Maximum and Envelope Theorems

Y. Eddie Lu, Summer 2026

ECON 8001 course index · Chapter 4, Sections 4.6–4.7

Orientation

What problem do these theorems solve?

An optimization problem has two moving parts: an objective and a feasible set. When a parameter changes, one wants to know whether an optimum still exists, whether its value changes smoothly, and whether the optimizing choices move stably. These are different questions.

• The maximum theorem turns continuity of primitives into stability of a value and upper hemicontinuity of the argmax correspondence.
• The envelope theorem differentiates the optimized value. It explains why derivatives of an optimizer often disappear from the derivative of the value.

Neither result says that a chosen optimizer is unique, continuous, or differentiable without further assumptions.

This page uses the correspondence conventions from Topology. Write a parameter as \(q\in U\subseteq\mathbb R^L\), a choice as \(x\in\mathbb R^N\), and a feasibility correspondence as \(\Psi:U\rightrightarrows\mathbb R^N\). A value function is a number; an argmax is usually a set.

Course map

1. Combine compactness and continuity of the objective with continuity of the feasible-set correspondence.
2. Apply the maximum theorem.
3. Obtain continuity of the value and upper hemicontinuity of the argmax.
4. Add differentiability assumptions when the question concerns derivatives.
5. Apply an envelope theorem to the optimized value.

The maximum theorem is about continuity. The envelope theorem is about derivatives. The first often supplies existence and continuity needed to set up the second, but it does not by itself make a value differentiable.

Before this page: Topology for compactness and hemicontinuity, Differentiation for the chain rule, and Optimization for first-order and KKT conditions. Next: Convexity gives conditions that make an argmax single-valued.

Prerequisite retrieval

Retrieval check. If \(\Psi(q)\) is compact-valued, what does this say about one particular set \(\Psi(q)\)? What does it not say about the union \(\bigcup_{q\in U}\Psi(q)\)?

Show answer

For each \(q\in U\), the value \(\Psi(q)\) is compact. This is a pointwise claim. It does not make the union compact, since the parameter set can be unbounded or the values can drift without a uniform bound.

Keep the objects distinct

• \(V(q)\in\mathbb R\) is the optimized value.
• \(A(q)\subseteq\mathbb R^N\) is the set of maximizers.
• A selection \(\phi\) is a function satisfying \(\phi(q)\in A(q)\) whenever it is defined.

The fact that \(V\) is continuous does not make \(A\) single-valued. Upper hemicontinuity of \(A\) does not make every selection \(\phi\) continuous. If \(A\) is a singleton at every parameter, however, its unique selection is continuous precisely because upper hemicontinuity then reduces to ordinary function continuity.

4.6 The maximum theorem

4.6.1 Set-up and the three conclusions

Let \(U\subseteq\mathbb R^L\) be open. Let \(u:U\times\mathbb R^N\to\mathbb R\) be continuous and let \(\Psi:U\rightrightarrows\mathbb R^N\) be a feasibility correspondence. Define

\[ V(q)=\max_{x\in\Psi(q)}u(q,x). \]

\[ A(q)=\operatorname*{arg\,max}_{x\in\Psi(q)}u(q,x). \]

The notation above presumes that the maximum is attained. Berge’s theorem supplies precisely that fact under its hypotheses.

Theorem 4.6.1: maximum theorem

Let \(X\subseteq\mathbb R^N\) and \(\Theta\subseteq\mathbb R^L\). Define

\[ f^*(\theta) =\max_{x\in\varphi(\theta)}f(x,\theta) \]

and

\[ \varphi^*(\theta) =\operatorname*{arg\,max}_{x\in\varphi(\theta)}f(x,\theta). \]

Assumptions.

1. \(f:X\times\Theta\to\mathbb R\) is continuous.
2. \(\varphi:\Theta\rightrightarrows X\) is nonempty-valued, compact-valued, and continuous, meaning both upper and lower hemicontinuous.

Conclusions. On \(\Theta\):

1. \(f^*\) is continuous.
2. \(\varphi^*\) is nonempty-valued and compact-valued.
3. \(\varphi^*\) is upper hemicontinuous.

The version proved in Nachbar’s Theorem of the Maximum holds \(u(q,x)=f(x)\) fixed in \(q\). The displayed version is the usual joint- continuous formulation of Berge’s theorem. It has the same three conclusions.

