Skip to the reading
QuodlibetFoundations · the descent · companion to The Ascent

The truth that outruns proof has no fixed ground

The Descent

The Ascent proved there is no top: no system proves everything, so truth outruns proof at every level. But the unprovable truths are true — true in the standard model ℕ. That opens a question the climb never asked: what is ℕ, and can it be pinned down? It cannot. No first-order theory fixes an infinite model; every attempt to secure the ground from outside needs a richer ground, itself unsecured. There is no roof, and there is no floor.

the intended model · nonstandard numbers · the ground that recedes · the diagonal turned downward

The Ascent ended on a line it did not examine. Truth outruns proof, it said — the Gödel sentence is true though unprovable. But true where? A sentence is not true or false in the void; it is true in a model. The Gödel sentence is true in ℕ, the standard natural numbers — the structure 0, 1, 2, … that every child counts and every mathematician means. The whole of the previous panel was syntax: which marks on paper follow from which. The instant we call a sentence true, we have left syntax for semantics, and stepped onto ground we have not yet inspected.

This panel inspects it, and finds it will not hold still. The intended model ℕ exists and is unique — but only in second-order logic, which pins it down at a price we will have to pay. In the first-order logic that actually carries Gödel's and Tarski's theorems, ℕ is not unique at all: there are nonstandard models, dense with infinite numbers, in which the very sentences true of ℕ come out false. And the obvious remedy — climb to a richer logic that fixes the intended model — relocates the problem exactly as the reflection ladder did, into a ground that is itself unfixed.

The two are bound tighter than analogy — by a theorem. The completeness theorem makes unprovable and false in some model one condition: a sentence the axioms leave open is precisely one on which two of their models disagree. So the Ascent's gap (a truth not proved) and the Descent's gap (a model not fixed) are two readings of a single distance — between what a theory says and what its models are. But that distance is opened and filled by two different forces, and holding them apart is the discipline of everything below: self-reference, which forbids a system from completing or naming itself from inside, and expressive weakness, which forbids first-order logic from saying finite, standard, or all subsets at all. The first is the diagonal; the second is not — it is what the diagonal's gap lets in. They meet on a floor the completeness theorem lays between them. The edifice has no roof and no floor — one distance, opened from above and filled from below. We descend in four movements.

I · the intended model

True in ℕ

The Gödel sentence is true — true in the standard model. In second-order logic that model is unique. The truth that outruns proof is truth in a structure.

The Gödel sentence G says, of itself, that it has no proof in T. If T is consistent, G indeed has no proof — so what G says is the case. G is true. But this "true" is not a verdict of the proof system; it is a claim about a structure, ℕ, in which G's arithmetic comes out right. So the gap the Ascent opened — truth beyond proof — is a gap between a theory and a model. Everything now turns on the model. What secures ℕ as a single, definite object?

Dedekind, 1888
The second-order Peano axioms are categorical. When the induction axiom quantifies over all subsets of the domain — ∀X (0∈X ∧ ∀n(n∈X→n+1∈X) → ∀n n∈X) — exactly one structure satisfies the axioms, up to isomorphism: ℕ. There is, up to relabeling, only one standard model. In second-order logic, "G is true" is fully determinate, and the intended model is a definite mathematical object.

So far the ground is firm — suspiciously so. Categoricity says the axioms admit no rival to ℕ; the unprovable Gödel sentence has a definite truth value because there is a definite structure to be true in. The trouble is hidden in four words: quantifies over all subsets. That phrase is what makes second-order induction strong enough to exclude every impostor — and, as the next movement shows, it is exactly the phrase the first-order logic of Gödel and Tarski cannot say. Drop it, and the impostors flood in.

II · the descent

ℕ has company

First-order arithmetic cannot pin down ℕ. By compactness, it has nonstandard models — full of infinite numbers, in which truths of ℕ go false. Truth is model-relative.

