Random Ramblings

Safe JSON in Lean: json-schema-lean or subtyping

2026-01-16T18:36:00-07:00

Safe JSON in Lean: json-schema-lean or subtyping

I wanted to explore using Vega-Lite for plotting in Lean, and I wanted to have some safety check. VegaLite has a JSON schema. One giant PR later, json-schema-lean can now validate plotting configs. It is ready for some broader testing of more diverse schema, and it should be helpful for statically known single-file schemas. Caveats:

Only supports JSON Schema Draft 7
Does not support automatic file/http remote reference resolution
Not battle-tested, only regular tested

Along the way, I also made a URI library lean-uri.

A Quick Demo

There is a single file for VegaLite's schema, so we load in the Vega-Lite schema with include_str, parse the schema, and validate our data.

import JsonSchema.Validation

def exampleVegaLite : Lean.Json :=
  Option.get! <| Except.toOption <| Lean.Json.parse r##"{
  "$schema": "https://vega.github.io/schema/vega-lite/v6.json",
  "data": {"url": "https://vega.github.io/vega-lite/data/seattle-weather.csv"},
  "mark": "bar",
  "encoding": {
    "x": {
      "timeUnit": "month",
      "field": "date",
      "type": "ordinal",
      "title": "Month of the year"
    },
    "y": {
      "aggregate": "count",
      "type": "quantitative"
    },
    "color": {
      "field": "weather",
      "type": "nominal",
      "scale": {
        "domain": ["sun", "fog", "drizzle", "rain", "snow"],
        "range": ["#e7ba52", "#c7c7c7", "#aec7e8", "#1f77b4", "#9467bd"]
      },
      "title": "Weather type"
    }
  }
}
"##
def vegaliteSchemaStr : String := include_str "v6.4.1.json"

def vegaliteSchema : JsonSchema.Schema :=
  ((Lean.Json.parse vegaliteSchemaStr) >>= JsonSchema.schemaFromJson
  ).toOption.get!

Except.ok ()#eval JsonSchema.validate vegaliteSchema exampleVegaLite

We can then embed the JSON into an HTML tag and display it as needed:

Options for Type-Level Safety

Since creating specialized data types identifies errors ahead of time, I tried my hand at turning schemas into Lean types. But I became dissatisfied with how JSON Schema code generation produces unergonomic types, no matter what I try. This mismatch pains me in several languages. Meanwhile, most languages don't reason about runtime validation. If you know that a JSON passed validation, then the compiler can't guarantee any properties of your data. But in Lean, we can use the validation as an assumption in a theorem. Then we can prove that fields are populated, or go backwards and prove that validation would check if we ran it. This idea wouldn't leave me, so I tried to implement it and came up with json-subtyping.

When attaching properties to our JSON data in Lean, it's convenient to emulate a kind of subtyping. Although the standard sum and product types have many nice properties for theorem proving, plotting becomes excessively verbose. When every union is implicitly tagged with a discriminator, as in Lean, extensions and escape hatches for plots complicate every union construction. Subtyping is one approach to minimizing the difficulty when you extend types. Furthermore, if you use some gradual typing, you can move fast when you don't need generalization, like for some one-off plots.

I also have hope for similar schema-based subtyping to provide guarantees for dataframe libraries, SQL results, and tensor manipulation. Those are places where traditional type systems have dropped the ball, where even validation frameworks like Pandera for pandas have high costs and limited utility. Using dependent types can invite "dependent type hell", but I had luck with just attaching the validation check as a Prop. By avoiding inductive "indexed families" in favor of a subtyping pattern, we also can more easily vary the underlying implementation. That said, the theorem proving for subtyping still require a significant amount of work, so I would only consider it when safety is a requirement not a luxury. Usually I am plotting very specific data, where it is easy to check after the fact.

By sharing an excessive level of detail below, I aim to encourage more people to work on libraries like json-schema-lean--Lean needs more libraries in my opinion. I also want to explore the details around code generation options in Lean. Finally, I want to show that subtyping is a viable pattern for type safety in dependent type languages. But at the end, there are still several unexplored options for better plotting in Lean I'll mention.

Step 1: JSON Schema in Lean

Starting out, I was lucky there was already a json-schema-lean library--a GSoC 2024 project. The main branch was incomplete, but there was nice testing infrastructure. I figured it wouldn't be too difficult to complete.

JSON Schema

JSON Schema is a schema spec; specs are written in JSON, and schema implementations let you validate JSON. The schema language lets you constrain JSON values, take unions of schemas, reference external definitions, etc. Tools like OpenAPI and openapi-generator generate stubs in different languages. Personally, the generated code is substandard but more or less workable depending on the language and application.

I have primarily used JSON Schema Draft 7, which has a relatively short spec. With it in hand, I implemented most of the features within a week or two, using a lot of Claude Code for most features, especially once it got really repetitive. I discovered that there were a lot of features of Draft 7 I never use nor want to:

You can pattern match regexes in strings.
You can have loops in your schema references, which you have to guard against.
There are properties, pattern properties, additional properties, etc. These all interact with each other.

The schema turned into a big mutually inductive type, since schemas have unusual options like just true or nested if-then-else schemas.

Bowtie's comprehensive tests saved me a bunch. There were quite a few parts around references where the spec confused me. Lean has a few regex libraries to choose from like Regex. That also saved me a lot of trouble since regex is not an isolated feature; it can be used to select schemas for properties. Sadly there was another missing element leading to yet another side-quest in the form of URI resolution.

Step 1.1: URIs

Uniform Resource Identifiers are special strings that serve as semantic IDs. They don't guarantee stability or uniqueness, but they often tell you something about some digital resource. URLs are a subtype of URIs. A URL is a URI plus the protocol to retrieve the URL. The URI spec (RFC 3986) breaks URI into URI = scheme ":" ["//" authority] path ["?" query] ["#" fragment], and it defines the percent-encoding and decoding (like why Google replaces spaces with %20 in the results URL). Different schemes can then have special rules on top like URL domain resolution or base64-encoding. There's also relative URIs to access "nearby" resources.

So what does this have to do with JSON Schema? Well, $ids and $refs follow the rules of URIs. You can use different protocols, you can use relative paths, and fragments point to definitions within files. Since Lean didn't have a URI library, I implemented one at lean-uri. Since testing is not as well centralized compared to JSON Schema, I mainly picked examples from the RFC and looked at Haskell equivalents. For implementation, I started with hoping Claude could read and operationalize the spec, then rewriting it when it got ugly. Since I hold parser combinators close to heart, I started with some hand-written Std.Internal.Parsec.String, and tried to work within that monad, making the code more uniform. The final interface provides parsing, normalization, resolution, which all feature in JSON Schema.

/-- info: "https://example.com/a/c?x#y" -/
#guard_msgs in
#eval match LeanUri.URI.parse "https://EXAMPLE.com/a/./b/../c?x#y" with
| .ok u   => (LeanUri.URI.normalize u).toString
| .error e => s!"error: {e}"

Step 1.1.1: Testing

Since URIs (unlike URLs) didn't seem to have a nice testing framework already, I really wanted to count on my own testing. Lean has a way to hook up an executable to lake test, and that attracted me too. I didn't really like LSpec, which appears to be the only testing library in Lean. My conclusion: time to write a little testing library. I decided to put it in a Test monad based on IO, where you can log passed, failed, and skipped tests to monad state, group tests, etc.

inductive TestTree where
  | test (name : String) (passed : Bool) (skipped : Bool := false) (message : Option String := none)
  | group (name : String) (children : Array TestTree) (skipped : Bool := false)
deriving Inhabited, Repr

structure TestState where
  stack : List (String × Array TestTree) := [ ("", #[]) ] -- (group name, children)
  filter : String → Bool := fun _ => true
deriving Inhabited

abbrev TestM := StateT TestState IO

This worked fine for what I needed, and I reused the helpers for testing code gen on a branch of json-schema-lean. Some tiny features like filtering or whatever are simple. I doubt I'll use this long-term, since having IO in all your tests is a blessing and a curse. There are too many features I want in a truly excellent testing library to use my hacky version forever.

-- This is nice, but could it be simpler?
def testHexConversion : TestM Unit := testFunction "Hex Conversion" do
  testEq "hex 0" (uInt8toOneHexChar 0) '0' -- testEq registers the equality test under a name

Once I had the basic URI interface, it was mainly a matter of repeatedly testing the $ref and $id cases until I got tests passing.

A slight detour: Json Pointer Fragments

We can refer to definitions within files as well with JSON "pointer fragments". The pointer fragment #/definitions/A/ refers to obj["definitions"]["A"], and similar notation is available for indexing lists, etc. RFC 6901 describes the format for JSON pointer fragments trailing on a URI anchor.

What doesn't work?

Several Bowtie tests require you to read referenced JSON schemas on the fly from a URL. Lean does not yet (as of January 2026) have a standard HTTP library to handle URLs, so I just decided to give up on that part.

Step 2: Json Schema Code Gen

Now that I parse and understand all the features of JSON schema, I decided to try generating Lean structs from JSON schema. My strategy plodded along, trying to parse Schema into the Except String Std.Format monad: first try to build simple abbreviations, then structures, etc. I considered macros, but inserting comments eluded me. I settled on Std.Formats, Lean's way to handle indentation, precedence, etc. The API was far nicer than I deserved, even though it is string manipulation.

Eventually, I needed more code generation context, recursion, and custom toJson/fromJson instances. I settled on writing all the parsers into a SchemaGen TypeDefinition monad where SchemaGen had context and error handling while TypeDefinition held all the parsed definitions. Using a custom monad name here is extremely useful, and I understand now why so many libraries live in a custom named monad transformer.

/-- A complete type definition including the type declaration and optional JSON instances -/
structure TypeDefinition where
  /-- The main type declaration (structure, inductive, or abbrev) -/
  typeDecl : Std.Format
  /-- Optional FromJson instance implementation -/
  fromJsonImpl : Option Std.Format := none
  /-- Optional ToJson instance implementation -/
  toJsonImpl : Option Std.Format := none
  /-- Nested type definitions that should be prepended before this definition -/
  dependencies : List TypeDefinition := []
  /-- Extra doc comment for use in structures and inductives -/
  extraDocComment : Option Std.Format := none
deriving Inhabited

/-- Configuration for code generation -/
structure Config where
  /-- How to sanitize names to valid Lean identifiers -/
  sanitizeName : String → String
  /-- Indentation string -/
  indent : String := "  "
  /-- Whether to generate FromJson instances -/
  generateFromJson : Bool := false
  /-- Whether to generate ToJson instances -/
  generateToJson : Bool := false
  /-- Whether to include the base URI filename in generated type names.
      When true: user.json with definition "Address" → "UserAddress"
      When false: user.json with definition "Address" → "Address" -/
  includeBaseNamePrefix : Bool := false

/-- Identifies a schema by its canonical URI and path -/
structure SchemaID where
  baseURI : LeanUri.URI
  path : List String
deriving BEq, Hashable, Inhabited

/-- Extended code generation context with reference support -/
structure CodeGenContext where
  /-- Resolver for looking up schemas -/
  resolver : Resolver
  /-- Mapping from SchemaID to generated type name -/
  nameMap : Std.HashMap SchemaID String
  /-- Configuration -/
  config : Config
  /-- Base URI which gets updated as we traverse -/
  baseURI : LeanUri.URI
  /-- Current type name being generated (for error reporting) -/
  currentTypeName : Option String := none
  /-- Current schema ID being processed (for error reporting) -/
  currentSchemaID : Option SchemaID := none

abbrev SchemaGen := ReaderT CodeGenContext (Except String ·)

def SchemaGen.run (gen : SchemaGen α) (ctx : CodeGenContext)
    : Except String α := ReaderT.run gen ctx

Lean requires mutually recursive types to be put in mutual blocks, so Tarjan's strongly connected components lets me detect the cyclic dependencies in the schema reference graph. The implementation can essentially be automated as there exist examples of it in Mathlib and Lean.SCC. So Claude could do it, taking away some of my fun ☹️.

Aside from that, there are so many different special cases, abbreviations, inductives, etc. The tension between verbose inductives and the unintended consequences of abbreviations was quite annoying.

Step 3: Code Gen with Vega-Lite

How did code gen work with Vega-Lite?

Mutual inductive types don't generate right, oops?
It would take several minutes to compile, and it's >15,000 lines.
All the code is too ugly to use.

Once I saw how I'd have to construct a RectConfig, I realized the library would not be fun to use as a whole.

structure RectConfig where
  /-- The horizontal alignment of the text or ranged marks (area, bar, image, rect, rule). One of `"left"`, `"right"`, `"center"`.

    __Note:__ Expression reference is *not* supported for range marks. -/
  align : Option (Align ⊕ ExprRef) := none
  /-- The rotation angle of the text, in degrees. -/
  angle : Option (Float ⊕ ExprRef) := none
  /-- A boolean flag indicating if [ARIA attributes](https://developer.mozilla.org/en-US/docs/Web/Accessibility/ARIA) should be included (SVG output only). If `false`, the "aria-hidden" attribute will be set on the output SVG element, removing the mark item from the ARIA accessibility tree. -/
  aria : Option (Bool ⊕ ExprRef) := none
  /-- Sets the type of user interface element of the mark item for [ARIA accessibility](https://developer.mozilla.org/en-US/docs/Web/Accessibility/ARIA) (SVG output only). If specified, this property determines the "role" attribute. Warning: this property is experimental and may be changed in the future. -/
  ariaRole : Option (String ⊕ ExprRef) := none
  /-- A human-readable, author-localized description for the role of the mark item for [ARIA accessibility](https://developer.mozilla.org/en-US/docs/Web/Accessibility/ARIA) (SVG output only). If specified, this property determines the "aria-roledescription" attribute. Warning: this property is experimental and may be changed in the future. -/
  ... -- It goes on like this for all the alphabetically sorted fields.

Now instead of {align: "left", ...}, we have to use .some (.inl .left). Specifying .inl or .inr and finding the right enum name can be really annoying. The long list of fields makes it difficult to remember which one if any is required. There are definitely ways to simplify this, but doing it automatically might be a bit much.

Back to the drawing board

You know what would be really convenient? If you could determine if the JSON schema validation passed during compile time. If the entire JSON is known at compile time, we can prove it using by native_decide to run the computation validate schema json and verify it equals true. What if a theorem about your JSON's structure proved validate schema json would pass? That sounds great, but proving the most useful properties requires validate terminates--not an easy proof at all. If we use a more restrictive schema language, we could more easily prove validation ahead of time.

I put this idea away for a week or so. After using TypeScript a bit professionally, I figured that we could crib TypeScript's homework and use a fragment of it to check JSON. One day I spent a few hours writing up a blueprint in Typst (an up-and-coming LaTeX alternative). This was also more fun than improving JSON Schema validation.

I also considered building the schema checking right into the JSON constructors as an inductive "indexed family", but using a schema.check function let me use the existing JSON data structure as a base. This brought me to separating out the proof data into a subtype equivalent to { x : Json // schema.check x }, which feels like a breath of fresh air compared to carefully encoding properties inductively. Overall, I believe that decoupling your evidence from your data is by default the correct approach, so that you only depend on a minimal amount of structure for your data. For example, we may want to one day switch to a more optimized tree format, which is easier the fewer propositions are bundled in it. We will use a few indexed families later for specific proofs in object construction and subtyping, but it is restricted to within those procedures.

TypeScript

JavaScript has 6 types: null, string, number, boolean, object, undefined. Many "types" in JavaScript are really just special objects like "functions". TypeScript lets you gradually define types to assign properties of variables at code locations, and then it will check properties "x has property 'id'" at compile-time by inspecting the control flow graph connecting locations. TypeScript does not try much to be sound.

Blueprint

I've never taken any course on type theory, so I probably did not use proof tree rules correctly, but I wrote a bunch of them in the blueprint anyway. I found it helpful especially for subtyping objects correctly.

For objects, JSON objects are always allowed to have extra fields, which becomes a lot more annoying when you are checking whether fields exist in big type unions. More on that later.

Strange challenges

Lean has a built-in JSON type at Lean.Json, which is used for the language server among other applications. Since the JSON type is recursive, and the recursion is contained in types like Array and maps, Lean identifies it as a "nested inductive type".

Nested inductives are massaged much more to make them appear normal. They are reorganized as an ordinary inductive, and then new definitions are used to create the appearance of the original nested inductive. The default induction rules are a real pain to use, since they include the induction rules for Arrays and maps. Worse, you cannot include dependent terms in inductive data types. The kernel will error with nested inductive datatypes parameters cannot contain local variables, which retains some mystery to me.

`Std.TreeMap.Raw`

The local variables restriction prevents the use of Std.TreeMap, a balanced binary search tree, in nested structures like JSON. Std.TreeMap contains a proof that the tree is properly constructed. Without that "well-formed" predicate, operations like insertion and lookup have fewer guarantees, but its inclusion does not play well with the nested inductive. So instead we have to use Std.TreeMap.Raw, which has no proof the data is "well-formed". The usual solution is to add the well-formedness again in the inductive, but the Json type doesn't attach the well-formedness anywhere.

I carefully tried to work around potentially ill-formed trees by asserting properties about .get? calls or by constructing maps using ofList, whose output is always well-formed.

Proving anything about JSON

Given that Json sheds so many invariants, it is somewhat surprising how elegant it is to prove JSON properties. As long as you can prove termination of functions on JSON, you can write your own custom induction rules by proving induction terminates.

I spent a day reading Lean's reference manual on "well-founded recursion" and tried simplifying termination goals that appear in a Json.beq implementation implicitly using such recurion. The reference manual lays out how termination_by and decreasing_by let you access these normally hidden goals. As opposed to trying to use induction, we write a recursive function where we only call on "smaller" values somehow. You can use any "well-founded" relation you want, which guarantees that eventually an execution will reduce the data to nothing and no more recursive calls are possible.

For instance, when we iterate .obj map : Lean.Json and recursively call on the values, we want to know that (k, v) ∈ map implies the size of v is smaller than map, which is smaller than .obj map. Lean provides a sizeOf definition automatically for most types where this property is practically guaranteed. During automatic termination checking, Lean attaches the membership proofs to elements of lists with List.attach (l : List α) : List { x // x ∈ l }.

We can then apply List.sizeOf_lt_of_mem {a : α} {as : List α} (h : a ∈ as) : sizeOf a < sizeOf as.

