text:
\section{Introduction}
Quine's NF set theory is a first-order theory whose language contains only the binary predicate symbol $\in$,
and whose axioms are two in number:  extensionality and stratified comprehension.
The definition of these axioms will be reviewed below; full details
can be found in \cite{forster}.
Intuitionistic NF, or {\rm INF},  is the theory
with the same language and axioms as NF, but with intuitionistic logic instead of classical.

The ``axiom'' of infinity is a theorem of NF, proved by Rosser
\cite{rosser1952} and Specker \cite{specker1953};
see also \cite{forster}, p.~49.  These proofs use classical logic
in an apparently essential way, and it is still an open question
whether {\rm INF}\ proves the existence of an infinite set.
In \cite{inf-basics},  the fundamental results of {\rm INF}\ have been
developed,  and on that basis, we analyzed (in unpublished work)
the constructive content
of Specker's proof,  but that did not lead to a proof of infinity.
It has also long been known that if ${\mathbb V}$ is not finite, then the logic
of stratified formulas must be classical, so Specker's proof could be
done; hence the statement ``${\mathbb V}$ is not finite'' can be proved in {\rm INF}.
But that does not lead to a proof of infinity, because there might be
a maximum integer,  whose elements $U$ would be ``unenlargeable''
in the sense that we cannot find any set that is not in $U$.

We therefore have two reasons for being interested in the Church
numerals in {\rm INF}:  to use them to prove infinity,  and to study their
structure for its own intrinsic interest.

   The Church numerals were introduced by Church (or technically,
by his student Kleene) in the context of $\lambda$-calculus.  They are defined so that the $n$-th Church number is a function
that takes inputs $f$ and $x$ and produces output $f^n(x)$, where $f^n$
is $f$ iterated $n$ times.  It turns out that the Church numerals,
or Church numbers as we shall call them%
\footnote{
The word ``numeral'' is usually used for a syntactic object, a name
for a number.  The ``Church numerals'' that we define here are
sets, not syntax.  We therefore refer to them as ``Church numbers''
instead.  Church himself in \cite{church1941}
never mentions the word ``numeral'' but instead refers to ``the formula
representing the integer $n$''.

},
and the set ${\mathbb N}$ of Church numbers, can be defined
by stratified comprehension straightforwardly in {\rm INF}.
The Church numerals were introduced in 1935 \cite{kleene1935}
and NF set theory in 1937 \cite{quine1937}, so the definition
of Church numerals in NF could have been done at any time since 1937.%
\footnote{Church defines addition, multiplication, and exponentiation
on p.~10 of \cite{church1941}, but he attributes these definitions
to Rosser and refers to \cite{kleene1935} for detailed proofs.
Rosser later worked on Quine's NF, so he had all the background
needed to write this paper
right after he wrote \cite{rosser1952}.
}

The equation satisfied by Church successor ${\sf S}$ is
$$ {\sf S} jfx = f(jfx). $$
 It was Church's student Kleene who defined
the predecessor function in $\lambda$-calculus, in his Ph.~D. thesis,
and in  \cite{kleene1935}.
The $\lambda$-calculus definition of that function does not lead
to a definition by stratified comprehension in NF, so to prove that
Church successor is injective in NF requires a new argument.

 In this paper we analyze the structure
of the Church numbers under successor.  First we
introduce addition $x \oplus y$ on ${\mathbb N}$. Assuming ${\mathbb N}$ is finite,
there is exactly one ``double successor'', i.e., there are exactly
two numerals ${\bf k}$ and ${\bf n}$ with ${\sf S} {\bf k} = {\sf S} {\bf n}$.  The numbers from
0 to ${\bf k}$ behave ``normally'' (trichotomy holds there).  We
call that the ``stem.''
The rest of the Church numbers form a ``loop'' ${\mathcal L}$, as a directed
graph in which the edges are pairs $\langle x, {\sf S} x\rangle$.
See Fig.~\ref{figure:rho}.

\begin{figure}[ht]
\caption{The stem ${\sf STEM}$, the loop ${\mathcal L}$, and unique double successor}
\label{figure:rho}
\FigureRho
\end{figure}

So trichotomy fails dramatically on ${\mathcal L}$: everything in ${\mathcal L}$ is
less than everything else.  The ``length'' of the loop is a
Church number ${\bf m}$ such that $x\oplus {\bf m} = x$ for every $x \in {\mathcal L}$.
We then prove the Annihilation Theorem:  any one-to-one map $f$ on
any finite set,  when iterated ${\bf m}$ times, is the identity.
In symbols, ${\bf m} f = f$.  Here the ${\bf m}$-fold iteration of $f$
is expressed by the Church number ${\bf m}$.

One could then reach a contradiction if one could simply exhibit
a finite set $X$ and a map whose ${\bf m}$-th iterate is not the identity.
The crucial question here is, what is the order of successor, considered
as a permutation of the loop?   Intuitively it seems that it should
be ${\bf m}$, the length of the loop.  That assertion,  however,  is
equivalent to the unstratified formula
$$ j \in {\mathbb N} \ {\rightarrow}\   j {\sf S} {\bf n} = {\bf n} \oplus j,$$
which in turn is equivalent to the Church counting axiom,
$$ j \in {\mathbb N} \ {\rightarrow}\  j {\sf S} {\bf 0} = j.$$
That unstratified formula,  although expressing a fundamental truth
about the Church numbers,  seems to be unprovable in NF.
If we assume the Church counting axiom, then it is a routine exercise
to define a permutation of the loop that  leaves one element unmoved
while cycling the rest, and that permutation will have order ${\bf m}-1$,
and hence will not satisfy the Annihilation Theorem.  That will show
that ${\mathbb N}$ is not finite; and we can go further and prove that ${\mathbb N}$ is
actually infinite, and Heyting's arithmetic is thus interpretable in
INF plus the counting axiom.

Without the counting axiom,   one can exhibit
specific permutations of specific finite sets, for example, a permutation
of order 3 or one of order 873  or one of order 24,569; so ${\bf m}$
must be larger than any integer with a name.  In general we must think
of the Church numbers as non-standard integers.  The counting axiom
is a way to outlaw certain non-standard integers.   In general in NF set theory
one cannot assert the existence of $\{ x \in {\mathbb N} :  P(x)\}$ unless $P$ is
stratified,  though such sets do not lead to any known paradoxes.  Of course
this separation axiom would imply the counting axiom.  Without the counting
axiom, the order ${\bf q}$ of the loop might be smaller than ${\bf m}$;  in fact the
quotient ${\bf m}/{\bf q}$ would itself be a non-standard integer, and the map
$x \mapsto x{\sf S}{\bf n}$ (which is not definable in NF because the formula is
not stratified)  would  take a small initial part of the loop
onto the whole loop,  and as $x$ increases past $q$,  $x {\sf S} {\bf n}$ would
wrap around the loop many times before $x$ reached ${\bf m}$.  It would
be interesting to see models of NF in which the Church counting axiom fails;
but then again,  it would be interesting to see models of NF at all.

Previous studies of infinity in NF have used the ``Frege cardinals''  ${\mathbb F}$,
defined as the least set containing ${\sf zero} := \{{\Lambda}\}$ and closed under
inhabited successor, where the Frege successor of $x$ is $x^+ $, the set of all $x \cup\{c\}$
such that $c \not\in x$.%
\footnote{Actually, Rosser and Spector used Nn, defined as the least set
containing ${\sf zero}$ and closed under successor;  so possibly Nn might contain
${\Lambda}$, while ${\mathbb F}$ certainly does not contain ${\Lambda}$.  Therefore we
use a different letter.}
Of course there are natural functions defined from ${\mathbb N}$
to ${\mathbb F}$ and vice-versa,  but nothing about these functions is obvious.  If ${\mathbb F}$ is
finite, then there is a maximum integer ${\sf max}$,  containing a set $U$ that is
``unenlargeable'' in the sense that no $c$ can be produced such that $c \not\in U$,
in spite of the fact that the universe ${\mathbb V}$ is infinite.   In that case there are
several possibilities:  ${\sf max}$ might come ``too soon'',  so that there are ``not enough''
Frege numbers to correspond to all the Church numbers.  Or, ${\sf max}$ might be ``too big'',
so that the correspondence is no longer one-to-one,  as the Frege numbers start to wrap
the ``loop'' a second time.  Possibly ${\sf max}$ is ``just right'' and the Frege numbers
correspond to the Church numbers in one-to-one fashion.    If ${\mathbb N}$ and ${\mathbb F}$
are both finite,  there is no obvious relation between their cardinalities.
\smallskip

If ${\mathbb N}$ is infinite, then of course ${\mathbb F}$ is infinite too, since there are
arbitrarily large finite sets, namely initial segments of ${\mathbb N}$.
  On the other hand, if ${\mathbb F}$ is infinite, then we can prove that
${\mathbb N}$ is infinite too,  since if ${\mathbb F}$ is infinite, we can show that every Church
number is the order of some permutation,  but that contradicts the
Annihilation Theorem.  Taken together with Specker's result that
 ${\mathbb F}$ is infinite in classical NF,  we see that classical NF does prove
 that ${\mathbb N}$ is infinite.
\smallskip

In the final section of the paper, we prove that the Church counting
axiom and the Rosser counting axiom are equivalent. The proof uses
our main result that the Church counting axiom implies ${\mathbb N}$ is infinite
and Church successor is one-to-one.   This equivalence is proved
in INF, without any assumptions.

We refer to \cite{inf-basics} for notation, axioms, and the basic theorems of
{\rm INF},  including the properties of finite sets and  finite cardinals.
In particular we use ${\mathbb F}$ for the set of finite (Frege)
cardinals.  In this paper
we make no use of arithmetic on the Frege cardinals, not even addition, let
alone multiplication and exponentiation.  What we mostly require from
\cite{inf-basics} is the intuitionistic theory of finite sets.    Lemmas,
theorems, and definitions from that \cite{inf-basics} will be referenced
like this:  Lemma~\sref{lemma:finitedecidable}.

Thanks to Thomas Forster for asking me (once a year for twenty years)
about the strength of {\rm INF}.
Thanks to Randall Holmes for his attention to my first draft,
and for the idea of the proof of Lemma~\ref{lemma:additionfunction}.
Thanks to Albert Visser for his
careful reading of an earlier version; many errors were
thus corrected.   Thanks to the creators of the proof assistant Lean \cite{LeanSystem},  which
has enabled me to state with high confidence that there are no errors in this
paper.  Thanks to the users of Lean who helped me acquire sufficient
expertise in using Lean by answering my questions, especially Mario Carneiro.%
\footnote{Although the proofs in this paper have been computer-checked
for correctness using Lean,  they are presented here in human-readable form
with detailed proofs.  Issues concerning the notation in Lean will not be discussed
here.}

There are many lemmas in this paper, and the intention is that each
of those lemmas is provable in {\rm INF}.  Inductions are stratified and proofs are
intuitionistically valid.  When the counting axiom is used, it is explicitly
mentioned as a hypothesis.

\section{The Church numbers}
We  define the class of single-valued relations:
\begin{definition} \label{definition:FUNC}
$$ {\sf FUNC} = \{ f : \forall x,y,z\, (\langle x,y \rangle \in f \ {\rightarrow}\  \langle x,z\rangle \in f \ {\rightarrow}\  y = z)\}.$$
\end{definition}
The definition does not rule out the possibility that $f$ might contain some members that are not ordered pairs.
A function is a single-valued relation, i.e. $f \in {\sf FUNC} \ \land \ Rel(f)$.
\smallskip

If   $f \in {\sf FUNC}$  and $\langle x,y \rangle \in f$, then
informally we write $y = f(x)$.  Formally this is $y = Ap(f,x)$, where $Ap$ is a
function symbol defined using stratified comprehension.  For details about $Ap$ see
Definition~\sref{definition:Ap} and Lemma~\sref{lemma:Ap}.
We will often suppress mention of the symbol $Ap$, as there is no other way to interpret $f(x)$.
In fact, we will informally follow the $\lambda$-calculus convention of writing $(f x)$ or just $fx$
for function application, with association to the left, so $fxy$ means $((f x) y)$.

The Church successor
function ${\sf S} $ is defined in $\lambda$-calculus by
\begin{eqnarray*}
{\sf S} (z) &=& \lambda f \lambda x f(zfx)
\end{eqnarray*}
Imitating this definition in NF we wish we could define
\begin{eqnarray*}
{\sf S}  &=& \{ \langle z,\{ \langle f, \{ \langle x, f(zfx)\rangle \} \rangle\}\rangle\}
\end{eqnarray*}
Expanding the formula on the right, it is equivalent, at least
for functions $f$ and $z$, to  the formula in the following definition.
To explain the relation between the two formulas,
$t = zf$, $q = tx = zfx$, $w = fq = f(zfx)$.
But we emphasize, everything about Church successor up to this
point is merely motivation for the definition below.

\begin{definition} \label{definition:sucdef}
Church successor is defined by
\begin{eqnarray*}
&& {\sf S} = \{ \langle z, \{ \langle f,p \rangle : f \in {\sf FUNC} \ \land \\
&& \forall u\, (u \in p \iff \exists x,w,t,q \,(u = \langle x,w\rangle \ \land \ t \in {\sf FUNC} \ \land \\
&& \langle f,t\rangle \in z \ \land \ \langle x,q \rangle \in t \ \land \ \langle q,w \rangle \in f)) \}
         : z \in {\sf FUNC} \}
\end{eqnarray*}
\end{definition}

\begin{lemma} \label{lemma:sucdef} The definition of  Church successor can be given in {\rm INF}\ using
stratified comprehension; that is, the graph of Church successor is definable in {\rm INF}.
\end{lemma}

\noindent{\em Proof}.
To stratify the formula in Definition~\ref{definition:sucdef},
we assign indices as follows:

\begin{center}
\begin{tabular}{rr}
$x$, $q$, and $w$  & 0 \\
$u, \langle x,q \rangle$, and $\langle q,w \rangle$ & 2 \\
$p$, $t$ and  $f$ & 3 \\
$\langle f,t \rangle$ & 5 \\
$z$             & 6
\end{tabular}
\end{center}

\noindent
With this assignment,  the left and right members of ordered pairs get the same index, and the formula is stratified.
$t \in {\sf FUNC}$ can be stratified assigning $t$ any desired index $\ge 2$, and that condition is satisfied by
the assignments in the table.
That completes the proof.

\begin{lemma}\label{lemma:ChurchSuccessor3} Let $f \in {\sf FUNC}$ and
$z \in {\sf FUNC}$.  Then ${\sf S} zf$ is a relation (contains only ordered pairs).
\end{lemma}

\noindent{\em Proof}.  Suppose $t \in {\sf S} zf$.  We have to prove $t$ is an ordered pair.
Officially ${\sf S} z f$ is $Ap({\sf S} z, f)$.  By definition of $Ap$, there exists $y$ such that
$\langle f,y \rangle \in {\sf S} z$ and $t \in y$.  Then by definition of Church successor,
$z \in {\sf FUNC}$ and $f \in {\sf FUNC}$ and for every $u$,
$$ u \in y \iff \exists x,w,r,q\, (u = \langle x,w\rangle \ \land\ r \in {\sf FUNC} \ \land \
\langle f,r \rangle \in z \ \land \ \langle x,q \rangle \in r \ \land \ \langle q,w\rangle \in f).$$
Instantiate the quantified $u$ to $t$; then $t = \langle x,w \rangle$ for some $x$ and $w$.
That completes the proof of the lemma.

\begin{lemma} \label{lemma:ChurchSuccessor2} Let $f \in {\sf FUNC}$ and
$z \in {\sf FUNC}$.  Then
\begin{eqnarray*}
{\sf S} zf &=&   \{ \langle x, w\rangle :
             \exists t,q\,
                     ( t \in {\sf FUNC} \land \langle f,t \rangle \in z \land
                       \langle x,q \rangle \in t \land
                       \langle q,w \rangle \in f
                      )
                \}
 \end{eqnarray*}
 \end{lemma}

 \noindent{\em Proof}.  Let $f \in {\sf FUNC}$ and $z \in {\sf FUNC}$.  By Lemma~\ref{lemma:ChurchSuccessor3},
 it suffices to prove
 \begin{eqnarray*}
  \langle x,w \rangle \in Ap({\sf S} z, f) \iff
  \exists t,q\,(t \in {\sf FUNC} \ \land \ \langle f,t \rangle \in z \ \land \ \langle x,q \rangle \in t \ \land \ \langle q,w\rangle \in f)
 \end{eqnarray*}
 Left to right:  Assume $\langle x,w \rangle\in Ap({\sf S} z,f)$.
    By Definition~\ref{definition:Ap},  that assumption is equivalent to
 $$\exists y\, (\langle \langle f,y \rangle, z \rangle \in {\sf S} \ \land \ \langle x,y \rangle \in y.$$
 it suffices to prove
 $$ t \in y \iff \exists y\, (\langle x,y \rangle \in f \ \land \ t \in y.$$
 Applying the definition of Church successor, in a few steps we obtain
 $$ t \in {\sf FUNC} \ \land \ \langle f,t\rangle \in z \ \land \ \langle x,q \rangle \in f  \ \land \ \langle q,w \rangle \in f.$$
 That completes the left-to-right direction.
 \smallskip

 Right to left:   Assume
 $$ t \in {\sf FUNC} \ \land \ \langle f,t\rangle \in z \ \land \ \langle x,q \rangle \in t  \ \land \ \langle q,w \rangle \in f.$$
 We have to prove $\langle x,w\rangle \in Ap({\sf S} z,f)$. Applying the definitions of $Ap$ and ${\sf S}$, we
 find that it suffices to prove
 \begin{eqnarray*}
 && \exists y\,(z \in {\sf FUNC} \land \ \exists g,p\, (\langle f,y \rangle = \langle g,p \rangle \ \land \
 g \in {\sf FUNC} \ \land \  \\
 &&\forall x,w\,(\langle x,w\rangle \in p \iff
 \exists t,q\, (t \in {\sf FUNC} \ \land \ \langle g,t\rangle \in z \ \land \ \langle x,q \rangle \in t \ \land \ \langle q,w\rangle \in g))) \\
 &&\land \ \langle x,w \rangle \in y).
 \end{eqnarray*}
 Now we choose
 $$ Y := \{ \langle x,w \rangle: \exists t,q\,(t \in {\sf FUNC} \ \land \ \langle f,t\rangle \in z \ \land \ \langle x,q \rangle \in t  \ \land \ \langle q,w \rangle \in f.\}$$
 (It is important to quantify over $t$ and $q$ even though there are free variables $t$ and $q$ in scope here.)
 The formula is stratified giving $x,w,t,q$ index 0 and $z,f$ index 3; ${\sf FUNC}$ is a parameter.  Hence
 the definition can be given in {\rm INF}.  Using $Y$ to instantiate $\exists y$, we have to prove
 \begin{eqnarray*}
 &&   z \in {\sf FUNC} \land \ \exists g,p\, (\langle f,Y \rangle = \langle g,p \rangle \ \land \
 g \in {\sf FUNC} \ \land \  \\
 &&\forall x,w\,(\langle x,w\rangle \in p \iff
 \exists t,q\, (t \in {\sf FUNC} \ \land \ \langle g,t\rangle \in z \ \land \ \langle x,q \rangle \in t \ \land \ \langle q,w\rangle \in g))) \\
 &&\land \ \langle x,w \rangle \in Y .
 \end{eqnarray*}
 We have $z \in {\sf FUNC}$ and $t\in {\sf FUNC}$;  take $g = f$ and $p = Y$; then it suffices to prove
 \begin{eqnarray*}
 &&\forall x,w\,(\langle x,w\rangle \in Y \iff
 \exists t,q\, (t \in {\sf FUNC} \ \land \ \langle f,t\rangle \in z \ \land \ \langle x,q \rangle \in t \ \land \ \langle q,w\rangle \in f))) \\
 &&\land \ \langle x,w \rangle \in Y).
 \end{eqnarray*}
 The first line follows from the definition of $Y$.  It remains to prove $\langle x,w\rangle\in Y$.
 Note that in the last line, $x$ and $w$ are free variables.   We have by assumption
 $$\langle f,t\rangle \in z \ \land \ \langle x,q \rangle \in t  \ \land \ \langle q,w \rangle \in f.$$
 Then by definition of $Y$ we have $\langle x,w\rangle\in Y$, as desired.
 That completes the proof of the lemma.

  \begin{lemma}\label{lemma:sfunction2} For all $z$,  $z \in {\sf FUNC} \ {\rightarrow}\  {\sf S} z \in {\sf FUNC}$.
 \end{lemma}

 \noindent{\em Proof}.  Immediate from Definition~\ref{definition:sucdef}.

 \begin{lemma}\label{lemma:srelation2} For all $z$, ${\sf S} z$ is a relation.
 \end{lemma}

 \noindent{\em Remark}. Since our definition of ${\sf FUNC}$ does not require a function
 to be a relation (i.e., contain only ordered pairs), this lemma adds something to the
 previous lemma.
 \medskip

\noindent{\em Proof}.  Immediate from Definition~\ref{definition:sucdef}.

\begin{definition} \label{definition:function}
$f: {\mathbb N} \to {\mathbb N}$ means   $f \in {\sf FUNC}$  and
for each $n \in {\mathbb N}$ there is a
unique $m \in {\mathbb N}$ such that $\langle n,m \rangle \in f$.
\end{definition}
The concept just defined does not prevent the domain of $f$
from being larger than ${\mathbb N}$.

\begin{definition}\label{definition:ChurchFreged}
${{\sf id}}$ is the identity function, $\{ \langle x,x\rangle: x =x \}$.
\end{definition}

\begin{definition}\label{definition:ChurchZero}
${\bf 0}$ is the function $\lambda f\,x.x$, which as a set
of ordered pairs is
$$ \{ \langle f,  {\sf id} \,\rangle  : f=f \},$$
\end{definition}

\noindent{\em Remark}.  Then ${\bf 0}: X \to X$ for any set $X$,
but the domain of ${\bf 0}$ is the whole universe, usually larger than $X$.
\smallskip

\begin{lemma} \label{lemma:zeroFUNC}
 ${\bf 0} \in {\sf FUNC}$.
\end{lemma}

\noindent{\em Proof}.  Immediate from the definition of ${\bf 0}$.

\begin{lemma} \label{lemma:ApZero} For all $x$, ${\bf 0} x = {\sf id} $, the identity function.
\end{lemma}

\noindent{\em Proof}.  By definition of ${\bf 0}$,  $\langle f,u \rangle \in {\bf 0}$
if and only if $u = {\sf id} $.    Then for any $f$,  $\langle f, {\sf id} \rangle \in
{\bf 0}$,  so by Lemma~\sref{lemma:Ap}, we have ${\sf id}  = Ap\, ({\bf 0}, f) = {\bf 0} f$
as desired.  That completes the proof.

\begin{lemma} \label{lemma:zeroAp}
For all $x$,  ${\bf 0} f x = x$.
\end{lemma}

\noindent{\em Proof}. By Lemma~\ref{lemma:ApZero},   ${\bf 0} f$ is the identity
function.  It follows from
Lemma~\sref{lemma:Ap} that $x = Ap (({\bf 0} f), x)$.  Suppressing explicit mention of $Ap$,
that is ${\bf 0} f x = x$.  That completes the proof of the lemma.

\begin{lemma} \label{lemma:ApOne} For all $f$, $f \in {\sf FUNC} \ {\rightarrow}\  Rel(f) \ {\rightarrow}\  {\sf S} {\bf 0} f = f$.
\end{lemma}

\noindent{\em Proof}
Lemma~\ref{lemma:ChurchSuccessor2}, with $z$ in the lemma set to ${\bf 0}$,
 \begin{eqnarray*}
{\sf S} {\bf 0} f &=&   \{ \langle x, w\rangle :
             \exists t,q\,
                     ( t \in {\sf FUNC} \land \langle f,t \rangle \in {\bf 0} \land
                       \langle x,q \rangle \in t \land
                       \langle q,w \rangle \in f
                      )
                \}
 \end{eqnarray*}
 By the definition of ${\bf 0}$,  $\langle f,t \rangle \in {\bf 0}$ is
 equivalent to $t = {\sf id} $; then $\langle x,q \rangle \in t$ is equivalent
 to $x = q$, and we have
 \begin{eqnarray*}
{\sf S} {\bf 0} f &=&   \{ \langle x, w\rangle : \langle x,w \rangle \in f \}  \\
                 &=& f \mbox{\qquad by extensionality and $Rel(f)$}
 \end{eqnarray*}

\begin{definition}\label{definition:N}
The set of Church numbers is the least set containing ${\bf 0}$
and closed under Church successor ${\sf S} $.  That is, it is the intersection
of all sets containing ${\bf 0}$ and closed under ${\sf S} $.
\end{definition}

\begin{theorem} \label{theorem:ChurchNumbers}
The set of Church numbers is definable (by stratified formulas) in {\rm INF}.
\end{theorem}

\noindent{\em Proof}.
By Lemma~\ref{lemma:sucdef}, ${\sf S}$ is definable in NF. Then
$$ {\mathbb N} = \{\ x : \forall X(0 \in X \land \forall u \in X( {\sf S} u \in X)) \ {\rightarrow}\  x \in X\ \} $$
In other words,
$$ {\mathbb N} = \{\ x : \exists z (z = 0) \land
 \forall X(z \in X \land \forall u \in X \exists v( v= {\sf S} u \land v\in X)) \ {\rightarrow}\  x \in X \ \} $$
To check that this definition is legal in NF, we stratify the
formula on the right, giving $v$ and $u$ the same index, say 6,
since ${\sf S}$ is a function.  Then $X$ gets index 7 and $x$ and $z$ get index 6.
As discussed above we can stratify $z = 0$ giving $z$ any
index $\ge 3$, so 6 is OK.  ${\mathbb N}$ is a parameter and does not need an index.
This stratification shows that ${\mathbb N}$ is well-defined in NF.
That completes the proof of the theorem.

\begin{lemma}[Proof by induction] \label{lemma:Ninduction}

$$ {\bf 0} \in x \land \forall n \in {\mathbb N}(n \in x \ {\rightarrow}\  {\sf S} n \in x) \ {\rightarrow}\  \forall k \in {\mathbb N}\,( k \in x).$$
\end{lemma}

\noindent{\em Proof}.
 By Definition~\ref{definition:N} and
 Theorem~\ref{theorem:ChurchNumbers},
 ${\mathbb N}$ is the
intersection of all sets closed under successor.  There is at least
one such set, since ${\mathbb V}$ is closed under successor and contains $0$,
so ${\mathbb N}$ is not empty.    Then $x$ contains $0$ and is closed under
successor. Hence ${\mathbb N} \subseteq x$.  That completes the proof.
\smallskip

{\em Remark}.  If we wish to prove a stratified formula $\phi$  ``by induction on $n$'', we use
stratified comprehension to define $x = \{ n: \phi(n)\}$, and then prove the ``base case'' that $\Phi(0)$and the ``induction step'' that $\phi(n) \ {\rightarrow}\  \phi({\sf S} n)$.  Then ${\bf 0} \in x$ and
$n \in x \ {\rightarrow}\  {\sf S} n \in x$.  Then Lemma~\ref{lemma:Ninduction} can
be used to conclude that ${\mathbb N} \subseteq x$.  Hence $\forall n \in {\mathbb N}\, \phi(n)$.
\smallskip

\begin{lemma}\label{lemma:zeroN}
 ${\bf 0} \in {\mathbb N}$.
\end{lemma}

\begin{lemma}\label{lemma:successorN}
 ${\sf S} : {\mathbb N} \to {\mathbb N}$
\end{lemma}

\noindent{\em Proof}. By definition ${\mathbb N}$ is the
intersection of all sets containing ${\bf 0}$ and closed under successor.
Therefore ${\bf 0} \in {\mathbb N}$.   That completes the proof of the lemma.

\noindent{\em Proof}. By definition ${\mathbb N}$ is the
intersection of all sets containing ${\bf 0}$ and closed under successor.
Let $n \in {\mathbb N}$.  Then $n$ belongs to every set $X$ containing ${\bf 0}$ and
closed under successor.  Hence ${\sf S} n$ belongs to every such set $X$.
Hence ${\sf S} n$ belongs to ${\mathbb N}$.  That completes the proof of the lemma.

\begin{lemma} \label{lemma:Churchnumbersarefunctions}
Every Church number $n$ is a function.
\end{lemma}

\noindent{\em Proof}.  By induction on $n$.
\smallskip

Base case: ${\bf 0} \in {\sf FUNC}$ by Lemma~\ref{lemma:zeroFUNC}.
\smallskip

Induction step:  Suppose $n \in {\mathbb N}$ and $n \in {\sf FUNC}$.
By Lemma~\ref{lemma:sfunction2}, ${\sf S} n \in {\sf FUNC}$.
That completes the induction step.  That completes the proof of the lemma.

\begin{lemma} \label{lemma:Churchnumbersarerelations}
Every Church number $n$ is a relation.
\end{lemma}

\noindent{\em Proof}.  By induction on $n$, similar to Lemma~\ref{lemma:Churchnumbersarefunctions},
but appealing to Lemma~\ref{lemma:srelation2} in
the induction step.

 \begin{lemma} \label{lemma:ChurchSuccessor4} Let $n \in {\sf FUNC}$ and $f \in {\sf FUNC}$.
 Then there exists $y$ such that $\langle f,y \rangle \in {\sf S} n$.
 \end{lemma}

 \noindent{\em Proof}.  Let $n$ and $f$ be given, with $n \in {\sf FUNC}$ and $f \in {\sf FUNC}$.
 Define
 $$ y := \{ \langle x, z\rangle : \langle f,p \rangle \in n \ \land \ \langle x,q \rangle \in p
 \ \land \ \langle q,z \rangle \in f \ \land \ p \in {\sf FUNC}\}.$$
 The formula defining $y$ is stratified, giving $x$, $z$, and $q$ index 0; then $\langle x, q\rangle$
 gets index 2, so $p$ gets index 3.  Then $f$ gets index 3 and $\langle f,p \rangle$ gets
 index 5, so $n$ gets index 6.  Therefore the formula is stratified, and the definition
 of $y$ is legal.

 The verification that $\langle f, y \rangle \in {\sf S} n$ then proceeds by unfolding the
 definitions of ${\sf S} n$ and $y$.  We omit the 65 routine steps of this verification.

\section{Iteration of a function}
If we have a mapping $f:X\to X$, we can iterate it $j$ times.  Often mathematicians
write the $j$-times iterated mapping as $f^j$, or if there is danger of confusion, as $f^{(j)}$.
Formally it is just $jf$, where $j$ is a Church number.  In treating this subject rigorously
one has to distinguish the relevant concepts precisely.  Namely, we have
\begin{eqnarray*}
f:X \to Y \\
Rel(f) \\
f \in {\sf FUNC} \\
oneone(f,X,Y)
\end{eqnarray*}
$Rel(f)$ means that all the members of $f$ are ordered pairs.  $f \in {\sf FUNC}$ means that
two ordered pairs in $f$ with the same first member have the same second member.  (Nothing
is said about possible members of $f$ that are not ordered pairs.)  $f:X \to Y$ means that
if $x \in X$, there is a unique $y$ such that $\langle x,y \rangle \in f$ and that $y$ is in $Y$.
(But nothing is said about $\langle x, y\rangle \in f$ with $x \not \in X$.)  ``$f$ is one-to-one
from $X$ to $Y$'',  or $oneone(f,X,Y)$,  means $f:X \to Y$ and in addition, if $\langle x,y \rangle \in f$
and $\langle u,y\rangle \in f$ then $x = u$,  and if $y \in Y$ then $x \in X$.  (So $x=u$ does
not require $y \in Y$ or $x \in X$.)  In particular, $f:X \to Y$ does not require $dom X \subseteq X$,
so the identity function maps $X$ to $X$ for every $X$; but the identity function (on the universe)
has to be restricted to $X$ before it is one-to-one.

We shall be mostly concerned with iterations of a map $f$ from some set $X$ to that same set.
In that setting the following concept is useful.

\begin{definition}\label{definition:permutation2}
$f$ is a {\bf permutation} of a finite set $X$ if and only if $f:X \to X$,
and $Rel(f)$ and $f \in {\sf FUNC}$, and $dom(f) \subseteq X$,
and $f$ is both one-to-one and onto from $X$ to $X$.
\end{definition}

But for some purposes, we don't need $f$ to be onto,  but we still need it
to be a relation and a function and to control its range and domain.  Therefore we define

\begin{definition}\label{definition:ChurchFregenjection}
$f$ is an {\bf injection} of a set $X$ into $Y$ if and only if $f:X \to Y$,
and $Rel(f)$ and $f \in {\sf FUNC}$, and $dom(f) \subseteq X$,
and $f$ is  one-to-one  from $X$ to $X$.
\end{definition}

Note that the definition does not require $X$ to be finite.
\smallskip

Any function can be iterated, even if it doesn't map some $X$ to itself:

\begin{lemma} \label{lemma:nf_defined} Let $n \in {\mathbb N}$ and $f \in {\sf FUNC}$.  Then there
exists $y$ such that $\langle f,y\rangle \in n$.
\end{lemma}

\noindent{\em Proof}.  The formula is stratified, so we may prove it by induction.
\smallskip

Base case: By the definition of Church zero, we have $\langle f, {\sf id}  \rangle \in {\bf 0}$.
\smallskip

Induction step: By Lemma~\ref{lemma:ChurchSuccessor4}.  That completes the induction step.
That completes the proof of the lemma.

\begin{lemma} \label{lemma:nfFUNC} Let $n \in {\mathbb N}$ and suppose $f \in {\sf FUNC}$ and $Rel(f)$.
Then $nf \in {\sf FUNC}$  and $Rel(nf)$.
\end{lemma}

\noindent{\em Proof}. By induction on $n$, which is legal since the formula is stratified.
(Although $Ap(n,f)$ gets the same type as $f$, that observation is not even needed here, as ${\sf FUNC}$
is just a parameter, so $f$ can be given any type and it doesn't matter what type $nf$ gets.)
\smallskip

Base case: ${\bf 0} f$ is the identity function, by definition of ${\bf 0}$.  Since the
identity function is also a a relation, that
completes the base case (though it requires 24 steps, here omitted, to spell out the details).
\smallskip

Induction step: Suppose $f \in {\sf FUNC}$ and $n \in {\mathbb N}$ and $nf \in {\sf FUNC}$.
 By Lemma~\ref{lemma:ChurchSuccessor2},
we have
\begin{eqnarray}
{\sf S} nf &=&   \{ \langle x, w\rangle :
             \exists t,q\,
                     ( t \in {\sf FUNC} \land \langle f,t \rangle \in n \land
                       \langle x,q \rangle \in t \land
                       \langle q,w \rangle \in f
                      )
                \}  \label{eq:E527}
 \end{eqnarray}
 Then ${\sf S} nf$ is a relation.  We next will prove ${\sf S} nf \in {\sf FUNC}$.
 Suppose $\langle x,y\rangle \in {\sf S} nf$ and $\langle x,z\rangle \in {\sf S} nf$. We must prove $y=z$.
 By (\ref{eq:E527}) there exist $t_1,q_1$ and $t_2,q_2$ such that
 \begin{eqnarray*}
 {\sf FUNC}(t_1) &&\\
 {\sf FUNC}(t_2) &&\\
 \langle f,t_1\rangle \in n && \\
 \langle f,t_2\rangle \in n &&\\
 \langle x,q_1 \rangle \in t_1 &&\\
 \langle x,q_2 \rangle \in t_2 &&\\
 \langle q_1,y \rangle \in f && \\
 \langle q_2,z \rangle \in f &&
 \end{eqnarray*}
 Using the definition of ${\sf FUNC}$ several times we obtain, in order, $t_1 = t_2$, then $q_1 = q_2$,
 and finally $y=z$.
That completes the induction step.
   That completes the proof of the lemma.

\begin{lemma} \label{lemma:iteration}
Let $X$ be any set.  Suppose $f: X \to X$
and $f \in {\sf FUNC}$  and $Rel(f)$).
Then for all
$n\in {\mathbb N}$ and $x \in X$,
$$ \langle f, nf \rangle \in n \ \land \ nf : X \to X$$
\end{lemma}

\noindent{\em Proof}.   Let $f \in {\sf FUNC}$ and $Rel(f)$ and $f:{\mathbb N} \to {\mathbb N}$.
By Lemma~\sref{lemma:Ap}, $\langle f, nf \rangle \in n$ is equivalent
to $\exists y\, (\langle f,y \rangle \in n)$.
\smallskip

The formula is stratified, giving $X$ index 1, $f$ index 3 (since
the members of $f$ are ordered pairs of members of $X$),  $x$ index 0;
$nf$ gets index 3, since $n$ is a function by Lemma~\ref{lemma:Churchnumbersarefunctions};
so we have to give $n$ index 6, since its members are pairs of objects of type 3.

Base case:
By Lemma~\ref{lemma:zeroFUNC}, ${\bf 0}$ is a function, and by definition of ${\bf 0}$,
${\bf 0} f$ is the identity function,  so ${\bf 0} f: X \to X$.  That completes the
base case.
\smallskip

Induction step:  We first have to show that $\langle f, {\sf S} nf \rangle \in {\sf S} n$.
By Lemma~\ref{lemma:ChurchSuccessor4}, we have $\exists y\,( \langle f, y \in {\sf S} n)$.
Then by Lemma~\sref{lemma:Ap}, we have $\langle f, {\sf S} n f \rangle \in {\sf S} n$, as claimed.
\smallskip

We turn to the proof that ${\sf S} nf : X \to X$.
 By Lemma~\ref{lemma:Churchnumbersarefunctions},
  $n$ is a function, and by Lemma~\ref{lemma:nfFUNC},
$nf$ is a function.   Then according to
  Lemma~\ref{lemma:ChurchSuccessor2},
we have
\begin{eqnarray}
{\sf S} nf &=&   \{ \langle x, w\rangle :
             \exists t,q\,
                     ( t \in {\sf FUNC} \land \langle f,t \rangle \in n \land
                       \langle x,q \rangle \in t \land
                       \langle q,w \rangle \in f
                      )
                \}  \label{eq:658}
 \end{eqnarray}
 Let $x \in X$.  By Lemma~\ref{lemma:nf_defined},
$\langle f,t\rangle \in n$ for some $t$; by Lemma~\sref{lemma:Ap}, $t = nf$.
By the induction hypothesis, $nf:X \to X$, so there exists $q$ with $\langle x,q\rangle \in t$
and $q \in X$.  Then since $f:X \to X$, there exists $w$ with $\langle q,w \rangle \in f$.
Then by (\ref{eq:658}), we have $\langle x,w \rangle \in {\sf S} nf$.  Since $x$ was arbitrary,
we have proved ${\sf S} nf : X \to X$.
That completes the induction step.  That completes the proof of the lemma.

\begin{theorem}[successor equation] \label{theorem:successorequation}
Let $X$ be any set and $f$ any function ($f \in {\sf FUNC}$ and $Rel(f)$)
with $f:X \to X$.
Then for all $n\in {\mathbb N}$ and $x \in X$,
$$ {\sf S}  n f x = f(n f x).$$
\end{theorem}

\noindent{\em Proof}.   Let $f:X \to X$ and $n \in {\mathbb N}$ and $x \in X$.
 By Lemma~\ref{lemma:Churchnumbersarefunctions},
  $n$ is a function, and by Lemma~\ref{lemma:nfFUNC},
$nf$ is a function.   Then according to
  Lemma~\ref{lemma:ChurchSuccessor2},
we have
\begin{eqnarray*}
{\sf S} nf &=&   \{ \langle x, w\rangle :
             \exists t,q\,
                     ( t \in {\sf FUNC}  \land \langle f,t \rangle \in n \land
                       \langle x,q \rangle \in t \land
                       \langle q,w \rangle \in f
                      )
                \}
 \end{eqnarray*}
By Lemma~\ref{lemma:iteration}, $nf:X \to X$.
Then as in the proof of that lemma, we have $t = nf$, $q = tx = nfx$, and $w = fq$,
with $\langle x,w \rangle \in {\sf S} nf$.  That completes the proof of the theorem.

\begin{lemma} \label{lemma:Church1notequal0}
Define $1 := {\sf S} 0$.  Then $1 \neq 0$.
\end{lemma}

\noindent{\em Proof}.
Let $f$ and $z$ be functional relations.  Then by Lemma~\ref{lemma:ChurchSuccessor3},
${\sf S} zf$ is a relation, and by
 Lemma~\ref{lemma:ChurchSuccessor2},
\begin{eqnarray*}
\langle x,w \rangle \in {\sf S} zf &\iff&
           \exists t,q(t \in {\sf FUNC}  \land \langle f,t\rangle \in z
                       \land \langle x,q \rangle \in t
                       \land \langle q,w \rangle \in f)
\end{eqnarray*}
Take $z = 0$.  Then on the right, $t = zf$ and $q = tx = zfx = x$
since $z=0$.   Then $w = fx$.  Thus
\begin{eqnarray*}
\langle x,w \rangle \in {\sf S} 0f &=&   \langle x,w\rangle \in   f
\end{eqnarray*}
By Lemma~\ref{lemma:ChurchSuccessor4}, ${\sf S} 0f$ is a relation, and
by hypothesis $f$ is a relation.  Therefore
$$ \forall u\, (u \in {\sf S} 0 f \iff u \in f).$$
Then by extensionality,
$1 f = f$, for all functional relations $f$.

  Now suppose,
for proof by contradiction, that $1 = 0$.  Then
on the one hand, $1f =f$, and on the other hand
$1f  = 0f  = {\sf id}  $.  Now we can get a contradiction
by exhibiting some (any) functional relation $f$ that
is not the identity. For example, we can use $f = \{ \langle {\Lambda}, \{{\Lambda}\}\}$.
It is easily verified that $f$ is a functional relation and is not
equal to ${\sf id} $.  That completes the proof of the lemma.
\smallskip

\noindent{\em Remark}. The proof does not follow immediately
from Theorem~\ref{theorem:successorequation}, it seems.
For if we assume $1=0$, that equation says
$$  1 f x\  = \ {\sf S} 0 fx \ = \ f(0f x)$$
and since we have assumed 1 = 0, also $1 fx = 0fx$.
But by definition of $0$, we have $0 f x = x$.
Thus $x = 0fx = 1fx = f(0fx) = fx$.  Hence $f$ is
the identity function on ${\mathbb N}$.  That is, however,
not yet a contradiction.

\begin{theorem} \label{theorem:successoromitszero}
The Church successor function
does not take the value ${\bf 0}$ on ${\mathbb N}$; that is, $n \in {\mathbb N} \ {\rightarrow}\  {\sf S} n \neq {\bf 0}$.
\end{theorem}

\noindent{\em Proof}.  Let $a$ and $b$ be any two unequal members of ${\mathbb N}$;
by Lemma~\ref{lemma:Church1notequal0} there do exist two unequal members of ${\mathbb N}$.
Let $f$ be
the constant function with value $a$.  Then $f:{\mathbb N} \to {\mathbb N}$.
 Suppose, for proof by
contradiction, that ${\sf S} (z) = 0$.  Applying both sides to
$f$ and $b$ we have, by the definitions of ${\sf S} $ and $0$,
\begin{eqnarray*}
{\sf S} zfb &=& 0fb\\
f(zfb) &=& 0fb \mbox{\qquad by Theorem~\ref{theorem:successorequation}}\\
f(zfb) &=& b  \mbox{\qquad since $0fb = b$ by definition of $0$}\\
a &=& b \mbox{\qquad since $f(u) = a$ for all $u$}
\end{eqnarray*}
But that contradicts $a \neq b$.  That completes the proof of the
theorem.
\smallskip

{\em Remark}.  All we needed to prove that successor omits the value $0$
is that there is some function $f:{\mathbb N} \to {\mathbb N}$ that omits some value;
and we can construct such a function if
there are two distinct members of ${\mathbb N}$.

\begin{lemma}[Predecessor] \label{lemma:predecessor}
If $n \in {\mathbb N}$ and $n \neq {\bf 0}$,
then $n = {\sf S} m$ for some $m \in {\mathbb N}$.
\end{lemma}

\noindent{\em Remark}.  The predecessor is, of course, not asserted
to be unique.
\medskip

\noindent{\em Proof}. By induction on $x$ we prove
that $x \in {\mathbb N} \ {\rightarrow}\  x \neq 0 \ {\rightarrow}\  \exists y\in {\mathbb N}\,({\sf S} y = x)$.
The base case and induction step are both
immediate.

\begin{lemma}\label{lemma:decidable0} $\forall n \in {\mathbb N}\,(n = {\bf 0} \ \lor \ n \neq {\bf 0})$.
\end{lemma}

\noindent{\em Proof}.  By induction on $n$, which is legal since the formula is stratified.
The base case is immediate; and the induction step is
immediate from Theorem~\ref{theorem:successoromitszero}.  That completes the proof of the lemma.

\begin{lemma} \label{lemma:iterationFUNC}
  Suppose $f: X \to X$, and $f \in {\sf FUNC}$ and $Rel(f)$,
and $dom(f) \subseteq X$.  Let $n \in {\mathbb N}$ and suppose $n \neq {\bf 0}$.  Then
$dom(nf) \subseteq X$.
\end{lemma}

\noindent{\em Remark}.  When $n = {\bf 0}$, $nf$ is the identity function, whose
domain is ${\mathbb V}$.  Hence the restriction $n \neq {\bf 0}$ is necessary.
\medskip

\noindent{\em Proof}.  By induction on $n$, which is legal since the formula is stratified.
Base case:  there is nothing to prove because of the hypothesis $n \neq {\bf 0}$.
\smallskip

Induction step: Assume ${\sf S} n \neq {\bf 0}$.
 By Lemma~\ref{lemma:decidable0}, $n = {\bf 0} \ \lor \ n \neq {\bf 0}$.  We argue
by cases accordingly.
\smallskip

Case 1, $n = {\bf 0}$.  We have to show $dom ({\sf S} {\bf 0} f) \subseteq X$.
  Suppose $x \in dom ({\sf S} nf)$.  It suffices to show $x \in X$.
    By Lemma~\ref{lemma:ApOne}, ${\sf S}{\bf 0} f = f$.
Therefore $x \in dom(f)$.  Since $dom(f) \subseteq X$, we have $x \in X$ as desired.
That completes Case~1.
\smallskip

Case 2, $n \neq {\bf 0}$.  By Lemma~\ref{lemma:nfFUNC}, we have $nf \in {\sf FUNC}$ and $Rel(nf)$,
and also ${\sf S} n f \in {\sf FUNC}$ and $Rel ({\sf S} n f)$.
  Suppose
$\langle x,y \rangle \in {\sf S} nf$.  We must show $x \in X$.  Since ${\sf S} nf \in {\sf FUNC}$,
we have $y =  ({\sf S} n f) x$.  By Lemma~\ref{lemma:ChurchSuccessor2}, we have
\begin{eqnarray*}
x \in dom ({\sf S} nf) \iff \exists w,t,q\,(t \in {\sf FUNC} \ \land \ \langle f,t \rangle \in n
\ \land \ \langle x,q \rangle \in t \ \land \ \langle q,w\rangle \in f)
\end{eqnarray*}
Suppose $x \in dom ({\sf S} nf)$.  Then for some $w,t,q$ we have
\begin{eqnarray*}
 t \in {\sf FUNC} \ \land \ \langle f,t \rangle \in n
\ \land \ \langle x,q \rangle \in t \ \land \ \langle q,w\rangle \in f
\end{eqnarray*}
Then by Lemma~\sref{lemma:Ap}, $ t = nf$.   By the induction hypothesis,
$dom(nf) \subseteq X$.  Since $\langle x,q \rangle \in t$ and $t = nf$, we have
$x \in dom(nf)$ and hence $x \in X$.  That completes Case~2.  That completes
the induction step.  That completes the proof of the lemma.

\begin{lemma}\label{lemma:oneoneiteration_helper}
Suppose  $f \in {\sf FUNC}$ and $Rel(f)$, and $f:X \to X$ and $m \in {\mathbb N}$
and $ mf$ is one-to-one
from $X$ to $X$,  and $dom(f) \subseteq X$.  Then ${\sf S} m f :X \to X$,
and ${\sf S} m f$ is
one-to-one.
\end{lemma}

\noindent{\em Proof}.
Suppose ${\sf S} m x = {\sf S} m z$.  I say $x = z$.  We have
\begin{eqnarray*}
{\sf S} m f x = f (m f x))  && \mbox{\qquad by Theorem~\ref{theorem:successorequation}}\\
{\sf S} m f z = f (m f z))  && \mbox{\qquad Theorem~\ref{theorem:successorequation}}\\
f( m f x) = f( m f z)  && \mbox{\qquad by the preceding two lines}\\
x = z  &&   \mbox{\qquad since $mf$ is one-to-one}
\end{eqnarray*}
Technically, however, the definition of one-to-one involves more than
just $x=z$.  We have
\begin{eqnarray*}
{\sf S} m f \in {\sf FUNC} && \mbox{\qquad by Lemma~\ref{lemma:nfFUNC}}
\end{eqnarray*}
We also have to show that $m f$ is a relation,
that its domain is a subset of $X$, and that its range is a subset of $X$.
These verifications require about 100 proof steps (here omitted),
using for example Lemmas~\ref{lemma:Churchnumbersarefunctions} and
~\ref{lemma:Churchnumbersarefunctions}
and \ref{lemma:iterationFUNC}.
That completes the proof of the lemma.

\begin{lemma} \label{lemma:oneoneiteration}
Let $X$ be any set, and let $f:X \to X$ be a permutation.
 Let $m \in {\mathbb N}$.  Then $mf:X \to X$  for  $m \neq {\bf 0}$, $mf$ is a permutation.
\end{lemma}

\noindent{\em Remark}.  When $ m = {\bf 0}$, $m f$ is the identity function,
which has domain ${\mathbb V}$, so it is not a permutation of $X$ (unless $X = {\mathbb V}$).
\medskip

\noindent{\em Proof}.  By induction on $m$.  The formula is stratified, as we
have already checked that ``one-to-one'' and ``$f:X \to X$'' are stratified.
\smallskip

Base case, when $m = {\bf 0}$ we have $mf = {\sf id} $, by definition of ${\bf 0}$,
and the identity function maps $X$ to $X$, and the identity
function is one-to-one.  That completes the base case.
\smallskip

Induction step.  Suppose $mf:X\to X$ is one-to-one, and
$$ m \neq {\bf 0} \ {\rightarrow}\  range(mf) \subseteq X.$$
We must prove ${\sf S} mf:X \to X$ and ${\sf S} m$ is one-to-one.  We have $m = {\bf 0} \ \lor \ m \neq {\bf 0}$,
by Lemma~\ref{lemma:decidable0}. We argue by cases.
\smallskip

Case~1: $m = {\bf 0}$.  Then $mf = f$, so by hypothesis, $mf$ is a permutation
of $X$.
\smallskip

Case~2: $m \neq {\bf 0}$.
Assume $x \in X$.  Then by Lemma~\ref{lemma:oneoneiteration_helper},
${\sf S} m f:X \to X$  and ${\sf S} m f$ is one-to-one.   That completes Case~2.
That completes the induction step.  That completes the proof of the lemma.

