Is there a simple formalism in which self-referential definitions can be made safely?

Is there a simple formalism in which self-referential definitions can be
made safely?

Consider the expression $g(f(x)).$ Its easy to draw this in a tree
diagram; the bottom node is $x$, above that is $f$, and above that is $g$.
Now consider the $(D(f))(x),$ for instance imagine that $D$ denotes
differentiation. If you try to draw this as a tree, you'll get "brackets"
in your tree. (Try it!)
To avoid these brackets, the best way is probably to introduce an
"evaluation function" $\mathrm{eval}(*,*)$ such that $\mathrm{eval}(f,x) =
f(x)$ so long as this expression is defined. Then we have $$(D(f))(x) =
\mathrm{eval}(D(f),x)$$
and we can draw this as a tree just fine. Problem solved!
However, to formalize this in ZFC, we'd have to restrict the definition of
$\mathrm{eval}$ to functions $f$ that are 'internal' to the theory. In
particular, theorems like $$\mathrm{eval}(\mathrm{eval},(f,x)) = f(x)$$
aren't even grammatically coherent. This seems moderately wasteful of what
appears to be a perfectly legitimate (though trivial) theorem. Probably,
there are similarly - but less trivial - theorems provable in a
self-referential language that allows these kinds of things.
So, my question is, is there a simple formalism in which self-referential
definitions can be made safely? It would have to be just restrictive
enough to block Russell-like paradoxes, but not so restrictive so as to
block our ability to define self-referential functions like
$\mathrm{eval}, \mathrm{identity}, \mathrm{domain}, \mathrm{range},
\mathrm{kernel}$ etc.



Discussion. What we'd really like is to be able to assert that
$$\mathrm{eval}(f,x) = f(x)$$
for all functions $f,$ including functions like $\mathrm{eval},
\mathrm{identity}, \mathrm{domain}, \mathrm{range}, \mathrm{kernel}$ etc.
However, just allowing definition-by-cases leads to Russell-like
paradoxes. For instance, lets assume that there exists a non-function,
call it $3$ for concreteness (we'll have to assume that $3$ is not a
Church numeral for this argument to work!). Now define a function $g$ by
cases as follows.
$$f(f)=f \rightarrow g(f) = 3$$ $$f(f)\neq f \rightarrow g(f) = f.$$
Try to evaluate $g(g)$ and you'll get a contradiction.