A Model Theory for the Potential Infinite

We present the model theoretic concepts that allow mathematics to be developed with the notion of the potential infinite instead of the actual infinite. The potential infinite is understood as a dynamic notion, being an indefinitely extensible finite. The main adoption is the interpretation of the universal quantifier, which has an implicit reflection principle. Each universal quantification refers to an indefinitely large, but finite set. The quantified sets may increase, so after a reference by quantification, a further reference typically uses a larger, still finite set. We present the concepts for classical first-order logic and show that these dynamic models are sound and complete with respect to the usual inference rules. Moreover, a finite set of formulas requires a finite part of the increasing model for a correct interpretation.

§1. Introduction. The aim of this paper is to present a model theory based on a potentialist's viewpoint, i.e., infinity is understood as a potential infinite. An introduction of this approach has been presented in [3]. In short, the usual formal language, in this paper first-order predicate logic, is directly interpreted in this model, whereby the domain of a universal quantifier is an indefinitely large, but finite set. A philosophical discussion of this concept has already been expounded by Shaughan Lavine in the Section "The Finite Mathematics of Indefinitely Large Size" in his book [4], based on Jan Mycielski's work about locally finite theories [8].
1.1. Motivation and Related Work. In [12] Shapiro and Wright considered the potential infinite as an indefinite extensible concept. Therein they state that "If a 'collection' is not a set, then it is nothing, has no size at all, and so can't be 'too big'" and ask: "The question, simply, is whether it is ever appropriate or intelligible to speak of all of the items that fall under a given indefinitely extensible concept". The authors come to the conclusion that there is no satisfying solution how to read such a quantification and refer to reflection principles as a possible answer. The interpretation that we present has this implicit reflection principle, with the characteristic that the use of the phrase "for all elements . . . " may immediately change the state of the indefinitely extensible collection.
Let us shortly recap Dummett's understanding 1 of this notion in [2]: "An indefinitely extensible concept is one such that, if we can form a definite conception carrier (N i ) i∈N with N i := {0, . . . , i − 1}, but none of the sets N i is closed under the successor operation.
The key part of the interpretation is a notion of being indefinitely large, given as a relation C i between a list C = (i 0 , . . . , i n−1 ) of indices, called context, and the indefinitely large index i. The state at index i is a substitute for an absolute infinitely large state. The set {i ∈ I | C i} defines an indefinitely large region inside the system, replacing the single actual infinite state outside of M I . It is enough to test quantified propositions on elements in M i for such an indefinitely large index i whether these propositions are true or not. New elements in M i with i ≥ i do not change the truth values of the propositions.
The interpretation |= of a formula Φ is then replaced by |= , with relation as an additional parameter. The variable assignment a is taken from M C , leading to |= Φ[a : C]. The basic difference to usual interpretations is the reading of the universal quantifier: |= ∀xΦ[a : C] holds by definition iff (i.e., if and only if) |= Φ[ab : Ci] holds for all elements b ∈ M i for some i C, whereby ab denotes the list a, extended by b (and b is assigned to the variable x).
The reason for this definition is that the use of a potential infinite set does not permit us to speak about all elements in all stages M i , because it constitutes an increasing or "open" collection and the locution "all" has no fixed meaning. As a consequence, quantifiers in a formula refer to different stages of an increasing domain. In a formula, say ∀x 0 ∃x 1 Φ, the stage to which x 1 refers is typically larger than the one to which x 0 refers 3 . We show in Section 4.6 that the usual classical deduction rules are nevertheless sound and complete w.r.t. the interpretation in these models.
It is important to note that this form of potentialism is an ontological one, not an epistemological one. In particular, Hilbert's Program is concerned with the justification of classical mathematics by finitary reasoning. Constructive mathematics uses finite algorithmic procedures. We do not claim that there is an effective procedure to determine an indefinitely large finite state. We only assume that if an existential assertion is true, then there must be an instance for which the statement is true 4 . Even if the existential assertion is unbounded, nonetheless, this does not require completed infinite sets: If an existential assertion is true, it makes sense to go step by step until one finds the witness in 3 Hilary Putnam already used a similar idea in [11] with concrete graph models of Zermelo set theory. His aim was to show that an understanding of "mathematics as a modal logic" is equivalent to "mathematics as set theory". Putnam proposes an interpretation of a single formula in increasing graph models, without reference to a maximal model, in order to translate a set theoretic reading of a statement into a modal logic one. 4 Basically, we refer to the meta-level notion and use the equivalence of the following statements (for a property P on natural numbers): ∃n ∈ N P (n), and ∃n ∈ N i P (n) for some i ∈ N. This equivalence is used for the interpretation of Section 4.1. Moreover, we assume that existential and universal quantification are reducible to each other. On meta-level we use classical reasoning, on object-level we investigate classical logic. This corresponds to a "liberal potentialist" in [5], since we do not have a notion of knowledge at stage i ∈ I, e.g. knowledge of whether ∀n ∈ N P (n) holds or whether there is some counterexample. Nevertheless, our approach can be applied to Kripke models and intuitionistic logic as well, see Section 5.1. finitely many steps and then to stop there. Of course, the truth of the statement is not decidable by this procedure, but this is epistemological issue.