Why each argmax set is nonempty and compact

For a fixed \(q\), nonemptiness is the extreme-value theorem: \(\Psi(q)\) is nonempty and compact, and \(x\mapsto u(q,x)\) is continuous. Therefore \(u(q,\cdot)\) attains a maximum on \(\Psi(q)\). The set of all such maximizers is nonempty. It is compact because it is a closed subset of the compact set \(\Psi(q)\).

What compact-valuedness is doing

Compact-valuedness is not a smoothness condition. It prevents a maximizing sequence from either escaping to infinity or converging to an infeasible point. Continuity of \(u\) then transfers the limiting value to that feasible limit.

A finite supremum need not be a maximum

Let \(\Psi(q)=(0,1)\) for every \(q\) and let \(u(q,x)=x\). The supremum is \(1\), but \(A(q)=\varnothing\). The objective is continuous and the feasible sets are nonempty, but they are not compact.

Why the argmax is only upper hemicontinuous

Upper hemicontinuity says that if \(q_j\to q\) and \(x_j\in A(q_j)\), then every convergent subsequence of \((x_j)\) can only limit to a member of \(A(q)\). In the finite-dimensional compact setting, this is the right stability statement: optimizers cannot suddenly acquire a remote limit outside the old argmax set.

Show proof

Proof strategy. Take a convergent parameter sequence \(q_j\to q\) and maximizers \(x_j\in A(q_j)\). Upper hemicontinuity and compact-valuedness of \(\Psi\) supply a subsequence \(x_{j_k}\to x\in\Psi(q)\). If \(x\) were not optimal at \(q\), choose a better feasible point \(\hat x\in\Psi(q)\). Lower hemicontinuity produces nearby feasible competitors \(\hat x_{j_k}\) tending to \(\hat x\). Continuity of \(u\) then eventually makes \(u(q_{j_k},\hat x_{j_k})>u(q_{j_k},x_{j_k})\), contradicting optimality.

This proof has a useful division of labor:

1. Compact values and upper hemicontinuity of \(\Psi\): extract a feasible limit from nearby maximizers.
2. Lower hemicontinuity of \(\Psi\): keep a strictly better limiting competitor feasible nearby.
3. Continuity of \(u\): preserve the strict value comparison.

Do not replace UHC by continuity of a selection

Let \(u(q,x)=qx\) on the fixed feasible set \([-1,1]\). Then

\[ A(q)= \begin{cases} \{-1\},&q<0,\\ [-1,1],&q=0,\\ \{1\},&q>0. \end{cases} \]

The argmax correspondence is upper hemicontinuous at \(0\), but it is not lower hemicontinuous there: the optimizer \(-1\in A(0)\) disappears immediately to the right. No continuous selection can pass through every parameter value.

Why the value is continuous

For values, the theorem controls both directions of variation. Nearby maximizers cannot produce values much above \(V(q)\), because their subsequential limits are maximizers at \(q\). Lower hemicontinuity lets a maximizer at \(q\) be approximated by feasible choices at nearby parameters, so nearby values cannot fall much below \(V(q)\).

Show proof

Fix a parameter \(q\). Upper hemicontinuity of \(A\) puts every nearby argmax set inside any chosen open neighborhood of the compact set \(A(q)\). Continuity of the objective makes its values uniformly close to \(V(q)\) on a sufficiently small neighborhood of \(A(q)\). Hence every nearby maximizing value is close to \(V(q)\).

Example 4.6.2: a budget correspondence

Let \(q=(p,m)\) with \(p\in\mathbb R^N_{++}\) and \(m>0\), and set

\[ \Psi(p,m)=\{x\in\mathbb R^N_+:p^{\mathsf{T}} x\le m\}. \]

For each \((p,m)\), this set is nonempty and compact. If utility \(u(x)\) is continuous, the consumer has an optimal bundle, indirect utility is continuous in \((p,m)\), and Marshallian demand is upper hemicontinuous. This does not make demand unique. Strict quasi-concavity of \(u\) is one route to uniqueness, studied on the next page.

Retrieval check. In the maximum theorem, which property retrieves a nearby feasible approximation to a fixed \(x\in\Psi(q)\)?

Show answer

Lower hemicontinuity of \(\Psi\). It says that every open set meeting \(\Psi(q)\) continues to meet \(\Psi(q')\) for all \(q'\) sufficiently close to \(q\).

