[proofplan] The proof constructs an explicit element $\beta \in L$ satisfying $\beta^n \in K$ and $L = K(\beta)$, using the Lagrange resolvent. Let $\phi$ be a generator of $\operatorname{Gal}(L/K)$. Define the $K$-linear map $T_\zeta \colon L \to L$ by $T_\zeta(\alpha) = \sum_{k=0}^{n-1} \zeta^k \phi^k(\alpha)$, and use [Dedekind's Lemma on the Linear Independence of Characters](/theorems/???) to find an $\alpha \in L$ with $\beta := T_\zeta(\alpha) \neq 0$. A direct computation shows $\phi(\beta) = \zeta^{-1} \beta$, which forces $\beta^n \in K$ (since $\phi$ fixes $\beta^n$) and $\beta \notin K$ (since $\zeta \neq 1$). Finally, a degree count using the minimal polynomial of $\beta$ over $K$ shows $[K(\beta) : K] = n = [L : K]$, so $L = K(\beta)$. [/proofplan]

[step:Construct the Lagrange resolvent $\beta = T_\zeta(\alpha)$ using Dedekind's Lemma]Let $\phi$ be a generator of $\operatorname{Gal}(L/K) \cong \mathbb{Z}/n\mathbb{Z}$. Define the $K$-linear map \begin{align*} T_\zeta \colon L &\to L \\ \alpha &\mapsto \sum_{k=0}^{n-1} \zeta^k \phi^k(\alpha). \end{align*} The automorphisms $\operatorname{id} = \phi^0, \phi^1, \ldots, \phi^{n-1}$ are pairwise distinct field automorphisms $L \to L$. By [Dedekind's Lemma on the Linear Independence of Characters](/theorems/???), any collection of distinct field homomorphisms from $L$ to $L$ is linearly independent over $L$. Since $\zeta^0, \zeta^1, \ldots, \zeta^{n-1}$ are not all zero (in particular $\zeta^0 = 1 \neq 0$), the $L$-linear combination $T_\zeta = \sum_{k=0}^{n-1} \zeta^k \phi^k$ is not the zero map. Therefore there exists $\alpha \in L$ such that \begin{align*} \beta := T_\zeta(\alpha) = \sum_{k=0}^{n-1} \zeta^k \phi^k(\alpha) \neq 0. \end{align*} Fix such an $\alpha$, and set $\beta := T_\zeta(\alpha)$. The element $\beta$ is the **Lagrange resolvent** of $\alpha$ with respect to $\zeta$ and $\phi$.[/step]

[guided]The central challenge of the proof is to produce an element $\beta \in L$ with two properties: $\beta^n \in K$ (so that $K(\beta)$ is contained in a radical extension) and $[K(\beta) : K] = n$ (so that $K(\beta) = L$). We cannot simply guess such an element; instead, we construct one using the Galois group action. Let $\phi$ be a generator of $\operatorname{Gal}(L/K)$. Since $L/K$ is cyclic of degree $n$, the group $\operatorname{Gal}(L/K) = \{\operatorname{id}, \phi, \phi^2, \ldots, \phi^{n-1}\}$ consists of exactly $n$ distinct automorphisms of $L$ that fix $K$. Define the $K$-linear map \begin{align*} T_\zeta \colon L &\to L \\ \alpha &\mapsto \sum_{k=0}^{n-1} \zeta^k \phi^k(\alpha). \end{align*} Why this particular linear combination? The powers $\zeta^k$ are chosen so that applying $\phi$ to $T_\zeta(\alpha)$ shifts the index and produces a scalar multiple — this is engineered in the next step. The construction is known as a **Lagrange resolvent**. We need $T_\zeta$ to be a nonzero map, so that some input $\alpha$ gives a nonzero output. The automorphisms $\phi^0 = \operatorname{id}, \phi^1, \ldots, \phi^{n-1}$ are pairwise distinct field homomorphisms from $L$ to $L$. By [Dedekind's Lemma on the Linear Independence of Characters](/theorems/???), any finite collection of distinct field homomorphisms from a field to