniquely Uniform Tarski Biconditionals).
The result has some bearings on the analysis performed in [2]. 3. We provide a new conservativity proof for CT 0 . Unlike in the first one from [15] we are able to show directly that CT 0 is arithmetically conservative over -iterations of uniform reflection over PA (denote this theory with REF (PA) 5 ). The proof is based on an essentially model-theoretic idea of prolonging a (partial) satisfaction class in an end-extension. This proves to be sufficiently robust to characterize finite iterations of Uniform Reflection. We show that a model (M, S), where S is a partial inductive satisfaction class, satisfies n iterations of uniform reflection if and only if a nonstandard restriction of S can be prolonged n times.
The paper is organised as follows: in Section 2 we introduce all the relevant preliminaries and context. In particular we develop handy and uniform conventions regarding the definable models and satisfaction classes. Section 3 is devoted to the proof of GRP in CT 0 . In particular we describe the history of the problem and comment on flaws in Kotlarski's aforementioned proof [15]. The proof is a streamlined version of the one presented by the author in [18]. In Section 4 we extend the result from the previous section answering the question of Beklemishev and Pakhomov in [2] in the positive: we give a proof of Σ 1 -uniform reflection over UTB -+ EA in CT 0 . The proof makes crucial use of the Arithmetized Completeness Theorem. Additionally, the section offers some strengthenings of this main result. In Section 5 we give a proof of the conservativity of CT 0 over -iterations of uniform reflection over PA. Extending the work of Kaye and Kotlarski [13] we characterize the theory of n-iterated uniform reflection over PA in terms of models of the form (M, S) where S is a partial inductive satisfaction class. Finally we examine the structure of models of CT 0 and prove a variation of the main result of Section 4.
To enhance the reading, (as usual) denotes the end of a proof, while means that the proof is omitted.
signalizes the end of a definition, remark, convention, etc. §2. Setting the stage. In this section we gather all the technical preliminaries needed to follow our reasoning and at the same time develop a useful framework for proving our main results. In particular most of the results contained herein can be found (sometimes under slightly different wording) in [9,12].
For starters, PA denotes Peano Arithmetic and L denotes its language, which we stipulate to contain +, ×, 0, 1, ≤ as primitive symbols. While studying extensions of PA in a richer language, we use a handy convention known from [14]: PA * denotes any theory in the extended language that admits all instantiations of the induction scheme for the extended language. Similarly, I Σ * n denotes the extension of PA with induction for Σ n formulae of the extended language. If L is any language then, L S and L T denote the result of extending L with a single binary predicate S or a single unary predicate T, respectively. Most of the extensions of PA that we study are formulated either in the language L S or L T . Last but not least, EA denotes elementary arithmetic, i.e., the extension of I Δ 0 with a single Π 2 assertion "exp is total." All the theories we study extend EA, possibly in a richer language. Δ 0 (exp) denote the class of bounded formulae in the language with a symbol for the exponential function exp: it will be used throughout the paper because various syntactical functions needed to state the axioms for the satisfaction predicate are in fact Δ 0 (exp). However, since most of the theories we consider are extensions of PA, the presence of exp as a primitive symbol do not increase their strength. We explain this in more detail in Section 3.
To smoothly deal with class sized-objects (such as definable models of arithmetical theories) various definitions will be stated in the canonical predicative two-sorted extension of PA, i.e., ACA 0 . Uppercase letters X, Y, Z, X 1 , Y 1 , Z 1 , ... denote secondorder variables. In all applications we shall reason about definable classes (perhaps in a richer language) which will be substituted for the free second-order variables. The two sorted language is denoted L 2 .

Coding conventions.
We assume a standard coding of syntax in PA (defined as in [9]): primitive symbols of the language are assigned numbers in a recursive way, and then terms, formulae, sentences, etc. are treated as well-formed sequences of such numbers. The notion of sequence is based on the definable Ackermanian membership predicate ∈. Term(x), ClTerm(x), Var(x), Form(x), and Sent(x) denote the arithmetical formulae expressing that x is an arithmetical term, a closed term, a variable, an arithmetical formula, and an arithmetical sentence, respectively.
x ∈ Subf(y) expresses that x is a subformula of y. We define x ∈ Term(y) and x ∈ ClTerm(y) analogously (y is required to be either a formula or a term).
x ∈ FV(y) expresses that x is a variable which has a free occurrence in (a formula) y.
The choice of coding apparatus is irrelevant as long as the coding is PA provably monotone, i.e., the following is provable in PA: We require a similar condition for (the given formalisation) of x ∈ Term(y). Various codings which violate this condition are studied in [8,11]. Throughout the paper we distinguish between variables of the metalanguage, for which we reserve the symbols x, y, z, x 0 , x 1 , ... , y 0 , y 1 , ... , and variables of the arithmetized language, which are denoted v, v 0 , v 1 , .... We assume a fixed correspondence between the first and the second ones.x,v, ... denote sequences of variables. For a formula φ, φ denotes its Gödel code.
2.2. Some model theory of PA. All the definitions and conventions regarding models of PA are as in [12]. By default M, N , K (possibly with indices) range over nonstandard models of PA and M, N, K denote their respective universes. If M is any model (possibly for L S ) and φ(x) a formula (possibly with parameters from M;x denotes a sequence of variables), then φ M denotes the set definable by φ in M, i.e., {ā ∈ M | M |= φ(ā)}. If M |= PA and X ⊆ M n , then X <b denotes the restriction of X to all elements smaller than b. In the case when N ⊆ M, X N denotes b∈N X <b (the restriction of a relation to the submodel).
Let I ⊆ M . We write d > I if d is greater than all the elements of I. I is called an initial segment of M if I is closed downwards with respect to ≤. We say that I is a cut if I is an initial segment which is closed under successor, i.e., If I is a cut of M, then we call M an end-extension of I and write I ⊆ e M (note that I need not be a submodel of M). Any element c ∈ M such that c > is called nonstandard.
The following is one of the most basic consequences of induction in models of PA * : In particular, if ∅ I e M is a cut and φ(x) is any formula such that then there exists a d > I such that M |= φ(d ).