Assumption audit for Theorem 4.6.1

1. Nonempty values: without them, there may be no feasible optimization problem.
2. Compact values: without them, the supremum may not be attained.
3. Continuity of the objective: without it, a limit of optimizing choices need not preserve a value comparison.
4. Upper hemicontinuity of feasibility: without it, nearby optimizers can acquire limiting points outside the limiting feasible set.
5. Lower hemicontinuity of feasibility: without it, a limiting competitor can disappear after an arbitrarily small parameter change.

The theorem has no uniqueness hypothesis. If strict concavity of \(x\mapsto u(q,x)\) on a convex feasible set makes \(A(q)\) a singleton for every \(q\), then Berge’s upper hemicontinuity makes the unique optimizer continuous. This conclusion needs uniqueness throughout the relevant parameter set, not merely at one parameter value.

4.7 The envelope theorem

4.7.1 Unconstrained envelope theorem

The optimizer may move when \(\theta\) changes. The envelope theorem says that, at a parameter with a unique optimizer, the first-order movement in optimized value is found by holding that optimizer fixed and differentiating only the primitive objective.

Theorem 4.7.1: envelope theorem, fixed feasible set

Let \(X\subseteq\mathbb R^N\) be compact and let \(\Theta\subseteq\mathbb R^L\) be open. Define

\[ f^*(\theta)=\max_{x\in X}f(x,\theta) \]

and

\[ X^*(\theta)=\operatorname*{arg\,max}_{x\in X}f(x,\theta). \]

Assumptions.

1. \(f:X\times\Theta\to\mathbb R\) is jointly continuous.
2. For each \(x\in X\), \(f(x,\cdot)\) is \(C^1\) on \(\Theta\).
3. \(D_\theta f(x,\theta)\) is jointly continuous in \((x,\theta)\).
4. At the parameter \(\theta_0\in\Theta\), the optimizer is unique: \(X^*(\theta_0)=\{x^*\}\).

Conclusion. \(f^*\) is differentiable at \(\theta_0\) and

\[ Df^*(\theta_0)=D_\theta f(x^*,\theta_0). \]

Here both sides are \(1\times L\) row vectors. Notice what the theorem does not assume: it does not require a differentiable optimizer selection.

Show proof

Proof strategy. Compare the new value with the payoff from keeping the old optimizer \(x^*\), then compare it with the payoff from a new optimizer \(x_h\). The maximum theorem and uniqueness imply \(x_h\to x^*\) as \(h\to0\).

Choose \(x_h\in X^*(\theta_0+h)\). Optimality gives the two bounds

\[ \begin{aligned} f(x^*,\theta_0+h)-f(x^*,\theta_0) &\le f^*(\theta_0+h)-f^*(\theta_0),\\ f^*(\theta_0+h)-f^*(\theta_0) &\le f(x_h,\theta_0+h)-f(x_h,\theta_0). \end{aligned} \]

The fundamental theorem of calculus in the parameter and joint continuity of \(D_\theta f\) make both outside expressions equal to

\[ D_\theta f(x^*,\theta_0)h+o(\lVert h\rVert). \]

The middle expression is therefore squeezed to the same first-order expansion. \(\square\)

This fixed-feasible-set result is stronger than the elementary chain-rule version because differentiability of an optimizer selection is not assumed. Compactness, upper hemicontinuity of the argmax, and uniqueness at \(\theta_0\) control the optimizing choices used in the difference quotient.

Do not use the interior-FOC story at a boundary

For a differentiable interior optimizer, the chain-rule term \(D_xf\,Dx^*\) vanishes because \(D_xf=0\). Theorem 4.7.1 does not rely on that story. In a constrained problem, \(D_xf\) need not vanish, and the multiplier correction in Theorem 4.7.2 must be retained.

Calculation example: a quadratic value

Fix \(M>0\), take \(X=[-M,M]\) and \(\Theta=(-M,M)\), and let

\[ f(x,\theta)=\theta x-\frac{x^2}{2}. \]

The unique optimizer is \(x^*(\theta)=\theta\), so \(f^*(\theta)=\theta^2/2\). Directly, \((f^*)'(\theta)=\theta\). The envelope calculation holds \(x\) fixed:

\[ f_\theta(x,\theta)=x \quad\Longrightarrow\quad f_\theta(x^*(\theta),\theta)=\theta. \]

The theorem reaches this derivative without differentiating \(x^*(\theta)\).