another field is linearly independent over the target field. In our case, the target field is $L$ itself, so the homomorphisms $\phi^0, \phi^1, \ldots, \phi^{n-1}$ are $L$-linearly independent. The map $T_\zeta$ is an $L$-linear combination of these homomorphisms with coefficients $\zeta^0 = 1, \zeta^1, \ldots, \zeta^{n-1} \in K \subset L$. Since not all coefficients are zero ($\zeta^0 = 1 \neq 0$) and the homomorphisms are $L$-linearly independent, the linear combination $T_\zeta = \sum_{k=0}^{n-1} \zeta^k \phi^k$ is not the zero map. Therefore there exists $\alpha \in L$ with \begin{align*} \beta := T_\zeta(\alpha) = \sum_{k=0}^{n-1} \zeta^k \phi^k(\alpha) \neq 0. \end{align*} Fix such an $\alpha$ and set $\beta := T_\zeta(\alpha)$. What would go wrong without Dedekind's Lemma? We would have no guarantee that $T_\zeta$ is nonzero — the automorphisms might conspire so that $\sum_{k} \zeta^k \phi^k(\alpha) = 0$ for every $\alpha \in L$. Dedekind's Lemma is the tool that prevents this cancellation.[/guided]

[step:Verify $\phi(\beta) = \zeta^{-1} \beta$ by applying $\phi$ to the resolvent]We compute $\phi(\beta)$ by applying $\phi$ term-by-term. Since $\phi$ is a field automorphism fixing $K$, and each $\zeta^k \in K$, we have $\phi(\zeta^k) = \zeta^k$. Therefore: \begin{align*} \phi(\beta) &= \phi\!\left(\sum_{k=0}^{n-1} \zeta^k \phi^k(\alpha)\right) = \sum_{k=0}^{n-1} \zeta^k \phi^{k+1}(\alpha). \end{align*} Writing out the sum explicitly and using $\phi^n = \operatorname{id}$ (since $\phi$ has order $n$): \begin{align*} \phi(\beta) &= \zeta^0 \phi^1(\alpha) + \zeta^1 \phi^2(\alpha) + \cdots + \zeta^{n-2} \phi^{n-1}(\alpha) + \zeta^{n-1} \underbrace{\phi^n(\alpha)}_{= \alpha}. \end{align*} Factor out $\zeta^{-1}$: for each term $\zeta^k \phi^{k+1}(\alpha)$, write $\zeta^k = \zeta^{-1} \cdot \zeta^{k+1}$, so $\zeta^k \phi^{k+1}(\alpha) = \zeta^{-1} \cdot \zeta^{k+1} \phi^{k+1}(\alpha)$. This gives: \begin{align*} \phi(\beta) &= \zeta^{-1}\!\left(\zeta^1 \phi^1(\alpha) + \zeta^2 \phi^2(\alpha) + \cdots + \zeta^{n-1} \phi^{n-1}(\alpha) + \zeta^n \alpha\right). \end{align*} Since $\zeta^n = 1$ (as $\zeta$ is a primitive $n$-th root of unity), the last term inside the parentheses is $\zeta^n \alpha = 1 \cdot \alpha = \zeta^0 \phi^0(\alpha)$. The expression in parentheses is therefore $\sum_{k=0}^{n-1} \zeta^k \phi^k(\alpha) = \beta$. Hence \begin{align*} \phi(\beta) = \zeta^{-1} \beta. \end{align*}[/step]

[guided]This is the step where the specific choice of coefficients $\zeta^k$ pays off. The goal is to show that $\phi$ acts on $\beta$ by multiplication by the scalar $\zeta^{-1}$, which will imply both that $\beta^n \in K$ and that $\beta \notin K$. Since $\phi$ is a $K$-automorphism of $L$ and each coefficient $\zeta^k$ lies in $K$, the automorphism $\phi$ passes through the coefficients: \begin{align*} \phi(\beta) &= \phi\!