Compared to Kripke models, the set of nodes K in a Kripke model is usually not directed. When these models are used in order to show intuitionistic invalid propositions, then they often use different nodes without upper bound. Even more important is the fact that properties and relations in Kripke models might grow although the set of objects is the same. In a model presented here, if a property P does not hold at some stage i for a, it will not hold at a later state i ≥ i on a either. Finally, a Kripke model uses a quantification over all (possibly infinitely many) later states k ≥ k to interpret ∀xΦ at node k. By that, the quantification may use infinite sets of objects.
1.3. A Consequent Finitistic Reading. Sets on meta-level, such as the index set I or relation , are in most situations infinite, so the question arises, whether actual infinite sets are still used. Probably the presented concepts cannot be developed without them.
Let us first assume that the infinite sets on meta-level are actual infinite sets. Then the investigation shows how to develop potential infinite models and how to relate them to actual infinite Tarskian models. Such a comparison obviously requires the notion of an actual infinite set, at least the carrier set M of a Tarskian model is actual infinite (if it is infinite). It is natural then to assume that meta-level sets, such as the index set I, are actual infinite as well. This leads to a comparison as formulated in Lemma 2.8.
Nevertheless, Theorem 4.20 states that one never needs the whole, infinite model M I to interpret expressions. So if we do not compare potential infinite models to actual infinite models, we can avoid actual infinity on meta-level as well. There is however an unavoidable circularity, because a consistent presentation requires the understanding of the interpretation from the very beginning. Compared to other approaches, e.g. [5], there is no other language or concept as a "rock bottom", instead, the new interpretation affects its own presentation. A way to deal with this situation is that in a first reading, one may regard infinite on meta-level as actual infinite. If the idea, that an infinite set is always an indefinitely extensible system with indefinitely large intermediate states, is clear, a second reading is possible.
In this second reading one should from the very beginning view infinite sets as dynamic concepts with a context dependent extension. The context is given by the currently used expressions, objects, relations and states of these. The context on meta-level is left implicit and the paper shows that it is always possible to make the context explicit, justifying the assumption that such a context always exists. Applied to the meta-level, one would have to explicitly formulate the background-model and to formalize the language in which the concepts have been developed. As a consequence, the locution i ∈ I, for instance, is a syntactical expression which has an interpretation as an element i and an increasing predicate (I j ) j∈J , such that i ∈ I means i ∈ I j for a sufficiently large index j. Theorem 4.20 then states that the background-model is itself finite 5 (at any time), but adequate for all the expressions used to develop the model theory and to apply it to specific models of interest. This consequent finitistic approach does not compare the potential infinite models with actual infinite Tarskian models anymore, but dynamic models with intermediate and indefinitely large states of this dynamic model.
Although it is possible to apply the results to first-order ZFC set theory, this is not sufficient for a consequent treatment of mathematics with a potential infinite. A set in ZFC set theory is a single object a that represents a "real" set through the interpretation of the membership relation, which is in this model theory a potential infinite set. However, a potential infinite set is primarily not a single entity, but a family of states of this object. Higher-order logic introduces indefinitely extensible objects as objects of a higher type. These are different to single objects. For instance, a Cauchy sequence is an indefinitely extensible sequence of higher type whereas a real number is a single base type object.
1.4. Structure of the Paper. In Section 2 we develop the replacement of a static carrier set by a system M I and relations by families of relations. A Σ-structure (Σ a signature) becomes a Σ I -structure, whereby Σ I is a refinement of Σ. The system M I reflects the potentialist view on a set (and likewise on a relation) as indefinitely increasing. We also introduce a notion to express that an index set has "almost all" indices and extend this to contexts C = (i 0 , . . . , i n−1 ). We call these sets indefinitely large and they reflect the cardinal aspect of the potential infinite.
Section 3 introduces the core concepts. First we introduce relation , mentioned in Section 1.2, which corresponds to the ordinal aspect of infinity. For an infinite structure, is itself indefinitely large. Before we define the interpretation, we introduce an intermediate notion between syntax and semantics, that of an state declaration C | t : i (with i ∈ I) and C | Φ for terms t and formulas Φ. It uses relation for the quantifier and guarantees that the necessary approximation instances of the functions and relations are available for the interpretation. We define the interpretation only for expressions (i.e., terms and formulas) having such a state declaration, but show that for an indefinitely large model all expressions have such a declaration. Section 4 presents the main results. To ensure that the interpretation is sound, additional requirements on relation are necessary. Roughly, if i C holds, then the set M i must contain all witnesses of existential quantified formulas, given that the variable assignment is taken from M C . The construction is similar as in the proof of the Löwenheim-Skolem theorem. This is handled in Section 4.4. In Section 4.5 we show amongst other topics that the interpretation is independent of the chosen state declaration.
The main result is Corollary 4.17 and Theorem 4.20: The interpretation with reflection principle is sound and complete and it requires for a finite set of formulas T only a finite substructure M J (with J a finite index set) to interpret all formulas in T correctly -Mycielski proved this in [8] by translating formulas and using a common Tarskian semantics. In Section 4.8 we carry out the moment of a specific reference, but the set could increase and a further reference uses a larger (still finite) set. developed concepts by use of set theory as an example. Section 5 concludes the paper with further remarks, mainly possible modifications. §2. Indefinitely Extensible Structures. This section describes the first step towards a model theory with potential infinite sets, the use of a system instead of the static carrier set of a Tarskian model.