One last notion which is very tightly linked to the topic of satisfaction classes is recursive saturation: Let p(x) be a set of formulae with at most one variable x and parametersā. We say that p(x) is recursive (or computable) if so is the set We say that M is recursively saturated (or computably saturated) if every recursive type over M is realized in M.

Some model theory in
PA. Models of theories extending Robinson's arithmetic are infinite objects; thus inside arithmetic they become essentially second-order objects. In what follows a set means a second-order object and we distinguish it from a coded set (a first-order object). The notion of a Δ n set is explained below. x ∈ X should be understood as a membership relation between a first-and a second-order object, whereas x ∈ y denotes the Ackermanian membership (mentioned earlier) between first-order objects.
In PA, a Σ n set (Π n set) is any Σ n (Π n ) formula φ(v) with precisely one free variable. We define a Δ n set to be a pair of formulae (φ, ) such that φ is Σ n , is Π n , and The notions of a Σ n (Π n , Δ n ) relation is defined analogously. If X is a Δ k set given by the Σ k formula φ(v) and a Π k formula (v), then x ∈ k X abbreviates Sat Σ k (φ, x).
Observe that a set A ⊆ M is definable from parameters in a model M if and only if, for some k ∈ , there exists a Δ k set X such that In the paper, except for side remarks, in which case the definitions below can clearly be adapted, we will only need to talk about models for very specific signatures consisting of two binary functions +, ×, one binary relational symbol S(x, y), reserved for a satisfaction class and two constants, 0 and 1.
We note that since in PA models for theories extending some basic arithmetic (which we are uniquely interested in) are class-size objects, we do not always have a satisfaction relation for them. Models without the satisfaction relation will called partial to contrast them with the full ones for which the truth of an arbitrary sentence can be decided.
We say that M is a Δ n -model if it is a Δ n set satisfying the above conditions. Definition 2.4. If N is any model of PA then we say that M is a partial N -definable model if for some k ∈ , N |= "M is a partial Δ k model." Note that, according to our convention, "N -definable" means "N -definable with parameters." Note that this is the same as (2 + x 1 = 3) ∧ (∃v 2 v 2 = v 2 ) . We shall use both formats.
4. (ACA 0 ) If α is any X -assignment, then α φ abbreviates α FV(φ) , where f A denotes the restriction of a function f to a set A. If φ is clear from context, we will write α · instead of α φ . 5. (ACA 0 ) If t is a term and α ∈ Asn(t), then t α denotes the value of t under α.
It is the same as the value of t[α] (t[α] is a closed term). 6. (PA) If α and are any two assignments and v is a variable, then α ≤ v expresses that extends α by assigning something to the variable v, i.e., dom( ) = dom(α) ∪ {v} and for all w ∈ dom(α), α(w) = (w). Note that if α ≤ v and v ∈ dom(α), then α = .   1.
Let CS -(X, M, S ) denote the conjunction of the above sentences of L 2 (we treat M, S , X as second-order variables). In the context of S, S(φ, α · ) always mean S(φ, α φ ).
Definition 2.12. (PA; measures of complexity of formulae) 1. The depth of a formula φ is the length of the longest path in the syntactic tree of φ. Equivalently, the depth of φ is defined recursively: the depth of an atomic formula is 0, ∃ and ¬ raise the complexity by one, and the depth of the disjunction is the maximum of the depths of the disjuncts plus one. φ ∈ dp(x) expresses that the depth of φ is at most x. 2. Let us fix a canonical syntactical (elementary) transformation, which for a formula φ(x) returns a formula in the Σ c form, that is logically equivalent to φ(x). Denote with φ(x) Σ the result of applying this transformation. We assume that FV(φ(x)) = FV(φ(x) Σ ). For a number c, let Σ * c denote the class Observe that if for every n ∈ , (M, Sat M ) is an N -definable n-full model, then we have two satisfaction classes for M at our disposal: the metatheoretical one and Sat M . The two relations agree in the following sense: for every φ(x 1 , ... , x n ) ∈ L S and for all a 1 , ... , a n ∈ (U M ) N , M |= φ[a 1 /x 1 , ... , a n /x n ] ⇐⇒ N |= Sat M ( φ(x 0 , ... , x n ) , [a 1 , ... , a n ]), where [a 1 , ... , a n ] denotes the assignment x i → a i , i ≤ n. Convention 2.14. We reserve calligraphic letters M, N , K to talk, both internally and externally, about models with satisfaction relations, while M, N, K will denote arbitrary partial models.
By the Tarski's undefinability of truth theorem one obtains that if M is any model of PA, then there is no formula Sat V with parameters from M such that for every n, (V, Sat V ) is an n-full model. However, relativizing the standard partial truth predicates (see [9]) one obtains the following observation. Proof. We reason in ACA 0 and assume the contrary. Then there is a sequentcalculus proof of the sequent Γ ⇒ 0 = 1 in the pure first-order logic, where Γ ⊆ Y is a finite set. By cut-elimination we may assume that this proof has a subformula property, so every formula occurring in it is a subformula of a formula from Γ ∪ {0 = 1}. By induction on the length of the proof we can show that for every sequent Θ ⇒ Δ it holds that This contradicts that the proof ends with 0 = 1.
The above notions of partial and full model lead to the definition of two interpretability relations between structures: Definition 2.17 (Interpretable models; see [12]). Let M and N be two models of an extension of PA (not necessarily satisfying PA * ). We say that M interprets N if there exists a partial M-definable model N such that We say that M strongly interprets N iff there exists K witnessing that M interprets N and there exists an M-definable satisfaction predicate Sat K making K a full model. Interpretability and strong interpretability will be denoted by ¡ and ¡ S , respectively.
Observe that, as defined neither interpretability nor strong interpretability is preserved under isomorphism, in the sense that from M ¡ N and N K we cannot conclude that M ¡ K. The next two propositions uncover the important properties of ¡. The following routine notion will come in handy: Definition 2.18 (ACA 0 ; relativization). Suppose that M is a partial model. For every formula φ we define its relativization φ M by induction on the complexity of φ: Proof. Suppose that N = (N) M and K = (K) N . Suppose further that N is partial Δ k model in M. Hence using partial satisfaction predicate for Σ k formulae, we can see that the K N (see Definition 2.18) makes sense in M, and, in M, K N is a partial Δ k model. Moreover it is easy to observe that which ends the proof.