Although this "attach" framework works well (and automatically) for lists and arrays, we lack those theorems for Std.TreeMap. After combing through Std.TreeMap's source code with Claude Code, I learned about Std.DTreeMap.Internal.Impl.toListModel. This function inefficiently flattens into a list, but the reasoning is far simpler. It's also proved equivalent to .toList, which is more efficient. Claude Code was essentially able to one-shot the sizeOf lemmas:

open Std.DTreeMap.Internal in
theorem Impl.sizeOf_lt_of_mem {α : Type u} {β : α → Type v} [SizeOf α] [(a : α) → SizeOf (β a)]
    {t : Impl α β} {k : α} {v : β k} (h : ⟨k, v⟩ ∈ t.toListModel) :
    sizeOf v < sizeOf t := byα:Type uβ:α → Type vinst✝¹:SizeOf αinst✝:(a : α) → SizeOf (β a)t:Impl α βk:αv:β kh:⟨k, v⟩ ∈ t.toListModel⊢ sizeOf v < sizeOf t
  induction t with
  | leaf =>leafα:Type uβ:α → Type vinst✝¹:SizeOf αinst✝:(a : α) → SizeOf (β a)k:αv:β kh:⟨k, v⟩ ∈ Impl.leaf.toListModel⊢ sizeOf v < sizeOf Impl.leaf simp [Impl.toListModel] at hAll goals completed! 🐙
  | inner sz k' v' l r ihl ihr =>innerα:Type uβ:α → Type vinst✝¹:SizeOf αinst✝:(a : α) → SizeOf (β a)k:αv:β ksz:Natk':αv':β k'l:Impl α βr:Impl α βihl:⟨k, v⟩ ∈ l.toListModel → sizeOf v < sizeOf lihr:⟨k, v⟩ ∈ r.toListModel → sizeOf v < sizeOf rh:⟨k, v⟩ ∈ (Impl.inner sz k' v' l r).toListModel⊢ sizeOf v < sizeOf (Impl.inner sz k' v' l r)
    simp only [Impl.toListModel_inner, List.mem_append, List.mem_cons] at hinnerα:Type uβ:α → Type vinst✝¹:SizeOf αinst✝:(a : α) → SizeOf (β a)k:αv:β ksz:Natk':αv':β k'l:Impl α βr:Impl α βihl:⟨k, v⟩ ∈ l.toListModel → sizeOf v < sizeOf lihr:⟨k, v⟩ ∈ r.toListModel → sizeOf v < sizeOf rh:⟨k, v⟩ ∈ l.toListModel ∨ ⟨k, v⟩ = ⟨k', v'⟩ ∨ ⟨k, v⟩ ∈ r.toListModel⊢ sizeOf v < sizeOf (Impl.inner sz k' v' l r)
    rw [Impl.inner.sizeOf_spec]innerα:Type uβ:α → Type vinst✝¹:SizeOf αinst✝:(a : α) → SizeOf (β a)k:αv:β ksz:Natk':αv':β k'l:Impl α βr:Impl α βihl:⟨k, v⟩ ∈ l.toListModel → sizeOf v < sizeOf lihr:⟨k, v⟩ ∈ r.toListModel → sizeOf v < sizeOf rh:⟨k, v⟩ ∈ l.toListModel ∨ ⟨k, v⟩ = ⟨k', v'⟩ ∨ ⟨k, v⟩ ∈ r.toListModel⊢ sizeOf v < 1 + sizeOf sz + sizeOf k' + sizeOf v' + sizeOf l + sizeOf r
    rcases h with hl | heq | hrinner.inlα:Type uβ:α → Type vinst✝¹:SizeOf αinst✝:(a : α) → SizeOf (β a)k:αv:β ksz:Natk':αv':β k'l:Impl α βr:Impl α βihl:⟨k, v⟩ ∈ l.toListModel → sizeOf v < sizeOf lihr:⟨k, v⟩ ∈ r.toListModel → sizeOf v < sizeOf rhl:⟨k, v⟩ ∈ l.toListModel⊢ sizeOf v < 1 + sizeOf sz + sizeOf k' + sizeOf v' + sizeOf l + sizeOf rinner.inr.inlα:Type uβ:α → Type vinst✝¹:SizeOf αinst✝:(a : α) → SizeOf (β a)k:αv:β ksz:Natk':αv':β k'l:Impl α βr:Impl α βihl:⟨k, v⟩ ∈ l.toListModel → sizeOf v < sizeOf lihr:⟨k, v⟩ ∈ r.toListModel → sizeOf v < sizeOf rheq:⟨k, v⟩ = ⟨k', v'⟩⊢ sizeOf v < 1 + sizeOf sz + sizeOf k' + sizeOf v' + sizeOf l + sizeOf rinner.inr.inrα:Type uβ:α → Type vinst✝¹:SizeOf αinst✝:(a : α) → SizeOf (β a)k:αv:β ksz:Natk':αv':β k'l:Impl α βr:Impl α βihl:⟨k, v⟩ ∈ l.toListModel → sizeOf v < sizeOf lihr:⟨k, v⟩ ∈ r.toListModel → sizeOf v < sizeOf rhr:⟨k, v⟩ ∈ r.toListModel⊢ sizeOf v < 1 + sizeOf sz + sizeOf k' + sizeOf v' + sizeOf l + sizeOf r
    ·inner.inlα:Type uβ:α → Type vinst✝¹:SizeOf αinst✝:(a : α) → SizeOf (β a)k:αv:β ksz:Natk':αv':β k'l:Impl α βr:Impl α βihl:⟨k, v⟩ ∈ l.toListModel → sizeOf v < sizeOf lihr:⟨k, v⟩ ∈ r.toListModel → sizeOf v < sizeOf rhl:⟨k, v⟩ ∈ l.toListModel⊢ sizeOf v < 1 + sizeOf sz + sizeOf k' + sizeOf v' + sizeOf l + sizeOf r have := ihl hlinner.inlα:Type uβ:α → Type vinst✝¹:SizeOf αinst✝:(a : α) → SizeOf (β a)k:αv:β ksz:Natk':αv':β k'l:Impl α βr:Impl α βihl:⟨k, v⟩ ∈ l.toListModel → sizeOf v < sizeOf lihr:⟨k, v⟩ ∈ r.toListModel → sizeOf v < sizeOf rhl:⟨k, v⟩ ∈ l.toListModelthis:?_mvar.17769 := @_fvar.16588 _fvar.17737⊢ sizeOf v < 1 + sizeOf sz + sizeOf k' + sizeOf v' + sizeOf l + sizeOf r; omegaAll goals completed! 🐙
    ·inner.inr.inlα:Type uβ:α → Type vinst✝¹:SizeOf αinst✝:(a : α) → SizeOf (β a)k:αv:β ksz:Natk':αv':β k'l:Impl α βr:Impl α βihl:⟨k, v⟩ ∈ l.toListModel → sizeOf v < sizeOf lihr:⟨k, v⟩ ∈ r.toListModel → sizeOf v < sizeOf rheq:⟨k, v⟩ = ⟨k', v'⟩⊢ sizeOf v < 1 + sizeOf sz + sizeOf k' + sizeOf v' + sizeOf l + sizeOf r cases heqinner.inr.inl.reflα:Type uβ:α → Type vinst✝¹:SizeOf αinst✝:(a : α) → SizeOf (β a)k:αv:β ksz:Natl:Impl α βr:Impl α βihl:⟨k, v⟩ ∈ l.toListModel → sizeOf v < sizeOf lihr:⟨k, v⟩ ∈ r.toListModel → sizeOf v < sizeOf r⊢ sizeOf v < 1 + sizeOf sz + sizeOf k + sizeOf v + sizeOf l + sizeOf r; omegaAll goals completed! 🐙
    ·inner.inr.inrα:Type uβ:α → Type vinst✝¹:SizeOf αinst✝:(a : α) → SizeOf (β a)k:αv:β ksz:Natk':αv':β k'l:Impl α βr:Impl α βihl:⟨k, v⟩ ∈ l.toListModel → sizeOf v < sizeOf lihr:⟨k, v⟩ ∈ r.toListModel → sizeOf v < sizeOf rhr:⟨k, v⟩ ∈ r.toListModel⊢ sizeOf v < 1 + sizeOf sz + sizeOf k' + sizeOf v' + sizeOf l + sizeOf r have := ihr hrinner.inr.inrα:Type uβ:α → Type vinst✝¹:SizeOf αinst✝:(a : α) → SizeOf (β a)k:αv:β ksz:Natk':αv':β k'l:Impl α βr:Impl α βihl:⟨k, v⟩ ∈ l.toListModel → sizeOf v < sizeOf lihr:⟨k, v⟩ ∈ r.toListModel → sizeOf v < sizeOf rhr:⟨k, v⟩ ∈ r.toListModelthis:?_mvar.18128 := @_fvar.16589 _fvar.17765⊢ sizeOf v < 1 + sizeOf sz + sizeOf k' + sizeOf v' + sizeOf l + sizeOf r; omegaAll goals completed! 🐙

theorem TreeMap.Raw.sizeOf_lt_of_mem {α β : Type} {cmp : α → α → Ordering}
    [SizeOf α] [SizeOf β] {t : Std.TreeMap.Raw α β cmp} {k : α} {v : β}
    (h : ⟨k, v⟩ ∈ t.inner.inner.toListModel) :
    sizeOf v < sizeOf t := byα:Typeβ:Typecmp:α → α → Orderinginst✝¹:SizeOf αinst✝:SizeOf βt:Std.TreeMap.Raw α β cmpk:αv:βh:⟨k, v⟩ ∈ t.inner.inner.toListModel⊢ sizeOf v < sizeOf t
  have h1 : sizeOf t = 1 + sizeOf t.inner := Std.TreeMap.Raw.mk.sizeOf_spec t.innerα:Typeβ:Typecmp:α → α → Orderinginst✝¹:SizeOf αinst✝:SizeOf βt:Std.TreeMap.Raw α β cmpk:αv:βh:⟨k, v⟩ ∈ t.inner.inner.toListModelh1:[Error pretty printing expression: unknown free variable `_uniq.18428`. Falling back to raw printer.]
Eq.{?_uniq.18434} ?_uniq.18527 (SizeOf.sizeOf.{?_uniq.18435} ?_uniq.18436 ?_uniq.18437 _uniq.18428) (HAdd.hAdd.{?_uniq.18451, ?_uniq.18450, ?_uniq.18449} ?_uniq.18510 ?_uniq.18511 ?_uniq.18512 ?_uniq.18513 (OfNat.ofNat.{?_uniq.18454} ?_uniq.18453 1 ?_uniq.18455) (SizeOf.sizeOf.{?_uniq.18463} ?_uniq.18464 ?_uniq.18465 (Std.TreeMap.Raw.inner.{?_uniq.18467, ?_uniq.18466} ?_uniq.18468 ?_uniq.18469 ?_uniq.18470 _uniq.18428))) := 
  [Error pretty printing expression: unknown free variable `_uniq.18428`. Falling back to raw printer.]
  Std.TreeMap.Raw.mk.sizeOf_spec.{?_uniq.18533, ?_uniq.18532} ?_uniq.18534 ?_uniq.18535 ?_uniq.18536 ?_uniq.18537 ?_uniq.18538 (Std.TreeMap.Raw.inner.{?_uniq.18540, ?_uniq.18539} ?_uniq.18541 ?_uniq.18542 ?_uniq.18543 _uniq.18428)⊢ sizeOf v < sizeOf t
  have h2 : sizeOf t.inner = 1 + sizeOf t.inner.inner := Std.DTreeMap.Raw.mk.sizeOf_spec t.inner.innerα:Typeβ:Typecmp:α → α → Orderinginst✝¹:SizeOf αinst✝:SizeOf βt:Std.TreeMap.Raw α β cmpk:αv:βh:⟨k, v⟩ ∈ t.inner.inner.toListModelh1:[Error pretty printing expression: unknown free variable `_uniq.18428`. Falling back to raw printer.]
Eq.{?_uniq.18434} ?_uniq.18527 (SizeOf.sizeOf.{?_uniq.18435} ?_uniq.18436 ?_uniq.18437 _uniq.18428) (HAdd.hAdd.{?_uniq.18451, ?_uniq.18450, ?_uniq.18449} ?_uniq.18510 ?_uniq.18511 ?_uniq.18512 ?_uniq.18513 (OfNat.ofNat.{?_uniq.18454} ?_uniq.18453 1 ?_uniq.18455) (SizeOf.sizeOf.{?_uniq.18463} ?_uniq.18464 ?_uniq.18465 (Std.TreeMap.Raw.inner.{?_uniq.18467, ?_uniq.18466} ?_uniq.18468 ?_uniq.18469 ?_uniq.18470 _uniq.18428))) := 
  [Error pretty printing expression: unknown free variable `_uniq.18428`. Falling back to raw printer.]
  Std.TreeMap.Raw.mk.sizeOf_spec.{?_uniq.18533, ?_uniq.18532} ?_uniq.18534 ?_uniq.18535 ?_uniq.18536 ?_uniq.18537 ?_uniq.18538 (Std.TreeMap.Raw.inner.{?_uniq.18540, ?_uniq.18539} ?_uniq.18541 ?_uniq.18542 ?_uniq.18543 _uniq.18428)h2:[Error pretty printing expression: unknown free variable `_uniq.18428`. Falling back to raw printer.]
Eq.{?_uniq.18562} ?_uniq.18644 (SizeOf.sizeOf.{?_uniq.18563} ?_uniq.18564 ?_uniq.18565 (Std.TreeMap.Raw.inner.{?_uniq.18567, ?_uniq.18566} ?_uniq.18568 ?_uniq.18569 ?_uniq.18570 _uniq.18428)) (HAdd.hAdd.{?_uniq.18573, ?_uniq.18572, ?_uniq.18571} ?_uniq.18627 ?_uniq.18628 ?_uniq.18629 ?_uniq.18630 (OfNat.ofNat.{?_uniq.18576} ?_uniq.18575 1 ?_uniq.18577) (SizeOf.sizeOf.{?_uniq.18585} ?_uniq.18586 ?_uniq.18587 (Std.DTreeMap.Raw.inner.{?_uniq.18594, ?_uniq.18593} ?_uniq.18595 ?_uniq.18596 ?_uniq.18597 (Std.TreeMap.Raw.inner.{?_uniq.18589, ?_uniq.18588} ?_uniq.18590 ?_uniq.18591 ?_uniq.18592 _uniq.18428)))) := 
  [Error pretty printing expression: unknown free variable `_uniq.18428`. Falling back to raw printer.]
  Std.DTreeMap.Raw.mk.sizeOf_spec.{?_uniq.18646, ?_uniq.18645} ?_uniq.18647 ?_uniq.18648 ?_uniq.18649 ?_uniq.18650 ?_uniq.18651 (Std.DTreeMap.Raw.inner.{?_uniq.18658, ?_uniq.18657} ?_uniq.18659 ?_uniq.18660 ?_uniq.18661 (Std.TreeMap.Raw.inner.{?_uniq.18653, ?_uniq.18652} ?_uniq.18654 ?_uniq.18655 ?_uniq.18656 _uniq.18428))⊢ sizeOf v < sizeOf t
  have h3 := Impl.sizeOf_lt_of_mem hα:Typeβ:Typecmp:α → α → Orderinginst✝¹:SizeOf αinst✝:SizeOf βt:Std.TreeMap.Raw α β cmpk:αv:βh:⟨k, v⟩ ∈ t.inner.inner.toListModelh1:[Error pretty printing expression: unknown free variable `_uniq.18428`. Falling back to raw printer.]
Eq.{?_uniq.18434} ?_uniq.18527 (SizeOf.sizeOf.{?_uniq.18435} ?_uniq.18436 ?_uniq.18437 _uniq.18428) (HAdd.hAdd.{?_uniq.18451, ?_uniq.18450, ?_uniq.18449} ?_uniq.18510 ?_uniq.18511 ?_uniq.18512 ?_uniq.18513 (OfNat.ofNat.{?_uniq.18454} ?_uniq.18453 1 ?_uniq.18455) (SizeOf.sizeOf.{?_uniq.18463} ?_uniq.18464 ?_uniq.18465 (Std.TreeMap.Raw.inner.{?_uniq.18467, ?_uniq.18466} ?_uniq.18468 ?_uniq.18469 ?_uniq.18470 _uniq.18428))) := 
  [Error pretty printing expression: unknown free variable `_uniq.18428`. Falling back to raw printer.]
  Std.TreeMap.Raw.mk.sizeOf_spec.{?_uniq.18533, ?_uniq.18532} ?_uniq.18534 ?_uniq.18535 ?_uniq.18536 ?_uniq.18537 ?_uniq.18538 (Std.TreeMap.Raw.inner.{?_uniq.18540, ?_uniq.18539} ?_uniq.18541 ?_uniq.18542 ?_uniq.18543 _uniq.18428)h2:[Error pretty printing expression: unknown free variable `_uniq.18428`. Falling back to raw printer.]
Eq.{?_uniq.18562} ?_uniq.18644 (SizeOf.sizeOf.{?_uniq.18563} ?_uniq.18564 ?_uniq.18565 (Std.TreeMap.Raw.inner.{?_uniq.18567, ?_uniq.18566} ?_uniq.18568 ?_uniq.18569 ?_uniq.18570 _uniq.18428)) (HAdd.hAdd.{?_uniq.18573, ?_uniq.18572, ?_uniq.18571} ?_uniq.18627 ?_uniq.18628 ?_uniq.18629 ?_uniq.18630 (OfNat.ofNat.{?_uniq.18576} ?_uniq.18575 1 ?_uniq.18577) (SizeOf.sizeOf.{?_uniq.18585} ?_uniq.18586 ?_uniq.18587 (Std.DTreeMap.Raw.inner.{?_uniq.18594, ?_uniq.18593} ?_uniq.18595 ?_uniq.18596 ?_uniq.18597 (Std.TreeMap.Raw.inner.{?_uniq.18589, ?_uniq.18588} ?_uniq.18590 ?_uniq.18591 ?_uniq.18592 _uniq.18428)))) := 
  [Error pretty printing expression: unknown free variable `_uniq.18428`. Falling back to raw printer.]
  Std.DTreeMap.Raw.mk.sizeOf_spec.{?_uniq.18646, ?_uniq.18645} ?_uniq.18647 ?_uniq.18648 ?_uniq.18649 ?_uniq.18650 ?_uniq.18651 (Std.DTreeMap.Raw.inner.{?_uniq.18658, ?_uniq.18657} ?_uniq.18659 ?_uniq.18660 ?_uniq.18661 (Std.TreeMap.Raw.inner.{?_uniq.18653, ?_uniq.18652} ?_uniq.18654 ?_uniq.18655 ?_uniq.18656 _uniq.18428))h3:?_mvar.18681 := Impl.sizeOf_lt_of_mem _fvar.18431⊢ sizeOf v < sizeOf t
  omegaAll goals completed! 🐙