2.1. Systems. The mathematical formalization of an indefinitely extensible structure is based on a system 6 , having several stages. This is a family of sets such that each M i is finite. The set I of indices or stages is a non-empty directed set with a preorder ≤ such that M i ⊆ M i holds for i ≤ i . We use the abbreviation ↑ i := {i ∈ I | i ≥ i}. In order to be in line with the common definition of a model, at least one set M i must be non-empty.
The main example is N N = (N i ) i∈N , whereby the index set N is equipped with the usual order ≤ and N i denotes {0, . . . , i − 1}. A further example is P N = (P i ) i∈N with P i = P(N i ). Here P(N i ) refers to the powerset of N i . Moreover, each finite set M is such a family in a trivial way: The index set is any singleton set, say I = { * }, and M * := M. The interesting situation is when I is unbounded, but we do not exclude the case that I is a fixed finite set. In that case a greatest element j ∈ I and a comprehensive set M j exists.
A list of indices C = (i 0 , . . . , i n−1 ) ∈ I n is called context, or more specifically state context. The empty context is denoted as () and Ci is the result of adding the index i to an existing context C. M C stands for M i0 × · · · × M in−1 and ↑ C for ↑ i 0 × · · · × ↑ i n−1 . Moreover, C ≤ C is defined pointwise for two contexts of the same length.
2.2. Indefinitely Many Elements. Many of the subsequent concepts need a notion of "infinitely many" indices. Cofinality of a set J ⊆ I is a weak notion of infinity, e.g., the intersection of two cofinal sets can be empty. What is required is a stronger notion, one which roughly states that finally all elements are in that set. Moreover, this notion must apply to contexts.
Consider a set H ⊆ I n × I of contexts as a n-ary multivalued function C → {i ∈ I | Ci ∈ H} that provides possible extensions of a context C ∈ I n . We are interested in those H that have sufficiently many values i for sufficiently many arguments C ∈ I n . This idea is formalized in the next definition by sets D n+1 . Therein up-set means a non-empty, upward closed set.  6 The family M I is a special case of a direct system. When extending the approach to higher-order logic, also inverse systems and more general notions of a system are required.
A family H N := (H n ) n∈N with H n ⊆ I n is indefinitely large or has indefinitely many contexts iff H n ∈ D n for all n ∈ N.
For a family H N = (H n ) n∈N we shortly write C H for C Hn+1 if C ∈ I n . The next proposition is essential, but its proof is straightforward.
Proposition 2.2. For all n ∈ N, the set D n is a (proper) filter. Each set H ∈ D n is cofinal and ↑ C ∈ D n holds for all C ∈ I n .
Each set H n ⊆ I n can be extended to a family H N in a natural way: Lemma 2.4. If H n ∈ D n , then the family H N generated by H n is indefinitely large. Moreover, Proof. We show H m ∈ D m for m ≤ n inductively on n − m and for m ≥ n inductively on m: The case m = n holds by assumption. For m < n we have The claim then follows from the induction hypothesis H m ∈ D m . Property (1) is obvious.
Operations and relations on families of sets are defined pointwise, for instance, 2.3. The Structure on Systems. In order to make the system M I a firstorder model, we need to define functions and relations on it. To simplify the presentation we use relations only.
The requirement H = ∅ in this definition is quite weak. However, we do not require the stronger condition of being indefinitely large in the general definition, since finite structures do not necessarily satisfy them (cf. Section 4.7).
The notion of a signature Σ in the common Tarskian semantics is refined to a signature Σ I . It consists of assignments R : C for relation symbols R in Σ, if C is of length arity(R), such that each relation symbol R has at least one assignment R : C. If not mentioned otherwise, the signature Σ I simply contains R : C for all state contexts C of length arity(R).
Definition 2.7. Given a signature Σ I , based on Σ. A Σ I -structure is a family M I (as introduced in Section 2.1) and a map assigning to each assignment R : C an instance R C ⊆ M C of a relation R H (with C ∈ H and H ⊆ I n ). We call Σ I indefinitely large 7 iff {C ∈ I n | R : C} ∈ D n for each n-ary relation symbol R in Σ I .
To each Σ-structure M there are associated Σ I -structures M I and vice versa: Conversely, given a Σ I -structure M I with relations R H , then the union of all elements M := i∈I M i together with relations R := C∈H R C defines a Σ-structure.
The simplest way to construct a Σ I -structure from a Σ-structure is by choosing an index set I which is isomorphic to P f in (M), the set of all finite subsets of M, together with relation ⊆. The example N N shows that the index set need not be the whole collection P f in (M), but it can be a well-ordered part of it. There are however situations in which this is not possible (or requires at least the well-ordering theorem) 8 . §3. State Declarations. In this section we give the prerequisites that are necessary to define for a formula Φ the interpretation |= Φ[a : C]. A peculiarity of this interpretation is that it can be applied only to formulas Φ having an state declaration C | Φ. Intuitively, C | Φ says that the formula Φ has a meaning relative to context C.
The language L that we consider is that of a first-order predicate logic of signature Σ. We assume that there is a fixed sequence x 0 , x 1 , . . . of variables, the constant ⊥, the primitive connectives →, ∧, ∨ and quantifiers ∀, ∃. We apply the usual abbreviations, for instance, ¬Φ for Φ → ⊥ and for ¬⊥. We use relation symbols only (function symbols and terms are treated shortly in Section 5.1).