\section{Definition of addition on ${\mathbb N}$}
In this section we define addition on ${\mathbb N}$ and prove some of
its properties.   To define the graph of a binary function
we use ordered triples, which are defined in Definition~\sref{definition:triples}.

\begin{lemma} \label{lemma:sum} {\rm INF}\ can define a
 set $Sum$ such that for $x,n,y \in {\mathbb N}$
\smallskip

(i) $\langle x,0,x  \rangle \in Sum$, and
\smallskip

(ii) $\langle x,n,y \rangle\in Sum \ {\rightarrow}\
 \langle x, {\sf S} n, {\sf S} y \rangle \in Sum$, and
 \smallskip

(iii) $Sum$ is the intersection of all sets $X$
satisfying those two conditions;

\end{lemma}

\noindent{\em Proof}.  $Sum$ is the intersection of
sets $X$ satisfying  conditions (i) and (ii)
with $Sum$ replaced by $X$.  Specifically those  conditions are
\begin{eqnarray*}
 x \in {\mathbb N} &\ {\rightarrow}\ & \langle x,0,x \rangle \in X  \\
x \in X \land y \in {\mathbb N} \land n \in {\mathbb N} &\ {\rightarrow}\ &
(\langle x,n,y \rangle \in X \ {\rightarrow}\
 \langle x, {\sf S} n, {\sf S} y \rangle \in X)
 \end{eqnarray*}
 These formulas can be stratified by assigning  $x$, $y$, and $n$
 all index 0, ${\mathbb N}$ index 1, and $X$ index 5.

 Then the conjunction of these two
 conditions, preceded by $\forall X$, is also stratifiable, and
 it defines $Sum$.

 Now we must prove that $Sum$ so defined satisfies the
three conditions itself.  Suppose $x \in {\mathbb N}$.  Then
 $\langle x,0,x \rangle$ belongs to
 every $X$ satisfying the conditions. Hence it belongs
 to $Sum$.  Hence $Sum$ satisfies the first condition.

 Suppose $x\in {\mathbb N}$ and $y \in {\mathbb N}$ and $n \in {\mathbb N}$.   Suppose
 $\langle x,n,y \rangle \in Sum$.
 Then for every $X$ satisfying the conditions,
  $\langle x,n,y \rangle \in X$.
 Then for every $X$ satisfying the conditions,
 $\langle x,{\sf S} n, {\sf S} y\rangle \in X$.
 Then
  $\langle x, {\sf S} n, {\sf S} y \rangle \in Sum$.
 That verifies that $Sum$ satisfies the second condition.
 That completes the proof of the lemma.
\smallskip

\begin{lemma} \label{lemma:additionfunction} {\rm INF}\ proves that
for each $x,n \in {\mathbb N}$, there is a unique $y \in N$ such that
$\langle x,n,y \rangle \in Sum$.
\end{lemma}

\noindent{\em Proof}. (Holmes) First, by induction on $n$, there is
some $y$ such that $\langle x, n, y \rangle \in Sum$; the
clauses (i) and (ii) in the definition yield the base case
and induction steps, respectively.  So it suffices to prove
by induction on $x$ that
$$ \forall y \in {\mathbb N}\,(\langle x,y,z \rangle \in Sum \land \langle x,y,w \rangle\in Sum
    \ {\rightarrow}\  z = w).$$

Base case: Since $\langle 0,y,y \rangle \in Sum$, it suffices to prove that
$\langle 0,y,z\rangle \in Sum$
implies $z = y$.  To that end define
$$ X = \{ \langle x,y,z \rangle : x = 0 \ {\rightarrow}\  y = z \}.$$
That is legal as the formula is stratifiable.
I say that $X$ satisfies the closure conditions in the definition
of $Sum$.  Ad~(i): We have $\langle x, 0, x \rangle \in X$,
since $x = 0 \ {\rightarrow}\  0 = x$.
Ad~(ii):  Suppose $\langle x, y, z \rangle \in X$.
We must show $\langle x, {\sf S} y, {\sf S} z \rangle \in X$.
Since $\langle x, y, z \rangle \in X$, we have $x = 0 \ {\rightarrow}\  y = z$.
Then also $x=0 \ {\rightarrow}\  {\sf S} y = {\sf S} z$.  Therefore
$\langle x, {\sf S} y, {\sf S} z \rangle \in X$.  Therefore $X$ satisfies
both closure conditions.  Therefore $Sum$ is a subset of $X$.
Therefore $\langle 0,y,z \rangle \in Sum$  implies $y=z$,
as desired.   That completes the base case.
\smallskip

Induction step:  The induction hypothesis is that (with $x$ fixed)
for every $y \in {\mathbb N}$, there
is a unique $p \in {\mathbb N}$ such
that $\langle x, y, p \rangle \in Sum$. We denote that unique $p$
by $x\oplus y$.
Suppose that
\begin{eqnarray}
&& \langle {\sf S} x, y, z \rangle \in Sum  \label{eq:707} \\
&&\langle {\sf S} x,y, w \rangle \in Sum \label{eq:708}
\end{eqnarray}
  We must prove $z=w$.
\smallskip

We define a set $X$ (depending on $x$, which is now fixed until
we finish the induction step):
$$X = \{ \langle u,v,z \rangle : u = {\sf S} x \ {\rightarrow}\  z = {\sf S}(x\oplus v)\}.$$
That formula is stratifiable, as ``$z = {\sf S}(x\oplus v)$'' can be replaced
by $\exists p\,(Sum(x,v,p) \land {\sf S} p = z$'', and all the variables
can be given the same type.  Hence the definition of $X$ is legal.
I say that $X$ satisfies the closure conditions in the definition
of $Sum$.  Ad~(i): We must show $\langle x, 0,x \rangle \in X$.
That holds if and only if $x = {\sf S} x \ {\rightarrow}\  x = {\sf S}(x\oplus 0)$.
But $x\oplus 0 = 0$, so the condition is $x = {\sf S} x \ {\rightarrow}\  x = {\sf S} x$,
which is indeed valid.
\smallskip

Ad (ii):  Suppose $\langle u,v,z \rangle \in X$.
We must show
$\langle u, {\sf S} v, {\sf S} z \rangle \in X$.
We have
\begin{eqnarray*}
u = {\sf S} x \ {\rightarrow}\  z = {\sf S}(x\oplus v)  && \mbox{\qquad since $\langle u,v,z \rangle \in X$}
\end{eqnarray*}
By the definition of $Sum$ we have ${\sf S}(x\oplus v) = x \oplus  {\sf S} v$.  Therefore
$$ u = {\sf S} x \ {\rightarrow}\  z = x \oplus  {\sf S} v.$$
Taking the successor of both sides of the equation after the implication,
$$ u = {\sf S} x \ {\rightarrow}\  {\sf S} z = {\sf S}(x\oplus {\sf S} v).$$
By the definition of $X$, this is equivalent to
$$\langle u, {\sf S} v, {\sf S} z \rangle \in X.$$
That completes the verification that $X$ satisfies (ii).
Hence $Sum$ is a subset of $X$. Then $\langle u,v,z \rangle \in Sum$
implies $\langle u,v,z\rangle \in X$.  Take $u = {\sf S} x$.  Then by
definition of $X$, we have
$$ \langle {\sf S} x, v, z \rangle \in Sum \ {\rightarrow}\  z = x\oplus v.$$
Applying this to (\ref{eq:707}) and (\ref{eq:708}) we have
$ z = x \oplus v$ and $w = x\oplus v$.  Therefore $z=w$ as desired. That completes
the induction step.  That completes the proof of the lemma.

Lemma~\ref{lemma:additionfunction} allows us to make the
following definition.

\begin{definition} \label{definition:Churchaddition}
We henceforth write $x \oplus  n = y$ instead
of $\langle x,n,y \rangle \in Sum$,
and when $x,n \in {\mathbb N}$, we write
 $x\oplus n$ for the unique $y$ such that $x\oplus n = y$.
\end{definition}

\noindent{\em Remark}.  We already used ``$x+y$'' for addition
of Frege numerals in \cite{inf-basics}.  While we never need
addition of Frege numerals in this paper, we have chosen to
keep the notation consistent between the two papers, by using
a different symbol for addition of Church numbers.

\begin{lemma}\label{lemma:ChurchZero_equation}
$\forall x\in {\mathbb N}\,(x\oplus 0 = x)$.
\end{lemma}

\noindent{\em Proof}.  By Definition~\ref{definition:Churchaddition},
this formula can be expressed in terms of $Sum$
as $\langle x,0, x\rangle \in Sum$, which is
 proved in Lemma~\ref{lemma:sum}.

\begin{lemma}\label{lemma:ChurchAddition_equation}
$\forall x,n \in {\mathbb N}\,  (x \oplus  {\sf S} n = {\sf S} (x\oplus n))$.
\end{lemma}

\noindent{\em Proof}.  By Definition~\ref{definition:Churchaddition},
this formula can be expressed in terms of $Sum$
as $\langle x,   n, y\rangle \in Sum \ {\rightarrow}\   \langle x, {\sf S} n, {\sf S} y \rangle \in Sum$, which is
 proved in Lemma~\ref{lemma:sum}.

\section{Alternate definitions of addition}
In this section we discuss two definitions that we do not use,
and the reasons we do not use them.
\subsection{Addition as iterated successor}
We could consider defining addition by
\begin{eqnarray}
 x \oplus  y &:=& y{\sf S} x  \label{eq:825}
\end{eqnarray}
Technically we have  defined the ``add $y$'' function
$y {\sf S}$,  which takes an argument $x$ and adds $y$ to it.

This definition of addition as iterated successor makes it
immediate that addition is single-valued, but the
defining formula (\ref{eq:825}) cannot be stratified
giving $x$ and $y$ the same type, for if we give $x$ index 0,
then $s$ has index 3 and $y$ has to get index 6.  So
this definition does not make addition a function of
the ordered pair $\langle x,y \rangle$.

The
laws of addition follow from the definition of successor:
\begin{eqnarray*}
x \oplus  {\sf S} y &=& ({\sf S} y) {\sf S} x \\
         &=& {\sf S} y {\sf S} x \\
         &=& {\sf S}( y {\sf S} x) \mbox{\qquad by definition of ${\sf S}$} \\
         &=& {\sf S}(x\oplus y)  \mbox{\qquad by (\ref{eq:825})}
\end{eqnarray*}
\begin{eqnarray*}
x \oplus  0 &=& 0{\sf S} x \\
      &=& 0 \mbox {\qquad by definition of $0$}
\end{eqnarray*}

With this definition of addition, the formula $x\oplus y=z$
is $y {\sf S} x = z$, which is stratified since it has only one occurrence
of each variable, but not homogeneous.  For example the formula
$0 \oplus  x = x$ is $ x {\sf S} 0 = x$, which is not stratified.  Hence, with
this definition, we would not see how to prove $0\oplus x = x$.  Similarly,
the formula asserting the equivalence of the two definitions is
$$ x \oplus  y = y {\sf S} x,$$
where $\oplus $ means the first definition.  This is not a stratified formula,
since $y$ on the right must get a greater index than on the left.
Hence we cannot prove,  at least not by induction on $y$, that
the two definitions are equivalent.   This gives us a
second reason not to use this
definition.

\subsection{Addition via composition}\label{section:churchaddition}
Church and Kleene (in \cite{church1941} and \cite{kleene1935})
define addition to satisfy this formula:
\begin{eqnarray}
 (x\oplus y)fz &=& xf(yfz)\label{eq:861}
\end{eqnarray}
This formula is stratified giving $z$ index 0, $x$ and $y$ both index 6, and
$f$ index 3, so it is possible to give this definition in INF.
The set-theoretical definition of addition given in Definition~\ref{definition:Churchaddition} produces
an addition function defined only on the Church numbers;  the more
general definition here can add any two functions mapping some set
into itself, not just mapping ${\mathbb N}$ into ${\mathbb N}$.

Unlike the definition of addition by iterated successor, there is
no compelling reason not to use the Church-Kleene definition.  But
there are several details to attend to in translating from the
$\lambda$-calculus to NF, for example, just to go from the definition
above to the set of ordered triples that is really the function $\oplus $.
We wrote out all the details required to reach the basic properties
of addition, and found it required twice as much
space as the set-theoretic details using Definition~\ref{definition:Churchaddition}.
 We shall see in
 Lemma~\ref{lemma:doubleiteration} that (\ref{eq:861}) is satisfied
by the addition of Definition~\ref{definition:Churchaddition}.

From (\ref{eq:861}) and the equation for successor we find
$ {\sf S}(x\oplus y) = {\sf S} x \oplus  y$ and $0\oplus y = y$.
From these we can prove the equivalence of this definition to
the one given in Definition~\ref{definition:Churchaddition}, when
restricted to Church numbers $x$ and $y$.

\section{Stratification}
Let $L$ be the fragment of the language of Peano
arithmetic that does not involve the symbol for multiplication;
thus $L$ has a constant $0$ and function symbols for
successor and addition, from which compound terms can be
built up.

Now that we have defined addition on ${\mathbb N}$, it is possible
to define an interpretation of (the language of) $L$
into NF (which does not have terms, constant symbols, or
function symbols).  Namely, for each term $t$ in $L$
with free variables $x$
there is a formula of NF with free variables
$x$ and one additional variable $y$
expressing $t = y$.  This formula contains many fresh
existentially quantified variables; rather than give a
recursive definition, or a program for computing it, we
illustrate with an example.  If $t$ is $x \oplus  s(z)$,
then the formula in question is
$$\exists u,v\, (\langle x,u, y\rangle \in Sum
   \land \langle z,u \rangle \in {\sf S})
 $$
where $w \in {\sf S}$ abbreviates the formula in Definition~\ref{definition:sucdef}, and
$w \in Sum$ stands for the formula defining $Sum$.
Similarly, the formula $y = 0$ is expressed by the
formula in Definition~\ref{definition:sucdef}.

\begin{lemma} \label{lemma:stratification}
Any formula in the language
of Peano arithmetic without multiplication is
interpreted by a formula of NF that can be stratified
by giving all the variables the same type.
\end{lemma}

\noindent{\em Proof}. By induction on the complexity
of the formula $\phi$.  Since all the variables are to be
given the same type, no conflict can arise between different
occurrences of a variable; hence we need consider only
atomic formulae $\phi$.  These have the form $p=q$ for
terms $p$ and $q$.  We can replace $p=q$ by
$\exists u\,(p=u \land q=u)$, so we need only atomic
formulae $p=u$.  These we prove stratifiable by induction
on the complexity of the term, which is either $q \oplus  r$
or ${\sf S}(q)$ (often written $q^{\, \prime}$ in PA).
We omit the details, which are technical but typical of
interpretation proofs.
\smallskip

\noindent{\em Examples}.  In the rest of this
 paper we have occasion to prove several theorems or lemmas by
 induction in NF.  To prove something by induction in NF
we have to check that the formula being proved is
stratified. The  theorems are all special cases of
the preceding lemma.
Some formulas to which we apply
Lemma~\ref{lemma:stratification} to obtain these
formulas are as follows:
\begin{eqnarray*}
0\oplus x = x && \mbox{\qquad Lemma~\ref{lemma:zeroplusx}} \\
\forall x\,(x \oplus  {\sf S}(n) = {\sf S} (x) \oplus  n)&& \mbox{\qquad
Lemma~\ref{lemma:ChurchSuccessorShift}} \\%noref
x \neq 0 \ {\rightarrow}\  0 < x&& \mbox{\qquad Lemma~\ref{lemma:zerosmall} }\\%noref
x < y \ {\rightarrow}\  {\sf S}  x < y \ \lor \ {\sf S}  x = y && \mbox{\qquad Lemma~\ref{lemma:order2}}
\end{eqnarray*}

\section{Properties of addition}\label{section:additionproperties}

For the rest of the paper, it does not matter how addition was defined;
we use only that it is defined by a stratified homogeneous formula and  satisfies the two formulas in Lemmas~\ref{lemma:ChurchAddition_equation} and \ref{lemma:ChurchZero_equation}, namely
\begin{eqnarray*}
x\oplus 0 &=& x \mbox{ \qquad and} \\
x \oplus  {\sf S} n &=& {\sf S}(x\oplus n).
\end{eqnarray*}

Indeed one can easily prove that if $x \oplus  y$ is another
function satisfying these properties then $x \oplus  y = x \oplus  y$
on Church numbers $x,y$.  Above we gave a set-theoretical definition
of addition, in Definition~\ref{definition:Churchaddition};  and
a definition closer to $\lambda$-calculus in spirit, in
\sect\ref{section:churchaddition}.
  The former is defined
only on Church numbers, while the latter can add any two functions;
but as just remarked, they {\em necessarily} agree on Church numbers.
In this section we develop further properties of addition, using
only the two properties listed above.

\begin{lemma} \label{lemma:zeroplusx}
For $x \in {\mathbb N}$, $0 \oplus  x = x$.
\end{lemma}

\noindent{\em Proof}.  By
induction on $x$.  The base case is $0\oplus 0=0$, which follows
from $x\oplus 0=0$, which is Lemma~\ref{lemma:ChurchZero_equation} part (i).
For the induction step, assume $0\oplus x=x$.  Applying successor
to both sides, we have ${\sf S}(0\oplus x) = {\sf S} x$.  By
Lemma~\ref{lemma:ChurchAddition_equation}   we have
${\sf S}(0\oplus x)= 0 \oplus  {\sf S} x$.  Therefore ${\sf S} x = 0 \oplus  {\sf S} x$.
That completes the induction step,
and that completes the proof of the lemma.

\begin{lemma} \label{lemma:ChurchSuccessorShift}
For  $x,n \in {\mathbb N}$,
 $$ x \oplus  {\sf S} n = {\sf S} x \oplus  n .$$
\end{lemma}

\noindent{\em Proof}.
We quantify universally over Church numbers $x$,
obtaining
$$ \forall x \in {\mathbb N} \,(x \oplus  {\sf S} n = {\sf S} x \oplus  n ),$$
and prove that by induction on $n$.  The formula
to be proved can be stratified by giving all variables
type 0.
\smallskip

Base case:  $x \oplus  {\sf S} 0 = {\sf S} x \oplus  0$.
\begin{eqnarray*}
x \oplus  {\sf S} 0 &=& {\sf S}(x\oplus 0)  \mbox{\qquad by Lemma~\ref{lemma:ChurchAddition_equation}}\\
&=& \ s x    \mbox{\qquad \qquad \ by Lemma~\ref{lemma:ChurchZero_equation}} \\
&=& {\sf S}(x) \oplus  0   \mbox{\qquad by Lemma~\ref{lemma:ChurchZero_equation}}
\end{eqnarray*}
That completes the base case.
\smallskip

Induction step:
\begin{eqnarray*}
x \oplus  {\sf S} {\sf S} n &=& {\sf S} (x \oplus  {\sf S} n) \mbox{\qquad
 by Lemma~\ref{lemma:ChurchAddition_equation}}\\
&=& {\sf S} ({\sf S} x \oplus  n)   \mbox{\qquad by the induction hypothesis}\\
&=&  {\sf S} x \oplus  {\sf S} n     \mbox{\qquad\  by
Lemma~\ref{lemma:ChurchAddition_equation},  with $x$ replaced by ${\sf S} x$}
\end{eqnarray*}
The replacement of $x$ by ${\sf S} x$ in the last step is legal, because
the statement being proved by induction is universally quantified over $x$.
That completes the proof of the theorem.

\begin{lemma} \label{lemma:ChurchAdditionMaps}
$\forall x,y \in {\mathbb N}\ (x \oplus  y \in {\mathbb N}).$
\end{lemma}

\noindent{\em Proof}.  By induction on $y$, which is legal since
the formula is stratified.   We omit the straightforward proof.

\begin{lemma}[Associativity] \label{lemma:ChurchAdditionAssociative}
$\forall x,y,z \in {\mathbb N},((x\oplus y)\oplus z = x \oplus  (y\oplus z))$.
\end{lemma}

\noindent{\em Proof}.
 By induction on $y$, which is legal since the formula is stratified.
 \smallskip

  Base case: $(x\oplus 0)\oplus  z = x \oplus  z$
and $x \oplus  (0\oplus z) = x \oplus  z$, by Lemma~\ref{lemma:zeroplusx}.  Hence
$(x\oplus 0)\oplus z = x \oplus  (0 \oplus  z)$, completing the base case.
\smallskip

Induction step:
\begin{eqnarray*}
(x \oplus  {\sf S} y) \oplus  z = {\sf S}(x\oplus y) \oplus  z &&\mbox{\qquad by Lemma \ref{lemma:ChurchAddition_equation}} \\
= (x\oplus y) \oplus  {\sf S} z &&\mbox{\qquad by Lemma~\ref{lemma:ChurchSuccessorShift}}\\
= {\sf S}( (x\oplus y)\oplus z) &&\mbox{\qquad by
         Lemmas \ref{lemma:ChurchAddition_equation} and \ref{lemma:ChurchAdditionMaps}}\\
= {\sf S} (x \oplus  (y\oplus z)) &&\mbox{\qquad by the induction hypothesis} \\
= x \oplus  {\sf S}(y\oplus z) &&\mbox{\qquad by Lemmas~\ref{lemma:ChurchSuccessorShift}} \\
= x \oplus  (y \oplus  {\sf S} z) &&\mbox{\qquad by Lemma \ref{lemma:ChurchAddition_equation} and \ref{lemma:ChurchAdditionMaps}}\\
= x \oplus  ({\sf S} y \oplus  z ) &&\mbox{\qquad  by Lemma~\ref{lemma:ChurchSuccessorShift}}
\end{eqnarray*}
That completes the proof of the lemma.
\smallskip

\begin{lemma}[Commutativity] \label{lemma:ChurchAdditionCommutative}
$\forall x,y  \in {\mathbb N}\,(x \oplus  y = y \oplus  x)$.
\end{lemma}

\noindent{\em Proof}. By induction on $y$, which is legal since the formula is
stratified.
\smallskip

Base case,  $x\oplus {\bf 0} = {\bf 0} \oplus x$.  We have
\begin{eqnarray*}
 x\oplus {\bf 0}=x  && \mbox{\qquad by  Lemma~\ref{lemma:ChurchZero_equation}} \\
{\bf 0}\oplus x=x   && \mbox{\qquad  by Lemma~\ref{lemma:zeroplusx}} \\
x \oplus {\bf 0}  = {\bf 0}  \oplus x &&\mbox{\qquad by the previous two lines}
\end{eqnarray*}
\smallskip

Induction step:
\begin{eqnarray*}
x \oplus  {\sf S} y &=& {\sf S}(x\oplus y) \mbox{\qquad\ by  Lemma~\ref{lemma:ChurchAddition_equation}} \\
&=& {\sf S}(y\oplus x) \mbox{\qquad\ by the induction hypothesis} \\
&=& y \oplus  {\sf S} x \mbox {\qquad\quad  by  Lemma~\ref{lemma:ChurchAddition_equation}}\\
&=& {\sf S} y \oplus  x \mbox{\qquad\quad  by Lemma~\ref{lemma:ChurchSuccessorShift}}
\end{eqnarray*}
That completes the induction step, and the proof of the lemma.

\begin{lemma} \label{lemma:doubleiteration} Let $f \in {\sf FUNC}$ and $f:X \to X$.
Then for Church numbers $j$ and $\ell$, and $x \in X$, we have
$$(jf)(\ell f x) = (j\oplus \ell)f x.$$
\end{lemma}

\noindent{\em Proof}.  The formula to be proved is stratified,
so we may prove it by induction on $j$.  Base case:
\begin{eqnarray*}
 0f(\ell fx) &=& \ell fx \mbox{\qquad\qquad by definition of 0} \\
 &=& (0 \oplus  \ell) fx \mbox{\quad \,  by Lemma~\ref{lemma:zeroplusx}}
 \end{eqnarray*}

 Induction step:
\begin{eqnarray*}
({\sf S} j f)(\ell fx) &=& f(j f(\ell fx)) \mbox{\quad\ \ by Theorem~\ref{theorem:successorequation}}\\
&=& f((j\oplus \ell)f x)  \mbox{\quad by the induction hypothesis} \\
&=& {\sf S}(j\oplus \ell)f x  \mbox{\qquad by Theorem~\ref{theorem:successorequation}}\\
&=& (j \oplus  {\sf S} \ell) f x \mbox{\qquad by Lemma~\ref{lemma:ChurchAddition_equation}}\\
&=& ({\sf S} j \oplus  \ell) \mbox{\qquad \ by Lemma~\ref{lemma:ChurchSuccessorShift}}
\end{eqnarray*}
That completes the proof of the lemma.

\section{Order on ${\mathbb N}$}

\begin{definition}\label{definition:orderN}
Order on the Church numbers is defined by
$$ x < y \iff  \exists n \in {\mathbb N}\,(x\oplus {\sf S} n = y).$$
$$ x \le y \iff \exists n \in {\mathbb N}\,(x\oplus  n = y).$$
\end{definition}
These formulas are stratifiable, giving
$x$, $y$, and $n$ all index 0. (${\mathbb N}$ is a parameter.)
Therefore the relations
$x < y$  and $x \le y$ are definable in INF as sets of ordered pairs.
\smallskip

\noindent{\em Remark.} We use the same symbols for these relations as
are used in \cite{inf-basics} for order on finite Frege cardinals; in our
formalization, we used different symbols, but for human readers, we think it
 better not to introduce a new symbol.%
\footnote{Life is short, but the alphabet is shorter.  And the alphabet
of binary ordering relations is even shorter, and we later need $\preceq$
and $\prec$ for something else.}
\smallskip

 \begin{lemma} \label{lemma:notless0}
For all $x\in {\mathbb N}$,  $ x \not < {\bf 0}$.
\end{lemma}

\noindent{\em Proof}.  Suppose $x \in {\mathbb N}$ and $x < {\bf 0}$.  Then
\begin{eqnarray*}
x \oplus {\sf S} n = {\bf 0} && \mbox{\qquad by definition of $<$}\\
{\sf S}(x \oplus n) = {\bf 0} && \mbox{\qquad by Lemma~\ref{lemma:ChurchSuccessorShift}}\end{eqnarray*}
But that contradicts Theorem~\ref{theorem:successoromitszero}, which
says that ${\bf 0}$ is not a successor.

\begin{lemma} \label{lemma:order1} For all $x$ and $y$ in ${\mathbb N}$,
$$x = y \ \lor \ x < y \ {\rightarrow}\  x < {\sf S} y $$
\end{lemma}

\noindent{\em Proof}.
Suppose $x = y \lor x < y$.
\smallskip

Case~1,  $x=y$.  We must prove $x < {\sf S} x$.
\begin{eqnarray*}
x \oplus  {\sf S} 0 = {\sf S} x \oplus  0  &&\mbox{\qquad by Lemma~\ref{lemma:ChurchAddition_equation}}\\
 = {\sf S} x &&\mbox{\qquad by Lemma~\ref{lemma:ChurchZero_equation}}\\
 x \oplus  {\sf S} 0 = {\sf S} x &&\mbox{\qquad by the preceding two lines}\\
 x < {\sf S} x  && \mbox{\qquad by Definition~\ref{definition:orderN}}
 \end{eqnarray*}
That completes Case~1.
\smallskip

Case~2, $x < y$.  We have to prove $x < {\sf S} y$.
\begin{eqnarray*}
x \oplus  {\sf S} t = y  && \mbox{\qquad for some $t \in {\mathbb N}$, by  Definition~\ref{definition:orderN}}\\
 {\sf S}(x\oplus  {\sf S} t) = {\sf S} y  && \mbox{\qquad by the preceding line}\\
 x \oplus  {\sf S} ( {\sf S} t) = {\sf S} y && \mbox{\qquad by Lemma~\ref{lemma:ChurchAddition_equation}}\\
x < {\sf S} y  &&\mbox{\qquad by   Definition~\ref{definition:orderN}}
\end{eqnarray*}
That completes Case~2.
 That completes the proof of the
lemma.

\begin{corollary} \label{lemma:xlessthansx}
For all $x \in {\mathbb N}$, $x < {\sf S} x$.
\end{corollary}

\noindent{\em Remark}.  This does not guarantee $x \neq {\sf S} x$
since we do not have trichotomy.
\medskip

\noindent{\em Proof}. Take $x=y$ in Lemma~\ref{lemma:order1}.

\begin{lemma} \label{lemma:zerosmall} For all $x \in {\mathbb N}$,
$x \neq {\bf 0} \ {\rightarrow}\  {\bf 0} < x$.
\end{lemma}

\noindent{\em Proof}.   By induction on $x$.  The formula to be proved
is stratifiable, by Lemma~\ref{lemma:stratification}.

We proceed with the induction.  The
base case is immediate (since ${\bf 0} \neq {\bf 0}$ implies anything).
  To prove the induction step, we have to prove
${\sf S}  x \neq {\bf 0} \ {\rightarrow}\  {\bf 0} < {\sf S}  x$.  Suppose ${\sf S} x \neq {\bf 0}$;
we have to prove ${\bf 0} < {\sf S} x$.   By Lemma~\ref{lemma:order1},
it suffices to prove ${\bf 0} < x \lor {\bf 0} = x$. But that follows from
the induction hypothesis $x \neq {\bf 0} \ {\rightarrow}\  {\bf 0} < x$, even with
intuitionistic logic, because by Lemma~\ref{lemma:decidable0},
 $x \neq {\bf 0} \lor x = {\bf 0}$, and
if $x \neq {\bf 0}$ then ${\bf 0} < x$, while if $x={\bf 0}$ then ${\bf 0} = x$.  That completes
the proof of the lemma.

\begin{lemma} \label{lemma:order2}
For all $x,y \in {\mathbb N}$,
$$ x < y \ {\rightarrow}\  {\sf S}  x < y \ \lor \ {\sf S}  x = y $$
\end{lemma}

\noindent{\em Proof}.
\begin{eqnarray*}
x < y && \mbox{\qquad assumption}\\
x\oplus  {\sf S} p = y  && \mbox{\qquad for some $p \in {\mathbb N}$, by definition of $<$}\\
x \oplus  {\sf S} p =  {\sf S} x \oplus  p = y && \mbox{\qquad  by Lemma~\ref{lemma:ChurchSuccessorShift}}\\
p = {\bf 0} \ \lor \ p \neq {\bf 0} && \mbox{\qquad by Lemma~\ref{lemma:decidable0}}
\end{eqnarray*}
 If $p = {\bf 0}$
then ${\sf S} x = y$ and we are done. If $ p \neq {\bf 0}$ then
\begin{eqnarray*}
p = {\sf S} \ell &&\mbox{\qquad for some $\ell \in {\mathbb N}$, by Lemma~\ref{lemma:predecessor}}\\
x \oplus {\sf S} ({\sf S} \ell) = y && \mbox{\qquad since $x \oplus {\sf S} p = y$}\\
 {\sf S} x \oplus  {\sf S} \ell = y  &&\mbox{\qquad by Lemma~\ref{lemma:ChurchSuccessorShift}}\\
 {\sf S} x < y && \mbox{\qquad by definition of $<$}
 \end{eqnarray*}
That completes the proof of the lemma.

\begin{lemma} \label{lemma:Churchletolessthan} For $x,y \in {\mathbb N}$, if $x \le y$ and $x \neq y$
then $x < y$.
\end{lemma}

\noindent{\em Proof}.  Suppose $x,y \in {\mathbb N}$ and $x \le y$. Then for some $m$ we have
$x \oplus  m = y$.  If $m = {\bf 0}$ then $ x= y$, by Lemma~\ref{lemma:ChurchZero_equation}.
Hence $m \neq {\bf 0}$.  Then by Lemma~\ref{lemma:predecessor},
$m = {\sf S} r$ for some $r \in {\mathbb N}$.  Then $x \oplus  {\sf S} r = y$.  Then by definition of $<$,
we have $x < y$.  That completes the proof of the lemma.

\begin{lemma} \label{lemma:Churchle} For $x,y \in {\mathbb N}$,
$$x \le y  \iff x < y \ \lor \ x =y.$$
\end{lemma}

\noindent{\em Proof}. Left to right: Suppose $x \le y$.  Then $x \oplus  m = y$ for some $m \in {\mathbb N}$.
By Lemma~\ref{lemma:decidable0}, $m = {\bf 0} \ \lor \ m \neq {\bf 0}$.  If $m = {\bf 0}$,
then by Lemma~\ref{lemma:ChurchZero_equation}, $x = y$.  If $m \neq {\bf 0}$,
then by Lemma~\ref{lemma:predecessor}, $m = {\sf S} r$ for some $r \in {\mathbb N}$.
Then $x < y$ by the definition of $<$.
\smallskip

Right to left.  Suppose $x < y \ \lor x = y$.  If $x < y $ then $x \oplus  {\sf S} m = y$ for some $m \in {\mathbb N}$.
Then ${\sf S} m \in {\mathbb N}$ by Lemma~\ref{lemma:successorN}, so $x \le y$ by definition of $\le$.
If $x = y$ then $x \oplus  {\bf 0} = y$, by Lemma~\ref{lemma:ChurchZero_equation}, so $x \le y$.
That completes the proof of the lemma.

\begin{lemma}[transitivity] \label{lemma:transitivity}
$x < y$ is a transitive relation.  That is,
for $x,y,z \in {\mathbb N}$,
$$ x < y \land y < z \ {\rightarrow}\  x < z.$$
\end{lemma}

\noindent{\em Proof}.    Suppose $x < y$ and $y < z$.
Then for some $p,q$ we have $x\oplus p = y$ and $y \oplus  q = z$.
Then $(x\oplus p)\oplus q = z$.  By the associativity
of addition we have $x\oplus  (p\oplus q) = z$.  Then $x < z$.
That completes the proof
of the lemma.

\begin{lemma}\label{lemma:trichotomy1}
For $x,y \in {\mathbb N}$,
$$x < y \ \lor \ x = y \ \lor \ y < x$$
\end{lemma}

\noindent{\em Remark}. We do not claim that exactly one
of the three alternatives holds.
\medskip

\noindent{\em Proof}. We proceed
by induction on $x$.
  When $x={\bf 0}$
we have to prove
$${\bf 0} < y \ \lor \ {\bf 0} = y\  \lor\  y < {\bf 0}.$$  We have
\begin{eqnarray*}
y = {\bf 0} \ \lor \ y \neq {\bf 0}  &&\mbox{\qquad by Lemma~\ref{lemma:decidable0}}
\end{eqnarray*}
If $y = {\bf 0}$, we are done.  If $y \neq  {\bf 0}$ then
\begin{eqnarray*}
{\bf 0} < y\, \lor\, {\bf 0} = y &&\mbox{\qquad by  Lemma~\ref{lemma:zerosmall}}
\end{eqnarray*}
That completes the base case.
\smallskip

For the induction step, we assume
\begin{eqnarray*}
 x < y \ \lor \ x = y \ \lor \ y < x
\end{eqnarray*}
and must prove
$${\sf S}  x < y \ \lor \ {\sf S}  x = y \ \lor \ y < {\sf S}  x.$$
We argue by cases.
\smallskip

Case~1, $x < y$.  Then by Lemma~\ref{lemma:order2}, ${\sf S}  x < y$
or ${\sf S}  x = y$.  That completes Case~1.
\smallskip

Case~2, $x = y$. Then by Corollary~\ref{lemma:xlessthansx}, $y < {\sf S}  x$.
That completes Case~2.
\smallskip

Case~3, $y < x$.
 Then
\begin{eqnarray*}
 x < {\sf S}  x  &&\mbox{\qquad by Corollary~\ref{lemma:xlessthansx}}\\
 y < {\sf S} x   && \mbox{\qquad by Lemma~\ref{lemma:transitivity}}
 \end{eqnarray*}
That completes Case~3.
That completes the proof of the lemma.

\section{Structure of ${\mathbb N}$ under successor:  The picture}
In this  and the following sections, we explore the consequences of the assumption
that Church successor is not one to one.  We first attempt to convey an intuitive
picture of the situation.

\begin{figure}[ht]
\caption{The stem ${\sf STEM}$, the loop ${\mathcal L}$, and unique double successor}
\label{figure:rho2}
\FigureRho
\end{figure}
Figure~\ref{figure:rho2} (already shown in the introduction, but reprinted
here for convenience) illustrates the structure of ${\mathbb N}$ under
successor.  To arrive at this figure, imagine coloring ${\bf 0}$ red, and
at each stage where you have just colored $x$ red, then color ${\sf S} x$
red unless ${\sf S} ({\sf S} x)$ is already red.  Then stop.  Let ${\bf n}$ be the last
number you encountered.
You will have
colored every integer red except ${\bf n}$ (shown black in the figure).  The
reason you did not color ${\bf n}$ is that ${\sf S} {\bf n} = {\sf S} {\bf k}$, where ${\bf k}$ is some
number that you already colored red.  We call ${\sf S} n$ a ``double successor.''
\smallskip

We emphasize that at this point we have not proved that this figure is
accurate.  There might be many more double successors not shown; imagine
a gray spiderweb of mysterious Church numbers, merging at different
places into the red part of the figure.  But the red part, if it
could be defined, contains 0 and is closed under successor, so it
intuitively should be all of ${\mathbb N}$.  We shall prove in
Theorem~\ref{theorem:rho} below
that, at least if ${\mathbb N}$ is assumed to be finite, this picture
is an accurate one. The part that you colored before reaching ${\bf k}$
(and including ${\bf k}$) is called the ``stem''.   The rest of the red numbers
(plus ${\bf n}$) comprise ``the loop.''   The next several sections will show in
detail that this picture is correct.

\begin{definition} \label{definition:doublesuccessor}  $p$ is
 not a double successor if
$$ \forall a,b\, (a \in {\mathbb N} \ \land \ b \in {\mathbb N} \ \land {\sf S} a = {\sf S} b = p  \ {\rightarrow}\  \ a = b).$$
\end{definition}

It might seem more natural to define the concept this way:
 $p$ is a double successor if there exists $a,b \in {\mathbb N}$ with $a \neq b$ and  ${\sf S} a = {\sf S} b =p$.
But negating this introduces a double negation, which we prefer not to have.  Hence
the definition above.   Soon we will be working under the hypothesis that ${\mathbb N}$ is finite,
which implies that ${\mathbb N}$ has decidable equality,  making this double negation irrelevant.
Also, we could strengthen the notion by dropping the condition $b \in {\mathbb N}$; we will do that
in one place below.

\begin{lemma} \label{lemma:lessthansuccessorN}
If $x,y \in {\mathbb N}$ and
 ${\sf S} x$ is not a double successor, then
 $$ y < {\sf S} x \iff y< x \mspace{1mu} \lor \mspace{2mu} y = x.$$
Explicitly this means
$$ \forall x,y \in {\mathbb N}\,(( \forall u \in {\mathbb N}\, ({\sf S} u = {\sf S} x \ {\rightarrow}\  u = x)) \ {\rightarrow}\
y < {\sf S} x \iff y< x \mspace{1mu} \lor \mspace{2mu} y = x).$$
\end{lemma}

\noindent{\em Proof}.
  Left to right:
\begin{eqnarray*}
y < {\sf S} x  && \mbox{\qquad assumption}\\
y \oplus {\sf S} p = {\sf S} x && \mbox{\qquad for some $p \in {\mathbb N}$, by definition of $<$}\\
{\sf S}(y \oplus p) = {\sf S} x && \mbox{\qquad by Lemma~\ref{lemma:ChurchAddition_equation}}\\
y \oplus p = x && \mbox{\qquad since ${\sf S} x$ is not a double successor}\\
p = {\bf 0} \ \lor \ p \neq {\bf 0} &&\mbox{\qquad by Lemma~\ref{lemma:decidable0}}
\end{eqnarray*}
Case~1, $p = {\bf 0}$.  Then $y = x$.  That completes Case~1.
\smallskip

Case~2, $p \neq {\bf 0}$.  Then
\begin{eqnarray*}
p = {\sf S} m && \mbox{\qquad for some $m \in {\mathbb N}$, by Lemma~\ref{lemma:predecessor}}\\
y \oplus {\sf S} m = x && \mbox{\qquad since $y \oplus p = x$}\\
y < x  && \mbox{\qquad by definition of $<$}
\end{eqnarray*}
That completes Case~2.
  That completes the left-to-right implication.

Right-to-left:  Suppose $y < x \lor y = x$, and ${\sf S} x$
is not a double successor.  We have to prove $y < {\sf S} x$.
We argue by cases.
\smallskip

Case~1, $y < x$.  Then
\begin{eqnarray*}
x < {\sf S} x && \mbox{\qquad by Corollary~\ref{lemma:xlessthansx}}\\
y < {\sf S} x && \mbox{\qquad by transitivity}
\end{eqnarray*}
That completes Case~1.
\smallskip

Case~2, $y = x$.
Then $y < {\sf S} x$ by Corollary~\ref{lemma:xlessthansx}.
That completes Case~2.  That completes the right-to-left direction.
That completes the proof of the lemma.

\section{Structure of ${\mathbb N}$ under successor:  The stem}

\begin{definition} \label{definition:stem}
The set ${\sf STEM}$  is the intersection of all subsets of ${\mathbb N}$
containing 0 and closed under successors that are not double successors.
More precisely, $ {\sf STEM}$ is the intersection of ${\mathbb N}$ and all $X$ such that
\begin{eqnarray*}
 0 \in X \ \land\ \forall u \in {\mathbb N}\,(u \in X  \ \land \  \forall v \in {\mathbb N}\,
({\sf S} v = {\sf S}  u \ {\rightarrow}\  v = u) \ {\rightarrow}\  {\sf S} u \in X).
\end{eqnarray*}
\end{definition}
The intention of the definition is that
 ${\sf STEM}$ should contain everything from ${\bf 0}$ up to but not including
the first double successor.

\begin{lemma} \label{lemma:SN} ${\sf STEM} \subseteq {\mathbb N}$.
\end{lemma}

\noindent{\em Proof}. Immediate from the definition of ${\sf STEM}$ as the intersection
of ${\mathbb N}$ with some other sets.

\begin{lemma} \label{lemma:S1} ${\sf STEM}$  is one of the sets
used to define ${\sf STEM}$.  That is,
$${\bf 0} \in {\sf STEM} \ \land\ \forall u \in {\mathbb N}\,(u \in {\sf STEM} \land \forall v \in {\mathbb N}\,
({\sf S} v = {\sf S}  u \ {\rightarrow}\  v = u) \ {\rightarrow}\  {\sf S} u \in {\sf STEM}).$$
\end{lemma}

\noindent{\em Proof}.
Let $X$ satisfy the formula in the lemma (with ${\sf STEM}$ replaced by $X$).
  Then ${\bf 0} \in X$.
Since $X$ was arbitrary, ${\bf 0} \in {\sf STEM}$.  Now suppose $u \in {\mathbb N}$ and $u \in {\sf STEM}$
and $\forall v\in {\mathbb N}\, ({\sf S} v = {\sf S} u \ {\rightarrow}\  v = u)$.  Then   ${\sf S} u \in X$.
Since $X$ was arbitrary, ${\sf S} u \in {\sf STEM}$, by Definition~\ref{definition:stem}.
  That completes the proof of the lemma.

\begin{lemma} \label{lemma:Soneone}
Church successor is one-to-one on ${\sf STEM}$.  What is more,
 $$ \forall u \in {\sf STEM}\, ( {\sf S} u \in {\sf STEM} \ {\rightarrow}\  \forall v\in {\mathbb N}\,( {\sf S} u = {\sf S} v \ {\rightarrow}\  u = v)).$$
 That is, there are no double successors in ${\sf STEM}$.
 \end{lemma}
\medskip

\noindent{\em Remark.} ``What is more'' because $v$ is not required to be in ${\sf STEM}$.
\medskip

\noindent{\em Proof}.  Define $X$ to be
\begin{eqnarray}
 X:= \{   p \in {\mathbb N} : \forall u, v\in {\mathbb N}\,(  p =  {\sf S} u \ {\rightarrow}\  {\sf S} u = {\sf S} v  \ {\rightarrow}\  u = v)\}. \label{eq:E1661}
 \end{eqnarray}
 The formula is stratified, giving all the variables index 0; ${\mathbb N}$ is a parameter.
 Hence the definition can be given in INF.
Then $X \subseteq {\mathbb N}$.  By Theorem~\ref{theorem:successoromitszero},
${\bf 0} \in X$.   $X$ is closed under successors except double successors;
that is, if $x \in X$ and $\forall v \in {\mathbb N}\,({\sf S} x= {\sf S} v \ {\rightarrow}\  x = v)$,
then ${\sf S} x \in X$, as we see by putting $p = {\sf S} x$ in the definition of $X$.
(By the hypothesis $x \in X$, we have $x \in {\mathbb N}$.)
Therefore, by the definition of ${\sf STEM}$, we have ${\sf STEM} \subseteq X$.
\smallskip

Suppose $S u \in {\sf STEM}$ and ${\sf S} u  = {\sf S} v$.   Then ${\sf S} u \in X$, since ${\sf STEM} \subseteq X$.
Therefore $u=v$.
That completes the proof of the lemma.

\begin{lemma} \label{lemma:Spred}
  If   $y \in {\mathbb N}$ and  ${\sf S} y \in {\sf STEM}$, then $y \in {\sf STEM}$.
\end{lemma}

\noindent{\em Proof}.
By Lemma~\ref{lemma:Soneone} there are no double successors in ${\sf STEM}$, so
it suffices to show that every nonzero element of ${\sf STEM}$ is the successor of
something in ${\sf STEM}$.  Let $X$  be the set of elements of ${\sf STEM}$
that are equal to ${\bf 0}$ or are successors of something in ${\sf STEM}$.  Explicitly
$$ X = \{ x: x \in {\sf STEM} \ \land \ x = {\bf 0} \ \lor\ \exists y\,( {\sf S} y = x \ \land \ y \in {\sf STEM})\}.$$
The formula is stratified, giving $x$ and $y$ index 0, with ${\sf STEM}$ as a parameter.
I say that $X$  is closed under successors that are not double successors.   Let
$x \in X$ and suppose
\begin{eqnarray}
\forall v\in {\mathbb N}\,({\sf S} x = {\sf S} v \ {\rightarrow}\  x = v) \label{eq:E1693}
\end{eqnarray}
 (informally, ${\sf S} x$ is
not a double successor).   We must show
${\sf S} x \in X$.  Since $x \in X$,  $x \in {\sf STEM}$.  To show ${\sf S} x \in X$ we must show two things:
\begin{eqnarray}
&& {\sf S} x \in {\sf STEM}  \label{eq:E1695}  \\
&&  \exists y\, ({\sf S} y = {\sf S} x \ \land \ y \in {\sf STEM})  \label{eq:E1696}
\end{eqnarray}
(\ref{eq:E1696}) is immediate, taking $y=x$.  To verify (\ref{eq:E1695}) we use
that $x \in {\sf STEM}$ and ${\sf S} x$ is not a double successor (\ref{eq:E1693}).
By Lemma~\ref{lemma:S1}, ${\sf STEM}$ is closed under successors except double successors,
so ${\sf S} x \in {\sf STEM}$ as desired.  That completes the proof that $X$ is closed under
successors except double successors.   Then by the definition of ${\sf STEM}$, we have
${\sf STEM} \subseteq X$.
\smallskip

Now suppose ${\sf S} x \in {\sf STEM}$ and $x \in {\mathbb N}$; we must prove $x \in {\sf STEM}$.  Since ${\sf STEM} \subseteq X$,
we have ${\sf S} x \in X$.  By definition of $X$,
$$ {\sf S} x = {\bf 0} \ \lor \ \exists y\,(y \in {\sf STEM} \ \land \ {\sf S} y = {\sf S} x).$$
By Theorem~\ref{theorem:successoromitszero}, and the hypothesis $x \in {\mathbb N}$,
we have ${\sf S} x \neq {\bf 0}$.   Therefore, for some $y \in {\sf STEM}$, we have ${\sf S} y = {\sf S} x$.
By Lemma~\ref{lemma:Soneone}, we have $y = x$.  Since $y \in {\sf STEM}$ and $y = x$, we have
$x \in {\sf STEM}$ as desired.
That completes the proof of the lemma.

\begin{lemma} \label{lemma:Sdecidable} ${\sf STEM}$ has decidable equality.  In fact,
\begin{eqnarray*}
 \forall x \in {\mathbb N}\, \forall y\,( x \in {\sf STEM} \ {\rightarrow}\   y \in {\mathbb N} \ {\rightarrow}\  x = y \ \lor\  x \neq y).
\end{eqnarray*}
\end{lemma}

\noindent{\em Remark}. It is not necessary to assume $y \in {\sf STEM}$.
\medskip

\noindent{\em Proof}.
 We prove by induction on $x$ that
\begin{eqnarray}
 \forall y( x \in {\sf STEM} \ {\rightarrow}\  y \in {\mathbb N} \ {\rightarrow}\  x = y \ \lor\  x \neq y).
 \label{eq:E2132}
\end{eqnarray}
That formula is stratified, so it is legal to prove it by induction.
The base case follows from Lemma~\ref{lemma:decidable0}.
For the induction step, suppose ${\sf S} x \in {\sf STEM}$ and $y \in {\mathbb N}$;
we have to prove ${\sf S} x = y \ \lor\  {\sf S} x \neq y$.
By Lemma~\ref{lemma:decidable0}, we may argue by cases
according as $y = {\bf 0}$ or not.  If $y = {\bf 0}$, we
are done by Lemma~\ref{lemma:decidable0}.  If $y \neq {\bf 0}$,
then $y = {\sf S} q$ for some $q$.  Then
\begin{eqnarray*}
x \in {\sf STEM} && \mbox{\qquad by Lemma~\ref{lemma:Spred}}\\
{\sf S} x = y \ \lor {\sf S} x \neq y   \iff   {\sf S} x = {\sf S} q \lor {\sf S} x \neq {\sf S} q
        && \mbox{\qquad since $y = {\sf S} q$} \\
 \iff  x = q \ \lor x \neq q &&\mbox{\qquad by Lemma~\ref{lemma:Soneone}, since ${\sf S} x \in {\sf STEM}$}
\end{eqnarray*}
and that  follows from the induction hypothesis (\ref{eq:E2132}).
That completes the proof  of the lemma.

\begin{lemma} \label{lemma:Sinit} Suppose $y \in {\sf STEM}$ and $x \in {\mathbb N}$ and $x < y$.  Then
$x \in {\sf STEM}$.
\end{lemma}

\noindent{\em Proof}.  By induction on $y$ we prove
$$ y \in {\mathbb N} \ {\rightarrow}\  y \in {\sf STEM} \ {\rightarrow}\  \forall x\in {\mathbb N}\, (x < y \ {\rightarrow}\  x \in {\sf STEM}).$$
That formula is stratified, so induction is legal.
\smallskip