So my strategy was to use .toList.attach to attach the membership proof, and then extract the size lemma with .sizeOf_lt_of_mem when proving the size of recursive arguments decreases. Compared to the verbosity of ordinary induction here, this is much briefer. Now we can implement better JSON induction methods:

set_option linter.unusedVariables false in
open Lean (Json) in
def Json.recOn {motive : Json → Sort u}
    (x : Json)
    (null : motive .null)
    (bool : ∀ b, motive (.bool b))
    (num : ∀ n, motive (.num n))
    (str : ∀ s, motive (.str s))
    (arr : ∀ (a : Array Json), (∀ j, j ∈ a → motive j) → motive (.arr a))
    (obj : ∀ (o : Std.TreeMap.Raw String Json compare),
           (∀ field value, ⟨field, value⟩ ∈ o.inner.inner.toList → motive value) →
           motive (.obj o)) :
    motive x :=
  match x with
  | .null => null
  | .bool b => bool b
  | .num n => num n
  | .str s => str s
  | .arr a => arr a (fun j jMem => Json.recOn j null bool num str arr obj)
  | .obj o => obj o (fun k v vMem => Json.recOn v null bool num str arr obj)
termination_by x
decreasing_by
  ·a:Array Jsonj:JsonjMem:j ∈ a⊢ sizeOf j < sizeOf (Json.arr a) suffices sizeOf j < sizeOf a bya:Array Jsonj:JsonjMem:j ∈ athis:sizeOf _fvar.20252 < sizeOf _fvar.20250 := ?_mvar.20760⊢ sizeOf j < sizeOf (Json.arr a) simp +aritha:Array Jsonj:JsonjMem:j ∈ athis:sizeOf _fvar.20252 < sizeOf _fvar.20250 := ?_mvar.20760⊢ sizeOf j ≤ sizeOf a; omegaAll goals completed! 🐙
    exact Array.sizeOf_lt_of_mem jMemAll goals completed! 🐙
  suffices sizeOf v < sizeOf o byo:Std.TreeMap.Raw String Json comparek:Stringv:JsonvMem:⟨k, v⟩ ∈ o.inner.inner.toListthis:sizeOf _fvar.20262 < sizeOf _fvar.20259 := ?_mvar.21399⊢ sizeOf v < sizeOf (Json.obj o) simp +aritho:Std.TreeMap.Raw String Json comparek:Stringv:JsonvMem:⟨k, v⟩ ∈ o.inner.inner.toListthis:sizeOf _fvar.20262 < sizeOf _fvar.20259 := ?_mvar.21399⊢ sizeOf v ≤ sizeOf o; omegaAll goals completed! 🐙
  apply TreeMap.Raw.sizeOf_lt_of_memho:Std.TreeMap.Raw String Json comparek:Stringv:JsonvMem:⟨k, v⟩ ∈ o.inner.inner.toList⊢ ⟨?k, v⟩ ∈ o.inner.inner.toListModelko:Std.TreeMap.Raw String Json comparek:Stringv:JsonvMem:⟨k, v⟩ ∈ o.inner.inner.toList⊢ String
  rw [<-Std.DTreeMap.Internal.Impl.toList_eq_toListModel]ho:Std.TreeMap.Raw String Json comparek:Stringv:JsonvMem:⟨k, v⟩ ∈ o.inner.inner.toList⊢ ⟨?k, v⟩ ∈ o.inner.inner.toListko:Std.TreeMap.Raw String Json comparek:Stringv:JsonvMem:⟨k, v⟩ ∈ o.inner.inner.toList⊢ String
  exact vMemAll goals completed! 🐙

Custom "recursors" like this let you split up recursive definitions really easily as long as you are able to take and apply hypotheses like j ∈ a. As long as you carry around membership information, you can split up recursive definitions while still proving termination.

List equality was a pain

Lawful equality already exists for List α, but it expects an existing instance of equality for α. For a particular subtyping proof, I needed a ReflBEq Json (∀x : Json, x == x); I hoped to use ReflBEq (List α). At the time, I ran out of patience and cleverness trying to prove a termination goal, so I reimplemented the lemma instead. Relatedly, writing inline definitions in a typeclass instance makes it strangely difficult to unfold those definitions.

Subtyping

After handling all those JSON difficulties, I went back to my very helpful blueprint for how subtyping would work: an incomplete set of rules to determine when one type implied another. From the beginning, I wanted to bundle the "schema" t : JsonType, the propositional check, and the JSON into an object TypedJson t. Then when you wanted to check if a typed json also satisfied t', you could run a decision procedure t.subtype t' to prove ∀x, t.check x → t'.check x. This would allow you to use JSON in more general contexts without having to care about the exact types involved.

I applied a bit of cleverness by bundling the proof into the return type of the subtype checker:

inductive DecideSubtype (t1 t2 : JsonType) where
  | none : DecideSubtype t1 t2
  | isSubtype : (∀j, t1.check j = true → t2.check j = true) → DecideSubtype t1 t2

This allowed me to reuse the convoluted logic of the subtype checking for the proof plumbing. Proving that subtyping worked separately involved so much more casework; it was so much easier to piggyback off the existing casework. Truly, dependent types are wonderful! Especially as long as you remember: "Programs that use these types will find themselves forced to mirror the algorithm used in the type-level function so that their structure matches the pattern-matching and recursive behavior of the type." This is the blessing and curse of dependent types.

There was a lot of rewriting and sublemmas for all the different JsonType constructors, especially for object subtyping, but I was mainly correcting the plan, ensuring that required and optional types behaved correctly, and trying a bunch of examples. Once I got a correct human proof, the Lean version held no surprises.

Object Construction

Given some TypedJson, say x1 x2 : TypedJson t, I would like to be able to construct typed objects during compile time. This might actually be the ideal use case for heterogeneous lists, a dependently typed list where each element can have its own type.

I carefully put the key-values as type parameters, so I can access them at compile time more easily, then the actual typed JSON is included as a field.

/-- Heterogeneous list of object fields indexed by schema.
    Each field carries a TypedJson value with proof that it checks against its type. -/
inductive ObjectFields : List (String × JsonType) → Type where
  | nil : ObjectFields []
  | cons {ty : JsonType} {rest : List (String × JsonType)} (name : String) :
      TypedJson ty → ObjectFields rest → ObjectFields ((name, ty) :: rest)

Then I could guarantee objects would pass validation once you ensure no duplicates.

/-- Construct an object from ObjectFields -/
def mkObj {req : List (String × JsonType)} (fields : ObjectFields req)
    (noDups : req.Pairwise (fun a b => ¬compare a.1 b.1 = .eq) := by native_decide) :
    TypedJson (.object req []) := sorry

I had Claude Code make a macro that would construct ObjectFields using obj{} notation, since I could just point it at the existing macro for list syntax [a, b, c]. Now we have a more readable constructor:

def testMkObj (s : String) (n : Nat) : TypedJson (
      .object [("name", .string), ("age", .number)] []
    ) := -- obj{} just created an ObjectFields, which mkObj converts to TypedJson
  mkObj obj{"name": (s : TypedJson .string), "age": (n : TypedJson .number)}

Narrowing

When you are within if statements, TypeScript is capable of "narrowing" unions to a variant:

type Person =
    | { age: number, id: number }
    | { dob: Date }

const person = getPerson();

if ("age" in person) {
    // person's type is "narrowed" to {age : number, id: number}
    console.log("person.age =", person.age);
    console.log("person.id =", person.id);
}

This is really helpful, but it is also more fraught with difficulty than it appears. Since objects may have extra fields in JSON, it is possible to have person = {dob: ..., age: 10}. Now TypeScript mistakenly believes that person.id is defined. When I learned about this, I decided that I should stop looking at the TypeScript source code. For a proof of concept, I only discriminate using a known property's values.

The blog post "Flow Nodes: How Type Inference Is Implemented" really helped me here too. For Lean, we have to start with filters for whether properties can match or not:

def JsonType.canMatchPropertyStr (t : JsonType) (key : String) (str : String) : Bool :=
  t.canBeObject &&
  match t.getKey? key with
  | .some kt => kt.check str
  | .none => true -- we have no information about key

If x has property key with value str, then I prove that t.check x = true implies t.canMatchPropertyStr key str = true. Similarly, if x does not have property key with value str, then I can prove t.canMismatchPropertyStr key str = true.

If t = t1 ||| t2 ||| t3 ||| t4, then I can turn that into a list [t1, t2, t3, t4] for which at least one must check. Now if t.check x = true, then I know some ti.check x = true, so ti.canMatchPropertyStr key str. The upshot is that I can filter [t1, t2, t3, t4] for canMatchPropertyStr, and one of them will still match x.

theorem JsonType.filterUnion_correctness
    {t : JsonType} {f : JsonType → Bool} {x : Json}
    (h : t.check x = true)
    (h' : ∀ t', t'.check x = true → f t' = true) :
    (t.filterUnion f).check x = true := by sorry

Putting this all the two together in JsonType.narrowKeyStr, we can do narrowing:

def circleType : JsonType :=
  .object [("type", .strLit "circle"), ("radius", .number)] []

def squareType : JsonType :=
  .object [("type", .strLit "square"), ("side", .number)] []

def shapeType : JsonType := circleType.union squareType

def calculateArea (shape : TypedJson shapeType) : IO Unit := do
  match h : shape.val.getObjVal? "type" with
  | .ok "circle" =>
    let circle : TypedJson circleType := (shape.narrowKeyStr "type" "circle" h).coe
    IO.println "Computing circle area"
  | .ok "square" =>
    let square : TypedJson squareType := (shape.narrowKeyStr "type" "square" h).coe
    IO.println "Computing square area"
  | _ => IO.println "Unknown shape type"

Conclusion

Despite the potential, creating schemas for all of VegaLite might be more work than I'd be willing to go through for plotting, where I only need correctness for my data. Even falling back to JSON Schema, there are plenty of opportunities for usability improvements there that would more meaningfully change how I use Lean. The syntax for constructing JSON in Lean is very unergonomic, since we can't combine string formatting with JSON syntax easily. Creating custom string syntax for JavaScript in general might be more usable for using JavaScript libraries in widgets.

String formatting can't be combined with raw strings like r##""##, and the default formatting uses {}, a common string in JavaScript and JSON. Mustache templating with multi-line strings would make it fairly elegant to include d3.js code inline in Lean. We might be able to call out to TypeScript and even have nice VS Code support for the embedded language.

Formalizing Hilbert Curves in Lean

2025-08-03T18:54:00-06:00

Formalizing Hilbert Curves in Lean

The famous Hilbert curve has a simple inductive construction, but key portions use analysis. Lean should be an ideal proof assistant for applying the key mathematical principles. In my last post, I walked through informal definitions and proofs. The following concerns a more sophisticated perspective on how Lean can undertake this sort of mathematics.

I'll present some of my formalization below using Verso, Lean's new HTML generation tool, but I'll also tell you about the other interesting facts you learn by thinking hard about every detail while coding a formalization, such as Hölder continuity, computability, partial invertibility, etc. Despite disappointing AI provers, promising inline visualizations with ProofWidgets, and our lovely library of math mathlib, the challenging gaps left by spatial intuition leave a lot of gnarly induction, casework, and algebra, along with some confusing remnants from mathlib and Lean's casting rules.

Notation for the Hilbert Curve
Lean Design Decisions and Selected Proofs
Additional Directions
Pros and Cons of using Lean here
Conclusion
P.S. Verso is fine

Mathematical Notation for the Hilbert Curve

We will construct integer versions of the Hilbert curve denoted as H_n(i) where n and i are natural numbers, and H_n(i) is a pair of natural numbers.

When we interpolate and scale down the integer versions, we'll use \tilde{H}_i(t).

Finally when we pass to the limit and get the final curve, as H(t) with no superscript or subscript.

Lean Design Decisions and Selected Proofs

If you don't care about the details of Lean proofs, then I would skip this section, so go to Additional Directions. If you are mildly interested, please skim all the proofs!

In our proofs in the previous post, I did mention the explicit definitions of each version, however most of the proofs deferred the case-work and algebra to the reader. Often, the truth of the statement is completely clear from the pictures involved, such as the bounds and injectivity of the integer case H_i(n). Of course, this is insufficient for a truly formal proof as in Lean 4. The primary tool for the low-level definitions is essentially always induction, but we still need to label the different cases.

Filling out the details here will involve explaining to Lean what a "quadrant" is, how the various intervals map to those quadrants, and explaining in detail what each transformation does, and defining their properties. In particular, the later proofs require continuity assumptions.

Additionally, there are some activities that seem to be mildly inadequately covered in Lean's mathlib: casting from \mathbb{N} \times \mathbb{N} to \mathbb{Z} \times \mathbb{Z} and to \mathbb{R} \times \mathbb{R}, linear interpolation, and a few proofs about floors.

Transformations and Quadrants

I define a custom name for the lengths, since it appeared as a very common repeated expression. In retrospect, I probably would I have used 4^n and made the term reducible to 4^n automatically, but you live and learn. I would not be surprised if my other choices here were somewhat suboptimal, especially the quadrants.

def hilbert_length (i : ℕ) := 2^(2*i)

For each of the integer transformations, we'll need some code.

def T0_nat : ℕ × ℕ → ℕ × ℕ := Prod.swap
def T1_nat (i : ℕ) (mn : ℕ × ℕ) : ℕ × ℕ := mn + (0, 2^i)
def T2_nat (i : ℕ) (mn : ℕ × ℕ) : ℕ × ℕ := mn + (2^i, 2^i)
def T3_nat (i : ℕ) (mn : ℕ × ℕ) : ℕ × ℕ := (2^(i+1) - 1, 2^i - 1) - mn.swap

Since the natural numbers are truly awful once you have subtraction, we have a ring version that applies any ring, so we get \mathbb{Z} and \mathbb{R}. Since we have this more general statements, we drop the _nat.

variable {R : Type*} [Ring R]

def T3 (i : ℕ) : R × R →ᵃ[R] R × R := {
  toFun := fun mn => (2^(i+1) - 1, 2^i - 1) - mn.swap
  linear := -HilbertCurve.T0
  map_vadd' p v := byR:Type u_1inst✝:Ring Ri:ℕp:R × Rv:R × R⊢ (2 ^ (i + 1) - 1, 2 ^ i - 1) - (v +ᵥ p).swap = (-HilbertCurve.T0) v +ᵥ (2 ^ (i + 1) - 1, 2 ^ i - 1) - p.swap
    simp [HilbertCurve.T0]R:Type u_1inst✝:Ring Ri:ℕp:R × Rv:R × R⊢ (2 ^ (i + 1) - 1, 2 ^ i - 1) - (v.swap + p.swap) = -v.swap + ((2 ^ (i + 1) - 1, 2 ^ i - 1) - p.swap)
    set a := ((2 : R)^(i + 1) - 1, (2 : R)^i - 1)R:Type u_1inst✝:Ring Ri:ℕp:R × Rv:R × Ra:R × R := (2 ^ (i + 1) - 1, 2 ^ i - 1)⊢ a - (v.swap + p.swap) = -v.swap + (a - p.swap)
    -- For some reason, ring doesn't work
    rw [add_comm, add_comm (-v.swap)]R:Type u_1inst✝:Ring Ri:ℕp:R × Rv:R × Ra:R × R := (2 ^ (i + 1) - 1, 2 ^ i - 1)⊢ a - (p.swap + v.swap) = a - p.swap + -v.swap
    rw [sub_eq_add_neg, sub_eq_add_neg, add_assoc, neg_add]All goals completed! 🐙
}

For each of these, we'll need quite a few lemmas for casting them which depend on bounds.

lemma T3_cast_nat (i : ℕ) (mn : ℕ × ℕ) (h1 : mn.1 ≤ 2^i - 1) (h2 : mn.2 ≤ 2^(i+1) - 1) :
  T3 i (mn : R × R) = T3_nat i mn := byR:Type u_1inst✝:Ring Ri:ℕmn:ℕ × ℕh1:mn.1 ≤ 2 ^ i - 1h2:mn.2 ≤ 2 ^ (i + 1) - 1⊢ (T3 i) ↑mn = ↑(T3_nat i mn)
  simp only [T3_nat, T3, Prod.swap, Prod.mk_sub_mk, RtimesR.coe_prod]R:Type u_1inst✝:Ring Ri:ℕmn:ℕ × ℕh1:mn.1 ≤ 2 ^ i - 1h2:mn.2 ≤ 2 ^ (i + 1) - 1⊢ { toFun := fun mn => (2 ^ (i + 1) - 1 - mn.2, 2 ^ i - 1 - mn.1), linear := -HilbertCurve.T0, map_vadd' := ⋯ }
    (↑mn.1, ↑mn.2) =
  (↑(2 ^ (i + 1) - 1 - mn.2), ↑(2 ^ i - 1 - mn.1))
  rw [Nat.cast_sub h1, Nat.cast_sub h2]R:Type u_1inst✝:Ring Ri:ℕmn:ℕ × ℕh1:mn.1 ≤ 2 ^ i - 1h2:mn.2 ≤ 2 ^ (i + 1) - 1⊢ { toFun := fun mn => (2 ^ (i + 1) - 1 - mn.2, 2 ^ i - 1 - mn.1), linear := -HilbertCurve.T0, map_vadd' := ⋯ }
    (↑mn.1, ↑mn.2) =
  (↑(2 ^ (i + 1) - 1) - ↑mn.2, ↑(2 ^ i - 1) - ↑mn.1)
  simpAll goals completed! 🐙

We will need to deal with a lot of different lemmas and casework about quadrants, so we'll create code for the transformations themselves.

inductive Quadrant where
| BOTTOM_LEFT | TOP_LEFT | TOP_RIGHT | BOTTOM_RIGHT
deriving DecidableEq

We'll need functions to then understand how we divide our input \mathbb{N} into quadrants as well as \mathbb{N} \times \mathbb{N} (which will be get_quadrant'). You might note that i here will be the divisions of H_{i+1}, and this is designed to work better with the pattern matching.

def get_quadrant (i n : ℕ) : Quadrant :=
  if n < hilbert_length i then
    Quadrant.BOTTOM_LEFT
  else if n < 2 * hilbert_length i then
    Quadrant.TOP_LEFT
  else if n < 3 * hilbert_length i then
    Quadrant.TOP_RIGHT
  else
    Quadrant.BOTTOM_RIGHT

Each of these quadrants will also have a few "equal" lemmas like bottom_left_eq : get_quadrant i n = Quadrant.BOTTOM_LEFT ↔ n < hilbert_length i. These statements seem required in my definition, which actually makes me think my definition is pretty bad.

The Integer Version

Finally, we can explain the definition of our first Hilbert curve:

def hilbert_curve : ℕ → ℕ → (ℕ × ℕ)
| 0 => fun _ => (0, 0)
| .succ i => fun n => match get_quadrant i n with
  | Quadrant.BOTTOM_LEFT =>
    let h := hilbert_curve i n
    T0_nat h
  | Quadrant.TOP_LEFT => let h := hilbert_curve i (n - hilbert_length i)
    T1_nat i h
  | Quadrant.TOP_RIGHT => let h := hilbert_curve i (n - 2*hilbert_length i)
    T2_nat i h
  | Quadrant.BOTTOM_RIGHT =>
    let h := hilbert_curve i (n - 3*hilbert_length i)
    T3_nat i h

Although this version has all the abbreviations such as Quadrant.BOTTOM_LEFT and get_quadrant. Those can be included inline without much loss in clarity, but the Lean proofs become much more difficult once casework gets involved.

Unlike the normal presentation of the Hilbert curve, we have a definition for the n = 0 case, H_0(i) = (0, 0). For i \ge 1, we can then divide everything up into quadrants, then apply each transformation, and recurse.

