[proofplan] We use the Cheeger-Gromoll convention $b_\rho(x)=\lim_{t\to\infty}(t-d_g(x,\rho(t)))$ for Busemann functions, so the protected regions are intersections of superlevel sets of concave functions. The two geometric inputs are the [Cheeger-Gromoll Busemann concavity theorem](/page/Cheeger-Gromoll%20Busemann%20Concavity%20Theorem), which gives total convexity of these superlevel sets, and the [Cheeger-Gromoll ray-separation lemma](/page/Cheeger-Gromoll%20Ray-Separation%20Lemma), which gives boundedness of the protected intersections with the same sign convention. Continuity gives closedness, the triangle inequality gives exhaustion, and the [Hopf-Rinow theorem](/page/Hopf-Rinow%20Theorem) turns closed bounded protected levels into compact sets. [/proofplan]

[step:Define the Busemann functions and protected levels] Let $\mathcal{R}_o$ denote the set of all unit-speed geodesic rays $\rho: [0,\infty) \to M$ with $\rho(0)=o$. For each $\rho \in \mathcal{R}_o$, define the Busemann function \begin{align*} b_\rho: M &\to \mathbb{R}, \\ x &\mapsto \lim_{t\to\infty}\bigl(t-d_g(x,\rho(t))\bigr), \end{align*} where $d_g: M \times M \to [0,\infty)$ is the Riemannian distance induced by $g$. For fixed $x\in M$, define $f_x:[0,\infty)\to\mathbb{R}$ by $f_x(t)=t-d_g(x,\rho(t))$. If $0\le s\le t$, then the triangle inequality gives \begin{align*} d_g(x,\rho(t))\le d_g(x,\rho(s))+d_g(\rho(s),\rho(t))=d_g(x,\rho(s))+t-s, \end{align*} so $f_x(s)\le f_x(t)$. Thus $f_x$ is nondecreasing. The triangle inequality also gives \begin{align*} t-d_g(o,x)\le d_g(x,\rho(t))\le t+d_g(o,x), \end{align*} because $d_g(o,\rho(t))=t$, and hence \begin{align*} -d_g(o,x)\le f_x(t)\le d_g(o,x). \end{align*} Therefore $f_x$ is monotone and bounded, so the defining limit for $b_\rho(x)$ exists. Define, for each $a\ge 0$, \begin{align*} C_a := \bigcap_{\rho\in \mathcal{R}_o}\{x\in M : b_\rho(x)\ge -a\}. \end{align*} [/step]

[step:Use concavity to prove total convexity]Fix $a\ge 0$. We prove that $C_a$ is totally convex, meaning that every geodesic segment with endpoints in $C_a$ has image contained in $C_a$. Let $p,q\in C_a$, and let $\gamma:[0,1]\to M$ be a geodesic segment with $\gamma(0)=p$ and $\gamma(1)=q$. For each $\rho\in\mathcal{R}_o$, the [Cheeger-Gromoll Busemann concavity theorem](/page/Cheeger-Gromoll%20Busemann%20Concavity%20Theorem) applies because $(M,g)$ is complete with $\operatorname{sec}\ge 0$ and $\rho$ is a unit-speed ray; it states that $b_\rho\circ\gamma:[0,1]\to\mathbb{R}$ is concave. Since $p,q\in C_a$, we have $b_\rho(p)\ge -a$ and $b_\rho(q)\ge -a$. Concavity gives, for every $s\in[0,1]$, \begin{align*} b_\rho(\gamma(s)) \ge (1-s)b_\rho(p)+s b_\rho(q) \ge -a. \end{align*} Because this holds for every $\rho\in\mathcal{R}_o$, we have $\gamma(s)\in C_a$ for every $s\in[0,1]$. Hence $C_a$ is totally convex.[/step]