Base case:  When $y = {\bf 0}$, it is impossible that $x < y$, by
Lemma~\ref{lemma:notless0}. Therefore $x < {\bf 0} \ {\rightarrow}\  x \in {\sf STEM}$.
That completes the base case.
\smallskip

Induction step: Suppose ${\sf S} y \in {\mathbb N}$ and ${\sf S} y \in {\sf STEM}$ and $x < {\sf S} y$.
We must prove $x \in {\sf STEM}$.  We have
\begin{eqnarray*}
y \in {\sf STEM}  && \mbox{\qquad  by Lemma~\ref{lemma:Spred}}\\
{\sf S} y \in {\sf STEM} && \mbox{\qquad by hypothesis}\\
 {\sf S} y \mbox{\ is not a double successor} && \mbox{\qquad by Lemma~\ref{lemma:Soneone}}\\
x < y \ \lor \ x = y  && \mbox{\qquad by  Lemma~\ref{lemma:lessthansuccessorN}}
\end{eqnarray*}
If $x < y$, then by the induction hypothesis, $x \in {\sf STEM}$.   If $x = y$
then $x \in {\sf STEM}$ because $y \in {\sf STEM}$.  That completes the induction step.
That completes the proof of the lemma.

\begin{lemma} \label{lemma:Smax}
Suppose  ${\sf S} k = {\sf S} n$ with $k \in {\sf STEM}$ and $n \in {\mathbb N}$ and $k \neq n$.
Then $k$ is a maximal element of ${\sf STEM}$; more precisely,
$$ {\sf STEM} = \{ x\in {\mathbb N}: x < k \ \lor \ x = k\}.$$
\end{lemma}

\noindent{\em Proof}.
Define
$$Z = \{x \in {\sf STEM} : x < k \ \lor\ x = k\}.$$
The formula is stratified, since $<$ is definable as a relation in INF.
I say that $Z$ contains ${\bf 0}$ and is closed under successor except
double successors.
\smallskip

To prove ${\bf 0} \in Z$:
\begin{eqnarray*}
 {\bf 0} \in {\sf STEM}  &&\mbox{\qquad by Lemma~\ref{lemma:S1}}\\
k = {\bf 0} = k \ \lor \ k \neq {\bf 0}  &&\mbox{\qquad by Lemma~\ref{lemma:decidable0}}
\end{eqnarray*}
We argue by cases.
\smallskip

Case 1, $k = {\bf 0}$.  Then ${\bf 0} \in Z$, by definition of $Z$.
\smallskip

Case 2, ${\bf k} \neq {\bf 0}$.  Then
\begin{eqnarray*}
k = {\sf S} m && \mbox{\qquad for some $m \in {\mathbb N}$, by Lemma~\ref{lemma:predecessor}}\\
{\bf 0} \oplus  {\sf S} m = {\sf S} m && \mbox{\qquad by Lemma~\ref{lemma:zeroplusx}}\\
{\bf 0} \oplus  {\sf S} m = k  && \mbox{\qquad since $k = {\sf S} m$}\\
{\bf 0} < k && \mbox{\qquad by definition of $<$}
\end{eqnarray*}

  To prove $Z$ is
closed under successor except double successor:
Suppose $x \in Z$ and ${\sf S} x$ is not a double successor.
Since $x \in Z$, $x < k \ \lor\ x = k$.  But ${\sf S} k$ is
a double successor, so $x \neq  k$.  Therefore $x < k$.
Then ${\sf S} x = k \lor {\sf S} x < k$,  by Lemma~\ref{lemma:order2}.
Hence ${\sf S} x \in Z$.
Therefore $Z$ contains ${\bf 0}$ and is closed
under successor except double successors.  Therefore ${\sf STEM} \subseteq Z$.
Now I say
$${\sf STEM} = \{ x \in {\mathbb N} : x < k \lor x = k\}.$$
It suffices to prove
$$ x \in {\sf STEM} \iff x \in {\mathbb N} \ \land \ ( x < k \lor x = k).$$
Left to right:  Suppose $x \in {\sf STEM}$.  By Lemma~\ref{lemma:SN}, ${\sf STEM} \subseteq {\mathbb N}$,
so $x \in {\mathbb N}$.  Since
${\sf STEM} \subseteq Z$, we
have $x \in Z$.  Then  $x < k \lor x = k$, by definition of $Z$.
\smallskip

Right to left:  Suppose $x \in {\mathbb N} \ \land \ ( x < k \lor x = k)$.
Since $k \in {\sf STEM}$, we have $x \in {\sf STEM}$ by Lemma~\ref{lemma:Sinit}.
That completes the proof of the lemma.

\begin{lemma} \label{lemma:trichotomyonS}
Let $P$ be any subset of ${\mathbb N}$ satisfying the following two conditions:
\smallskip

(i)  $\forall x \in {\mathbb N}\,( S x \in P \ {\rightarrow}\  x \in P)$.
\smallskip

(ii) $\forall x,y \in P (y < {\sf S} x \iff y< x \mspace{1mu} \lor \mspace{2mu} y = x)$.
\smallskip

Then trichotomy holds on $P$. That is, for $x,y \in P$, exactly
one of $x < y$, $x = y$, or $y < x$ holds.
\end{lemma}

\noindent{\em Proof}.  Assume (i) and (ii).
By Lemma~\ref{lemma:trichotomy1}, at least one of the
three alternatives (of trichotomy) holds.  We prove by induction on $y$ that
$$ y\in P \ {\rightarrow}\  \forall x \in P\, ( \neg(x < y \ \land \ y < x) \ \land \ x \not< x).$$
The formula is stratified, giving $x$ and $y$ index 0 and $P$ index 1, so
we may proceed by induction.
\smallskip

 Base case, $y={\bf 0}$.  Suppose $x \in P$ and ${\bf 0} \in P$.   We do not have
$x < {\bf 0}$, by Lemma~\ref{lemma:notless0}. Suppose $x={\bf 0} \ \land \ {\bf 0} < x$.
Then ${\bf 0} < {\bf 0}$, contradicting Lemma~\ref{lemma:notless0}.  That
completes the base case.
\smallskip

Induction step:  Suppose ${\sf S} y \in P$.  Assume $x\in P$.  We have to prove
\begin{eqnarray*}
 \neg\,(x < {\sf S} y \ \land {\sf S} y < x) \ \land \ {\sf S} y \not< {\sf S} y. \label{eq:E2113}
 \end{eqnarray*}
We have
\begin{eqnarray*}
y \in P  && \mbox{\qquad by (i), since ${\sf S} y \in P$}\\
x < {\sf S} y  && \mbox{\qquad assumption}\\
x < y \lor x = y  && \mbox{\qquad by (ii), with $x$ and $y$ switched}\\
x < y \ {\rightarrow}\  x \oplus  j = y   && \mbox{ for some $j\in {\mathbb N}$, by the definition of $<$}\\
x = y \ {\rightarrow}\  x \oplus j = y    && \mbox{ for $j = {\bf 0}$, by Lemma~\ref{lemma:ChurchZero_equation}}\\
x \oplus j = y && \mbox{ for some $j\in {\mathbb N}$, by the preceding three lines}\\
\end{eqnarray*}
Now assume that also ${\sf S} y < x$. Then arguing as above, but switching $x$ and $y$,
we have
\begin{eqnarray*}
  {\sf S} y \oplus  \ell = x && \mbox{\qquad for some $\ell \in {\mathbb N}$} \\
 {\sf S} y \oplus  \ell \oplus  j = x\oplus j  && \mbox{\qquad by the preceding line}\\
 {\sf S} y \oplus  \ell \oplus  j  = y  &&\mbox{\qquad since $x \oplus j = y$}\\
 y \oplus  {\sf S}(\ell \oplus  j) = y && \mbox{\qquad by Lemma~\ref{lemma:ChurchSuccessorShift}}\\
 y < y && \mbox{\qquad by the definition of $<$}
\end{eqnarray*}
But that contradicts the induction hypothesis, since $y \in P$.
We have now proved the first half of (\ref{eq:E2113}), namely
$$  \neg\,(x < {\sf S} y \ \land {\sf S} y < x).$$
Then by Lemma~\ref{lemma:trichotomy1} we have ${\sf S} y = x$.
It remains to prove ${\sf S} y \not< {\sf S} y$.  Suppose ${\sf S} y < {\sf S} y$.  Then
\begin{eqnarray*}
y < {\sf S} y && \mbox{\qquad by Corollary~\ref{lemma:xlessthansx}}\\
{\sf S} y \in P  && \mbox{\qquad by hypothesis}\\
{\sf S} y < y \ \lor \ {\sf S} y  = y && \mbox{\qquad by hypothesis (ii)}
\end{eqnarray*}
We argue by cases accordingly.
\smallskip

Case~1, ${\sf S} y < y$.  Since $y < {\sf S} y$ we have $y < y$ by
transitivity, contradicting the induction hypothesis.
\smallskip

Case~2, ${\sf S} y = y$.  Then since $y < {\sf S} y$ we again have $y < y$,
contradicting the induction hypothesis.
That completes the proof of (\ref{eq:E2113}.
That completes the induction step.  That
completes  the proof of the lemma.

\begin{lemma}\label{lemma:knotlessthank}
Suppose there is a double successor
${\sf S} {\bf k} = {\sf S}  {\bf n}$ with ${\bf k} \in {\sf STEM}$ and $ {\bf n} \neq {\bf k}$.
Then ${\bf k} \not < {\bf k}$.
\end{lemma}

\noindent{\em Proof}.   Let
$$ X:= {\sf STEM} - \{ x \in {\mathbb N}: {\bf k} < x\}.$$
I say that $X$ is closed under non-double successors.  Suppose $x \in X$ and
${\sf S} x$ is not a double successor.  Then
\begin{eqnarray*}
{\sf S} x \in {\sf STEM}  &&\mbox{\qquad  by Lemma~\ref{lemma:S1}}\\
{\bf k} \not< x  &&\mbox{\qquad since $x \in X$}
\end{eqnarray*}
 I say $  {\bf k} \not < {\sf S} x$.  Suppose ${\bf k} < {\sf S} x$.
Then by Lemma~\ref{lemma:lessthansuccessorN}, we have ${\bf k} < x \ \lor \ {\bf k} = x$.
We do not have ${\bf k} = x$, since ${\sf S} {\bf k}$ is a double successor but ${\sf S} x$ is not.
Therefore ${\bf k} < x$, contradiction.  Therefore $X$ is closed under non-double
successors, as claimed.  Therefore ${\sf STEM} \subseteq X$, by definition of ${\sf STEM}$.
But ${\bf k} < {\bf k}$ implies ${\bf k} \not \in X$,  while by hypothesis, ${\bf k} \in {\sf STEM}$.
That completes the proof of the lemma.

\begin{lemma} \label{lemma:kisunique}
Suppose there is a double successor
${\sf S} {\bf k} = {\sf S}  {\bf n}$ with ${\bf k} \in {\sf STEM}$ and $ {\bf n} \neq {\bf k}$.
Let $x \in {\sf STEM}$ with $x \neq {\bf k}$.  Then ${\sf S} x$ is
not a double successor; that is, $\forall u\in {\mathbb N}( {\sf S} u = {\sf S} x \ {\rightarrow}\  u = x).$
\end{lemma}

\noindent{\em Proof}.
Suppose ${\sf S} {\bf k}$ is a double
successor, and $x \in {\sf STEM}$ and $x \neq {\bf k}$. Then by Lemma~\ref{lemma:Smax},
we have $x< {\bf k}$.  If ${\sf S} x$ is a double successor, then by Lemma~\ref{lemma:Smax},
  ${\bf k} < x$.   Then by Lemma~\ref{lemma:transitivity}, ${\bf k} < {\bf k}$.
But that contradicts Lemma~\ref{lemma:knotlessthank}.  Hence,
${\sf S} x$ is not a double successor.  That is,
$$ \neg \exists u \in {\mathbb N}\,({\sf S} u = {\sf S} x \ \land \ u \neq x).$$
By logic,
$$ \forall u \in {\mathbb N}\,({\sf S} u = {\sf S} x \ {\rightarrow}\  \neg\neg\,(u = x).$$
Since $x \in {\sf STEM}$ and $y \in {\mathbb N}$,  we have $\neg\neg\,u = x \ {\rightarrow}\  u = x$,
by Lemma~\ref{lemma:Sdecidable}.  Therefore we can drop the double negation:
$$ \forall u \in {\mathbb N}\,({\sf S} u = {\sf S} u \ {\rightarrow}\   u = x).$$
That completes the proof of the lemma.

\begin{lemma}\label{lemma:Strichotomy}
Suppose there is a double successor
${\sf S} {\bf k} = {\sf S} {\bf n}$ with ${\bf k} \in {\sf STEM}$ and ${\bf n} \neq {\bf k}$.  Then
 for $y \in {\sf STEM}$,  we have $\neg(x < y \ \land y < x) \ \land \ \neg\,(y < y)$.
\end{lemma}

\noindent{\em Proof}.
We intend to apply Lemma~\ref{lemma:trichotomyonS},
with $P$ replaced by ${\sf STEM}$.   To do that, it suffices to verify
the  hypotheses of Lemma~\ref{lemma:trichotomyonS}, namely
\begin{eqnarray*}
&&(i) \qquad   x \in {\mathbb N} \ {\rightarrow}\  {\sf S} x \in {\sf STEM}  \ {\rightarrow}\  x \in {\sf STEM} \\
&&(ii) \qquad x,y \in {\sf STEM}  \ {\rightarrow}\  (y < {\sf S} x \iff y< x \mspace{1mu} \lor \mspace{2mu} y = x)
 \end{eqnarray*}
Ad (i):  This is Lemma~\ref{lemma:Spred}.
\smallskip

Ad (ii):  Assume $x,y \in {\sf STEM}$.  By Lemma~\ref{lemma:Sdecidable}, we have $x = {\bf k} \ \lor \ x \neq {\bf k}$.  We
argue by cases.
\smallskip

Case 1, $x = {\bf k}$.  We have to prove $y < {\sf S} {\bf k} \iff y < {\bf k} \ \lor \ y = {\bf k}$.
\smallskip

Left to right: By
Lemma~\ref{lemma:Smax}, the right side is equivalent to $y \in {\sf STEM}$, which we have assumed.
\smallskip

Right to left: Assume $y < {\bf k} \ \lor \ y = {\bf k}$; we have to prove $y < {\sf S} {\bf k}$.  We have
${\bf k} < {\sf S} {\bf k}$ by Lemma~\ref{lemma:xlessthansx}.  If $y = {\bf k}$ we are done;  if
$y < {\bf k}$ then by transitivity (Lemma~\ref{lemma:transitivity}) we have $y < {\sf S} {\bf k}$.
That completes Case~1.
\smallskip

Case 2, $x \neq {\bf k}$.  By Lemma~\ref{lemma:kisunique}, $x$ is not a double successor.
Then by Lemma~\ref{lemma:lessthansuccessorN}, we have (ii).
That completes Case~2.  That completes the proof of the lemma.

\begin{lemma}\label{lemma:nneqzero}
Suppose there is a double successor
${\sf S} {\bf k} = {\sf S} {\bf n}$ with ${\bf k} \in {\sf STEM}$ and ${\bf n} \neq {\bf k}$.  Then ${\bf n} \neq {\bf 0}$.
\end{lemma}

\noindent{\em Proof}. Assume  ${\bf n} = {\bf 0}$.
 Then ${\bf n} \in {\sf STEM}$, by Lemma~\ref{lemma:S1}.
By Lemma~\ref{lemma:Smax},
${\bf 0}$ is the maximal element of ${\sf STEM}$.  Then ${\bf 0}$ is the only
element of ${\sf STEM}$, by Lemma~\ref{lemma:notless0}.
  Then ${\bf k} = {\bf 0}$, since ${\bf k} \in {\sf STEM}$. But
that contradicts ${\bf n} \neq {\bf k}$. That completes the proof of the lemma.

\section{Structure of ${\mathbb N}$ under successor: the loop}

\begin{definition} \label{definition:loop}
Suppose there is a double successor
${\sf S} {\bf k} = {\sf S} {\bf n}$ with ${\bf k} \in {\sf STEM}$ and ${\bf n} \neq {\bf k}$.  Then the {\bf loop}
  ${\mathcal L}({\bf n})$ is the intersection of all sets $X$ containing ${\bf n}$ and
closed under successor.
\end{definition}

The formula is stratified, giving ${\bf n}$ and ${\bf k}$ both index 0.  ${\sf STEM}$ is a parameter.
Hence the definition is legal in INF.

\begin{lemma}\label{lemma:L1} Suppose there is a double successor
${\sf S} {\bf k} = {\sf S} {\bf n}$ with ${\bf k} \in {\sf STEM}$ and ${\bf n} \neq {\bf k}$.   Then ${\bf n} \in {\mathcal L}({\bf n})$ and
${\mathcal L}({\bf n})$ is closed under Church successor.
\end{lemma}

\noindent{\em Proof}. Follows from the definition of ${\mathcal L}({\bf n})$ as the intersection of
all sets $w$ that
  contain ${\bf n}$ and are closed under successor.  Since ${\bf n}$ belongs to every such $w$,
  it belongs to their intersection.  Suppose $x \in {\mathcal L}({\bf n})$;  then $x\in w$, so ${\sf S} x \in w$.
  Then ${\sf S} x$ belongs to the intersection of all such $w$, i.e., ${\sf S} x \in {\mathcal L}({\bf n})$.
  That completes the proof of the lemma.

\begin{lemma} \label{lemma:LN} Suppose there is a double successor
${\sf S} {\bf k} = {\sf S} {\bf n}$ with ${\bf k} \in {\sf STEM}$ and ${\bf n} \neq {\bf k}$.   Then ${\mathcal L} ({\bf n}) \subseteq {\mathbb N}$.
\end{lemma}

\noindent{\em Proof}. ${\bf n} \in {\mathcal L} n$ by Lemma~\ref{lemma:L1}.  Then ${\mathbb N}$ is a set containing
${\bf n}$ and closed under successor.  Then by definition of ${\mathcal L} ({\bf n})$, ${\mathcal L} ({\bf n}) \subseteq {\mathbb N}$.
That completes the proof of the lemma.

\begin{lemma} \label{lemma:LcapS}
Suppose there is a double successor
${\sf S} {\bf k} = {\sf S} {\bf n}$ with ${\bf k} \in {\sf STEM}$ and ${\bf n} \neq {\bf k}$.
Then
 ${\mathcal L}({\bf n}) \cap {\sf STEM} = \phi$.
 \end{lemma}

\noindent{\em Proof}.   Assume ${\sf S} {\bf k} = {\sf S} {\bf n}$ and ${\bf k} \in {\sf STEM}$ and ${\bf n} \neq {\bf k}$.
We will prove by induction on $j$ that
 $$j \in {\sf STEM} \ {\rightarrow}\  j \not \in {\mathcal L}({\bf n}).$$
 The formula is stratified, giving $j$ index 0; ${\sf STEM}$ and ${\mathcal L}({\bf n})$ are parameters.
 \smallskip

  Base case: We must
show $0 \not\in{\mathcal L}$.  Let $Z = {\mathcal L}({\bf n})- \{0\}$.  Then $Z$ is closed
under successor, by Theorem~\ref{theorem:successoromitszero}.
And $Z$ contains ${\bf n}$, since ${\bf n} \neq 0$ by Lemma~\ref{lemma:nneqzero}.
Therefore ${\mathcal L}({\bf n}) \subseteq Z$.  Therefore $0 \not\in{\mathcal L}$, as desired.
\smallskip

Induction step:  Suppose ${\sf S} j \in {\sf STEM}$.
 We have $j \in {\sf STEM}$ by Lemma~\ref{lemma:Spred}.
By Lemma~\ref{lemma:Soneone},
 ${\sf S} j$ is not a double successor.  Therefore,
if ${\sf S} j = {\sf S} {\bf n}$, $j= {\bf n}$.  But $j \neq {\bf n}$, since
${\bf n} \in {\mathcal L}({\bf n})$ by definition of ${\mathcal L}({\bf n})$, but $j \not\in{\mathcal L}$ by
the induction hypothesis.   Therefore,
${\sf S} j \neq {\sf S} {\bf n}$.
\smallskip

Define $Z = {\mathcal L}({\bf n}) - \{{\sf S} j\}$.  I say $Z$ is closed under
successor.  Let $x \in Z$; then $x \in {\mathcal L}({\bf n})$, so ${\sf S} x \in {\mathcal L}$.
By induction hypothesis $j \not\in{\mathcal L}({\bf n})$, but $x \in {\mathcal L}$;
therefore $x \neq j$.
If ${\sf S} x = {\sf S} j$ then ${\sf S} j$ is a double successor,
contradicting Lemma~\ref{lemma:Soneone}, since ${\sf S} j \in {\sf STEM}$.  Hence ${\sf S} x \in Z$
as claimed.
\smallskip

Now I say ${\bf n} \in Z$.  Since ${\bf n} \in {\mathcal L}({\bf n})$ it suffices to show
that ${\bf n} \neq {\sf S} j$.  Suppose to the contrary that ${\bf n} = {\sf S} j$.
Then ${\bf n} \in {\sf STEM}$, since ${\sf S} j \in {\sf STEM}$.
  Since ${\sf S}{\bf n}$ is a double successor, by
Lemma~\ref{lemma:Smax}, ${\bf n}$ is the maximal element of ${\sf STEM}$.
But ${\bf k}$ is the maximal element of ${\sf STEM}$, by definition of ${\bf k}$.
Therefore ${\bf k} = {\bf n}$, contradiction.  Hence ${\bf n} \neq {\sf S} j$.
Hence ${\bf n} \in Z$, as claimed.
\smallskip

 Therefore $Z$ satisfies the conditions defining ${\mathcal L}({\bf n})$.
Therefore ${\mathcal L}({\bf n}) \subseteq Z$. Therefore ${\sf S} j \not \in {\mathcal L}({\bf n})$, as
desired.  That completes the induction step.
That completes the proof of the lemma.

\begin{lemma}\label{lemma:LcupS}
Suppose there is a double successor
${\sf S} {\bf k} = {\sf S} {\bf n}$ with ${\bf k} \in {\sf STEM}$ and ${\bf n} \neq {\bf k}$.
Then ${\mathbb N} = {\mathcal L}({\bf n}) \cup {\sf STEM}$.
\end{lemma}

\noindent{\em Proof}.  Assume ${\sf S} {\bf k} = {\sf S} {\bf n}$ and ${\bf k} \in {\sf STEM}$ and ${\bf n} \neq {\bf k}$.
We will prove by induction on $x$ that
\begin{eqnarray}
x \in {\mathbb N} \ {\rightarrow}\  x \in {\mathcal L}({\bf n}) \cup {\sf STEM} \label{eq:2027}
\end{eqnarray}
The formula is stratified, giving $x$ index 0; ${\mathcal L}({\bf n})$ is a parameter.
\smallskip

Base case: ${\bf 0} \in {\sf STEM}$, by Lemma~\ref{lemma:SN}.  Therefore
${\bf 0} \in {\mathcal L}({\bf n}) \cup {\sf STEM}$.  That completes the base case.
\smallskip

Induction step:
Let $x \in {\mathcal L}({\bf n}) \cup {\sf STEM}$. Then $x \in {\mathcal L}({\bf n}) \ \lor \ x \in {\sf STEM}$.
\smallskip

Case~1:
$x \in {\mathcal L}({\bf n})$. Then by Lemma~\ref{lemma:L1}, ${\sf S} x \in {\mathcal L}({\bf n})$, so ${\sf S} x \in {\mathcal L}({\bf n}) \cup {\sf STEM}$.
\smallskip

Case~2: $x \in {\sf STEM}$.  We have
\begin{eqnarray*}
{\bf k} \in {\sf STEM} && \mbox{\qquad by hypothesis}\\
{\bf k} \in {\mathbb N}  && \mbox{\qquad by Lemma~\ref{lemma:SN}}\\
x = {\bf k} \lor x \neq {\bf k} &&\mbox{\qquad by Lemma~\ref{lemma:Sdecidable}}
\end{eqnarray*}
 Therefore we may
argue by cases according as $x = {\bf k}$ or not.
\smallskip

Case~2a: $x \neq {\bf k}$.  Then
\begin{eqnarray*}
\forall u\,(u \in {\mathbb N} \ {\rightarrow}\  {\sf S} u = {\sf S} x \ {\rightarrow}\  u = x) &&\mbox{\qquad by Lemma~\ref{lemma:kisunique}}\\
 {\sf S} x \in {\sf STEM} && \mbox{\qquad by Lemma~\ref{lemma:S1}}\\
x \in {\mathcal L}({\bf n}) \cup {\sf STEM} &&\mbox{\qquad by definition of union}
\end{eqnarray*}

Case~2b: $x = {\bf k}$.
Then
\begin{eqnarray*}
{\bf n} \in {\mathbb N} && \mbox{\qquad by Lemma~\ref{lemma:LN}}\\
 {\sf S} {\bf n} \in {\mathcal L}({\bf n}) && \mbox{\qquad by Lemma\ref{lemma:L1}}\\
{\sf S} x = {\sf S} {\bf k} = {\sf S} n && \mbox{\qquad by hypothesis}\\
{\sf S} x \in {\sf STEM} \cup {\mathcal L}({\bf n}) &&\mbox{\qquad by definition of union}
\end{eqnarray*}
That completes the induction step.
 That completes the proof of (\ref{eq:2027}).
\smallskip

By (\ref{eq:2027}), ${\mathbb N} \subseteq {\mathcal L}({\bf n}) \cup {\sf STEM}$.  It remains
to prove ${\mathcal L}({\bf n}) \cup {\sf STEM} \subseteq {\mathbb N}$.  Suppose $x \in {\mathcal L}({\bf n}) \cup {\sf STEM}$.
Then $x \in {\mathcal L}(n)$ or $x \in {\sf STEM}$.  If $x \in {\mathcal L}(n)$, then $x \in {\mathbb N}$ by Lemma~\ref{lemma:LN}.
If $x \in {\sf STEM}$, then $x \in {\mathbb N}$ by Lemma~\ref{lemma:SN}.  That completes
the proof of the lemma.

\begin{lemma} \label{lemma:Lindependent}
Suppose there is a double successor
${\sf S} {\bf k} = {\sf S} {\bf n}$ with ${\bf k} \in {\sf STEM}$ and ${\bf n} \neq {\bf k}$.
Then  ${\mathcal L}({\bf n}) = {\mathbb N}- {\sf STEM}$.   Consequently ${\mathcal L}(n)$ does not
depend on the choice of ${\bf n}$.
\end{lemma}

\noindent{\em Remark}.  This lemma is never used; we include it only to
clarify why we keep writing in English ``the loop'', while in formulas
we keep writing ${\mathcal L}({\bf n})$ as if ``the loop'' depended on ${\bf n}$.
\medskip

\noindent{\em Proof}.  By Lemma~\ref{lemma:LcupS}, we have ${\mathbb N} = {\mathcal L} ({\bf n}) \cup {\sf STEM}$.
Therefore it suffices to prove
\begin{eqnarray}
{\mathcal L}({\bf n}) = ({\mathcal L} (n) \cup {\sf STEM}) - {\sf STEM}  \label{eq:2163}
\end{eqnarray}
Left to right:  Suppose $t \in {\mathcal L}({\bf n})$.  By Lemma~\ref{lemma:LcapS}, $t \not\in{\sf STEM}$.
Therefore $t \in ({\mathcal L} (n) \cup {\sf STEM}) - {\sf STEM}$, as desired.
\smallskip

Right to left: Suppose $t \in ({\mathcal L} (n) \cup {\sf STEM}) - {\sf STEM}$.  Then $t \in {\mathcal L}({\bf n})$.
That completes the proof of the lemma.

\begin{lemma} \label{lemma:nissuccessor}
Suppose there is a double successor
${\sf S} {\bf k} = {\sf S} {\bf n}$ with ${\bf k} \in {\sf STEM}$ and ${\bf n} \neq {\bf k}$.
Then $\exists p \in {\mathbb N}\, ( p \in {\mathcal L}({\bf n}) \ \land \ {\sf S} p = {\bf n})$.
\end{lemma}

\noindent{\em Proof}.
We have
\begin{eqnarray*}
{\bf n} \not\in {\sf STEM} &&\mbox{\qquad by Lemma~\ref{lemma:kisunique}}\\
{\bf 0} \in {\sf STEM}  &&\mbox{\qquad by Lemma~\ref{lemma:S1}} \\
 {\bf n} \neq {\bf 0} &&\mbox{\qquad by the preceding two lines}\\
{\bf n} = {\sf S} p  &&\mbox{\qquad for  some $p$, by Lemma~\ref{lemma:predecessor}}
\end{eqnarray*}
 By Lemma~\ref{lemma:LcupS}, $p \in {\mathcal L}({\bf n}) \ \lor \ p \in {\sf STEM}$.  We argue
 by cases accordingly.
 \smallskip

 Case 1,  $p \in {\mathcal L}({\bf n})$.  Then we use $p$ to instantiatiate $\exists p$.
 That completes Case~1.
 \smallskip

 Case~2,  $p \in {\sf STEM}$.
 Since we have decidable equality on ${\sf STEM}$.
By Lemma~\ref{lemma:Sdecidable},
we have $p = {\bf k} \ \lor \ p \neq {\bf k}$.
We argue by cases accordingly.
\smallskip

Case~2a, $p = {\bf k}$.
Then ${\bf n} = {\sf S} p = {\sf S} {\bf k} = {\sf S} {\bf n}$,
so ${\bf n} = {\sf S} {\bf n}$.   We use
$n$ to instantiate $\exists p$.  We have
${\bf n} \in {\mathcal L}({\bf n})$ by Lemma~\ref{lemma:L1}.
That completes Case~2a.
\smallskip

Case~2b, $p \neq {\bf k}$.  Then
\begin{eqnarray*}
p < {\bf k} && \mbox{\qquad by Lemma~\ref{lemma:Smax}} \\
 {\sf S} p \in {\sf STEM} &&\mbox{\qquad by Lemma~\ref{lemma:order2}} \\
{\sf STEM} \cap {\mathcal L}({\bf n}) = {\Lambda} &&\mbox{\qquad by Lemma~\ref{lemma:LcapS}}\\
 {\bf n} \in {\mathcal L}({\bf n})  &&\mbox{\qquad by Lemma~\ref{lemma:L1}}\\
 {\sf S} p \in {\mathcal L}({\bf n}) && \mbox{\qquad since ${\sf S} p = {\bf n}$}\\
 {\sf S} p \not\in {\sf STEM} && \mbox{\qquad since ${\sf STEM} \cap {\mathcal L}({\bf n}) = \phi$}
\end{eqnarray*}
But that contradicts ${\sf S} p \in {\sf STEM}$.
That completes Case~2b.
That completes the proof of the lemma.

\begin{theorem} \label{theorem:looponto}
Suppose there is a double successor
${\sf S} {\bf k} = {\sf S} {\bf n}$ with ${\bf k} \in {\sf STEM}$ and ${\bf n} \neq {\bf k}$.
Then ${\sf S}: {\mathcal L}({\bf n}) \to {\mathcal L}(n)$ is onto.
\end{theorem}

\noindent{\em Proof}.  By Lemma~\ref{lemma:L1}, ${\mathcal L}({\bf n})$ is closed under
successor, so ${\sf S}: {\mathcal L}({\bf n}) \to {\mathcal L}(n)$.  Define
$$ Z:= \{ x \in {\mathcal L}({\bf n}) : \exists y\, (y \in {\mathcal L}({\bf n}) \ \land \ {\sf S} y = x) \}.$$
The formula is stratified, giving $x$ and $y$ index 0; ${\mathcal L}({\bf n})$ is a parameter.
We have
\begin{eqnarray*}
{\bf n} \in {\mathcal L}({\bf n}) && \mbox{\qquad by Lemma~\ref{lemma:L1}}\\
\exists p\in {\mathcal L}({\bf n})\,({\sf S} p = {\bf n}) && \mbox{\qquad by Lemma~\ref{lemma:nissuccessor}}\\
 {\bf n} \in Z &&\mbox{\qquad by the definition of $Z$}
\end{eqnarray*}
I say that $Z$ is closed under successor.  Suppose $x \in Z$.
Then
\begin{eqnarray*}
x \in {\mathcal L}({\bf n}) &&\mbox{\qquad by definition of $Z$}\\
{\sf S} x \in {\mathcal L}({\bf n}) && \mbox{\qquad by Lemma~\ref{lemma:L1}}\\
{\sf S} x \in {\mathbb Z} && \mbox {\qquad  by the definition of ${\mathbb Z}$}
\end{eqnarray*}
We have shown that $Z$ contains ${\bf n}$ and is closed under successor. Then by
the definition of ${\mathcal L}({\bf n})$, we have ${\mathcal L}(n) \subseteq Z$.  That completes
the proof of the theorem.

\begin{lemma} \label{lemma:kinN}
Suppose there is a double successor
${\sf S} {\bf k} = {\sf S} {\bf n}$ with ${\bf k} \in {\sf STEM}$ and ${\bf n} \neq {\bf k}$.
Then ${\bf k} \in {\mathbb N}$.
\end{lemma}

\noindent{\em Proof}.  We have ${\sf STEM} \subseteq {\mathbb N}$, since ${\mathbb N} = {\sf STEM} \ \cup \ {\mathcal L}(n)$
by Lemma~\ref{lemma:LcupS}. Since ${\bf k} \in {\sf STEM}$, we have ${\bf k} \in {\mathbb N}$.
That completes the proof of the lemma.

 \section{The Annihilation Theorem}

\begin{theorem} [Annihilation Theorem]
\label{theorem:annihilation}
 Suppose $u$ and $m$ are Church numbers such that
$u \oplus  m = u$.
Let $X$ be any set and let $f:X\to X$ be an injection.
 Then $f$, iterated $m$ times, is the
identity on $X$.  In symbols, $m fx = x$ for all $x \in X$.
\end{theorem}

\noindent{\em Remarks}.  This theorem is proved for any set $X$,
not just for any finite set,  and we do not assume ${\mathbb N}$ is
finite.  Definition~\ref{definition:ChurchFregenjection} defines ``injection''.
We also do not need to know that there is only one
double successor (and even if there is none, the theorem
is still true, although then $m = 0$ is the only possibility.)
\medskip

\noindent{\em Proof}.   Let $f:X \to {\mathbb N}$, and
assume $f \in {\sf FUNC}$ and $Rel(f)$.  By Lemma~\ref{lemma:iteration},
each iterate $uf$ of $f$ maps $X$ to $X$ and is also a functional relation.
Moreover, by Lemma~\ref{lemma:oneoneiteration}, each iterate of $f$ is also
one-to-one from $X$ to $X$.
Then

\begin{eqnarray*}
u &=& u \oplus m \mbox{\qquad\qquad by hypothesis} \\
ufx &=& (u \oplus  m)fx  \mbox{\qquad since $u$, $u\oplus m$, $uf$, and $(u\oplus m)f$ are functions} \\
&=& uf(mfx) \mbox{\qquad \ \ by Lemma~\ref{lemma:doubleiteration}}\\
\end{eqnarray*}
Since $uf$ is one-to-one from $X$ to $X$,  this implies $x = mfx$.
 That completes the proof of the theorem.
\smallskip

\noindent{\em Remark}.
Nothing proved up to now rules out the possibility that ${\bf n} = {\sf S} {\bf k}$
and ${\sf S} {\bf n} = {\bf n}$.  That would make the loop ${\mathcal L}$ contain only one element,
and ${\bf m}$ would be 1.  The following corollary shows that ${\bf m}$ is
much greater.

\begin{corollary} \label{lemma:mbig}
Suppose  $x = x\oplus  m$ for some
$x,m \in {\mathbb N}$.
Then  $m$ is not equal to 1, 2, 3, $\ldots$, where by $1$ we mean ${\sf S} {\bf 0}$, etc.
\end{corollary}

\noindent{\em Remark}.  Formally, this is a different theorem for each
value of $m$.  We formalized the cases $m=1$ and $m=2$ in Lean, which was
sufficient for our application.
\smallskip

\noindent{\em Proof}. If there is
a finite set $X$ with a permutation $f$ that is not the identity on $X$, but
  $d f$ is the identity on $X$, then ${\bf m} \neq d$.  (Here $d$ is not
a variable, but a specific named integer, with a different proof for each $d$.
)
For example, when $d = {\sf S} {\bf 0}$, we have ${\bf 0} \neq {\sf S} {\bf 0}$
by Theorem~\ref{theorem:successoromitszero}. We can define
 a permutation $f$ of $\{ {\bf 0}, {\sf S} {\bf 0}\}$
 that interchanges  ${\bf 0}$ and $ {\sf S} {\bf 0}$.
  (It takes about 400 steps to verify
 that formally, as the definition of permutation has several clauses.)
 Therefore ${\bf m} \neq {\sf S} {\bf 0}$.
\smallskip

Therefore there are at least three   elements in ${\mathbb N}$, namely
${\bf 0}$, ${\bf n}$, and ${\sf S} {\bf n}$.  I say these are distinct elements.
We have ${\sf S} {\bf n} \neq {\bf n}$ since we have just shown ${\bf m} \neq {\bf 0}$.
We have ${\sf S} n \neq {\bf 0}$ by Theorem~\ref{theorem:successoromitszero}.
And we have ${\bf n} \neq {\bf 0}$ by Lemma~\ref{lemma:nneqzero}.
We can then construct a permutation $f$ of ${\mathbb N}$ such that $jf$ is not
the identity for $j = {\sf S} {\bf 0}$ or $j = {\sf S}({\sf S} {\bf 0})$.
Therefore ${\bf m} \neq {\sf S} ({\sf S} {\bf 0})$.  Then one can show that there
are three distinct members of ${\mathcal L}({\bf n})$, so there are four distinct
members of ${\bf n}$, and we can construct a permutation of those members
to show that ${\bf m} \neq {\sf S}({\sf S}({\sf S}{\bf 0}))$.  Similarly we can continue
through any particular value of ${\bf m}$.   That is,
 ${\bf m}$ is not equal to any integer with a name, as for such $d$ we can construct
the required permutation.
\smallskip

\begin{corollary} \label{lemma:snneqn}
Nothing
 is its
own successor.  That is, for $x \in {\mathbb N}$, we have ${\sf S} x \neq x$.
\end{corollary}

\noindent{\em Remark}.  This corollary shows that the loop
does not degenerate to a singleton, in that ${\sf S} {\bf n} \neq {\bf n}$,
but it applies more generally to any Church number $x$.   Thanks
to Albert Visser for pointing out that we can obtain this corollary
immediately
for any $x$, not just for ${\bf n}$.  In fact we do not even need to
assume that there is a double successor.
\medskip

\noindent{\em Proof}. We have ${\sf S} x = x\oplus {\sf S} 0 = x \oplus 1$.
Then if ${\sf S} x = x$ we have $x = x\oplus m$ with $m=1$, contradicting
Corollary~\ref{lemma:mbig}.  That completes the proof.

\begin{corollary} \label{lemma:ssnneqn}
For $x \in {\mathbb N}$, we have ${\sf S}({\sf S} x) \neq x$.
\end{corollary}

\noindent{\em Remark}. To formalize this result, we have to formalize
Lemma~\ref{lemma:mbig} for ${\bf m} = 2$, or more precisely, ${\bf m} = {\sf S}({\sf S} {\bf 0}))$,
which involves constructing a permutation of three elements.  We define
$X = \{ a, b,c\}$ where $a = {\bf 0}$, $b = {\sf S} a$, and $c = {\sf S} b$.
Those three elements are distinct, by Lemma~\ref{lemma:snneqn} and
Theorem~\ref{theorem:successoromitszero}. To prove that there is a
permutation of $X$ requires about 700 steps,  which we omit here.
(There are several
arguments by cases with nine cases.) Somewhat
surprisingly, one does not need to first prove $X$ is finite.
\smallskip

\noindent{\em Proof}.
Suppose ${\sf S}({\sf S} x) = x$.  Then
\begin{eqnarray*}
x = x \oplus {\bf 0} && \mbox{\qquad by Lemma~\ref{lemma:ChurchZero_equation}}\\
{\sf S} x = {\sf S}(x \oplus {\bf 0}) &&\mbox{\qquad by the previous line}\\
 = x \oplus {\sf S} {\bf 0} && \mbox{\qquad by Lemma~\ref{lemma:ChurchSuccessorShift}} \\
{\sf S} ({\sf S} x) = {\sf S} (x \oplus {\sf S} {\bf 0})  &&\mbox{\qquad by the previous line}\\
 = x \oplus {\sf S} ({\sf S} {\bf 0}) &&\mbox{\qquad by Lemma~\ref{lemma:ChurchSuccessorShift}} \\
x = x \oplus {\sf S} ({\sf S} {\bf 0}) && \mbox{\qquad since ${\sf S} ({\sf S} x) = x$}
\end{eqnarray*}
But that contradicts Lemma~\ref{lemma:mbig}.
That completes the proof.

\begin{corollary}\label{lemma:klessthann}
 If  ${\sf S} {\bf k} = {\sf S} {\bf n}$  with ${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$ and ${\bf k} \neq {\bf n}$, then ${\bf k} < {\bf n}$.
That is, there exists $m \in {\mathbb N}$ such that ${\bf n} = {\bf k} \oplus  m$.
\end{corollary}

\noindent{\em Proof}.   Define
$$Z = \{ x\in {\sf STEM}: x \le {\bf n} \}.$$
I say that $Z$ contains 0
and is closed under successor except double successors.
We have
\begin{eqnarray*}
{\bf 0} \in {\sf STEM}  && \mbox{\qquad by Lemma~\ref{lemma:S1}}\\
{\bf 0} \oplus  {\bf n} = {\bf n} && \mbox{\qquad by Lemma~\ref{lemma:zeroplusx}}\\
{\bf 0} \le {\bf n}  && \mbox{\qquad by definition of $<$}\\
{\bf 0} \in Z && \mbox{\qquad by definition of $Z$}
\end{eqnarray*}
Now suppose $x \in Z$ and ${\sf S} x$ is not a double successor.  We
must show ${\sf S} x \in Z$. We have
\begin{eqnarray*}
x \in {\sf STEM} \ \land \ x \le {\bf n} && \mbox{\qquad by the definition of $Z$}\\
{\sf S} x \in {\sf STEM} &&\mbox{\qquad by Lemma~\ref{lemma:S1}}\\
x \neq {\bf n}  && \mbox{\qquad by Lemma~\ref{lemma:kisunique}, since ${\sf S} x$ is not a double successor} \\
x < {\bf n} && \mbox{\qquad by Lemma~\ref{lemma:Churchletolessthan}}\\
 {\sf S} x \le {\bf n} &&\mbox{\qquad by Lemma~\ref{lemma:Churchle}}
\end{eqnarray*}
 Hence ${\sf STEM} \subseteq Z$.
Then ${\bf k} \in Z$.  Therefore ${\bf k} \le {\bf n}$.  Since ${\bf k} \neq {\bf n}$ we
have ${\bf k} < {\bf n}$, by Lemma~\ref{lemma:Churchletolessthan}.
  By definition of $<$, there exists $m \in {\mathbb N}$
such that ${\bf n} = {\bf k} \oplus  m$.  That completes the proof of the corollary.
\medskip

\noindent{\em Remarks}. $m$ is not asserted to be unique.  We do not
know if $m$ has to be in the loop or has to be in the stem.
\smallskip

In order to apply the Annihilation Theorem (Theorem~\ref{theorem:annihilation}), we need to know that the
iterates of $f$ still map $X$ to $X$.  That is the content of the next lemma.
\begin{lemma} \label{lemma:xfmaps}
Let $X$ be any set. Let $f:X \to X$, and suppose $f \in {\sf FUNC}$ and $Rel(f)$.
   Then
$$ q \in {\mathbb N} \ {\rightarrow}\   x \in X \ {\rightarrow}\   q f x \in X.$$
\end{lemma}

\noindent{\em Proof}. The formula is stratified, giving $x$ index 0,
$f$ index 3, and $q$ index 6.  Therefore we may proceed by induction on $q$.
\smallskip

Base case, $q={\bf 0}$.  Then
\begin{eqnarray*}
x \in X && \mbox{\qquad by hypothesis} \\
{\bf 0} f x = x && \mbox{\qquad by Lemma~\ref{lemma:zeroAp}}
\end{eqnarray*}
That completes the base case.
\smallskip

Induction step.
\begin{eqnarray*}
q f x \in X && \mbox{\qquad by the induction hypothesis}\\
{\sf S} (q f x) \in X && \mbox{\qquad since $f:X \to X$} \\
{\sf S} q f x = {\sf S} (q f x) && \mbox{\qquad by Theorem~\ref{theorem:successorequation}}\\
{\sf S} q f x \in X && \mbox{\qquad by the preceding two lines}
\end{eqnarray*}
That completes the induction step.
That completes the proof of the lemma.

\section{Some consequences of assuming ${\mathbb N}$ is finite}
We take this opportunity to point out that ``${\mathbb N}$ is not finite'' is,
on the face of it at least,
a weaker assertion than ``${\mathbb N}$ is infinite'',  where the latter is
taken in Dedekind's sense, that the Church successor function is
one-to-one.   Thus ``${\mathbb N}$ is finite'' is a stronger assumption
than ``${\mathbb N}$ is not infinite''.   In this section we show that under the assumption
that ${\mathbb N}$ is finite,  we rather quickly reach several important results:
  ${\mathbb N}$ has decidable equality,
  successor is one-to-one on the loop ${\mathcal L}$, and there is a unique double successor.

 That ${\mathbb N}$ has decidable equality
is immediate if we assume ${\mathbb N}$ is finite, since according to Lemma~\sref{lemma:finitedecidable}, every finite set has decidable
equality.

\begin{lemma} \label{lemma:loopfinite}
If ${\mathbb N}$ is finite, and there is a double successor
${\sf S} {\bf k} = {\sf S} {\bf n}$ with ${\bf k} \in {\sf STEM}$, then  ${\mathcal L}({\bf n})$ is finite.
\end{lemma}

\noindent{\em Proof.} Assume ${\mathbb N}$ is finite
and there is a double successor
${\sf S} {\bf k} = {\sf S} {\bf n}$ with ${\bf k} \in {\sf STEM}$.
  I say that
${\mathcal L}({\bf n})$ is a separable subset of ${\mathbb N}$. By Definition~\sref{definition:SSC},
that means that ${\mathbb N} = {\mathcal L} \cup ({\mathbb N}-{\mathcal L})$.
By Lemma~\ref{lemma:LcupS}, ${\mathbb N}-{\mathcal L} = {\sf STEM}$,
and ${\mathbb N} = {\mathcal L} \cup {\sf STEM}$, so ${\mathcal L}$ is a separable subset of ${\mathbb N}$, as claimed.
Then by Lemma~\sref{lemma:separablefinite}, ${\mathcal L}$ is finite.
That completes the proof of the lemma.

\begin{theorem} \label{theorem:looponeone}
If ${\mathbb N}$ is finite, and there is a double successor
${\sf S} {\bf k} = {\sf S} {\bf n}$ with ${\bf k} \in {\sf STEM}$, then
Church successor restricted to ${\mathcal L}({\bf n})$ is one-to-one.
\end{theorem}

\noindent{\em Proof}.  Assume ${\mathbb N}$ is finite
and there is a double successor
${\sf S} {\bf k} = {\sf S} {\bf n}$ with ${\bf k} \in {\sf STEM}$.
By Lemma~\ref{lemma:loopfinite}, ${\mathcal L}(n) \in {\sf FINITE}$.
By Theorem~\ref{theorem:looponto}, successor is onto as a map from ${\mathcal L}({\bf n})$ to ${\mathcal L}({\bf n})$.
By Theorem~\sref{theorem:dedekind2},   successor is
 one-to-one as a map from ${\mathcal L}$ to ${\mathcal L}$.
That completes
the proof of the theorem.

\begin{theorem} \label{theorem:rho}
Suppose  ${\mathbb N}$ is finite and there is a double successor
${\sf S} {\bf k} = {\sf S} {\bf n}$ with ${\bf k} \neq {\bf n}$ and ${\bf n} \in {\mathbb N}$ and  ${\bf k} \in {\sf STEM}$.
 Then there is exactly
one double successor.  More precisely,  if $j, \ell \in {\mathbb N}$ and $j \neq \ell$
and $j < \ell$ and
 ${\sf S} j = {\sf S} \ell$,
 then $j = {\bf k}$ and $\ell = {\bf n}$.
\end{theorem}

\noindent{\em Proof}.  Suppose ${\mathbb N}$ is finite and ${\sf S} {\bf k} = {\sf S} {\bf n}$
with ${\bf k} \neq {\bf n}$ and ${\bf k} \in {\sf STEM}$.
Suppose ${\sf S} j = {\sf S} \ell$ with $j < \ell$.   We have to prove $\ell = {\bf n}$.
\smallskip

 By Theorem~\ref{theorem:looponeone},
successor is one-to-one on ${\mathcal L}$, so not both $j$ and $\ell$ can belong to ${\mathcal L}({\bf n})$.
By Lemma~\ref{lemma:LcupS}, each of them belongs to ${\mathcal L}({\bf n})$ or to ${\sf STEM}$,
and by Lemma~\ref{lemma:LcapS}, ${\mathcal L}(n)$ and ${\sf STEM}$ are disjoint.
I say that
\begin{eqnarray}
\ell \in {\sf STEM} \ {\rightarrow}\  j \in {\sf STEM} \ \land \ {\sf S} j \in {\sf STEM} \label{eq:2631}
\end{eqnarray}
To prove that, assume $\ell \in {\sf STEM}$.  Then
\begin{eqnarray*}
\ell \in {\sf STEM} && \mbox{\qquad by assumption} \\
j \in {\sf STEM} && \mbox{\qquad by Lemma~\ref{lemma:Sinit}, since $j < \ell$}\\
\end{eqnarray*}
By Lemma~\ref{lemma:S1}, to prove ${\sf S} j \in {\sf STEM}$ it suffices to prove
that ${\sf S} j$ is not a double successor. To that end, assume ${\sf S} j = {\sf S} v$;
we must prove $j = v$.  I say that $j \neq {\bf k}$.  Here is the proof:
\begin{eqnarray*}
j = {\bf k} && \mbox{\qquad assumption}\\
\ell < {\bf k} \ \lor \ \ell = {\bf k} &&\mbox{\qquad by Lemma~\ref{lemma:Smax}, since $\ell \in {\sf STEM}$}\\
\ell < {\bf k} && \mbox{\qquad since ${\bf k} \neq \ell$}\\
{\bf k} < {\bf k}  && \mbox{\qquad by transitivity, since ${\bf k} < \ell$} \\
{\bf k} \not < {\bf k}  && \mbox{\qquad by Lemma~\ref{lemma:knotlessthank}}
\end{eqnarray*}
That contradiction completes the proof that $j \neq {\bf k}$.
Then by Lemma~\ref{lemma:kisunique}, we have $v=j$ as desired.
That completes the proof of (\ref{eq:2631}).
\smallskip

Now I say that $\ell \not \in {\sf STEM}$.  To prove that:
\begin{eqnarray*}
\ell \in {\sf STEM} && \mbox{\qquad by assumption} \\
j \in {\sf STEM} && \mbox{\qquad by (\ref{eq:2631})}\\
{\sf S} j \in {\sf STEM} && \mbox{\qquad by (\ref{eq:2631})}\\
j = \ell  && \mbox{\qquad by Lemma~\ref{lemma:Soneone}}\\
j \neq \ell && \mbox{\qquad by Lemma~\ref{lemma:Strichotomy}, since $j < \ell$}
\end{eqnarray*}
That contradiction completes the proof that $\ell \not\in {\sf STEM}$.
\smallskip

Then
\begin{eqnarray*}
\ell \in {\mathcal L} ({\bf n})  && \mbox{\qquad by Lemma~\ref{lemma:LcupS}, since $\ell \not \in {\sf STEM}$}\\
j \in {\mathcal L}({\bf n}) \ {\rightarrow}\  j = \ell && \mbox{\qquad by Theorem~\ref{theorem:looponeone} }\\
j \not\in {\mathcal L}({\bf n})  && \mbox{\qquad since $j \neq \ell$}\\
j \in {\sf STEM}  && \mbox{\qquad by Lemmas~\ref{lemma:LcupS} and \ref{lemma:LcapS}}\\
{\sf STEM} = \{ x \in {\mathbb N} : x < {\bf k} \lor x = {\bf k}\}  && \mbox{\qquad by Lemma~\ref{lemma:Smax}}\\
{\sf S} {\bf k} \not\in{\sf STEM} && \mbox{\qquad by Lemma~\ref{lemma:Soneone} applied to ${\bf k},{\bf n}$} \\
 {\bf k} \neq {\sf S} {\bf k}  &&\mbox{\qquad since ${\bf k} \in {\sf STEM}$  but ${\sf S} {\bf k} \not\in {\sf STEM}$}\\
 {\bf k} \in {\mathbb N} && \mbox{\qquad by Lemma~\ref{lemma:kinN}}\\
 j = {\bf k} \ \lor \ j \neq {\bf k} && \mbox{\qquad by Lemma~\sref{lemma:finitedecidable}, since ${\mathbb N} \in {\sf FINITE}$}
\end{eqnarray*}
We argue by cases accordingly.
\smallskip

Case~1, $j={\bf k}$. Then
\begin{eqnarray*}
 {\sf S} {\bf k} = {\sf S} \ell  &&\mbox{\qquad since ${\sf S} {\bf k} = {\sf S} j = {\sf S} \ell$}\\
 {\sf S} {\bf n} = {\sf S} \ell  && \mbox{\qquad since ${\sf S} {\bf k} = {\sf S} n$}\\
 \ell \in {\mathcal L}({\bf n}) &&\mbox{\qquad by Lemma~\ref{lemma:LcupS}}\\
{\sf S} \ell \in {\mathcal L}({\bf n}) && \mbox{\qquad by Lemma~\ref{lemma:L1}}\\
 {\sf S} {\bf n} \in {\mathcal L}({\bf n})  && \mbox{\qquad by Lemma~\ref{lemma:L1}}\\
 {\bf n} = \ell && \mbox{\qquad  by Theorem~\ref{theorem:looponeone}}
 \end{eqnarray*}
That completes Case~1.
\smallskip

Case~2, $j \neq {\bf k}$. Then
\begin{eqnarray*}
{\sf S} j \mbox{\ is not a double successor} && \mbox{\qquad by Lemma~\ref{lemma:kisunique}}\\ {\sf S} j \in {\sf STEM}  && \mbox{\qquad by Lemma~\ref{lemma:S1}, since $j \in {\sf STEM}$}\\
j = \ell && \mbox{\qquad by Lemma~\ref{lemma:Soneone}} \\
j \neq \ell && \mbox{\qquad by hypothesis}
\end{eqnarray*}
That contradiction completes Case~2.
That completes the proof of the theorem.

\begin{corollary} \label{lemma:rho2}
Suppose  ${\mathbb N}$ is finite and there is a double successor
${\sf S} {\bf k} = {\sf S} {\bf n}$ with ${\bf k} \neq {\bf n}$ and ${\bf n} \in {\mathbb N}$ and  ${\bf k} \in {\sf STEM}$.
Suppose $j, \ell \in {\mathbb N}$ and $j \neq \ell$ and
 ${\sf S} j = {\sf S} \ell$.  Then $\{j, \ell\} = \{ {\bf k}, {\bf n}\}$,
 i.e., $j$ and $\ell$ are ${\bf n}$ and ${\bf k}$ or ${\bf k}$ and ${\bf n}$.
\end{corollary}

\noindent{\em Proof}. By Lemma~\ref{lemma:trichotomy1},
$j < \ell \ \lor \ell < j$.  If $j < \ell$ then by
Theorem~\ref{theorem:rho} we have $j = {\bf k}$ and $\ell = {\bf n}$.
If $\ell < j$ then (applying Theorem~\ref{theorem:rho} to $\ell$ and $j$ instead of to $j$ and $\ell$\,),
we have  $\ell = {\bf k}$ and $j = {\bf n}$.  That
completes the proof of the corollary.