First-order induction is a schema: one axiom per definable property, not a single axiom quantifying over all subsets. That is a weaker net, and it cannot hold ℕ alone. The proof is a machine you can run. Introduce a fresh constant c and the axioms c > 0, c > 1, c > 2, …. Any finite batch of them is satisfiable in plain ℕ — just interpret c as a number bigger than the largest bound used. The compactness theorem then forces the whole infinite set to be satisfiable too — in a model where c is bigger than every numeral at once.

every finite subset is satisfiable in ℕ — so the infinite set is too — but its model is not ℕ. Compactness cannot tell the standard numbers from a structure with infinite ones bolted on past the end.

The model the machine produces is no curiosity. Every countable nonstandard model of arithmetic has the same shape: the standard ray ℕ, and then — past every finite number — a procession of ℤ-chains (each running …, c−1, c, c+1, … with no first or last), packed together as densely as the rationals, no chain first and no chain last. And the sentences change their minds across the gap. Since PA ⊬ Con(PA), the theory PA + ¬Con(PA) is consistent — so it has a model, a nonstandard one harboring a "proof of 0=1" of infinite length. In ℕ, arithmetic is consistent; in M, a number codes its refutation. True was never a property of the sentence alone.

undecided means divided — the equivalence beneath both panels
For a first-order theory and a sentence, to be undecided is to be disagreed about. By soundness and completeness, T ⊬ φ and T ⊬ ¬φ hold together exactly when T has one model satisfying φ and another satisfying ¬φ. Independence is disagreement among models — not its symptom but its definition. So the Gödel sentence's unprovability is not merely accompanied by nonstandard models; it is their existence: PA ⊬ G precisely because some model satisfies ¬G. The Ascent's incompleteness and The Descent's nonstandard numbers are one fact, written once in syntax and once in semantics.

But not every nonstandard model owes its existence to incompleteness, and that difference is the hinge of the whole movement — the place where two engines, not one, are running. A model of PA + ¬Con(PA) disagrees with ℕ: it satisfies a sentence false in the standard numbers, and it exists because PA fails to decide Con(PA) — this is incompleteness, the diagonal's doing. But there are also nonstandard models that agree with ℕ on every first-order sentence: models of Th(ℕ) — true arithmetic itself, the complete theory that already decides everything — which are nonetheless not isomorphic to ℕ. Compactness builds one in a single line: adjoin c > 0, c > 1, … to Th(ℕ), and every finite part still holds in ℕ. These owe nothing to incompleteness — a complete theory has them anyway — and everything to a logic that cannot say finite. So beneath the single phrase "no floor" run two distinct mechanisms: one is the diagonal; the other is pure expressive weakness, with no diagonal anywhere in it. The fourth movement turns on keeping them apart.

the bridge — and the trapdoor

Where does such a model come from? Not from a platonic elsewhere — from the same theorem read constructively. Completeness does not merely assert that a consistent theory has a model; the Henkin construction builds one out of the theory's own sentences. And the arithmetized completeness theorem (Hilbert–Bernays, 1939) carries that construction inside arithmetic: from Con(T) it produces a model of T whose relations are arithmetically definable — for a consistent r.e. theory, a structure computable relative to the halting problem. So the deviant model of PA + ¬Con(PA) is nearly an inside job, a Henkin model the theory all but writes for itself. The bridge that joins proof to truth is, read the other way, the trapdoor that drops ℕ into a crowd of impostors — and it hands you their blueprints.

overspill — the model cannot find its own edge
In a nonstandard M ⊨ PA, the standard part ℕ ⊆ M is not definable in M. Were it definable, induction inside M would force it to swallow all of M — yet it is a proper initial segment, so no formula can carve it out. The consequence is overspill: any property that holds of every standard number already holds of some infinite one, and the border between finite and infinite is invisible from within. This is the semantic echo of Tarski. There the model could not define its own truth; here it cannot define its own standard cut — the thing you most want to name is the one thing the structure cannot.

And yet — against all this receding — there is one direction in which ℕ is pinned exactly. Where model theory cannot single it out, recursion theory can.