Before it is time to prove theorems, it is important to test definitions like this. My first few definitions had some sign and off-by-one errors which can be found with testing:

/--
info: [(0, 0), (0, 1), (1, 1), (1, 0)]
-/
#guard_msgs in
#eval List.map (hilbert_curve 1) (List.range (2^2))

Using ProofWidgets, we can also display these, which makes the nature of a bug extremely clear. By giving the examples folder of ProofWidgets to any modern LLM (I used Gemini), you can generate SVGs from Lean data. Then #html sends the SVGs to the Lean InfoView on the right:

-- HilbertCurve.Pictures (omitting the verbose SVG AI-generated code)
def hilbert_curve_svg (i : ℕ) (stroke : Svg.Size frame := .px 1) : Svg frame :=
  sorry
  -- https://github.com/josephmckinsey/LeanHilbertCurves/blob/325dc26792e216989d0a713696a698db04e9d7b6/HilbertCurve/Pictures.lean#L57

#html (hilbert_curve_svg 2).toHtml

These pictures can be quite helpful, since they can let you verify hypotheses experimentally before committing to a precise, yet wrong statement. Ever since @thingskatedid inspired me, I've been enjoying the fruits of visualizations created with throwaway Javascript.

Since I know how annoying extra conditions can get, all of my functions use "normal" types like ℕ instead of Fin n. I didn't test this design decision, so maybe adding dependent information isn't so bad. Beyond the typical input bounds, our definition naturally makes the curve constant.

Some formal proofs about integers

To actually prove injectivity and surjectivity, I decided to implement the inverse, which made preliminary testing easy. Formally verifying it amounted to a lot of casework and induction. For the casework, we have to prove that each of the transformations actually preserve the quadrants. Each one is basic algebra (modulo annoying casting).

open HilbertCurve
HilbertCurve.get_quadrant'_T0 (i : ℕ) (mn : ℕ × ℕ) (h : mn ≤ (2 ^ i - 1, 2 ^ i - 1)) :
  get_quadrant' i (T0_nat mn) = Quadrant.BOTTOM_LEFT#check get_quadrant'_T0
example (i : ℕ) (mn : ℕ × ℕ) (h : mn ≤ (2^i - 1, 2^i - 1)) :
  get_quadrant' i (T0_nat mn) = Quadrant.BOTTOM_LEFT := byi:ℕmn:ℕ × ℕh:mn ≤ (2 ^ i - 1, 2 ^ i - 1)⊢ get_quadrant' i (T0_nat mn) = Quadrant.BOTTOM_LEFT
  simp only [get_quadrant', T0_nat]i:ℕmn:ℕ × ℕh:mn ≤ (2 ^ i - 1, 2 ^ i - 1)⊢ (if mn.swap.1 < 2 ^ i then if mn.swap.2 < 2 ^ i then Quadrant.BOTTOM_LEFT else Quadrant.TOP_LEFT
  else if mn.swap.2 < 2 ^ i then Quadrant.BOTTOM_RIGHT else Quadrant.TOP_RIGHT) =
  Quadrant.BOTTOM_LEFT
  have : 2^i - 1 < 2^i := byi:ℕmn:ℕ × ℕh:mn ≤ (2 ^ i - 1, 2 ^ i - 1)⊢ get_quadrant' i (T0_nat mn) = Quadrant.BOTTOM_LEFT simpAll goals completed! 🐙
  rw [if_pos, if_pos]hci:ℕmn:ℕ × ℕh:mn ≤ (2 ^ i - 1, 2 ^ i - 1)this:2 ^ i - 1 < 2 ^ i⊢ mn.swap.2 < 2 ^ ihci:ℕmn:ℕ × ℕh:mn ≤ (2 ^ i - 1, 2 ^ i - 1)this:2 ^ i - 1 < 2 ^ i⊢ mn.swap.1 < 2 ^ i
  ·hci:ℕmn:ℕ × ℕh:mn ≤ (2 ^ i - 1, 2 ^ i - 1)this:2 ^ i - 1 < 2 ^ i⊢ mn.swap.2 < 2 ^ i apply lt_of_le_of_lt h.1 thisAll goals completed! 🐙
  apply lt_of_le_of_lt h.2 thisAll goals completed! 🐙

which then let us decompose the hilbert_curve

HilbertCurve.quadrant_preserved (i n : ℕ) : get_quadrant' i (hilbert_curve (i + 1) n) = get_quadrant i n#check quadrant_preserved
declaration uses 'sorry'example (i n : ℕ) : get_quadrant' i (hilbert_curve (i+1) n) = get_quadrant i n := byi:ℕn:ℕ⊢ get_quadrant' i (hilbert_curve (i + 1) n) = get_quadrant i n sorryAll goals completed! 🐙

and finally we can finish with a bunch of induction. As a reminder, you can hover or click elements to get details!

HilbertCurve.hilbert_curve_injective (i n : ℕ) (h : n < hilbert_length i) : hilbert_inverse i (hilbert_curve i n) = n#check hilbert_curve_injective
/--
A hilbert curve is injective on its length
-/
example (i : ℕ) (n : ℕ) (h : n < hilbert_length i) :
  hilbert_inverse i (hilbert_curve i n) = n := byi:ℕn:ℕh:n < hilbert_length i⊢ hilbert_inverse i (hilbert_curve i n) = n
  induction i generalizing n with
  | zero =>
    simp [hilbert_length] at hzeron:ℕh:n = 0⊢ hilbert_inverse 0 (hilbert_curve 0 n) = n
    rw [h]zeron:ℕh:n = 0⊢ hilbert_inverse 0 (hilbert_curve 0 0) = 0
    simp [hilbert_curve, hilbert_inverse]All goals completed! 🐙
  | succ i ih =>
    have := quadrant_preserved i nsucci:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = get_quadrant i n⊢ hilbert_inverse (i + 1) (hilbert_curve (i + 1) n) = n
    set q := get_quadrant i n with q_defsucci:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)q:Quadrant := get_quadrant i nthis:get_quadrant' i (hilbert_curve (i + 1) n) = qq_def:q = get_quadrant i n⊢ hilbert_inverse (i + 1) (hilbert_curve (i + 1) n) = n
    unfold hilbert_inversesucci:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)q:Quadrant := get_quadrant i nthis:get_quadrant' i (hilbert_curve (i + 1) n) = qq_def:q = get_quadrant i n⊢ (match get_quadrant' i (hilbert_curve (i + 1) n) with
  | Quadrant.BOTTOM_LEFT => hilbert_inverse i (T0_nat (hilbert_curve (i + 1) n))
  | Quadrant.TOP_LEFT => hilbert_length i + hilbert_inverse i (T1_inv_nat i (hilbert_curve (i + 1) n))
  | Quadrant.BOTTOM_RIGHT => 3 * hilbert_length i + hilbert_inverse i (T3_inv_nat i (hilbert_curve (i + 1) n))
  | Quadrant.TOP_RIGHT => 2 * hilbert_length i + hilbert_inverse i (T2_inv_nat i (hilbert_curve (i + 1) n))) =
  n
    rw [this]succi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)q:Quadrant := get_quadrant i nthis:get_quadrant' i (hilbert_curve (i + 1) n) = qq_def:q = get_quadrant i n⊢ (match q with
  | Quadrant.BOTTOM_LEFT => hilbert_inverse i (T0_nat (hilbert_curve (i + 1) n))
  | Quadrant.TOP_LEFT => hilbert_length i + hilbert_inverse i (T1_inv_nat i (hilbert_curve (i + 1) n))
  | Quadrant.BOTTOM_RIGHT => 3 * hilbert_length i + hilbert_inverse i (T3_inv_nat i (hilbert_curve (i + 1) n))
  | Quadrant.TOP_RIGHT => 2 * hilbert_length i + hilbert_inverse i (T2_inv_nat i (hilbert_curve (i + 1) n))) =
  n
    rcases qsucc.BOTTOM_LEFTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_LEFTq_def:Quadrant.BOTTOM_LEFT = get_quadrant i n⊢ (match Quadrant.BOTTOM_LEFT with
  | Quadrant.BOTTOM_LEFT => hilbert_inverse i (T0_nat (hilbert_curve (i + 1) n))
  | Quadrant.TOP_LEFT => hilbert_length i + hilbert_inverse i (T1_inv_nat i (hilbert_curve (i + 1) n))
  | Quadrant.BOTTOM_RIGHT => 3 * hilbert_length i + hilbert_inverse i (T3_inv_nat i (hilbert_curve (i + 1) n))
  | Quadrant.TOP_RIGHT => 2 * hilbert_length i + hilbert_inverse i (T2_inv_nat i (hilbert_curve (i + 1) n))) =
  nsucc.TOP_LEFTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.TOP_LEFTq_def:Quadrant.TOP_LEFT = get_quadrant i n⊢ (match Quadrant.TOP_LEFT with
  | Quadrant.BOTTOM_LEFT => hilbert_inverse i (T0_nat (hilbert_curve (i + 1) n))
  | Quadrant.TOP_LEFT => hilbert_length i + hilbert_inverse i (T1_inv_nat i (hilbert_curve (i + 1) n))
  | Quadrant.BOTTOM_RIGHT => 3 * hilbert_length i + hilbert_inverse i (T3_inv_nat i (hilbert_curve (i + 1) n))
  | Quadrant.TOP_RIGHT => 2 * hilbert_length i + hilbert_inverse i (T2_inv_nat i (hilbert_curve (i + 1) n))) =
  nsucc.TOP_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.TOP_RIGHTq_def:Quadrant.TOP_RIGHT = get_quadrant i n⊢ (match Quadrant.TOP_RIGHT with
  | Quadrant.BOTTOM_LEFT => hilbert_inverse i (T0_nat (hilbert_curve (i + 1) n))
  | Quadrant.TOP_LEFT => hilbert_length i + hilbert_inverse i (T1_inv_nat i (hilbert_curve (i + 1) n))
  | Quadrant.BOTTOM_RIGHT => 3 * hilbert_length i + hilbert_inverse i (T3_inv_nat i (hilbert_curve (i + 1) n))
  | Quadrant.TOP_RIGHT => 2 * hilbert_length i + hilbert_inverse i (T2_inv_nat i (hilbert_curve (i + 1) n))) =
  nsucc.BOTTOM_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_RIGHTq_def:Quadrant.BOTTOM_RIGHT = get_quadrant i n⊢ (match Quadrant.BOTTOM_RIGHT with
  | Quadrant.BOTTOM_LEFT => hilbert_inverse i (T0_nat (hilbert_curve (i + 1) n))
  | Quadrant.TOP_LEFT => hilbert_length i + hilbert_inverse i (T1_inv_nat i (hilbert_curve (i + 1) n))
  | Quadrant.BOTTOM_RIGHT => 3 * hilbert_length i + hilbert_inverse i (T3_inv_nat i (hilbert_curve (i + 1) n))
  | Quadrant.TOP_RIGHT => 2 * hilbert_length i + hilbert_inverse i (T2_inv_nat i (hilbert_curve (i + 1) n))) =
  n <;>succ.BOTTOM_LEFTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_LEFTq_def:Quadrant.BOTTOM_LEFT = get_quadrant i n⊢ (match Quadrant.BOTTOM_LEFT with
  | Quadrant.BOTTOM_LEFT => hilbert_inverse i (T0_nat (hilbert_curve (i + 1) n))
  | Quadrant.TOP_LEFT => hilbert_length i + hilbert_inverse i (T1_inv_nat i (hilbert_curve (i + 1) n))
  | Quadrant.BOTTOM_RIGHT => 3 * hilbert_length i + hilbert_inverse i (T3_inv_nat i (hilbert_curve (i + 1) n))
  | Quadrant.TOP_RIGHT => 2 * hilbert_length i + hilbert_inverse i (T2_inv_nat i (hilbert_curve (i + 1) n))) =
  nsucc.TOP_LEFTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.TOP_LEFTq_def:Quadrant.TOP_LEFT = get_quadrant i n⊢ (match Quadrant.TOP_LEFT with
  | Quadrant.BOTTOM_LEFT => hilbert_inverse i (T0_nat (hilbert_curve (i + 1) n))
  | Quadrant.TOP_LEFT => hilbert_length i + hilbert_inverse i (T1_inv_nat i (hilbert_curve (i + 1) n))
  | Quadrant.BOTTOM_RIGHT => 3 * hilbert_length i + hilbert_inverse i (T3_inv_nat i (hilbert_curve (i + 1) n))
  | Quadrant.TOP_RIGHT => 2 * hilbert_length i + hilbert_inverse i (T2_inv_nat i (hilbert_curve (i + 1) n))) =
  nsucc.TOP_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.TOP_RIGHTq_def:Quadrant.TOP_RIGHT = get_quadrant i n⊢ (match Quadrant.TOP_RIGHT with
  | Quadrant.BOTTOM_LEFT => hilbert_inverse i (T0_nat (hilbert_curve (i + 1) n))
  | Quadrant.TOP_LEFT => hilbert_length i + hilbert_inverse i (T1_inv_nat i (hilbert_curve (i + 1) n))
  | Quadrant.BOTTOM_RIGHT => 3 * hilbert_length i + hilbert_inverse i (T3_inv_nat i (hilbert_curve (i + 1) n))
  | Quadrant.TOP_RIGHT => 2 * hilbert_length i + hilbert_inverse i (T2_inv_nat i (hilbert_curve (i + 1) n))) =
  nsucc.BOTTOM_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_RIGHTq_def:Quadrant.BOTTOM_RIGHT = get_quadrant i n⊢ (match Quadrant.BOTTOM_RIGHT with
  | Quadrant.BOTTOM_LEFT => hilbert_inverse i (T0_nat (hilbert_curve (i + 1) n))
  | Quadrant.TOP_LEFT => hilbert_length i + hilbert_inverse i (T1_inv_nat i (hilbert_curve (i + 1) n))
  | Quadrant.BOTTOM_RIGHT => 3 * hilbert_length i + hilbert_inverse i (T3_inv_nat i (hilbert_curve (i + 1) n))
  | Quadrant.TOP_RIGHT => 2 * hilbert_length i + hilbert_inverse i (T2_inv_nat i (hilbert_curve (i + 1) n))) =
  n dsimpsucc.BOTTOM_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_RIGHTq_def:Quadrant.BOTTOM_RIGHT = get_quadrant i n⊢ 3 * hilbert_length i + hilbert_inverse i (T3_inv_nat i (hilbert_curve (i + 1) n)) = n <;>succ.BOTTOM_LEFTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_LEFTq_def:Quadrant.BOTTOM_LEFT = get_quadrant i n⊢ hilbert_inverse i (T0_nat (hilbert_curve (i + 1) n)) = nsucc.TOP_LEFTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.TOP_LEFTq_def:Quadrant.TOP_LEFT = get_quadrant i n⊢ hilbert_length i + hilbert_inverse i (T1_inv_nat i (hilbert_curve (i + 1) n)) = nsucc.TOP_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.TOP_RIGHTq_def:Quadrant.TOP_RIGHT = get_quadrant i n⊢ 2 * hilbert_length i + hilbert_inverse i (T2_inv_nat i (hilbert_curve (i + 1) n)) = nsucc.BOTTOM_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_RIGHTq_def:Quadrant.BOTTOM_RIGHT = get_quadrant i n⊢ 3 * hilbert_length i + hilbert_inverse i (T3_inv_nat i (hilbert_curve (i + 1) n)) = n unfold hilbert_curvesucc.BOTTOM_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_RIGHTq_def:Quadrant.BOTTOM_RIGHT = get_quadrant i n⊢ 3 * hilbert_length i +
    hilbert_inverse i
      (T3_inv_nat i
        (match get_quadrant i n with
        | Quadrant.BOTTOM_LEFT =>
          let h := hilbert_curve i n;
          T0_nat h
        | Quadrant.TOP_LEFT =>
          let h := hilbert_curve i (n - hilbert_length i);
          T1_nat i h
        | Quadrant.TOP_RIGHT =>
          let h := hilbert_curve i (n - 2 * hilbert_length i);
          T2_nat i h
        | Quadrant.BOTTOM_RIGHT =>
          let h := hilbert_curve i (n - 3 * hilbert_length i);
          T3_nat i h)) =
  n <;>succ.BOTTOM_LEFTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_LEFTq_def:Quadrant.BOTTOM_LEFT = get_quadrant i n⊢ hilbert_inverse i
    (T0_nat
      (match get_quadrant i n with
      | Quadrant.BOTTOM_LEFT =>
        let h := hilbert_curve i n;
        T0_nat h
      | Quadrant.TOP_LEFT =>
        let h := hilbert_curve i (n - hilbert_length i);
        T1_nat i h
      | Quadrant.TOP_RIGHT =>
        let h := hilbert_curve i (n - 2 * hilbert_length i);
        T2_nat i h
      | Quadrant.BOTTOM_RIGHT =>
        let h := hilbert_curve i (n - 3 * hilbert_length i);
        T3_nat i h)) =
  nsucc.TOP_LEFTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.TOP_LEFTq_def:Quadrant.TOP_LEFT = get_quadrant i n⊢ hilbert_length i +
    hilbert_inverse i
      (T1_inv_nat i
        (match get_quadrant i n with
        | Quadrant.BOTTOM_LEFT =>
          let h := hilbert_curve i n;
          T0_nat h
        | Quadrant.TOP_LEFT =>
          let h := hilbert_curve i (n - hilbert_length i);
          T1_nat i h
        | Quadrant.TOP_RIGHT =>
          let h := hilbert_curve i (n - 2 * hilbert_length i);
          T2_nat i h
        | Quadrant.BOTTOM_RIGHT =>
          let h := hilbert_curve i (n - 3 * hilbert_length i);
          T3_nat i h)) =
  nsucc.TOP_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.TOP_RIGHTq_def:Quadrant.TOP_RIGHT = get_quadrant i n⊢ 2 * hilbert_length i +
    hilbert_inverse i
      (T2_inv_nat i
        (match get_quadrant i n with
        | Quadrant.BOTTOM_LEFT =>
          let h := hilbert_curve i n;
          T0_nat h
        | Quadrant.TOP_LEFT =>
          let h := hilbert_curve i (n - hilbert_length i);
          T1_nat i h
        | Quadrant.TOP_RIGHT =>
          let h := hilbert_curve i (n - 2 * hilbert_length i);
          T2_nat i h
        | Quadrant.BOTTOM_RIGHT =>
          let h := hilbert_curve i (n - 3 * hilbert_length i);
          T3_nat i h)) =
  nsucc.BOTTOM_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_RIGHTq_def:Quadrant.BOTTOM_RIGHT = get_quadrant i n⊢ 3 * hilbert_length i +
    hilbert_inverse i
      (T3_inv_nat i
        (match get_quadrant i n with
        | Quadrant.BOTTOM_LEFT =>
          let h := hilbert_curve i n;
          T0_nat h
        | Quadrant.TOP_LEFT =>
          let h := hilbert_curve i (n - hilbert_length i);
          T1_nat i h
        | Quadrant.TOP_RIGHT =>
          let h := hilbert_curve i (n - 2 * hilbert_length i);
          T2_nat i h
        | Quadrant.BOTTOM_RIGHT =>
          let h := hilbert_curve i (n - 3 * hilbert_length i);
          T3_nat i h)) =
  n rw [<-q_def]succ.BOTTOM_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_RIGHTq_def:Quadrant.BOTTOM_RIGHT = get_quadrant i n⊢ 3 * hilbert_length i +
    hilbert_inverse i
      (T3_inv_nat i
        (match Quadrant.BOTTOM_RIGHT with
        | Quadrant.BOTTOM_LEFT =>
          let h := hilbert_curve i n;
          T0_nat h
        | Quadrant.TOP_LEFT =>
          let h := hilbert_curve i (n - hilbert_length i);
          T1_nat i h
        | Quadrant.TOP_RIGHT =>
          let h := hilbert_curve i (n - 2 * hilbert_length i);
          T2_nat i h
        | Quadrant.BOTTOM_RIGHT =>
          let h := hilbert_curve i (n - 3 * hilbert_length i);
          T3_nat i h)) =
  n
    ·succ.BOTTOM_LEFTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_LEFTq_def:Quadrant.BOTTOM_LEFT = get_quadrant i n⊢ hilbert_inverse i
    (T0_nat
      (match Quadrant.BOTTOM_LEFT with
      | Quadrant.BOTTOM_LEFT =>
        let h := hilbert_curve i n;
        T0_nat h
      | Quadrant.TOP_LEFT =>
        let h := hilbert_curve i (n - hilbert_length i);
        T1_nat i h
      | Quadrant.TOP_RIGHT =>
        let h := hilbert_curve i (n - 2 * hilbert_length i);
        T2_nat i h
      | Quadrant.BOTTOM_RIGHT =>
        let h := hilbert_curve i (n - 3 * hilbert_length i);
        T3_nat i h)) =
  n simp  [T0_involutive]succ.BOTTOM_LEFTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_LEFTq_def:Quadrant.BOTTOM_LEFT = get_quadrant i n⊢ hilbert_inverse i (T0_nat (T0_nat (hilbert_curve i n))) = n
      apply ihsucc.BOTTOM_LEFT.hi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_LEFTq_def:Quadrant.BOTTOM_LEFT = get_quadrant i n⊢ n < hilbert_length i
      exact (bottom_left_eq i n).mp (Eq.symm q_def)All goals completed! 🐙
    ·succ.TOP_LEFTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.TOP_LEFTq_def:Quadrant.TOP_LEFT = get_quadrant i n⊢ hilbert_length i +
    hilbert_inverse i
      (T1_inv_nat i
        (match Quadrant.TOP_LEFT with
        | Quadrant.BOTTOM_LEFT =>
          let h := hilbert_curve i n;
          T0_nat h
        | Quadrant.TOP_LEFT =>
          let h := hilbert_curve i (n - hilbert_length i);
          T1_nat i h
        | Quadrant.TOP_RIGHT =>
          let h := hilbert_curve i (n - 2 * hilbert_length i);
          T2_nat i h
        | Quadrant.BOTTOM_RIGHT =>
          let h := hilbert_curve i (n - 3 * hilbert_length i);
          T3_nat i h)) =
  n simp onlysucc.TOP_LEFTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.TOP_LEFTq_def:Quadrant.TOP_LEFT = get_quadrant i n⊢ hilbert_length i + hilbert_inverse i (T1_inv_nat i (T1_nat i (hilbert_curve i (n - hilbert_length i)))) = n
      rw [T1_inv_of_T1_nat]succ.TOP_LEFTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.TOP_LEFTq_def:Quadrant.TOP_LEFT = get_quadrant i n⊢ hilbert_length i + hilbert_inverse i (hilbert_curve i (n - hilbert_length i)) = n
      have := (top_left_eq i n).mp (Eq.symm q_def)succ.TOP_LEFTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this✝:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.TOP_LEFTq_def:Quadrant.TOP_LEFT = get_quadrant i nthis:hilbert_length i ≤ n ∧ n < 2 * hilbert_length i⊢ hilbert_length i + hilbert_inverse i (hilbert_curve i (n - hilbert_length i)) = n
      rw [ih (n - hilbert_length i)]succ.TOP_LEFTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this✝:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.TOP_LEFTq_def:Quadrant.TOP_LEFT = get_quadrant i nthis:hilbert_length i ≤ n ∧ n < 2 * hilbert_length i⊢ hilbert_length i + (n - hilbert_length i) = nsucc.TOP_LEFTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this✝:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.TOP_LEFTq_def:Quadrant.TOP_LEFT = get_quadrant i nthis:hilbert_length i ≤ n ∧ n < 2 * hilbert_length i⊢ n - hilbert_length i < hilbert_length i
      ·succ.TOP_LEFTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this✝:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.TOP_LEFTq_def:Quadrant.TOP_LEFT = get_quadrant i nthis:hilbert_length i ≤ n ∧ n < 2 * hilbert_length i⊢ hilbert_length i + (n - hilbert_length i) = n omegaAll goals completed! 🐙
      omegaAll goals completed! 🐙
    ·succ.TOP_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.TOP_RIGHTq_def:Quadrant.TOP_RIGHT = get_quadrant i n⊢ 2 * hilbert_length i +
    hilbert_inverse i
      (T2_inv_nat i
        (match Quadrant.TOP_RIGHT with
        | Quadrant.BOTTOM_LEFT =>
          let h := hilbert_curve i n;
          T0_nat h
        | Quadrant.TOP_LEFT =>
          let h := hilbert_curve i (n - hilbert_length i);
          T1_nat i h
        | Quadrant.TOP_RIGHT =>
          let h := hilbert_curve i (n - 2 * hilbert_length i);
          T2_nat i h
        | Quadrant.BOTTOM_RIGHT =>
          let h := hilbert_curve i (n - 3 * hilbert_length i);
          T3_nat i h)) =
  n simp onlysucc.TOP_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.TOP_RIGHTq_def:Quadrant.TOP_RIGHT = get_quadrant i n⊢ 2 * hilbert_length i + hilbert_inverse i (T2_inv_nat i (T2_nat i (hilbert_curve i (n - 2 * hilbert_length i)))) = n
      rw [T2_inv_of_T2_nat]succ.TOP_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.TOP_RIGHTq_def:Quadrant.TOP_RIGHT = get_quadrant i n⊢ 2 * hilbert_length i + hilbert_inverse i (hilbert_curve i (n - 2 * hilbert_length i)) = n
      have := (top_right_eq i n).mp (Eq.symm q_def)succ.TOP_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this✝:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.TOP_RIGHTq_def:Quadrant.TOP_RIGHT = get_quadrant i nthis:2 * hilbert_length i ≤ n ∧ n < 3 * hilbert_length i⊢ 2 * hilbert_length i + hilbert_inverse i (hilbert_curve i (n - 2 * hilbert_length i)) = n
      rw [ih (n - 2*hilbert_length i)]succ.TOP_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this✝:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.TOP_RIGHTq_def:Quadrant.TOP_RIGHT = get_quadrant i nthis:2 * hilbert_length i ≤ n ∧ n < 3 * hilbert_length i⊢ 2 * hilbert_length i + (n - 2 * hilbert_length i) = nsucc.TOP_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this✝:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.TOP_RIGHTq_def:Quadrant.TOP_RIGHT = get_quadrant i nthis:2 * hilbert_length i ≤ n ∧ n < 3 * hilbert_length i⊢ n - 2 * hilbert_length i < hilbert_length i
      ·succ.TOP_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this✝:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.TOP_RIGHTq_def:Quadrant.TOP_RIGHT = get_quadrant i nthis:2 * hilbert_length i ≤ n ∧ n < 3 * hilbert_length i⊢ 2 * hilbert_length i + (n - 2 * hilbert_length i) = n omegaAll goals completed! 🐙
      omegaAll goals completed! 🐙
    simp onlysucc.BOTTOM_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_RIGHTq_def:Quadrant.BOTTOM_RIGHT = get_quadrant i n⊢ 3 * hilbert_length i + hilbert_inverse i (T3_inv_nat i (T3_nat i (hilbert_curve i (n - 3 * hilbert_length i)))) = n
    have size := hilbert_curve_size i (n - 3 * hilbert_length i)succ.BOTTOM_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_RIGHTq_def:Quadrant.BOTTOM_RIGHT = get_quadrant i nsize:hilbert_curve i (n - 3 * hilbert_length i) ≤ (2 ^ i - 1, 2 ^ i - 1)⊢ 3 * hilbert_length i + hilbert_inverse i (T3_inv_nat i (T3_nat i (hilbert_curve i (n - 3 * hilbert_length i)))) = n
    rw [T3_inv_of_T3_nat]succ.BOTTOM_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_RIGHTq_def:Quadrant.BOTTOM_RIGHT = get_quadrant i nsize:hilbert_curve i (n - 3 * hilbert_length i) ≤ (2 ^ i - 1, 2 ^ i - 1)⊢ 3 * hilbert_length i + hilbert_inverse i (hilbert_curve i (n - 3 * hilbert_length i)) = nsucc.BOTTOM_RIGHT.h1i:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_RIGHTq_def:Quadrant.BOTTOM_RIGHT = get_quadrant i nsize:hilbert_curve i (n - 3 * hilbert_length i) ≤ (2 ^ i - 1, 2 ^ i - 1)⊢ (hilbert_curve i (n - 3 * hilbert_length i)).1 ≤ 2 ^ i - 1succ.BOTTOM_RIGHT.h2i:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_RIGHTq_def:Quadrant.BOTTOM_RIGHT = get_quadrant i nsize:hilbert_curve i (n - 3 * hilbert_length i) ≤ (2 ^ i - 1, 2 ^ i - 1)⊢ (hilbert_curve i (n - 3 * hilbert_length i)).2 ≤ 2 ^ (i + 1) - 1
    ·succ.BOTTOM_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_RIGHTq_def:Quadrant.BOTTOM_RIGHT = get_quadrant i nsize:hilbert_curve i (n - 3 * hilbert_length i) ≤ (2 ^ i - 1, 2 ^ i - 1)⊢ 3 * hilbert_length i + hilbert_inverse i (hilbert_curve i (n - 3 * hilbert_length i)) = n rw [ih _]succ.BOTTOM_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_RIGHTq_def:Quadrant.BOTTOM_RIGHT = get_quadrant i nsize:hilbert_curve i (n - 3 * hilbert_length i) ≤ (2 ^ i - 1, 2 ^ i - 1)⊢ 3 * hilbert_length i + (n - 3 * hilbert_length i) = nsucc.BOTTOM_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_RIGHTq_def:Quadrant.BOTTOM_RIGHT = get_quadrant i nsize:hilbert_curve i (n - 3 * hilbert_length i) ≤ (2 ^ i - 1, 2 ^ i - 1)⊢ n - 3 * hilbert_length i < hilbert_length i
      ·succ.BOTTOM_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_RIGHTq_def:Quadrant.BOTTOM_RIGHT = get_quadrant i nsize:hilbert_curve i (n - 3 * hilbert_length i) ≤ (2 ^ i - 1, 2 ^ i - 1)⊢ 3 * hilbert_length i + (n - 3 * hilbert_length i) = n have := (bottom_right_eq i n).mp (Eq.symm q_def)succ.BOTTOM_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this✝:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_RIGHTq_def:Quadrant.BOTTOM_RIGHT = get_quadrant i nsize:hilbert_curve i (n - 3 * hilbert_length i) ≤ (2 ^ i - 1, 2 ^ i - 1)this:3 * hilbert_length i ≤ n⊢ 3 * hilbert_length i + (n - 3 * hilbert_length i) = n
        omegaAll goals completed! 🐙
      rw [hilbert_length_succ] at hsucc.BOTTOM_RIGHTi:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < 4 * hilbert_length ithis:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_RIGHTq_def:Quadrant.BOTTOM_RIGHT = get_quadrant i nsize:hilbert_curve i (n - 3 * hilbert_length i) ≤ (2 ^ i - 1, 2 ^ i - 1)⊢ n - 3 * hilbert_length i < hilbert_length i
      omegaAll goals completed! 🐙
    ·succ.BOTTOM_RIGHT.h1i:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_RIGHTq_def:Quadrant.BOTTOM_RIGHT = get_quadrant i nsize:hilbert_curve i (n - 3 * hilbert_length i) ≤ (2 ^ i - 1, 2 ^ i - 1)⊢ (hilbert_curve i (n - 3 * hilbert_length i)).1 ≤ 2 ^ i - 1 exact size.1All goals completed! 🐙
    apply le_trans size.2succ.BOTTOM_RIGHT.h2i:ℕih:∀ n < hilbert_length i, hilbert_inverse i (hilbert_curve i n) = nn:ℕh:n < hilbert_length (i + 1)this:get_quadrant' i (hilbert_curve (i + 1) n) = Quadrant.BOTTOM_RIGHTq_def:Quadrant.BOTTOM_RIGHT = get_quadrant i nsize:hilbert_curve i (n - 3 * hilbert_length i) ≤ (2 ^ i - 1, 2 ^ i - 1)⊢ (2 ^ i - 1, 2 ^ i - 1).2 ≤ 2 ^ (i + 1) - 1
    omegaAll goals completed! 🐙