\section{A linear order on ${\mathbb N}$}

In this section we introduce a certain linear ordering on ${\mathbb N}$,
 which we write as $x \preceq y$,  or in its strict version, $x \prec y$.
The definition of $x \preceq y$ will be given in such a way that it
does not presume that ${\mathbb N}$ is finite or that there is a double successor,
because we need it under those conditions near the end of the paper,
after we have proved ${\mathbb N}$ is not finite but still need to prove ${\mathbb N}$ is
infinite.
\smallskip

The intuitive meaning of $x \preceq y$ is that we come to $x$ before $y$ as we
trace out the stem and then the loop (also allowing $x=y$).

\begin{definition} \label{definition:preceq_aux}
For $X \subseteq {\mathbb N}$, we say ``$X$ is closed under successors except greater double successors''  to mean
$$ \forall u\, (u \in X \ {\rightarrow}\  \forall v \in {\mathbb N}\,(v < u \ {\rightarrow}\  {\sf S} u = {\sf S} v \ {\rightarrow}\  u = v) \ {\rightarrow}\  {\sf S} u \in X)).$$
\end{definition}

\noindent{\em Remark}.  ${\bf n}$ does not actually appear in the definition of ``closed under
successors except greater double successors,''  but the following lemma shows that,
if there is a double successor,  it really means ``closed under successors except ${\bf n}$.''
However, the definition does not {\em assume} that there is a double successor.
\smallskip

\begin{lemma}\label{lemma:preceq_helper}
Suppose ${\mathbb N}$ is finite, and  ${\sf S}{\bf k} = {\sf S}{\bf n}$ with ${\bf k} \in {\sf STEM}$ and ${\bf n} \neq {\bf k}$.  Let $X \subseteq {\mathbb N}$.
 Then
$$ \forall u\, (u \in X \ {\rightarrow}\  \forall v \in {\mathbb N}\,( v < u \ {\rightarrow}\  {\sf S} u = {\sf S} v \ {\rightarrow}\  u = v) \ {\rightarrow}\  {\sf S} u \in X))$$
(which is the formula in the preceding definition) is equivalent to
$$ \forall u\, (u \in X  \ {\rightarrow}\  u \neq {\bf n}  \ {\rightarrow}\  {\sf S} u \in X).$$
\end{lemma}

\noindent{\em Proof}. Let ${\sf S}{\bf k} = {\sf S}{\bf n}$ with ${\bf k} \in {\sf STEM}$ and ${\bf n} \neq {\bf k}$,
and let $X$ be any set.
We have to prove
\begin{eqnarray*}
&& \forall u\, (u \in X \ {\rightarrow}\  \forall v\in {\mathbb N}\,(v < u \ {\rightarrow}\  ({\sf S} u = {\sf S} v \ {\rightarrow}\  u = v) \ {\rightarrow}\  {\sf S} u \in X)) \\
\iff &&
 \forall u\, (u \in X  \ {\rightarrow}\  u \neq {\bf n}  \ {\rightarrow}\  {\sf S} u \in X).
\end{eqnarray*}
Left to right:  Assume $u \in X$ and $u \neq {\bf n}$.  Instantiating the left side to $u$,
we see that it suffices to prove
$$ \forall v \in {\mathbb N}\,(v < u \ {\rightarrow}\  {\sf S} u = {\sf S} v \ {\rightarrow}\  u = v).$$
Suppose $v \in {\mathbb N}$ and $v < u$ and ${\sf S} u = {\sf S} v$.  Since $u \in X$ and $X \subseteq {\mathbb N}$,
we have $u \in {\mathbb N}$.  Since ${\mathbb N}$ is finite, it has decidable equality, by Lemma~\sref{lemma:finitedecidable}.
Therefore $ u = v \ \lor \ u \neq v$.  If $u = v$, the desired conclusion is immediate,
so we may assume $u \neq v$. Then
by Theorem~\ref{theorem:rho}, since $u \neq {\bf n}$,
we have $u=v$ as desired.  That completes the left-to-right direction.
\smallskip

Right to left: Assume
\begin{eqnarray}
 \forall u\, (u \in X  \ {\rightarrow}\  u \neq {\bf n}  \ {\rightarrow}\  {\sf S} u \in X)) \label{eq:E2793}
\end{eqnarray}
and suppose $u\in X$ and
\begin{eqnarray}
\forall v < u\,({\sf S} u = {\sf S} v \ {\rightarrow}\  u = v). \label{eq:E2812}
\end{eqnarray}
  We must prove
${\sf S} u \in X$.  We have
\begin{eqnarray*}
{\bf k} \in {\mathbb N} && \mbox{\qquad by Lemma~\ref{lemma:kinN}}\\
{\bf k} < {\bf n}  && \mbox{\qquad by Corollary~\ref{lemma:klessthann}}
\end{eqnarray*}
 We have $u \neq {\bf n}$, since if $u = {\bf n}$ then taking $u = {\bf n}$ and $v = {\bf k}$ in (\ref{eq:E2812})  we have
${\sf S} u = {\sf S} v$, so $u = v$, i.e., ${\bf n} = {\bf k}$, contradiction.   Then by (\ref{eq:E2793}),
we have ${\sf S} u \in X$, as desired.  That completes the right-to-left direction.
That completes the proof of the lemma.

\begin{definition}\label{definition:preceq}
The relation $x \preceq y$,
 means that $x\in {\mathbb N}$ and $y \in {\mathbb N}$ and $y$ belongs to
  every separable
subset of ${\mathbb N}$ containing $x$ and closed under successors except greater
double successors.
\smallskip

Explicitly,
\begin{eqnarray*}
&& x \preceq y  \iff  \forall X\,( {\mathbb N} = X \cup ({\mathbb N} -X) \ {\rightarrow}\
        x \in X  \\
 &&\ {\rightarrow}\
   \forall u\, (u \in X \ {\rightarrow}\  \forall v\in {\mathbb N}\,(v < u \ {\rightarrow}\  ({\sf S} u = {\sf S} v \ {\rightarrow}\  u = v) \ {\rightarrow}\  {\sf S} u \in X) \ {\rightarrow}\  y \in X.
\end{eqnarray*}
\end{definition}

The definition is stratified, giving $x$ and $y$ index 0 and $X$ index 1.  ${\mathbb N}$ is a parameter.
Since $x$ and $y$ get the same index, the relation $x \preceq y$ is definable in INF.

\begin{lemma} \label{lemma:preceq} Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  Then  for all $x,y \in {\mathbb N}$, we have $ x \preceq y$ if and only if
$$   \forall w\,({\mathbb N} = X \cup ({\mathbb N} -X) \ {\rightarrow}\  x \in w \ {\rightarrow}\
(\forall u\,(u \in w \ {\rightarrow}\  u \neq {\bf n} \ {\rightarrow}\  {\sf S} u \in w)     \ {\rightarrow}\  y \in w).$$
\end{lemma}

\noindent{\em Remark}.  Although ${\bf n}$ appears in this lemma,
${\bf n}$ does not appear in the definition of $\preceq$.  We can use therefore
use this lemma to express $\preceq$ in terms of any (hypothesized) double successor,
without it depending on the particular double successor.
\medskip

\noindent{\em Proof}. Using Lemma~\ref{lemma:preceq_helper} (in the right-to-left direction)
to rewrite the closure condition in the lemma, we see that it suffices to prove
\begin{eqnarray*} x \preceq y \iff
\forall w\,({\mathbb N} = X \cup ({\mathbb N} -X) \ {\rightarrow}\  x \in w \ {\rightarrow}\   \\
 \forall u\, (u \in w \ {\rightarrow}\  \forall v \in {\mathbb N}\,( v < u \ {\rightarrow}\  {\sf S} u = {\sf S} v \ {\rightarrow}\  u = v) \ {\rightarrow}\  {\sf S} u \in w) \\
 \ {\rightarrow}\  y \in w)
\end{eqnarray*}
But that is just Definition~\ref{definition:preceq} (up to renaming a bound variable).
  That completes the proof of the lemma.

\begin{definition}\label{definition:prec}
We define $$x \prec y \iff x \preceq y \ \land x\ \neq y.$$
\end{definition}

\begin{lemma} [Transitivity of $\preceq$] \label{lemma:preceqtrans}
For $x,y,z \in {\mathbb N}$ we have
$$ x \preceq y \ {\rightarrow}\  y \preceq z \ {\rightarrow}\  x \preceq z.$$
\end{lemma}

\noindent{\em Proof}.  Suppose $x \preceq y$ and $y \preceq z$.
Let $X$ be a separable subset of ${\mathbb N}$  closed under successors except
greater double successors.    Suppose $x \in X$.  Since $x \preceq y$
we have $y \in X$.  Since $y \preceq z$, we have $z \in X$.  Then
by the definition of $\preceq$,  we have $x \preceq z$.
That completes the proof of the lemma.

\begin{lemma} \label{lemma:preceqreflexive}
For $x \in {\mathbb N}$ we have $x \preceq x$.
\end{lemma}

\noindent{\em Proof}. $x$ belongs to every separable set $X$ containing $x$ and
satisfying some condition; putting in the particular condition from the
definition of $\preceq$ we have the desired result.  That completes the proof of the lemma.

\begin{lemma} \label{lemma:preceqzero}
 Suppose $x \in {\mathbb N}$ and $x \preceq {\bf 0}$.  Then $x = {\bf 0}$.
\end{lemma}

\noindent{\em Proof}.   By Theorem~\ref{theorem:successoromitszero}, $Z:= {\mathbb N} - \{{\bf 0}\}$ is
  closed under successor.
By Lemma~\ref{lemma:decidable0},  $x = {\bf 0} \ \lor \ x \neq {\bf 0}$.
Therefore $Z$ is a separable subset of ${\mathbb N}$.
If $x \neq {\bf 0}$, then $x \in Z$.
Since $x \preceq {\bf 0}$,   then
${\bf 0} \in Z$.  But ${\bf 0} \not\in Z$.  Therefore
$x = {\bf 0}$.   That completes the proof of the lemma.

\begin{lemma} \label{lemma:precmin2}  For $x \in {\mathbb N}$,  we have $\neg\, (x \prec {\bf 0})$.
\end{lemma}

\noindent{\em Proof}.  Suppose $x \in {\mathbb N}$ and $x \prec {\bf 0}$.  By definition of $\prec$, $x \preceq {\bf 0}$
and $x \neq {\bf 0}$. By Lemma~\ref{lemma:preceqzero}, $x = {\bf 0}$, contradiction.
That completes the proof of the lemma.

\begin{lemma} \label{lemma:preceqsuccessor}
 Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  Then for $x,y \in {\mathbb N}$ we have
$$ y \neq {\bf n} \ {\rightarrow}\   x \preceq {\sf S} y \iff  x \preceq y \ \lor \ x = {\sf S} y.$$
\end{lemma}

\noindent{\em Remark}.  The reader should refer to Fig.~\ref{figure:rho}
to see why the condition $y \neq {\bf n}$ is needed.
\smallskip

\noindent{\em Proof}.  Suppose $y \neq {\bf n}$.  Left to right: suppose $x \preceq {\sf S} y$.
Since ${\mathbb N}$ is finite, it has decidable equality, so $x = {\sf S} y \ \lor \ x \neq {\sf S} y$.
If $x = {\sf S} y$ we are done, so we may suppose $x \neq {\sf S} y$. We
have to prove $x \preceq y$.  Let $X$ be a separable subset
of ${\mathbb N}$ closed under successor except ${\bf n}$ and containing $x$.  We have to prove
$y \in X$.  Since $X$ is a separable subset of ${\mathbb N}$, we have $y \in X \ \lor \ y \not\in X$.
If $y \in X$, we are done, so we may assume $y \not\in X$.
 Define $Z:= X- \{ {\sf S} y\}$. Since $X$ is a separable subset of ${\mathbb N}$ and
${\mathbb N}$ has decidable equality, $Z$ is a separable subset of ${\mathbb N}$ (80 steps omitted).
Since $x \neq {\sf S} y$, we have $x \in Z$.
\smallskip

I say that $Z$ is closed under successor except ${\bf n}$.
To prove that, suppose $u \in {\mathbb Z}$ and $u \neq {\bf n}$; we must prove ${\sf S} u \in {\mathbb Z}$. We have
${\sf S} u \in X$ since $X$ is closed under successor except ${\bf n}$.  Since $Z = X - \{ {\sf S} y\}$,
it suffices to prove ${\sf S} u \neq {\sf S} y$.  Suppose that ${\sf S} u = {\sf S} y$; we must
derive a contradiction.
\begin{eqnarray*}
u = y && \mbox{\qquad by Corollary ~\ref{lemma:rho2}, since $u \neq {\bf n}$ and $y \neq {\bf n}$}\\
u \not\in X && \mbox{\qquad since $y \not\in X$ and $u = y$}\\
u \in X   && \mbox{\qquad since $u \in Z = X - \{{\sf S} y\}$}
\end{eqnarray*}
  That completes the proof that
$Z$ is closed under successor except ${\bf n}$.  Since $x \in Z$ and $x \preceq {\sf S} y$,
we have ${\sf S} y \in Z$.  But that is a contradiction.  That completes the proof of the
left-to-right direction of the lemma.
\smallskip

Right to left: Suppose $y \neq {\bf n}$ and  $x \preceq y \ \lor \ x = {\sf S} y$.
We must prove $x \preceq {\sf S} y$.
Let $X$ be a separable subset of ${\mathbb N}$ closed
under successor except ${\bf n}$ and containing $x$; we must prove ${\sf S} y \in X$.
Since $x \preceq y \ \lor \ x = {\sf S} y$, we may argue by cases.
\medskip

Case~1, $x \preceq y$.  Since $x \in X$ and $y \neq {\bf n}$, we have ${\sf S} y \in X$.
That completes case~1.
\smallskip

Case~2, $x = {\sf S} y$.  Since $x \in X$ we have ${\sf S} y \in X$.
That completes Case~2.
That completes the proof of the lemma.

\begin{corollary} \label{lemma:xpreceqsx}
Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  Then for $x,y \in {\mathbb N}$ we have
$$x \neq {\bf n} \ {\rightarrow}\  x \preceq {\sf S} x.$$
\end{corollary}

\noindent{\em Proof}. By Lemma~\ref{lemma:preceqreflexive}, we have $x \preceq x$.
Taking $y = x$ in Lemma~\ref{lemma:preceqsuccessor}, we have $x \preceq {\sf S} x$
as desired.  That completes the proof of the corollary.

\begin{corollary}\label{lemma:xprecsx}
  Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$.  Then for all $x \in {\mathbb N}$, we have
$$ x \neq {\bf n} \ {\rightarrow}\  x \prec {\sf S} x.$$
\end{corollary}

\noindent{\em Proof}.  Suppose $x \neq {\bf n}$ and $x \in {\mathbb N}$.  We have
\begin{eqnarray*}
x \preceq {\sf S} x && \mbox{\qquad by Lemma~\ref{lemma:xpreceqsx}}\\
x \neq {\sf S} x && \mbox{\qquad by Lemma~\ref{lemma:snneqn}}\\
x \prec {\sf S} x && \mbox{\qquad by definition of $\prec$}
\end{eqnarray*}
That completes the proof of the lemma.

\begin{lemma} \label{lemma:leftpreceqsuccessor}
Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  Then for $x,y \in {\mathbb N}$ we have
$$   x \prec   y \ {\rightarrow}\   {\sf S} x \preceq y.$$
\end{lemma}

\noindent{\em Proof}.  Suppose $x \prec y$.  By definition of $\prec$,
$x \preceq y$ and $x \neq y$.  We must prove ${\sf S} x \preceq y$.
By Lemma~\ref{lemma:preceq}, it suffices to show that for every separable
subset $X$ of ${\mathbb N}$ that contains ${\sf S} x$ and is closed under successor except ${\bf n}$,
we have $y \in X$.   Let $X$ be such a set, and define
\begin{eqnarray}
 Z := X \cup \{ x\} \label{eq:E2991}
\end{eqnarray}
Since ${\mathbb N}$ is finite, it has decidable equality; hence $Z$ is a separable subset of ${\mathbb N}$.
Since ${\sf S} x \in X$, we have ${\sf S} x \in Z$, so $Z$ is closed under successor except ${\bf n}$.
We have $x \in Z$ by (\ref{eq:E2991}).
Since $x \preceq y$, we have $y \in Z$ by Lemma~\ref{lemma:preceq}.
Since $x \neq y$, we have $y \in X$ by (\ref{eq:E2991}).
That completes the proof of the lemma.

\begin{lemma}\label{lemma:precmax}
Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  Then for all $x \in {\mathbb N}$ we have $x \preceq {\bf n}$.
\end{lemma}

\noindent{\em Proof}.
Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  We begin by proving
\begin{eqnarray}
{\sf S} {\bf k} \preceq {\bf n} \label{eq:E3033}
\end{eqnarray}
To prove that, let $X$ be a separable subset of ${\mathbb N}$ containing
${\sf S} {\bf k}$ and closed under successor except ${\bf n}$. We must prove ${\bf n} \in X$.
\smallskip

 Define $Z:= X \cup \{{\bf n}\}$.
I say that $Z$ is closed under successor.
To prove that: if $x \in Z$ then $x \in X \ \lor \ x = {\bf n}$.
If $x \in X$ and $x \neq {\bf n}$, then ${\sf S} x \in X$, since $X$ is closed under successor except ${\bf n}$.
But if $x = {\bf n}$ then ${\sf S} x = {\sf S} {\bf n} = {\sf S} k$, which is in $X$ by hypothesis, and hence in $Z$.
  Since ${\mathbb N}$
is finite, it has decidable equality, so these cases are exhaustive.  Hence $Z$ is
closed under successor, as claimed.
\smallskip

Now we can prove ${\bf n} \in X$:
\begin{eqnarray*}
{\mathcal L}(n) \subseteq Z && \mbox{\qquad by the definition of ${\mathcal L}({\bf n})$}\\
{\bf n} \in {\mathcal L}({\bf n})     && \mbox{\qquad by Lemma~\ref{lemma:L1}}\\
{\bf 0} \in {\sf STEM}  &&\mbox{\qquad by Lemma~\ref{lemma:S1}}\\
{\mathcal L}(n) \cap {\sf STEM} = {\Lambda} && \mbox{\qquad by Lemma~\ref{lemma:LcapS}}\\
{\bf n} \neq {\bf 0} && \mbox{\qquad by the preceding lines}\\
{\bf n} = {\sf S} r   && \mbox{\qquad for some $r \in {\mathcal L}({\bf n})$, by Theorem~\ref{theorem:looponto}}\\
r \in Z   && \mbox{\qquad since ${\mathcal L}({\bf n}) \subseteq Z$}\\
r \neq n  && \mbox{\qquad by Lemma~\ref{lemma:snneqn}}\\
r \in X   && \mbox{\qquad since $Z = X \cup \{n\}$}\\
{\sf S} r \in X &&\mbox{\qquad since $X$ is closed under successor except ${\bf n}$, and $r \neq {\bf n}$}\\
{\bf n} \in X   && \mbox{\qquad since ${\sf S} r = {\bf n}$}
\end{eqnarray*}
That completes the proof that ${\bf n} \in X$.  That
completes the proof of (\ref{eq:E3033})
\smallskip

We must prove
$$ \forall x \in {\mathbb N}\,( x\preceq {\bf n}).$$
We will prove this by induction on $x$.
The formula to be proved is stratified, giving
$x,{\bf k},{\bf n}$ all index 0, since $\preceq$ is a definable relation, appearing
here as a parameter.
Therefore we may proceed by induction on $x$.
\smallskip

Base case. ${\bf 0} \preceq {\bf n}$ by Lemma~\ref{lemma:preceqzero}.
\smallskip

Induction step.  The induction hypothesis is $x \preceq {\bf n}$.
We have to prove ${\sf S} x \preceq n$.  Since ${\mathbb N}$ is finite,
it has decidable equality, so we have $x = {\bf n} \ \lor \ x \neq {\bf n}$.
If $x = {\bf n}$, we are done by (\ref{eq:E3033}), since ${\sf S} {\bf n} = {\sf S} {\bf k}$.
Therefore we may assume $x \neq {\bf n}$.
Then
\begin{eqnarray*}
x \prec {\bf n} && \mbox{\qquad by definition of $\prec$}\\
{\sf S} x \preceq {\bf n} && \mbox{\qquad by Lemma~\ref{lemma:leftpreceqsuccessor} with ${\bf n}$ for $y$}
\end{eqnarray*}
That completes the induction step.  That completes the proof of the lemma.

\begin{lemma}[Finite induction] \label{lemma:finiteinduction}
Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.
Suppose ${\bf 0} \in X$ and $\forall u\,(u \in X \ {\rightarrow}\  u \neq {\bf n} \ {\rightarrow}\  {\sf S} u \in X)$.
Then ${\mathbb N} \subseteq X$.
\end{lemma}

\noindent{\em Proof}. We will prove by  induction on $z$ that
\begin{eqnarray}
 \forall x \in {\mathbb N}\,(x \preceq z \ {\rightarrow}\  x \in X). \label{eq:E3150}
\end{eqnarray}
The formula is stratified, giving $x$ and $z$ index 0, since $\preceq$ is a
definable relation, so we may proceed by induction.
\smallskip

Base case, $z = {\bf 0}$. We must show $x \preceq {\bf 0} \ {\rightarrow}\  x \in X$.
Suppose $x \preceq {\bf 0}$.  By Lemma~\ref{lemma:preceqzero}, $x = {\bf 0}$.
Then $x \in X$ by hypothesis.  That completes the base case.
\smallskip

Induction step.  Suppose
\begin{eqnarray}
\forall x \in {\mathbb N}\,(x \preceq z \ {\rightarrow}\  x \in X) \label{eq:E2940}
\end{eqnarray}
  and
suppose $x \preceq {\sf S} z$.  We must prove $x \in X$.
\begin{eqnarray*}
{\mathbb N} \in {\sf DECIDABLE} && \mbox{\qquad by Lemma~\sref{lemma:finitedecidable}}\\
z = {\bf n} \ \lor \ z \neq {\bf n} && \mbox{\qquad  since ${\mathbb N} \in {\sf DECIDABLE}$}
\end{eqnarray*}
We argue by cases.
\smallskip

Case~1, $z = {\bf n}$. Then
\begin{eqnarray*}
{\sf S} z = {\sf S} {\bf n} = {\sf S} {\bf k} &&\mbox{\qquad since $z = {\bf n}$ and ${\sf S} {\bf n} = {\sf S} {\bf k}$}\\
x \preceq {\bf n} \ {\rightarrow}\  x \in X && \mbox{\qquad by (\ref{eq:E2940})}\\
x \preceq {\bf n}  && \mbox{\qquad by Lemma~\ref{lemma:precmax}} \\
x \in X && \mbox{\qquad by the preceding two lines}
\end{eqnarray*}
That completes Case~1.
\smallskip

Case~2.  $z \neq {\bf n}$.
\begin{eqnarray*}
x \preceq {\sf S} z  && \mbox{\qquad by hypothesis}\\
x \preceq z \ \lor \ x = {\sf S} z && \mbox{\qquad by Lemma~\ref{lemma:preceqsuccessor}, since $z \neq {\bf n}$} \\
\end{eqnarray*}
 If $x \preceq z$, we are done by (\ref{eq:E2940}),
so we can assume $x = {\sf S} z$.  Since $X$ is closed under successor except ${\bf n}$,
and $z \neq {\bf n}$,  we have $x \in X$.  That completes the induction step.
That completes the proof of (\ref{eq:E3150}).
\smallskip

Now under the assumptions of the lemma, we have to prove ${\mathbb N} \subseteq X$.  It suffices
to prove that for all $z$, $z \in {\mathbb N} \ {\rightarrow}\  z \in X$.  Assume $z \in {\mathbb N}$.  Substituting
$z$ for the bound variable $x$ in (\ref{eq:E3150}),
we have $z \preceq z \ {\rightarrow}\  z \in X$.  By Lemma~\ref{lemma:preceqreflexive}, we have
$z \preceq z$.  Hence $z \in X$ as desired.  That completes the proof of the lemma.

\begin{theorem}\label{theorem:prectrichotomy1}
 Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  Then for $x,y \in {\mathbb N}$ we have
$$  x \prec y \ \lor\ x = y \ \lor \ y \prec x.$$
\end{theorem}

\noindent{\em Proof}.  We will prove by finite induction on $x$ that
\begin{eqnarray}
 \forall y\in {\mathbb N}\, (  x \preceq y \ \lor\  \ y \preceq x)
 \label{eq:E3108}
\end{eqnarray}
Since ${\mathbb N}$ is finite, it has decidable equality, so $x \preceq y \iff x \prec y \ \lor \ x = y$.
Therefore (\ref{eq:E3108}) is equivalent to the lemma as stated.
\smallskip

The formula is stratified, giving $x$ and $y$ both index 0, since $\preceq$ is
a definable relation.  Hence induction is legal.
\smallskip

Base case.  By Lemma~\ref{lemma:preceqzero}, we have ${\bf 0} \preceq y$.
 That completes the base case.
\smallskip

Induction step.  The induction hypothesis is (\ref{eq:E3108}).  Let $y$ be given. We must prove
\begin{eqnarray}
{\sf S} x \preceq y  \ \lor\  y \preceq {\sf S} x     \label{eq:E3124}
\end{eqnarray}
Since we are using finite induction on $x$ (Lemma~\ref{lemma:finiteinduction}), we may assume
\begin{eqnarray}
x \neq {\bf n} \label{eq:E3181}
\end{eqnarray}
 By (\ref{eq:E3108})
we have $x \preceq y   \ \lor \ y \preceq x$.  We argue by cases accordingly.
\smallskip

Case~1: $x \preceq y$.  By decidable equality and the definition of $\prec$,
we have $x \prec y$ or $x = y$.  If $x \prec y$, then ${\sf S} x \preceq y$,
 by Lemma~\ref{lemma:leftpreceqsuccessor}.  If $x = y$ then $y \preceq {\sf S} x$,
 by Lemma~\ref{lemma:preceqsuccessor}. That completes Case~1.
\smallskip

Case~2:  $y \preceq x$.  Then $y \preceq {\sf S} x$, by Lemma~\ref{lemma:preceqsuccessor} and (\ref{eq:E3181}).
That completes Case~2.   That completes the proof of the lemma.

\begin{lemma} \label{lemma:successorprec}
   Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  Then for $x,y \in {\mathbb N}$ we have
$$ y \neq {\bf n} \ {\rightarrow}\  {\sf S} y \prec x \ {\rightarrow}\  y \preceq x.$$
\end{lemma}

\noindent{\em Proof}.  By finite induction on $x$.
\smallskip

Base case.  We must prove ${\sf S} y \prec {\bf 0} \ {\rightarrow}\  y \preceq {\bf 0}$.
But ${\sf S} y \prec {\bf 0}$ can never hold, by Lemma~\ref{lemma:precmin2}.
That completes the base case.
\smallskip

Induction step.  Suppose ${\sf S} y \prec {\sf S} x$ and $x \neq {\bf n}$.  We have to
prove $y \preceq {\sf S} x$.  We have
\begin{eqnarray*}
{\sf S} y \preceq {\sf S} x  \ \land \ {\sf S} y \neq {\sf S} x && \mbox{\qquad by definition of $\prec$}\\
y \neq {\bf n}      && \mbox{\qquad by hypothesis}\\
{\sf S} y \preceq x  && \mbox{\qquad by Lemma~\ref{lemma:preceqsuccessor}, since $y \neq {\bf n}$}\\
y \preceq {\sf S} y  && \mbox{\qquad by Lemma~\ref{lemma:preceqsuccessor}}\\
y \preceq x    && \mbox{\qquad by Lemma~\ref{lemma:preceqtrans} and the preceding two lines}\\
y \preceq {\sf S} x  && \mbox{\qquad by Lemma~\ref{lemma:preceqsuccessor}}
\end{eqnarray*}
That completes the induction step.  That completes the proof of the lemma.

\begin{lemma} \label{lemma:sxnotpreceqx}
   Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  Then for $x \in {\mathbb N}$ we have
$$x \neq {\bf n} \ {\rightarrow}\  \neg\,({\sf S} x \preceq x).$$
\end{lemma}

\noindent{\em Proof}.  Suppose $x \in {\mathbb N}$ and $x \neq {\bf n}$ and
\begin{eqnarray}
{\sf S} x \preceq x. \label{eq:E3369}
\end{eqnarray}
We must derive a contradiction. Define
$$ Z:= \{ u \in {\mathbb N}: \neg\, ({\sf S} x \preceq u \ \land \ u \preceq x)\}.$$
The formula is stratified, giving $x$ and $u$ index 0, so the definition
can be given in INF.
\smallskip

I say that ${\mathbb N} \subseteq Z$. By the definition of $\subseteq$, that is equivalent to
\begin{eqnarray}
\forall u\in {\mathbb N}\,(u \in Z) \label{eq:E3398}
\end{eqnarray}
We will prove that by finite induction.
\smallskip

Base case, ${\bf 0} \in Z$.  We have to prove $\neg\,( {\sf S} x \preceq {\bf 0} \ \land \ {\bf 0} \preceq x).$  It suffices to prove $\neg\,({\sf S} x \preceq {\bf 0}).$  Suppose ${\sf S} x \preceq {\bf 0}$.
Then by Lemma~\ref{lemma:preceqzero}, ${\sf S} x = {\bf 0}$.  But that contradicts
Theorem~\ref{theorem:successoromitszero}.  That completes the base case.
\smallskip

Induction step.  We have to prove that
$$  u \in Z \ {\rightarrow}\  u \neq {\bf n} \ {\rightarrow}\  {\sf S} u \in Z.$$
Using the definition of $Z$, that becomes
$$ \neg\, ({\sf S} x \preceq u \ \land \ u \preceq x)  \ {\rightarrow}\  u \neq {\bf n} \ {\rightarrow}\  \neg\,({\sf S} x \preceq {\sf S} u \ \land \ {\sf S} u \preceq x).$$
It suffices to prove, assuming $u \neq {\bf n}$, that
$$ {\sf S} x \preceq {\sf S} u \ \land \ {\sf S} u \preceq x  \ {\rightarrow}\  {\sf S} x \preceq u \ \land \ u \preceq x.$$
Suppose
\begin{eqnarray}
 && u \neq {\bf n}   \label{eq:E3373} \\
 && {\sf S} x \preceq {\sf S} u \ \land \ {\sf S} u \preceq x. \label{eq:E3408}
 \end{eqnarray}
We must prove
\begin{eqnarray}
{\sf S} x \preceq u \ \land \ u \preceq x \label{eq:E3412}
\end{eqnarray}
We have
\begin{eqnarray*}
{\sf S} x \preceq u \ \lor \ {\sf S} x = {\sf S} u  && \mbox{\qquad by Lemma~\ref{lemma:preceqsuccessor} and (\ref{eq:E3408}) and (\ref{eq:E3373})}
\end{eqnarray*}
We argue by cases accordingly to prove (\ref{eq:E3412}).
\smallskip

Case~1, ${\sf S} x \preceq  u$.  That is already the first half of (\ref{eq:E3412}); it
remains to prove $u \preceq x$.  We have
\begin{eqnarray*}
{\sf S} u \preceq x && \mbox{\qquad by (\ref{eq:E3408})}\\
u \preceq u && \mbox{\qquad by Lemma~\ref{lemma:preceqreflexive}}\\
u \preceq {\sf S} u && \mbox{\qquad by Lemma~\ref{lemma:preceqsuccessor}, since $u \neq {\bf n}$}\\
u \preceq x && \mbox{\qquad by Lemma~\ref{lemma:preceqtrans}}
\end{eqnarray*}
That completes Case~1.
\smallskip

Case~2, $ {\sf S} x = {\sf S} u$.   Since ${\mathbb N}$ has decidable equality, we have
$x = u \ \lor \ x \neq u$.  We argue by cases.
\smallskip

Case 2a,  $x = u$. Then (\ref{eq:E3412}) becomes
${\sf S} x \preceq x \ \land \ x \preceq x$, which follows from (\ref{eq:E3369})
and Lemma~\ref{lemma:preceqreflexive}.
\smallskip

Case 2b. $x \neq u$.
  Then ${\sf S} x = {\sf S} u$
is a double successor.   Then
\begin{eqnarray*}
\{x,u\} = \{{\bf k},{\bf n}\} &&\mbox{\qquad by Corollary~\ref{lemma:rho2}}\\
x = {\bf n} \ \land \ u = {\bf k}  && \mbox{\qquad since $u \neq {\bf n}$ by (\ref{eq:E3373})}\\
 x \neq {\bf n} && \mbox{\qquad by hypothesis}
 \end{eqnarray*}
The last two lines are contradictory.
That contradiction completes the proof of (\ref{eq:E3412}).
That completes the proof that ${\mathbb N} \subseteq Z$.
\smallskip

Therefore $x \in Z$.  But by hypothesis we have ${\sf S} x \preceq x$,  and by Lemma~\ref{lemma:preceqreflexive}
we have $x \preceq x$. Hence $x \not\in Z$.  That contradiction completes the proof
of the lemma.

\begin{lemma}\label{lemma:predecessornotn}
   Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.   Let $x \in {\mathbb N}$ with $x \neq {\bf 0}$.  Then there exists an $r \in {\mathbb N}$
with ${\sf S} r = x$ and $r \neq {\bf n}$.
\end{lemma}

\noindent{\em Proof}.  Let $x \in {\mathbb N}$ be nonzero. By Lemma~\ref{lemma:predecessor},
there exists $u \in {\mathbb N}$ with ${\sf S} u = x$.  Since ${\mathbb N}$ is finite, it has decidable equality,
so $u = {\bf n} \ \lor \ u \neq {\bf n}$.
 If $u \neq {\bf n}$, we may take $r = u$, and then we are done.
If $u  = {\bf n}$, then
 $x = {\sf S} {\bf n} = {\sf S} {\bf k}$.  Since ${\bf k} \neq {\bf n}$ we may take $r = {\bf k}$.  That completes the proof of the lemma.

\begin{theorem} \label{theorem:prectrichotomy3}
  Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  Then for $x,y \in {\mathbb N}$ we have
$$  x \preceq y  \ {\rightarrow}\   y \preceq x \ {\rightarrow}\  x = y.$$
\end{theorem}

\noindent{\em Proof}. Since ${\mathbb N}$ is finite, it has decidable equality.
Therefore the lemma
as stated is equivalent to
$$ x \neq y \ {\rightarrow}\  \neg (x \preceq y \ \land \ y \preceq x).$$
That formula is stratified, since $\preceq$ and $\prec$ are definable
relations.  We will prove it by finite induction on $y$.
\smallskip

Base case, $x \neq {\bf 0} \ {\rightarrow}\  \neg\,(x \preceq {\bf 0} \ \land {\bf 0} \preceq x).$
is immediate from Lemma~\ref{lemma:preceqzero}.
\smallskip

Induction step.  Suppose $y \neq {\bf n}$ and $x \neq {\sf S} y$.  We must prove
\begin{eqnarray}
 \neg\, (x \preceq {\sf S} y  \ \land \ {\sf S} y \preceq x). \label{eq:E3297}
\end{eqnarray}
To prove that, we must derive a contradiction from
\begin{eqnarray}
x \preceq {\sf S} y  \label{eq:E3273} \\
{\sf S} y \preceq x  \label{eq:E3274}
\end{eqnarray}
We have
\begin{eqnarray}
x \preceq y  && \mbox{\qquad by Lemma~\ref{lemma:preceqsuccessor} and (\ref{eq:E3273}) and $y \neq {\bf n}$ and $x \neq {\sf S} y$}
\label{eq:E3278}\\
{\sf S} y \prec x  && \mbox{\qquad by (\ref{eq:E3274}) and $x \neq {\sf S} y$ and the definition of $\prec$} \nonumber\\
x \neq y \label{eq:E3311} &&\mbox{\qquad by Lemma~\ref{lemma:sxnotpreceqx} and (\ref{eq:E3274})  } \nonumber\\
y \preceq x &&\mbox{\qquad by Lemma~\ref{lemma:successorprec}} \label{eq:E3309} \\
\neg\,(x \preceq y \ \land \ y \preceq x) && \mbox{\qquad by (\ref{eq:E3311}) and the induction hypothesis} \nonumber
\end{eqnarray}
But that is contradicted by (\ref{eq:E3278}) together with (\ref{eq:E3309}).
That completes the induction step.  That completes the proof of the lemma.

\begin{theorem} \label{theorem:prectrichotomy2}
  Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  Then for $x,y \in {\mathbb N}$ we have
$$ \neg (x \prec y \ \land\  y \prec x).$$
\end{theorem}

\noindent{\em Proof}.  Suppose $x \prec y$ and $y \prec x$.
Then we have
\begin{eqnarray*}
x \preceq y  && \mbox{\qquad by definition of $\prec$}\\
y \preceq x  && \mbox{\qquad by definition of $\prec$}\\
x = y  && \mbox{ \qquad by Theorem~\ref{theorem:prectrichotomy3}}\\
x \prec x && \mbox{\qquad since $x \prec y$ and $x = y$}\\
x \neq x  && \mbox{\qquad by definition of $\prec$}
\end{eqnarray*}
That contradiction completes the proof of the theorem.

\begin{lemma}\label{lemma:precmax2}
 Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  Let $x \in {\mathbb N}$.
Then $\neg\,({\bf n} \prec x).$
\end{lemma}

\noindent{\em Proof}. Suppose $x \in {\mathbb N}$.  Then
\begin{eqnarray*}
x \preceq n && \mbox{\qquad by Lemma~\ref{lemma:precmax}}\\
 {\bf n} \prec x && \mbox{\qquad assumption, for proof by contradiction}\\
{\bf n} \preceq x \ \land \ n \neq x && \mbox{\qquad by definition of $\prec$}\\
x = {\bf n}   && \mbox{\qquad by Theorem~\ref{theorem:prectrichotomy2}}
\end{eqnarray*}
That contradiction completes the proof of the lemma.

\begin{lemma}\label{lemma:leastelement}
 Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.
Let $X$ be a finite nonempty subset of ${\mathbb N}$.  Then $X$ has a $\preceq$-least
element.  More formally,
$$\forall X \in {\sf FINITE}( X \subseteq {\mathbb N} \land X \neq {\Lambda} \ {\rightarrow}\
\exists p \in X\, \forall q \in X\,(p \preceq q)).$$
\end{lemma}

\noindent{\em Proof}.  The formula to be proved is stratified, giving
$p$ and $q$ both index 0 and $X$ index 1.   Therefore we can proceed
by induction on finite sets $X$.  Because of the hypothesis that $X \neq {\Lambda}$,
the base case is immediate.  For the induction step, suppose
$X = Y \cup \{b\}$ with $b \not\in Y$ and $Y$ a finite set, and
$X \subseteq {\mathbb N}$.  Then also $Y \subseteq {\mathbb N}$.  By Lemma~\sref{lemma:empty_or_inhabited},
$Y$ is empty or inhabited. If $Y = {\Lambda}$, then $b$ is the only element of
$X$, and hence the least element of $X$.  So we may assume $Y$ is inhabited.
Then, by the induction hypothesis,
$Y$ has a $\preceq$-least element $r$.  By Theorem~\ref{theorem:prectrichotomy1},
we have $r \preceq b  \ \lor \ b \preceq r$.  We argue by cases.
\smallskip

Case~1:  $r \preceq b$.  Then $r$ is the desired $\preceq$-least member of $X$.
\smallskip

Case~2: $b \preceq r$.  Then $b$ is the desired $\preceq$-least member of $X$,
by Lemma~\ref{lemma:transitivity}.
That completes the proof of the lemma.

\begin{lemma} [Transitivity of $\prec$] \label{lemma:prectrans}
Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  Then for $x,y,z \in {\mathbb N}$ we have
$$ x \prec  y \ {\rightarrow}\  y \prec  z \ {\rightarrow}\  x \prec  z.$$
\end{lemma}

\noindent{\em Proof}.  Suppose $x \prec y$ and $y \prec z$.  Then
\begin{eqnarray*}
x \preceq y  && \mbox{\qquad by the definition of $\prec$}\\
y \preceq z  && \mbox{\qquad by the definition of $\prec$}\\
x \preceq z  && \mbox{\qquad by Lemma~\ref{lemma:preceqtrans}}\\
x = z \ {\rightarrow}\  z \preceq y  && \mbox{\qquad since $x \preceq y$}\\
x = z \ {\rightarrow}\  y = z  && \mbox{\qquad by Theorem~\ref{theorem:prectrichotomy3}}\\
y \neq z  && \mbox{\qquad by the definition of $y \prec z$}\\
x \neq z  && \mbox{\qquad by the preceding two lines}\\
x \prec z && \mbox{\qquad by the definition of $\prec$}
\end{eqnarray*}
That completes the proof of the lemma.

\begin{lemma} \label{lemma:precpred}
 Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.   Let $x,y \in {\mathbb N}$ with $x \neq {\bf n}$.
Then ${\sf S} x \preceq {\sf S} y \ {\rightarrow}\  x \preceq y$.
\end{lemma}

\noindent{\em Proof}. Assume all the hypotheses of the lemma, as well
as ${\sf S} x \preceq {\sf S} y$.  We must prove $x \preceq y$.
Since ${\mathbb N}$ is finite, it has decidable equality.
Therefore $y = {\bf n} \ \lor \ y \neq {\bf n}$.  If $y = n$ then
$x \preceq y$ by Lemma~\ref{lemma:precmax}, and we are done.  Therefore
we may assume $y \neq {\bf n}$.
\smallskip

We have
\begin{eqnarray*}
x \preceq {\sf S} x  && \mbox{\qquad by Lemma~\ref{lemma:xpreceqsx}}\\
x \neq {\sf S} x   && \mbox{\qquad by Lemma~\ref{lemma:snneqn}}\\
{\sf S} x \preceq {\sf S} y && \mbox{\qquad by hypothesis}\\
x \preceq {\sf S} y && \mbox{\qquad by Lemma~\ref{lemma:preceqtrans}}\\
x\preceq {\sf S} y \iff x \preceq y \ \lor x = {\sf S} y && \mbox{\qquad by Lemma~\ref{lemma:preceqsuccessor}, since $y \neq {\bf n}$}\\
 x \preceq y \ \lor x = {\sf S} y  && \mbox{\qquad by the preceding two lines}
\end{eqnarray*}
If $x \preceq y$ we are finished; so we may assume $x = {\sf S} y$.  Then
${\sf S} x \preceq {\sf S} y$ becomes ${\sf S} x \preceq x$.  Then
\begin{eqnarray*}
x = {\sf S} x && \mbox{\qquad by Theorem~\ref{theorem:prectrichotomy3}, since $x \preceq {\sf S} x \preceq x$}\\
x \neq {\sf S} x && \mbox{\qquad by Lemma~\ref{lemma:snneqn}}
\end{eqnarray*}
That contradiction completes the proof of the lemma.