Tennenbaum's theorem (1959) — ℕ is the only one you can compute

No nonstandard model of PA is computable — neither its addition nor its multiplication can be a recursive function of the codes. The reason exposes what a model can see. Every nonstandard M carries a standard system SSy(M): the subsets of ℕ coded by single elements of M — read off the divisors, or the binary digits, of one nonstandard number. By overspill that collection is unavoidably rich. It is a Scott set: closed under relative computability and containing a branch through every infinite binary tree it codes — so it must contain a set separating any pair of effectively inseparable r.e. sets, and such a separator is provably not computable. Were M computable, SSy(M) would lie inside the recursive sets, where no such separator can live. So while PA has infinitely many models, exactly one — ℕ — can ever be exhibited, written down, computed with; the rest are guaranteed to exist and guaranteed to be unreachable, solid in the model theory and ghosts to any computation. Reference is unfixed in the model theory and pinned in the recursion theory — and that split, not a verdict for either side, is the exact situation we are in.

Skolem's paradox — the relativity goes all the way up

It is not only arithmetic. By the downward Löwenheim–Skolem theorem, any consistent first-order theory in a countable language has a countable model — set theory included. So ZFC, if consistent, has a model with only countably many objects, even though ZFC proves there are uncountable sets. The resolution is exact and unsettling: the bijection that would count that model's "reals" exists outside the model, not within it. "Uncountable" is not absolute; it is relative to a model. Cardinality is not preserved when you change the surrounding universe: "x is uncountable" can hold in one model and fail in an extension that adds the missing bijection, touching no element of x, only the world around it. That non-absoluteness is not a curiosity — it is the very lever forcing pulls to make the continuum hypothesis true in one universe and false in another, which The Descent meets again, magnified, in the fourth movement. The most basic notions of size — like the most basic notions of truth — recede when you formalize them.

and truth recedes with it — the semantic Tarski

The relativity reaches truth itself. The set of sentences true in ℕ — Th(ℕ), true arithmetic — is not arithmetical: by Tarski's theorem no arithmetical formula defines it. Its Turing degree is 0(ω), the ω-th jump, sitting strictly above every level Σ⁰ₙ and Π⁰ₙ of the arithmetical hierarchy at once. Where The Ascent reached Tarski through syntax — no consistent effective theory defines its own truth — The Descent reaches the same wall through semantics: the standard model's complete theory outruns every formula that would capture it, exactly as proof outran truth one panel above.

III · the ground recedes

No self-grounding base

To fix ℕ you ascend to a richer logic or theory — which has its own unfixed model. Grounding has no bottom, for the same shape of reason the ascent has no top.

The remedy is the one we already named: if first-order logic is too weak to pin down ℕ, use second-order logic, which by Dedekind does. But second-order logic exacts two payments, and together they end the hope of standing on solid ground.

payment one — no grip  The logic strong enough to fix ℕ is exactly the logic with no effective hold on its own truths.

full (standard) semantics

Pins ℕ down — but you cannot compute with it

categorical (fixes ℕ)✓ yes
sound, complete, effective proof system✗ none
validity is …not even arithmetical
Henkin semantics

Has a proof system — but no longer fixes ℕ

complete proof system✓ yes
categorical (fixes ℕ)✗ no
in effect, it is …first-order again
You may have the logic that fixes ℕ, or the logic you can reason in — never both at once (Henkin, 1950). The categoricity that secures the ground comes with no procedure to walk on it.

payment two — borrowed definiteness  And the categoricity rests on a totality it does not itself secure. Second-order induction excludes the impostors only by quantifying over all subsets of the domain — it presupposes that "all subsets of ℕ," the full powerset, is one determinate thing. The categoricity is genuine: in any universe with a settled ℘(ℕ), second-order PA pins ℕ exactly, and nothing here is sleight of hand. But whether that powerset is determinate is just what set theory leaves open — and the point must be made carefully, because it is easy to overstate. It is not that the continuum hypothesis refutes categoricity; it does not, and the pinning holds whatever the continuum's size turns out to be. It is that CH's independence (Cohen, 1963) shows ZFC does not fix even the structure of ℘(ℕ), and that ZFC has its own teeming multitude of models — so the determinacy second-order logic borrows is exactly the determinacy set theory cannot certify. The definiteness of ℕ was drawn on the definiteness of the powerset; that draft must be honored one level up, by a theory no more uniquely fixed than the arithmetic it was sent to ground.