To each expression we explicitly add the list of free variables, which is always a list of the form (x 0 , . . . , x n−1 ), whereby quantifiers bind the last 9 variable of the list. We will write as usual Φ(x 0 , . . . , x n−1 ) to indicate this and sometimes we 7 It may be the case that I is infinite but i∈I M i is nevertheless finite. Then the signature Σ I of a structure M I can be indefinitely large by this definition, although the whole structure is finite. This does not lead to problems, however, we can also ignore these kind of structures because, if M := i∈I M i is finite, they can be replaced by a trivial structure with I = { * } and M * = M. 8 For instance, the set P f in (R) is an uncountable collection without a well-ordered subset having R as its union. 9 This kind of convention is sometimes called "inverse (or dual) de Bruijn notation" or "de Bruijn levels". The order x 0 , x 1 , . . . corresponds to the order of bound variables in a formula which allows a straightforward mapping of variables to positions in a context and in a variable assignment a = (a 0 , . . . , a n−1 ). That is, a k is assigned to x k in a formula Φ(x 0 , . . . , x n−1 ). We especially use this advantage when we present an extended example in Section 4.8. call these expression "n-ary". We often omit the subscript of a variable, simply writing x.
3.1. The Indefinitely Large Relation. The core concept in order to interpret a formula in a potential infinite structure M I is the notion of an "indefinitely large finite" or a "relative infinite", given by the notion of a -relation. (1), i.e., Ci ∈ n+1 implies C ∈ n for all n ∈ N. An element C ∈ n in a -relation is a -context (of length n).
We use infix notation, i.e., Ci ∈ n+1 is written as C i, including () i for i ∈ 1 . Then C is the set {i ∈ I | C i} and we sometimes write i k for all 0 ≤ k < n. The set C corresponds to an indefinitely large region and if C = ↑ h, then we call h the horizon, see the figure below. The intuition is that the number of objects and means at the current stage, given by the context C, is finite, and an indefinitely large (or sufficiently large) index i C is beyond the scope that we can overlook from there.
sufficiently large index i current context C indefinitely large region So far we have not defined what exactly it means that an index i is indefinitely large relative to a context C. This will be done in Section 4.2. For infinite structures M I we will later assume that is indefinitely large in the sense of definition 2.1. A trivial example of an indefinitely large -relation is I * = (I n ) n∈N . We already have, and we later will call mathematical concepts "indefinitely large" if the set of involved states is in the filter D n . These are: 5. Σ I -models (M I , |= ) iff Σ I and are indefinitely large, Def. 4.1. One of the task is to show that the notion of being indefinitely large transfers from one concept to the next.
3.2. Defining the State Declarations. Assume the model is using the extensible structure N N of natural numbers and let Φ(x 0 , x 1 ) be the formula x 0 + 1 ≤ x 1 . Here we use a function symbol + that we have not introduced yet, but we look at it shortly in Section 5.1. In order to interpret the formula we have to select states i 0 ∈ I and i 1 ∈ I for the variables x 0 and x 1 . The variable assignment (a 0 , a 1 ) will then be taken from N i0 × N i1 . To interpret the constant 1 requires at least N 2 , and to interpret x 0 + 1 requires at least N i0+1 .

The interpretation of formula Φ then uses an instance
In order to make sure that we have the instances of (functions and) relations that are large enough for an interpretation, we introduce a binary relation between a context C ∈ I n and a formula Φ(x 0 , . . . , x n−1 ), written as C | Φ. For terms t, in particular variables, we introduce a ternary relation C | t : i between a context C ∈ I n , a term t and an index i ∈ I.
Definition 3.2. Given a signature Σ I and a -relation . The state declarations C | x k : j and C | Φ are relations between a variable x k , a -context C of length n and an index j ∈ I, resp. between a formula Φ(x 0 , . . . , x n−1 ) and -context C of length n. State declarations are defined recursively on Φ.
The relation C | ⊥ holds for all -contexts C. An expression is called approximable (in Σ I with ) if there is some state declaration for it. Likewise, a set of expressions is called approximable if all expressions therein are approximable. We call the set of declaration for a formula Φ indefinitely large iff {C ∈ I n | C | Φ} ∈ D n .
Remind that by Definition 3.1, if Ci is a -context, then C is a -context, too. If the language has no function symbols, the terms t k in Definition 3.2 are all variables. Expressions usually have several state declarations, and for the same declaration C | Φ there may also be several ways how it has been derived, i.e., there could be different declarations for subformulas.
One might compare a state declaration with a common type declaration Γ | t : σ of a term t (having type σ in the type context Γ). A type declaration adds further information to terms in order to rule out meaningless terms and to interpret them properly. Similarly, a state declaration C | t : i adds the necessary state information that is necessary to interpret the terms dynamically (and similarly the formulas). In both cases the declarations are constraints to yield meaningful expressions only, as well as to define their meaning. The next lemma roughly states that in an infinite structure all formulas are approximable with infinitely many contexts. In particular, each formula is approximable.