\section{Multiplication of Church numbers}

In this section we define multiplication $x {\,\otimes\,} y$  of Church numbers in
such a way that
 it satisfies the ``defining'' laws $x {\,\otimes\,} {\bf 0} = {\bf 0}$
 and $x {\,\otimes\,} {\sf S} y = x {\,\otimes\,} y \oplus  x$.  This requires knowing that either
 successor is one-to-on on ${\mathbb N}$,  or that there is a double successor
 ${\sf S} {\bf n} = {\sf S} {\bf k}$ with ${\bf k} \neq {\bf n}$.  Then the further laws of
 multiplication can be developed from those two, plus the decidability
 of equality on ${\mathbb N}$.  Hence, all the results of this section will be
 valid when there is a double successor, and we use them later to show
 that ${\mathbb N}$ cannot be finite.  But then, we still need multiplication to
 interpret HA, so we need these results also in the case when successor is
 one-to-one.

\begin{lemma} \label{lemma:ChurchMultiplication}
Multiplication $x {\,\otimes\,} y$ on ${\mathbb N} \times {\mathbb N}$ can be defined (as a function
of two variables) in INF and
satisfies the following laws for all $x,y \in {\mathbb N}$:
\smallskip

(i) $x {\,\otimes\,} {\bf 0} = {\bf 0}$
\smallskip

(ii) $x {\,\otimes\,}  {\sf S} y = x {\,\otimes\,}  y \oplus  x$.
\end{lemma}

\noindent{\em Remark}.  The lemma does not assume that ${\mathbb N}$ is finite
or that there is a double successor, or that there is no double successor.
To prove it we have to give an ``agnostic'' definition of multiplication,
that works without any assumption of that sort.
\smallskip

\noindent{\em Proof}.
 We define multiplication as the intersection of
all sets
$Z$ of ordered triples $\langle x,y,z \rangle$ satisfying these
conditions:
\begin{eqnarray*}
&& \forall y \in {\mathbb N}\,(\langle {\bf 0},y,{\bf 0} \rangle \in Z) \\
&& \forall y \in {\mathbb N}\,(\langle x,y,z \rangle \in Z \land \neg \exists u\,(u \in {\mathbb N} \ \land \ u < y \ \land \ {\sf S} y = {\sf S} u) \ {\rightarrow}\
                             \langle x, {\sf S} y, z\oplus x \rangle \in Z)
\end{eqnarray*}
These formulas are stratified, giving $x,y,z$ index 0 and $Z$
index 5,  so the definition is legal in INF, and defines a
relation, which we write $x {\,\otimes\,}  y = z$.  It remains to prove
that this relation is a function.
 We will prove by induction on $y$ that for each
$x$ there exists a unique $z$ such that $x {\,\otimes\,}  y = z$.
\smallskip

Base case: Existence: $x{\,\otimes\,}  {\bf 0} = {\bf 0}$ by the first condition.
Uniqueness: $x {\,\otimes\,}  {\bf 0} = z$ is only possibly by the first condition,
by Theorem~\ref{theorem:successoromitszero}.  That completes the base case.
\smallskip

Induction step: Existence: By the induction hypothesis,
there exists $z$ such that $x {\,\otimes\,}  y = z$.  Then
by the second condition, $x {\,\otimes\,}  {\sf S} y = z \oplus  x$.
\smallskip

Uniqueness.  Suppose $x {\,\otimes\,}  {\sf S} y = z$ and $x {\,\otimes\,}  {\sf S} y = w$.
Then by the second condition, $z = x{\,\otimes\,}  u \oplus  x$ and
$w = x {\,\otimes\,}  v \oplus  x$, where ${\sf S} u = {\sf S} v = {\sf S} y$.  Then
$\neg\, (u < v)$ and $\neg\,(v < u)$, by the second condition.
Then by Lemma~\ref{lemma:trichotomy1} we have $u=v$.    Hence
$z =  x {\,\otimes\,}  v \oplus  x = x {\,\otimes\,}  u \oplus  x =w$ as desired.
That completes the induction step.
That completes the proof of the lemma.

\begin{lemma}\label{lemma:ChurchMultiplicationMaps}
$\forall x,y \in {\mathbb N}\,(x {\,\otimes\,} y \in {\mathbb N}).$
\end{lemma}

\noindent{\em Proof}.  The formula is stratified, so we can prove it
by induction on $y$.
\smallskip

Base case.  $x {\,\otimes\,} {\bf 0} = {\bf 0}$ by Lemma~\ref{lemma:ChurchMultiplication}.
${\bf 0} \in {\mathbb N}$ by Lemma~\ref{lemma:zeroN}.  That completes the base case.
\smallskip

Induction step.  Suppose
\begin{eqnarray}
\forall x\,(x {\,\otimes\,} y \in {\mathbb N}) \label{eq:E3688}
\end{eqnarray}  We have to prove
$$
{\sf S} y \in {\mathbb N} \ {\rightarrow}\ \forall x\in {\mathbb N}\,( x {\,\otimes\,} {\sf S} y \in {\mathbb N})
$$
  Suppose $y,x \in {\mathbb N}$.  We have
\begin{eqnarray*}
x {\,\otimes\,} {\sf S} y = x {\,\otimes\,} y \oplus  x &&\mbox{\qquad By Lemma~\ref{lemma:ChurchMultiplication}}\\
x {\,\otimes\,} y \in {\mathbb N} && \mbox{\qquad by (\ref{eq:E3688})}\\
{\sf S} y \in  && \mbox{\qquad by Lemma~\ref{lemma:successorN}}\\
x {\,\otimes\,} y \oplus  x \in {\mathbb N} && \mbox{\qquad by Lemma~\ref{lemma:ChurchAdditionMaps}}\\
x {\,\otimes\,} {\sf S} y \in {\mathbb N} && \mbox{\qquad by the preceding lines}
\end{eqnarray*}
That completes the induction step.  That completes the proof of the lemma.

\begin{lemma} \label{lemma:zerotimes}
For $y \in {\mathbb N}$ we have
\begin{eqnarray*}
{\bf 0} {\,\otimes\,} y = {\bf 0}
\end{eqnarray*}
\end{lemma}

\noindent{\em Proof}.  By Lemma~\ref{lemma:ChurchMultiplication},
multiplication is well-defined and satisfies the laws in
 Lemma~\ref{lemma:ChurchMultiplication}.  The formula is stratified, so we
may use  induction on $y$.
\smallskip

Base case, ${\bf 0} {\,\otimes\,} {\bf 0} = {\bf 0}$ by Lemma~\ref{lemma:ChurchMultiplication}.
\smallskip

Induction step,
\begin{eqnarray*}
{\bf 0} {\,\otimes\,} {\sf S} y = {\bf 0} {\,\otimes\,} y \oplus  {\bf 0}  && \mbox{\qquad by Lemma~\ref{lemma:ChurchMultiplication}}\\
= {\bf 0} {\,\otimes\,} y  && \mbox{\qquad  since $z \oplus  {\bf 0} = z$}\\
= {\bf 0}  && \mbox{\qquad by the induction hypthesis}
\end{eqnarray*}
That completes the induction step.  That completes the proof of the lemma.

\begin{lemma} \label{lemma:successortimes}
For $x,y \in {\mathbb N}$ we have
\begin{eqnarray*}
{\sf S} x {\,\otimes\,}  y = x {\,\otimes\,}  y \oplus  y.
\end{eqnarray*}
\end{lemma}

\noindent{\em Proof}.  By Lemma~\ref{lemma:ChurchMultiplication},
multiplication is well-defined and satisfies the laws in
 Lemma~\ref{lemma:ChurchMultiplication}.  The formula is stratified, so we
may use induction on $y$.
\smallskip

Base case:
\begin{eqnarray*}
{\sf S} x {\,\otimes\,}  {\bf 0} = {\bf 0} && \mbox{\qquad by Lemma~\ref{lemma:ChurchMultiplication}}\\
{\bf 0} = x {\,\otimes\,} {\bf 0} &&\mbox{\qquad by Lemma~\ref{lemma:ChurchMultiplication}}\\
{\bf 0} = x {\,\otimes\,} {\bf 0} \oplus  {\bf 0} &&\mbox{\qquad by Lemma~\ref{lemma:ChurchZero_equation}}
\end{eqnarray*}
  That completes the base case.
\smallskip

Induction step:  Assume ${\sf S} x {\,\otimes\,}  y = x {\,\otimes\,}  y \oplus  y$.   We must prove
\begin{eqnarray*}
{\sf S} x {\,\otimes\,}  {\sf S} y = x {\,\otimes\,}  {\sf S} y \oplus  {\sf S} y.
\end{eqnarray*}

We have
\begin{eqnarray*}
{\sf S} x {\,\otimes\,}  {\sf S} y &=&{\sf S} x {\,\otimes\,}  y \oplus  {\sf S} x \mbox{\qquad\quad \ \ \  by definition of multiplication}\\
               &=& x {\,\otimes\,}  y \oplus  y \oplus  {\sf S} x \mbox{\qquad\ \ by the induction hypothesis} \\
               &=& x {\,\otimes\,} y \oplus  ( y \oplus  {\sf S} x) \mbox{\qquad by Lemma~\ref{lemma:ChurchAdditionAssociative}}\\
               &=& x {\,\otimes\,}  y \oplus  ({\sf S} y \oplus  x)  \mbox{\qquad by Lemma~\ref{lemma:ChurchSuccessorShift}}\\
               &=& x {\,\otimes\,}  y \oplus  (x \oplus  {\sf S} y)  \mbox{\qquad by Lemma~\ref{lemma:ChurchAdditionCommutative}}\\
               &=& x {\,\otimes\,}  y \oplus   x \oplus  {\sf S} y  \mbox{\qquad\ \  by Lemma~\ref{lemma:ChurchAdditionAssociative}}\\
               &=& x {\,\otimes\,}  {\sf S} y \oplus  {\sf S} y   \mbox{\qquad\quad\ \ \ by Lemma~\ref{lemma:ChurchMultiplication}}
\end{eqnarray*}
That completes the induction step. That completes the proof of the lemma.

\begin{lemma}\label{lemma:Church_leftdistrib}
For $x,y,z \in {\mathbb N}$ we have
\begin{eqnarray*}
x {\,\otimes\,} (y \oplus  z) &=& x {\,\otimes\,}  y \oplus  x {\,\otimes\,}  z
\end{eqnarray*}
\end{lemma}

\noindent{\em Proof}. By induction on $x$.
\smallskip

Base case.
\begin{eqnarray*}
y \oplus  z \in {\mathbb N} && \mbox{\qquad by Lemma~\ref{lemma:ChurchAdditionMaps}}\\
{\bf 0} {\,\otimes\,} (y \oplus  z) = {\bf 0} && \mbox{\qquad by Lemma~\ref{lemma:zerotimes}}\\
{\bf 0} {\,\otimes\,} y = {\bf 0} && \mbox{\qquad by Lemma~\ref{lemma:zerotimes}}\\
{\bf 0} {\,\otimes\,} z = {\bf 0} && \mbox{\qquad by Lemma~\ref{lemma:zerotimes}}\\
{\bf 0} {\,\otimes\,} (y \oplus  z) = {\bf 0} {\,\otimes\,} y \oplus  {\bf 0} {\,\otimes\,} z &&\mbox{\qquad since ${\bf 0}\oplus {\bf 0} = {\bf 0}$}
\end{eqnarray*}
That completes the base case.

Induction step.
\begin{eqnarray*}
y \oplus  z \in {\mathbb N} && \mbox{\qquad by Lemma~\ref{lemma:ChurchAdditionMaps}}\\
x {\,\otimes\,} y \in {\mathbb N} && \mbox{\qquad by Lemma~\ref{lemma:ChurchMultiplicationMaps}}\\
x {\,\otimes\,} z \in {\mathbb N} && \mbox{\qquad by Lemma~\ref{lemma:ChurchMultiplicationMaps}}\\
{\sf S} x {\,\otimes\,} (y\oplus z) = x {\,\otimes\,} (y\oplus z) \oplus  (y\oplus z)  && \mbox{\qquad by Lemma~\ref{lemma:successortimes}}\\
                = x {\,\otimes\,}  y \oplus  x {\,\otimes\,}  z \oplus   y \oplus  z  &&\mbox{\qquad by the induction hypothesis}\\
                 = x {\,\otimes\,}  y \oplus  (x {\,\otimes\,}  z \oplus   y) \oplus  z  &&\mbox{\qquad by Lemma~\ref{lemma:ChurchAdditionAssociative}}\\                  = x {\,\otimes\,}  y \oplus  (y \oplus  x {\,\otimes\,} z)  \oplus  z  &&\mbox{\qquad by Lemma~\ref{lemma:ChurchAdditionCommutative}}\\
               = (x {\,\otimes\,}  y \oplus  y) \oplus  (x {\,\otimes\,}  z \oplus  z) &&\mbox{\qquad by Lemma~\ref{lemma:ChurchAdditionAssociative}}\\
                = {\sf S} x {\,\otimes\,}  y \oplus  {\sf S} x {\,\otimes\,}  z &&\mbox{\qquad by Lemma~\ref{lemma:successortimes}}
\end{eqnarray*}
That completes the proof of the lemma.

\begin{lemma}\label{lemma:Church_rightdistrib}
Suppose there is a double successor ${\sf S} {\bf k} = {\sf S} {\bf n}$ with ${\bf k} \in {\sf STEM}$ and ${\bf k} \neq {\bf n}$ and ${\bf n} \in {\mathbb N}$.
Then for $x,y \in {\mathbb N}$ we have
\begin{eqnarray*}
(x \oplus  y) {\,\otimes\,}  z &=& x {\,\otimes\,}  z \oplus  y {\,\otimes\,}  z
\end{eqnarray*}
\end{lemma}

\noindent{\em Proof}. By induction on $z$.  The base case is immediate.  For the induction step we have
\begin{eqnarray*}
(x \oplus  y) {\,\otimes\,} {\sf S} z  &=& (x\oplus y) {\,\otimes\,} z  \oplus  (x \oplus  y) \mbox{\qquad\quad by Lemma~\ref{lemma:ChurchMultiplication}}\\
                &=& x {\,\otimes\,}  z \oplus  y {\,\otimes\,}  z \oplus   (x\oplus y) \mbox{\qquad by the induction hypothesis} \\
                &=& (x {\,\otimes\,}  z \oplus  x) \oplus  (y {\,\otimes\,}  z \oplus  y) \mbox{\quad by associativity and commutativity of $\oplus $} \\
                &=&  x {\,\otimes\,}  {\sf S} z \oplus  y {\,\otimes\,}  {\sf S} z  \mbox{\qquad\qquad\quad by Lemma~\ref{lemma:ChurchMultiplication}}
\end{eqnarray*}
That completes the proof of the lemma.

\begin{lemma}[Church multiplication associative]\label{lemma:ChurchMultiplicationAssociative}
For $x,y,z \in {\mathbb N}$ we have
\begin{eqnarray*}
   x {\,\otimes\,}  ( y {\,\otimes\,} z) &=& (x {\,\otimes\,} y) {\,\otimes\,}  z
\end{eqnarray*}
\end{lemma}

\noindent{\em Proof}.
By induction on $y$.
\smallskip

Base case:
\begin{eqnarray*}
x {\,\otimes\,}  ({\bf 0} {\,\otimes\,}  z) = x {\,\otimes\,}  {\bf 0} && \mbox{\qquad by Lemma~\ref{lemma:zerotimes}}\\
= {\bf 0}  && \mbox{\qquad by Lemma~\ref{lemma:ChurchMultiplication}}\\
= (x {\,\otimes\,} {\bf 0}) {\,\otimes\,}  {\bf 0} && \mbox{\qquad by Lemma~\ref{lemma:ChurchMultiplication}}
\end{eqnarray*}
That completes the base case.
\smallskip

Induction step:
\begin{eqnarray*}
x {\,\otimes\,}  ({\sf S} y {\,\otimes\,}  z)= x {\,\otimes\,}  (y {\,\otimes\,}  z \oplus  z) && \mbox{\qquad by Lemma~\ref{lemma:successortimes}} \\
                     =x {\,\otimes\,}  (y {\,\otimes\,}  z) \oplus  x {\,\otimes\,}  z  && \mbox{\qquad by Lemma~\ref{lemma:Church_leftdistrib} } \\
                      = (x {\,\otimes\,}  y) {\,\otimes\,}  z) \oplus  x {\,\otimes\,}  z && \mbox{\qquad by the induction hypothesis } \\
                       = (x {\,\otimes\,}  y \oplus  x) {\,\otimes\,}  z&& \mbox{\qquad  by Lemma~\ref{lemma:Church_rightdistrib} }  \\
                      =(x {\,\otimes\,}  {\sf S} y) {\,\otimes\,}  z && \mbox{\qquad by Lemma~\ref{lemma:ChurchMultiplication} }
\end{eqnarray*}

\begin{lemma}[Church multiplication commutative]\label{lemma:ChurchMultiplicationCommutative}
For $x,y \in {\mathbb N}$ we have
\begin{eqnarray*}
   x {\,\otimes\,}  y &=&  y {\,\otimes\,} x
\end{eqnarray*}
\end{lemma}

\noindent{\em Proof}. By induction on $y$, which is legal since
the formula is stratified.
\smallskip

Base case. We have
\begin{eqnarray*}
x {\,\otimes\,} {\bf 0} = {\bf 0} && \mbox{\qquad by Lemma~\ref{lemma:ChurchMultiplication}}\\
= {\bf 0} {\,\otimes\,} x && \mbox{\qquad by Lemma~\ref{lemma:zerotimes}}
\end{eqnarray*}
That completes the base case.
\smallskip

Induction step. We have
\begin{eqnarray*}
{\sf S} x {\,\otimes\,} y = x {\,\otimes\,} y \oplus  y &&\mbox{\qquad by Lemma~\ref{lemma:successortimes}}\\
            = y {\,\otimes\,}  x \oplus  y && \mbox{\qquad by the induction hypothesis}\\
 = y {\,\otimes\,}  {\sf S} x.  && \mbox{\qquad by Lemma~\ref{lemma:ChurchMultiplication}}
\end{eqnarray*}
That completes the induction step.
That completes the proof of the lemma.

\section{Successor and addition on the loop}

In this section we consider the map $f$ on the loop, defined by restricting
Church successor to the loop.  We will show that $f$ is a permutation of the loop;
by the Annihilation Theorem then ${\bf m} f$ is the identity on the loop.  We then
consider solutions $x$ of the equation ${\bf n} + x = {\bf n}$.  There is a solution,
and we show there is a $\preceq$-least solution ${\bf m}$.   If ${\bf m}$ were the
order of $f$, we could reach a contradiction, proving that ${\mathbb N}$ is not
finite.
We assumed the Church counting axiom to reach that conclusion; but in the last
half of this section we prove, without the counting axiom, that the order
of successor at least exists.  That existence is not subsequently used,
but we include it anyway.

\begin{lemma}\label{lemma:loopaddition}
Suppose ${\mathbb N}$ is finite and
 ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  Then every element
of ${\mathcal L}({\bf n})$ has the form ${\bf n} \oplus  x$ for some $x \in {\mathbb N}$.
\end{lemma}

\noindent{\em Proof}.   Let
$$X:= \{ {\bf n} \oplus  x : x \in {\mathbb N}\}.$$
The formula is stratified, so the definition is legal.
Then
\begin{eqnarray*}
{\bf n} \in X && \mbox{\qquad since ${\bf n} = {\bf n} \oplus  {\bf 0}$, by Lemma~\ref{lemma:ChurchZero_equation}}\\
z \in X \ {\rightarrow}\  {\sf S} z \in X && \mbox{ \qquad since ${\sf S}(n\oplus x) = {\bf n} \oplus  {\sf S} x$, by Lemma~\ref{lemma:ChurchAddition_equation}} \\
{\mathcal L}({\bf n}) \subseteq X && \mbox{\qquad by the definition of ${\mathcal L}({\bf n})$}
\end{eqnarray*}
That completes the proof of the lemma.

\begin{lemma}\label{lemma:mexists_helper}
  Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.   Then there exists ${\bf m} \in {\mathbb N}$ such that ${\bf n} = {\bf k} \oplus  {\bf m}$.
\end{lemma}

\noindent{\em Proof}.
\begin{eqnarray*}
 {\bf n} \in {\mathcal L}({\bf n})   && \mbox{\qquad by Lemma~\ref{lemma:L1}}\\
 {\bf n} = {\sf S} p   && \mbox{\qquad for some $p \in {\mathcal L}({\bf n})$ by Theorem~\ref{theorem:looponto}}\\
p = {\bf n}\oplus  u && \mbox{\qquad for some $u \in {\mathbb N}$, by Lemma~\ref{lemma:loopaddition}}\\
{\sf S} p = {\sf S} (n \oplus  u) && \mbox{\qquad by the preceding line}\\
{\bf n} = {\sf S}(n\oplus u)  && \mbox{\qquad since ${\sf S} p = {\bf n}$}\\
{\bf n} = {\bf n} \oplus  {\sf S} u  && \mbox{\qquad by Lemma~\ref{lemma:ChurchAddition_equation}}\\
{\bf n} = {\sf S} {\bf n} \oplus  u  && \mbox{\qquad by Lemma~\ref{lemma:ChurchSuccessorShift}}\\
{\bf n} = {\sf S} {\bf k} \oplus  u  && \mbox{\qquad since ${\sf S} {\bf n} = {\sf S} {\bf k}$}\\
{\bf n} = {\bf k} \oplus  {\sf S} u  && \mbox{\qquad by Lemma~\ref{lemma:ChurchSuccessorShift}}
\end{eqnarray*}
Setting ${\bf m}:= {\sf S} u$ we have ${\bf n} = {\bf k} \oplus  {\bf m}$.  That completes the proof of the lemma.

\begin{lemma}\label{lemma:mexists}
  Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.   Then there exists ${\bf m} \in {\mathbb N}$ such that ${\bf n} = {\bf k} \oplus  {\bf m}$
and ${\bf m}$ is the $\preceq$-least number with that property.  Explicitly,
$$ \forall p \in {\mathbb N}\,({\bf n} = {\bf k} \oplus  p \ {\rightarrow}\  {\bf m} \preceq p ).$$
\end{lemma}

\noindent{\em Proof}. Define
$$X = \{\ x : x \in {\mathbb N} \ \land \ {\bf n} = {\bf k} \oplus  x \ \}.$$
By Lemma~\ref{lemma:mexists_helper},  $X$ is inhabited.
Since ${\mathbb N}$ is finite, it has decidable equality, by Lemma~\sref{lemma:finitedecidable}.
Therefore $X$ is a separable subset of ${\mathbb N}$.   By Lemma~\ref{lemma:separablefinite},
$X \in {\sf FINITE}$.
By Lemma~\ref{lemma:leastelement}, $X$ has a $\preceq$-least element.
That completes the proof of the lemma.

\begin{lemma}\label{lemma:xsmapsloop}
 Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  Then $x{\sf S} : {\mathcal L}({\bf n}) \to {\mathcal L}({\bf n})$.  That is,
$$ \forall x \in {\mathbb N}\, \forall y\,( y \in {\mathcal L}({\bf n}) \ {\rightarrow}\  (x {\sf S} y \in {\mathcal L}({\bf n})).$$
\end{lemma}

\noindent{\em Proof}.  To stratify the formula, we give $y$  index 0 and $x$ index 6.
Then $x{\sf S} y$ gets index 0, so the two occurrences of ${\mathcal L}({\bf n})$ could get the same index,
but since
${\mathcal L}({\bf n})$ is a parameter we do not even have to assign ${\mathcal L}({\bf n})$ an index.
Since the formula is stratified, we may prove it by finite induction on $x$.
\smallskip

Base case, $x = {\bf 0}$.  Suppose $y \in {\mathcal L}({\bf n})$.  Then
\begin{eqnarray*}
y \in {\mathbb N} && \mbox{\qquad by Lemma~\ref{lemma:LN}}\\
 {\bf 0} {\sf S}  y = y &&\mbox{\qquad by Lemma~\ref{lemma:ChurchZero_equation}}\\
  {\bf 0} {\sf S}   y \in {\mathcal L}({\bf n}) && \mbox{\qquad by the preceding two lines}
 \end{eqnarray*}
 That completes the base case.
 \smallskip

 Induction step.  Suppose $x \neq {\bf n}$ and  $x \in {\mathbb N}$ and $y \in {\mathcal L}({\bf n})$.
 We must prove $ ({\sf S} x) {\sf S} y \in {\mathcal L}({\bf n})$.  We have
 \begin{eqnarray*}
 x {\sf S}  y \in {\mathcal L}({\bf n})  && \mbox{\qquad by the induction hypothesis} \\
 ({\sf S} x) {\sf S} y = {\sf S} (x {\sf S} y) && \mbox{\qquad by Theorem~\ref{theorem:successorequation}}\\
 {\sf S} (x {\sf S} y) \in {\mathcal L}({\bf n}) && \mbox{\qquad by Lemma~\ref{lemma:L1}}\\
 ({\sf S} x) {\sf S} y \in {\mathcal L}({\bf n}) && \mbox{\qquad by the preceding two lines}
 \end{eqnarray*}
 That completes the induction step.  That completes the proof of the lemma.

\begin{lemma} [Loop closed under addition]\label{lemma:additionmapsloop}
Suppose ${\mathbb N}$ is finite and
 ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  Then
$$ x \in {\mathcal L}({\bf n}) \ {\rightarrow}\  y \in {\mathbb N} \ {\rightarrow}\  x \oplus y \in {\mathcal L}({\bf n}).$$
\end{lemma}

\noindent{\em Proof}.  The displayed formula is stratified, giving $x$ and ${\bf n}$ index
0, since $L({\bf n})$ and ${\mathbb N}$ are parameters.  So we may prove it by  induction
on $y$.
\smallskip

Base case, $y = {\bf 0}$. Then
\begin{eqnarray*}
x \in {\mathbb N} && \mbox{\qquad by Lemma~\ref{lemma:LN}}\\
x \oplus {\bf 0}  = x && \mbox{\qquad by Lemma~\ref{lemma:ChurchZero_equation}} \\
x \oplus y  = x && \mbox{\qquad since $y = {\bf 0}$} \\
x \oplus y \in {\mathcal L}({\bf n}) && \mbox{\qquad since $x \in {\mathbb N}$}
 \end{eqnarray*}
\smallskip

Induction step.  Suppose  $x \in {\mathcal L}({\bf n})$ and ${\sf S} y \in {\mathcal L}({\bf n})$ and $x \oplus y \in {\mathcal L}({\bf n})$.
We must prove $x \oplus {\sf S} y \in {\mathcal L}({\bf n})$. We have
\begin{eqnarray*}
x \oplus y \in {\mathcal L}({\bf n})  && \mbox{\qquad by the induction hypothesis}\\
{\sf S} (x \oplus y) \in {\mathcal L}({\bf n}) && \mbox{\qquad by Lemma~\ref{lemma:L1}}\\
x \oplus {\sf S} y  \in {\mathcal L}({\bf n}) && \mbox{\qquad by Lemma~\ref{lemma:ChurchAddition_equation}}
\end{eqnarray*}
That completes the induction step.
That completes the proof of the lemma.

\begin{lemma} \label{lemma:knm}
Suppose ${\mathbb N}$ is finite and
 ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  Suppose ${\bf k} \oplus {\bf m} = {\bf n}$.
Then ${\bf n} \oplus {\bf m} = {\bf n}$.
\end{lemma}

\noindent{\em Proof}.   We have
\begin{eqnarray*}
{\bf k} \oplus {\bf m} = {\bf n}  && \mbox{\qquad by hypothesis}\\
{\sf S} ({\bf k} \oplus {\bf m}) = {\sf S} {\bf n}  && \mbox{\qquad by the previous line}\\
{\bf k} \in {\mathbb N}    && \mbox{\qquad by Lemma~\ref{lemma:SN}}\\
{\bf k} \oplus {\sf S} {\bf m} = {\sf S} {\bf n} && \mbox{\qquad by Lemma~\ref{lemma:ChurchAddition_equation}}\\
{\sf S} {\bf k} \oplus  {\bf m} = {\sf S} {\bf n} && \mbox{\qquad by Lemma~\ref{lemma:ChurchSuccessorShift}}\\
{\sf S} {\bf k} = {\sf S} {\bf n}  && \mbox{\qquad by hypothesis}\\
{\sf S} {\bf n} \oplus   {\bf m} = {\sf S} {\bf n} && \mbox{\qquad by the preceding two lines} \\
{\bf n} \oplus {\sf S} {\bf m} = {\sf S} {\bf n} && \mbox{\qquad by Lemma~\ref{lemma:ChurchSuccessorShift}}\\
{\sf S} (n \oplus {\bf m}) = {\sf S} {\bf n} && \mbox{\qquad by Lemma~\ref{lemma:ChurchAddition_equation}}\\
{\bf n} \oplus {\bf m} \in {\mathcal L}({\bf n}) && \mbox{\qquad by Lemma~\ref{lemma:additionmapsloop}}\\
{\bf n} \oplus {\bf m} = {\bf n}  && \mbox{\qquad by Theorem~\ref{theorem:looponeone}}
\end{eqnarray*}
That completes the proof of the lemma.

\begin{lemma} \label{lemma:kplusm}
Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  Then for all $x \in {\mathbb N}$,
$$ x \neq {\bf 0} \ {\rightarrow}\  {\bf n} = {\bf n} \oplus x \ {\rightarrow}\  {\bf n} = {\bf k} \oplus x.$$
\end{lemma}

\noindent{\em Proof}.  Suppose ${\bf n} = {\bf n} \oplus x$. Then
\begin{eqnarray*}
{\sf S} {\bf n} = {\sf S}({\bf n} \oplus x)  && \mbox{\qquad since ${\bf n} = {\bf n} \oplus x$}\\
{\sf S} {\bf n} = {\bf n}  \oplus  {\sf S} x  && \mbox{\qquad  by Lemma~\ref{lemma:ChurchAddition_equation}}\\
{\sf S} {\bf n} = {\sf S} {\bf n} \oplus x    && \mbox{\qquad by Lemma~\ref{lemma:ChurchSuccessorShift}}\\
{\sf S} {\bf n} = {\sf S} {\bf k} \oplus x     && \mbox{\qquad since ${\sf S} {\bf n} = {\sf S} {\bf k}$}\\
{\bf k} \in {\mathbb N}                 && \mbox{\qquad by Lemma~\ref{lemma:SN}, since $k \in {\sf STEM}$}\\
{\sf S} {\bf n} = {\bf k} \oplus {\sf S} x && \mbox{\qquad by Lemma~\ref{lemma:ChurchSuccessorShift}}\\
{\sf S} {\bf n} = {\sf S}({\bf k} \oplus x)&& \mbox{\qquad  by Lemma~\ref{lemma:ChurchAddition_equation}}\\
{\bf n} \in {\mathcal L}({\bf n})   && \mbox{\qquad by Lemma~\ref{lemma:L1}}\\
{\sf S} {\bf n} \in {\mathcal L}({\bf n})   && \mbox{\qquad by Lemma~\ref{lemma:L1}}\\
{\sf S} {\bf k} \in {\mathcal L}({\bf n})   && \mbox{\qquad since ${\sf S} {\bf k} = {\sf S} {\bf n}$}\\
x \neq {\bf 0}  && \mbox{\qquad by hypothesis}\\
x = {\sf S} r            && \mbox{\qquad for some $r \in {\mathbb N}$, by Lemma~\ref{lemma:predecessor}}\\
{\bf k} \oplus x = {\bf k} \oplus {\sf S} r && \mbox{\qquad since $x = {\sf S} r$}\\
{\bf k} \oplus x = {\sf S} {\bf k} \oplus r  && \mbox{\qquad by Lemma~\ref{lemma:ChurchSuccessorShift}}\\
{\sf S} {\bf k} \oplus r  \in {\mathcal L}({\bf n})  && \mbox{\qquad by Lemma~\ref{lemma:additionmapsloop}}\\
{\bf k} = {\bf n} \oplus x        && \mbox{\qquad by Theorem~\ref{theorem:looponeone}, since ${\sf S} {\bf n} = {\sf S}({\bf k} \oplus x)$}
\end{eqnarray*}
That completes the proof of the lemma.

\begin{definition} \label{definition:orderL}
Suppose ${\mathbb N}$ is finite and
 ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  Then we define
the {\bf order of successor on the loop} to be the $\preceq$-least Church number ${\bf q}$ such that
${\bf q} {\sf S}$  is the identity on ${\mathcal L}({\bf n})$.  That is,
\begin{eqnarray*}
&&\forall x \in {\mathcal L}({\bf n})\,( {\bf q} {\sf S} x = x) \\
&& \forall r\in {\mathbb N}\,( r \prec {\bf q} \ {\rightarrow}\  \neg\, \forall x \in {\mathcal L}({\bf n})\,(r {\sf S} x = x))
\end{eqnarray*}
For short we call ${\bf q}$ the ``order of ${\mathcal L}({\bf n})$'' or the ``order of the loop.''
\end{definition}
We shall show below that there actually exists such a number ${\bf q}$.   That, of course,
requires a proof, not just a definition.  Of course, assuming the Church
counting axiom, it is easy to prove that ${\bf m}$ is the order of the loop,
but we shall prove without the counting axiom that the order is well-defined.

\begin{lemma}\label{lemma:xsmapsN} Let $x\in {\mathbb N}$ and $y \in {\mathbb N}$.
Then $x{\sf S} y \in {\mathbb N}$.
\end{lemma}

\noindent{\em Proof}.  The formula is stratified, giving $x$ index 6
and $y$ index 0, with ${\mathbb N}$ as parameter.  Therefore we may prove it
by induction on $x$.
\smallskip

Base case.  We  have
\begin{eqnarray*}
{\bf 0} {\sf S} y = y  && \mbox{\qquad by Lemma~\ref{lemma:zeroAp}}\\
{\bf 0} {\sf S} y \in {\mathbb N}  && \mbox{\qquad since $y\in{\mathbb N}$}
\end{eqnarray*}
That completes the base case.
\smallskip

Induction step.  We have
\begin{eqnarray*}
x {\sf S} y \in {\mathbb N}  && \mbox{\qquad by the induction hypothesis}\\
x \in {\sf FUNC}  && \mbox{\qquad by Lemma~\ref{lemma:Churchnumbersarefunctions}}\\
{\sf S}(x {\sf S} y) \in {\mathbb N} && \mbox{\qquad by Lemma~\ref{lemma:successorN}, since $y \in {\mathbb N}$ }\\
{\sf S} x {\sf S} y = {\sf S} (x {\sf S} y) && \mbox{\qquad by Theorem~\ref{theorem:successorequation}}\\
{\sf S} x {\sf S} y \in {\mathbb N} && \mbox{\qquad by the preceding two lines}
\end{eqnarray*}
That completes the induction step.  That completes the proof of the theorem.

\begin{lemma} \label{lemma:successorflip} Let $t \in {\mathbb N}$ and $q \in {\mathbb N}$.
Then
$$ q {\sf S} ({\sf S} t) = {\sf S} (q {\sf S} t).$$
\end{lemma}

\noindent{\em Remark}.  Intuitively, both sides refer to successor applied
$q$ plus one times to $t$.
\smallskip

\noindent{\em Proof}.  We have
\begin{eqnarray*}
{\bf 0} {\sf S} t = t  && \mbox{\qquad by Lemmas~\ref{lemma:zeroAp}}\\
{\sf S} ({\bf 0} {\sf S} t) = {\sf S} t && \mbox{\qquad by the preceding line}\\
q {\sf S} t \in {\mathbb N} && \mbox{\qquad by Lemma~\ref{lemma:xsmapsN}}\\
{\sf S} t \in {\mathbb N} && \mbox{\qquad by Lemma~\ref{lemma:successorN}}\\
{\sf S} t \in {\sf FUNC} && \mbox{\qquad by Lemma~\ref{lemma:Churchnumbersarefunctions}}\\
Rel({\sf S} t)  && \mbox{\qquad by Lemma~\ref{lemma:Churchnumbersarerelations}}\\
{\sf S} {\bf 0} {\sf S} t = {\sf S} t && \mbox{\qquad by Lemma~\ref{lemma:ApOne}}\\
{\sf S} t = {\sf S} {\bf 0} {\sf S} t  && \mbox{\qquad by the preceding line}\\
q {\sf S} ({\sf S} t) = q {\sf S} ({\sf S} {\bf 0} {\sf S} t) && \mbox{\qquad by the preceding line}\\
    = (q \oplus {\sf S} {\bf 0}) {\sf S} t && \mbox{\qquad by Lemma~\ref{lemma:doubleiteration} with $X = {\mathbb N}$ and $f = {\sf S}$}\\
    = ({\sf S} q \oplus {\bf 0}) {\sf S} t && \mbox{\qquad by Lemma~\ref{lemma:ChurchSuccessorShift}}\\
 = {\sf S} q {\sf S} t  && \mbox{\qquad by Lemma~\ref{lemma:ChurchZero_equation}}\\
 = {\sf S} (q {\sf S} t) &&  \mbox{\qquad by Theorem~\ref{theorem:successorequation}}
\end{eqnarray*}
That completes the proof of the lemma.

\begin{lemma} \label{lemma:orderq_helper}
Suppose ${\mathbb N}$ is finite and
 ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  Suppose   $q \in {\mathbb N}$ and $q \neq {\bf 0}$ and $q{\sf S} {\bf n} = {\bf n}$.
Then
  $q {\sf S} $ is the identity on ${\mathcal L}({\bf n})$.
\end{lemma}

\noindent{\em Proof}.   Define
$X = \{ x \in {\mathcal L}(n):  q {\sf S} x = x \}$
The formula is stratified, giving $x$ index 0 and $q$ index 6, so the
definition is legal.  By hypothesis, ${\bf n} \in X$.  I say that $X$ is closed
under successor.  Suppose $x \in X$.  Then $x \in {\mathcal L}({\bf n})$ and $q {\sf S} x = x$.
\begin{eqnarray*}
 q {\sf S} ( {\sf S} x)      = {\sf S} (q {\sf S} x)  && \mbox{\qquad by Lemma~\ref{lemma:successorflip}}\\
 q {\sf S} ({\sf S} x)    = {\sf S} x   && \mbox{\qquad since $q {\sf S} x = x$} \\
 {\sf S} x \in {\mathcal L}({\bf n})  && \mbox{\qquad by Lemma~\ref{lemma:L1}}\\
 {\sf S} x \in X  && \mbox{\qquad by definition of $X$}
\end{eqnarray*}
That completes the proof that $X$ is closed under successor.
Then by definition of ${\mathcal L}({\bf n})$,  we have ${\mathcal L}({\bf n}) \subseteq X$.
That completes the proof of the lemma.

\begin{lemma} \label{lemma:orderq_helper2}
Suppose ${\mathbb N}$ is finite and
 ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  Suppose   $q \in {\mathbb N}$ and $q \neq {\bf 0}$ and
 $t \in {\mathcal L}({\bf n})$ and $q{\sf S} t = t$.
Then
  $q {\sf S} $ is the identity on ${\mathcal L}({\bf n})$.  That is,
  $$\forall x \in {\mathcal L}({\bf n})\, (q {\sf S} x = x).$$
\end{lemma}

\noindent{\em Proof}.  The formula is stratified, giving $x$ and $t$ index 0 and
$q$ index 6.  We can therefore prove it by ``loop induction.'' That is,
we show that the set of $t$ for which the lemma holds contains ${\bf n}$ and
is closed under successor.   That set, explicitly, is
$$ Z:= \{\ t\in {\mathcal L}({\bf n}):  q {\sf S} t = t \ {\rightarrow}\  \forall x \in {\mathcal L}({\bf n})\,(q {\sf S} x = x)\ \}.$$
The formula defining $Z$ is stratified, giving $q$ index 6 and $x$ and $t$
index 0.  ${\mathcal L}({\bf n})$ is a parameter.  Therefore $Z$ can be defined in INF.
\smallskip

$Z$ contains ${\bf n}$, by Lemma ~\ref{lemma:orderq_helper}.  It remains to
show $Z$ is closed under successor.  Suppose $t \in Z$.  We must show
${\sf S} t \in {\mathbb Z}$.  Suppose $q {\sf S} ({\sf S} t) =  {\sf S} t $, and let $x \in {\mathcal L}({\bf n})$
be given.  We must show ${\bf q} {\sf S} x = x$.  We have
\begin{eqnarray*}
q {\sf S} ({\sf S} t) = {\sf S} (q {\sf S} t)  && \mbox{\qquad by Lemma~\ref{lemma:successorflip}}\\
{\sf S} (q {\sf S} t) = {\sf S} t  && \mbox{\qquad since $q {\sf S} ({\sf S} t) =  {\sf S} t $}\\
q {\sf S} t = t   && \mbox{\qquad by Theorem~\ref{theorem:looponeone}}\\
\forall x \in {\mathcal L}({\bf n})\, (q x = x) && \mbox{\qquad by the induction hypothesis}
\end{eqnarray*}
That completes the induction step.  That completes the proof of the lemma.

\begin{lemma} \label{lemma:successoronloop}
Suppose ${\mathbb N}$ is finite and
 ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  Let $f$ be Church successor
restricted to ${\mathcal L}({\bf n})$.  Then for every $q \in {\mathbb N}$ and $x \in {\mathcal L}({\bf n})$,
$$ qfx = q {\sf S} x.$$
\end{lemma}

\noindent{\em Proof}.  The displayed formula is stratified, giving $x$
index 0, $f$ index 3, and $q$ index 6.  Therefore we can prove it by induction
on $q$.
\smallskip

Base case, ${\bf 0} f x = x$ and ${\bf 0} {\sf S} x = x$, by Lemma~\ref{lemma:zeroAp}.
Therefore ${\bf 0} f x = {\bf 0} {\sf S} x$.  That completes the base case.
\smallskip

Induction step.  We have
\begin{eqnarray*}
f:{\mathcal L}({\bf n}) \to {\mathcal L}({\bf n}) && \mbox{\qquad by Lemma~\ref{lemma:L1}}\\
Rel(f) \ \land \ f \in {\sf FUNC}  && \mbox{\qquad since $f$ is a subset of the graph of Church successor} \\
{\sf S} q f x = f(q f x) && \mbox{\qquad by Theorem~\ref{theorem:successorequation}}\\
{\sf S} q f x  = f (q {\sf S} x)  && \mbox{\qquad by the induction hypothesis, $q f x = q {\sf S} x$}\\
 {\sf S} q {\sf S} x) ={\sf S} (q {\sf S} x)   && \mbox{\qquad by Theorem~\ref{theorem:successorequation}} \\
 q {\sf S} x \in {\mathcal L}({\bf n})  && \mbox{\qquad by Lemma~\ref{lemma:xsmapsloop}} \\
f(q {\sf S} x) = {\sf S} (q {\sf S} x) && \mbox{\qquad since $f$ is the restriction of ${\sf S}$ to ${\mathcal L}({\bf n})$} \\
{\sf S} q f x = {\sf S} (q {\sf S} x)  && \mbox{\qquad since ${\sf S} q f x = f(q f x)$}\\
{\sf S} q f x = {\sf S} q {\sf S} x   && \mbox{\qquad since $ {\sf S} q {\sf S} x) ={\sf S} (q {\sf S} x) $}
 \end{eqnarray*}
That completes the induction step.  That completes the proof of the lemma.

\begin{lemma} \label{lemma:orderq}  Suppose ${\mathbb N}$ is finite and
 ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.   Then the order of successor on the loop exists.
\end{lemma}

\noindent{\em Proof}.
\begin{eqnarray*}
{\bf n} = {\bf k} \oplus {\bf m}  &&\mbox{\qquad for some ${\bf m} \in{\mathbb N}$, by  Lemma~\ref{lemma:mexists}}\\
{\bf n} = {\bf n} \oplus {\bf m}  && \mbox{\qquad by Lemma~\ref{lemma:knm}}\\
 {\bf m} {\sf S} \mbox{  is the identity on ${\mathcal L}({\bf n})$ }&&\mbox{\qquad by the Annihilation Theorem}\\
 {\bf m} {\sf S} {\bf n} = {\bf n} && \mbox{\qquad by the previous line}
 \end{eqnarray*}
 Define
$$X := \{ q \in {\mathbb N}  : q {\sf S} {\bf n} = {\bf n}\}.$$
The formula defining $X$ is stratified, giving $q$ index 6 and ${\bf n}$ index 0, so
$X$ can be defined in INF.   Define
$f$ to be Church successor restricted to ${\mathcal L}({\bf n})$.   Then
\begin{eqnarray*}
f:{\mathcal L}({\bf n}) \to {\mathcal L}({\bf n}) && \mbox{\qquad by Lemma~\ref{lemma:L1}}\\
f \mbox{\ is an injection} && \mbox{\qquad by Theorem~\ref{theorem:looponeone}} \\
{\bf m} f \mbox{\ is the identity on ${\mathcal L}({\bf n})$} && \mbox{\qquad by the Annihilation Theorem} \\
x \in {\mathcal L}({\bf n})\ {\rightarrow}\  {\bf m} f x = {\bf m} {\sf S} x && \mbox{\qquad by Lemma~\ref{lemma:successoronloop}}\\
{\bf m} {\sf S} \mbox{\ is the identity on ${\mathcal L}({\bf n})$} && \mbox{\qquad by the preceding two lines} \\
{\bf m} \in X  && \mbox{\qquad by the definition of $X$}\\
{\mathbb N} \in {\sf DECIDABLE} && \mbox{\qquad  by Lemma~\sref{lemma:finitedecidable}} \\
X \mbox{\  is a separable subset of ${\mathbb N}$} && \mbox{\qquad by definition of separable}\\
X \in {\sf FINITE} && \mbox{\qquad by Lemma~\ref{lemma:separablefinite}} \\
X \mbox{\ has a $\preceq$-least element} && \mbox{\qquad by Lemma~\ref{lemma:leastelement}, since ${\bf m} \in X$}
\end{eqnarray*}
Let ${\bf q}$ be that element.  By Lemma~\ref{lemma:orderq_helper},
${\bf q} {\sf S}$ is the identity on ${\mathcal L}({\bf n})$.   Now let $r \prec q$,  and suppose $r {\sf S}$ is the
identity on ${\mathcal L}({\bf n})$.  Then $r \in X$, contradiction, since ${\bf q}$ is the $\preceq$-least element of $X$.
Therefore ${\bf q}$ is the order of ${\sf S}$ on ${\mathcal L}({\bf n})$, as claimed.

\section{The Church counting axiom}

The ``Church counting axiom'' expresses the idea that iterating the Church successor function
$j$ times starting from ${\bf 0}$ leads to the Church number $j$.  The
formula expressing this fact is not stratified,  since $j$ as a function must get an
index six higher than $j$ as an ``object.''    Hence if one wishes to use this principle,
it must be assumed as a new axiom.   Here is that
axiom:

\begin{definition}\label{definition:countingaxiom}
The {\bf Church counting axiom} is
$$\forall j \in {\mathbb N}\,(j{\sf S} 0 = j).$$
\end{definition}
A similar axiom was introduced by Rosser \cite{rosser1953}.
Rosser's axiom is stated using the finite Frege cardinals.
It says that $\{x\in {\mathbb F} : x < p\}$ belongs to the
cardinal number $p$.   In the last section of this paper,
we will prove that the two counting axioms are equivalent.
Orey proved \cite{orey1964} that the Rosser counting axiom is
not provable in NF (unless, of course, NF is inconsistent).
Therefore our result shows that the same is true of the Church
counting axiom.

The main result of this paper is that INF plus the Church counting axiom proves that
${\mathbb N}$ is infinite and Church successor is one-to-one on ${\mathbb N}$.  Whether this can
be proved with intuitionistic logic and
without the Church counting axiom we do not know.  Our proof
appears to require that the order of (successor on) the loop be ${\bf m}$, and
we failed to prove that without the Church counting axiom.  In this section, we
present a proof of that fact using the Church counting axiom.

\begin{lemma} [loop counting]\label{lemma:loopcounting}
Assume the Church counting axiom.
Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  Let $q \in {\mathbb N}$.  Then
$$ q{\sf S}{\bf n} = {\bf n} \oplus q.$$
\end{lemma}

\noindent{\em Proof}.  We have
\begin{eqnarray*}
{\bf n} = {\bf n} {\sf S} {\bf 0} && \mbox{\qquad by the Church counting axiom}\\
q {\sf S} {\bf n} =  q {\sf S} ({\bf n} {\sf S} {\bf 0}) && \mbox{\qquad by the preceding line}\\
 q {\sf S} {\bf n} = (q \oplus  {\bf n}){\sf S} {\bf 0}  && \mbox{\qquad by Lemma~\ref{lemma:doubleiteration}}\\
q {\sf S} {\bf n}  = ({\bf n} \oplus q){\sf S} {\bf 0} && \mbox{\qquad by Lemma~\ref{lemma:ChurchAdditionCommutative}}\\
{\bf n} \oplus q \in {\mathbb N}  && \mbox{\qquad by Lemma~\ref{lemma:ChurchAdditionMaps}}\\
q {\sf S} {\bf n}  = {\bf n} \oplus q    && \mbox{\qquad by the Church counting axiom}
\end{eqnarray*}

\begin{theorem}[Order of successor on the loop is ${\bf m}$] \label{theorem:orderm}
Assume the Church counting axiom.
 Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  Suppose ${\bf m} \in {\mathbb N}$ and ${\bf n} = {\bf k} \oplus  {\bf m}$,
and ${\bf m}$ is the $\preceq$-least solution of ${\bf n} = {\bf k} \oplus {\bf m}$.
Suppose $q \in {\mathbb N}$ and $q \neq {\bf 0}$ and  $q {\sf S}$ is the identity on ${\mathcal L}({\bf n})$.   Then ${\bf m} \preceq q$.
\end{theorem}

\noindent{\em Proof}.  Suppose $q s$ is the identity on ${\mathcal L}({\bf n})$ and $q \neq {\bf 0}$.
We must show ${\bf m} \preceq q$.  We have
\begin{eqnarray*}
q {\sf S} {\bf n} = {\bf n} \oplus q  && \mbox{\qquad by Lemma~\ref{lemma:loopcounting} and the Church counting axiom}\\
q {\sf S} {\bf n} = {\bf n}   && \mbox{\qquad since $q {\sf S}$ is the identity on ${\mathcal L}({\bf n})$}\\
{\bf n} = {\bf n} \oplus q    && \mbox{\qquad by the preceding two lines}\\
{\bf n} = {\bf k} \oplus q    && \mbox{\qquad by Lemma~\ref{lemma:kplusm}}\\
{\bf m} \preceq q   && \mbox{\qquad since ${\bf m}$ is the least solution of ${\bf n} = {\bf k} \oplus {\bf m}$}
\end{eqnarray*}
That completes the proof of the theorem.