internal categoricity — definiteness transmitted, not made
One might hope second-order categoricity needs no platonic powerset — and in a sense it does not. Categoricity for second-order PA is provable internally, inside a deductive calculus with comprehension, with no appeal to full semantics (Väänänen–Wang, 2015): any two interpretations obeying the second-order axioms together with their own comprehension are isomorphic. But this does not manufacture definiteness — it transmits it. The isomorphism is only as determinate as the second-order domain the background fixes; internal categoricity says ℕ is exactly as definite as "all subsets" is, and no more. The borrowing is not removed. It is made precise.

watch the ground recede  The Ascent let you climb: add the consistency a theory lacked, and the tower rose with no top. Here the motion inverts. Each theory borrows its definiteness from a richer one beneath it — and that one borrows in turn. Add the ground each level needs, and the floor sinks away forever.

no self-grounding base has been reached — and none can be
each level fixes the one above by borrowing a totality it cannot itself secure — and is itself a theory with unfixed models. Descend as far as you like; the readout will never report a ground that fixes itself.
the keystone — Löwenheim–Skolem
No first-order theory with an infinite model is categorical. Any first-order theory that has an infinite model has models of every infinite cardinality — and so cannot determine its model up to isomorphism. The intended structure cannot be singled out from inside first-order logic. Where The Ascent proved no consistent r.e. theory proves its own soundness, The Descent proves no first-order theory fixes its own infinite model. The missing thing — completeness there, categoricity here — is in each case unreachable from within.
the descent — the grounding regress

Grounding never bottoms out

To fix the model of a theory, interpret it in a richer metatheory. That metatheory has its own unfixed model — so it needs another beneath it. The regress descends without end.

Mod(T) fixed in M
⊐ Mod(M) fixed in M′
⊐ Mod(M′) fixed in M″
⊐ ⋯  no base
the forbidden bedrock

A self-grounding base cannot exist

Bedrock would be a theory that fixes its own intended model while staying first-order and effective — categorical, with an infinite model.

T fixes Mod(T), first-order
⟹ categorical, infinite model
✗  Löwenheim · Skolem
The exact mirror of The Ascent's hinge. There the repair operator had no fixed point, so the theory ascended forever toward a completeness it never reached. Here the grounding operator has no base, so the model descends forever toward a bedrock that is never there. Same absence — read up in proof, down in meaning.

the seam the dispute turns on  This does not settle whether ℕ is "really" a definite thing. It locates, precisely, the seam where that ancient argument runs — and shows why neither side can dislodge the other.

the mathematician — ℕ is real

Platonism (Gödel)

The standard model is a definite reality the axioms grope toward. The unprovable truths are facts about ℕ that our formal nets fail to land — incompleteness is a limit on us, not on the numbers. We see that G is true.

the formalizer — ℕ is unfixed

Skepticism (Skolem, Putnam)

"ℕ" is only ever specified by theories, and no theory we can write distinguishes it from its nonstandard rivals. To say G is "true" is to have already chosen a model the formalism cannot single out. The reference of ℕ is not pinned by anything we can say.

Both are right, and that is the discovery. The standard model is real to the one who works in it and unreachable to the one who formalizes the reaching — because every formal net fine enough to catch ℕ catches infinitely much besides. The seam does not close. It is the subject.
IV · the diagonal, turned downward

One distance, two forces

The climb with no top and the dig with no floor are bound — but not by a single construction. One is the diagonal; the other is what the diagonal's gap lets in. This movement itemizes the purchase the corpus has been spending.