The following proposition will play a crucial role in some of our arguments. Its proof consists in internalizing the argument from Remark 2.6 and makes use of the arithmetization of the relativization function introduced above.
Proof. By Proposition 2.19 we have M ¡ K and (K) N is a partial M-definable model witnessing the interpretability. We define the satisfaction relation for (K) N via the formula In PA we can prove that every consistent theory admits a full model. Since in most cases both the theory and the model are infinite objects, this is in fact a parametrized family of theorems: Theorem 2.21 (Arithmetized Completeness Theorem). For every n ∈ , PA * proves the sentence Every Δ n consistent theory has a Δ n+1 full model.
Since the proof of this fact (apart from axioms for arithmetical operations) depends only on the presence of induction, it can be proved also in every extension of PA which includes full induction scheme (for the extended language). This will be crucial in the second part of the paper. Let us complete this introductory part with two classical observations which give us some information about the structure of interpretable models. The first one shows that in fact interpretability can be seen as refined end-extendibility.
where x is a canonical numeral (in the sense of M) naming x. By the earlier remarks there exists a satisfaction predicate Sat N making N a 1-full model. The fact that is an initial embedding follows since for every x we can build a quantifier-free sentence (in the sense of M) and by induction on x show that every such sentence is true in N according Sat N . But this is equivalent to being an initial embedding. Now, if is any other M definable isomorphism between M and an initial segment of N , then it follows that Then, by induction it follows that M |= ∀x (x) = (x) .
If we strengthen the assumption to strong interpretability, then we can conclude that the interpreted model is always "longer." With such a definition for every formula φ(x 1 , ... , x n ) and all a 1 , ... , a n ∈ M we have Then, if were elementary, then the condition on the right-hand side would be equivalent to M |= φ(a 1 , ... , a n ) which contradicts Tarski's theorem. The last part follows easily from the above and Proposition 2.23.
Let us note one immediate corollary. Recall that M is κ-like if |M | = κ but every proper initial segment of M has cardinality strictly smaller than κ. Moreover, models strongly interpretable in a nonstandard model of PA have to be recursively saturated. This is a corollary to the proposition below (see also [14]): and d being as above. Fix an arbitrary recursive type p(x) = {φ i (x, a) | i ∈ } with (without loss of generality) a single parameter a and let (x, y) be the Δ 1 formula representing its recursive enumeration, i.e., for every i ∈ , Now, since the depth of every φ i is less than d and p(x) is a type we have for every n ∈ ([x → z, y → a] denotes the unique assignment sending the variable x to z and the variable y to a). Hence, by overspill for some nonstandard c we have which shows that p(x) is realised in M.

Satisfaction classes.
Satisfaction classes provide truth conditions for V. 6 Usually they are studied in the context of nonstandard models of PA. Let M be such a model. Definition 2.27. We say that S ⊆ M 2 is a partial satisfaction class on M if there is a nonstandard c such that (M, S) |= CS -(dp(c + 1), V, S). Equivalently the following holds in (M, S): Henceforth, the conjunction of 1-5 will be denoted by CS -(c). If additionally (M, S) |= PA * , then S is called a partial inductive satisfaction class. If (M, S) |= ∀x CS -(x), then S is called a full satisfaction class. Further define: If S is a partial satisfaction class on M and b ∈ M , then we put Note that if S is a full satisfaction class, then (M, S) strongly interprets M and V is a Δ 0 partial model witnessing the interpretation. However, (V, S) need not be full, as we need not have any induction for S. In particular, it does not follow that which, arguably, would mean that M knows that V is a model of PA. Let us call such a satisfaction class PA-correct. It can be shown that for a countable M the following conditions are equivalent: 1. There exists a full satisfaction class on M.
2. There exists a PA-correct full satisfaction class on M.
The name UTBstands for Uniform Tarski Biconditionals 7 and is normally used for the theory having as axioms all sentences of the form 8 One can show that, over EA, this set of sentences is equivalent to the one we've officially taken as a definition of UTB -. By Observation 2.15 each finite portion of UTBis definable in PA and consequently we obtain the following proposition (which formalizes in EA).
Proposition 2.28 (EA). If Th is any extension of PA, then UTB + Th is conservative over Th.
Furthermore, observe that (M, S) |= CSiff S is a full satisfaction class on M and (M, S) |= CS iff S is a full inductive satisfaction class in the sense of [14]. For further usage let us observe that the relation of CS to CS n is similar to that between PA and I Σ n . In particular there are definable partial Sat Σn satisfaction predicates for Σ n L S formulae. Each Sat Σn is a Σ n L S formula. As a consequence we obtain: Proposition 2.29. For every n, EA + CS n+1 Con EA+CSn .
We note that if S is a partial satisfaction class on a model M, then for an arbitrary standard formula φ(x 0 , ... , x n ) ∈ L, In particular it follows from Tarski's theorem that S is never definable in M (even if we allow parameters).
Nonstandard satisfaction classes provide a very useful tool for investigating nonstandard models of PA. The first point of interest is that their existence implies recursive saturation. For starters we cite a proposition which directly follows from Proposition 2.26: Proposition 2.30 (Folklore; see [12]). If S is a partial inductive satisfaction class in M, then M is recursively saturated.
Proof. Suppose that (M, S) |= CS(c) for some nonstandard c ∈ M . Then M is isomorphic to a depth-c-full M-definable model. Hence by Proposition 2.26 it is recursively saturated.
Interestingly, with a much more complicated proof one can strengthen the above proposition lifting the assumption that the chosen satisfaction class is inductive.
The converse to Lachlan's theorem fails, as was shown by Smith.
The condition that (M, S ) |= I Δ 0 (S) implies that S is piecewise coded (in the sense of [9]) or, using set-theoretical notions, a class on M. Since (M, S ) |= CS -(c) it follows that S is not definable (even allowing parameters) in M (or, is a proper class). Since there are recursively saturated models of PA in which every class is definable (with parameters; see [14]), Smith's result shows that there are recursively saturated models which do not carry a full satisfaction class.