\section{Church counting implies ${\mathbb N}$ is not finite}

Now we prove a series of lemmas under the hypothesis that ${\mathbb N}$ is finite.
With only that hypothesis,  results
proved earlier under the additional hypothesis that there is a double successor are not
applicable;  without careful attention to the hypothesis, the reader might
get a sense of {\em deja vu}.

\begin{lemma} \label{lemma:stemseparable_helper}
Suppose ${\mathbb N}$ is finite and $x \in {\sf STEM}$.  Then
$$\exists y \in {\mathbb N}\, ({\sf S} y = {\sf S} x \ \land \ y \neq x) \ \lor \ \neg \exists y \in {\mathbb N}\, ({\sf S} y = {\sf S} x \ \land \ y \neq x).$$
\end{lemma}

\noindent{\em Proof}.  Since ${\mathbb N}$ is finite,  it has decidable equality,
by Lemma~\sref{lemma:finitedecidable}.  Then define
$$ R := \{ \ \langle x,y \rangle \in {\mathbb N} \times {\mathbb N} : {\sf S} y = {\sf S} x\ \ \land \ y \neq x\}.$$
The formula is stratified, giving $x$ and  $y$ index 0, with ${\mathbb N} \times {\mathbb N}$ as
a parameter.  Since ${\mathbb N}$ has decidable equality, $R$
 is a decidable relation $R$ on ${\mathbb N}$.   The
conclusion of the lemma then follows from
Lemma~\sref{lemma:boundedquantification}.

\begin{lemma}\label{lemma:stemseparable}
Suppose ${\mathbb N}$ is finite.  Then ${\sf STEM}$ is a separable subset of ${\mathbb N}$.
\end{lemma}

\noindent{\em Proof}. We have to prove
$$ \forall x \in {\mathbb N}\, (x \in {\sf STEM} \ \lor \ x \not \in {\sf STEM}).$$
That formula is stratified, giving $x$ index 0, with ${\sf STEM}$ a parameter.
We can therefore proceed by induction on $x$.
\smallskip

Base case. ${\bf 0} \in {\sf STEM}$, by Lemma~\ref{lemma:S1}.  Hence
${\bf 0} \in {\sf STEM} \ \lor \ {\bf 0} \not \in {\sf STEM}$.  That completes
the base case.
\smallskip

Induction step.
We must prove
$${\sf S} x \in {\sf STEM} \ \lor \ {\sf S} x \not\in {\sf STEM}.$$
The induction hypothesis is $x \in {\sf STEM} \ \lor \ x \not\in {\sf STEM}$.
We argue by cases accordingly.
\smallskip

Case~1, $x \in {\sf STEM}$.  By Lemma~\ref{lemma:stemseparable_helper}, we
have
$$\exists y \in {\mathbb N}\, ({\sf S} y = {\sf S} x \ \land \ y \neq x) \ \lor \ \neg \exists y \in {\mathbb N}\, ({\sf S} y = {\sf S} x\ \land \ y \neq x).$$
We argue by cases accordingly.
\smallskip

Case~1a, $\exists y \in {\mathbb N}\, ({\sf S} y = {\sf S} x\ \land \ y \neq x)$.  Then ${\sf S} x \not \in {\sf STEM}$,
by Lemma~\ref{lemma:Soneone}.  That completes Case~1a.
\smallskip

Case~1b, $\neg \exists y \in {\mathbb N}\, ({\sf S} y = {\sf S} x\ \land \ y \neq x)$.  Then ${\sf S} x \in {\sf STEM}$,
by Lemma~\ref{lemma:S1}. That completes Case~1b.  That completes Case~1.
\smallskip

Case~2, $x \not\in {\sf STEM}$.  Then ${\sf S} x \not\in {\sf STEM}$, by Lemma~\ref{lemma:Spred}.
That completes Case~2.  That completes the induction step.
That completes the proof of the lemma.

\begin{lemma} \label{lemma:kinstem}
Suppose ${\mathbb N}$ is  finite.  Then there exists a double successor ${\sf S} {\bf k} = {\sf S} n$
with ${\bf k} \neq {\bf n}$ and ${\bf k} \in {\sf STEM}$.
\end{lemma}

\noindent{\em Proof}. We have
\begin{eqnarray*}
{\sf STEM} \mbox{\ is a separable subset of ${\mathbb N}$} &&\mbox{\qquad by Lemma~\ref{lemma:stemseparable}}\\
{\mathbb N} \in {\sf FINITE}  && \mbox{\qquad by hypothesis}\\
{\sf STEM} \in {\sf FINITE} && \mbox{\qquad by Lemma~\sref{lemma:separablefinite}}
\end{eqnarray*}
We would like to identify ${\bf k}$ as the maximal element of the finite set
${\sf STEM}$, but that is not a one-line proof, as we do not have a linear ordering
on ${\sf STEM}$ without assuming ${\bf k} \in {\sf STEM}$, which is what we are trying to prove,
so ``maximal'' makes no sense.
\smallskip

We avoid the need for a linear ordering as follows.  Define
$$ R:= \{\ \langle y,x \rangle \in {\mathbb N} \times {\mathbb N}:  x \in {\sf STEM} \ \land \ x \neq y \ \land \ {\sf S} x = {\sf S} y \ \}. $$
The formula is stratified, so the definition is legal.
Then
\begin{eqnarray*}
{\sf STEM} \mbox{ \ is a separable subset of ${\mathbb N}$} &&\mbox{\qquad by Lemma~\ref{lemma:stemseparable}}\\
{\mathbb N} \in {\sf DECIDABLE} && \mbox{\qquad by  Lemma~\sref{lemma:finitedecidable}}\\
R \mbox{\  is a decidable relation on ${\mathbb N}$}
   && \mbox{\qquad by the preceding lines}
\end{eqnarray*}
 Define
$$Z:=  \{ \ x \in {\mathbb N} : \exists y \in {\mathbb N}\, \langle y, x \rangle \in  R \ \}.$$
{\em Remark}.   $Z$ is the set of $x \in {\sf STEM}$ such that ${\sf S} x$ is a
double successor.
\smallskip

By Lemma~\ref{lemma:boundedquantification},
$Z \in {\sf FINITE}$.
By Lemma~\sref{lemma:empty_or_inhabited}, $Z$ is empty
or inhabited.  We argue by cases accordingly.
\smallskip

Case~1, $Z = {\Lambda}$.  Then there is no $x \in {\sf STEM}$ such that ${\sf S} x$ is  a
double successor.  Then
\begin{eqnarray*}
{\bf 0} \in {\sf STEM} && \mbox{\qquad by Lemma~\ref{lemma:S1}}
\end{eqnarray*}
I say that ${\sf STEM}$ is closed under successor.  Suppose $x \in {\sf STEM}$;
we must show ${\sf S} x \in {\sf STEM}$.  By Lemma~\ref{lemma:S1}, it suffices
to show that ${\sf S} x$ is not a double successor; that is, it suffices
to show that
$$ \forall v \in {\mathbb N}\,({\sf S} x = {\sf S} v \ {\rightarrow}\  x = v).$$
Let $v \in {\mathbb N}$ and ${\sf S} x = {\sf S} v$; we must show $x = v$.  Since ${\mathbb N}$
has decidable equality, we may prove that by contradiction.  Suppose $x \neq v$.
Then $x \in {\sf STEM}$ and ${\sf S} x$ is a double successor, so $x \in Z$.
But that contradicts the hypothesis $Z = {\Lambda}$ of Case~1.  That
completes the proof that ${\sf STEM}$ is closed under successor.  Then

\begin{eqnarray*}
{\mathbb N} \subseteq {\sf STEM}  && \mbox{\qquad  by the definition of ${\mathbb N}$}\\
{\sf STEM} \subseteq {\mathbb N}  && \mbox{\qquad by Lemma~\ref{lemma:S1}}\\
{\mathbb N} = {\sf STEM}  && \mbox{\qquad by the preceding two lines}\\
\mbox{ Church successor is
one-to-one on ${\sf STEM}$} && \mbox{\qquad by  Lemma~\ref{lemma:Soneone}}\\
\mbox{ Church successor is
one-to-one on ${\mathbb N}$} &&\mbox{\qquad by the preceding two lines}\\
\mbox{ChurchSuccessor is not onto ${\mathbb N}$} && \mbox{\qquad by Theorem~\ref{theorem:successoromitszero}}\\
\mbox{${\mathbb N}$ is infinite} && \mbox{\qquad by Definition~\sref{definition:infinite}} \\
\neg\, {\mathbb N} \in {\sf FINITE}  && \mbox{\qquad by Theorem~\sref{theorem:infiniteimpliesnotfinite}}
\end{eqnarray*}
But that contradicts the hypothesis that ${\mathbb N}$ is finite.  That completes
Case~1.
\smallskip

Case~2, $Z$ is inhabited.  Then there exists some $x \in {\sf STEM}$ such
that ${\sf S} x$ is a double successor.  That completes the proof of the lemma.

\begin{lemma} \label{lemma:nplusm}
 Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  Then
$$  \forall x \in {\mathbb N}\,( x \neq {\bf 0} \ {\rightarrow}\  {\bf n} = {\bf k} \oplus x \ {\rightarrow}\  {\bf n} = {\bf n} \oplus x).$$
\end{lemma}

\noindent{\em Proof}.  We have
\begin{eqnarray*}
{\bf k} \in {\mathbb N} && \mbox{\qquad by Lemma~\ref{lemma:SN}, since ${\bf k} \in {\sf STEM}$}\\
{\bf n} = {\bf k} \oplus x  && \mbox{\qquad by hypothesis}\\
{\sf S} {\bf n} = {\sf S} ({\bf k} \oplus x)  && \mbox{\qquad by the previous line}\\
{\sf S} {\bf n} = {\bf k} \oplus {\sf S} x  && \mbox{\qquad by Lemma~\ref{lemma:ChurchAddition_equation}}\\
{\sf S} {\bf n}= {\sf S} {\bf k} \oplus x  && \mbox{\qquad by Lemma~\ref{lemma:ChurchSuccessorShift}}\\
{\sf S} {\bf n}= {\sf S} {\bf n} \oplus x   && \mbox{\qquad since ${\sf S} {\bf k} = {\sf S} {\bf n}$}\\
{\sf S} {\bf n}= {\bf n} \oplus {\sf S} x  && \mbox{\qquad by Lemma~\ref{lemma:ChurchSuccessorShift}}\\
{\sf S} {\bf n} = {\sf S} ({\bf n} \oplus x)   && \mbox{\qquad by Lemma~\ref{lemma:ChurchAddition_equation}}\\
{\bf n} \in {\mathcal L}({\bf n}) && \mbox{\qquad by Lemma~\ref{lemma:L1}}\\
{\bf n} \oplus x \in {\mathcal L}({\bf n}) && \mbox{\qquad by Lemma~\ref{lemma:additionmapsloop}}\\
{\bf n} \oplus x = {\bf n} && \mbox{\qquad by Theorem~\ref{theorem:looponeone}}
\end{eqnarray*}
That completes the proof of the lemma.

\begin{lemma}\label{lemma:smloop}
 Suppose ${\mathbb N} \in {\sf FINITE}$ and ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $  {\bf k} \neq {\bf n}$ and
${\bf k} \in {\sf STEM}$ and ${\bf n} \in {\mathbb N}$.  Suppose ${\bf m} \in {\mathbb N}$ with ${\bf n} = {\bf k}+{\bf m}$.
Then ${\bf m} {\sf S}$ is the identity on ${\mathcal L}({\bf n})$.
\end{lemma}

\noindent{\em Remark}.    We want to say, ``by the Annihilation Theorem.''
But the domain of successor is more than just the loop, so we must consider
its restriction $f$ to ${\mathcal L}({\bf n})$, and verify that $f$ satisfies the hypotheses
of the Annihilation Theorem; and after the application, we still have to verify
that the iterates of the restriction are the restrictions of the iterates.
\smallskip

\noindent{\em Proof}. We have
\begin{eqnarray*}
{\sf S} {\bf n} = {\sf S} ({\bf k} + {\bf m})  && \mbox{\qquad since ${\bf n} = {\bf k} + {\bf m}$}\\
 = {\bf k} + {\sf S}{\bf m}  && \mbox{\qquad by Lemma~\ref{lemma:ChurchAddition_equation}}\\
 = {\sf S} {\bf k} + {\bf m} && \mbox{\qquad by Lemma~\ref{lemma:ChurchSuccessorShift}}\\
 = {\sf S} {\bf n} + {\bf m} && \mbox{\qquad since ${\sf S} {\bf k} = {\sf S} {\bf n}$}
\end{eqnarray*}
Define $f$ to be the restriction of Church successor  to ${\mathcal L}({\bf n})$
(which can be done by means of a stratified formula).
One can verify that $f$ is an injection from ${\mathcal L}(n)$ to ${\mathcal L}({\bf n})$, in the sense of
Definition~\ref{definition:ChurchFregenjection}.   The most important step
is that $f$ is one-to-one, by Theorem~\ref{theorem:looponeone}.
We omit the details of the verification (about 180 steps).
\smallskip

 By Lemma~\ref{lemma:loopfinite}, ${\mathcal L}({\bf n})$ is finite.
 By Lemma~\ref{lemma:nplusm} and the hypothesis that ${\bf n} = {\bf k} + {\bf m}$,
 we have ${\bf n} = {\bf k} + {\bf m}$.
Since $f: {\mathcal L}({\bf n}) \to {\mathcal L}({\bf n})$ is an injection, we can apply the
Annihilation Theorem to obtain
$$ \forall x \in {\mathcal L}({\bf n})\,({\bf m} f x = x).$$
Then by Lemma~\ref{lemma:successoronloop}, we have
$$ \forall x \in {\mathcal L}({\bf n})\,({\bf m} {\sf S} x = x).$$
as desired.
That completes the proof of the lemma.

\begin{theorem} \label{theorem:main}
 The Church counting axiom implies that ${\mathbb N}$ is not finite.
\end{theorem}

\noindent{\em Proof}. Assume the Church counting axiom, and suppose   ${\mathbb N}$ is finite.
 By Lemma~\ref{lemma:kinstem},
there is a double successor ${\sf S} {\bf n} = {\sf S} {\bf k}$ with
with ${\bf k} \neq {\bf n}$ and ${\bf k} \in {\sf STEM}$.
 Then by Lemma~\ref{lemma:mexists},  there exists a $\preceq$-least
${\bf m} \in {\mathbb N}$ such that ${\bf n} = {\bf k} + {\bf m}$.   Fix that ${\bf m}$. Then
by Theorem~\ref{theorem:orderm}, ${\bf m}$ is the order  of successor
restricted to ${\mathcal L}({\bf n})$.  Explicitly, we have
\begin{eqnarray}
\forall q \in {\mathbb N}\,(q \neq {\bf 0} \ {\rightarrow}\  q{\sf S}{\bf n} = {\bf n} \ {\rightarrow}\  {\bf m} \preceq q).
\label{eq:E4523}
\end{eqnarray}
 (This is where we use the Church counting axiom, since Theorem~\ref{theorem:orderm} requires it.)
\smallskip

We have
\begin{eqnarray*}
{\bf n} \neq {\bf 0}  && \mbox{\qquad by Lemma~\ref{lemma:nneqzero}}\\
{\bf n} \in {\mathcal L}({\bf n})        && \mbox{\qquad by Lemma~\ref{lemma:L1}}\\
{\bf n} = {\sf S} p             && \mbox{\qquad for some $p \in {\mathcal L}({\bf n})$, by Theorem~\ref{theorem:looponto}}
\end{eqnarray*}
Now define
$$X := {\mathcal L}({\bf n}) - \{{\bf n}\}.$$
and define $f$
$$ f = ( \{ \langle x,{\sf S} x \rangle : x \in X \} - \{\langle p,{\bf n}\rangle\}) \cup \{ \ \langle p, {\sf S} {\bf n} \rangle \}.$$
  Informally,
the idea of the definition of $f$ is that
  $f(x) = {\sf S} x$ except when $x = p$, and $f(p) = {\sf S} {\bf n}$.
  \smallskip

Our first observation about $f$ is that
\begin{eqnarray}
\langle x, {\sf S} {\bf n} \rangle \in f \ {\rightarrow}\  x = p \label{eq:E4545}
\end{eqnarray}
To prove that, suppose $\langle x, {\sf S} {\bf n} \rangle \in f$.  Then
\begin{eqnarray*}
x \in {\mathcal L}({\bf n})  && \mbox{\qquad by definition of $X$ and $f$}\\
{\sf S} \in   {\mathcal L}({\bf n}) && \mbox{\qquad by Lemma~\ref{lemma:L1}}\\
{\sf S} n \neq {\bf n}  && \mbox{\qquad by Lemma~\ref{lemma:snneqn}}\\
{\sf S} x = {\sf S} n \ {\rightarrow}\  x = p && \mbox{\qquad by Theorem~\ref{theorem:looponeone}}
\end{eqnarray*}
Now (\ref{eq:E4545}) follows from the definition of $f$.
\smallskip

We have
\begin{eqnarray*}
Rel(f) && \mbox{\qquad by 17 omitted steps}\\
f \in {\sf FUNC}      && \mbox{\qquad by 60 omitted steps} \\
{\sf S} {\bf n} \neq {\bf n}  && \mbox{\qquad by Lemma~\ref{lemma:snneqn}}\\
dom(f) \subseteq X  && \mbox{\qquad by the preceding line and 30 omitted steps} \\
range(f) \subseteq X && \mbox{\qquad by Theorem~\ref{theorem:looponeone}, Lemma~\ref{lemma:snneqn}, and 46 omitted steps}\\
f: X \to X      && \mbox{\qquad by Theorem~\ref{theorem:looponeone} and 82 omitted steps}
\end{eqnarray*}
I say that $f$ is one-to-one.  Suppose $\langle x, y \rangle \in f$
and $\langle u, y\rangle \in f$.  We must prove $x=u$.
 Since ${\mathbb N}$ is finite, ${\mathbb N}$ has decidable equality, by Lemma~\sref{lemma:finitedecidable}.  Therefore
$$ y = {\sf S}{\bf n} \ \lor \ y \neq {\sf S} {\bf n}.$$
Case~1, $y = {\sf S}{\bf n}$.  Then
\begin{eqnarray*}
x = p && \mbox{\qquad by (\ref{eq:E4545})}\\
u = p && \mbox{\qquad by (\ref{eq:E4545})} \\
x = u && \mbox{\qquad by the preceding two lines}
\end{eqnarray*}
That completes Case~1.
\smallskip

\noindent
Case~2, $y \neq {\sf S} {\bf n}$.  Then $y = {\sf S} x$ and $y = {\sf S} u$.  We have
\begin{eqnarray*}
x \in X  \ \land \ u \in X && \mbox{\qquad since $dom(f) \subseteq X$}\\
x \in {\mathcal L}({\bf n}) \ \land \ u \in {\mathcal L}({\bf n}) && \mbox{\qquad since $X \subseteq {\mathcal L}({\bf n})$}\\
{\sf S} x \in {\mathcal L}({\bf n}) && \mbox{\qquad by Lemma~\ref{lemma:L1}}\\
y \in {\mathcal L}({\bf n})  && \mbox{\qquad since $y = {\sf S} x$}\\
x = u && \mbox{\qquad by Theorem~\ref{theorem:looponeone}}
\end{eqnarray*}
That completes Case~2.  That completes the proof that $f$ is one-to-one.
\smallskip

We have now proved that $f$ is an injection, since by definition that
means $f:X \to X$, $f$ is one-to-one, $f \in {\sf FUNC}$ and $Rel(f)$, all of
which we have verified.
 Hence we can apply the Annihilation Theorem to $f$ and $X$
to conclude that ${\bf m} f$ is the identity on $X$. Explicitly,
\begin{eqnarray}
\forall x \in X\,({\bf m} f x = x)\label{eq:E4598}
\end{eqnarray}
In the rest of the proof, we will show that ${\bf m} f$ is not the identity
on $X$, thus contradicting (\ref{eq:E4598}).
\smallskip

Let $\alpha:= {\sf S} {\bf n}$.  Then
\begin{eqnarray*}
{\sf S}{\bf n} \neq {\bf n} && \mbox{\qquad by Lemma~\ref{lemma:snneqn}}\\
{\bf n} \in {\mathcal L}({\bf n}) && \mbox{\qquad by Lemma~\ref{lemma:L1}}\\
{\sf S} {\bf n} \in L({\bf n}) && \mbox{\qquad by Lemma~\ref{lemma:L1}}\\
\alpha \in {\mathcal L}({\bf n}) && \mbox{\qquad since $\alpha = {\sf S} {\bf n}$ and ${\bf n} \in {\mathcal L}({\bf n})$}\\
\alpha \neq {\bf n}  && \mbox{\qquad since $\alpha = {\sf S} {\bf n}$  and ${\sf S} {\bf n} \neq {\bf n}$}\\
\alpha \in X && \mbox{\qquad since $X = {\mathcal L}({\bf n}) - \{{\bf n}\}$ }
\end{eqnarray*}
I say that
\begin{eqnarray}
q \neq {\bf n} \ {\rightarrow}\  {\sf S} q \prec {\bf m} \ {\rightarrow}\   q f \alpha = q {\sf S} \alpha. \label{eq:E4424}
 \end{eqnarray}
We prove this by finite induction on $q$.  That is legal, since we
can stratify that formula, giving $q$ index 6 and $\alpha$ index 0.
${\bf m}$ occurs as a parameter, so we do not need to give it an index, but
we could give it index 6.  $f$ gets index 3, since it contains pairs of
objects of index 0; so $q$ contains pairs of objects of index 3; those
pairs have index 5, which is why $q$ gets index 6.
\smallskip

Base case, $q = {\bf 0}$.  We have ${\bf 0} f \alpha = \alpha = {\bf 0} {\sf S} \alpha$, by Lemma~\ref{lemma:zeroAp}.  That completes the base case.
\smallskip

Induction step.  Since we are using finite induction, we get to
assume
\begin{eqnarray}
q \neq {\bf n} \label{eq:E4724}
\end{eqnarray}
We also assume
\begin{eqnarray}
{\sf S} q \neq {\bf n} \ \land \ {\sf S}({\sf S} q) \prec {\bf m} \label{eq:E4628}
\end{eqnarray}
 We have to prove
\begin{eqnarray}
{\sf S} q {\sf S} \alpha = {\sf S} q f \alpha \label{eq:E4629}
\end{eqnarray}
 We have
\begin{eqnarray*}
{\sf S} ({\sf S} q) \neq {\bf n}   && \mbox{\qquad by Lemma~\ref{lemma:precmax2},since ${\sf S}({\sf S} q) \prec {\bf m}$}\\
{\sf S} q \prec {\sf S} ({\sf S} q)  && \mbox{\qquad by Corollary~\ref{lemma:xprecsx}, since ${\sf S} q \neq {\bf n}$}\\
{\sf S} q \prec {\bf m} && \mbox{\qquad by Lemma~\ref{lemma:prectrans},
since ${\sf S} ({\sf S} {\bf q}) \prec {\bf m}$}\\
q {\sf S} \alpha \in {\mathcal L}({\bf n})  && \mbox{\qquad by Lemma~\ref{lemma:xsmapsloop}, since $\alpha \in {\mathcal L}({\bf n})$} \\
{\mathcal L}({\bf n}) \subseteq {\mathbb N} && \mbox{\qquad by Lemma~\ref{lemma:L1}}\\
q {\sf S} \alpha \in {\mathbb N}  && \mbox{\qquad by the preceding two lines}\\
p \in {\mathbb N} && \mbox{\qquad since $p \in {\mathcal L}({\bf n})$  and ${\mathcal L}({\bf n}) \subseteq {\mathbb N}$.}
\end{eqnarray*}
Since ${\mathbb N}$ is finite, it has decidable equality, by Lemma~\sref{lemma:finitedecidable}.  Since $p \in {\mathcal L}({\bf n})$ and $q{\sf S} \alpha \in {\mathbb N}$,
we have
$$ {\bf q} {\sf S} \alpha = p \ \lor\ {\bf q} {\sf S} \alpha \neq p.$$
We argue by cases accordingly.
\smallskip

Case~1, $q {\sf S} \alpha = p$.  Then
\begin{eqnarray*}
{\sf S}(q {\sf S} \alpha) = {\sf S} p && \mbox{\qquad since $q {\sf S} \alpha = p$}\\
                = {\bf n}   && \mbox{\qquad since ${\sf S} p = {\bf n}$}\\
{\sf S} ({\sf S} (q {\sf S} \alpha)) = {\sf S} n && \mbox{\qquad by the previous line}\\
{\sf S} ({\sf S} (q {\sf S} \alpha)) = \alpha && \mbox{\qquad since ${\sf S} n = \alpha$}\\
{\sf S} (q {\sf S} \alpha) = {\sf S} q {\sf S} \alpha &&  \mbox{\qquad by Theorem~\ref{theorem:successorequation}}\\
{\sf S} ({\sf S} q {\sf S} \alpha) = \alpha && \mbox{\qquad by the preceding two lines}\\
{\sf S}({\sf S} q) {\sf S} \alpha = \alpha && \mbox{\qquad by Theorem~\ref{theorem:successorequation}} \\
{\sf S}({\sf S} q){\sf S} x = x \mbox{ \ for all $x\in {\mathcal L}({\bf n})$} && \mbox{\qquad by Lemma~\ref{lemma:orderq_helper2}}\\
{\bf m} \preceq {\sf S} ({\sf S} q) && \mbox{\qquad by Theorem~\ref{theorem:orderm} and (\ref{eq:E4523})} \\
{\sf S} ({\sf S} q) \prec {\bf m}  && \mbox{\qquad by (\ref{eq:E4628})}\\
{\sf S} ({\sf S} q) \preceq {\bf m} \ \land \ {\sf S}({\sf S} q) \neq {\bf m} && \mbox{\qquad by the definition of $\prec$}\\
{\sf S}({\sf S} q) = {\bf m}  && \mbox{\qquad by Theorem~\ref{theorem:prectrichotomy2}}
\end{eqnarray*}
But the last two lines are contradictory.  That shows that Case~1 is impossible.
\smallskip

Case~2, $q {\sf S} \alpha \neq p$.  We have ${\sf S} q \neq {\bf n}$  and ${\sf S} ({\sf S} q) \prec {\bf m}$
by hypothesis,
but in order to apply the induction hypothesis, we need $q \neq {\bf n}$ and ${\sf S} q \prec {\bf m}$.  We have $q \neq {\bf n}$ by (\ref{eq:E4724}).  Here is
a proof that ${\sf S} q \prec {\bf m}$:
\begin{eqnarray*}
{\sf S} q \prec {\sf S} ({\sf S} q) && \mbox{\qquad by Lemma~\ref{lemma:preceqsuccessor}, since ${\sf S} q \neq {\bf n}$}\\
{\sf S} ({\sf S} q) \prec {\bf m} && \mbox{\qquad by hypothesis}\\
{\sf S} q \prec {\bf m} && \mbox{\qquad by Lemma~\ref{lemma:prectrans}}
\end{eqnarray*}
Now we can use the induction hypothesis. We proceed to the
proof of the induction step.
\begin{eqnarray*}
{\sf S} q f \alpha = f (q f \alpha) && \mbox{\qquad by Theorem~\ref{theorem:successorequation}}\\
q f \alpha \in X && \mbox{\qquad by Lemma~\ref{lemma:xfmaps}, since $f:X \to X$}\\
{\sf S} q f \alpha = f( q {\sf S} \alpha)  && \mbox{\qquad by the induction hypothesis} \\
 = {\sf S} (q {\sf S} \alpha) && \mbox{\qquad since $q {\sf S} \alpha \neq p$, by definition of $f$}\\
 = {\sf S} q {\sf S} \alpha && \mbox{\qquad by Theorem~\ref{theorem:successorequation}}
\end{eqnarray*}
That completes Case~2.  That completes the induction step.
That completes the proof of (\ref{eq:E4629}); that is,
it completes the induction step.  That completes the proof of (\ref{eq:E4424}).
\smallskip

We have ${\bf m} \neq {\bf 0}$, since if ${\bf m} = {\bf 0}$ then ${\bf n} = {\bf k} + {\bf m} = {\bf k} + {\bf 0} = {\bf k}$, contradiction.  Then by
 Lemma~\ref{lemma:predecessornotn}, there exists $m_1$  such that
\begin{eqnarray*}
{\sf S} m_1 = {\bf m} && \\
m_1 \in {\mathbb N} \ \land \ m_1 \neq {\bf n} &&
\end{eqnarray*}
(The variable names $m_1$ and $m_2$ in this proof are meant to suggest $m-1$ and $m-2$,
although subtraction has not been defined.)
I say  $ m_1 \neq {\bf 0}$.  Here is the proof:
\begin{eqnarray*}
 m_1 = {\bf 0} && \mbox{\qquad assumption} \\
  {\sf S} m_1 =   {\sf S} {\bf 0} && \mbox{\qquad by the previous line}\\
 {\sf S} m_1 = {\bf m}  && \mbox{\qquad by construction of $m_1$}\\
 {\bf m} = {\sf S} {\bf 0} && \mbox{\qquad by the preceding lines} \\
 {\bf k} \oplus {\sf S} {\bf 0} = {\bf n} && \mbox{\qquad since ${\bf k} + {\bf m} = {\bf n}$}\\
 {\sf S} ({\bf k} \oplus {\bf 0}) = {\bf n} && \mbox{\qquad by Lemma~\ref{lemma:ChurchAddition_equation}}\\
 {\sf S} {\bf k} = {\bf n} && \mbox{\qquad by Lemma~\ref{lemma:ChurchZero_equation}}\\
 {\sf S} ({\sf S} {\bf k}) = {\sf S} {\bf n} && \mbox{\qquad by the previous line}\\
 {\sf S} ({\sf S} {\bf k}) = {\sf S} {\bf k} && \mbox{\qquad since ${\sf S} {\bf n} = {\sf S} {\bf k}$}\\
 {\sf S} ({\sf S} {\bf k}) \neq {\sf S} {\bf k} && \mbox{\qquad by Lemma~\ref{lemma:snneqn}}
 \end{eqnarray*}
That contradiction completes the proof that $m_1 \neq {\bf 0}$.
\smallskip

Then by Lemma~\ref{lemma:predecessornotn},
there exists $m_2$  such that
\begin{eqnarray*}
{\sf S} m_2 = m_1 &&\\
m_2 \in {\mathbb N} \ \land \ m_2 \neq {\bf n} &&
\end{eqnarray*}
Then
\begin{eqnarray*}
m_1 \prec {\sf S} m_1   && \mbox{\qquad by Lemma~\ref{lemma:xprecsx}, since $m_1 \neq {\bf n}$}\\
{\sf S} m_2  \prec {\bf m}  && \mbox{\qquad since ${\sf S} m_2 = {\bf m}_1$ and ${\sf S} m_1 = {\bf m}$}
\end{eqnarray*}
 Since ${\sf S} m_2 \prec {\bf m}$ and $m_2 \neq {\bf n}$, we have
\begin{eqnarray}
 m_2  f \alpha = m_2{\sf S} \alpha &&\mbox{\qquad by (\ref{eq:E4424})}.\label{eq:4455}
 \end{eqnarray}
We also have
\begin{eqnarray*}
 {\sf S} ({\sf S}(p)) = {\sf S} {\bf n} = \alpha  && \mbox{\qquad by the definitions of $p$ and $\alpha$}\\
 {\bf m} {\sf S} \alpha = \alpha   && \mbox{\qquad by Lemma~\ref{lemma:smloop}}\\
{\sf S} ({\sf S}  m_2) {\sf S} \alpha = \alpha && \mbox{\qquad since ${\sf S}({\sf S} m_2) = {\bf m}$} \\
{\sf S} ({\sf S}  m_2) {\sf S} \alpha = {\sf S} {\bf n} && \mbox{\qquad since $\alpha = {\sf S} {\bf n}$}\\
{\sf S} ({\sf S} m_2 {\sf S} \alpha) = {\sf S} {\bf n} && \mbox{\qquad by Theorem~\ref{theorem:successorequation}}\\
({\sf S}  m_2) {\sf S} \alpha \in {\mathcal L}({\bf n}) && \mbox{\qquad by Lemma~\ref{lemma:xsmapsloop}}\\
({\sf S}  m_2) {\sf S} \alpha =  {\bf n} && \mbox{\qquad by Theorem~\ref{theorem:looponeone}}\\
({\sf S}  m_2) {\sf S} \alpha = {\sf S} p && \mbox{\qquad since ${\bf n} = {\sf S} p$}\\
{\sf S} ( m_2 {\sf S} \alpha) = {\sf S} p && \mbox{\qquad by Theorem~\ref{theorem:successorequation}}\\
m_s {\sf S} \alpha \in {\mathcal L}({\bf n}) && \mbox{\qquad by Lemma~\ref{lemma:xsmapsloop}}
\end{eqnarray*}
\begin{eqnarray}
\hspace{-20pt} m_2 {\sf S} \alpha = p &&\mbox{\qquad by Theorem~\ref{theorem:looponeone}} \label{eq:E4459}
\end{eqnarray}
\begin{eqnarray*}
 m_2 f \alpha = p  && \mbox{\qquad by (\ref{eq:4455}) and (\ref{eq:E4459})}\\
 f(m_2 f \alpha) = f(p) && \mbox{\qquad applying $f$ to both sides} \\
 ({\sf S} m_2) f(\alpha) = f(p) && \mbox{\qquad by Theorem~\ref{theorem:successorequation}}\\
 m_1  f \alpha = f(p) && \mbox{\qquad since ${\sf S} m_2 = m_1$} \\
 f(p) = \alpha && \mbox{\qquad by the definition of $f$}\\
  m_1  f \alpha = \alpha && \mbox{\qquad by the preceding two lines}\\
f( m_1 f \alpha) = f(\alpha) && \mbox{\qquad applying $f$ to both sides} \\
({\sf S} m_1) f \alpha = f(\alpha) && \mbox{\qquad by Theorem~\ref{theorem:successorequation}}\\
  {\bf m} f \alpha = f(\alpha) && \mbox{\qquad since ${\sf S} m_1 = {\bf m}$}\\
  {\sf S} ({\sf S} {\bf n}) \neq {\bf n}   && \mbox{\qquad by Lemma~\ref{lemma:ssnneqn}}\\
\alpha = p \ {\rightarrow}\  {\sf S} ({\sf S} {\bf n}) = {\bf n} &&\mbox{\qquad since $  {\sf S} {\bf n} = \alpha$ and ${\sf S} p = {\bf n} $}\\
\alpha \neq p  &&  \mbox{\qquad by the previous two lines} \\
f(\alpha) = {\sf S} \alpha &&\mbox{\qquad by definition of $f$, since $\alpha \neq p$} \\
{\bf m} f \alpha  = {\sf S} \alpha  && \mbox{\qquad since ${\bf m} f \alpha = f(\alpha)$} \\
{\sf S} \alpha  \neq \alpha  && \mbox{\qquad by Lemma~\ref{lemma:snneqn}} \\
{\bf m} f(\alpha) \neq \alpha  && \mbox{\qquad by the previous two lines} \\
{\bf m} f(\alpha) = \alpha  && \mbox{\qquad by the Annihilation Theorem}
  \end{eqnarray*}
That contradiction completes the proof of the theorem.

\section{${\mathbb N}$ not finite implies ${\mathbb N}$ is infinite}

In this section we will show that if ${\mathbb N}$ is not finite, then
${\mathbb N}$ is infinite, and indeed (what is more)
 Church successor is one-to-one on ${\mathbb N}$.
  Since we proved that the Church counting axiom implies
${\mathbb N}$ is not finite, it will follow that the Church counting axiom implies
${\mathbb N}$ is infinite and ${\sf S}$ is one-to-one.
\smallskip

That Church successor is one-to-one means ${\sf S} x = {\sf S} y \ {\rightarrow}\  x = y$.
That it is weakly one-to-one means $x \neq y \ {\rightarrow}\  {\sf S} x \neq {\sf S} y$.
One can check that if successor is weakly one-to-one, then ${\mathbb N}$ has
decidable equality (by induction, with Lemma~\ref{lemma:decidable0} as
the base case).  With decidable equality, weakly one-to-one implies one-to-one.
\smallskip

The idea of the proof can be explained simply.
We start at ${\bf 0}$ and make dots on our paper for $0,1,2,\ldots$.
At any moment the set of dots so far written is finite.  If we come to
a double successor (as shown in Fig.~\ref{figure:rho}),
 then we have a set that contains ${\bf 0}$ and
is closed under successor, so it is all of ${\mathbb N}$; but then ${\mathbb N}$ is finite,
so that cannot happen.  Instead we continue on indefinitely, i.e., successor
is one-to-one.

 To make that idea rigorous, we will define
 a relation ${\mathbb B}$, whose intended interpretation
 is that if $\langle \{x\},y \rangle \in {\mathbb B}$,
 then $y$ is the set of dots written down after $x$ steps
of the drawing process described above.  We use $\{x\}$ instead
of $x$ to achieve stratification.   The idea is to
define ${\mathbb B}$ in such a way that ${\mathbb B}$ is the least relation such that
\begin{eqnarray*}
&& \langle \{ {\bf 0} \}, \{{\bf 0}\} \rangle \in {\mathbb B}     \\
&& \forall x,y \in {\mathbb N}\,( \langle \{x\}, y \rangle \in {\mathbb B} \ {\rightarrow}\  {\sf S} x \not\in y \ {\rightarrow}\  \langle {\sf S} x, y \cup \{ {\sf S} x\} \rangle \in {\mathbb B})
\end{eqnarray*}
Of course, a proper definition cannot mention ${\mathbb B}$ on the right.  Here is
a proper definition:

\begin{definition} \label{definition:Jlift}
  ${\mathbb B}$ is the set
of all ordered pairs $\langle \{ p \}, q\rangle$ with $p,q \in {\mathbb N}$ such that $\langle \{ p\}, q\rangle$ belongs
  to every set $w$
satisfying the following conditions:
\begin{eqnarray*}
&& \langle \{ {\bf 0} \}, \{{\bf 0}\} \rangle \in w     \\
&& \forall x,y \in {\mathbb N}\,( \langle \{x\}, y \rangle \in w \ {\rightarrow}\  {\sf S} x \not\in y \ {\rightarrow}\  \langle \{ {\sf S} x\}, y \cup \{ {\sf S} x\} \rangle \in w)
\end{eqnarray*}
\end{definition}
The formula is stratified, giving $x$ index 0, $y$ index 1, so $\langle \{x\},y\rangle$
gets index 3; then $2$ gets index 4. ${\bf 0}$ is a parameter, so does not
need an  index, but we could give it index 0.  Either way, the formula is
stratified, so the definition can be given in INF.

\begin{lemma} \label{lemma:JLift0}
 $\langle \{{\bf 0}\}, \{ {\bf 0} \}\rangle \in {\mathbb B}$.
\end{lemma}

\noindent{\em Proof}. Immediate from the definition of ${\mathbb B}$.

\begin{lemma} \label{lemma:JLiftRec}

$$ \langle \{x\}, y \rangle \in {\mathbb B} \ {\rightarrow}\  {\sf S} x \neq y \ {\rightarrow}\
\langle \{{\sf S} x\}, y \cup \{ {\sf S} x\} \in {\mathbb B}.$$
\end{lemma}

\noindent{\em Proof}. Follows  from Definition~\ref{definition:Jlift}
in about 25 steps (omitted here).

\begin{lemma} \label{lemma:JLiftfinite}
 Suppose $\langle \{ x\}, y\rangle \in {\mathbb B}$.
Then $y \in {\sf FINITE}$ and $y \subseteq {\mathbb N}$ and $x \in {\mathbb N}$.
\end{lemma}

\noindent{\em Proof}.  Let $W$ be the set of members of ${\mathbb B}$ satisfying
the conditions in the lemma; explicitly,
$$W = \{\ \langle \{ x\}, y\rangle \in {\mathbb B}: y \in {\sf FINITE} \ \land \ y \subseteq {\mathbb N} \ \land \ x \in {\mathbb N}\ \}.$$
Then $W$ satisfies the closure
conditions in  Definition~\ref{definition:Jlift}:
\begin{eqnarray*}
\langle \{{\bf 0}\}, \{{\bf 0}\}\rangle \in W && \mbox{\qquad by
Lemma~\ref{lemma:JLift0}}\\
\{{\bf 0}\} \in {\sf FINITE} && \mbox{\qquad by Lemma~\sref{lemma:singletons_finite}}\\
y \cup \{ {\sf S} x \} \in {\sf FINITE} && \mbox{\qquad if ${\sf S} x \not\in y$, by
Lemma~\sref{lemma:finite_adjoin}}
\end{eqnarray*}
The details, omitted here, take about 90 steps.
Therefore $Z \subseteq W$.
That completes the proof of the lemma.

\begin{lemma} \label{lemma:JLiftMaps_helper}
Suppose $\langle \{x\}, y \rangle \in {\mathbb B}$. Then
\begin{eqnarray*}
&&{\bf 0} \in y \\
&& x \in y \\
&&\forall u\,(u \in y \ {\rightarrow}\  u \neq x \ {\rightarrow}\  {\sf S} x \in y)
\end{eqnarray*}
\end{lemma}

\noindent{\em Remark}.  The last condition, expressed
in words, is ``$y$ is closed under successor except $x$.''
\smallskip

\noindent{\em Proof}.  Let $W$ be defined as the
set of all $\langle \{x\},y \rangle \in {\mathbb B} $ such that
conditions of the lemma are satisfied.  Since the formulas in the lemma
are stratified, $W$ can be defined in INF.
 We will prove $W$ satisfies
the closure conditions in the definition of ${\mathbb B}$.

First, $\langle \{{\bf 0}\}, \{{\bf 0}\}\rangle \in W$; it
belongs to $Z$ by Lemma~\ref{lemma:JLift0}, and the other conditions
are straightforward.

Second, assume $\langle \{x\}, y\rangle \in W$ and ${\sf S} x \not \in y$.
We must show $\langle \{{\sf S} x\}, y \cup \{ {\sf S} x\} \rangle \in W$.
By Lemma~\ref{lemma:JLiftRec}, it belongs to ${\mathbb B}$.

Since $\langle \{x\}, y\rangle \in W$, we have ${\bf 0} \in y$.
Hence ${\bf 0} \in y \cup \{ {\sf S} x\}$.

By Lemma~\ref{lemma:JLiftfinite}, we have $y \in {\sf FINITE}$.
Then  $y \in {\sf DECIDABLE}$, by Lemma~\sref{lemma:finitedecidable}.
We have to show $y \cup \{{\sf S} x\}$
is closed under successor except ${\sf S} x$. Let $u \in y \cup \{ {\sf S} x\}$
with $u \neq {\sf S} x$.  Then $u \in y$.  Since $y \in {\sf DECIDABLE}$,
we have $u = x \ \lor\  u \neq x$.  If $u = x$ then ${\sf S} u = {\sf S} x \in y \cup \{ {\sf S} x\}$.
If $ u \neq x$ then ${\sf S} x \in y$ since $\langle \{x\}, y\rangle \in W$;
therefore ${\sf S} x \in y \cup \{{\sf S} x\}$ as well.
\smallskip

That completes the proof that $W$ satisfies the closure conditions.
That completes the proof of the lemma.

\begin{lemma}[No loops]\label{lemma:noloops}
Assume ${\mathbb N}$ is not finite.  Suppose $\langle \{x\}, y\rangle \in {\mathbb B}$.
Then ${\sf S} x \not \in y$.
\end{lemma}

\noindent{\em Proof}.  Suppose ${\sf S} x \in y$.  Then
\begin{eqnarray*}
{\bf 0} \in y  && \mbox{\qquad by Lemma~\ref{lemma:JLiftMaps_helper}}\\
u \in y \ {\rightarrow}\  u \neq x \ {\rightarrow}\  {\sf S} u \in y &&\mbox{\qquad by Lemma~\ref{lemma:JLiftMaps_helper}}\\
{\sf S} x \in y  && \mbox{\qquad by hypothesis}\\
y \in {\sf FINITE} && \mbox{\qquad by Lemma~\ref{lemma:JLiftfinite}}\\
y \in {\sf DECIDABLE} && \mbox{\qquad by Lemma~\sref{lemma:finitedecidable}}\\
x \in y          && \mbox{\qquad by Lemma~\ref{lemma:JLiftMaps_helper}} \\
u \in y \ {\rightarrow}\  u = x \ \lor \ u \neq x  &&\mbox{\qquad by the preceding lines}\\
u \in y \ {\rightarrow}\  {\sf S} u \in y  && \mbox{\qquad by the preceding lines}\\
{\mathbb N}  \subseteq y          && \mbox{\qquad by the definition of ${\mathbb N}$}\\
y \subseteq {\mathbb N}           && \mbox{\qquad by Lemma~\ref{lemma:JLiftfinite}}\\
y = {\mathbb N}                    && \mbox{\qquad by the preceding two lines}\\
{\mathbb N} \in {\sf FINITE}           && \mbox{\qquad since $y \in {\sf FINITE}$}
\end{eqnarray*}
But that contradicts the hypothesis.  That completes the  proof of the lemma.

\begin{lemma} \label{lemma:JLiftMaps}
Assume ${\mathbb N}$ is not finite.
Then
$$\forall x \in {\mathbb N}\, \exists y\,(\langle \{x\},y\rangle \in {\mathbb B}).$$
\end{lemma}

\noindent{\em Proof}.
The formula in the lemma is stratified, giving $x$ and $y$ index 0, since $Z$ is
a definable relation (occurring here as a parameter).  Therefore we
may prove it by induction on $x$.
\smallskip

Base case, $x = {\bf 0}$, holds by Lemma~\ref{lemma:JLift0}.
\smallskip

Induction step.  Suppose $\langle \{x\},y \rangle \in {\mathbb B}$.
By Lemma~\ref{lemma:noloops}, ${\sf S} x \not \in y$.
Then by Lemma~\ref{lemma:JLiftRec}, $\{{\sf S} x\}, y \cup \{{\sf S} x\} \in {\mathbb B}$.
That completes the induction step.  That completes the proof of the lemma.

\begin{lemma}\label{lemma:JLiftdom} Suppose $\langle \{   x \}, p \rangle \in {\mathbb B}$.   Then $x = {\bf 0}$,  or $x = {\sf S} u$ for some $u \in {\mathbb N}$.
\end{lemma}

\noindent{\em Proof}.  Define
$$Z := \{ \ \langle \{ x\}, p\rangle \in {\mathbb B} : x = {\bf 0} \ \lor \
\exists u \in {\mathbb N}\, ({\sf S} u = x) \}.$$
Then $Z$ satisfies the conditions in the definition of ${\mathbb B}$,
as one verifies in about 70 steps (here omitted).
Therefore ${\mathbb B} \subseteq Z$.  To finish the proof:
\begin{eqnarray*}
\langle \{   x \}, p \rangle \in {\mathbb B}  && \mbox{\qquad assumption}\\
 \langle \{   x \}, p \rangle \in Z && \mbox{\qquad since ${\mathbb B} \subseteq Z$}\\
 x = {\bf 0} \ \lor \
\exists u \in {\mathbb N}\, ({\sf S} u = x) && \mbox{\qquad by the definition of $Z$}
\end{eqnarray*}
The two resulting cases are just the conditions that $Z$ has been proved
to satisfy.  That completes the proof of the lemma.

\begin{lemma} \label{lemma:JLift1} Suppose $\langle \{ {\bf 0} \}, p \rangle \in {\mathbb B}$.   Then $p = \{ {\bf 0}\}$.
\end{lemma}

\noindent{\em Proof}.  Suppose $p \neq \{ {\bf 0}\}$.  Then define
$$Z:= {\mathbb B} - \{ \langle \{ {\bf 0} \}, p \rangle \}.$$
One can verify that $Z$ satisfies the closure
conditions in the definition of ${\mathbb B}$.  (It takes about 60 steps,
omitted here, using several of the lemmas above, including Lemmas~\ref{lemma:JLiftRec}
and \ref{lemma:JLiftdom}.)
Therefore ${\mathbb B} \subseteq  Z$.
But that is a contradiction.  Therefore $ \neg\neg\, p = \{{\bf 0}\}$.
Now
\begin{eqnarray*}
p \in {\sf FINITE} && \mbox{\qquad by Lemma~\ref{lemma:JLiftfinite}}\\
p \in {\sf DECIDABLE} && \mbox{\qquad by Lemma~\sref{lemma:finitedecidable}}\\
{\bf 0} \in p && \mbox{\qquad by Lemma~\ref{lemma:JLiftMaps_helper}}\\
 \neg\neg\, \forall u \in p\,
( u = {\bf 0})   && \mbox{\qquad since $ \neg\neg\, p = \{{\bf 0}\}$}\\
 \forall u \in p\, (\neg\neg\,
( u = {\bf 0}))  && \mbox{\qquad by intuitionistic logic}\\
\forall u \in p\,
( u = {\bf 0})  && \mbox{\qquad since $p \in {\sf DECIDABLE}$}\\
p = \{ {\bf 0}\} && \mbox{\qquad by the preceding line and ${\bf 0} \in p$}
\end{eqnarray*}
That completes the proof of the lemma.

\begin{lemma} \label{lemma:JLift2} Suppose $x \in {\mathbb N}$ and
$\langle \{ {\sf S} x\}, y \rangle \in {\mathbb B}$.
Then there exist $u$ and $p$ such that
\begin{eqnarray*}
&& {\sf S} x = {\sf S} u  \\
&& \langle \{ u\}, p \rangle \in {\mathbb B} \\
&& {\sf S} u \not \in p     \\
&& y = p \cup \{ {\sf S} u\}
\end{eqnarray*}
\end{lemma}

\noindent{\em Remark}.  The point of the lemma (and the preceding one)
is that everything
in ${\mathbb B}$ is in ${\mathbb B}$ because it has been constructed according to
the two construction rules in the definition.
\medskip

\noindent{\em Proof}.  Define
\begin{eqnarray*}
Z:= \{\ z \in {\mathbb B} : && z = \langle \{{\bf 0}\},\{{\bf 0}\}\rangle \ \lor \\
 && (\exists x,y\,(x \in {\mathbb N} \ \land \ z = \langle \{{\sf S} x\},y\rangle) \ \land \\
 && (\forall x,y\,(x \in {\mathbb N} \ {\rightarrow}\   z = \langle \{{\sf S} x\},y\rangle) \ {\rightarrow}\  \\
&& \exists u,p\,( \langle \{ u\}, p\rangle \in {\mathbb B} \ \land \ x \in {\mathbb N} \ \land \ u \in {\mathbb N} \ \land \\
&& {\sf S} u = {\sf S} x \ \land \ {\sf S} u \not \in p \ \land \ y = p \cup \{{\sf S} u\}) \ \}
\end{eqnarray*}
The formula is stratified, giving $x$ and $u$ index 0, and $y$ and $p$ index 1.
Then the ordered pairs are pairs of type 1 objects, so they get type 3.
So $z$ gets index 3, and ${\mathbb B}$ is a parameter.  Therefore the definition
is legal in INF.