\left(\sum_{k=0}^{n-1} \zeta^k \phi^k(\alpha)\right) = \sum_{k=0}^{n-1} \phi(\zeta^k) \cdot \phi(\phi^k(\alpha)) = \sum_{k=0}^{n-1} \zeta^k \phi^{k+1}(\alpha). \end{align*} The effect of applying $\phi$ is to shift the index of the automorphism by one: each $\phi^k$ becomes $\phi^{k+1}$. Let us write out the sum explicitly to see the cyclic structure: \begin{align*} \phi(\beta) &= \zeta^0 \phi^1(\alpha) + \zeta^1 \phi^2(\alpha) + \zeta^2 \phi^3(\alpha) + \cdots + \zeta^{n-2} \phi^{n-1}(\alpha) + \zeta^{n-1} \phi^n(\alpha). \end{align*} The crucial observation is that $\phi$ has order $n$ in $\operatorname{Gal}(L/K)$, so $\phi^n = \operatorname{id}$, and therefore $\phi^n(\alpha) = \alpha$. The last term becomes $\zeta^{n-1} \alpha$. Now we want to relate this back to $\beta = \zeta^0 \alpha + \zeta^1 \phi(\alpha) + \zeta^2 \phi^2(\alpha) + \cdots + \zeta^{n-1} \phi^{n-1}(\alpha)$. Comparing term by term, each summand in $\phi(\beta)$ has a power of $\zeta$ that is one less than the corresponding summand in $\beta$ — the coefficient of $\phi^j(\alpha)$ in $\phi(\beta)$ is $\zeta^{j-1}$, while in $\beta$ it is $\zeta^j$. Factoring out $\zeta^{-1}$: \begin{align*} \phi(\beta) &= \zeta^{-1}\!\left(\zeta^1 \phi^1(\alpha) + \zeta^2 \phi^2(\alpha) + \cdots + \zeta^{n-1} \phi^{n-1}(\alpha) + \zeta^n \alpha\right). \end{align*} Since $\zeta$ is a primitive $n$-th root of unity, $\zeta^n = 1$, so $\zeta^n \alpha = 1 \cdot \alpha = \zeta^0 \phi^0(\alpha)$. The parenthesised expression is now \begin{align*} \zeta^0 \phi^0(\alpha) + \zeta^1 \phi^1(\alpha) + \zeta^2 \phi^2(\alpha) + \cdots + \zeta^{n-1} \phi^{n-1}(\alpha) = \sum_{k=0}^{n-1} \zeta^k \phi^k(\alpha) = \beta. \end{align*} Therefore $\phi(\beta) = \zeta^{-1} \beta$. The mechanism behind this calculation is the cyclic index shift: applying $\phi$ rotates the automorphisms $\phi^0, \phi^1, \ldots, \phi^{n-1}$ cyclically (since $\phi^n = \phi^0$), while the geometric weights $1, \zeta, \zeta^2, \ldots, \zeta^{n-1}$ are exactly the characters of $\mathbb{Z}/n\mathbb{Z}$. The Lagrange resolvent is a discrete Fourier transform of $\alpha$ with respect to the cyclic group action, and the eigenvalue relation $\phi(\beta) = \zeta^{-1} \beta$ is the statement that $\beta$ lies in the $\zeta^{-1}$-eigenspace of $\phi$.[/guided]

[step:Deduce $\beta^n \in K$ from the eigenvalue relation]We show that $\phi$ fixes $\beta^n$. Since $\phi$ is a ring homomorphism: \begin{align*} \phi(\beta^n) = \phi(\beta)^n = (\zeta^{-1} \beta)^n = \zeta^{-n} \beta^n. \end{align*} Since $\zeta$ is a primitive $n$-th root of unity, $\zeta^n = 1$, so $\zeta^{-n} = 1$. Therefore $\phi(\beta^n) = \beta^n$. The fixed field of $\langle \phi \rangle = \operatorname{Gal}(L/K)$ is $K$, by the Galois correspondence: since $L/K$ is Galois with group $\langle \phi \rangle$, the fixed field $L^{\langle \phi \rangle} = K$. The element $\beta^n$ is fixed by $\phi$, and since $\phi$ generates $\operatorname{Gal}(L/K)$, the element $\beta^n$ is fixed by every automorphism in $\operatorname{Gal}(L/K)$. Hence $\beta^n \in L^{\operatorname{Gal}(L/K)} = K$. Set $a := \beta^n \in K$.[/step]