A common strengthening of theorems of Smith's and Lachlan's was obtained by Wcisło in [25]: An interesting open problem in the model theory of PA is whether the converse to the above theorem is true, i.e., whether every M |= PA which admits a partial inductive satisfaction class admits a full satisfaction class. If one allows to prolong the given model, then there is a positive answer to this question. Remark 2.35. The theory CSis a cousin of a compositional truth theory CTwhich admits a unary predicate T. All compositional axioms of CScan be easily adapted to this new setting; however in the case of the universal quantifier we have two natural ways to go. The first candidate is the "numeral" version, i.e., We stress that φ[x/v] denotes the result of substituting the numeral naming x for every free occurrence of the variable v. If such an axiom is adopted, then the resulting theory, denote it nCT -, can define the satisfaction predicate satisfying CSvia the formula Let us stress that the above formula is Δ 0 (exp). The second option is the "term" version of CT -, denote it tCT -, where the axiom for ∀ is the following: Using Enayat-Visser methods from [7] it can be shown that nCTand tCTare independent of each other, i.e., neither of them implies the other one (over the remaining axioms of CS -). Moreover, it is an open problem whether tCTcan define the predicate of CS -. In this paper CTwill be introduced in Section 3 and will denote the numeral version, i.e., nCT -.

Reflection principles.
Reflection principles are various (families of) statements expressing the soundness of a given theory Th in a way which is transparent for Th. In other words, their aim is to capture the meaning of the metatheoretical assertion: Every theorem of Th is true. In order to avoid the problem of choosing the presentation for (an abstractly given theory Th), we will assume that Th is an elementary formula, which, provably in EA, defines a set of sentences. Such a formula will be called a Gödelized theory. We use PA to abbreviate the canonical elementary formula saying "x is an axiom of PAor an axiom of induction." Having a satisfaction predicate S(x, y) at our disposal we can express the above in the form of the Global Reflection Principle If S satisfies UTB -, then from this one can derive instantiation of the uniform reflection Hence In the successor step we tacitly fix the canonical representation of Γ-REF n (Th).
The last definition which is relevant to formalizing soundness claims introduces the oracle provability predicates.
Definition 2.36. Let Th be any elementary theory. Proof X Th (x, y) denotes a Δ 0 0 (exp) formula with a second-order variable X which canonically formalizes the relation: "y is a proof of sentence x from axioms of Th and sentences belonging to X." Pr X Th is the Σ 0 1 provability predicate based on it. The oracle provability predicate defined above enables us to (uniformly) define a closure conditions on various satisfaction classes. For example we shall often encounter the assertion S(φ, ε) , which should be read as "Every first-order consequence of true sentences is true," where "true" abbreviates that S(φ, ε) holds. In the above assertion we simply substitute the definable class {x | S(x, ε)} for the free second-order variable X. Let us also observe that formally Pr X Th is the same as Pr Th∪X ; however, for heuristic reasons we prefer to keep the lower index for absolute definitions and the upper one for arbitrary sets of formulae.  The main difference will be that we shall work with models with satisfaction classes.

Reflection and satisfaction classes.
Full satisfaction classes in nonstandard models embody the conception of a satisfaction relation for V. However, as we have already remarked, not every satisfaction class provides us with a reasonable truth predicate for V. One property that one would require from such a truth predicate is the closure under the internal provability relation. In particular the satisfaction relation for V should make true all the (internal) theorems of first-order logic. This corresponds to the sentence being true in a model (M, S). However, as shown for the first time in [4], over CSthe above sentence implies GR(PA). In particular, in a countable recursively saturated model M in which there is a proof of inconsistency of PA there is no such a reasonable class for V (although there are many unreasonable ones). A characterization of models admitting a well-behaved satisfaction class was essentially first given by Kotlarski (in [15]): 9 A different natural question is how much induction is required to prove the global reflection for PA. Here a partial answer was given by Wcisło in [25], who showed that the satisfaction predicate satisfying CS -+ GR(PA) is definable in CS 0 : In the next section we improve this result and show that GR(PA) is provable in EA + CS 0 . §3. Provability of the global reflection principle. In this section we confirm Kotlarski's claim [15] that, over EA, the Δ 0 induction for a satisfaction predicate is enough to prove the Global Reflection Principle for PA. We start by explaining the original strategy and our fix. Unless said otherwise, all theories by default extend EA. However, it is very easy to see that CS 0 + EA PA, since for every arithmetical formula φ(x), (x) := T (φ[x]) is a Δ 0 (L T + exp) and consequently, we have an induction axiom for it. Kotlarski

Kotlarski's proof.
Here Kotlarski's proof of PA-correctness ends. However, it is not obvious whether the above is equivalent to S (Ind(φ(v)), ε), where Ind( ) denotes the axiom of induction for a formula . Repeated applications of the compositional clauses yield the equivalence of S (Ind(φ(v)), ε) with The second problem lies in showing that a Δ 0 -inductive satisfaction class is closed under provability, i.e., proving the sentence In the above Pr S ∅ derives from the oracle provability predicate defined in Definition 2.36. Kotlarski's idea was to work (internally in PA) with a Hilbertstyle proof calculus with Modus Ponens as the only rule of reasoning and then using Δ 0 (exp) induction for an L S formula (x, p) := "If φ is the x-th sentence in p, then S(φ, ε)." In (x, p) all quantifiers can be bounded by p, 10 that can be taken as a parameter. So it is indeed a Δ 0 (exp)-formula. In the base step φ is either a logical axiom or a true sentence, so it's truth is either trivial (the latter case) or seems to follow from the compositional axioms. In the inductive step, we have to check that if φ and φ → are true, then so is . This is indeed guaranteed by the compositional axioms.
However, problems arise while verifying the base step. For example (working in a nonstandard model) we might encounter the following logical axiom: for some nonstandard formula φ and a term t. Then S( , ε) is equivalent to so we encounter problems similar to the ones discussed while dealing with the truth of induction axioms. Moreover, there are more generic problems: if one does not want to incorporate the rule of universal generalisation, then one has to accept universal generalisations of all instances of propositional tautologies as axioms. In particular (working in a nonstandard model (M, S)) in the base step one might encounter an axiom of the form If it is true that that for any full satisfaction class S on M, (M, S) |= ∀α ∈ Asn(φ)S(φ ∨ ¬φ, α), inferring that (M, S) |= S( , ε) requires some argument which cannot be carried out in CSalone.