Proof. By induction on Φ. For atomic formulas we show that C | Rt 0 . . . t m−1 holds for each -context C of length n. Firstly, the set {C ∈ I m | R : C } is in D m by assumption. Secondly, the set of all (j 0 , . . . , j m−1 ) with C | t 0 : j 0 , . . . , C | t m−1 : j m−1 is an up-set and hence in D m . Since their intersection is in D m , and thus non-empty, we have a context C = (j 0 , . . . , j m−1 ) with R : C and C | t k : j k . This shows C | Rt 0 . . . t m−1 .
The claim for the connectives follows directly from the filter property (Proposition 2.2). For the quantifier we have by definition In order to show {C ∈ I n | C | ∀xΨ} ∈ D n it suffices to show that both sets on the r.h.s. are in D n . By induction hypothesis {Ci ∈ I n+1 | Ci | Ψ} ∈ D n+1 and hence {C ∈ I n | {i ∈ I | Ci | Ψ} ∈ D 1 } ∈ D n . The set {C ∈ I n | C ∈ D 1 } is in D n since n+1 ∈ D n+1 holds by assumption.
The next definition is used in Section 4.7. Its main application is for an infinite set I with a finite subset J ⊆ I. From this definition it follows immediately that any set J ⊆ I with J ⊆ J is again a possible restriction for T . The required index set J is C|Φ∈T + J C|Φ ∪I 0 ∪{j} with j ∈ I an upper bound of this set. The sole role of index j is to make J a directed set. The way the indices have been selected guarantees that the state declaration of C | Φ ∈ T + is also a state declaration in Σ J .
In some situations it is possible to select a single -context of length n such that each n-ary formula is approximable with this single context: Example 3.6. For each relation symbol R ∈ Σ let the signature Σ I contain R : C for all contexts C of the length arity(R). Moreover, Σ shall have no function symbols. Assume that is such that we can define functions ι n , selecting a specific index from C (n the length of C) as follows:

This is for instance possible if
is indefinitely large and n ⊆ d n ( n+1 ) holds, i.e., C ∈ D 1 for all -contexts C. The latter may not be the case in general. Then each context (i 0 , . . . , i n−1 ) is a -context and  is a function with two arguments, first, a variable in a state context C | x k : j, i.e. the triple (C, x k , j), and second, a variable assignment a = (a 0 , . . . , a n−1 ) ∈ M C . Its value is in M j . The interpretation of a formula |= is a relation between a formula in a state context C | Φ and a variable assignment a = (a 0 , . . . , a n−1 ) ∈ M C .
[[x k ]] j a:C := a k for C = (i 0 , . . . , i n−1 ) and C | x k : j. It is important to note that Definition 4.1 is at this stage too general as to be useful. The interpretation of a formula Φ depends by definition on the state declaration of Φ and could be different for different declarations. It is vital to have suitable restrictions on the relation , call adequate (see Definition 4.10). The next example is one of many which shows the provisional nature of the definition so far. In contrast to the universal quantifier, the interpretation of the existential quantifier uses the locution "for all i ∈ I", so i does not range over a fixed finite collection 10 . In Section 4.5 we will see that it possible to replace "for all i ∈ I" by a single index i ∈ I. It is easy to confirm that the interpretation |= becomes the usual Tarskian interpretation |= if the system consists of one single set M i . Then i n must be a -context for all n ∈ N and the structure must be finite then.

How to Find Sufficiently Large Indices.
Our aim is to show that propositions Φ interpreted by |= have the same truth value as in the usual Tarskian model and are thus independent of the chosen state declaration. Additionally, the value [[Φ]] will then be a (compatible) relation in the sense of Definition 2.6. The technique which we apply for this purpose has been used in various ways, most notably in the Löwenheim-Skolem theorem. Basically, we must guarantee that an index i C is as large as to embrace all witnesses of valid existential quantified formulas in scope.
We may describe the notion C i also as the use of "means". If C defines the current stage, then the elements of consideration are inside M C , in particular all assignments a are within C. If we claim ∀x n Φ(x 0 , . . . , x n ), then we only have to make sure that we consider all elements b, replacing x n , that are reachable by the means applied to the current stage M C , with a 0 ∈ [[i 0 ]], . . . , a n−1 ∈ [[i n−1 ]] replacing x 0 , . . . , x n−1 for C = (i 0 , . . . , i n−1 ). These means are given by a set of relations such that at each stage there is only a finite set S of them. All relations in S are moreover definable from a finite set T ⊆ L of formulas 11 . So the construction only needs the definable relations.
This yields the following chain -we add the subscript T to S and in order to indicate the dependency from the set T : To getT from T , first replace each occurrence of ∀x in T by ¬∃x¬. Then add all subformulas resulting in the setT , which is finite whenever T is. We will introduce the other notions soon.
4.3. Avoiding a Circularity. The step from a set of formulas T to the set of relations S T = {[[Ψ]] | ∃xΨ ∈T } already requires an interpretation. The natural choice would be to take the interpretation |= . But then we already need an adequate relation before we define the properties that we require from . In order to avoid this circularity, define an auxiliary interpretation |= m , which does not use relation and which yields the same truth values as |= for formulas in T .