[guided]We prove total convexity directly from the definition. Fix $a\ge 0$, choose two points $p,q\in C_a$, and let $\gamma:[0,1]\to M$ be any geodesic segment joining them, so $\gamma(0)=p$ and $\gamma(1)=q$. To prove that $C_a$ is totally convex, we must show that every point $\gamma(s)$ remains in $C_a$. By the definition of $C_a$, membership in $C_a$ means satisfying all Busemann inequalities at once. Thus we fix an arbitrary ray $\rho\in\mathcal{R}_o$ and prove the inequality for this one $\rho$. The [Cheeger-Gromoll Busemann concavity theorem](/page/Cheeger-Gromoll%20Busemann%20Concavity%20Theorem) applies because $(M,g)$ is complete, $\operatorname{sec}\ge 0$, and $\rho$ is a unit-speed ray. It says that the real-valued function $b_\rho\circ\gamma:[0,1]\to\mathbb{R}$ is concave along the geodesic segment $\gamma$. Since $p,q\in C_a$, the defining inequalities give \begin{align*} b_\rho(p)\ge -a, \qquad b_\rho(q)\ge -a. \end{align*} Concavity of $b_\rho\circ\gamma$ now yields, for each $s\in[0,1]$, \begin{align*} b_\rho(\gamma(s)) \ge (1-s)b_\rho(\gamma(0))+s b_\rho(\gamma(1)) = (1-s)b_\rho(p)+s b_\rho(q) \ge -a. \end{align*} The ray $\rho$ was arbitrary, so the same inequality holds for every ray issuing from $o$. Therefore $\gamma(s)$ belongs to the intersection defining $C_a$ for every $s\in[0,1]$. This proves that $C_a$ is totally convex.[/guided]

[step:Prove closedness and nesting from continuity and the level inequality] Each Busemann function $b_\rho:M\to\mathbb{R}$ is $1$-Lipschitz with respect to $d_g$, because for $x,y\in M$ and $t\ge 0$ the [reverse triangle inequality](/theorems/2300) gives \begin{align*} \bigl|d_g(x,\rho(t))-d_g(y,\rho(t))\bigr|\le d_g(x,y), \end{align*} and passing to the limit in $t$ gives $|b_\rho(x)-b_\rho(y)|\le d_g(x,y)$. Hence $b_\rho$ is continuous, so $\{x\in M:b_\rho(x)\ge -a\}$ is closed. Therefore $C_a$, as an arbitrary intersection of closed sets, is closed. If $0\le a\le a'$, then $-a\ge -a'$, so every inequality $b_\rho(x)\ge -a$ implies $b_\rho(x)\ge -a'$; hence $C_a\subset C_{a'}$. [/step]

[step:Use ray separation and Hopf-Rinow to obtain compactness] Fix $a\ge 0$. We invoke the [Cheeger-Gromoll ray-separation lemma](/page/Cheeger-Gromoll%20Ray-Separation%20Lemma) in the following form: if $(M,g)$ is complete, noncompact, and satisfies $\operatorname{sec}\ge 0$, then for the basepoint $o\in M$ and the Busemann convention \begin{align*} b_\rho(x)=\lim_{t\to\infty}\bigl(t-d_g(x,\rho(t))\bigr), \end{align*} there exists a radius $R(a)>0$ such that, for every $x\in M$ with $d_g(o,x)>R(a)$, there is a ray $\rho_x\in\mathcal{R}_o$ satisfying \begin{align*} b_{\rho_x}(x)<-a. \end{align*} The hypotheses of the lemma are exactly the hypotheses of the theorem: completeness, noncompactness, and nonnegative sectional curvature. If $x\in C_a$, then the defining inequality gives $b_\rho(x)\ge -a$ for every $\rho\in\mathcal{R}_o$. Therefore no point with $d_g(o,x)>R(a)$ can lie in $C_a$, and hence \begin{align*} C_a\subset \overline{B}(o,R(a)). \end{align*} The [metric space](/page/Metric%20Space) $(M,d_g)$ is proper by the [Hopf-Rinow theorem](/page/Hopf-Rinow%20Theorem), because $(M,g)$ is complete. Thus the closed metric ball $\overline{B}(o,R(a))$ is compact. Since $C_a$ is closed and contained in this compact ball, $C_a$ is compact. [/step]

[step:Verify that the protected levels exhaust the manifold] Let $x\in M$. For every $\rho\in\mathcal{R}_o$ and every $t\ge 0$, the triangle inequality gives \begin{align*} d_g(x,\rho(t)) \le d_g(x,o)+d_g(o,\rho(t)) = d_g(x,o)+t. \end{align*} Rearranging and passing to the limit defining $b_\rho$ gives \begin{align*} b_\rho(x)=\lim_{t\to\infty}\bigl(t-d_g(x,\rho(t))\bigr)\ge -d_g(x,o). \end{align*} Thus, for any $a\ge d_g(x,o)$, we have $b_\rho(x)\ge -a$ for every $\rho\in\mathcal{R}_o$, and hence $x\in C_a$. Therefore \begin{align*} M=\bigcup_{a\ge 0} C_a. \end{align*} Combining compactness, nesting, total convexity, and exhaustion shows that the closed protected levels $C_a$ form the claimed totally convex exhaustion of $M$. [/step]