Class choice and the surprising weakness of Kelley-Morse set theory

Kelley-Morse set theory KM is weaker than generally supposed and fails to prove several principles that may be desirable in a foundational second-order set theory. Even though KM includes the global choice principle, for example, (i) KM does not prove the class choice scheme, asserting that whenever every set $x$ admits a class $X$ with $\phi (x,X)$, then there is a class $Z\subseteq V\times V$ for which $\phi (x,Z_x)$ on every section. This scheme can fail with KM even in low-complexity first-order instances $\phi$ and even when only a set of indices $x$ are relevant. For closely related reasons, (ii) the theory KM does not prove the Łoś theorem scheme for internal second-order ultrapowers, even for large cardinal ultrapowers, such as the ultrapower by a normal measure on a measurable cardinal. Indeed, the theory KM itself is not generally preserved by internal ultrapowers. Finally, (iii) KM does not prove that the ${\mathrm{\Sigma }}_n^1$ logical complexity is invariant under first-order quantifiers, even bounded first-order quantifiers. For example, $\mathrm{\forall }\alpha <\delta \psi (\alpha ,X)$ is not always provably equivalent to a ${\mathrm{\Sigma }}_1^1$ assertion when $\psi$ is. Nevertheless, these various weaknesses in KM are addressed by augmenting it with the class choice scheme, thereby forming the theory KM+, which we propose as a robust KM alternative for the foundations of second-order set theory.