Let the state declaration be that from Definition 3.2 but without condition i C in case of the quantifiers, i.e., we take the trivial -relation I * . It is easy to confirm that for an indefinitely large signature Σ I the assignment C | Φ holds for any context C of length n and any n-ary formula Φ (the proof is similar as for Lemma 3.3, but simpler). In other words, each formula Φ is approximable in Σ I with I * . The interpretation |= m is as |= , but with the quantifiers adopted 11 If L contains function symbols, then we have to add terms to L and functions to S.

Witnesses of Existential Quantified Formulas.
Given an n + 1-ary relation R H and an element a ∈ M C for a context C of length n. The following sets play a key role: This set is in any case non-empty. In a next step we define a -relation R from this set. First define ( R ) n+1 by and let R be the -relation generated by ( R ) n+1 (see Definition 2.3). Note that R is indeed a -relation by Lemma 2.4, i.e., Ci ∈ ( R ) m+1 implies C ∈ ( R ) m for a context C of length m. Lemma 4.6. If R H is an indefinitely large n + 1-ary relation, then R is an indefinitely large -relation.
Proof. By Lemma 2.4 it suffices to show ( R ) n+1 ∈ D n+1 , that is By assumption we have {C ∈ I n | C H ∈ D 1 } ∈ D n since H ∈ D n+1 . Furthermore, ↑ i ∩ C H ⊆ I R (a : C) holds for any a ∈ M C and i ∈ I R (a : C): In the first case of definition (2), R Ci (ab) implies R Ci (ab) for all i ≥ i with Ci ∈ H by compatibility of R H ; for the "otherwise case" this holds trivially.
Therefore, if C H ∈ D 1 then I R (a : C) is also in D 1 and we conclude that {C ∈ I n | I R (a : C) ∈ D 1 } ∈ D n . This holds for all finitely many a ∈ M C , hence Property (4) follows from the fact that a∈M C I R (a : C) ∈ D 1 holds iff I R (a : C) ∈ D 1 for all a ∈ M C .
To a set S of relations on a system M I , define S by It follows immediately from Lemmata 4.6 and 2.5: Remind thatT results from T by replacing each occurrence of ∀x in T by ¬∃x¬ and then adding all subformulas. Let the relation S T be abbreviated by T .
Example 4.8. Let T consist of the single formula ∃x 1 Rx 0 x 1 and consider the structure N N . The interpretation of R shall be "x 0 + x 1 is a perfect number", the first of them are 6 and 28. The relevant relation in since the sets ↑ 7 to ↑ 1 stem from assigning 0 up to 6 to a 0 , while ↑ 22 is needed for a 0 = 7 (note that P 29 (7 + 21) holds and 21 ∈ N 22 ). Hence we have 8 T 22 and (8, 22) is thus a -context. Remark 4.9. If we consider a set of valid sentences T , as for instance axioms, then only the restricted occurrences are relevant, i.e., the positive occurrences of ∃x and the negative occurrences of ∀x, since for other occurrences no witness (or counterexample) exists. So instead of replacing each occurrence of a universal quantifier to yieldT , it is enough in that situation to only translate negative occurrences of ∀x.

Adequacy.
We are now ready to define the necessary restriction onrelations in order to get a correct interpretation. This section contains the central result, Proposition 4.12, from which the final theorems follow easily. A simple consequence of this definition is that if a -relation on I is adequate for T , then its restriction to a subset J ⊆ I is also adequate for T . Lemma 4.11. Given an indefinitely large signature Σ I and a finite set T of formulas. Then there is an indefinitely large -relation that is adequate for T .
Proof. Take the relation T , which is adequate for T , and use Corollary 4.7 to show that T is indefinitely large. Firstly, S T is a finite set of relations since T is finite. Secondly, all relations in S T are indefinitely large (as a consequence of Lemmata 4.4 and 4.5).
Note that this is different to a situation in which a relation exists which is adequate for the set L of all expressions. For instance, for a model (N N , |= ) of arithmetic there is no such -context except (). This is due to the fact that L contains the valid formulas ∃x 0 x 0 ≥ n for each n ∈ N, and n∈N I ∃x0 x0≥n = ∅.
The next proposition states that within T the interpretations |= and |= m are the same and they coincide with the usual validity in Tarskian semantics. Let M I be the structure with underlying set i∈I M i , defined in Section 2.3.
Proposition 4.12. Given a model (M I , |= ), adequate for a set T of formulas. Then for each Φ ∈ T , each -context C with C | Φ and each variable assignment a ∈ M C we have Proof. Consider in the beginning the situation that T is closed under subexpressions and does not contain a universal quantifier. The equivalence is shown by induction on C | Φ and the only interesting case is the existential quantifier Φ = ∃xΨ. The implication "|= ⇒ |= m " follows from the fact that for allcontexts C there is an index i C, since the declaration C | ∃xΨ presupposes Ci | Ψ with some i C. Next we show the implication "|= m ⇒ |= ", i.e., there is j ∈ I such that ∃b ∈ M j |= m Ψ[ab : Cj] implies ∃b ∈ M i |= Ψ[ab : Ci ] for all i C.
Given a ∈ M C . Formula ∃xΨ is an element of T =T , hence R := [[Ψ]] m is an element of S T . We must prove ∃b ∈ M i |= Ψ[ab : Ci ] for all i C. By induction hypothesis this is the same as ∃b ∈ M i R Ci (ab ) for all i C. Every index i with C i satisfies C T i since |= is adequate for T , hence C R i . Consequently, i ∈ I R (a : C). By assumption there is an index j ∈ I such that ∃b ∈ M j R Cj (ab). Therefore, by definition of set I R (a : C), there is an element b ∈ M i with R Ci (ab ).