Then one can verify that $Z$ satisfies the closure conditions in
the definition of ${\mathbb B}$.  (It takes about 110 steps, omitted here.)
There are several variations of the definition of $Z$ that
look equally convincing but are in fact not correct.  Once the definition
is correct, the 110 steps mentioned are fairly straightforward.
\smallskip

Having derived that $Z$ satisfies the closure conditions, we have
${\mathbb B} \subseteq Z$, by definition of ${\mathbb B}$.  Now suppose $x \in {\mathbb N}$
and $\langle \{{\sf S} x\}, y \rangle \in {\mathbb B}$.  Then since ${\mathbb B} \subseteq Z$
we have $\langle \{{\sf S} x\}, y \rangle \in Z$.  Substituting
$\langle \{{\sf S} x\}, y \rangle$ for $z$ in the definition of $Z$,
the disjunction on the right of the definition gives rise to two cases.
\smallskip

Case~1, $\langle \{{\sf S} x\}, y \rangle   =
\langle \{{\bf 0}\},\{{\bf 0}\}\rangle$.
Then
\begin{eqnarray*}
\{ {\sf S} x\} = \{ {\bf 0}\}  && \mbox{\qquad by Lemma~\sref{lemma:ordered_pair_equality}}\\
{\sf S} x = {\bf 0}  && \mbox{\qquad by Lemma~\sref{lemma:single_oneone}}\\
x \in {\mathbb N}           && \mbox{\qquad by hypothesis}\\
{\sf S} x \neq {\bf 0} && \mbox{\qquad by Theorem~\ref{theorem:successoromitszero}}
\end{eqnarray*}
That disposes of Case~1.   (Note the necessity of including $x \in {\mathbb N}$ as a
hypothesis of the lemma; we cannot rule out the strange possibility that
${\sf S} x$ might be ${\bf 0}$ for some $x$ that is not a Church number.)
\smallskip

Case~2, the other disjunction of the definition of $Z$ holds with
$z:= \langle \{{\sf S} x\}, y \rangle$.  Then it is a straightforward
ten steps (which we omit here) to deduce the conclusion of the lemma.
That completes the proof of the lemma.

\begin{definition} \label{definition:comparable}
Two subsets $x$ and $y$ of ${\mathbb N}$ are {\bf comparable}:
$$  \comp(x,y) :=  x \subseteq {\mathbb N} \ \land \ y \subseteq {\mathbb N}  \ \land \ \neg\neg\, (x \subseteq y  \ \lor \ y \subseteq x).$$
\end{definition}

\noindent{\em Remark}.  Comparability is symmetric and reflexive, but not
 transitive.  Perhaps this would have worked without the double negation,
 but it certainly does work with the double negation.
\smallskip

\begin{lemma}\label{lemma:JFUNC_helper2}
Suppose $\langle \{x\}, y \rangle \in {\mathbb B}$ and
$y$ is comparable to every element in the rangle of ${\mathbb B}$ and
$$\forall z\,\langle \{x\}, z \rangle \in {\mathbb B} \ {\rightarrow}\  y = z.$$
Then $y \cup \{{\sf S} x\}$ is comparable to every element in the
range of ${\mathbb B}$.
\end{lemma}

\noindent{\em Remark}. Functionality at $\{x\}$ and comparability at $y$
imply comparability at $y \cup \{{\sf S} x\}$.
\medskip

\noindent{\em Proof}.  Suppose
 $\langle \{x\}, y\rangle \in {\mathbb B}$
 and $\langle \{ u\}, p\rangle \in {\mathbb B}$.
Then $ \comp (y,p)$, by the first hypothesis.  We must show
$ \comp (y \cup \{ {\sf S} x\}, p)$.  It suffices to prove it from
$$ x = u \ \lor  x \neq u \ {\rightarrow}\  y \subseteq p \ \lor \ p \subseteq y \ {\rightarrow}\   \comp (y \cup \{ {\sf S} x\}, p),$$
since double-negating that statement yields the desired
$$ \comp(y,p) \ {\rightarrow}\  \comp (y \cup \{ {\sf S} x\}, p).$$
Therefore we may assume
\begin{eqnarray}
x = u \ \lor  x \neq u  && \mbox{\qquad assumption} \label{eq:E5477}\\
 y \subseteq p \ \lor \ p \subseteq y && \mbox{\qquad assumption}\nonumber
\end{eqnarray}
We argue by cases accordingly to prove $\comp (y \cup \{ {\sf S} x\}, p)$.
\smallskip

Case~1, $p \subseteq y$.  Then $p \subseteq y \cup \{ {\sf S} x\}$, done.
\smallskip

Case~2. $y \subseteq p$. Then
\begin{eqnarray}
x \in y  && \mbox{\qquad by Lemma~\ref{lemma:JLiftMaps_helper}}\nonumber\\
x \in p  && \mbox{\qquad since $y \subseteq p$\nonumber}\\
x \neq u \ {\rightarrow}\  {\sf S} x \in p && \mbox{\qquad by Lemma~\ref{lemma:JLiftMaps_helper}}\nonumber\\
x \neq u \ {\rightarrow}\  y \cup \{{\sf S} x\} \subseteq p && \mbox{\qquad since $y \subseteq p$} \label{eq:E5491}\\
x = u \ \lor  x \neq u && \mbox{\qquad by (\ref{eq:E5477})} \nonumber
\end{eqnarray}
We argue by cases accordingly.
\smallskip

Case~1, $x = u$.
  Then $\langle \{x\}, y \rangle \in {\mathbb B}$ and
$\langle \{x\}, p\rangle \in {\mathbb B}$.  So by hypothesis $y = p$.  Then
$p \subseteq y \cup \{ {\sf S} x\}$, so $\comp(y,p)$.
\smallskip

Case~2, $x \neq u$.  Then
\begin{eqnarray*}
y \cup \{{\sf S} x\} \subseteq p && \mbox{\qquad by (\ref{eq:E5491})}\\
\comp(y \cup \{{\sf S} x\}, p    && \mbox{\qquad by the definition of $\comp$ and logic}
\end{eqnarray*}
That completes the proof of the lemma.

\begin{lemma}\label{lemma:JFUNC_helper3}
Assume ${\mathbb N} \not\in {\sf FINITE}$.
Suppose $x \in {\mathbb N}$ and
\begin{eqnarray}
&&\langle \{x\}, y \rangle \in {\mathbb B}  \nonumber\\
&&\forall t,u\,(\langle\{t\},u\rangle \in {\mathbb B} \ {\rightarrow}\  \comp(y,u) \label{eq:comparability} \\
&& \forall z\,\langle \{x\}, z \rangle \in {\mathbb B} \ {\rightarrow}\  y = z  \label{eq:functionality}\\
&& \forall t,u\, (\langle \{t\},u\rangle \in {\mathbb B} \ {\rightarrow}\  t = x \ \lor \ t \neq x)
                                                   \label{eq:domaindecidability} \\
&& \langle \{{\sf S} x\},u\rangle \in {\mathbb B}   \nonumber \\
&&  \langle \{{\sf S} x\}, v \rangle \in {\mathbb B}. \label{eq:E5521}
  \end{eqnarray}
 Then $u=v$.
\end{lemma}

\noindent{\em Remark}. It may help to attach names to the formulas.

(\ref{eq:comparability}) is ``comparability''.

(\ref{eq:functionality}) is ``functionality''.

(\ref{eq:domaindecidability}) is ``domain decidability''.

\noindent
Then the lemma says:
Functionality at $\{x\}$ and domain decidability at $x$
 and comparability at $y$
imply functionality at $\{ {\sf S} x \}$.
\medskip

\noindent{\em Proof}.
\begin{eqnarray*}
u = p \cup  \{{\sf S} t \}  \ \land \ {\sf S} t = {\sf S} x \ \land \ \langle \{t\}, p \rangle \in {\mathbb B}  && \mbox{\qquad by Lemma~\ref{lemma:JLift2}}\\
v = q \cup \{{\sf S} r \}  \ \land \ {\sf S} r = {\sf S} x \ \land \ \langle \{r\}, q \rangle \in {\mathbb B}  && \mbox{\qquad by Lemma~\ref{lemma:JLift2}}\\
\langle \{{\sf S} x\}, y \cup \{{\sf S} x\} \rangle \in {\mathbb B} && \mbox{\qquad by Lemma~\ref{lemma:JLiftRec}}\\
\langle \{x\}, y \rangle \in {\mathbb B} && \mbox{\qquad by hypothesis}\\
{\sf S} x \not\in y && \mbox{\qquad by Lemma~\ref{lemma:noloops}, since ${\mathbb N} \not\in {\sf FINITE}$}\\
\comp(y,p)  && \mbox{\qquad by hypothesis, since $\langle \{t\}, p \rangle \in {\mathbb B} $ }
\end{eqnarray*}
By Lemma~\ref{lemma:JLiftMaps_helper}, $y$ is closed under successor except $x$,
and $p$ is closed under successor except $t$, and
$q$ is closed under successor except $r$.  Explicitly,
\begin{eqnarray}
\forall z \in y\, (z \neq x \ {\rightarrow}\  {\sf S} z \in y) \label{eq:E5339}  \\
\forall z \in p\, (z \neq t \ {\rightarrow}\  {\sf S} z \in p) \label{eq:E5340} \\
\forall z \in q\, (z \neq r \ {\rightarrow}\  {\sf S} z \in q) \label{eq:E5341}
\end{eqnarray}
\smallskip

Now I say that
\begin{eqnarray}
 t = x  \label{eq:E5538}
\end{eqnarray}
By (\ref{eq:domaindecidability}), we have $t \in x \ \lor \ t \neq x$.
In case $t = x$, we have (\ref{eq:E5538}) immediately; so we may
assume
\begin{eqnarray}
  t \neq x  \label{eq:E5547}
\end{eqnarray}
We must derive a contradiction.
I say that $t \not \in y$:
\begin{eqnarray*}
t \in y  && \mbox{\qquad assumption, for contradiction}\\
{\sf S} t \in y && \mbox{\qquad by (\ref{eq:E5339}) and (\ref{eq:E5547})} \\
{\sf S} x \in y &&\mbox{\qquad since ${\sf S} x = {\sf S} t$}\\
{\sf S} x \not \in y && \mbox{\qquad as shown above}
\end{eqnarray*}
Therefore $t \not\in y$, as claimed.
Similarly $x \not \in p$.
We have
\begin{eqnarray*}
t \in p  && \mbox{\qquad by Lemma~\ref{lemma:JLiftMaps_helper}} \\
\neg\,(p \subseteq y) && \mbox{\qquad since $t \not \in y$}\\
x \in y  && \mbox{\qquad by Lemma~\ref{lemma:JLiftMaps_helper}} \\
\neg\,(y \subseteq p) && \mbox{\qquad since $x \not \in p$} \\
\neg\, (p \subseteq y \ \lor \ y \subseteq p)  && \mbox{\qquad by logic}\\
\neg\, (y \subseteq p \ \lor \ p \subseteq y)  && \mbox{\qquad by logic}\\
\neg\, \comp(y,p) && \mbox{\qquad by the definition of $\comp$}
\end{eqnarray*}
But we have derived $\comp(y,p)$ above. That
contradiction completes the proof of (\ref{eq:E5538}), namely $ t = x$.
\smallskip

Proceeding, we have
\begin{eqnarray*}
\langle \{x\},y \rangle \in {\mathbb B} && \mbox{\qquad by hypothesis}\\
\langle \{t\},p \rangle \in {\mathbb B} && \mbox{\qquad derived above} \\
\langle \{x\},p \rangle \in {\mathbb B} && \mbox{\qquad since $t = x$}\\
 y = p  && \mbox{\qquad by the functionality hypothesis}
\end{eqnarray*}
Interchanging $r$ for $t$ and $q$ for $p$,  and using (\ref{eq:E5341})
instead of (\ref{eq:E5340}), we similarly derive
$r=x$ and $y = q$.  Then $t = r$, since both are equal to $x$,
and $p = q$, since both are equal to $y$.
Then $u = v$, since
$$ u = p \cup \{ {\sf S} t\} = q \cup \{ {\sf S} r \} = v.$$
That completes the proof of the lemma.

\begin{lemma}\label{lemma:JFUNC_helper4}
Assume ${\mathbb N} \not\in {\sf FINITE}$.
Suppose $x \in {\mathbb N}$ and  $\langle \{x\}, y \rangle \in {\mathbb B}$ and
\begin{eqnarray*}
&&\forall t,u\,(\langle\{t\},u\rangle \in {\mathbb B} \ {\rightarrow}\  \comp(y,u))  \\
&& \forall z\,\langle \{x\}, z \rangle \in {\mathbb B} \ {\rightarrow}\  y = z  \\
&& \forall t,u\, (\langle \{t\},u\rangle \in {\mathbb B} \ {\rightarrow}\  t = x \ \lor \ t \neq x)
                                                   \label{eq:domaindecidability2} \\
&& \langle \{{\sf S} x\},u\rangle \in {\mathbb B}
  \end{eqnarray*}
 Then
$$ \forall t,q\,( \langle\{t\},q \rangle \in {\mathbb B} \ {\rightarrow}\  {\sf S} x = t \lor {\sf S} x \neq  t).$$
\end{lemma}

\noindent{\em Remark}.  This lemma adds to Lemma~\ref{lemma:JFUNC_helper3}
by extending ``domain decidability'' from $x$ to ${\sf S} x$.
\medskip

\noindent{\em Proof}.
\begin{eqnarray*}
\langle\{t\},q \rangle \in {\mathbb B}  && \mbox{\qquad assumption} \\
\langle \{x\}, y \rangle \in {\mathbb B} &&\mbox{\qquad hypothesis} \\
{\sf S} x \not \in y && \mbox{\qquad by Lemma~\ref{lemma:noloops}}\\
\langle \{{\sf S} x\}, y \cup \{ {\sf S} x\} \rangle \in {\mathbb B} &&\mbox{\qquad by Lemma~\ref{lemma:JLiftRec}}\\
t \in {\mathbb N}  && \mbox{\qquad by Lemma~\ref{lemma:JLiftfinite}}\\
x \in {\mathbb N}  && \mbox{\qquad by Lemma~\ref{lemma:JLiftfinite}} \\
\langle \{{\sf S} x\}, z  \rangle \in {\mathbb B} \ {\rightarrow}\  z = y \cup\{{\sf S} x\} &&
    \mbox{\qquad by Lemma~\ref{lemma:JFUNC_helper3}}
\end{eqnarray*}

By Lemma~\ref{lemma:decidable0}, $t = {\bf 0} \ \lor\
t \neq {\bf 0}$.  We argue by cases accordingly.
\smallskip

Case~1, $t= {\bf 0}$.  Then  ${\sf S} x \neq t$, by
Theorem~\ref{theorem:successoromitszero}.  That completes Case~1.
\smallskip

Case~2, $t \neq {\bf 0}$.  Then
\begin{eqnarray*}
t = {\sf S} m && \mbox{\qquad for some $m \in {\mathbb N}$, by Lemma~\ref{lemma:predecessor}}\\
\langle\{{\sf S} m\},q \rangle \in {\mathbb B}&& \mbox{\qquad since
$\langle\{t\},q \rangle \in {\mathbb B}$}\\
m = x \ \lor \ m \neq x && \mbox{\qquad by (\ref{eq:domaindecidability2})}
\end{eqnarray*}

Case~2a, $m = x$. Then  ${\sf S} x = {\sf S} m$, so we are done.
\smallskip

Case~2b, $m \neq x$.  I say that ${\sf S} x \neq {\sf S} m$.  Suppose
${\sf S} x = {\sf S} m$. Then
\begin{eqnarray*}
\langle\{{\sf S} m\},q \rangle \in {\mathbb B} && \\
\langle\{{\sf S} x\},q \rangle \in {\mathbb B} && \mbox{\qquad since ${\sf S} x = {\sf S} m$}\\
\langle \{{\sf S} x\}, y \cup \{ {\sf S} x\}\rangle \in {\mathbb B} &&\\
q = y \cup \{{\sf S} x\} && \mbox{\qquad by Lemma~\ref{lemma:JFUNC_helper3}}\\
\langle\{x\},y \rangle\in {\mathbb B} && \mbox{\qquad by hypothesis}\\
\langle\{m\}, u \rangle \in {\mathbb B} && \mbox{\qquad for some $u \in{\mathbb N}$,
                 by Lemma~\ref{lemma:JLiftMaps}} \\
m \in u    && \mbox{\qquad by Lemma~\ref{lemma:JLiftMaps_helper}}\\
{\sf S} m \not \in u && \mbox{\qquad by Lemma~\ref{lemma:noloops}}\\
\langle\{{\sf S} m\}, u \cup \{{\sf S} m\} \rangle\in {\mathbb B} && \mbox{\qquad by Lemma~\ref{lemma:JLiftRec}}\\
\langle\{{\sf S} x\}, u \cup \{{\sf S} x\} \rangle\in {\mathbb B} && \mbox{\qquad  since ${\sf S} x = {\sf S} m$}\\
u \cup \{{\sf S} x \} = y \cup \{{\sf S} x\} && \mbox{\qquad by Lemma~\ref{lemma:JFUNC_helper3}}\\
{\sf S} x \not \in y && \mbox{\qquad by Lemma~\ref{lemma:noloops}, since $\langle\{x\},y \rangle\in {\mathbb B}$}\\
{\sf S} m \not \in u && \mbox{\qquad by Lemma~\ref{lemma:noloops}, since $\langle\{m\}, u \rangle \in {\mathbb B}$}\\
{\sf S} x \not \in u  && \mbox{\qquad since ${\sf S} x = {\sf S} m$}\\
u = y  && \mbox{\qquad since $u \cup \{{\sf S} x \} = y \cup \{{\sf S} x\} $ }\\
m \in y && \mbox{\qquad since $m \in u$ and $u = y$}\\
\forall q \in y\,(q \neq x \ {\rightarrow}\  {\sf S} q \in y) && \mbox{\qquad by Lemma~\ref{lemma:JLiftMaps_helper}, since $\langle\{x\},y\rangle \in {\mathbb B}$}\\
{\sf S} m \in y  && \mbox{\qquad since $m \neq x$ and $m \in y$}\\
{\sf S} x \in y  && \mbox{\qquad since ${\sf S} x = {\sf S} m$} \\
{\sf S} x \not \in y && \mbox{\qquad as proved above, by  Lemma~\ref{lemma:noloops}}
\end{eqnarray*}
That contradiction completes the proof that ${\sf S} x \neq {\sf S} m$.
That completes Case~2b.  That completes Case~2.  That completes
the proof of the lemma.
\medskip

Now we are in a position to prove ${\mathbb B}\in {\sf FUNC}$; that is,
the value $y$ such that $\langle \{{\sf S} x\},y \rangle \in {\mathbb B}$
is uniquely determined by ${\sf S} x$.  We prove this property
simultaneously with the property that equality is decidable between
$x$ and any element of the domain of ${\mathbb B}$, and $y$ is comparable
to any element of the range of ${\mathbb B}$.  The last three lemmas
together have the information needed to carry out the induction step.%
\footnote{If any readers think  this proof is too complicated, I can
assure them there are several simpler ``proofs'' that are not correct.
This one may be complicated, but it {\em is} correct. It is, however,
annoying that the picture is so much simpler than the proof.  At least
a part of the problem is that we do not have decidability of equality on
${\mathbb N}$ at this point.
}

 \begin{lemma}\label{lemma:JLiftFUNC}
Assume ${\mathbb N} \not\in {\sf FINITE}$.  Then ${\mathbb B}$ is a functional relation,
in the sense that if $\langle \{ x\}, y \rangle \in {\mathbb B}$
and $\langle\{ x\}, z\rangle \in {\mathbb B}$, then $y = z$.
\end{lemma}

\noindent{\em Proof}.  As described above,  we actually prove a more
complicated proposition.  Namely, the conjunction of these three:
\begin{eqnarray*}
\mbox{functionality}&& \forall y,z\, \langle \{ x\}, y \rangle \in {\mathbb B} \ {\rightarrow}\
 \langle\{ x\}, z\rangle \in {\mathbb B} \ {\rightarrow}\  y = z  \\
\mbox{domain decidability}&& \forall y,p,t\, \langle \{x\},y \rangle \in {\mathbb B} \ {\rightarrow}\
 \langle\{ t\}, p\rangle \in {\mathbb B} \ {\rightarrow}\  x = t \ \lor \ x \neq t  \\
\mbox{comparability} &&  \forall y,p,t\, \langle \{x\},y \rangle \in {\mathbb B} \ {\rightarrow}\
 \langle\{ t\}, p\rangle \in {\mathbb B} \ {\rightarrow}\  \comp(y,p)
\end{eqnarray*}
These formulas are all stratified, giving $x$ and $t$ index 0 and $y$, $z$, and $p$
index 1.  Therefore we may proceed by induction.
\smallskip

Base case, $x = {\bf 0}$.  By Lemma~\ref{lemma:JLift1},
we have $\langle \{ {\bf 0} \}, y \rangle \in {\mathbb B}$ if
and only if $y = \{ {\bf 0} \}$.  That takes care of
functionality when $x = {\bf 0}$. By Lemma~\ref{lemma:decidable0},
we have $t \in {\mathbb N} \ {\rightarrow}\  {\bf 0} = t \ \lor \ {\bf 0} \neq t$.
That takes care of domain decidability when $x = {\bf 0}$.
To prove comparability, it suffices by Lemma~\ref{lemma:JLift1}
to prove that $\{ {\bf 0}\}$ is comparable to any $y$ such
that $\langle\{ x\}, y\rangle \in {\mathbb B}$ for some $x,y$.  But
any such $y$ contains ${\bf 0}$, by Lemma~\ref{lemma:JLiftMaps_helper}.
Therefore $\{ {\bf 0}\} \subseteq y$. Therefore $\comp(\{{\bf 0}\},y)$.
That completes the base case.
\smallskip

Induction step.  We will use the three
lemmas \ref{lemma:JFUNC_helper2}, \ref{lemma:JFUNC_helper3},
and \ref{lemma:JFUNC_helper4} to carry out the induction step.
We will spell out the logic explictly here.  To that end,
let $A$, $B$, and $C$ be the three sets, respectively, of $x$
satisfying functionality, domain decidability, and comparability,
as explicitly written about above.  Let $Z:= A \cap B \cap C$.
 Then the induction hypotheses
is $x \in X$.  We have
\begin{eqnarray*}
x \in Z \ {\rightarrow}\  {\sf S} x \in A &&\mbox{\qquad by Lemma~\ref{lemma:JFUNC_helper3}}\\
x \in Z \ {\rightarrow}\  {\sf S} x \in B &&\mbox{\qquad by Lemma~\ref{lemma:JFUNC_helper4}}\\
x \in Z \ {\rightarrow}\  {\sf S} x \in A  \ {\rightarrow}\  {\sf S} x \in C &&\mbox{\qquad by Lemma~\ref{lemma:JFUNC_helper2}}
\end{eqnarray*}
Combining these three implications, we have $x \in Z \ {\rightarrow}\  {\sf S} x \in Z$.
Note that the induction step for $A$ is used again in proving
the induction step for $C$.  Let us look at that part of the argument,
i.e., at the third implication listed above.
\begin{eqnarray*}
\langle \{{\sf S} x\},y \rangle \in {\mathbb B} && \mbox{\qquad assumption}\\
\langle \{ t\}, p \rangle \in {\mathbb B}  && \mbox{\qquad assumption} \\
\langle \{ x\}, u \rangle \in {\mathbb B}  && \mbox{\qquad for some $u$, by Lemma~\ref{lemma:JLiftMaps}}\\
\langle \{{\sf S} x\}, u \cup \{ {\sf S} x\}\rangle && \mbox{\qquad by Lemma~\ref{lemma:JLiftRec}}
\end{eqnarray*}
and we have to prove $\comp(y,p)$. We have
\begin{eqnarray*}
{\sf S} x \not \in u && \mbox{\qquad by Lemma~\ref{lemma:noloops}}
\end{eqnarray*}
Then the crucial step is
\begin{eqnarray*}
y = u \cup \{{\sf S} x\}
\end{eqnarray*}
which comes from the induction step for functionality, i.e. ${\sf S} x \in A$.
Then we have
\begin{eqnarray*}
\forall z\,(\langle \{x\},z\rangle \in {\mathbb B} \ {\rightarrow}\  u = z) && \mbox{\qquad since $x \in A$}\\
\forall r,p\,(\langle \{r\},p \rangle \in {\mathbb B} \ {\rightarrow}\  \comp(u,p) && \mbox{\qquad since $x \in C$} \\
\comp ( u \cup \{{\sf S} x\},p) && \mbox{\qquad by Lemma~\ref{lemma:JFUNC_helper2}} \\
\comp (y,p)  && \mbox{\qquad since $y = u \cup \{{\sf S} x\}$}
\end{eqnarray*}
That is the desired goal of the third implication.
\smallskip

 The first two implications are
straightforward applications of the lemmas; they take about
100 ``bookkeeping'' steps, which we omit here.
 That completes the proof of the lemma.
\smallskip

\noindent{\em Remark}.  The original plan was to prove that
  ${\mathbb B}$ is the graph of a function, and then introduce
 the function itself by a comprehension term, so that
 \begin{eqnarray*}
 {\mathcal J}(\{{\bf 0}\}) = \{{\bf 0}\} \\
  {\mathcal J}(\{{\sf S} x\}) = {\mathcal J}(x) \cup \{ {\sf S} x\}
\end{eqnarray*}
That is now easily done; but we do not do it, because from this
point we can reach the main theorem directly from ${\mathbb B}$.

\begin{theorem}\label{theorem:Churchsuccessorweaklyoneone}
Suppose ${\mathbb N}$ is not finite.  Then Church successor is weakly one-to-one on ${\mathbb N}$,
in the sense that $$ x \neq y \ {\rightarrow}\  {\sf S} x \neq {\sf S} y,$$
and ${\mathbb N}$ is (therefore) infinite.
\end{theorem}

\noindent{\em Proof}.  Suppose $x \in {\mathbb N}$ and $t \in {\mathbb N}$ and ${\sf S} x = {\sf S} t$.
and $x \neq t$.  We must derive a contradiction.  We have
\begin{eqnarray*}
\langle \{ x\}, y \rangle \in {\mathbb B} && \mbox{\qquad for some $y$, by Lemma~\ref{lemma:JLiftMaps}}\\
{\sf S} x \not \in y && \mbox{\qquad by Lemma~\ref{lemma:noloops}} \\
\langle \{ {\sf S} x\}, y \cup \{{\sf S} x\} \rangle \in {\mathbb B}
                     && \mbox{\qquad by Lemma~\ref{lemma:JLiftRec}}\\
\langle \{ t\}, p \rangle \in {\mathbb B} && \mbox{\qquad for some $p$, by Lemma~\ref{lemma:JLiftMaps}}\\
{\sf S} t \not \in p && \mbox{\qquad by Lemma~\ref{lemma:noloops}} \\
\langle \{ {\sf S} t\}, p \cup \{{\sf S} t\} \rangle \in {\mathbb B}
                     && \mbox{\qquad by Lemma~\ref{lemma:JLiftRec}}\\
\langle \{ {\sf S} x\}, p \cup \{{\sf S} x\} \rangle \in {\mathbb B}
                     && \mbox{\qquad since ${\sf S} t = {\sf S} x$}\\
{\sf S} x \in {\mathbb N}          && \mbox{\qquad by Lemma~\ref{lemma:successorN}}\\
{\sf S} t \in {\mathbb N}           && \mbox{\qquad by Lemma~\ref{lemma:successorN}}\\
p \cup \{{\sf S} x\} = y \cup \{{\sf S} x\}  && \mbox{\qquad by Lemma~\ref{lemma:JLiftFUNC}}\\
{\sf S} x \not\in p        && \mbox{\qquad since ${\sf S} t \not \in p$ and ${\sf S} x = {\sf S} t$}\\
{\sf S} x \not \in y       && \mbox{\qquad  proved above }\\
p = y                && \mbox{\qquad by the preceding three lines}
\end{eqnarray*}
Now by Lemma~\ref{lemma:JLiftMaps_helper},
$y$ is closed under successor except $x$, and
$p$ is closed under successor except $t$.  Explicitly,
\begin{eqnarray*}
\forall u \in y\,(u \neq x \ {\rightarrow}\  {\sf S} u \in y) && \mbox{\qquad by Lemma~\ref{lemma:JLiftMaps_helper}}\\
\forall u \in p\,(u \neq t \ {\rightarrow}\  {\sf S} u \in p) && \mbox{\qquad by Lemma~\ref{lemma:JLiftMaps_helper}}\\
y \in {\sf FINITE}      && \mbox{\qquad by Lemma~\ref{lemma:JLiftfinite}}\\
y \in   {\sf DECIDABLE}   &&\mbox{\qquad by Lemma~\sref{lemma:finitedecidable}} \\
x \in y   && \mbox{\qquad by Lemma~\ref{lemma:JLiftMaps_helper}}\\
x \in p   && \mbox{\qquad since $y=p$}\\
t \in y   && \mbox{\qquad since $t \in p$ and $y = p$}\\
{\bf 0} \in y && \mbox{\qquad by Lemma~\ref{lemma:JLiftMaps_helper}}\\
t = x \ \lor \ t \neq x && \mbox{\qquad since $y \in {\sf DECIDABLE}$} \\
\end{eqnarray*}
Now I say that $y$ is closed under successor.  To prove that,
suppose $u \in y$.   We have to prove ${\sf S} u \in y$.
Since $y \in {\sf DECIDABLE}$, we have
$$ u = x \ \lor u \neq x.$$
We argue by cases accordingly.
\smallskip

Case~1, $u = x$.   Then
\begin{eqnarray*}
x \neq t && \mbox{\qquad by hypothesis}\\
p = y    && \mbox{\qquad proved above}\\
{\sf S} x \in y  && \mbox{\qquad since $p$ is
closed under successor except $t$ and $y=p$}
\end{eqnarray*}
That completes Case~1.
\smallskip

Case~2, $u \neq x$.  Since $y$ is closed under successor except $x$,
we have ${\sf S} u \in y$.  That completes Case~2.
That completes the proof that $y$ is closed under successor.
\smallskip

Now we have proved that $y$ contains ${\bf 0}$ and is closed
under successor.  By definition of ${\mathbb N}$, we have ${\mathbb N} \subseteq y$.
By Lemma~\ref{lemma:JLiftfinite}, we have $ y \subseteq {\mathbb N}$.  Hence $y = {\mathbb N}$.
But $y \in {\sf FINITE}$ and ${\mathbb N} \not \in {\sf FINITE}$.  That contradiction
completes the proof of the theorem.

 \begin{corollary} \label{lemma:oneoneimpliesdecidableequality}
If ${\mathbb N}$ is not finite, then ${\mathbb N}$ has decidable equality.
\end{corollary}

\noindent{\em Proof}.
 We prove by induction on $x$
that
\begin{eqnarray}
 \forall y \in {\mathbb N}\,( x = y \ \lor \ x \neq y).\label{eq:E3930}
 \end{eqnarray}
The base case is Lemma~\ref{lemma:decidable0}.
For the induction step, the induction hypothesis is (\ref{eq:E3930}).
We have to prove ${\sf S} x = y \ \lor \ {\sf S} x \neq y$.
Let $y \in {\mathbb N} $ be given.
By Lemma~\ref{lemma:decidable0}, $y = 0 \ \lor \ y \neq 0$.
If $y = 0$ then we are done by Lemma~\ref{lemma:decidable0}
(or by Theorem~\ref{theorem:successoromitszero}),
so we may assume $y \neq 0$.  Then by Lemma~\ref{lemma:predecessor},
$y = {\sf S} z$ for some $z \in {\mathbb N}$.
Then we have to prove ${\sf S} x = {\sf S} z \ \lor \ {\sf S} x \neq {\sf S} z$.
By (\ref{eq:E3930}), we have
$x = z \ \lor x \neq z$.
We argue by cases.
\smallskip

Case~1, $x = z$.  Then ${\sf S} x = {\sf S} z$.
That completes Case~1.
\smallskip

Case~2, $x \neq z$.  Then by Theorem~\ref{theorem:Churchsuccessorweaklyoneone},
${\sf S} x \neq {\sf S} z$.  That completes Case~2.
 That completes the
proof of the lemma.

\begin{theorem} \label{theorem:Churchsuccessoroneone}
If ${\mathbb N}$ is not finite, then Church successor is one-to-one.
\end{theorem}

\noindent{\em Proof}.  Suppose ${\mathbb N}$ is not finite.  Suppose
$x\in {\mathbb N}$ and $y \in {\mathbb N}$, and ${\sf S} x = {\sf S} y$.  We must show $x = y$.
By Theorem~\ref{theorem:Churchsuccessorweaklyoneone},
we have $\neg\neg\,(x = y)$.
By Corollary~\ref{lemma:oneoneimpliesdecidableequality},
${\mathbb N}$ has decidable equality.  Therefore $x = y$.
That completes the proof.

\begin{theorem} \label{theorem:notfiniteimpliesinfinite}
If ${\mathbb N}$ is not finite, then ${\mathbb N}$ is infinite.
\end{theorem}

\noindent{\em Proof}. Suppose ${\mathbb N} \not\in {\sf FINITE}$.
  Define $Z:= {\mathbb N} - \{ {\bf 0}\}$.  By
Theorem~\ref{theorem:successoromitszero}, $Z$ is a proper subset of ${\mathbb N}$.
By Lemma~\ref{lemma:predecessor}, Church successor maps ${\mathbb N}$ onto $Z$.
By Theorem~\ref{theorem:Churchsuccessoroneone}, Church successor
is one-to-one; therefore it is a similarity from ${\mathbb N}$ to $Z$.
One can verify straightforwardly that Church successor is a similarlity
between ${\mathbb N}$ and $Z$ (120 steps omitted here).    By the
definition of infinite, ${\mathbb N}$ is infinite.  That completes
the proof of the theorem.

\begin{theorem} \label{theorem:infinity1} The Church counting axiom
implies ${\mathbb N}$ is infinite and Church successor is one-to-one.
\end{theorem}

\noindent{\em Proof}. By Theorem~\ref{theorem:main}, the
Church counting axiom implies ${\mathbb N}$ is not finite. Then by
Theorem~\ref{theorem:notfiniteimpliesinfinite}, ${\mathbb N}$ is infinite.
By Theorem~\ref{theorem:Churchsuccessoroneone}, Church successor
is one-to-one.  That completes the proof of the theorem.

\begin{theorem} \label{theorem:interpretability}
Heyting's arithmetic HA  can be interpreted in INF plus the
Church counting axiom.
\end{theorem}

\noindent{\em Remark}. Since this is a meta-theorem,  not a theorem of INF,
we have not checked it in Lean as we did all the other proofs in this paper.
\medskip

\noindent{\em Proof}.  We have already shown in \cite{inf-basics} that
one may conservatively add comprehension terms to INF.  We have defined
Church successor, Church addition, and Church multiplication by such
comprehension terms.  The interpretation of a formula $A$ of HA is defined by
replacing the function terms of $A$ by comprehension terms involving
the symbols for Church successor, addition, and multiplication, and the
constant $0$ of HA by the comprehension term defining ${\bf 0}$.
The quantifiers of $A$ are replaced by bounded quantifiers restricted to ${\mathbb N}$,
which is defined by a comprehension term.  The interpretations of the
axioms for addition and multiplication hold, by Lemmas~\ref{lemma:ChurchAdditionAssociative},
 \ref{lemma:ChurchAdditionCommutative},
\ref{lemma:ChurchMultiplicationAssociative},
\ref{lemma:ChurchMultiplicationCommutative},
\ref{lemma:ChurchAddition_equation}, and
\ref{lemma:ChurchZero_equation}.
The interpretation of any formula of HA is a stratified formula, giving all
the variables index 0,  so the interpretation of the induction axiom schema
follows from the definition of ${\mathbb N}$.  The main point of
interest is that we need Theorem~\ref{theorem:Churchsuccessoroneone}
to verify that
successor is one-to-one.   That completes the proof of the theorem.

\section{If ${\mathbb F}$ is infinite, so is ${\mathbb N}$}
The plan of this section is to prove that (assuming ${\mathbb F}$ is infinite),
every Church number is the order of a cyclic permutation on some finite set.
Then if ${\mathbb N}$ is finite, we have ${\sf S} {\bf n} = {\sf S} k$ with ${\bf n} = {\bf k} + {\bf m}$ and
${\bf m} \neq {\bf 0}$,  so ${\bf m}$ has a predecessor $r$.  Then there is
a finite set $X$ and cyclic permutation $f$ of $X$ whose order is $r$.  Then
${\bf m} f x = {\sf S} r f x = f(r f x) = f x$.  But by the Annihilation Theorem,
${\bf m} f x = x$, contradiction, since a cyclic permutation is not the identity.
While this proof is conceptually simple, there are many details to supply.

\begin{lemma} \label{lemma:enlarge}
Suppose Frege successor maps ${\mathbb F}$ to ${\mathbb F}$.  Then
for every finite set $X$, not-not there exists $c$ with $c \not\in X$.
\end{lemma}

\noindent{\em Remark}.  That is, every finite set is not-not enlargeable,
as $X \cup \{c\}$ is a finite set properly containing $X$.  We were not
able to eliminate the double negation (which would have simplified the subsequent arguments).
\medskip

\noindent{\em Proof}.  Let $p = Nc(X)$.  Then
\begin{eqnarray*}
p \in {\mathbb F}  && \mbox{\qquad by Lemma~\sref{lemma:finitecardinals3}}\\
p^+ \in {\mathbb F} && \mbox{\qquad since ${\mathbb F}$ is closed under successor, by hypothesis}\\
u \in p^+  && \mbox{\qquad for some $u$, by Lemma~\sref{lemma:cardinalsinhabited}} \\
u \in {\sf FINITE} && \mbox{\qquad by Lemma~\sref{lemma:finitecardinals2}}
\end{eqnarray*}
 By the definition of Frege successor,
there exist $v$ and $c$ such that
$u = v \cup \{c\}$, $v \in p$, and $c \not \in v$.  Then
\begin{eqnarray*}
X \in p && \mbox{\qquad by Lemma~\sref{lemma:xinNcx}}\\
X \sim v &&\mbox{\qquad  by Lemma~\sref{lemma:finitecardinals2}}
\end{eqnarray*}

I say $u \not \subseteq X$.  To prove that, assume $u \subseteq X$.
Then
\begin{eqnarray*}
c \in u && \mbox{\qquad since $u = v \cup \{c\}$}\\
c \in X && \mbox{\qquad since $u \subseteq X$}\\
v \neq X && \mbox{\qquad since $c \not \in v$ and $c \in X$} \\
v \subseteq X && \mbox{\qquad since $v \subseteq u$ and $u \subseteq X$}\\
X \mbox{\ is infinite} && \mbox{\qquad by Definition~\sref{definition:infinite}} \\
X \in {\sf FINITE} && \mbox{\qquad by hypothesis}
\end{eqnarray*}
But then $X$ is both finite and infinite, contradicting Theorem~\sref{theorem:infiniteimpliesnotfinite}.  That
completes the proof that $u \not\subseteq X$.
\smallskip

By Lemma~\sref{lemma:finitecardinals3}, since $u \in p^+$ and $p^+ \in {\mathbb F}$,
we have $u \in {\sf FINITE}$.
Recall that we can move double negation both ways across a finite universal quantifier:
\begin{eqnarray*}
\forall z \in u\, \neg\neg\, (z \in X) \ {\rightarrow}\  \neg\neg\, \forall z \in u (z \in X)
          && \mbox{\qquad by Lemma~\sref{lemma:finiteDNS}}
\end{eqnarray*}
and double negation moves in the other direction by pure logic.
Using these facts we have
\begin{eqnarray*}
\neg\, \forall z \in u\,(z \in X) && \mbox{\qquad by the definition of $\subseteq$}\\
\neg\, \forall z \in u\, \neg\neg\,(z \in X) && \mbox{\qquad by Lemma~\sref{lemma:finiteDNS}, since $u$ and $X$ are finite}\\
\neg\neg\, \exists z \in u \, \neg\, (z \in X) && \mbox{\qquad by logic}
\end{eqnarray*}
That completes the proof of the lemma.

For convenience we repeat Definition~\ref{definition:permutation2}.
\begin{definition}
$f$ is a {\bf permutation} of a finite set $X$ if and only if $f:X \to X$,
and $Rel(f)$ and $f \in {\sf FUNC}$, and $dom(f) \subseteq X$,
and $f$ is both one-to-one and onto from $X$ to $X$.
\end{definition}

\begin{definition}\label{definition:cyclic}
$f$ is a {\bf cyclic permutation} of a finite set $X$ with {\bf generator} $a$ if
$f$ is a permutation of $X$ and  $a \in X$ and
$$\forall z \in X\, \exists r \in {\mathbb N}\, (z = rfa).$$
\end{definition}

\begin{definition} \label{lemma:permorder} Let $X$ be a finite set and
let $f:X \to X$ be a cyclic permutation of $X$ with generator $a$.
Suppose $q \in {\mathbb N}$ and $qfa = a$   and $q$ is the $\preceq$-least such
Church number, i.e.,
$$ \forall r \in {\mathbb N}\,(r \preceq q \ {\rightarrow}\  (\forall x\, (rfx = x) ) \ {\rightarrow}\  r = q).$$
Suppose also that
$$ \forall x \in X\, \exists r \in {\mathbb N}\,(r \preceq q \ \land \ r f a = x).$$
Then $q$ is the {\bf order} of $f$.
\end{definition}

\noindent{\em Remark}. The second condition is usually omitted, and could also
be omitted in this context, but then we would have to prove that when we divide $x$
by $y$, the remainder is $\prec y$.  That can be done, but it is easier to
just use this stronger definition of ``order.''
\medskip

\begin{lemma} \label{lemma:permorder2} Let $X$ be a finite set and
let $f:X \to X$ be a cyclic permutation of $X$  with generator $a$.
Let $q \in {\mathbb N}$ and suppose $qfa = a$.
Then $\forall x \in X\, (qfx = x)$.
\end{lemma}

\noindent{\em Proof}. Let $x \in X$.
Since $f$ is a cyclic permutation with generator $a$,
we have $x = jfa$ for some $j \in {\mathbb N}$.  Suppose $qfa = a$.
Then
\begin{eqnarray*}
qfx = qf(jfa)  && \mbox{\qquad since $x = jfa$}\\
 = (q\oplus j)fa   && \mbox{\qquad by Lemma~\ref{lemma:doubleiteration}}\\
 = (j\oplus q)fa  && \mbox{\qquad since  $\oplus$ is commutative}\\
 =jf(qfa)  &&  \mbox{\qquad by Lemma~\ref{lemma:doubleiteration}}\\
 = jfa  && \mbox{\qquad since $qfa = a$}\\
 = x    &&  \mbox{\qquad since $x = jfa$}
\end{eqnarray*}

\begin{lemma} \label{lemma:orderstep}  Suppose $X$ is a finite set,
$f:X\to X$ is a cyclic permutation of $X$ with generator $a$, and
$c \not\in X$.  Suppose ${\mathbb N}$ is finite with ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $k \in {\sf STEM}$.
Let $q$ be the order of $f$.  Suppose $q \neq {\bf n}$ and $q \neq {\bf 0}$.
Then there is a cyclic permutation $g$ of $X \cup \{c\}$ with generator $a$ and
order ${\sf S} q$.
\end{lemma}

\noindent{\em Proof}.  Let $a$ be a generator of $f$.
Let $b = f^{-1}(a)$, so $a = f(b)$.   Define
$$ g = f - \{\langle b,a \rangle\} \cup \{\langle b,c \rangle \} \cup \{ \langle c,a \rangle \}.$$
Using functional notation may clarify the idea of the definition of $g$,
although we are not legally entitled to do so until we prove that $g$ is a function.
$$ g(x) = \threecases {f(x)  \mbox{\qquad if $x \neq b \ \land \ x \neq c$}}
                    { c     \mbox{\ \quad\qquad if $x = b$} }
                    { a     \mbox{\ \quad\qquad if $x = c$}}
$$
 Then $g$ is a permutation of $X \cup \{c\}$.  The formal proof
of that fact requires about 850 steps,  since there are several cases in
the definition of ``permutation'', and three cases in the definition of $g$,
making nine cases for each case in the definition of ``permutation''.  We
omit those 850 steps.
\smallskip

  Since $q \neq {\bf 0}$,
 by Lemma~\ref{lemma:predecessornotn}
there exists $t \in {\mathbb N}$ with
\begin{eqnarray}
{\sf S} t = q \ \land \ t \neq {\bf n}. \label{eq:E5781}
\end{eqnarray}
  I say that
 \begin{eqnarray}
 r \prec t \ {\rightarrow}\  rga = rfa \ \land \ rfa \neq b  \label{eq:E5752} \\
 tfa = tga = b  \label{eq:E5846}
 \end{eqnarray}
In spite of the intuitive conviction that a simple picture of the
situation provides, the proofs of these assertions are not short;
and unlike the proof that $g$ is a permutation, they are not particularly
straightforward or obvious.
To keep the
 length and logical complexity of proofs manageable, we prove
 these formulas in three separate lemmas.  Logically those lemmas should come before this one, but for
 readability we postpone them.  We will first finish this proof
under the additional assumptions  (\ref{eq:E5752}) and (\ref{eq:E5846}).
\smallskip

We then have
\begin{eqnarray}
tfa \in X && \mbox{\qquad by Lemma~\ref{lemma:xfmaps}}\nonumber\\
f (tfa)= f (b)  && \mbox{\qquad by (\ref{eq:E5846})}\nonumber \\
{\sf S} tfa =  f(b)  && \mbox{\qquad by Theorem~\ref{theorem:successorequation}}\nonumber\\
qfa = f(b)     && \mbox{\qquad since ${\sf S} t = q$}\nonumber\\
qfa = a         && \mbox{\qquad since $f(b) = a$}  \label{eq:qfa}
\end{eqnarray}
Similarly,
\begin{eqnarray}
tga \in X \cup \{c\} && \mbox{\qquad by Lemma~\ref{lemma:xfmaps}}\nonumber\\
g(tga) = g(b) && \mbox{\qquad by (\ref{eq:E5846})} \nonumber\\
{\sf S} tga =  g(b)  && \mbox{\qquad by Theorem~\ref{theorem:successorequation}}\nonumber\\
qga = g(b)     && \mbox{\qquad since ${\sf S} t = q$}\nonumber\\
qga = c         && \mbox{\qquad since $g(b) = c$} \label{eq:qga}\\
g(qga) = g(c)   && \mbox{\qquad by the preceding line} \nonumber\\
{\sf S} q ga = g(c)    && \mbox{\qquad by Theorem~\ref{theorem:successorequation}}\nonumber\\
{\sf S} q ga = a       && \mbox{\qquad since $g(c) = a$} \label{eq:sqga}
 \end{eqnarray}

We must prove that $g$ is a cyclic permutation of $X \cup \{c\}$
 with generator $a$ and order ${\sf S} q$.  Let $z \in X \cup \{c\}$.  We must
 show that $z = rga$ for some $r \in {\mathbb N}$ with $r \preceq {\sf S} q$.
 We have

 \begin{eqnarray*}
 X \in {\sf FINITE}  && \mbox{\qquad by hypothesis} \\
 X \cup \{c\} \in {\sf FINITE} && \mbox{\qquad by Lemma~\ref{lemma:finite_adjoin}}\\
 X \cup \{c\} \in {\sf DECIDABLE} && \mbox{\qquad by Lemma~\ref{lemma:finitedecidable}}\\
 z = a \ \lor \ z \neq a && \mbox{\qquad by definition of ${\sf DECIDABLE}$} \\
 z = c \  \lor \ z \neq c && \mbox{\qquad by definition of ${\sf DECIDABLE}$}
 \end{eqnarray*}
 If $z=a$ we take $r = {\bf 0}$; then $rga=a=z$.
 If $z=c$ we take $r = q$; then by (\ref{eq:qga}) we have $rga = qga = c = z$.
  Therefore
 we may assume
 \begin{eqnarray}
 z \neq a \ \land \ z \neq c \label{eq:E6855}
 \end{eqnarray}
 Since $z \in X \cup \{c\}$ and $z \neq c$, we have $z \in X$.
 Since $f$ is a cyclic permutation of $X$ of order $q$, there
 exists $r \preceq q$ such that $z =  rfa$.  By Theorem~\ref{theorem:prectrichotomy1},
 we have $r \prec t \ \lor\ r = t \ \lor \ t \prec r$.  I say first that
\begin{eqnarray}
r \neq t  \label{eq:E5865}
\end{eqnarray}

 Case~1, $r \prec t$.  Then
\begin{eqnarray*}
rga = rfa \ \land \ rfa \neq b &&\mbox{\qquad by (\ref{eq:E5752})}\\
z = rga  && \mbox{\qquad since $z = rfa$ and $rga = rfa$} \\
q \prec {\sf S} q  && \mbox{\qquad by Lemma~\ref{lemma:xpreceqsx}}\\
r \preceq {\sf S} q  && \mbox{\qquad by Lemma~\ref{lemma:preceqtrans}, since $r \preceq q$}
\end{eqnarray*}
That completes Case~1.
\smallskip

Case~2, $r=t$.
Then
 \begin{eqnarray*}
 z = tfa  && \mbox{\qquad since $z = rfa$ and $r=t$}\\
  = tga  && \mbox{\qquad by (\ref{eq:E5846}) }\\
  = rga  && \mbox{\qquad since $r=t$}
\end{eqnarray*}
It remains to show $r \preceq {\sf S} q$. We have
\begin{eqnarray*}
q \neq {\bf n} && \mbox{\qquad by hypothesis}\\
{\sf S} r \neq {\bf n} && \mbox{\qquad since $q = {\sf S} t$ and $r = t$}\\
r \neq {\bf n} && \mbox{\qquad by (\ref{eq:E5781}), since $r=t$}\\
{\sf S} r \preceq {\sf S} {\sf S} r && \mbox{\qquad by Lemma~\ref{lemma:xpreceqsx}, since ${\sf S} r \neq {\bf n}$ }\\
r \preceq {\sf S} r && \mbox{\qquad by Lemma~\ref{lemma:xpreceqsx}, since $ r \neq {\bf n}$ }\\
r \preceq {\sf S} {\sf S} r && \mbox{\qquad by Lemma~\ref{lemma:preceqtrans}}\\
r \preceq {\sf S} q  && \mbox{\qquad since $q = {\sf S} t$ and $r = t$}
\end{eqnarray*}
That completes Case~2.
\smallskip

 Case~3, $t \prec r$.
Then
\begin{eqnarray*}
t \neq r \ \land \ t \preceq r && \mbox{\qquad by definition of $\prec$}\\
r \preceq q = {\sf S} t && \mbox{\qquad proved above}\\
r \preceq t \ \lor \ r = {\sf S} t && \mbox{\qquad by Lemma~\ref{lemma:preceqsuccessor}, since $t \neq {\bf n}$}\\
\neg\, (r\preceq t) && \mbox{\qquad by Theorem~\ref{theorem:prectrichotomy3}, since
$t \preceq r$ and $t \neq r$} \\
r = {\sf S} t  && \mbox{\qquad by the preceding two lines}\\
tfa = tga && \mbox{\qquad by (\ref{eq:E5846})}\\
r = q  && \mbox{\qquad since $q = {\sf S} t$} \\
z = qfa  && \mbox{\qquad since $z = rfa$ and $r = q$}\\
\exists r \preceq q\, (z = rfa) && \mbox{\qquad namely, $r = q$}
\end{eqnarray*}
That completes Case~3.
\smallskip

I say that
${\sf S} q$ is the order of $g$.
By (\ref{eq:sqga}),   ${\sf S} q g a= a$.   Suppose $r g a = a$.  We must
prove ${\sf S} q \preceq r$.  By Theorem~\ref{theorem:prectrichotomy3},
it suffices to derive a contradiction from $r \prec {\sf S} q$.
We now assume $r \prec {\sf S} q$

Then by Lemma~\ref{lemma:preceqsuccessor},
$ r \preceq q$.  We have
\begin{eqnarray*}
qga = c && \mbox{\qquad by (\ref{eq:qga}) }\\
rga = a && \mbox{\qquad by the definition of order}\\
a \neq c  && \mbox{\qquad since $a \in X$ but $c \not\in X$}\\
r \neq q  && \mbox{\qquad since if $r=q$ then $a =c$}\\
\end{eqnarray*}
\begin{eqnarray*}
r \preceq {\sf S} t && \mbox{\qquad since $q = {\sf S} t$}\\
r \preceq t \ \lor r = {\sf S} t && \mbox{\qquad by Lemma~\ref{lemma:preceqsuccessor}}\\
r \neq {\sf S} t && \mbox{\qquad since $q = {\sf S} t$ and $r \neq q$}\\
r \preceq t && \mbox{\qquad by the preceding two lines}\\
rga= a && \mbox{\qquad since $r$ is the order of $g$}\\
tga = b  && \mbox{\qquad by (\ref{eq:E5846}) }\\
r \neq t  && \mbox{\qquad by the preceding lines, since $a \neq b$}\\
r \prec t && \mbox{\qquad by the definition of $\prec$}\\
rga = rfa && \mbox{\qquad by (\ref{eq:E5752})}\\
rfa = a && \mbox{\qquad since $rga = a$}\\
q \preceq r && \mbox{\qquad since $q$ is the order of $f$}\\
q = r && \mbox{\qquad by Theorem~\ref{theorem:prectrichotomy3}, since $r \preceq q$}
\end{eqnarray*}
That contradicts $r \neq q$, which was proved above.
We have now proved that if $rga = a$, then ${\sf S} q \preceq r$.
That is, however, only have the definition of ``${\sf S} q$ is the order of $g$.''
\smallskip