As you can see, it seems that a lot of the "obvious" proofs I skipped in the informal post run into hundreds of lines of code once you spell it all out. After thinking about it, I think that turning a picture into mathematics involves encoding a lot of geometry we humans have very well internalized, sort of like how it took many decades to program the difference between a cat and a bird reliably.

The surjectivity proofs ended up committing a similar level of "collateral damage". To prove the Hilbert curve only moves by 1 each step, a similar level of boilerplate shows that the quadrants "connect" with each transformation. I had to define a little l1 norm dist' for pairs of integers, which feels like it should exist somewhere. If you know of where to look, please reach out.

I am at a bit of a loss of how to make this simple. It all feels extremely basic, but there was so many definitions involved here.

Cauchy Condition

After staring at several diagrams comparing the different curves, I came up with the following statement:

lemma declaration uses 'sorry'subdivision_size (i n : ℕ) :
  2 * hilbert_curve i (n/4) ≤ hilbert_curve (i+1) n ∧
  hilbert_curve (i+1) n ≤ 2 * hilbert_curve i (n/4) + 1 := byi:ℕn:ℕ⊢ 2 * hilbert_curve i (n / 4) ≤ hilbert_curve (i + 1) n ∧ hilbert_curve (i + 1) n ≤ 2 * hilbert_curve i (n / 4) + 1 sorryAll goals completed! 🐙

I won't bore you with the proof, except that in addition to induction, we also need some extra definitions and proofs for each transformation:

