reserve x,y,z for Variable,
  H for ZF-formula,
  E for non empty set,
  a,b,c,X,Y,Z for set,
  u,v,w for Element of E,
  f,g,h,i,j for Function of VAR,E;

theorem
  E is epsilon-transitive implies E |= the_axiom_of_extensionality
proof
  assume
A1: X in E implies X c= E;
  E |= All(x2,x2 'in' x0 <=> x2 'in' x1) => x0 '=' x1
  proof
    let f;
    now
      assume
A2:   E,f |= All(x2,x2 'in' x0 <=> x2 'in' x1);
      f.x0 = f.x1
      proof
        thus for a being object holds a in f.x0 implies a in f.x1
        proof let a be object;
          assume
A3:       a in f.x0;
          f.x0 c= E by A1;
          then reconsider a9 = a as Element of E by A3;
          set g = f+*(x2,a9);
A4:       g.x1 = f.x1 by FUNCT_7:32;
          for x st g.x <> f.x holds x2 = x by FUNCT_7:32;
          then E,g |= x2 'in' x0 <=> x2 'in' x1 by A2,ZF_MODEL:16;
          then
A5:       E,g |= x2 'in' x0 iff E,g |= x2 'in' x1 by ZF_MODEL:19;
          g.x2 = a9 & g.x0 = f.x0 by FUNCT_7:32,128;
          hence thesis by A3,A5,A4,ZF_MODEL:13;
        end;
        let a be object such that
A6:     a in f.x1;
        f.x1 c= E by A1;
        then reconsider a9 = a as Element of E by A6;
        set g = f+*(x2,a9);
A7:     g.x1 = f.x1 by FUNCT_7:32;
        for x st g.x <> f.x holds x2 = x by FUNCT_7:32;
        then E,g |= x2 'in' x0 <=> x2 'in' x1 by A2,ZF_MODEL:16;
        then
A8:     E,g |= x2 'in' x0 iff E,g |= x2 'in' x1 by ZF_MODEL:19;
        g.x2 = a9 & g.x0 = f.x0 by FUNCT_7:32,128;
        hence thesis by A6,A8,A7,ZF_MODEL:13;
      end;
      hence E,f |= x0 '=' x1 by ZF_MODEL:12;
    end;
    hence thesis by ZF_MODEL:18;
  end;
  then E |= All(x1,All(x2,x2 'in' x0 <=> x2 'in' x1) => x0 '=' x1) by
ZF_MODEL:23;
  hence thesis by ZF_MODEL:23;
end;