4.7.2 Constrained envelope theorem

The constraint term has a sign and a source. We use the maximization convention

\[ \mathcal L(x,\lambda;\theta) =f(x,\theta)-\lambda^{\mathsf T}G(x,\theta). \]

Thus multipliers on active inequalities of the form \(h_j\le0\) are nonnegative. Equality multipliers remain unrestricted.

Theorem 4.7.2: envelope theorem with constraints

Let \(X\subseteq\mathbb R^N\) be open and let \(\Theta\subseteq\mathbb R^L\) be open. For each \(\theta\), consider

\[ \begin{aligned} \max_{x\in X}\quad &f(x,\theta)\\ \text{s.t.}\quad &g_i(x,\theta)=0, &&i=1,\ldots,k,\\ &h_j(x,\theta)\le0, &&j=1,\ldots,\ell. \end{aligned} \]

Define the feasible correspondence

\[ F(\theta) = \left\{x\in X: \begin{array}{l} g_i(x,\theta)=0,\\ i=1,\ldots,k,\\[3pt] h_j(x,\theta)\le0,\\ j=1,\ldots,\ell \end{array} \right\}, \]

the value \(f^*(\theta)\), and the argmax \(X^*(\theta)\) by optimizing over \(F(\theta)\). Combine the constraints as

\[ G_r(x,\theta)=g_r(x,\theta), \qquad r=1,\ldots,k, \]

and

\[ G_{k+j}(x,\theta)=h_j(x,\theta), \qquad j=1,\ldots,\ell. \]

Assumptions.

1. \(f\), every \(g_i\), and every \(h_j\) are \(C^1\).

2. \(F\) is nonempty-valued, compact-valued, and continuous.

3. \(X^*(\theta)\) is a singleton for every \(\theta\in\Theta\); write its unique element as \(x^*(\theta)\).

4. At each \(\theta\), the gradients in \(x\) of the active constraints are linearly independent:

   \[ \operatorname{rank} D_xG_{A(\theta)}(x^*(\theta),\theta) =|A(\theta)|, \]

   where

   \[ A(\theta)= \{r:G_r(x^*(\theta),\theta)=0\}. \]

5. The optimizer \(x^*(\theta)\) is differentiable at the parameter of interest \(\theta_0\).

Let \(\lambda^*(\theta_0)\in\mathbb R^{k+\ell}\) be the associated KKT multipliers, with inactive inequality multipliers set to zero.

Conclusion. \(f^*\) is differentiable at \(\theta_0\), and

\[ \begin{aligned} Df^*(\theta_0) &=D_\theta f(x^*(\theta_0),\theta_0)\\ &\quad- \lambda^*(\theta_0)^{\mathsf T} D_\theta G(x^*(\theta_0),\theta_0). \end{aligned} \]

The ambient set must not hide another boundary

The slide states only that \(X\) is a set. The displayed KKT system is valid as written when the optimizer is interior to the ambient choice domain, which is why this page takes \(X\) to be open. If \(X\) itself imposes an additional boundary, encode that boundary among \(g\) and \(h\) or add its normal-cone term. Otherwise stationarity can omit a binding restriction.

Show proof

Proof strategy. Differentiate the value through the optimizer, use KKT stationarity to replace \(D_xf\), and then differentiate every active constraint identity.

Write \(x_0^*=x^*(\theta_0)\) and \(\lambda_0^*=\lambda^*(\theta_0)\). The chain rule gives

\[ Df^*(\theta_0) =D_xf(x_0^*,\theta_0)Dx^*(\theta_0) +D_\theta f(x_0^*,\theta_0). \]

KKT stationarity gives

\[ D_xf(x_0^*,\theta_0) =\lambda_0^{*\mathsf T}D_xG(x_0^*,\theta_0). \]

For an equality constraint, its identity along the optimizer has derivative zero. An active inequality with a nonzero multiplier also has derivative zero: its value along the feasible optimizer is at most zero near the interior point \(\theta_0\) and equals zero at \(\theta_0\). Thus, for every constraint that contributes to the multiplier term,

\[ D_xG_r(x_0^*,\theta_0)Dx^*(\theta_0) +D_\theta G_r(x_0^*,\theta_0)=0. \]

Substitution yields the stated multiplier correction. Inactive constraints have zero multipliers and contribute nothing. \(\square\)

Track the sign through the Lagrangian

Under \(\mathcal L=f-\lambda^{\mathsf T}G\), the correction is \(-\lambda^{\mathsf T}D_\theta G\). If instead you normalize a maximization constraint as \(G\ge0\) and write \(\mathcal L=f+\lambda^{\mathsf T}G\), the displayed sign changes with the convention. The numerical derivative does not.