def within_square (a b : ℕ × ℕ) : Prop :=
  2•a ≤ b ∧ b ≤ 2•a+1

lemma T1_within_square (i : ℕ) (mn1 mn2 : ℕ × ℕ) :
  within_square mn1 mn2 →
  within_square (T1_nat i mn1) (T1_nat (i+1) mn2) := byi:ℕmn1:ℕ × ℕmn2:ℕ × ℕ⊢ within_square mn1 mn2 → within_square (T1_nat i mn1) (T1_nat (i + 1) mn2)
  simp [within_square, T1_nat]i:ℕmn1:ℕ × ℕmn2:ℕ × ℕ⊢ 2 * mn1 ≤ mn2 →
  mn2 ≤ 2 * mn1 + 1 →
    2 * mn1 + (0, 2 * 2 ^ i) ≤ mn2 + (0, 2 ^ (i + 1)) ∧ mn2 + (0, 2 ^ (i + 1)) ≤ 2 * mn1 + (0, 2 * 2 ^ i) + 1
  intro h1 h2i:ℕmn1:ℕ × ℕmn2:ℕ × ℕh1:2 * mn1 ≤ mn2h2:mn2 ≤ 2 * mn1 + 1⊢ 2 * mn1 + (0, 2 * 2 ^ i) ≤ mn2 + (0, 2 ^ (i + 1)) ∧ mn2 + (0, 2 ^ (i + 1)) ≤ 2 * mn1 + (0, 2 * 2 ^ i) + 1
  have : 2 * mn1.1 ≤ mn2.1 := h1.1i:ℕmn1:ℕ × ℕmn2:ℕ × ℕh1:2 * mn1 ≤ mn2h2:mn2 ≤ 2 * mn1 + 1this:2 * mn1.1 ≤ mn2.1⊢ 2 * mn1 + (0, 2 * 2 ^ i) ≤ mn2 + (0, 2 ^ (i + 1)) ∧ mn2 + (0, 2 ^ (i + 1)) ≤ 2 * mn1 + (0, 2 * 2 ^ i) + 1
  have : 2 * mn1.2 ≤ mn2.2 := h1.2i:ℕmn1:ℕ × ℕmn2:ℕ × ℕh1:2 * mn1 ≤ mn2h2:mn2 ≤ 2 * mn1 + 1this✝:2 * mn1.1 ≤ mn2.1this:2 * mn1.2 ≤ mn2.2⊢ 2 * mn1 + (0, 2 * 2 ^ i) ≤ mn2 + (0, 2 ^ (i + 1)) ∧ mn2 + (0, 2 ^ (i + 1)) ≤ 2 * mn1 + (0, 2 * 2 ^ i) + 1
  have : mn2.1 ≤ 2*mn1.1 + 1 := h2.1i:ℕmn1:ℕ × ℕmn2:ℕ × ℕh1:2 * mn1 ≤ mn2h2:mn2 ≤ 2 * mn1 + 1this✝¹:2 * mn1.1 ≤ mn2.1this✝:2 * mn1.2 ≤ mn2.2this:mn2.1 ≤ 2 * mn1.1 + 1⊢ 2 * mn1 + (0, 2 * 2 ^ i) ≤ mn2 + (0, 2 ^ (i + 1)) ∧ mn2 + (0, 2 ^ (i + 1)) ≤ 2 * mn1 + (0, 2 * 2 ^ i) + 1
  have : mn2.2 ≤ 2*mn1.2 + 1 := h2.2i:ℕmn1:ℕ × ℕmn2:ℕ × ℕh1:2 * mn1 ≤ mn2h2:mn2 ≤ 2 * mn1 + 1this✝²:2 * mn1.1 ≤ mn2.1this✝¹:2 * mn1.2 ≤ mn2.2this✝:mn2.1 ≤ 2 * mn1.1 + 1this:mn2.2 ≤ 2 * mn1.2 + 1⊢ 2 * mn1 + (0, 2 * 2 ^ i) ≤ mn2 + (0, 2 ^ (i + 1)) ∧ mn2 + (0, 2 ^ (i + 1)) ≤ 2 * mn1 + (0, 2 * 2 ^ i) + 1
  constructorlefti:ℕmn1:ℕ × ℕmn2:ℕ × ℕh1:2 * mn1 ≤ mn2h2:mn2 ≤ 2 * mn1 + 1this✝²:2 * mn1.1 ≤ mn2.1this✝¹:2 * mn1.2 ≤ mn2.2this✝:mn2.1 ≤ 2 * mn1.1 + 1this:mn2.2 ≤ 2 * mn1.2 + 1⊢ 2 * mn1 + (0, 2 * 2 ^ i) ≤ mn2 + (0, 2 ^ (i + 1))righti:ℕmn1:ℕ × ℕmn2:ℕ × ℕh1:2 * mn1 ≤ mn2h2:mn2 ≤ 2 * mn1 + 1this✝²:2 * mn1.1 ≤ mn2.1this✝¹:2 * mn1.2 ≤ mn2.2this✝:mn2.1 ≤ 2 * mn1.1 + 1this:mn2.2 ≤ 2 * mn1.2 + 1⊢ mn2 + (0, 2 ^ (i + 1)) ≤ 2 * mn1 + (0, 2 * 2 ^ i) + 1 <;>lefti:ℕmn1:ℕ × ℕmn2:ℕ × ℕh1:2 * mn1 ≤ mn2h2:mn2 ≤ 2 * mn1 + 1this✝²:2 * mn1.1 ≤ mn2.1this✝¹:2 * mn1.2 ≤ mn2.2this✝:mn2.1 ≤ 2 * mn1.1 + 1this:mn2.2 ≤ 2 * mn1.2 + 1⊢ 2 * mn1 + (0, 2 * 2 ^ i) ≤ mn2 + (0, 2 ^ (i + 1))righti:ℕmn1:ℕ × ℕmn2:ℕ × ℕh1:2 * mn1 ≤ mn2h2:mn2 ≤ 2 * mn1 + 1this✝²:2 * mn1.1 ≤ mn2.1this✝¹:2 * mn1.2 ≤ mn2.2this✝:mn2.1 ≤ 2 * mn1.1 + 1this:mn2.2 ≤ 2 * mn1.2 + 1⊢ mn2 + (0, 2 ^ (i + 1)) ≤ 2 * mn1 + (0, 2 * 2 ^ i) + 1 constructorright.lefti:ℕmn1:ℕ × ℕmn2:ℕ × ℕh1:2 * mn1 ≤ mn2h2:mn2 ≤ 2 * mn1 + 1this✝²:2 * mn1.1 ≤ mn2.1this✝¹:2 * mn1.2 ≤ mn2.2this✝:mn2.1 ≤ 2 * mn1.1 + 1this:mn2.2 ≤ 2 * mn1.2 + 1⊢ (mn2 + (0, 2 ^ (i + 1))).1 ≤ (2 * mn1 + (0, 2 * 2 ^ i) + 1).1right.righti:ℕmn1:ℕ × ℕmn2:ℕ × ℕh1:2 * mn1 ≤ mn2h2:mn2 ≤ 2 * mn1 + 1this✝²:2 * mn1.1 ≤ mn2.1this✝¹:2 * mn1.2 ≤ mn2.2this✝:mn2.1 ≤ 2 * mn1.1 + 1this:mn2.2 ≤ 2 * mn1.2 + 1⊢ (mn2 + (0, 2 ^ (i + 1))).2 ≤ (2 * mn1 + (0, 2 * 2 ^ i) + 1).2
  <;>left.lefti:ℕmn1:ℕ × ℕmn2:ℕ × ℕh1:2 * mn1 ≤ mn2h2:mn2 ≤ 2 * mn1 + 1this✝²:2 * mn1.1 ≤ mn2.1this✝¹:2 * mn1.2 ≤ mn2.2this✝:mn2.1 ≤ 2 * mn1.1 + 1this:mn2.2 ≤ 2 * mn1.2 + 1⊢ (2 * mn1 + (0, 2 * 2 ^ i)).1 ≤ (mn2 + (0, 2 ^ (i + 1))).1left.righti:ℕmn1:ℕ × ℕmn2:ℕ × ℕh1:2 * mn1 ≤ mn2h2:mn2 ≤ 2 * mn1 + 1this✝²:2 * mn1.1 ≤ mn2.1this✝¹:2 * mn1.2 ≤ mn2.2this✝:mn2.1 ≤ 2 * mn1.1 + 1this:mn2.2 ≤ 2 * mn1.2 + 1⊢ (2 * mn1 + (0, 2 * 2 ^ i)).2 ≤ (mn2 + (0, 2 ^ (i + 1))).2right.lefti:ℕmn1:ℕ × ℕmn2:ℕ × ℕh1:2 * mn1 ≤ mn2h2:mn2 ≤ 2 * mn1 + 1this✝²:2 * mn1.1 ≤ mn2.1this✝¹:2 * mn1.2 ≤ mn2.2this✝:mn2.1 ≤ 2 * mn1.1 + 1this:mn2.2 ≤ 2 * mn1.2 + 1⊢ (mn2 + (0, 2 ^ (i + 1))).1 ≤ (2 * mn1 + (0, 2 * 2 ^ i) + 1).1right.righti:ℕmn1:ℕ × ℕmn2:ℕ × ℕh1:2 * mn1 ≤ mn2h2:mn2 ≤ 2 * mn1 + 1this✝²:2 * mn1.1 ≤ mn2.1this✝¹:2 * mn1.2 ≤ mn2.2this✝:mn2.1 ≤ 2 * mn1.1 + 1this:mn2.2 ≤ 2 * mn1.2 + 1⊢ (mn2 + (0, 2 ^ (i + 1))).2 ≤ (2 * mn1 + (0, 2 * 2 ^ i) + 1).2 (simp [pow_add]right.righti:ℕmn1:ℕ × ℕmn2:ℕ × ℕh1:2 * mn1 ≤ mn2h2:mn2 ≤ 2 * mn1 + 1this✝²:2 * mn1.1 ≤ mn2.1this✝¹:2 * mn1.2 ≤ mn2.2this✝:mn2.1 ≤ 2 * mn1.1 + 1this:mn2.2 ≤ 2 * mn1.2 + 1⊢ mn2.2 + 2 ^ i * 2 ≤ 2 * mn1.2 + 2 * 2 ^ i + 1; omegaAll goals completed! 🐙)

A digression on casting and pairs

The biggest obstacle to algebra in Lean is that you need to do a lot of casting. Often times, statements on \mathbb{N} which are trivial for integers or reals requires a lot of intermediate bound proofs to satisfy the conditions for Nat.cast_sub. I decided that if the tactic omega ever failed, I would try converting to integers, but luckily omega covers a lot.

Sasting pairs are not very well covered by mathlib, so I included a few instances.

NtimesN.toRtimesR.{u_1} {R : Type u_1} [Ring R] : ℕ × ℕ → R × R#check NtimesN.toRtimesR

@[coe]
example : ℕ × ℕ → R × R := fun p => (p.1, p.2)

instance : Coe (ℕ × ℕ) (R × R) where
  coe := NtimesN.toRtimesR

ZtimesZ.toR : ℤ × ℤ → ℝ × ℝ#check (ZtimesZ.toR : ℤ × ℤ → ℝ × ℝ)

Thanks to Yaël Dillies for pointing out a noncommmuting type class diamond when you add Coe α β → Coe (α × α) (β × β) and Coe α β → Coe α (β × β). Coe α β → Coe (α × α) ((β × β) × (β × β)) can be (x, y) ↦ ((↑x, ↑x), (↑y, ↑y)), or ((↑x, ↑y), (↑x, ↑y)). Eric Wieser's PhD thesis has a section "Multiple-inheritance hazards in dependently-typed algebraic hierarchies" about similar issues. Given their use in other languages, a proper array broadcasting interface should be able to define stable lifting procedures (at least in \mathbb{R}).

Interpolating

To construct our interpolated version of the Hilbert curve, first we must define an API for interpolation. In mathlib, we have the ability to (1) concatenate paths and (2) use AffineMap.lineMap to connect points. Unfortunately, blindly concatenating paths is not so nice, since it always compresses the two arguments to [0, \frac{1}{2}] and [\frac{1}{2}, 1]. Repeated application does not evenly space points, which we need. So instead, we'll need to define linear interpolation:

interpolate_points (f : ℤ → ℝ × ℝ) (t : ℝ) : ℝ × ℝ#check interpolate_points
noncomputable example (f : ℤ → ℝ × ℝ) (t : ℝ) : ℝ × ℝ :=
  let n := ⌊t⌋
  (AffineMap.lineMap (f n) (f (n+1))) (t - ⌊t⌋)

Here, AffineMap.lineMap is exactly the (1 - t)x + t y = x + t (y - x) but for affine spaces. I didn't bother to generalize this definition, but affine spaces seem like a convenient target. I also find this definition to be much simpler than the "informal" definition, which is a nice change. You may notice that it is noncomputable. This is because the floor function is terribly annoying, but the computable alternative here is also a chore. I'll leave it as an exercise for the reader to construct a computable version.

There are a few theorems for interpolation that are all ordinary. Remember you can hover or click to to get description and docs

interpolate_interpolates
interpolate_add and interpolate_add'
interpolate_eq_affine_map
interpolate_section
interpolate_preserves: this one was actually difficult to prove, since it involved some strange use of @Set.Accumulate.
interpolate_map and interpolate_map'
interpolate_is_continuous
interpolate_distance

Proving interpolate_is_continuous required using LocallyFinite.continuous. Trying to compose lots of continuous functions can be abused by interleaving them, and I refuse to "manually" use continuity here. Our "component" intervals [i, i+1] cover each point at most twice. I found this to be completely obvious, but also very annoying to prove, so I prove at most 3 or 4 times with the use of the \lfloor \cdot \rfloor and \lfloor \cdot \rfloor.

I suspect that these proofs can be reordered and streamlined as well as extended to some really nice space. I am wary of standardizing too soon, since minor extensions like adding circular arcs are still a huge pain. There are plenty of questions like "why make them evenly spaced".

Scaling and Normalized Version

I often wanted to break things up into a "core" interpolated version and then compose it with linear functions for scaling. Oddly enough, the "scale" linear function didn't appear anywhere. I'm not sure if it's even necessary, but I implemented it:

/--
scale is smul as a LinearMap
-/
@[reducible]
noncomputable def scale (s : ℝ) : ℝ × ℝ →L[ℝ] ℝ × ℝ :=
  LinearMap.toContinuousLinearMap {
    toFun := fun x => s • x
    map_add' := byR:Type u_1inst✝:Ring Rs:ℝ⊢ ∀ (x y : ℝ × ℝ), s • (x + y) = s • x + s • y simpAll goals completed! 🐙
    map_smul' := byR:Type u_1inst✝:Ring Rs:ℝ⊢ ∀ (m : ℝ) (x : ℝ × ℝ), s • m • x = (RingHom.id ℝ) m • s • x simpR:Type u_1inst✝:Ring Rs:ℝ⊢ ∀ (m a b : ℝ), s * (m * a) = m * (s * a) ∧ s * (m * b) = m * (s * b); ring_nfR:Type u_1inst✝:Ring Rs:ℝ⊢ ∀ (m a b : ℝ), True ∧ True; simpAll goals completed! 🐙
  }

Now, defining the final interpolated version involves stitching this together (+ casting :( )

/--
An iteration of the Hilbert curve as ℝ → ℝ × ℝ interpolated
and scaled to [0, 1] × [0, 1].
-/
noncomputable def normalized_hilbert_curve (i : ℕ) :=
  interpolate_points (
    scale ((2 : ℝ)^i)⁻¹ ∘ (↑) ∘ hilbert_curve i ∘ (fun x ↦ x.toNat)
  ) ∘ (fun t ↦ t * hilbert_length i)

Continuity ends up being extremely simple:

HilbertCurve.normal_hilbert_curve_continuous (i : ℕ) : Continuous (normalized_hilbert_curve i)#check normal_hilbert_curve_continuous
/--
Each real Hilbert curve is continuous.
-/
example (i : ℕ) : Continuous (normalized_hilbert_curve i) := byi:ℕ⊢ Continuous (normalized_hilbert_curve i)
  rw [normalized_hilbert_curve]i:ℕ⊢ Continuous
  (interpolate_points (⇑(scale (2 ^ i)⁻¹) ∘ NtimesN.toRtimesR ∘ hilbert_curve i ∘ fun x => x.toNat) ∘ fun t =>
    t * ↑(hilbert_length i))
  set f : ℤ → ℝ × ℝ := (⇑(scale (2 ^ i)⁻¹) ∘ (fun x ↦ (↑x.1, ↑x.2)) ∘ hilbert_curve i ∘ fun x ↦ x.toNat) with f_defi:ℕf:ℤ → ℝ × ℝ := ⇑(scale (2 ^ i)⁻¹) ∘ (fun x => (↑x.1, ↑x.2)) ∘ hilbert_curve i ∘ fun x => x.toNatf_def:f = ⇑(scale (2 ^ i)⁻¹) ∘ (fun x => (↑x.1, ↑x.2)) ∘ hilbert_curve i ∘ fun x => x.toNat⊢ Continuous
  (interpolate_points (⇑(scale (2 ^ i)⁻¹) ∘ NtimesN.toRtimesR ∘ hilbert_curve i ∘ fun x => x.toNat) ∘ fun t =>
    t * ↑(hilbert_length i))
  have := interpolate_is_continuous fi:ℕf:ℤ → ℝ × ℝ := ⇑(scale (2 ^ i)⁻¹) ∘ (fun x => (↑x.1, ↑x.2)) ∘ hilbert_curve i ∘ fun x => x.toNatf_def:f = ⇑(scale (2 ^ i)⁻¹) ∘ (fun x => (↑x.1, ↑x.2)) ∘ hilbert_curve i ∘ fun x => x.toNatthis:Continuous (interpolate_points f)⊢ Continuous
  (interpolate_points (⇑(scale (2 ^ i)⁻¹) ∘ NtimesN.toRtimesR ∘ hilbert_curve i ∘ fun x => x.toNat) ∘ fun t =>
    t * ↑(hilbert_length i))
  apply Continuous.comp thisi:ℕf:ℤ → ℝ × ℝ := ⇑(scale (2 ^ i)⁻¹) ∘ (fun x => (↑x.1, ↑x.2)) ∘ hilbert_curve i ∘ fun x => x.toNatf_def:f = ⇑(scale (2 ^ i)⁻¹) ∘ (fun x => (↑x.1, ↑x.2)) ∘ hilbert_curve i ∘ fun x => x.toNatthis:Continuous (interpolate_points f)⊢ Continuous fun t => t * ↑(hilbert_length i)
  apply continuous_mul_rightAll goals completed! 🐙

Once I had the distance lemma normal_subdivision_size informally, writing it in Lean didn't need too much creatively, except for this missing floor lemma which I had to prove "by definition".

/--
If you multiply by n, floor, then integer divide by n, then it is the same as floor.
-/
lemma declaration uses 'sorry'div_floor_mul_eq_floor (t : ℝ) (n : ℕ) (h : 0 ≤ t) (h' : 0 < n):
  ⌊t * n⌋ / n = ⌊t⌋ := byt:ℝn:ℕh:0 ≤ th':0 < n⊢ ⌊t * ↑n⌋ / ↑n = ⌊t⌋ sorryAll goals completed! 🐙

