The models a theory cannot tell apart
Seven volumes followed one construction — the diagonal — through every room of the foundations, and found it forcing a fixed point a system could not escape. But the diagonal is only one face of the limit. It is the system turned inward, reasoning about itself. There is a second face, turned outward: a theory reasoning about the worlds that satisfy it, and discovering it cannot pin them down. A first‑order theory has not one model but a multitude — of every infinite size, with strange nonstandard worlds hidden indistinguishably among them — and no sentence it can write will tell them apart. This is the semantic limit, and it has its own single engine, the way the diagonal had Lawvere's. The engine is the ultraproduct, and from it flow compactness, Löwenheim–Skolem, the nonstandard models, and at last Lindström's theorem, which reveals that these are not defects of first‑order logic but its very definition. Where the diagonal said a system cannot grasp itself, the multitude says a theory cannot grasp its worlds — and the two limits, syntactic and semantic, are the complete price of formal reasoning.
the semantic complement to the diagonal · the model‑theoretic face of the limit — the ultraproduct and Łoś's theorem as the single engine; compactness as its first consequence; the Löwenheim–Skolem theorems and Skolem's paradox; the nonstandard models, where the diagonal's independence becomes the splitting of worlds; Tennenbaum's theorem, the boundary where the two faces meet the limits of computation; and Lindström's theorem, the capstone that mirrors the conservation law
The corpus has been, until now, the story of one face of the limit. To see the whole, the other face must be drawn — and the relation between them stated, because they are not two subjects but two views of a single gap.
two ways a formal system meets its edge A formal system can fail to grasp two things, and the foundations are the study of both failures. It can fail to grasp itself: turned inward, naming its own sentences and predicates, it forces a fixed point — the Liar, the Gödel sentence, the halting program — and the diagonal is the engine of that inward failure. Seven volumes traced it. But a system can also fail to grasp its models: turned outward, a theory tries to single out the structure it means to describe — the natural numbers, the real line, the cumulative hierarchy of sets — and discovers that its sentences are satisfied by a whole multitude of structures it cannot distinguish from the intended one. This is the semantic failure, and it is governed not by self‑reference but by the gap between what a theory says and what satisfies it. The diagonal is intensional; the multitude is extensional. One is the mirror; the other is the horizon.
one engine again The deep claim of this volume is that the semantic face, like the syntactic, is not a scattering of separate accidents but the output of a single construction. Where the diagonal family had Lawvere's fixed‑point theorem as its one engine, the model‑theoretic family has the ultraproduct: a way of blending a whole family of structures into one, with truth in the blend decided by a vote — an ultrafilter — among the factors. The governing law is Łoś's theorem, the exact analogue of Lawvere's: it says truth transfers from the many to the one by majority. From that single construction follow compactness (a theory finitely satisfiable is satisfiable), the upward Löwenheim–Skolem theorem (models grow without bound), the nonstandard models of arithmetic, and the characterisation of when two structures are elementarily alike. And the capstone, Lindström's theorem, will mirror the conservation law of the diagonal exactly: just as no consistent system escaped the diagonal's four‑way choice, no logic stronger than first‑order keeps the multitude's two defining properties. The limits are not failures bolted on. They are what first‑order logic is.
It would be enough if the semantic limit were merely the diagonal's twin, a parallel story told in a different key. It is more than that: the two faces are locked together, and seeing how is the reward of this volume. The diagonal's signature result, incompleteness, says a theory cannot prove every truth of its intended model. The multitude's signature phenomenon, nonstandard models, says the theory has other models besides the intended one. These are the same fact seen twice. A sentence is independent of a theory — neither provable nor refutable — exactly when the theory's models disagree about it: true in some, false in others. So incompleteness, read outward, simply is the splitting of the multitude; the unprovable Gödel sentence is true in the standard world and false in some nonstandard one, and the gap between provability and truth is precisely the gap between the intended model and its shadows. Gödel's completeness theorem and Gödel's incompleteness theorem, so often felt to be in tension, are the two faces meeting: completeness says a theory proves what holds in all its models; incompleteness says some truths hold only in the intended one. The difference between all models and the intended model is the multitude, and Tennenbaum's theorem, near the end, will show that this difference lives exactly at the boundary of the computable. The inward limit and the outward limit are one limit, viewed from inside the system and from outside it.