Example 4.7.3: a parameterized resource cap

For \(\theta>0\), solve

\[ \begin{aligned} \max_{x>0}\quad &\log x\\ \text{s.t.}\quad &x-\theta\le0. \end{aligned} \]

With \(h(x,\theta)=x-\theta\) and \(\mathcal L=\log x-\lambda(x-\theta)\), stationarity and complementarity give

\[ x^*(\theta)=\theta, \qquad \lambda^*(\theta)=\frac1\theta. \]

The envelope calculation is

\[ \begin{aligned} (f^*)'(\theta) &=f_\theta(x^*(\theta),\theta) -\lambda^*(\theta)h_\theta(x^*(\theta),\theta)\\ &=0-\frac1\theta(-1)\\ &=\frac1\theta. \end{aligned} \]

Directly, \(f^*(\theta)=\log\theta\), so the derivative agrees. The positive multiplier is the marginal value of relaxing the upper bound.

Beyond Section 4.7: arbitrary choice sets

The baseline theorem assumes a differentiable optimizer. That assumption can be too strong: optimizers can jump, multiple optima can coexist, and an economic choice set may lack convenient topological or convex structure. Milgrom and Segal separate the envelope identity from the task of proving differentiability of the value.

Let \(X\) be any set, let \(f:X\times[0,1]\to\mathbb R\), and define

\[ V(t)=\sup_{x\in X}f(x,t). \]

\[ X^*(t)=\{x\in X:f(x,t)=V(t)\}. \]

The set \(X^*(t)\) can be empty: a supremum need not be attained. Every use of an optimizer below therefore explicitly assumes \(X^*(t)\ne\varnothing\).

Milgrom-Segal envelope theorem, Theorem 1

Fix \(t\in[0,1]\) such that \(X^*(t)\ne\varnothing\), choose \(x^*\in X^*(t)\), and suppose the partial derivative \(f_t(x^*,t)\) exists.

• If \(t>0\) and \(V\) has a left derivative at \(t\), then \(V'_-(t)\le f_t(x^*,t)\).

• If \(t<1\) and \(V\) has a right derivative at \(t\), then \(V'_+(t)\ge f_t(x^*,t)\).

• If \(t\in(0,1)\) and \(V\) is differentiable at \(t\), then

  \[V'(t)=f_t(x^*,t).\]

This statement is Theorem 1 of Milgrom and Segal (2002). It imposes no topology, convexity, or continuity on \(X\). It also does not say that \(V\) is differentiable. Differentiability of \(V\) is an explicit premise of the equality conclusion.

Show proof

Proof strategy. Optimality at \(t\) gives, for every nearby \(t'\),

\[ f(x^*,t')-f(x^*,t)\le V(t')-V(t). \]

Divide by a positive difference quotient on the right or left and take the corresponding limit. If both one-sided derivatives of \(V\) exist and agree, the two inequalities squeeze them to \(f_t(x^*,t)\).

What the arbitrary-choice-set theorem buys

The result does not differentiate a policy function. It needs only an optimizer at the parameter of interest, a partial derivative of the objective there, and the relevant derivative of the value. The hard work is often proving that last property of \(V\).

A kink is compatible with smooth objectives

Let \(X=\{-1,1\}\) and \(f(x,t)=xt\). Then \(V(t)=|t|\). Each function \(t\mapsto f(x,t)\) is differentiable, but \(V\) is not differentiable at \(0\). At \(t=0\), both choices optimize and their partial derivatives are \(-1\) and \(1\). There is no single derivative of the value for an envelope formula to identify.