HilbertCurve.normal_subdivision_size (i : ℕ) (t : ℝ) :
  dist (normalized_hilbert_curve i t) (normalized_hilbert_curve (i + 1) t) ≤ 2 * (2 ^ i)⁻¹#check normal_subdivision_size
/--
The real Hilbert curve only moves 1 / 2^(i-1) each iteration for each t.
-/
example (i : ℕ) (t : ℝ) :
  dist (normalized_hilbert_curve i t)
    (normalized_hilbert_curve (i+1) t) ≤ 2 * (2^i)⁻¹ := byi:ℕt:ℝ⊢ dist (normalized_hilbert_curve i t) (normalized_hilbert_curve (i + 1) t) ≤ 2 * (2 ^ i)⁻¹
  -- We'll prove this by the triangle inequality between H_i(t), H_i(n / L_i),
  -- H_{i+1}(n / L_{i+1)}), and finally H_{i+1}(t). We do this instead
  -- of a more obvious subdivision lemma since the edge effects at the boundary
  -- are too annoying.
  apply le_trans (dist_triangle4 _
    (normalized_hilbert_curve i (⌊t * hilbert_length i⌋ / hilbert_length i))
    (normalized_hilbert_curve (i+1) (⌊t * (hilbert_length (i+1))⌋ / (hilbert_length (i + 1))))
    _)i:ℕt:ℝ⊢ dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) +
      dist (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i)))
        (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1)))) +
    dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
      (normalized_hilbert_curve (i + 1) t) ≤
  2 * (2 ^ i)⁻¹
  -- Bounding the distance between points t and n / L_i is still easy.
  have t1 : dist (normalized_hilbert_curve i t)
    (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤ (2^i)⁻¹ :=
    normal_hilbert_dist i ti:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹⊢ dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) +
      dist (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i)))
        (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1)))) +
    dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
      (normalized_hilbert_curve (i + 1) t) ≤
  2 * (2 ^ i)⁻¹
  have t3 : dist (normalized_hilbert_curve (i+1) (⌊t * (hilbert_length (i+1))⌋ / (hilbert_length (i+1))))
    (normalized_hilbert_curve (i+1) t) ≤ (2^(i+1))⁻¹ := byi:ℕt:ℝ⊢ dist (normalized_hilbert_curve i t) (normalized_hilbert_curve (i + 1) t) ≤ 2 * (2 ^ i)⁻¹
    rw [dist_comm]i:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹⊢ dist (normalized_hilbert_curve (i + 1) t)
    (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1)))) ≤
  (2 ^ (i + 1))⁻¹
    exact normal_hilbert_dist (i+1) tAll goals completed! 🐙
  have t2 : dist (normalized_hilbert_curve i (⌊t * (hilbert_length i)⌋ / (hilbert_length i)))
    (normalized_hilbert_curve (i+1) (⌊t * hilbert_length (i+1)⌋ / (hilbert_length (i+1)))) ≤ (2^(i+1))⁻¹ := byi:ℕt:ℝ⊢ dist (normalized_hilbert_curve i t) (normalized_hilbert_curve (i + 1) t) ≤ 2 * (2 ^ i)⁻¹
    -- When t ≤ 0, it's a straightforward calculation.
    by_cases h : t ≤ 0posi:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:t ≤ 0⊢ dist (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i)))
    (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1)))) ≤
  (2 ^ (i + 1))⁻¹negi:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:¬t ≤ 0⊢ dist (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i)))
    (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1)))) ≤
  (2 ^ (i + 1))⁻¹
    ·posi:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:t ≤ 0⊢ dist (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i)))
    (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1)))) ≤
  (2 ^ (i + 1))⁻¹ have : ∀n : ℕ, ⌊t * n⌋ / n ≤ (0 : ℝ) :=  byi:ℕt:ℝ⊢ dist (normalized_hilbert_curve i t) (normalized_hilbert_curve (i + 1) t) ≤ 2 * (2 ^ i)⁻¹
        intro ni:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:t ≤ 0n:ℕ⊢ ↑⌊t * ↑n⌋ / ↑n ≤ 0
        apply div_nonpos_of_nonpos_of_nonneghai:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:t ≤ 0n:ℕ⊢ ↑⌊t * ↑n⌋ ≤ 0hbi:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:t ≤ 0n:ℕ⊢ 0 ≤ ↑n
        ·hai:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:t ≤ 0n:ℕ⊢ ↑⌊t * ↑n⌋ ≤ 0 norm_casthai:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:t ≤ 0n:ℕ⊢ ⌊t * ↑n⌋ ≤ 0
          apply Int.floor_nonposha.hai:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:t ≤ 0n:ℕ⊢ t * ↑n ≤ 0
          apply mul_nonpos_of_nonpos_of_nonnegha.ha.hai:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:t ≤ 0n:ℕ⊢ t ≤ 0ha.ha.hbi:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:t ≤ 0n:ℕ⊢ 0 ≤ ↑n
          exact hha.ha.hbi:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:t ≤ 0n:ℕ⊢ 0 ≤ ↑n
          simp only [Nat.cast_nonneg]All goals completed! 🐙
        simp only [Nat.cast_nonneg]All goals completed! 🐙
      rw [normalized_hilbert_curve_nonpos i _ (this (hilbert_length i))]posi:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:t ≤ 0this:∀ (n : ℕ), ↑⌊t * ↑n⌋ / ↑n ≤ 0⊢ dist (normalized_hilbert_curve i 0)
    (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1)))) ≤
  (2 ^ (i + 1))⁻¹
      rw [normalized_hilbert_curve_nonpos (i+1) _ (this (hilbert_length (i+1)))]posi:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:t ≤ 0this:∀ (n : ℕ), ↑⌊t * ↑n⌋ / ↑n ≤ 0⊢ dist (normalized_hilbert_curve i 0) (normalized_hilbert_curve (i + 1) 0) ≤ (2 ^ (i + 1))⁻¹
      rw [normal_hilbert_start, normal_hilbert_start]posi:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:t ≤ 0this:∀ (n : ℕ), ↑⌊t * ↑n⌋ / ↑n ≤ 0⊢ dist (0, 0) (0, 0) ≤ (2 ^ (i + 1))⁻¹
      simpAll goals completed! 🐙
    simp only [not_le] at hnegi:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:0 < t⊢ dist (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i)))
    (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1)))) ≤
  (2 ^ (i + 1))⁻¹
    -- Now we can relate the ⌊n⌋ = ⌊4 * n⌋ / 4
    have : ⌊t * hilbert_length i⌋ = ⌊t * hilbert_length (i+1)⌋ / 4 := byi:ℕt:ℝ⊢ dist (normalized_hilbert_curve i t) (normalized_hilbert_curve (i + 1) t) ≤ 2 * (2 ^ i)⁻¹
      rw [hilbert_length_succ, mul_comm 4]i:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:0 < t⊢ ⌊t * ↑(hilbert_length i)⌋ = ⌊t * ↑(hilbert_length i * 4)⌋ / 4
      rw [Nat.cast_mul, Nat.cast_ofNat]i:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:0 < t⊢ ⌊t * ↑(hilbert_length i)⌋ = ⌊t * (↑(hilbert_length i) * 4)⌋ / 4
      rw [<-mul_assoc]i:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:0 < t⊢ ⌊t * ↑(hilbert_length i)⌋ = ⌊t * ↑(hilbert_length i) * 4⌋ / 4
      symmi:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:0 < t⊢ ⌊t * ↑(hilbert_length i) * 4⌋ / 4 = ⌊t * ↑(hilbert_length i)⌋
      apply div_floor_mul_eq_floorhi:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:0 < t⊢ 0 ≤ t * ↑(hilbert_length i)h'i:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:0 < t⊢ 0 < 4
      ·hi:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:0 < t⊢ 0 ≤ t * ↑(hilbert_length i) positivityAll goals completed! 🐙
      norm_numAll goals completed! 🐙
    rw [this]negi:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:0 < tthis:⌊t * ↑(hilbert_length i)⌋ = ⌊t * ↑(hilbert_length (i + 1))⌋ / 4⊢ dist (normalized_hilbert_curve i (↑(⌊t * ↑(hilbert_length (i + 1))⌋ / 4) / ↑(hilbert_length i)))
    (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1)))) ≤
  (2 ^ (i + 1))⁻¹
    -- We need to deal with some toNat casting to apply normal_hilbert_across_dist
    rw [show ⌊t * hilbert_length (i+1)⌋ = ⌊t * hilbert_length (i+1)⌋.toNat by
      refine Int.eq_natCast_toNat.mpr ?_
      positivity
    ]negi:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:0 < tthis:⌊t * ↑(hilbert_length i)⌋ = ⌊t * ↑(hilbert_length (i + 1))⌋ / 4⊢ dist (normalized_hilbert_curve i (↑(↑⌊t * ↑(hilbert_length (i + 1))⌋.toNat / 4) / ↑(hilbert_length i)))
    (normalized_hilbert_curve (i + 1) (↑↑⌊t * ↑(hilbert_length (i + 1))⌋.toNat / ↑(hilbert_length (i + 1)))) ≤
  (2 ^ (i + 1))⁻¹
    rw [show ⌊t * hilbert_length (i+1)⌋.toNat / (4 : ℤ) = (⌊t * hilbert_length (i+1)⌋.toNat / 4 : ℕ) by
      simp
    ]negi:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:0 < tthis:⌊t * ↑(hilbert_length i)⌋ = ⌊t * ↑(hilbert_length (i + 1))⌋ / 4⊢ dist (normalized_hilbert_curve i (↑↑(⌊t * ↑(hilbert_length (i + 1))⌋.toNat / 4) / ↑(hilbert_length i)))
    (normalized_hilbert_curve (i + 1) (↑↑⌊t * ↑(hilbert_length (i + 1))⌋.toNat / ↑(hilbert_length (i + 1)))) ≤
  (2 ^ (i + 1))⁻¹
    have : ∀n : ℕ, ((n : ℤ) : ℝ) = (n : ℝ) := byi:ℕt:ℝ⊢ dist (normalized_hilbert_curve i t) (normalized_hilbert_curve (i + 1) t) ≤ 2 * (2 ^ i)⁻¹ intro ni:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:0 < tthis:⌊t * ↑(hilbert_length i)⌋ = ⌊t * ↑(hilbert_length (i + 1))⌋ / 4n:ℕ⊢ ↑↑n = ↑n; norm_castAll goals completed! 🐙
    rw [this, this]negi:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹h:0 < tthis✝:⌊t * ↑(hilbert_length i)⌋ = ⌊t * ↑(hilbert_length (i + 1))⌋ / 4this:∀ (n : ℕ), ↑↑n = ↑n⊢ dist (normalized_hilbert_curve i (↑(⌊t * ↑(hilbert_length (i + 1))⌋.toNat / 4) / ↑(hilbert_length i)))
    (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋.toNat / ↑(hilbert_length (i + 1)))) ≤
  (2 ^ (i + 1))⁻¹
    apply normal_hilbert_across_distAll goals completed! 🐙
  rw [show 2  * ((2 : ℝ)^i)⁻¹ = (2^i)⁻¹ + (2^(i+1))⁻¹ + (2^(i+1))⁻¹ by
    rw [pow_add]
    ring
  ]i:ℕt:ℝt1:dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) ≤
  (2 ^ i)⁻¹t3:dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
    (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ (i + 1))⁻¹t2:dist (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i)))
    (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1)))) ≤
  (2 ^ (i + 1))⁻¹⊢ dist (normalized_hilbert_curve i t) (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i))) +
      dist (normalized_hilbert_curve i (↑⌊t * ↑(hilbert_length i)⌋ / ↑(hilbert_length i)))
        (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1)))) +
    dist (normalized_hilbert_curve (i + 1) (↑⌊t * ↑(hilbert_length (i + 1))⌋ / ↑(hilbert_length (i + 1))))
      (normalized_hilbert_curve (i + 1) t) ≤
  (2 ^ i)⁻¹ + (2 ^ (i + 1))⁻¹ + (2 ^ (i + 1))⁻¹
  linarithAll goals completed! 🐙

From this, we get a Cauchy sequence normal_is_cauchy.

To prove "approximate" surjectivity, we can use the floor function except for the top and right edge, which we have to do manually. Because we already lost computability, we can use classical logic and simplify our life a bit. We'll go even further and turn this existential into a left-inverse too.

exists_normal_hilbert_approx_inv
norm_hilbert_inv

Limit Definition

Our final limit definition is straightforward at this point:

HilbertCurve.limit_hilbert_curve_exists (t : ℝ) :
  ∃ x, Filter.Tendsto (fun x => normalized_hilbert_curve x t) Filter.atTop (nhds x)#check limit_hilbert_curve_exists
/--
The real Hilbert converges at each point.
-/
example (t : ℝ) :
  ∃x, Filter.Tendsto (normalized_hilbert_curve · t) Filter.atTop (nhds x) := byt:ℝ⊢ ∃ x, Filter.Tendsto (fun x => normalized_hilbert_curve x t) Filter.atTop (nhds x)
  apply cauchySeq_tendsto_of_completeHt:ℝ⊢ CauchySeq fun x => normalized_hilbert_curve x t
  exact normal_is_cauchy tAll goals completed! 🐙

/-- Name has a ' to avoid name conflicts. -/
noncomputable def limit_hilbert_curve' (t : ℝ) : ℝ × ℝ :=
  Classical.choose (limit_hilbert_curve_exists t)

Many of the remaining difficulties concern the difficulties of computing limits, which appears to have some fundamental complexity. On the technical side, mathlib's definition of uniform convergence is extremely general. It uses "Uniformity Spaces" (mathlib: Mathlib.Topology.UniformSpaces.Defs). I am luckily familiar enough with topological groups that nothing scared me too much, since otherwise this might have required more effort to get used to.

Each of our proofs, such as surjectivity, go through the same sort of steps at this point: (1) choose a really nice sequence that we can evaluate at the interpolated version, (2) choose an even nicer subsequence that converges, and then (3) use unique and uniform convergence to lift it back up to limit_hilbert_curve.

HilbertCurve.limit_hilbert_surj_on : Set.SurjOn limit_hilbert_curve (Set.Icc 0 1) (Set.Icc 0 1)#check limit_hilbert_surj_on
/-
The limit touches every point in [0,1]×[0,1]
-/
example :
  Set.SurjOn limit_hilbert_curve (Set.Icc 0 1) (Set.Icc 0 1) := by⊢ Set.SurjOn limit_hilbert_curve (Set.Icc 0 1) (Set.Icc 0 1)
  intro x xyx:ℝ × ℝxy:x ∈ Set.Icc 0 1⊢ x ∈ limit_hilbert_curve '' Set.Icc 0 1
  -- Since [0, 1] is compact, we can lift the approximate norm_hilbert_inv to
  -- a convergent subsequence.
  have : IsCompact (Set.Icc (0 : ℝ) 1) := isCompact_Iccx:ℝ × ℝxy:x ∈ Set.Icc 0 1this:IsCompact (Set.Icc 0 1)⊢ x ∈ limit_hilbert_curve '' Set.Icc 0 1
  obtain ⟨t, th, φ, φh, h⟩ := this.tendsto_subseq (norm_hilbert_inv_bounded (xh := xy) (x := x))intro.intro.intro.introx:ℝ × ℝxy:x ∈ Set.Icc 0 1this:IsCompact (Set.Icc 0 1)t:ℝth:t ∈ Set.Icc 0 1φ:ℕ → ℕφh:StrictMono φh:Filter.Tendsto ((fun n => norm_hilbert_inv n x xy) ∘ φ) Filter.atTop (nhds t)⊢ x ∈ limit_hilbert_curve '' Set.Icc 0 1
  use t, thrightx:ℝ × ℝxy:x ∈ Set.Icc 0 1this:IsCompact (Set.Icc 0 1)t:ℝth:t ∈ Set.Icc 0 1φ:ℕ → ℕφh:StrictMono φh:Filter.Tendsto ((fun n => norm_hilbert_inv n x xy) ∘ φ) Filter.atTop (nhds t)⊢ limit_hilbert_curve t = x
  set f := fun n ↦ norm_hilbert_inv n x xyrightx:ℝ × ℝxy:x ∈ Set.Icc 0 1this:IsCompact (Set.Icc 0 1)t:ℝth:t ∈ Set.Icc 0 1φ:ℕ → ℕφh:StrictMono φf:ℕ → ℝ := fun n => norm_hilbert_inv n x xyh:Filter.Tendsto (f ∘ φ) Filter.atTop (nhds t)⊢ limit_hilbert_curve t = x
  -- Now we use the uniform convergence to show that we the hilbert curve converges
  -- on the subsequence of f to limit_hilbert_curve t
  have h' : Filter.Tendsto (fun i ↦ normalized_hilbert_curve (φ i) (f (φ i)))
    Filter.atTop (nhds (limit_hilbert_curve t)) :=
    TendstoUniformly.tendsto_comp
      ((tendstoUniformly_iff_seq_tendstoUniformly.mp limit_hilbert_curve_tendstouniformly) φ
        (StrictMono.tendsto_atTop φh))
      (Continuous.continuousAt limit_hilbert_continuous)
      hrightx:ℝ × ℝxy:x ∈ Set.Icc 0 1this:IsCompact (Set.Icc 0 1)t:ℝth:t ∈ Set.Icc 0 1φ:ℕ → ℕφh:StrictMono φf:ℕ → ℝ := fun n => norm_hilbert_inv n x xyh:Filter.Tendsto (f ∘ φ) Filter.atTop (nhds t)h':Filter.Tendsto (fun i => normalized_hilbert_curve (φ i) (f (φ i))) Filter.atTop (nhds (limit_hilbert_curve t))⊢ limit_hilbert_curve t = x
  apply tendsto_nhds_unique h'rightx:ℝ × ℝxy:x ∈ Set.Icc 0 1this:IsCompact (Set.Icc 0 1)t:ℝth:t ∈ Set.Icc 0 1φ:ℕ → ℕφh:StrictMono φf:ℕ → ℝ := fun n => norm_hilbert_inv n x xyh:Filter.Tendsto (f ∘ φ) Filter.atTop (nhds t)h':Filter.Tendsto (fun i => normalized_hilbert_curve (φ i) (f (φ i))) Filter.atTop (nhds (limit_hilbert_curve t))⊢ Filter.Tendsto (fun i => normalized_hilbert_curve (φ i) (f (φ i))) Filter.atTop (nhds x)
  -- Now all that remains is to show that it also converges to x
  apply (Filter.tendsto_iff_seq_tendsto (k := Filter.atTop) (
    f := fun i ↦ normalized_hilbert_curve i (f i)
  )).mp ?_ φ (StrictMono.tendsto_atTop φh)x:ℝ × ℝxy:x ∈ Set.Icc 0 1this:IsCompact (Set.Icc 0 1)t:ℝth:t ∈ Set.Icc 0 1φ:ℕ → ℕφh:StrictMono φf:ℕ → ℝ := fun n => norm_hilbert_inv n x xyh:Filter.Tendsto (f ∘ φ) Filter.atTop (nhds t)h':Filter.Tendsto (fun i => normalized_hilbert_curve (φ i) (f (φ i))) Filter.atTop (nhds (limit_hilbert_curve t))⊢ Filter.Tendsto (fun i => normalized_hilbert_curve i (f i)) Filter.atTop (nhds x)
  -- We can use the bound from the approximate inverse to guarantee convergence.
  rw [tendsto_iff_dist_tendsto_zero]x:ℝ × ℝxy:x ∈ Set.Icc 0 1this:IsCompact (Set.Icc 0 1)t:ℝth:t ∈ Set.Icc 0 1φ:ℕ → ℕφh:StrictMono φf:ℕ → ℝ := fun n => norm_hilbert_inv n x xyh:Filter.Tendsto (f ∘ φ) Filter.atTop (nhds t)h':Filter.Tendsto (fun i => normalized_hilbert_curve (φ i) (f (φ i))) Filter.atTop (nhds (limit_hilbert_curve t))⊢ Filter.Tendsto (fun b => dist (normalized_hilbert_curve b (f b)) x) Filter.atTop (nhds 0)
  have : Filter.Tendsto (fun n => ((2 : ℝ) ^ n)⁻¹) Filter.atTop (nhds 0) := by⊢ Set.SurjOn limit_hilbert_curve (Set.Icc 0 1) (Set.Icc 0 1)
    rw [show (fun n ↦ ((2 : ℝ)^n)⁻¹) = fun n ↦ ((2 : ℝ)⁻¹)^n by
      simp]x:ℝ × ℝxy:x ∈ Set.Icc 0 1this:IsCompact (Set.Icc 0 1)t:ℝth:t ∈ Set.Icc 0 1φ:ℕ → ℕφh:StrictMono φf:ℕ → ℝ := fun n => norm_hilbert_inv n x xyh:Filter.Tendsto (f ∘ φ) Filter.atTop (nhds t)h':Filter.Tendsto (fun i => normalized_hilbert_curve (φ i) (f (φ i))) Filter.atTop (nhds (limit_hilbert_curve t))⊢ Filter.Tendsto (fun n => 2⁻¹ ^ n) Filter.atTop (nhds 0)
    apply tendsto_pow_atTop_nhds_zero_of_abs_lt_onehx:ℝ × ℝxy:x ∈ Set.Icc 0 1this:IsCompact (Set.Icc 0 1)t:ℝth:t ∈ Set.Icc 0 1φ:ℕ → ℕφh:StrictMono φf:ℕ → ℝ := fun n => norm_hilbert_inv n x xyh:Filter.Tendsto (f ∘ φ) Filter.atTop (nhds t)h':Filter.Tendsto (fun i => normalized_hilbert_curve (φ i) (f (φ i))) Filter.atTop (nhds (limit_hilbert_curve t))⊢ |2⁻¹| < 1
    rw [abs]hx:ℝ × ℝxy:x ∈ Set.Icc 0 1this:IsCompact (Set.Icc 0 1)t:ℝth:t ∈ Set.Icc 0 1φ:ℕ → ℕφh:StrictMono φf:ℕ → ℝ := fun n => norm_hilbert_inv n x xyh:Filter.Tendsto (f ∘ φ) Filter.atTop (nhds t)h':Filter.Tendsto (fun i => normalized_hilbert_curve (φ i) (f (φ i))) Filter.atTop (nhds (limit_hilbert_curve t))⊢ max 2⁻¹ (-2⁻¹) < 1
    norm_numAll goals completed! 🐙
  apply squeeze_zero (fun n ↦ dist_nonneg) (g0 := this)x:ℝ × ℝxy:x ∈ Set.Icc 0 1this✝:IsCompact (Set.Icc 0 1)t:ℝth:t ∈ Set.Icc 0 1φ:ℕ → ℕφh:StrictMono φf:ℕ → ℝ := fun n => norm_hilbert_inv n x xyh:Filter.Tendsto (f ∘ φ) Filter.atTop (nhds t)h':Filter.Tendsto (fun i => normalized_hilbert_curve (φ i) (f (φ i))) Filter.atTop (nhds (limit_hilbert_curve t))this:Filter.Tendsto (fun n => (2 ^ n)⁻¹) Filter.atTop (nhds 0)⊢ ∀ (t : ℕ), dist (normalized_hilbert_curve t (f t)) x ≤ (2 ^ t)⁻¹
  intro nx:ℝ × ℝxy:x ∈ Set.Icc 0 1this✝:IsCompact (Set.Icc 0 1)t:ℝth:t ∈ Set.Icc 0 1φ:ℕ → ℕφh:StrictMono φf:ℕ → ℝ := fun n => norm_hilbert_inv n x xyh:Filter.Tendsto (f ∘ φ) Filter.atTop (nhds t)h':Filter.Tendsto (fun i => normalized_hilbert_curve (φ i) (f (φ i))) Filter.atTop (nhds (limit_hilbert_curve t))this:Filter.Tendsto (fun n => (2 ^ n)⁻¹) Filter.atTop (nhds 0)n:ℕ⊢ dist (normalized_hilbert_curve n (f n)) x ≤ (2 ^ n)⁻¹
  rw [dist_comm]x:ℝ × ℝxy:x ∈ Set.Icc 0 1this✝:IsCompact (Set.Icc 0 1)t:ℝth:t ∈ Set.Icc 0 1φ:ℕ → ℕφh:StrictMono φf:ℕ → ℝ := fun n => norm_hilbert_inv n x xyh:Filter.Tendsto (f ∘ φ) Filter.atTop (nhds t)h':Filter.Tendsto (fun i => normalized_hilbert_curve (φ i) (f (φ i))) Filter.atTop (nhds (limit_hilbert_curve t))this:Filter.Tendsto (fun n => (2 ^ n)⁻¹) Filter.atTop (nhds 0)n:ℕ⊢ dist x (normalized_hilbert_curve n (f n)) ≤ (2 ^ n)⁻¹
  exact norm_hilbert_inv_dist n x xyAll goals completed! 🐙