So we are finished for the case that T is closed under sub-expressions and does not contain a universal quantifier. The general situation is reduced to the just proven one by noticing that T is the same as T (or by using the fact that ∀x can be reduced to ¬∃x¬ for both interpretations). The second equivalence has been stated in Lemma 4.5. This proposition has useful consequences. First of all it shows that an interpretation |= , which is adequate for T , does not diverge from the common interpretation in a Tarskian model, as long as formulas are taken from the set T . For formulas outside T there will surely be differences. From a potentialist's point of view however, T is at most potential infinite, and the substitute for talking about the whole set T is to specify a sufficiently large finite set of expressions, so there is no "outside".
Secondly, the interpretation |= is independent of the chosen state declaration and the way it has been derived. This follows from the equivalence M I |= Φ

Proof. Compatibility of [[Φ]] is a consequence of the following equivalences
As a further consequence from Proposition 4.12 we have an alternative definition for |= (∃xΦ)[a : C], that is, |= Φ[ab : Ci] holds for an element b ∈ M i for some i ∈ I. This follows immediately from Proposition 4.12 and the interpretations of ∃xΦ with respect to |= m and |= resp. Basically this states the irrelevance of the outer quantifier, be it ∃i C or ∀i C or a fixed i C. This is indeed an essential property of an index being "sufficiently large". The next corollary expresses this irrelevance of the index i C: Corollary 4.14. Given a set T of formulas with Φ ∈ T , a model (M I , |= ) adequate for T , and a -context C with C | Φ. Then for any i C and any variable assignment a ∈ M C we have

Soundness and Completeness.
In this section we show that the constructions of Σ-models out of Σ I -models and vice versa preserve validity. As a consequence, the usual deduction rules of classical first-order predicate logic are sound and complete with respect to the collection M ind of all (indefinitely extensible) Σ I -models. Thereby we not only have to vary 13 on the set of models, but also on the index set I and relation .
Let T be a set of sentences (of a language L of signature Σ I ), which is no restriction since we may consider the universal closure of an open formula. We write M ind |= T to mean that M I |= Φ holds for all formulas Φ ∈ T and all Σ I -models (M I , |= ) ∈ M ind , adequate for T . Note that in M ind |= T , the suffix is "generic", not referring to a specific relation. Let M T ar be the collection of all usual Tarskian models for a given signature Σ and M T ar |= T denote M |= Φ for all (M, |=) ∈ M T ar and Φ ∈ T . The following corollary follows immediately from the proposition above. This is obviously the basis of a soundness and completeness result by applying the corresponding theorems for Tarskian models 14 . From a potentialist's viewpoint, either T is a fixed finite set and we apply Corollary 4.16 to it. Or, if the set T is potential infinite, we use some (indefinitely large) finite subset of it and again apply Corollary 4.16.
Corollary 4.17. From a potentialist's viewpoint, the interpretation |= is sound and complete with respect to the collection M ind of all indefinitely extensible models and a common deductive system of classical first-order predicate logic.

A Finite Submodel.
Let a set of formulas T be given as well as a Σ I -model (M I , |= ), adequate for T . There is a submodel of M I that suffices to interpret the formulas in T correctly. This submodel is finite, whenever T is. Let us call a structure M J of signature Σ J a substructure of a Σ I -structure M I iff J ⊆ I and Σ J consists of those R : C in Σ I , for which C ∈ J n holds. That is, the interpretation of R ∈ Σ as a relation R H in M J is a subset of instances from the interpretation in M I .
If (M I , |= ) is a Σ I -model and J is a possible restriction for T (see Definition 3.4), then each formula approximable in Σ I is also approximable in Σ J and thus has an interpretation |= in the structure M J . The -relation used for the interpretation in M J is the restriction of that in M I to J . We will first show that a substructure M J of M I is automatically a T -submodel in that case. Proof. We show (5) by induction on the state declaration C | Φ. Since the satisfaction relation is independent of the state declaration and the way it has been derived (see Section 4.5), we may assume that the same declaration C | Φ (with the same derivation) as for M J has been used for M I as well.
This immediately yields the equivalence for atomic formulas Rt 0 . . . t m−1 . For Φ → Ψ, Φ ∧ Ψ, and Φ ∨ Ψ the claim follows straightforwardly from the induction hypothesis, so consider ∃xΨ. By induction hypothesis we have for all ab : Ci, with the index i ∈ J , i C, used in the derivation Ci | Ψ: We can use Corollary 4.14 on both sides of the equivalence to get the equiva- which is the same in M I as in M J . 4.8. Extended Example: Set Theory. Shaughan Lavine considered in [4] ZFC set theory and called the finitistic translation of the axiom of infinity (by adding bounds to the variables) "Axiom of a Zillion". In our approach the axiom of a zillion is the usual axiom of infinity, but interpreted in an increasing model. The signature Σ of the language of set theory has two binary relation symbols (membership) and = (equality). Consider a set universe 15 V with index set I = P f in (V) and V i = i. The signature Σ I over Σ consists of : (i 0 , i 1 ) and = : (i 0 , i 1 ) for all i 0 , i 1 ∈ I. We use common abbreviations, e.g., 0 := ∅, 1 : Let the ZFC axioms be given in an enumerated form. As mentioned in Remark 4.9, it suffices to avoid only the negative occurrences of universal quantifiers in order to yield setT . Let the first 5 axioms -already formulated without negative occurrences of universal quantifiers -constitute set T . Assume these are: Empty := ∃x 0 ∀x 1 ¬x 1 x 0 (an instance of the separation schema).