[guided]We want to show that $\beta^n$ lies in the base field $K$. The strategy is to show that $\beta^n$ is fixed by every element of $\operatorname{Gal}(L/K)$, and then invoke the Galois correspondence. Since $\phi$ is a field automorphism, it is in particular a ring homomorphism, so $\phi(\beta^n) = \phi(\beta)^n$. Using the relation $\phi(\beta) = \zeta^{-1} \beta$ established in the previous step: \begin{align*} \phi(\beta^n) = \phi(\beta)^n = (\zeta^{-1} \beta)^n = (\zeta^{-1})^n \cdot \beta^n = \zeta^{-n} \beta^n. \end{align*} Since $\zeta$ is a primitive $n$-th root of unity, $\zeta^n = 1$ by definition, hence $\zeta^{-n} = (\zeta^n)^{-1} = 1^{-1} = 1$. Therefore $\phi(\beta^n) = \beta^n$. Now, $\phi$ generates $\operatorname{Gal}(L/K)$. Every element of $\operatorname{Gal}(L/K)$ is of the form $\phi^m$ for some $m \in \{0, 1, \ldots, n-1\}$. Since $\phi(\beta^n) = \beta^n$, iterating gives $\phi^m(\beta^n) = \beta^n$ for every $m$. Hence $\beta^n$ is fixed by every automorphism in $\operatorname{Gal}(L/K)$. By the Galois correspondence, since $L/K$ is a Galois extension with $\operatorname{Gal}(L/K) = \langle \phi \rangle$, the fixed field of $\operatorname{Gal}(L/K)$ is exactly $K$: $L^{\operatorname{Gal}(L/K)} = K$. Since $\beta^n$ is fixed by all of $\operatorname{Gal}(L/K)$, we conclude $\beta^n \in K$. Set $a := \beta^n \in K$. This gives us half of what we need: $\beta$ is a root of the polynomial $X^n - a \in K[X]$.[/guided]

[step:Show $\beta \notin K$ and conclude $L = K(\beta)$ by a degree argument]Since $\phi(\beta) = \zeta^{-1} \beta$ and $\zeta$ is a primitive $n$-th root of unity, $\zeta^{-1} \neq 1$ (this uses $n \ge 2$; the case $n = 1$ is vacuous since $L = K$). Therefore $\phi(\beta) \neq \beta$, so $\beta$ is not fixed by $\phi$. Since every element of $K$ is fixed by $\phi$ (as $\phi \in \operatorname{Gal}(L/K)$), we have $\beta \notin K$, and so $K \subsetneq K(\beta) \subset L$. It remains to show $K(\beta) = L$. The element $\beta$ satisfies $\beta^n = a \in K$, so $\beta$ is a root of the polynomial $f(X) := X^n - a \in K[X]$. The minimal polynomial of $\beta$ over $K$ divides $f$, so $[K(\beta) : K] = \deg(\min_K(\beta)) \le n$. We now show $[K(\beta) : K] = n$. Since $K$ contains the primitive $n$-th root of unity $\zeta$, the roots of $X^n - a$ in any splitting field are $\zeta^j \beta$ for $j = 0, 1, \ldots, n-1$. The iterates of the eigenvalue relation give, for each $m \in \{0, 1, \ldots, n-1\}$: \begin{align*} \phi^m(\beta) = \zeta^{-m} \beta. \end{align*} To verify this: $\phi^1(\beta) = \zeta^{-1} \beta$ is established. Inductively, if $\phi^m(\beta) = \zeta^{-m} \beta$, then $\phi^{m+1}(\beta) = \phi(\zeta^{-m} \beta) = \zeta^{-m} \phi(\beta) = \zeta^{-m} \cdot \zeta^{-1} \beta = \zeta^{-(m+1)} \beta$, using that $\zeta^{-m} \in K$ is fixed by $\phi$. Since $\zeta$ is a primitive $n$-th root of unity, the elements $\zeta^0, \zeta^{-1}, \zeta^{-2}, \ldots, \zeta^{-(n-1)}$ are pairwise distinct. Therefore $\phi^0(\beta) = \beta, \phi^1(\beta) = \zeta^{-1}\beta, \ldots, \phi^{n-1}(\beta) = \zeta^{-(n-1)}\beta$ are $n$ distinct elements of $L$, all of which are roots of $X^n - a$. Each $\phi^m$ is a $K$-automorphism of $L$. If $g \in K[X]$ and $g(\beta) = 0$, then applying $\phi^m$ to both sides gives $g(\phi^m(\beta)) = 0$, because $\phi^m$ fixes the coefficients of $g$. In particular, every $\phi^m(\beta) = \zeta^{-m}\beta$ is a root of $\min_K(\beta)$. Since the elements $\zeta^{-m}\beta$ for $m = 0, 1, \ldots, n-1$ are pairwise distinct (as $\beta \neq 0$ and $\zeta$ is a primitive $n$-th root of unity), the polynomial $\min_K(\beta)$ has at least $n$ distinct roots. On the other hand, $\min_K(\beta)$ divides $X^n - a$ (since $\beta^n = a$), which has degree $n$. Therefore $\deg(\min_K(\beta)) = n$, and so \begin{align*} [K(\beta) : K] = \deg(\min_K(\beta)) = n = [L : K]. \end{align*} Since $K(\beta) \subset L$, this forces $L = K(\beta)$.[/step]