Set the two engines side by side. The Ascent: a theory cannot complete itself — the operation add the soundness you lack has no fixed point, so the climb has no top. The Descent: a first-order theory cannot fix its model — so the dig has no floor. Having come this far, the temptation is to declare them the same theorem and pocket the slogan. They are not quite the same theorem, and the difference is worth more than the slogan. One is a genuine fixed-point obstruction — the diagonal, refusing to be escaped because the move that would escape it builds the very fixed point it flees. The other is an obstruction of expression: first-order logic, having traded away the power to say finiteness for the powers of completeness and compactness, simply cannot utter the constraint that would pin the model. What binds the two is not a shared construction but a shared bookkeeping — and a floor, laid by the completeness theorem, on which they meet. The rest of this movement makes each of those three things exact.

aspect
The Ascent — no top
The Descent — no floor
the domain
syntax — what is provable
semantics — what is true in a model
the gap
truth outruns proof
reference outruns description
the missing thing
completeness — proving all it should
categoricity — fixing the model it means
the operator
R — add the soundness you lack
G — borrow the ground beneath you
forbidden fixed point
T = R(T) ⟹ T ⊢ Con(T) — Gödel·Löb
T fixes Mod(T), first-order ⟹ categorical·infinite — L·Skolem
the motion
T ⊊ R(T) ⊊ R²(T) ⊊ ⋯ ascends
Mod(T) ⊐ Mod(M) ⊐ ⋯ descends
Read down the columns and the parallel is exact; read into the mechanisms and it splits. The left column is a true fixed-point obstruction — R has no fixed point because a theory equal to its own reflective closure would prove its own consistency, which the diagonal forbids. The right column is an expressive obstruction — first-order logic cannot say the constraint that would pin the model, and no diagonal is involved. The construction g(x)=α(φ(x)(x)) governs the left directly; it governs the right only at one remove, through the gap it opens. The two boxes below make that exact — first the bookkeeping that makes them dual, then the construction that makes only one of them an instance.
the bookkeeping — Th and Mod are a Galois connection
Syntax and semantics are joined by an antitone Galois connection. Let Mod(Σ) be the models of a set of sentences and Th(K) the sentences true throughout a class; then Σ ⊆ Th(K) ⟺ K ⊆ Mod(Σ), and each map reverses order. Completeness is the statement that the closed sets on the syntactic side are exactly the deductively closed theories (Th(Mod(Σ)) = the consequences of Σ). Under this connection incompleteness and non-categoricity are order-dual: a theory sitting below a complete one, T ⊊ Th(M), corresponds exactly to a model class sitting above a single elementary class, Mod(T) ⊋ Mod(Th(M)). Too few theorems and too many models are one gap, read from its two ends. The roof and the floor answer to each other not by metaphor but because they are a single distance under an adjunction.

and yet they are not the same theorem  The Galois connection makes the two gaps correspond; it does not make them the same. Watch the residue. Even Th(ℕ) — the complete theory, with no incompleteness left to spend — still has nonstandard models. Its model class Mod(Th(ℕ)) is a single elementary class, yet it properly contains the lone isomorphism type of ℕ. That surplus owes nothing to any undecided sentence; it is pure expressive weakness, the part of "no floor" that survives after incompleteness is subtracted. The diagonal opens the gap; compactness, all on its own, keeps it open. To see why only one of the two is the diagonal, state the diagonal itself.

the construction itself — Lawvere, 1969
if φ : A × A → B is point-surjective,
then every f : B → B has a fixed point

One theorem, read two ways. Forward: when self-application is rich enough to name every map — Gödel coding, the Y-combinator — fixed points are forced, and you get recursion, the diagonal lemma, the Gödel sentence G ↔ ¬Prov(⌜G⌝). Contrapositive: when some f has no fixed point — negation on {⊤,⊥} — the naming map cannot exist, and you get Cantor, Tarski, the impossibility of a complete inner truth predicate. Power and limit are the single theorem with α set to identity or to negation. The corpus is, finally, an audit of which results are this construction and which only border it.