The idea.
To fill in the gaps in Kotlarski's reasoning it is sufficient to establish within CS 0 a kind of induction on the buildup of formulae. Indeed, what we missed were (inter alia) the following properties: . The above hold (provably in CS -) if φ is an atomic formula and clearly are preserved by taking disjunctions, negations, and applying existential quantification. However, in order to secure the step for ∃ we need a Π 1 assumption, saying that the equivalence

S( , α) ≡ S( [α], ε)
holds under an arbitrary assignment α. It turns out, however, that such assumptions can be expressed with a Δ 0 formula. Firstly, the above is clearly equivalent to ∀α ∈ Asn( )S ( ≡ [α], α). (1) Secondly, if S commuted with the blocks of universal quantifiers, the above could have been further reduced to where ucl(·) is a (definable) function which given a formula returns its universal closure. Our problem thus reduces to showing the equivalence between conditions of types (1) and (2). The standard strategy is to use induction on the length of the quantifier prefix. However, the proof of this once again uses Π 1 induction. To bypass this problem, we shall first establish commutation with blocks of uniformly bounded universal quantifiers, i.e., the principle where bucl(φ, x) denotes the universal closure of φ, in which every quantifier in the prefix is bounded by (the term) x and α ≺ [x] φ says that dom(α) = FV(φ) and each value of α is less than x. Having this, we will express ∀αS(φ, α) in a Δ 0 way via where v is a variable which do not occur in φ. We now proceed to the details.

The proof.
One more preparation step will be helpful. We shall expand the language L S with symbols for all primitive recursive functions and extend CS 0 with the defining equations of them. Let L + S denote the expanded language and CS + 0 the extended theory. Since, trivially, CS + 0 is L S -conservative over CS 0 , it is sufficient to prove (GR(Th)) in CS + 0 . Let us observe that the latter theory proves Δ 0 induction for the language with new function symbols. Proof. Fix a model M |= CS + 0 and a Δ 0 (L + S ) formula with parameters φ(x). Without loss of generality all the terms occurring in φ(x) are of the form f(n, y) where f(x, y) is a two place p.r. function. Let f (x, y, z) be the Δ 0 formula of L defining the graph of f. Fix an arbitrary a ∈ M , assume that φ(a) holds, and let b be greater than a and all parameters from φ(x). Without loss of generality assume that b is nonstandard. Let c be such that where z, w are fresh variables. φ (x) is a Δ 0 (L S ) formula and clearly we have Hence, since a < b and φ(a) holds, φ (a) holds as well. Since for φ (x) we have an induction axiom there is the least d < a such that φ (d ) holds. Hence d is the least element satisfying φ(x).
In the proof below we shall use the following primitive recursive functions (we identify p.r. relations with their characteristic functions): • ≺ is a primitive recursive product ordering on functions. That is, if α and are two functions, then α ≺ holds if α is smaller than in the product ordering, i.e., is the partial ordering based on ≺. • bucl(φ, x) denotes the universal closure of φ, in which every quantifier in the prefix is bounded by (the term) x. • bucl(φ, x, c) returns the formula where x i 1 , ... , x iy are all the elements of the set c listed in the order of decreasing indices (i.e., i y < i y-1 < ··· < i 1 ). In particular x has to be a term and c a set of variables. Officially ∀x < t abbreviates ∀x x < t → ); hence the above formula is slightly more complicated than it seems to be. Moreover c need not contain uniquely variables which are free in φ; hence some of the quantifiers in the prefix of bucl(φ, x, c) might be dummy.
Assume that the inductive hypothesis holds for d and let i d be the index of the (d + 1)-st variable in c. Observe that bucl(φ, a, c↑ d +1 ) = ∀v i d < a bucl(φ, a, c↑ d ).

Hence by compositional axioms
Observe that the above is equivalent to which, by induction hypothesis, is equivalent to ∀ ≺ [a] c S(φ, α ∪ · ).
In the above v is a variable with the least index among those which do not occur in φ. In particular cl(x, y) is a (partial) primitive recursive function, so we have a symbol for it in CS + 0 . cl(φ) abbreviates cl(φ, FV(φ)). Now, the following corollary clearly follows from Lemma 3.2. Proof. Fix φ and c. By the compositional axioms and Lemma 3.2 S(∀vbucl(φ, v, c), α) is equivalent to ∀x∀ ≺ [x] c S(φ, α ∪ · ), which is clearly equivalent to ∀ dom( ) = c → S(φ, α ∪ · )), since each assignment for φ is dominated by an assignment of the form [a] φ for some a. Now, we demonstrate how to use the above corollary for establishing, within CS + 0 , the induction on the buildup of formulae. It will be convenient to isolate a few more definitions.
Definition 3.4 (PA). An occurrence of a variable v in a formula φ (term s) is a path in a syntactic tree of φ (term s) ending with v. An occurrence of a subformula of a formula φ is defined analogously. The fact that is a subformula occurrence in φ is denoted ≤ o φ. The (coded) set of occurrences of variables in a formula φ (term s) will be denoted Occ(φ) (Occ(s)).
A substitution of terms for a formula φ is a (coded) function such that dom( ) ⊆ Occ(φ) and rg( ) ⊆ ClTerm. For a formula φ, φ[ ] denotes the result of applying to φ.
If is a substitution of terms for φ and is a subformula of φ, then naturally gives rise to a substitution of terms for (we look only at those paths that pass through and take their suffixes starting from ). Such a substitution will be denoted by or simply · if it is clear from context which formula should occur in the subscript.
The substitution of terms for a formula φ agrees with an assignment α ∈ Asn(φ) if whenever p ∈ dom( ) is an occurrence of a variable v in φ, then ( (p)) • = α(v).
Let v p denote the variable whose occurrence p is.
Let φ be a formula and an occurrence of its subformula. Var(φ/ ) denotes the (coded) set of variables whose occurrence in is free in but bounded in φ.