Order the formulas inT (consisting of the five axioms and all its subformulas) according to the length of the context in which they occur. Then we find a possible index for which the first case of Definition (2) applies. Note that x 0 ranges over V i0 , x 1 over V i1 and so on. The relevant formulas inT are the existential assertions: P ω refers to the power set of ω (which are both single elements in V). Let us look more closely at the contexts of length 2: The elements 0, ω and 2 in i 2 are witnesses for the formula ∃x 2 x 2 x 0 x 1 ; for instance, 2 witnesses the difference of ω and 1, if ω is assigned to x 0 and 1 to x 1 . The pair-sets 2, {0, P ω}, {ω, 1} and {ω, P ω} stem from ∃x 2 Ψ pair , the last formula ∃x 2 x 2 x 0 ∧ x 2 = suc x 1 only requires the witness 2 again (due to assigning ω to x 0 and 1 to x 1 ). These indices satisfy () T i 0 , i 0 T i 1 , (i 0 , i 1 ) T i 2 and (i 0 , i 1 , i 2 ) T i 3 . The finite model V J with J = {i 0 , i 1 , i 2 , i 3 , j} and j = i 0 ∪ i 1 ∪ i 2 ∪ i 3 , is a T -submodel of V I .
Adding more and more axioms and instances of schemata increases the finite model. If we do not add all (actual) infinitely many instances of the schemata at once, we can still use an "infinite" element ω inside the investigated model, but interpret it as potential infinite in the background model by an increasing family of finite, "real" sets {b ∈ V i | b (i,i) ω} at stage i. For instance, the element ω at stage i 2 is {0, 2} and {0, 1} at stage i 3 . §5. Further Remarks. There are some immediate variations, which we shortly mention.
5.1. Some Adoptions. An obvious and simple generalization is attained by using a typed or sorted first-order logic. Another generalization is attained by replacing subset inclusion by embeddings emb i i : M i → M i for i ≤ i , which are not necessarily injective. One uses the direct limit instead of the union in all constructions. This includes further examples e.g. syntactical ones in which terms are identified at a larger stage.
A transfer to intuitionistic logic with Kripke models is also possible, but requires more effort. This model has two index sets, the preorder of epistemic states (the Kripke frame) and the directed set I of ontological states, used here. A relation R in a Kripke structure is then a family of sets R k C with k a node and C a context. They satisfy R k C (a) ⇐⇒ R k C (a) for a ∈ M C ∩ M C on the one hand and the weaker requirement R k C (a) ⇒ R k C (a) for k ≤ k and a ∈ M C on the other hand.
Notice that we never required the property that a -context (i 0 , . . . , i n−1 ) satisfies i 0 ≤ · · · ≤ i n−1 . This is not necessary, but it can easily be achieved: Add · · · ∩ 0≤k<n ↑ i k , for C = (i 0 , . . . , i n−1 ), to the right hand side in the Definition (3).
One may as well allow terms and functions f H := (f C→j ) Cj∈H with finite maps f C→j in a straightforward way. The state declaration C | t : j and interpretation [[t]] j a:C ∈ M j for an n-ary term t, context C ∈ I n , index j ∈ I and assignment a ∈ M C is C | ft 0 . . . Instead of finite, we may use the notion of a definite collection -we avoid the notion "small" due to its misleading connotation of size. These definite collection are defined by closure properties. An indefinite collection is simply a collection that is not definite. Being finite is the least notion of definiteness, whereas the natural reading in set theory is "definite = size of a set" and "indefinite = size of a proper class", including the example of the cumulative hierarchy V On (with the class of ordinal numbers On as index set and V α being the α's rank of this hierarchy). A further example is that definite refers to countable sets. In that case we may see the Löwenheim-Skolem theorem as a special case of the construction described here. For a structure M I , the index set I must then be directed with respect to definite sets, that is, for each non-empty definite subset J ⊆ I of indices an upper bound of J exists in I, and M I must be locally definite, i.e., all sets M i are definite. With these adoptions, all statements and proofs are carried over easily to this more general situation.

Conclusion and Further
Work. This paper presents a first step to develop a consequent view of infinity as a potential infinite, that does not require any restrictions of logical inferences. We presented the approach for classical first-order logic as a blueprint for other logics. The core concepts are a formalized notion of an indefinitely large state and a state declaration for expressions. Both concepts allow an interpretation of the universal quantifier that refers to finite sets only.
In order to use it for a larger part of mathematics we have to deal with functions and relations as objects. This requires (potential) infinite objects, which can be accessed only by their approximations. We will extend this approach to a fragment of simple type theory, which includes classical higher-order logic. This requires a more general notion of a system, not only a direct system, and a general notion of a limit of this system. A further challenge is the extension to intuitionistic higher-order logic.