A useful stronger conclusion

Milgrom and Segal’s Theorem 2 gives conditions for absolute continuity of \(V\). Suppose \(V(0)\in\mathbb R\), every \(f(x,\cdot)\) is absolutely continuous, and there is a function \(b\in L^1([0,1])\) and a null set \(N\) such that, for every \(t\in[0,1]\setminus N\) and every \(x\in X\),

\[ f_t(x,t)\text{ exists and }\lvert f_t(x,t)\rvert\le b(t). \]

Then \(V\) is absolutely continuous. If, in addition, every \(f(x,\cdot)\) is differentiable on \([0,1]\) and \(X^*(t)\ne\varnothing\) for almost every \(t\), then any optimizer selection \(x^*(t)\in X^*(t)\) on that full-measure set gives

\[ V(t)=V(0)+\int_0^t f_t(x^*(s),s)\,ds. \]

The absolute-value bound is uniform over choices: a separate integrable bound depending on \(x\) would not deliver this conclusion.

For this course, keep two failed implications straight:

• Smooth objective functions do not imply a differentiable value function.
• A differentiable value function does not imply an envelope equality when the equality’s other premises fail.

Assumption audit

1. Existence: nonempty compact feasibility and a continuous objective give \(A(q)\ne\varnothing\).
2. Continuity of value: a continuous objective and a nonempty, compact-valued, continuous feasibility correspondence give continuous \(V\).
3. Upper stability of choices: the same maximum-theorem assumptions make \(A\) upper hemicontinuous.
4. Theorem 4.7.1: a compact fixed choice set, joint continuity, continuous parameter derivatives, and a unique optimizer at \(\theta_0\) give the envelope derivative there.
5. Theorem 4.7.2: KKT regularity, differentiability of the optimizer, and the active parameterized constraints give the multiplier correction.
6. Arbitrary-set equality: an optimizer, the partial derivative \(f_t\), and differentiability of \(V\) give \(V'=f_t\).

Proof blueprints

Applying the maximum theorem

1. State \(U\), the objective \(u(q,x)\), and \(\Psi(q)\).
2. Check that every feasible value is nonempty and compact.
3. Check both UHC and LHC of \(\Psi\).
4. Check joint continuity of \(u\).
5. State separately: existence, continuity of \(V\), and UHC of \(A\).
6. Add uniqueness only if strict curvature and convex feasibility justify it.

Applying an envelope theorem

1. Define the value function before differentiating it.
2. Identify whether the choice is unconstrained, constrained, or arbitrary.
3. State exactly what makes \(V\) differentiable. Do not assume it from a smooth objective alone.
4. For Theorem 4.7.1, check compactness, uniqueness at the parameter of interest, and continuity of the parameter derivative. A differentiable optimizer is not required.
5. For Theorem 4.7.2, check that the optimizer is differentiable at the parameter, write the Lagrangian convention, and retain the multiplier terms.

Exit tickets

1. Which maximum-theorem hypothesis prevents a better limiting competitor from disappearing when the parameter changes?
2. Give a one-sentence reason that continuity of \(V\) does not imply differentiability of \(V\).
3. In Theorem 4.7.1, what replaces the chain-rule argument involving an optimizer derivative?
4. State the missing premise in the false sentence: “\(f_t\) exists, so \(V'(t)=f_t(x^*,t)\).”

Show answer

1. Lower hemicontinuity of the feasible correspondence. 2. A continuous value can have a kink, as \(|t|\) does at zero. 3. Two optimality bounds squeeze the value change between payoff changes at the old and new optimizers; compactness, upper hemicontinuity, and uniqueness make the new optimizer converge to the old one. 4. The value function itself must be differentiable at \(t\) for the equality in Milgrom-Segal Theorem 1.

Mastery checklist

• I can distinguish existence of an optimizer, continuity of a value, and upper hemicontinuity of an argmax.
• I can state the nonempty compact-valued and continuous conditions on a feasibility correspondence.
• I know where UHC and LHC enter the maximum-theorem proof.
• I can derive the baseline envelope formula with conformable dimensions.
• I know why binding parameterized constraints add multiplier terms.
• I can state what Milgrom-Segal does and does not assume about the value function.

Sources and further reading

• John Nachbar, Theorem of the Maximum, especially the separation of nonempty argmax/UHC from continuity of the value.
• John Nachbar, The Envelope Theorem, for the differentiable optimizer and KKT formulations.
• Paul Milgrom and Ilya Segal, “Envelope Theorems for Arbitrary Choice Sets” (2002), clearly labeled here as the arbitrary-choice-set extension.