One construction drives the entire semantic family, and it is as compact as Lawvere's. Blend a multitude of structures into one, let a vote decide what is true in the blend, and the limits of first‑order logic follow as corollaries.
the construction Take a family of structures { Mi : i ∈ I } — they need not be alike — and a way of deciding which subsets of the index set I count as large. The decision is an ultrafilter U: a collection of "large" sets closed under supersets and finite intersection, never containing the empty set, and — the defining stroke — deciding every subset, so that for each A ⊆ I, exactly one of A or its complement is large. Now form the ultraproduct ∏i Mi / U: its elements are sequences (ai), with two sequences identified when they agree on a large set, and its relations and functions computed coordinatewise. The ultrafilter is a notion of "almost everywhere," and the ultraproduct is the structure that emerges when the factors are averaged under it.
the first surprise The engine already does something the diagonal never could: it manufactures a structure unlike all its factors. Blend the finite linear orders L1, L2, L3, … — orders of one element, two, three — under a non‑principal ultrafilter, and Łoś computes the theory of the result property by property. "Has a least and greatest element" holds in every factor, so it holds in the blend. "Has at least five elements" holds in all but finitely many, so it holds in the blend. But "is finite" is not a single first‑order sentence, and the blend, satisfying "has at least k elements" for every k, is infinite — an infinite order assembled entirely from finite ones. Finiteness has slipped through the net, and that escape is the seed of every limit to come. Choose a property below and watch the vote decide.
truth by majority — the ultraproduct of finite linear orders
The engine's first and most consequential output. A single theorem — that satisfiability is a finite affair — is the deep reason a theory can never fence its models in.
why this is the source of the multitude Compactness is the precise statement that first‑order truth is local: any obstruction to having a model would already be visible in some finite fragment. Turn that around and it becomes a licence for proliferation. To build a model with a strange feature, one need only ensure that every finite demand is jointly satisfiable; compactness then delivers a model meeting all the demands at once, however many, however infinite their conjunction would be. A theory cannot say "be finite," cannot say "be exactly this size," cannot say "contain no infinite elements," because each such constraint is a demand on the whole that no finite fragment can enforce. Every limit in this volume is compactness wearing a costume: the upward Löwenheim–Skolem theorem is compactness adding constants, the nonstandard models are compactness adding a number larger than all the others, and Lindström's theorem is the discovery that a logic with compactness cannot escape these consequences. The finiteness of proof, which in the diagonal corpus let provability obey its derivability conditions, here lets a theory's grip on its models slip irretrievably loose.
If a theory has one infinite model it has them in every infinite cardinality, and no sentence can tell them apart. The most famous consequence is a paradox that is not a contradiction — only a lesson about what "uncountable" can mean.
grow and shrink Two theorems, two directions, both preserving every first‑order truth. Downward Löwenheim–Skolem: any theory with an infinite model has a countable one — indeed an elementary substructure, built by closing a countable set under Skolem functions, the "hull" that keeps just enough elements to witness every existential the theory asserts. Upward Löwenheim–Skolem: any theory with an infinite model has models of every cardinality above the size of its language — add that many new constants with all‑distinct axioms, observe that every finite demand is met inside the original infinite model, and let compactness produce the rest. Between them, a theory with an infinite model has a model of every infinite size, all elementarily equivalent, none distinguishable by any sentence. The grow is the ultrapower; the shrink is the Skolem hull; and the structure's true cardinality is something the theory describing it can never feel.
the spectrum — a model of ZFC at every cardinality
The sharpest demonstration that a theory cannot pin down its models is also the most disorienting. If ZFC is consistent, downward Löwenheim–Skolem hands us a countable model of it. But ZFC proves Cantor's theorem — it proves "there exist uncountable sets." So the countable model contains an element x that the model itself certifies as uncountable, even though x, viewed from outside, has only countably many members. There is no contradiction, only a collapse of a word's absoluteness. "x is uncountable" means "there is no bijection between x and ω" — and the bijection that would refute it exists in the larger universe but not inside the countable model. The model is missing the function that would reveal x's true size, and so it sees x as uncountable. Cardinality, like provability in the diagonal corpus, turns out to be relative to the system that judges it: a structure cannot see beyond the functions it contains, and a first‑order theory cannot force it to contain them all. The multitude is not only large; it is internally deceived about its own scale.
Compactness builds a number larger than every number, and arithmetic acquires worlds it never intended. These nonstandard worlds are the exact place the diagonal's incompleteness becomes the multitude's disagreement — the deepest joint in the corpus.
a number past all numbers Add to Peano arithmetic a fresh constant c and the axioms c > 0, c > 1, c > 2, …, one for each numeral. Any finite batch of these is satisfied in the standard model ℕ — just take c larger than the largest numeral mentioned. So every finite subset has a model, and compactness delivers a model of the whole: a structure satisfying all of PA, in which c exceeds every standard number. It is a nonstandard model — the standard numbers sitting at the bottom, and above them, after a gap, blocks of "infinite" numbers stretching up. Arithmetic cannot rule them out, because ruling them out would require saying "every number is reached from zero by finitely many successors," and finitely many is not something first‑order can say. Build the number below, one axiom at a time, and watch it slip past the standard world.
building a nonstandard number by compactness
Now the two faces close into one. A sentence is independent of a theory exactly when the theory's models disagree about it — true in some, false in others — for if every model agreed, the completeness theorem would make it provable or refutable. Gödel's sentence G and the consistency statement Con(PA) are independent; so PA + ¬Con(PA) is consistent and has a model, and that model is necessarily nonstandard — it contains a number coding a "proof" of 0 = 1, a proof of nonstandard length, since no standard proof of contradiction exists. In the standard world ℕ, arithmetic is consistent and G is true; in that nonstandard world, ¬Con holds and G fails. The incompleteness proved by the diagonal — G true but unprovable — is, viewed from outside, precisely this: G holds in the intended model but not in all of them, and the unreachable truths are exactly the ones the nonstandard shadows deny. Completeness says a theory proves what holds in every model; incompleteness says some truths hold only in the intended one; and the daylight between "every model" and "the intended model" is the multitude. The mirror and the horizon were always the same gap, seen from the two sides of the satisfaction relation.