Proof. Fix a formula φ, any assignment ∈ Asn(φ), and a substitution of terms which agrees with . We reason by induction on y in the Δ 0 (L + S )-formula (y) : Let us observe that S(cl φ ( ≡ [ ]), · ) makes sense: each occurrence of a free variable of ≡ [ ] is either an occurrence of a free variable of φ and hence the variable gets assigned a value by , or is bounded in φ and so, belonging to Var(φ/ ), gets bounded by a quantifier occurring in a prefix of cl φ ( ≡ [ ]). Let z be the least variable not occurring in φ. We show that (0) holds. The unique sentences of depth 0 are atomic sentences, so let us fix two terms s, t and argue that S cl φ (s = t ≡ (s = t[ s=t ])), · holds. Let c = Var(φ/ ). Consequently Call the above sentence on the right-hand side . By Corollary 3.3 we know that S( , · ) is equivalent to The last sentence holds, since, by the compositional conditions for atomic sentences and connectives, it is equivalent to the assertion that for every α ∈ Asn such that dom(α) = c To avoid double restrictions let us abbreviate with . Observe that s=t = . To prove ($) it is sufficient to show that each occurrence of a variable in either s or t gets assigned the same value on both sides. This holds since The same holds for t in place of s. Now assume that the thesis holds for y and consider (an occurrence of) of depth y + 1. We shall do the case of = 1 ∨ 2 and = ∃v 3 . We treat them simultaneously. As previously put : , c = Var(φ/ ), and c i = Var(φ/ i ). Applying the inductive assumption and Corollary 3.3 we have for i ∈ {1, 2, 3}

Now observe that
i i = i and if dom(α) = c i , then α i = α. By this and compositional conditions, for arbitrary α such that dom(α) = c i , the succedent of the above implication is equivalent to In the case = 1 ∨ 2 we have c = c 1 ∪ c 2 . Now, by compositional conditions, the following are equivalent for an arbitrary assignment α such that dom(α) = c: Now observe that ]) (= ) and a free variable in i , if and only if v is a free variable in cl φ ( i ≡ i [ i ]) (= i ) and in i . Hence dom( i ) = dom( i i ) and this completes our claim. The same reasoning shows also that Finally, if dom(α) = c, then dom(α i ) = c i . It follows that (3) implies the above condition (5) and the case of ∨ is done.
In the case of ∃, we observe that The following are equivalent for every α ∈ Asn such that dom(α) = c: ( 3 ), because every occurrence of v in ∃v 3 is bounded in φ. Hence = 3 , and consequently 3 = 3 3 = 3 . With this observation the proof in the case v / ∈ FV( 3 ) is straightforward, for (8) immediately reduces to (for all α such that dom(α) = c 3 ) The above is the same as our induction assumption. So we may assume that v ∈ FV( 3 ). Now fix α such that dom(α) = c. Suppose first that 3 ) holds. Let us observe that in this case, 3 = . Moreover dom(α) ∩ dom( 3 ) = ∅; hence for some α such that dom(α ) = c 3 , = α ∪ 3 . Hence S( 3 [ 3 ], 3 [ 3 ] ) follows by induction assumption (3). It is left to show that . So now assume that for some   Proof. By the previous considerations at the beginning of this section, for a fixed φ(v), S(Ind(φ(v)), ε) is equivalent to By Lemma 3.6 and Corollary 3.7 we have Hence, finally S (Ind(φ(v)), ε) is equivalent to the following axiom of Δ 0 (L + S )induction: Recall that φ(t/v) denotes the substitution of t for all (free) occurrences of v in φ(v). Corollary 3.9 (CS + 0 ). For every formula φ(v), term t (possibly having some variables), which is substitutable for v in φ(v) and every α ∈ Asn(φ(t/v)), if S(∀vφ(v), α · ), then S(φ(t/v), α).
Proof . Fix φ(v), t, α, as above and suppose S(∀vφ(v), α · ). By compositional conditions we know that for every such that ≥ v α ∀vφ(v) , S(φ(v), · ) holds. Define such that ∀vφ(x) = α ∀vφ(x) and (v) = t α . Hence, by our assumption we have S(φ(v), ). Let 0 be a substitution of t[α] for every occurrence of v in φ(v). Then 0 agrees with , so by Lemma 3.6 we have ). Let be a (coded) set of occurrences of the free variables from φ(t/v) that are within the new occurrences of t (observe that there might be some occurrences of t in φ(v)). Let be a substitution of numerals such that for every occurrence p ∈ , (p) = α(v p ) (recall that v p is the variable whose occurrence is p). By the definition of , we have φ(v) hence we can conclude that S(φ(t/v)[ ], α . ) holds. Since agrees with α, Lemma 3.6 yields S(φ(t/v), α).
Proof. We reason in CS + 0 . We fix a sequent calculus for the first-order logic with equality, as in [24] (this choice is just a matter of convenience 11 ). We fix a proof p of a sentence φ and by induction on its length argue that whenever a sequent Γ ⇒ Δ occurs in p, then holds, where Γ and Γ denote (the canonically parenthesized) conjunction and disjunction over sentences from sets Γ and Δ, respectively. To simplify the notation Γ → Δ will be abbreviated using the sequent notation as Γ ⇒ Δ. In the course of the induction we rely on the fact that the following sentence is provable in CS 0 : The proof of (DC) in CT 0 consists in a straightforward induction on the size of Γ and a similar argument can be given in the case of yielding a dual equivalence (see also [3,25] for precise arguments). We go back to the main induction on the length of the fixed proof p. In the base step we have to establish that all initial sequents satisfy (9). These include initial sequents for equality and all sequents of the form φ ⇒ φ. In both cases the proof follows the same pattern: first using Corollary 3.3 we get rid of the quantifier prefix and then verify that the formula following it is satisfied by every assignment. In the case of the initial sequents for equality we use the conditions for atomic sentences from CS -, in case of φ ⇒ φ we use the axioms for ¬ and ∨.