the result
the mechanism
a Lawvere fixed point?
Cantor
f = ¬ on {0,1} has no fixed point, so no point-surjection X → 2ˣ
yes · direct
diagonal lemma · Gödel I · Tarski
coding makes self-reference point-surjective, so fixed points abound — and a fixed-point-free truth map therefore cannot be defined
yes · direct
The Ascent — reflection has no fixed point
Gödel II off the diagonal lemma: T = R(T) ⟹ T ⊢ Con(T), impossible for consistent T
yes · one level up
The Descent — no infinite categorical first-order theory
compactness / Löwenheim–Skolem: first-order logic cannot express finite; even a complete theory has nonstandard models
no · expressive weakness
the bridge — independence ⟺ disagreement
the completeness theorem, turning every undecided sentence into a pair of disagreeing models
no · it is the floor between
So the honest map has three regions, not one. The diagonal proper, and the reflection ladder it drives, are fixed-point obstructions you cannot escape, because the construction that would escape them is the fixed point they forbid. Compactness and Löwenheim–Skolem are not that; they are the standing cost of a logic that bought completeness and compactness with the coin of expressive power. And the completeness theorem is the seam between, exchanging unprovable truths for disagreeing models in both directions. The Mirror's slogan — power and limit, one purchase — survives the scrutiny, but only once the purchase is itemized.

the skeptic's permanent move  One might still hope to say which model is meant — adjoin an axiom, a constraint, a causal story that pins ℕ down. Putnam's argument (1980) is that the hope is structurally empty: whatever you add is just more theory, itself a set of sentences with its own deviant interpretations. The fix never closes, for the same reason the ladder never tops out.

adjoin constraint C to pin ℕ
⟹ C is more sentences ⟹ a deviant M ⊨ PA + C
✗  reference still unfixed

And the seam does not stay in arithmetic. Ask the same question one level up — is the universe of sets V itself a definite thing? — and the dispute reappears unchanged, with the continuum hypothesis standing where the Gödel sentence stood.

the set theorist — V is real

The universe view (Gödel · Woodin)

There is one universe of sets, and CH has an answer we have not yet found. The work is to discover the axioms — large cardinals, an ultimate inner model — that decide it. Independence marks our ignorance, not the world's indeterminacy.

the forcing theorist — V is plural

The multiverse view (Hamkins, 2012)

CH is a switch — true in some universes, false in others, flipped at will by forcing. To ask its "real" value is a category mistake; the plurality of universes is the subject, exactly as the plurality of models was below.

The same seam, one storey up, and it never terminates: every ground you stand on to fix the level below is itself a level whose ground is in dispute. The seam is not a flaw in the floors — it is the shape of having floors at all. (That the ℕ-seam and the V-seam are one seam is a framing; the results beneath them are not.)

the seam has structure  And the dispute is no longer only a posture; it has become mathematics. Between the lone universe and the unconstrained multiverse sits a precise object — the generic multiverse, the closure of a universe under set forcing — and it carries its own logic (Ω-logic) and its own notion of truth: what holds across every forcing extension. CH is not generic-multiverse valid, which is one exact sense of its being "unsettled." Set against this, Woodin's Ultimate-L program seeks a single canonical inner model that absorbs all large cardinals and satisfies CH — a mathematical attempt to earn the universe view rather than assume it. The seam is a working front, not a stalemate: what is at issue is whether a distinguished floor exists, and there is real machinery being built to lay one.

So the corpus closes where it began. The Diagonal found the construction; The Engine ran its twist as the identity and got recursion, the fixed point that powers computation; The Ascent ran it as negation in proof and got no roof; The Descent carries it into meaning — and finds the gap it opens already flooded by a second force, the expressive weakness of first-order logic, so the floor is missing twice over; The Mirror reads power and limit as the one purchase. Not one construction read four ways, but a construction, its dual, and the completeness theorem that binds them — the figure the whole corpus has been drawing. The sign of α is the dial that sets power against limit; whether the limit then shows as no-roof or no-floor is which logic you ask, and what it is too weak to say.

⌜ no top ⌝ the structure that holds PROOF · MEANING ⌞ no floor ⌟
Neither resting on a foundation nor crowned by a completion — held between a proof it cannot finish and a ground it cannot reach. The suspension is the structure.

The Ascent found no roof: no system proves everything. The Descent finds no floor: no system fixes everything it means. Between a truth it cannot finish proving and a ground it cannot finish fixing, mathematics hangs — and holds. The standard model is real to the one who works in it and unreachable to the one who formalizes the reaching; both are right, because every net fine enough to catch ℕ catches infinitely much besides. No top, no bottom — and the suspension is the structure.