The nonstandard worlds exist, but none can ever be written down. The line between the standard model and its shadows is drawn by a single theorem, and it is the precise place where the semantic face meets the limits of computation that drove the diagonal.
existent, yet never effective Compactness conjures nonstandard models freely, but it conjures them non‑constructively — through an ultrafilter no algorithm can name. Tennenbaum's theorem reveals this is no accident of the method but a law: a nonstandard model of arithmetic can never be presented effectively. There is no nonstandard model of PA whose addition and multiplication tables are computable. The shadows are real — the model theory proves they exist — but their arithmetic is forever beyond any machine. And so the standard model ℕ, the one we meant all along, is recovered uniquely by a single extra demand: it is the only model of PA you can compute with.
Tennenbaum's theorem is the seam between this volume and the seven before it. The diagonal corpus ran entirely on effectiveness: the provability predicate is computably enumerable, the universal machine simulates all programs, the Gödel sentence is built by an effective diagonal. Effectiveness was the air it breathed. The multitude, by contrast, is profligate with non‑effective objects — ultrafilters, Skolem hulls, models of every cardinality. Tennenbaum stands exactly where the two meet and rules: the nonstandard models the multitude produces, though they exist, are barred from the effective world the diagonal inhabits. Add the computability constraint that the diagonal always silently assumed, and the entire multitude of nonstandard arithmetics vanishes, leaving ℕ alone — categorical at last, not by logic but by computation. The failure of first‑order logic to pin down ℕ (the multitude) and the power of computation to pin it down anyway (Tennenbaum) are the two faces of the limit shaking hands. What syntax could not enforce and semantics could not prevent, effectiveness decides — and that is why the standard model, unreachable by any sentence, is nonetheless the only one we can ever calculate in.
The capstone, and the exact mirror of the conservation law. The multitude's two great weaknesses are not weaknesses at all. They are the definition of first‑order logic — and any logic that escapes them ceases to be tractable in the same breath.
the defects are the definition Gather the limits of this volume and they sort into two properties. Compactness: what is finitely satisfiable is satisfiable. Löwenheim–Skolem: a theory with an infinite model has a countable one. Both look like failures — the logic too weak to enforce finiteness, too weak to fix cardinality. Lindström's theorem turns the verdict inside out. These two properties do not merely belong to first‑order logic; they characterise it.
Set Lindström's theorem beside the conservation law and the symmetry is exact. The conservation law said the diagonal's limits are inescapable: no consistent expressive system holds all four wishes — reflexivity, a rigid twist, factivity, the structural rules — and each foundational tradition is one surrender. Lindström's theorem says the multitude's limits are constitutive: no logic stronger than first‑order keeps both compactness and Löwenheim–Skolem, and each stronger logic surrenders one, forfeiting tractability with it. Two "no free lunch" theorems, one for each face of the limit. And the faces are one. The diagonal is a formal system unable to grasp itself; the multitude is a theory unable to grasp its models; and these are the two sides of the single gap between a formal system and the reality it reaches for — the gap between what can be said and what can be so, read once from inside the system and once from outside it. Incompleteness is the splitting of the multitude; the nonstandard shadows are the unprovable truths made visible; Tennenbaum patrols their border at the edge of computation; and Lindström and the conservation law are the same discovery in two keys — that the limits are not damage to formal reasoning but its shape. The system turned inward finds a fixed point it cannot escape. Turned outward, it finds a multitude it cannot reduce. They are the same cliff, and we have now stood at both its edges. The corpus is complete.
The diagonal was one face of the limit; this is the other. Where the diagonal turned a system inward to force a fixed point, the multitude turns a theory outward to find that its models cannot be counted, sized, or singled out. One engine drives it — the ultraproduct, with truth decided by an ultrafilter's vote, Łoś's theorem the exact mirror of Lawvere's. From it: compactness, the finiteness of satisfiability; Löwenheim–Skolem, models of every size and Skolem's paradox of relative uncountability; the nonstandard models, where incompleteness is revealed as the splitting of worlds; Tennenbaum, drawing the border at computability; and Lindström, who proves the limits are not defects but the definition of first‑order logic itself. The two faces interlock and turn out to be one — the unbridgeable gap between what a formal system can say and what is so, seen from inside it and from outside it. A system cannot fully grasp itself, and a theory cannot fully grasp its worlds, and these are the same necessity. ∏ Mi /U ⊨ φ ⟺ { i : Mi ⊨ φ } ∈ U — truth in the one is the vote of the many.