In the induction step the cases of quantifier rules are the unique non-obvious ones. Let us consider the dictum de omni rule: where φ(v) is a formula and t is free for v in φ(v). We may safely assume that v is a free variable in φ. For simplicity abbreviate φ(t/v) with simply φ(t). So suppose for every α ∈ Asn Γ + φ(t) ⇒ Δ it holds that Fix an arbitrary α ∈ Asn Γ + ∀vφ(v) ⇒ Δ and assume that for every ∈ Γ ∪ {∀vφ(v)}, S( , α · ) holds. Consider any ∈ Asn Γ + φ(t) ⇒ Δ such that , then by Lemma 3.9, S(φ(t), · ) as well.
Corollary 3.11. For every Gödelized theory Th, we have Hence, Proof. The first part follows directly from Theorem 3.10. Having it, we prove the second one: by induction on n we prove that For n = 0 this follows from the first part. Fix n and assume the thesis holds for it. By the compositional clauses for CSwe have Consequently, reapplying the first part of this corollary for REF n (Th) substituted for Th we get the induction thesis for n + 1.
The corollary below easily follows from the corollary above and Corollary 3.8.

Corollaries.
3.4.1. Compositional satisfaction vs. compositional truth. The above results transfer immediately to the setting of the following theory of truth: Definition 3.14. CTis the L ∪ {T } theory extending EA with the following axioms: . As usual CT n denotes the result of extending the following theory with induction axioms for Σ n formulae of the extended language.
Let L + T denote the extension of L T with function symbols for all p.r. recursive functions and CT + 0 denote the extension of CT 0 with all defining axioms for fresh functions symbols in L + T . Then we have an analogue of Proposition 3.1: Proposition 3.15. CT + 0 IΔ 0 (L + T ). Now we show that the result on the provability of (GR(Th)) in CS 0 transfers to the setting with the truth predicate. The above is a Δ 0 (L + T ) formula, so obviously we have IΔ 0 (L + S ). Now, we show that S(x, y) behaves compositionally. We focus on the ∃-axiom. Pick a formula φ(v) and α ∈ Asn(∃vφ(v)). Observe that the following equivalences hold: In the second and the third equivalence we use the fact that v / ∈ dom(α). Hence (in CT 0 ) by Theorem 3.10 we have ∀φ ∈ Sent Pr PA (φ) → S(φ, ε) .
Translating it back to the language with the truth predicate, we get our thesis.
The proof of the above corollary proceeds by defining the satisfaction predicate satisfying CS + 0 in CT + 0 . In fact, the same translation works also in the context of the non-inductive versions of both theories, CSand CT -. However, it is not known, whether the reverse is true in the context of these theories, i.e., whether CScan define the truth predicate of CT -. Using the Enayat-Visser method [7] of constructing pathological models for CSone can show that standard methods of defining truth from satisfaction do not work. However, the results from the previous section witness that Δ 0 induction is sufficient to overcome these deficiencies of CS -. As previously, T (x) is a Δ 0 (L S ) formula, so CS 0 IΔ 0 (L T ). Since sentences are the unique formulae for which ε is an assignment, so axiom 1. of CSimplies the corresponding axiom of CT -. Once again we focus on the compositional axioms for ∃. Working in CS 0 fix φ and without loss of generality assume that v ∈ FV(φ). Observe that the following equivalences hold: The proof of the fourth equivalence involves the crucial use of Lemma 3.6.

3.4.2.
Many faces theorem. Corollary 3.16 coupled with some known results from the literature, shows that the Global Reflection Principle is a very robust notion. Not only it is equivalent to bounded induction but is immune to, apparently significant, variations. This is summarized in the corollary below (we state it for the theory of compositional truth; however all the equivalences should transfer to the setting of a satisfaction predicate without significant changes). Pr T Sent (φ) asserts that φ is provable from the set of true sentences in pure sentential logic, while DC is a truth variant of the principles from the proof of Theorem 3.10.

Fullness.
The following is one of the most useful properties of CS 0 . It implies that every model of CS 0 is full, a theorem first demonstrated by Wcisło and presented in [25]. The proof below is an observation also due to Wcisło which crucially uses the provability of (GR(Th)). It's proof is included also in [20] (Fact 33) but we give it here for completeness. In the definition below we fix a canonical elementary translation transforming a given formula φ into one in the Σ n form. We assume that it formalizes in PA.
Recall (Definition 2.12) that φ(x) Σ denotes the canonical Σ c form of φ(x) and Σ * c := {φ | φ Σ ∈ Σ c }. Moreover recall that S c denotes the restriction of S to all formulae which are equivalent to sentences of Σ c complexity (in the sense of M). More precisely . From now on we work in (M, T ). By the classical metamathematics of PA, for every c there is a formula Sat Σc such that for every φ ∈ Σ * c and every α ∈ Asn(φ) we have Hence, by GR(PA) we conclude that for every sentence φ ∈ Σ * c T (φ) ≡ T (Sat Σc (φ Σ , ε)).
Consequently, T satisfies the compositional axioms of CTfor formulae from the Σ * c class. We shall now show (M, T ) |= Ind(L T ). Thus let [T ] be an arbitrary axiom of induction for a formula with T (we mark all occurrences of T in ). We may assume that [T ] is in the semirelational form (as defined in [19]). Since, using the notation of [19], T is of the form T * , by Lemma 25 in [19] we have Remark 3.20. A very similar reasoning was used in Kotlarski in [15]. However various parts of this paper are negatively influenced by the significant gaps already discussed at the beginning of this section. We decided to reprove it in a rigorous way. Essentially the same proof is given in [20].
where (x) i denotes the i-th projection of x. Working in (M, S) fix an arbitrary c. Obviously, if a formula φ < c then φ ∈ Σ * c . Hence, it is sufficient to find a d such that This clearly can be done as S c satisfies full induction. §4. Consequences of the global reflection principle. In this section we focus on the Δ 0 -inductive truth predicate. We remind the Reader that by default all theories extend EA. We extend the result from the previous section and prove the following theorem.
Theorem 4.1. For every φ(x) ∈ Σ 1 (L T ) and every n ∈ the following sentence is provable in CT 0 : The above answers affirmatively the question of Beklemishev and Pakhomov from [2].