We still have to prove that every $x \in X \cup \{c\}$ has the
form $rga$ for some $r \preceq {\sf S} q$, which is the second part of the definition.
Let $x \in X \cup \{c\}$.  Since $X \cup \{c\}$ is finite, it has
decidable equality, so we have
$$ x = c \ \lor \ x = b \ \lor x = a \ \lor \ (x \neq c \ \land \ x \neq b \ \land \ x \neq a).$$
We argue by cases.
\smallskip

Case~1, $x = c$.  Then take $r = q$. We have $qga = c$
by (\ref{eq:qga}), and $q \preceq {\sf S} q$ since $q \neq {\bf n}$.
\smallskip

Case~2, $x = b$.  Then take $r = t$.  We have $tga = b$ by (\ref{eq:E5846}),
and $t \preceq {\sf S} t \preceq {\sf S} ({\sf S} t) = {\sf S} q$, since $t \neq {\bf n}$ and $q \neq {\bf n}$.
\smallskip

Case~3, $x = a$.  Then take $r = {\sf S} q$.  We have ${\sf S} q ga = a$ by (\ref{eq:sqga}).
\smallskip

Case~4, $x \neq c \ \land \ x \neq b \ \land \ x \neq a$.  Then $x \in X$.
By the induction hypothesis, $q$ is the order of $f$, so there exists $\rho \preceq q$
such that $rfa = x$.  We have
\begin{eqnarray*}
\rho \preceq {\sf S} t && \mbox{\qquad since $q = {\sf S} t$}\\
\rho \preceq t \ \lor \ r = {\sf S} t && \mbox{\qquad by Lemma~\ref{lemma:preceqsuccessor}} \\
\rho= t \ \lor \ \rho \neq t && \mbox{\qquad since ${\mathbb N} \in {\sf DECIDABLE}$} \\
\rho \prec t \ \lor \ \rho = t \ \lor \ \rho = {\sf S} t && \mbox{\qquad by the definition of $\prec$}
\end{eqnarray*}
If $\rho \prec t$ then by  (\ref{eq:E5752}),  $\rho ga = \rho fa = x$, so we can take $r=\rho$.
If $\rho = t$ then by  (\ref{eq:E5846}), then $tga = b$, so $x=b$,
contradicting the hypothesis of Case~4. If $\rho= {\sf S} t = q$, then
$x = \rho ga = qga = c$ by (\ref{eq:qga}), contrary to the hypothesis $x \neq c$
of Case~4.
That completes Case~4.
That completes the proof that ${\sf S} q$ is the order of $g$.
That completes the proof of the lemma,
under the assumptions (\ref{eq:E5752}) and (\ref{eq:E5846}).

 \begin{lemma} \label{lemma:formula62}
  Suppose $X$ is a finite set,
$f:X\to X$ is a cyclic permutation of $X$ with generator $a$, and
$c \not\in X$.  Suppose ${\mathbb N}$ is finite with ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $k \in {\sf STEM}$.
Let $q$ be the order of $f$.  Suppose $q \neq {\bf n}$ and $q = {\sf S} t$ with $t \neq {\bf n}$,
and
$$ g = f - \{\langle b,a \rangle\} \cup \{\langle b,c \rangle \} \cup \{ \langle c,a \rangle \}.$$
Then
$$ r \prec t \ {\rightarrow}\  rga = rfa \ \land \ rfa \neq b.$$
 \end{lemma}

\noindent{\em Proof}.
 The conclusion of the lemma is a stratified formula, giving  $a$ and $b$ index 0, $f$ index 3,
 and $t$ and $r$ index 6.  We prove it by induction on $r$.
 \smallskip

 Base case, $r = {\bf 0}$.  Then $rga = rfa = a$.  If $a=b$ then
 $f(a) = a$, so $f$ is the identity, contradiction.  That completes the
 base case.
 \smallskip

Induction step.  We use ``finite induction'', so we may assume $r \neq {\bf n}$.
\begin{eqnarray*}
{\sf S} r \prec t  && \mbox{\qquad assumption} \\
r \prec {\sf S} r  && \mbox{\qquad by Lemma~\ref{lemma:xprecsx}, since $r \neq {\bf n}$}\\
r \prec t      && \mbox{\qquad by Lemma~\ref{lemma:prectrans}}\\
 rga  = rfa       && \mbox{\qquad by the induction hypothesis} \\
g(rga) = g(rfa)   && \mbox{\qquad by the preceding line} \\
f:X \to X         && \mbox{\qquad by definition of ``permutation''}\\
rf:X \to X         && \mbox{\qquad by Lemma~\ref{lemma:xfmaps}}\\
rfa \in X          && \mbox{\qquad since $a \in X$ and $rf: X \to X$}\\
rfa \neq b        && \mbox{\qquad by the induction hypothesis}\\
g( rfa) = f (rfa)  && \mbox{\qquad by the definition of $g$, since $rfa \neq b$}\\
= {\sf S} r fa   && \mbox{\qquad by Theorem~\ref{theorem:successorequation}} \\
{\sf S} rga = g (rga)  && \mbox{\qquad by Theorem~\ref{theorem:successorequation}}\\
 = {\sf S} rfa && \mbox{\qquad  by the preceding lines}
\end{eqnarray*}
It remains to show that ${\sf S} rfa \neq b$.  We have
\begin{eqnarray*}
{\sf S} rfa = b  && \mbox{\qquad by assumption, for proof by contradiction}\\
 f({\sf S} rfa)) = f(b) && \mbox{\qquad by the previous line}\\
 f({\sf S} rfa) = a    && \mbox{\qquad since $f(b) = a$} \\
 ({\sf S} {\sf S} r) f a = a &&\mbox{\qquad by Theorem~\ref{theorem:successorequation}} \\
q \preceq {\sf S} {\sf S} r  && \mbox{\qquad since $q$ is the order of $f$}  \\
{\sf S} t \preceq {\sf S} {\sf S} r && \mbox{\qquad since ${\sf S} t = q$ }\\
\neg {\bf n} \prec t   && \mbox{\qquad by Lemma~\ref{lemma:precmax2}}\\
{\sf S} r \prec t      && \mbox{\qquad as assumed above for the induction step}\\
{\sf S} r \neq {\bf n}       && \mbox{\qquad by the preceding two lines }\\
t \neq {\bf n}          && \mbox{\qquad by (\ref{eq:E5781})}\\
t \preceq {\sf S} r  && \mbox{\qquad by Lemma~\ref{lemma:precpred}, since ${\sf S} t \preceq {\sf S} {\sf S} r$ and $t\neq {\bf n}$ }\\
{\sf S} r \preceq t && \mbox{\qquad by definition of $\prec$, since ${\sf S} r \prec t$} \\
{\sf S} r = t        && \mbox{\qquad by Theorem~\ref{theorem:prectrichotomy3}} \\
{\sf S} r \neq t     && \mbox{\qquad by definition of $\prec$, since ${\sf S} r \prec t$}
\end{eqnarray*}
That contradiction completes the proof that ${\sf S} rga \neq b$.
That completes the induction step.  That completes
the proof of the lemma.

\begin{lemma} \label{lemma:formula63}
  Suppose $X$ is a finite set,
$f:X\to X$ is a cyclic permutation of $X$ with generator $a$, and
$c \not\in X$.  Suppose ${\mathbb N}$ is finite with ${\sf S} {\bf k} = {\sf S} {\bf n}$ and $k \in {\sf STEM}$.
Let $q$ be the order of $f$.  Suppose $q \neq {\bf n}$ and $q = {\sf S} t$ with $t \neq {\bf n}$,
and
$$ g = f - \{\langle b,a \rangle\} \cup \{\langle b,c \rangle \} \cup \{ \langle c,a \rangle \}.$$
Then $tga = tfa = b$.
 \end{lemma}

\noindent{\em Proof}.
\begin{eqnarray*}
z:= tfa  && \mbox{\qquad definition of $z$}\\
tfa \in X && \mbox{\qquad by Lemma~\ref{lemma:xfmaps}}\\
z \in X  && \mbox{\qquad by the preceding two lines}\\
fz = f(t f a)  && \mbox{\qquad since $z = tfa$}\\
 fz = {\sf S} t f a   &&\mbox{\qquad  by Theorem~\ref{theorem:successorequation}}\\
 fz = q f a  &&\mbox{\qquad since $q = {\sf S} t$}\\
 fz = a    && \mbox{\qquad since $qfa = a$}  \\
  z = b  && \mbox{\qquad since $f$ is one-to-one and $fb = a$}\\
 t \prec {\sf S} t && \mbox{\qquad by Lemma~\ref{lemma:xprecsx}, since $t \neq {\bf n}$}\\
 t \prec q   && \mbox{\qquad since ${\sf S} t = q$}\\
 tfa \neq a  && \mbox{\qquad since $q$ is the order of $f$}\\
 z \neq a && \mbox{\qquad since $z = tfa$ }\\
  t \neq {\bf 0} && \mbox{\qquad since if $t = {\bf 0}$ then $z = tfa = a$} \\
 t = {\sf S} p  && \mbox{\qquad for some $p \in {\mathbb N}$ with $p \neq {\bf n}$, by Lemma~\ref{lemma:predecessornotn}} \\
  p \prec t  && \mbox{\qquad by Corollary~\ref{lemma:xprecsx}} \\
   u := p f a && \mbox{\qquad defining $u$}\\
 u = pga && \mbox{\qquad by (\ref{eq:E5752})} \\
gu = {\sf S} p g a &&\mbox{\qquad  by Theorem~\ref{theorem:successorequation}}\\
     = tga  && \mbox{\qquad since $t = {\sf S} p$} \\
     f u = f(p f a) && \mbox{\qquad since $u = pfa$}\\
 = {\sf S} p f a &&\mbox{\qquad  by Theorem~\ref{theorem:successorequation}} \\
 = tfa  && \mbox{\qquad since ${\sf S} p = t$}\\
 = z  = b  && \mbox{\qquad as shown above}\\
  f u \neq f b && \mbox{\qquad since $fu = b$ and $fb = a$ and $a \neq b$ }\\
 pf : X \to X && \mbox{\qquad by Lemma~\ref{lemma:xfmaps}} \\
 u \in X  && \mbox{\qquad since $u = pfa$ and $a \in X$ and $pf:X \to X$}\\
 u \neq b  && \mbox{\qquad since $f$ is one-to-one and $f u \neq f b$} \\
 gu = fu   && \mbox{\qquad by definition of $g$, since $u \neq b$}\\
 gu = b    && \mbox{\qquad since $fu = b$}\\
 z = b = t ga && \mbox{\qquad since $gu = tga$}\\
z = rga && \mbox{\qquad since $r=t$}
\end{eqnarray*}
That completes the proof of the lemma.
\smallskip

Now we have supplied the supporting lemmas required to prove
(\ref{eq:E5752}) and (\ref{eq:E5846}).  That completes the proof
of Lemma~\ref{lemma:orderstep}.

\begin{lemma}\label{lemma:simplestperm} Let $X = \{ a, b\}$, where $a \neq b$.
Let $f = \{ \langle a, b \rangle, \langle b, a \rangle \}$.  Then $f$ is
a cyclic permutation with generator $a$ of $X$ with order ${\sf S} ({\sf S} {\bf 0})$.
\end{lemma}

\noindent{\em Remark}.
There is no cyclic permutation of order $\one = {\sf S} {\bf 0}$,
as it would have to fix the generator $a$, so $X$ would have to be a singleton,
and the identity permutation on  a singleton has order ${\bf 0}$.
\medskip

\noindent{\em Proof}.
  We omit the 610 simple steps of this proof. (The definitions involved
create many cases.)

\begin{lemma}\label{lemma:allorders}
Suppose ${\mathbb N}$ is finite and Frege successor maps ${\mathbb F}$ to ${\mathbb F}$ (so ${\mathbb F}$
is infinite).
Let $q \in {\mathbb N}$ with $q \neq {\bf 0}$ and $q \neq {\sf S} {\bf 0}$. Then not-not there exists a
finite set $X$ and a cyclic permutation $f$ of $X$ with generator $a$
and order $q$.
\end{lemma}

\noindent{\em Remark}.  ``Every Church number is not-not the order of some
permutation.''  The double negation comes from Lemma~\ref{lemma:enlarge}.
\smallskip

\noindent{\em Proof}.  By Lemma~\ref{lemma:kinstem}, there exist ${\bf k}$ and ${\bf n}$
in ${\mathbb N}$
 with ${\sf S} {\bf k} = {\sf S} {\bf n}$ and ${\bf k} \in {\sf STEM}$ and ${\bf n} \neq {\bf k}$.
 By   induction on $q$ we prove that $q \neq {\bf 0}$ implies  not-not $q$ is the
order of some cyclic permutation on a finite set.   We use ``finite induction'',
which means we get to assume $q \neq {\bf n}$ in the induction step.
\smallskip

Base case, there is nothing to prove because of the hypothesis $q \neq {\bf 0}$.
\smallskip

Induction step.  The assumptions for the induction step are
\begin{eqnarray*}
 q \in {\mathbb N}   &&\\
 {\sf S} q \neq {\bf 0} &&\\
 {\sf S} q \neq {\sf S} {\bf 0} &&\\
 q \neq {\bf n} && \mbox{\qquad for ``finite induction''}
 \end{eqnarray*}
 Then also
 \begin{eqnarray*}
 q \neq {\bf 0}   && \mbox{\qquad since ${\sf S} q \neq {\sf S} {\bf 0}$}
 \end{eqnarray*}

 We have to produce a set $X$ and a permutation
$f$ of $X$ whose order is ${\sf S} q$.
 If ${\sf S} q = {\sf S} ({\sf S} {\bf 0})$, or for short ${\sf S} q = 2$,  then by
Lemma~\ref{lemma:simplestperm}, there is a permutation of order 2, so
we are finished.   In other words, we may assume
\begin{eqnarray*}
q \neq {\sf S} {\bf 0} && \mbox{\qquad by Lemma~\ref{lemma:simplestperm}}
\end{eqnarray*}
Now that we have $q \neq {\bf 0}$ and $q \neq {\sf S} {\bf 0}$,
we may apply the induction hypothesis.
 By the induction
hypothesis, not-not there is a finite set $X$ and a cyclic permutation of $X$
with generator $a$ such that $xfa = a$, and $f$ has order $q$.
   Suppose $X$ is such a set;
by Lemma~\ref{lemma:enlarge},  not-not there exists $c \not\in X$.
By
Lemma~\ref{lemma:orderstep},  not-not there is an $X$,
and a cyclic permutation of $X \cup \{c\}$, such that ${\sf S} x f a = a$,
and $f$ has order ${\sf S} q$.
  That completes the induction step.  That completes
the proof of the lemma.

\begin{theorem}\label{theorem:FinfiniteimpliesNinfinite}
Suppose Frege successor maps ${\mathbb F}$ to ${\mathbb F}$ (so ${\mathbb F}$ is infinite).
Then ${\mathbb N}$ is infinite and Church successor is one-to-one.
\end{theorem}

\noindent{\em Proof}.  Suppose Frege successor maps ${\mathbb F}$ to ${\mathbb F}$.
We have to prove Church successor is one-to-one.  By
Theorem~\ref{theorem:Churchsuccessoroneone}, it suffices to
prove that ${\mathbb N}$ is not finite.  Suppose ${\mathbb N}$ is finite; we must
derive a contradiction.   Since we have assumed ${\mathbb N}$ is finite,
by Lemma~\ref{lemma:kinstem}  there exist ${\bf k}$ and ${\bf n}$
in ${\mathbb N}$
 with ${\sf S} {\bf k} = {\sf S} {\bf n}$ and ${\bf k} \in {\sf STEM}$ and ${\bf n} \neq {\bf k}$.  By Lemma~\ref{lemma:mexists}, there exists
${\bf m}$ such that ${\bf n} = {\bf k} + {\bf m}$.  Since ${\bf n} \neq {\bf k}$, we have
${\bf m} \neq {\bf 0}$.  By Lemma~\ref{lemma:predecessor}, there exists
$r\in {\mathbb N}$ with ${\sf S} r = {\bf m}$.  We have $r \neq {\bf 0}$ and $r \neq {\sf S} {\bf 0}$,
by Lemma~\ref{lemma:mbig}.   By
 Lemma~\ref{lemma:allorders},  not-not there is a finite set $X$ and a permutation
 $f:X \to X$ with generator $a$ such that $rfa=a$ and $fa \neq a$.   Suppose $X$ and $f$
 are such a finite set and permutation.      Then
\begin{eqnarray*}
{\bf m} f a = {\sf S} r f a  && \mbox{\qquad since ${\bf m} = {\sf S} r$}\\
= f (r f a)      && \mbox{\qquad by Theorem~\ref{theorem:successorequation}}\\
= f(a)           && \mbox{\qquad since $rfx = x$}
\end{eqnarray*}
On the other hand, by the Annihilation Theorem, ${\bf m} f a = a$.
Hence $f(a) = a$, contradiction.
\smallskip

We reached that contradiction under the assumption that $X$ is a finite set
with a permutation $f$ of order $r$;  but we have actually proved only the
double negation of that.  But still,  if a proposition leads to a contradiction,
so does its double negation.
That completes the proof of the theorem.

\begin{corollary} \label{corollary:Ninfinite}
Classical NF proves ${\mathbb N}$ is infinite and Church successor is
one-to-one.
\end{corollary}

\noindent{\em Proof}.  Specker \cite{specker1953} proved, in
classical NF,  that ${\mathbb F}$ is infinite.  By Theorem~\ref{theorem:FinfiniteimpliesNinfinite}, Specker's result
implies that ${\mathbb N}$ is infinite and Church successor is one-to-one.
That completes the proof of the corollary.
\medskip

{\em Remarks}.  We also proved that every inhabited finite set
has a cyclic permutation; this proof uses the lemmas above in its
induction step,  but it also requires proving that the order of a
permutation cannot be ${\bf n}$, which needs the Annihilation theorem
and a bit more.  That focuses attention on the question whether an
unenlargeable finite set $U$ can have a cyclical permutation $f$,
since if that were impossible, then ${\mathbb F}$ could not be finite,  so
both ${\mathbb F}$ and ${\mathbb N}$ would be infinite.   However, we could not
derive a contradiction from the assumption that there is a cyclic
permutation $f$ on an unenlargeable set $U$.

\section{Equivalence of Church and Rosser counting axioms}

Thanks are due to Thomas Forster, who overcame
my initial skepticism about proving the equivalence of these two axioms.
\smallskip

We make use of ${\mathbb T} x$, defined so that for $x \in {\mathbb F}$, and $a \in x$,
we have ${\mathbb T}(x) = Nc(USC(a))$.

\begin{lemma} \label{lemma:T2} Suppose that ${\mathbb T}^2 x  = x$ for all $x \in {\mathbb F}$.
  Then ${\mathbb T} x = x$ holds for all $x \in {\mathbb F}$.
\end{lemma}

\noindent{\em Proof}.   By Lemma~\sref{lemma:Tfinite},
${\mathbb T} x \in {\mathbb F}$.
By Theorem~\sref{theorem:finitetrichotomy}, we have
$$x < {\mathbb T} x \ \lor \ x = {\mathbb T} x \ \lor \ {\mathbb T} x < x.$$
We argue by cases.
\smallskip

Case~1, $x < {\mathbb T} x$.  Then
\begin{eqnarray*}
{\mathbb T} x < {\mathbb T}^2 x && \mbox{\qquad by Lemma~\sref{lemma:Tlessthan}}\\
{\mathbb T} x < x      && \mbox{\qquad since ${\mathbb T}^2 x = x$}\\
x  < x  && \mbox{\qquad by Lemma~\sref{lemma:lessthan_transitive}}\\
x \not < x && \mbox{\qquad by Lemma ~\sref{lemma:xnotlessthanx}}
\end{eqnarray*}
That contradiction completes Case~1.
\smallskip

Case~2, $x = {\mathbb T} x$.  Then ${\mathbb T} x = x$ and we are done.
\smallskip

Case~3, ${\mathbb T} x < x$.  Then
\begin{eqnarray*}
{\mathbb T}^2 x < {\mathbb T} x && \mbox{\qquad by Lemma~\sref{lemma:Tlessthan}}\\
x < {\mathbb T} x && \mbox{\qquad since ${\mathbb T}^2 x = x$}\\
x  < x  && \mbox{\qquad by Lemma~\sref{lemma:lessthan_transitive}}\\
x \not < x && \mbox{\qquad by Lemma ~\sref{lemma:xnotlessthanx}}
\end{eqnarray*}
That contradiction completes Case~3.
That completes the proof of the lemma.

\begin{lemma} \label{lemma:T6} Suppose that ${\mathbb T}^6 x  = x$ for all $x \in {\mathbb F}$.
  Then ${\mathbb T} x = x$ holds for all $x \in {\mathbb F}$.
\end{lemma}

\noindent{\em Proof}.  (Similar to the proof of Lemma~\ref{lemma:T2}.)
 By Lemma~\sref{lemma:Tfinite},
${\mathbb T} x \in {\mathbb F}$.
By Theorem~\sref{theorem:finitetrichotomy}, we have
$$x < {\mathbb T} x \ \lor \ x = {\mathbb T} x \ \lor \ {\mathbb T} x < x.$$
We argue by cases.
\smallskip

Case~1, $x < {\mathbb T} x$.  Then
\begin{eqnarray*}
x < {\mathbb T} x < {\mathbb T}^2 x < T^3 x \ldots < {\mathbb T}^6 x && \mbox{\qquad by Lemma~\sref{lemma:Tlessthan}}\\
x  < {\mathbb T}^6 x && \mbox{\qquad by Lemma~\sref{lemma:lessthan_transitive}}\\
x < x  && \mbox{\qquad since ${\mathbb T}^6 x = x$}\\
x \not < x && \mbox{\qquad by Lemma ~\sref{lemma:xnotlessthanx}}
\end{eqnarray*}
That contradiction completes Case~1.
\smallskip

Case~2, $x = {\mathbb T} x$.  Then ${\mathbb T} x = x$ and we are done.
\smallskip

Case~3, ${\mathbb T} x < x$.  Then
\begin{eqnarray*}
{\mathbb T}^6 x < {\mathbb T}^5 x \ldots < {\mathbb T}^2 x < {\mathbb T} x && \mbox{\qquad by Lemma~\sref{lemma:Tlessthan}}\\
{\mathbb T}^6 x < x && \mbox{\qquad by Lemma~\sref{lemma:lessthan_transitive}}\\
x  < x  && \mbox{\qquad since ${\mathbb T}^6 x = x$}\\
x \not < x && \mbox{\qquad by Lemma ~\sref{lemma:xnotlessthanx}}
\end{eqnarray*}
That contradiction completes Case~3.
That completes the proof of the lemma.

Define $J(x):= \{z \in {\mathbb F}: z < x\}.$   Rosser stated his counting
axiom in the form $J(x) \in x$ for $x \in {\mathbb F}$.

\begin{lemma} \label{lemma:RosserT}
 Rosser's counting axiom is equivalent to ${\mathbb T}(x) = x$ for all $x \in {\mathbb F}$.
\end{lemma}

\noindent{\em Proof}.
Left to right:  Assume Rosser's counting axiom.  Let $x \in {\mathbb F}$.  Then
\begin{eqnarray*}
Nc(J(x)) = {\mathbb T}^2 x  && \mbox{\qquad by Lemma~\sref{lemma:Jcardinality}}\\
J(x) \in x   && \mbox{\qquad by   Rosser's counting axiom}\\
Nc(J(x)) = x  && \mbox{\qquad by Lemma~\sref{lemma:Ncdef}}\\
{\mathbb T}^2 x = x  && \mbox{\qquad by the preceding lines}
\end{eqnarray*}
Since $x$ was arbitrary, we have proved
$\forall x \in {\mathbb F}\,(  {\mathbb T}^2 x = x)$.  Then  by Lemma~\ref{lemma:T2},
we have $\forall x \in {\mathbb F}\, ({\mathbb T} x = x)$.  That completes the left-to-right
direction.

Right to left: Assume for all $x \in {\mathbb F}$,  ${\mathbb T}(x) = x$.  Then
$Nc(J(x)) = {\mathbb T}^2 x = {\mathbb T} x = x$, so $\J(x) \in x$ by Lemma~\sref{lemma:finitecardinals3}.
That completes the proof of the lemma.

\begin{definition} \label{definition:ChurchFrege}
 Let ${\bf i\, }$   be the intersection of all sets $w$
such that
\begin{eqnarray*}
&&u \in w \ {\rightarrow}\  \exists p,q\, (u = \langle p,q\rangle \ \land \ p \in {\mathbb N} \ \land \ q \in {\mathbb F}  \\
&&\langle {\bf 0}, {\sf zero} \rangle \in w \\
&& \langle p,q \rangle \in w \ {\rightarrow}\  q^+ \in {\mathbb F} \ {\rightarrow}\
 \langle {\sf S} p, q^+ \rangle \in w.
\end{eqnarray*}
\end{definition}

\noindent{\em Remark}.  If ${\mathbb N}$ is finite,  then ${\bf i\, }$ may not be a function,
because if ${\sf S} {\bf n} = {\sf S} {\bf k}$ then ${\bf i\, }({\sf S} {\bf n})$ would have to be both
${\bf i\, }({\bf n})^+$ and ${\bf i\, }({\bf k})^+$.   And, if ${\mathbb F}$ is not finite, then the domain of
${\bf i\, }$ might be a proper subset of ${\mathbb F}$.  But, if both ${\mathbb N}$ and ${\mathbb F}$ are infinite,
then ${\bf i\, }$ should turn out to be a similarity between them.

\begin{lemma} \label{lemma:ChurchFrege0} $\langle {\bf 0}, {\sf zero} \rangle \in {\bf i\, }$.
\end{lemma}

\noindent{\em Proof}.  Let $w$ be a set satisfying the conditions in
the definition of ${\bf i\, }$.  Then $\langle {\bf 0}, {\sf zero} \rangle \in w$.
Since $w$ is arbitrary,  $\langle {\bf 0}, {\sf zero} \rangle \in {\bf i\, }$.
That completes the proof of the lemma.

\begin{lemma} \label{lemma:ChurchFrege1}
Suppose $\langle p,q \rangle \in {\bf i\, }$ and $q^+ \in {\mathbb F}$. Then $\langle {\sf S} p, q^+\rangle \in {\bf i\, }$.
\end{lemma}

\noindent{\em Proof}. Suppose
$\langle p, q\rangle \in {\bf i\, }$ and $q^+ \in {\mathbb F}$.  We must show $\langle {\sf S} p, q^+\rangle
\in {\bf i\, }$.  Let $w$ be any set satisfying the conditions in the definition.
Then $\langle p,q \rangle \in w$.  Since $q^+ \in {\mathbb F}$ we have
$\langle {\sf S} p, q^+ \rangle \in w$.  Since $w$ was any set satisfying the
conditions, we have $\langle {\sf S} p, q^+\rangle \in {\bf i\, }$ as desired.
That completes the proof of the lemma.

\begin{lemma} \label{lemma:ChurchFrege2}
 Let ${\bf i\, }$ be as in Definition~\ref{definition:ChurchFrege}.  Suppose $\langle p, q\rangle\in {\bf i\, }$.
 Then either $p = {\bf 0} \ \land \ q = {\sf zero}$,  or for some $t \in{\mathbb N}$ and $r \in {\mathbb F}$,  we have $$\langle t,r \rangle \in {\bf i\, }  \ \land \
  p = {\sf S} t \ \land \ q = r^+.$$
\end{lemma}

\noindent{\em Proof}.   Define
$$ w := \{\, \langle p,q \rangle \in {\bf i\, } :  (p = {\bf 0} \ \land \ q = {\sf zero})
\ \lor \ \exists t,r\,(\langle t, r \rangle \in {\bf i\, } \ \land \ p = {\sf S} t \ \land \ q = r^+)\, \}.
$$
The formula is stratified, giving $p,q,r$ all index 0; ${\bf i\, }$ is a parameter.
Therefore the definition is legal.
\smallskip

Then $w$ satisfies the conditions in Definition~\ref{definition:ChurchFrege}.  Therefore
${\bf i\, } \subseteq w$.   That completes the proof of the lemma.

\begin{lemma} \label{lemma:ChurchFrege3}
 Let ${\bf i\, }$ be as in Definition~\ref{definition:ChurchFrege}.  Suppose $\langle p, y^+\rangle\in {\bf i\, }$.
 Then   for some $t \in{\mathbb N}$ ,  we have $$\langle t,y \rangle \in {\bf i\, }  \ \land \
  p = {\sf S} t.$$
\end{lemma}

\noindent{\em Proof}.   Take $q$ in Lemma~\ref{lemma:ChurchFrege2} to be
$y^+$.  By Lemma~\sref{lemma:Fregesuccessoromits0}, we do not have $y^+ = {\sf zero}$.
Hence there exists $t,r$ with $\langle t,r \rangle \in {\bf i\, }$ and
$p = {\sf S} t$ and $y^+ = r^+$.  By Lemma~\sref{lemma:successoroneone}, we have
$y = r$.  Then $\langle t, y \rangle \in i$.  That completes the proof of the lemma.

\begin{lemma} \label{lemma:ChurchRosserhelper} Suppose Church successor
is one-to-one on ${\mathbb N}$.  Then for all $x \in {\mathbb N}$ and $z \in {\mathbb F}$,
 $$
\langle x, y \rangle \in {\bf i\, } \ {\rightarrow}\  \langle x {\sf S} {\bf 0},z \rangle \in {\bf i\, }
\ {\rightarrow}\  {\mathbb T}^6 z = y.$$
\end{lemma}

\noindent{\em Proof}.
The formula is stratified, giving $x$ and $y$ index 6 and $z$ index 0,
with ${\bf i\, }$ as a parameter.  Therefore we may prove it by ${\mathbb N}$-induction on $x$.
\smallskip

Base case, $x = {\bf 0}$.  Assume
$\langle {\bf 0}, y \rangle \in {\bf i\, } $ and $\langle {\bf 0} {\sf S} {\bf 0},z \rangle \in {\bf i\, }$.
Then $y = z = {\sf zero}$, since ${\bf 0} {\sf S} {\bf 0} = {\bf 0}$.
By Lemma~\sref{lemma:Tzero}, ${\mathbb T}^6 {\bf 0} = {\bf 0}$.
That completes the base case.
\smallskip

Induction step.  Suppose $\langle {\sf S} x, y \rangle \in {\bf i\, }$ and
$\langle {\sf S} x {\sf S} {\bf 0}, z \rangle \in {\bf i\, }$.
Then
\begin{eqnarray*}
\langle {\sf S} (x {\sf S} {\bf 0}), z \rangle \in {\bf i\, }  && \mbox{\qquad by Theorem~\ref{theorem:successorequation}}
\end{eqnarray*}
By Lemma~\ref{lemma:ChurchFrege3},
 $z = r^+$ for some $r \in {\mathbb F}$ and some $p$ with
  $\langle p, r \rangle \in {\bf i\, }$ where ${\sf S} p = {\sf S} (x {\sf S} {\bf 0})$.
Since Church successor is one-to-one (by hypothesis), we have
$p = x {\sf S} {\bf 0}$.  Therefore $\langle x {\sf S} {\bf 0},r \rangle\in {\bf i\, }$.
 Similarly, since  $\langle {\sf S} x, y \rangle \in {\bf i\, }$,
  $y = t^+$ for some $t \in {\mathbb F}$ with $\langle x,t\rangle \in {\bf i\, }$.
Since  $\langle x,t\rangle \in {\bf i\, }$ and $\langle x {\sf S} {\bf 0},r \rangle\in {\bf i\, }$,
we have
\begin{eqnarray*}
{\mathbb T}^6 r = t  && \mbox{\qquad  by the induction hypothesis}\\
({\mathbb T}^6 r)^+ = t^+ && \mbox{\qquad by the previous line}\\
({\mathbb T}^6 r)^+  = y && \mbox{\qquad since $y=t^+$}
\end{eqnarray*}
I say that
\begin{eqnarray}
({\mathbb T}^6 r)^+ = {\mathbb T}^6 (r^+)  \label{eq:E5798}
\end{eqnarray}
We wish to justify (\ref{eq:E5798}) by six applications of
 Lemma~\sref{lemma:Tsuccessor}; let us consider the first step,
$({\mathbb T} r)^+ = {\mathbb T} (r^+)$.  To use Lemma~\sref{lemma:Tsuccessor}, we
need to show that $r^+$ is inhabited.   We have
\begin{eqnarray*}
z \in {\mathbb F} && \mbox{\qquad since $\langle {\sf S} x {\sf S} {\bf 0}, z \rangle \in {\bf i\, }$}\\
\exists u\,(u \in z) && \mbox{\qquad by Lemma~\sref{lemma:cardinalsinhabited}}\\
\exists u\, (u \in r^+)&& \mbox{\qquad since $z = r^+$} \\
({\mathbb T} r)^+ = {\mathbb T} (r^+) && \mbox{\qquad by Lemma~\sref{lemma:Tsuccessor}}
\end{eqnarray*}
 Now to take the next steps, we
need Lemma~\sref{lemma:successorT}, which says that ${\mathbb T}$ of anything in ${\mathbb F}$
has its successor in ${\mathbb F}$.   We have
\begin{eqnarray*}
{\mathbb T} r \in {\mathbb F}   && \mbox{\qquad by Lemma~\ref{lemma:Tfinite}}\\
({\mathbb T} r)^+ \in {\mathbb F} && \mbox{\qquad by Lemma~\ref{lemma:successorT}}\\
\exists u\,(u \in ({\mathbb T} r)^+) && \mbox{\qquad by Lemma~\sref{lemma:cardinalsinhabited}}\\
 {\mathbb T}^2 r \in {\mathbb F}  && \mbox{\qquad by Lemma~\ref{lemma:Tfinite}}\\
({\mathbb T}^2 r)^+ \in {\mathbb F}  &&\mbox{\qquad by Lemma~\ref{lemma:successorT}}\\
\exists u\, (u \in ({\mathbb T}^2 r)^+) && \mbox{\qquad by Lemma~\sref{lemma:cardinalsinhabited}}
\end{eqnarray*}
Continuing in this way we eventually prove ${\mathbb T}^m r$ is in ${\mathbb F}$ and is inhabited,
for $m$ up to and including 6.  Now we have all the side conditions
necessary to apply Lemma~\sref{lemma:Tsuccessor} six times.
That completes the proof of (\ref{eq:E5798}).  Continuing, we have
\begin{eqnarray*}
({\mathbb T}^6 r)^+  = y   && \mbox{\qquad as shown above}\\
{\mathbb T}^6 (r^+) = y   && \mbox{\qquad by (\ref{eq:E5798}) }\\
 {\mathbb T}^6 z = y   && \mbox{\qquad since $z = r^+$}
 \end{eqnarray*}
   That completes the induction step.  That completes
the proof of the lemma.

\begin{lemma}\label{lemma:ChurchFregeonto}
The relation ${\bf i\, }$ is onto ${\mathbb F}$.   Explicitly,
\begin{eqnarray}
\forall y \in {\mathbb F}\, \exists x \in {\mathbb N}\, (\langle x, y \rangle \in {\bf i\, }) \label{eq:E5803}
\end{eqnarray}
\end{lemma}

\noindent{\em Proof}.  The formula is stratified, giving $x$ and $y$ index 0,
so it can be proved
by ${\mathbb F}$-induction on $y$.
\smallskip

Base case, $y = {\sf zero}$;  then $x = {\bf 0}$ will do.
\smallskip

Induction step.  Suppose $\langle x, y \rangle \in {\bf i\, }$ and $y^+$ is inhabited.
Then $y^+ \in {\mathbb F}$ by Lemma~\sref{lemma:successorF}, so $\langle {\sf S} x, y^+\rangle \in {\bf i\, }$.  That completes the proof of the lemma.

\begin{theorem}\label{theorem:ChurchimpliesRosser}
The Church counting axiom implies the Rosser counting axiom.
\end{theorem}

\noindent{\em Proof}.  Assume the Church counting axiom.  By
Theorem~\ref{theorem:main}, ${\mathbb N}$ is not finite.
Then by Theorem~\ref{theorem:infinity1}, Church successor is
one-to-one on ${\mathbb N}$.
Let $z \in {\mathbb F}$.  By Lemma~\ref{lemma:ChurchFregeonto},
 there exists $x \in {\mathbb N}$
such that $\langle x, z\rangle \in {\bf i\, }$. We have
\begin{eqnarray*}
x {\sf S} {\bf 0} = x  && \mbox{\qquad by the Church counting axiom} \\
\langle x {\sf S} {\bf 0},z \rangle \in {\bf i\, } && \mbox{\qquad since $\langle x, z\rangle \in {\bf i\, }$} \\
{\mathbb T}^6 z = z && \mbox{\qquad by Lemma~\ref{lemma:ChurchRosserhelper}, with $y=z$} \\
\forall z\in {\mathbb F}\,({\mathbb T}^6 z = z)  && \mbox{\qquad since $z$ was arbitrary}\\
\forall z \in {\mathbb F}\,({\mathbb T} x = x) && \mbox{\qquad by Lemma~\ref{lemma:T6}}
\end{eqnarray*}
By Lemma~\ref{lemma:RosserT}, we have the Rosser counting axiom.
That completes the proof of the theorem.

\begin{lemma} \label{lemma:ChurchFregeoneone}
$\langle x,y \rangle \in {\bf i\, } \ {\rightarrow}\  \langle z,y \rangle \in {\bf i\, } \ {\rightarrow}\  x = z$.
\end{lemma}

\noindent{\em Proof}.  The formula is stratified, giving $x$, $y$, and $z$
all index 0.  We prove it by ${\mathbb F}$-induction on $y$.
\smallskip

Base case, $y = {\sf zero}$.  By Lemma~\ref{lemma:ChurchFrege2} and
Lemma~\sref{lemma:Fregesuccessoromits0}, we have $x = {\bf 0}$
and $z = {\bf 0}$.  Therefore $x=z$.  That completes the base case.
\smallskip

Induction step.  Suppose $\langle x, y^+\rangle \in {\bf i\, }$ and
$\langle z, y^+\rangle \in {\bf i\, }$.  We must show $x=z$.
By Lemma~\ref{lemma:ChurchFrege2} and Lemma~\sref{lemma:Fregesuccessoromits0},
there exist $p,q \in {\mathbb N}$ and $r,t \in {\mathbb F}$ such that
$x = {\sf S} p$, $z = {\sf S} q$, and $r^+ = y^+ = t^+$, and $\langle p,r \rangle \in {\bf i\, }$
and $\langle q,t\rangle \in {\bf i\, }$.
  By Lemma~\sref{lemma:successoroneone},
$r = y =t$.   Then
\begin{eqnarray*}
 \langle q,y\rangle \in {\bf i\, } &&\mbox{\qquad since $t = y$ and $\langle q,t\rangle \in {\bf i\, }$}\\
\langle p,y\rangle \in {\bf i\, } &&\mbox{\qquad since $\langle p,r\rangle \in {\bf i\, }$ and $y=r$}\\
p = q && \mbox{\qquad by the induction hypothesis}\\
x = z && \mbox{\qquad since $x = {\sf S} p$, $z = {\sf S} q$, and $p=q$}
\end{eqnarray*}
That completes the induction step.  That completes the proof of the lemma.

\begin{lemma} \label{lemma:RosserimpliesFinfinite}
The Rosser counting axiom implies that $x^+$ is inhabited for every $x \in {\mathbb F}$.
\end{lemma}

\noindent{\em Proof}.  Assume the Rosser counting axiom.
Define $J(x):= \{z \in {\mathbb F}: z < x\}$.   Then
  $x \not\in J(x)$, by Lemma~\sref{lemma:xnotlessthanx}.
We will prove that
 $x^+$ is inhabited for every $x \in {\mathbb F}$.  The formula is
 stratified, so we may prove it by induction on $x$.
\smallskip

Base case, ${\sf zero}^+$ is inhabited, since ${\sf zero} \in {\sf zero}^+$.
\smallskip

Induction step.  Suppose $x^+$ is inhabited; we must show $x^{++}$ is
inhabited.  By the Rosser counting axiom, $J(x^+)\in x^+$.
By Lemma~\sref{lemma:successorF}, $x^+ \in {\mathbb F}$.
By Lemma~\sref{lemma:xnotlessthanx}, $x^+ \not\in J(x^+)$.
Then $J(x^+) \cup \{ x^+\} \in x^{++}$.  That completes the
induction step.   That completes the proof of the lemma.

\begin{lemma} \label{lemma:Rosserimpliesitotal}
The Rosser counting axiom implies ${\bf i\, }$ is total.  Explicitly:
\begin{eqnarray*}
\forall x \in {\mathbb N}\, \exists y \in {\mathbb F}\, (\langle x, y \rangle \in {\bf i\, })
\end{eqnarray*}
\end{lemma}

\noindent{\em Remark}.  ${\bf i\, }$ may still not be a function.
\medskip

\noindent{\em Proof}.  Assume the Rosser counting axiom.
The formula is stratified, giving $x$ and $y$ index 0, with ${\bf i\, }$ as parameter.
We prove it by ${\mathbb N}$-induction on $x$.
\smallskip

Base case, $x = {\bf 0}$.  Take $y = {\sf zero}$.
\smallskip

Induction step.
By the induction hypothesis, there exists $y$ such that
$\langle x, y\rangle \in {\bf i\, }$ and $y\in{\mathbb F}$.  Then
\begin{eqnarray*}
x \in {\mathbb N} \ \land \ y \in {\mathbb F}  && \mbox{\qquad since $\langle x, y\rangle \in {\bf i\, }$ }\\
\exists u\, (u \in y^+) && \mbox{\qquad by Lemma~\ref{lemma:RosserimpliesFinfinite}}\\
 y^+ \in {\mathbb F} && \mbox{\qquad by Lemma~\sref{lemma:successorF}}\\
 \langle {\sf S} x, y^+\rangle \in {\bf i\, } && \mbox{\qquad by  Lemma~\ref{lemma:ChurchFrege1}}
 \end{eqnarray*}
  That
completes the induction step.  That completes the proof of the lemma.

 \begin{lemma} \label{lemma:jFUNC}
Assume the Rosser counting axiom.  Let ${\bf j\,}$ be the converse relation of ${\bf i\, }$,
that is, $\langle u, v \rangle \in j \iff \langle v, u\rangle \in {\bf i\, }$.  Then
$j: {\mathbb F} \to {\mathbb N}$ is a function.
\end{lemma}

\noindent{\em Proof}.   We have to prove
\begin{eqnarray*}
\forall y, z\,(\langle y,x \rangle \in {\bf i\, } \ {\rightarrow}\  \langle z,x\rangle \in {\bf i\, } \ {\rightarrow}\  y = z)
\end{eqnarray*}
That formula is stratified, giving $x$, $y$, and $z$ all index 0, with ${\bf i\, }$ as a
parameter.  We prove it by ${\mathbb F}$-induction on $x$.
\smallskip

Base case, $x = {\sf zero}$.  Suppose $\langle y, {\sf zero} \rangle \in {\bf i\, }$ and
$\langle z, {\sf zero} \rangle \in {\bf i\, }$.  Then $y = z = {\bf 0}$.  That completes
the base case.
\smallskip

Induction step.  Suppose $x^+$ is inhabited and $\langle y, x^+ \rangle \in {\bf i\, }$
and $\langle z, x^+\rangle \in i$.  Then
\begin{eqnarray*}
y = {\sf S} r  \ \land \ \langle r, x\rangle \in i  && \mbox{\qquad for some $r$, by Lemma~\ref{lemma:ChurchFrege3}}\\
z = {\sf S} t  \ \land \ \langle t, x\rangle \in i  && \mbox{\qquad for some $r$, by Lemma~\ref{lemma:ChurchFrege3}}\\
r = t  && \mbox{\qquad by the induction hypothesis}\\
y = z  && \mbox{\qquad since $y = {\sf S} r$ and $z = {\sf S} t$}
\end{eqnarray*}
That completes the induction step.  That completes the proof of the lemma.

\begin{lemma} \label{lemma:jhelper}
Assume the Rosser counting axiom.  Then for all $x \in {\mathbb F}$,
$$({\bf j\,} x){\sf S} {\bf 0}  = {\bf j\,} ({\mathbb T}^6 x).$$
\end{lemma}

\noindent{\em Proof}.  The formula of the lemma is  stratified,
so we may prove it  by ${\mathbb F}$-induction on $x$.
\smallskip

Base case, $x = {\sf zero}$.  We have
\begin{eqnarray*}
{\bf j\,}({\sf zero}) = {\bf 0} && \mbox{\qquad by Lemma~\ref{lemma:ChurchFrege0}}\\
({\bf j\,} {\sf zero}) {\sf S} {\bf 0} = {\bf 0} {\sf S} {\bf 0} && \mbox{\qquad by the preceding line}\\
= {\bf 0}  && \mbox{\qquad by Lemma~\ref{lemma:ApZero}}
\end{eqnarray*}
On the other hand
\begin{eqnarray*}
{\mathbb T}^6 {\sf zero} = {\sf zero} && \mbox{\qquad by Lemma~\sref{lemma:Tzero}}\\
{\bf j\,} ({\mathbb T}^6 {\sf zero}) = {\bf j\,}({\sf zero})  && \mbox{\qquad by the preceding line}\\
 = {\bf 0}  && \mbox{\qquad by Lemma~\ref{lemma:ChurchFrege0}}
\end{eqnarray*}
Therefore $({\bf j\,} {\sf zero}) {\sf S} {\bf 0} = {\bf j\,}({\mathbb T}^6 {\sf zero})$, since
both sides are equal to ${\bf 0}$.  That
completes the base case.
\smallskip

Induction step.  We have
\begin{eqnarray*}
({\bf j\,} (x^+)) {\sf S} {\bf 0} = ({\sf S} ({\bf j\,} x)) {\sf S} {\bf 0} &&\mbox{\qquad by Lemma~\ref{lemma:ChurchFrege3}} \\
 = {\sf S} (({\bf j\,} x) {\sf S} {\bf 0}) && \mbox{\qquad by Theorem~\ref{theorem:successorequation}}\\
 = {\sf S} ({\bf j\,} ({\mathbb T}^6 x)) && \mbox{\qquad by the induction hypothesis}\\
{\mathbb T} x = x && \mbox{\qquad by Lemma~\ref{lemma:RosserT} and the Rosser counting axiom}\\
{\mathbb T}^6 x =x && \mbox{\qquad by six applications of the preceding line}\\
({\bf j\,} (x^+)) {\sf S} {\bf 0}  = {\sf S} ({\bf j\,} x)   && \mbox{\qquad by the preceding three lines}\\
 = {\bf j\,} ({\mathbb T}^6 (x^+)) && \mbox{\qquad since ${\mathbb T}(x^+) = x^+$ by Lemma~\ref{lemma:RosserT}}
\end{eqnarray*}
That completes the induction step.
 That completes the proof of the lemma.

\begin{theorem} \label{theorem:RosserimpliesChurch}
The Rosser counting axiom implies the Church counting axiom.
\end{theorem}

\noindent{\em Proof}. Assume the Rosser counting axiom.
 Let $z \in {\mathbb N}$.  Then
 \begin{eqnarray*}
z {\sf S} {\bf 0} \in {\mathbb N}  && \mbox{\qquad by Lemma~\ref{lemma:xsmapsN}}\\
 \langle z, x \rangle \in {\bf i\, } && \mbox{\qquad for some $x$, by
  Lemma~\ref{lemma:Rosserimpliesitotal}}\\
 {\bf j\,} x = z && \mbox{\qquad since $\langle x, z \rangle \in {\bf j\,} \iff \langle z,x \rangle \in {\bf i\, }$}\\
({\bf j\,} x){\sf S} {\bf 0}  = {\bf j\,} {\mathbb T}^6 x && \mbox{\qquad by Lemma~\ref{lemma:jhelper}}\\
{\mathbb T}^6 x =x  && \mbox {\qquad by  Lemma~\ref{lemma:RosserT} and the Rosser counting axiom}\\
  ({\bf j\,} x){\sf S} {\bf 0}  = {\bf j\,}   x && \mbox{\qquad by the preceding two lines}
\end{eqnarray*}
Since $z = {\bf j\,} x$, we have $z {\sf S} {\bf 0} = z$.
Since $z$ was arbitrary, we have proved the Church counting axiom.
That completes the proof of the lemma.

\section{Conclusion}
We have thoroughly studied the Church numbers in NF set theory,
thus relating the logical work of the two great twentieth-century
logicians Quine and Church.  This analysis led to the result that
the set of Church numbers ${\mathbb N}$, if not infinite, must have a
certain structure under successor, namely a stem ${\sf STEM}$ and a loop ${\mathcal L}$,
connected at the unique double successor.  That situation led
to the Annihilation Theorem:  There is a Church number ${\bf m}$ such
that the ${\bf m}$-th iterate of any map from any finite set to itself
is the identity.

This leads to a contradiction if we can show that there is a finite
set with a permutation of order not divisible by ${\bf m}$.
This we could do only under the additional assumption
of the Church counting axiom, that $j {\sf S} {\bf 0} = j$
for every Church number $j$.

Assuming the Church counting axiom, we can use the Annihilation
Theorem to prove that the set ${\mathbb N}$ of Church numbers
is not finite.
That result is new even in NF with classical reasoning.  That is,
Specker's result shows that ${\mathbb F}$ is infinite, but that was not
known to imply anything about ${\mathbb N}$, even with the aid of the
Rosser counting axiom.

We also proved that if ${\mathbb N}$ is not finite, then ${\mathbb N}$ is infinite
and Church successor is injective.
While that result is classically trivial, it is far from obvious
intuitionistically.  That implicaation does not require the
Church counting axiom.  Together, the two results show that Heyting's
arithmetic HA is interpretable in INF plus the Church counting axiom.
It remains open whether HA is interpretable in INF alone.

However,  if we are willing to use classical
logic, then we do not need the Church counting axiom, as we will
now explain.  Specker proved, using classical logic, that ${\mathbb F}$ is
infinite.  We proved in Theorem~\ref{theorem:FinfiniteimpliesNinfinite}
that
if ${\mathbb F}$ is infinite, but ${\mathbb N}$ is finite,
then every Church number
is the order of some permutation, contradicting the Annihilation Theorem.
Therefore, if ${\mathbb F}$ is infinite, ${\mathbb N}$ is not finite, and therefore ${\mathbb N}$
is infinite.   Then, appealing to Specker's result, classical logic implies
${\mathbb N}$ is infinite.  Summarizing, we showed that ${\mathbb N}$ is infinite if either
the Rosser counting axiom, or the Church counting axiom, or classical logic
holds.   It remains open whether INF proves ${\mathbb N}$ is infinite (without any
additional assumption).

We also  proved that the Church counting axiom
is equivalent to the Rosser counting axiom in INF.  This proof uses
our results that Church counting implies ${\mathbb N}$ is infinite.  And again,
although we proved the equivalent intuitionistically,  it is a new result
even classically.

redpajama_set_name: RedPajamaArXiv