[guided]This final step has two parts: showing $\beta \notin K$, and then showing $K(\beta) = L$ (not merely a proper intermediate extension). **Part 1: $\beta \notin K$.** The eigenvalue relation gives $\phi(\beta) = \zeta^{-1} \beta$. Since $\zeta$ is a *primitive* $n$-th root of unity with $n \ge 2$, we have $\zeta \neq 1$, hence $\zeta^{-1} \neq 1$. Therefore $\phi(\beta) = \zeta^{-1}\beta \neq \beta$. But $\phi \in \operatorname{Gal}(L/K)$ fixes every element of $K$. Since $\beta$ is not fixed by $\phi$, $\beta \notin K$. (When $n = 1$, the extension $L/K$ is the identity $L = K$, and the theorem holds vacuously: any $\beta \in K$ satisfies $\beta^1 \in K$ and $K(\beta) = K = L$.) **Part 2: $K(\beta) = L$.** We know $K \subsetneq K(\beta) \subset L$ and $[L : K] = n$. We need $[K(\beta) : K] = n$. The element $\beta$ is a root of $X^n - a \in K[X]$ where $a = \beta^n \in K$. Since $K$ contains the primitive $n$-th root of unity $\zeta$, all $n$ roots of $X^n - a$ are $\beta, \zeta\beta, \zeta^2\beta, \ldots, \zeta^{n-1}\beta$. These are pairwise distinct because $\beta \neq 0$ and the powers $\zeta^0, \zeta^1, \ldots, \zeta^{n-1}$ are distinct. Now, the key observation: applying the iterates of $\phi$ to $\beta$ produces all these roots. We verify by induction that $\phi^m(\beta) = \zeta^{-m}\beta$ for each $m \in \{0, 1, \ldots, n-1\}$: - **Base case:** $\phi^0(\beta) = \beta = \zeta^0 \beta$. - **Inductive step:** If $\phi^m(\beta) = \zeta^{-m}\beta$, then \begin{align*} \phi^{m+1}(\beta) = \phi(\phi^m(\beta)) = \phi(\zeta^{-m}\beta) = \zeta^{-m}\phi(\beta) = \zeta^{-m} \cdot \zeta^{-1}\beta = \zeta^{-(m+1)}\beta. \end{align*} Here we used that $\zeta^{-m} \in K$ is fixed by $\phi$. The elements $\phi^0(\beta), \phi^1(\beta), \ldots, \phi^{n-1}(\beta)$ are therefore $\beta, \zeta^{-1}\beta, \zeta^{-2}\beta, \ldots, \zeta^{-(n-1)}\beta$ — which are $n$ distinct roots of $X^n - a$. Why does this force $\deg(\min_K(\beta)) = n$? Each $\phi^m$ is a $K$-automorphism of $L$. If $\beta$ is a root of a polynomial $g \in K[X]$, then $\phi^m(\beta)$ is also a root of $g$ (because $\phi^m$ fixes the coefficients of $g$). In particular, every root of $\min_K(\beta)$ is also a root of $\min_K(\beta)$ under the action of $\phi^m$ — but more precisely, all $n$ elements $\phi^m(\beta) = \zeta^{-m}\beta$ are roots of $\min_K(\beta)$, because $\min_K(\beta)$ is the minimal polynomial of $\beta$ and each $\phi^m(\beta)$ is a root of the same polynomial ($\phi^m$ permutes roots of polynomials in $K[X]$). Since these are $n$ distinct roots and $\min_K(\beta)$ divides $X^n - a$ (degree $n$), we conclude $\deg(\min_K(\beta)) = n$. Therefore $[K(\beta) : K] = \deg(\min_K(\beta)) = n = [L : K]$. Since $K(\beta) \subset L$, the Tower Law gives $[L : K(\beta)] = 1$, hence $L = K(\beta)$. To summarise: we have found $\beta \in L$ with $\beta^n = a \in K$ and $L = K(\beta)$. The extension $L/K$ is generated by an $n$-th root of an element of $K$, as required.[/guided]