Let us start by explaining that Theorem 4.1 really improves on the results from the previous section. Let Th be a Gödelized theory extending EA in a language L and let UTB -(Th) denote the extension of Th with UTBaxioms. It is enough to observe that over EA Δ 0 (L UTB -(Th) )-REF(UTB -(Th)) GR(Th).
Proof of Theorem 4.1 starts with a lemma: 12 Remark 4.5. The above proof generalises to the case in which PA is replaced with a (formalized) theory Th in an expanded (at most countable) language L (we assume a fixed Gödel coding of L ) such that Th Ind L . This allows us to obtain: Lemma 4.6. For every φ ∈ Δ 0 (L T ), . In order to bypass the problems with infinitely many additional predicates in L it is sufficient to work with an M-bounded fragment of Th and consider only the fragment of L consisting of predicates which occur in a formula in the fixed proof p.
The following lemma suffices to complete the proof of Theorem 4.1.
Lemma 4.7 (Bounding lemma). For every formula φ(x) ∈ Δ 0 (L T ) and every n ∈ , the following implication is provable in CT 0 : ). Before we prove it, let us show a proposition which was the motivation for the proof of the above lemma: Proof. Suppose that for every n, UTB -+ Th(N) + ∀x < n¬φ(x) is consistent. A trivial compactness argument then shows that Th(N)+UTB -+{∀x < nφ(x) | n ∈ } is consistent as well. So let us take (M, T ) |= Th(N) + UTB -+ {∀x < nφ(x) | n ∈ } and look at (N, T N ). Since N e M, (N, T N ) |= UTB -, and, consequently T N = Th(N), because in N there is only one interpretation for the UTB --truth predicate. Since φ(x) ∈ Δ 0 (L T ), then (N, Th(N)) |= ∀x¬φ(x), which suffices to end the proof. UTBn c (∀v¬φ(v)), which suffices to prove the claim by a trivial compactness argument (UTB n c denotes the first c -1 axioms of UTB n ). Fix c and let c < b be big enough so that every formula in T c and every axiom of UTBc belongs to Σ * b-1 . Working in (M, T b ) consider So fix an arbitrary such φ. Now the following conditions are equivalent: . Now, the equivalence between (2) and (3) [15]. 13 We shall show that the theory is consistent. The proof proceeds in two stages. In the first one, we fix a full model of REF (  For the base step fix M, S, X as above and assume first that S is 0-prolongable. Fix N as in the definition of 0-prolongability. Working in (M, S) take any proof p of a sentence φ ∈ s(Σ * c ) from EA. Since EA is a finite theory N |= Sat N EA. Then, since p is a proof from true axioms in the sense of Sat N , then Sat N (φ, ε). Hence, since φ is a formula from s(Σ * c ), S(φ, ε) holds by the definition of 0-prolongability. Suppose now that (M, S, c) |= ∀φ ∈ s(Σ * c ) Pr S EA (φ) → S(φ, ε) . Consider the following (M, S, c)-definable theory Th := {φ ∈ Σ * c | S(φ, ε)}. By our assumption, (M, S, c) |= Con Th . Work in (M, S, c). By the Arithmetized Completeness Theorem (we use the assumption that (M, S, c) |= PA * ), we have a full model N |= Sat N Th. Hence, obviously Sat N and S coincide on s(Σ * c ) (observe that they need not coincide on Σ * c ). Now assume that the equivalence holds for n. Fix M, S, Σ * c as above and assume first that S is (n + 1)-prolongable and pick (N , S , c ) |= CS(Σ * c ) such that ( * ) follows as in [19] and Theorem 3.19. We note that the above chain need not be continuous. where (x, y, c) is ∀φ ∈ Σ * y ∀i < x∀α < c i φ < c i ∧ α ∈ Asn(∃vφ) ∧ S(∃vφ, α) Thus (x, y, z) expresses that there is a witness-bounding sequence c of length x and starting from z, which works for those formulae of Σ * y complexity which are below some of the elements of the sequence. Let e be such that ed 0 is nonstandard. We reason in (M, S e ) |= CS(Σ * e ) and by a straightforward induction conclude that ∀x (x, e, e).
We let a be an arbitrary nonstandard number and we fix c witnessing (a, e, e). We define Clearly if b 1 , b 2 < c i , for some i, then b 1 + b 2 , b 1 · b 2 < c i+1 by the assumption on c.
In the successor step assume that (M α , S α , c α ) has been constructed and w.l.o.g. assume that d α+1 / ∈ M α . We pick e ∈ M such that ed α+1 is nonstandard and repeat the reasoning from the base step with d α+1 replacing d 0 . In the limit step, we assume that for every α < , (M α , S α , c α ) has been constructed. We take (M , S ) = α< (M α , S α ) and assume (by the regularity of κ) that is the least such that d / ∈ M . We put c = d and repeat the reasoning from the base step with c replacing d 0 .
The construction from Lemma 5.3 enables us to extend the result from Section 4. Moreover, if is an assumption of proof p and an arithmetical sentence, then ∈ T ; hence, by the choice of i, ∈ S i . It follows that (M i+1 , S i+2 M i+1 ) |= Sat i+1 , since Sat i+1 coincides with Sat i+1 on sentences from M i . We conclude, still working in (M i , S i ), that Sat i+1 makes every premise of p true in (M i+1 , S i+2 M i+1 ). So p's conclusion, φ(c), must be deemed true in (M i+1 , S i+2 M i+1 ) by Sat i+1 . Since φ(c) is a standard formula with a parameter, we can conclude that (M i+1 , S i+2 M i+1 ) |= φ(c). Now, we show how to justify the existence of the chain {(M i , S i , c i )} i∈ . Let BΣ 1 (L T ) denote the extension of CT 0 with Σ 1 collection scheme for the language with the truth predicate. As shown in [20], BΣ 1 (L T ) is Π 2 conservative over CT 0 . So we can assume that the above model (M, T ) is a countable recursively saturated (in the extended language) model of CT -+ BΣ 1 (L T ). By the classical result of Wilkie-Paris [26] there exists a proper end-extension (M , T ) |= CT 0 of (M, T ). 15  Let us stress that, by the proof of Theorem 5.14, the positive answer to Question 1 implies that the answer to Question 2 is positive as well.