For the symmetries, we use uniform continuity of transformations to preserve uniform convergence. To get uniform continuity of each transformation, there's some new definitions, plus some little lemmas I defined to get AffineMap.toContinuousAffineMap for finite-dimensional spaces and ContinuousAffineMap.uniformContinuous.

noncomputable def T3_real (i : ℕ) : ℝ × ℝ →ᴬ[ℝ] ℝ × ℝ :=
  let id := (LinearMap.id (M := ℝ × ℝ) (R := ℝ))
  let post := (1 / (2^(i+1)) : ℝ) • id
  let pre := (2^i : ℝ) • id
  AffineMap.toContinuousAffineMap <|
    (post.toAffineMap.comp (T3 i)).comp
    pre.toAffineMap

noncomputable def T3_real_lim : ℝ × ℝ →ᴬ[ℝ] ℝ × ℝ :=
  AffineMap.toContinuousAffineMap {
    toFun := fun x ↦ (1, 1/(2 : ℝ)) - (1/2 : ℝ) • x.swap
    linear := -(1/2 : ℝ) • {
      toFun := Prod.swap
      map_add' := byR:Type u_1inst✝:Ring R⊢ ∀ (x y : ℝ × ℝ), (x + y).swap = x.swap + y.swap simpAll goals completed! 🐙
      map_smul' := byR:Type u_1inst✝:Ring R⊢ ∀ (m : ℝ) (x : ℝ × ℝ), (m • x).swap = (RingHom.id ℝ) m • x.swap simpAll goals completed! 🐙
    }
    map_vadd' p v := byR:Type u_1inst✝:Ring Rp:ℝ × ℝv:ℝ × ℝ⊢ (1, 1 / 2) - (1 / 2) • (v +ᵥ p).swap =
  (-(1 / 2) • { toFun := Prod.swap, map_add' := ?m.117106, map_smul' := ?m.117116 }) v +ᵥ (1, 1 / 2) - (1 / 2) • p.swap
      simpR:Type u_1inst✝:Ring Rp:ℝ × ℝv:ℝ × ℝ⊢ (1, 2⁻¹) - (2⁻¹ • v.swap + 2⁻¹ • p.swap) = -(2⁻¹ • v.swap) + ((1, 2⁻¹) - 2⁻¹ • p.swap)
      ring_nfAll goals completed! 🐙
  }

After I formalized this, I suspect there is a better method that uses convergence on \top \times \mathcal{N}(x) instead of uniform convergence, since uniform convergence isn't very compositional, whereas continuity on a product filter is more compositional. I have not pursued this properly.

The symmetry properties end up involving some annoying calculation to pick the appropriate t_i so we stay within a quadrant.

lemma declaration uses 'sorry'sequence_exists (t : ℝ) (n : ℕ) (h : n/4 ≤ t) (h' : t ≤ (n+1)/4)
 : ∃f : ℕ → ℕ, Filter.Tendsto (fun i ↦ (f i : ℝ) / hilbert_length i) Filter.atTop (nhds t) ∧
  ∀i≥1, n * hilbert_length i ≤ 4*(f i) ∧ 4*(f i) < (n+1) * hilbert_length i := byt:ℝn:ℕh:↑n / 4 ≤ th':t ≤ (↑n + 1) / 4⊢ ∃ f,
  Filter.Tendsto (fun i => ↑(f i) / ↑(hilbert_length i)) Filter.atTop (nhds t) ∧
    ∀ i ≥ 1, n * hilbert_length i ≤ 4 * f i ∧ 4 * f i < (n + 1) * hilbert_length i
  sorryAll goals completed! 🐙 -- it's very long :'(

Once we have a bunch of these lemmas for the right sequence and the extra uniform convergence and uniform continuity theorems, we can proceed with stitching it altogether:

HilbertCurve.limit_hilbert_recurse_bottom_right (t : ℝ) (h : t ∈ Set.Icc (3 / 4) 1) :
  limit_hilbert_curve t = T3_real_lim (limit_hilbert_curve (4 * t - 3))#check limit_hilbert_recurse_bottom_right
/-
The hilbert curve is a fractal just like its construction, i.e.
it can be broken up into 4 copies of itself.
-/
example (t : ℝ) (h : t ∈ Set.Icc (3/4) 1) :
  limit_hilbert_curve t = T3_real_lim (limit_hilbert_curve (4*t - 3)) := byt:ℝh:t ∈ Set.Icc (3 / 4) 1⊢ limit_hilbert_curve t = T3_real_lim (limit_hilbert_curve (4 * t - 3))
  rcases (sequence_exists t 3 (byt:ℝh:t ∈ Set.Icc (3 / 4) 1⊢ ↑3 / 4 ≤ t linarith [h.1]All goals completed! 🐙) (byt:ℝh:t ∈ Set.Icc (3 / 4) 1⊢ t ≤ (↑3 + 1) / 4 linarith [h.2]All goals completed! 🐙))
    with ⟨fnat, f_tendsto, hf2⟩
  set f := fun i => fnat i / (hilbert_length i : ℝ) with f_defintro.introt:ℝh:t ∈ Set.Icc (3 / 4) 1fnat:ℕ → ℕhf2:∀ i ≥ 1, 3 * hilbert_length i ≤ 4 * fnat i ∧ 4 * fnat i < (3 + 1) * hilbert_length if:ℕ → ℝ := fun i => ↑(fnat i) / ↑(hilbert_length i)f_tendsto:Filter.Tendsto f Filter.atTop (nhds t)f_def:f = fun i => ↑(fnat i) / ↑(hilbert_length i)⊢ limit_hilbert_curve t = T3_real_lim (limit_hilbert_curve (4 * t - 3))
  have lhs_tendsto : Filter.Tendsto
    (fun i ↦ normalized_hilbert_curve (i + 1) (f i))
    Filter.atTop
    (nhds (limit_hilbert_curve t)) := byt:ℝh:t ∈ Set.Icc (3 / 4) 1⊢ limit_hilbert_curve t = T3_real_lim (limit_hilbert_curve (4 * t - 3))
    apply TendstoUniformly.tendsto_comp (hg := f_tendsto)ht:ℝh:t ∈ Set.Icc (3 / 4) 1fnat:ℕ → ℕhf2:∀ i ≥ 1, 3 * hilbert_length i ≤ 4 * fnat i ∧ 4 * fnat i < (3 + 1) * hilbert_length if:ℕ → ℝ := fun i => ↑(fnat i) / ↑(hilbert_length i)f_tendsto:Filter.Tendsto f Filter.atTop (nhds t)f_def:f = fun i => ↑(fnat i) / ↑(hilbert_length i)⊢ TendstoUniformly (fun n => normalized_hilbert_curve (n + 1)) limit_hilbert_curve Filter.atTophft:ℝh:t ∈ Set.Icc (3 / 4) 1fnat:ℕ → ℕhf2:∀ i ≥ 1, 3 * hilbert_length i ≤ 4 * fnat i ∧ 4 * fnat i < (3 + 1) * hilbert_length if:ℕ → ℝ := fun i => ↑(fnat i) / ↑(hilbert_length i)f_tendsto:Filter.Tendsto f Filter.atTop (nhds t)f_def:f = fun i => ↑(fnat i) / ↑(hilbert_length i)⊢ ContinuousAt limit_hilbert_curve t
    ·ht:ℝh:t ∈ Set.Icc (3 / 4) 1fnat:ℕ → ℕhf2:∀ i ≥ 1, 3 * hilbert_length i ≤ 4 * fnat i ∧ 4 * fnat i < (3 + 1) * hilbert_length if:ℕ → ℝ := fun i => ↑(fnat i) / ↑(hilbert_length i)f_tendsto:Filter.Tendsto f Filter.atTop (nhds t)f_def:f = fun i => ↑(fnat i) / ↑(hilbert_length i)⊢ TendstoUniformly (fun n => normalized_hilbert_curve (n + 1)) limit_hilbert_curve Filter.atTop apply tendstoUniformly_iff_seq_tendstoUniformly.mp
        limit_hilbert_curve_tendstouniformlyh.at:ℝh:t ∈ Set.Icc (3 / 4) 1fnat:ℕ → ℕhf2:∀ i ≥ 1, 3 * hilbert_length i ≤ 4 * fnat i ∧ 4 * fnat i < (3 + 1) * hilbert_length if:ℕ → ℝ := fun i => ↑(fnat i) / ↑(hilbert_length i)f_tendsto:Filter.Tendsto f Filter.atTop (nhds t)f_def:f = fun i => ↑(fnat i) / ↑(hilbert_length i)⊢ Filter.Tendsto (fun n => n + 1) Filter.atTop Filter.atTop
      exact Filter.tendsto_add_atTop_nat 1All goals completed! 🐙
    exact limit_hilbert_continuous.continuousAtAll goals completed! 🐙
  have rhs_tendsto : Filter.Tendsto
    (fun i ↦ T3_real i (normalized_hilbert_curve i (4 * f i - 3)))
    Filter.atTop
    (nhds (T3_real_lim (limit_hilbert_curve (4*t - 3)))) := byt:ℝh:t ∈ Set.Icc (3 / 4) 1⊢ limit_hilbert_curve t = T3_real_lim (limit_hilbert_curve (4 * t - 3))
    have : Filter.Tendsto (fun i ↦ (normalized_hilbert_curve i (4 * f i - 3)))
      Filter.atTop
      (nhds (limit_hilbert_curve (4*t - 3))) := byt:ℝh:t ∈ Set.Icc (3 / 4) 1⊢ limit_hilbert_curve t = T3_real_lim (limit_hilbert_curve (4 * t - 3))
      apply TendstoUniformly.tendsto_compht:ℝh:t ∈ Set.Icc (3 / 4) 1fnat:ℕ → ℕhf2:∀ i ≥ 1, 3 * hilbert_length i ≤ 4 * fnat i ∧ 4 * fnat i < (3 + 1) * hilbert_length if:ℕ → ℝ := fun i => ↑(fnat i) / ↑(hilbert_length i)f_tendsto:Filter.Tendsto f Filter.atTop (nhds t)f_def:f = fun i => ↑(fnat i) / ↑(hilbert_length i)lhs_tendsto:Filter.Tendsto (fun i => normalized_hilbert_curve (i + 1) (f i)) Filter.atTop (nhds (limit_hilbert_curve t))⊢ TendstoUniformly normalized_hilbert_curve limit_hilbert_curve Filter.atTophft:ℝh:t ∈ Set.Icc (3 / 4) 1fnat:ℕ → ℕhf2:∀ i ≥ 1, 3 * hilbert_length i ≤ 4 * fnat i ∧ 4 * fnat i < (3 + 1) * hilbert_length if:ℕ → ℝ := fun i => ↑(fnat i) / ↑(hilbert_length i)f_tendsto:Filter.Tendsto f Filter.atTop (nhds t)f_def:f = fun i => ↑(fnat i) / ↑(hilbert_length i)lhs_tendsto:Filter.Tendsto (fun i => normalized_hilbert_curve (i + 1) (f i)) Filter.atTop (nhds (limit_hilbert_curve t))⊢ ContinuousAt limit_hilbert_curve (4 * t - 3)hgt:ℝh:t ∈ Set.Icc (3 / 4) 1fnat:ℕ → ℕhf2:∀ i ≥ 1, 3 * hilbert_length i ≤ 4 * fnat i ∧ 4 * fnat i < (3 + 1) * hilbert_length if:ℕ → ℝ := fun i => ↑(fnat i) / ↑(hilbert_length i)f_tendsto:Filter.Tendsto f Filter.atTop (nhds t)f_def:f = fun i => ↑(fnat i) / ↑(hilbert_length i)lhs_tendsto:Filter.Tendsto (fun i => normalized_hilbert_curve (i + 1) (f i)) Filter.atTop (nhds (limit_hilbert_curve t))⊢ Filter.Tendsto (fun n => 4 * f n - 3) Filter.atTop (nhds (4 * t - 3))
      ·ht:ℝh:t ∈ Set.Icc (3 / 4) 1fnat:ℕ → ℕhf2:∀ i ≥ 1, 3 * hilbert_length i ≤ 4 * fnat i ∧ 4 * fnat i < (3 + 1) * hilbert_length if:ℕ → ℝ := fun i => ↑(fnat i) / ↑(hilbert_length i)f_tendsto:Filter.Tendsto f Filter.atTop (nhds t)f_def:f = fun i => ↑(fnat i) / ↑(hilbert_length i)lhs_tendsto:Filter.Tendsto (fun i => normalized_hilbert_curve (i + 1) (f i)) Filter.atTop (nhds (limit_hilbert_curve t))⊢ TendstoUniformly normalized_hilbert_curve limit_hilbert_curve Filter.atTop exact limit_hilbert_curve_tendstouniformlyAll goals completed! 🐙
      ·hft:ℝh:t ∈ Set.Icc (3 / 4) 1fnat:ℕ → ℕhf2:∀ i ≥ 1, 3 * hilbert_length i ≤ 4 * fnat i ∧ 4 * fnat i < (3 + 1) * hilbert_length if:ℕ → ℝ := fun i => ↑(fnat i) / ↑(hilbert_length i)f_tendsto:Filter.Tendsto f Filter.atTop (nhds t)f_def:f = fun i => ↑(fnat i) / ↑(hilbert_length i)lhs_tendsto:Filter.Tendsto (fun i => normalized_hilbert_curve (i + 1) (f i)) Filter.atTop (nhds (limit_hilbert_curve t))⊢ ContinuousAt limit_hilbert_curve (4 * t - 3) exact Continuous.continuousAt limit_hilbert_continuousAll goals completed! 🐙
      apply Filter.Tendsto.sub_consthg.ht:ℝh:t ∈ Set.Icc (3 / 4) 1fnat:ℕ → ℕhf2:∀ i ≥ 1, 3 * hilbert_length i ≤ 4 * fnat i ∧ 4 * fnat i < (3 + 1) * hilbert_length if:ℕ → ℝ := fun i => ↑(fnat i) / ↑(hilbert_length i)f_tendsto:Filter.Tendsto f Filter.atTop (nhds t)f_def:f = fun i => ↑(fnat i) / ↑(hilbert_length i)lhs_tendsto:Filter.Tendsto (fun i => normalized_hilbert_curve (i + 1) (f i)) Filter.atTop (nhds (limit_hilbert_curve t))⊢ Filter.Tendsto (fun x => 4 * f x) Filter.atTop (nhds (4 * t))
      apply Filter.Tendsto.const_mulhg.h.ht:ℝh:t ∈ Set.Icc (3 / 4) 1fnat:ℕ → ℕhf2:∀ i ≥ 1, 3 * hilbert_length i ≤ 4 * fnat i ∧ 4 * fnat i < (3 + 1) * hilbert_length if:ℕ → ℝ := fun i => ↑(fnat i) / ↑(hilbert_length i)f_tendsto:Filter.Tendsto f Filter.atTop (nhds t)f_def:f = fun i => ↑(fnat i) / ↑(hilbert_length i)lhs_tendsto:Filter.Tendsto (fun i => normalized_hilbert_curve (i + 1) (f i)) Filter.atTop (nhds (limit_hilbert_curve t))⊢ Filter.Tendsto (fun k => f k) Filter.atTop (nhds t)
      exact f_tendstoAll goals completed! 🐙
    apply TendstoUniformly.tendsto_comp
      (hf := T3_real_lim.continuous.continuousAt)
      (hg := this)
      (g := (fun i ↦ (normalized_hilbert_curve i (4 * f i - 3))))
      (h := T3_real_tendsto_uniformly)All goals completed! 🐙
  have lhs_eq_rhs :
    (fun i ↦ normalized_hilbert_curve (i + 1) (f i)) =ᶠ[Filter.atTop]
    (fun i ↦ T3_real i (normalized_hilbert_curve i (4 * f i - 3))) := byt:ℝh:t ∈ Set.Icc (3 / 4) 1⊢ limit_hilbert_curve t = T3_real_lim (limit_hilbert_curve (4 * t - 3))
    apply Filter.eventually_atTop.mprt:ℝh:t ∈ Set.Icc (3 / 4) 1fnat:ℕ → ℕhf2:∀ i ≥ 1, 3 * hilbert_length i ≤ 4 * fnat i ∧ 4 * fnat i < (3 + 1) * hilbert_length if:ℕ → ℝ := fun i => ↑(fnat i) / ↑(hilbert_length i)f_tendsto:Filter.Tendsto f Filter.atTop (nhds t)f_def:f = fun i => ↑(fnat i) / ↑(hilbert_length i)lhs_tendsto:Filter.Tendsto (fun i => normalized_hilbert_curve (i + 1) (f i)) Filter.atTop (nhds (limit_hilbert_curve t))rhs_tendsto:Filter.Tendsto (fun i => (T3_real i) (normalized_hilbert_curve i (4 * f i - 3))) Filter.atTop
  (nhds (T3_real_lim (limit_hilbert_curve (4 * t - 3))))⊢ ∃ a,
  ∀ b ≥ a,
    (fun i => normalized_hilbert_curve (i + 1) (f i)) b =
      (fun i => (T3_real i) (normalized_hilbert_curve i (4 * f i - 3))) b
    use 1ht:ℝh:t ∈ Set.Icc (3 / 4) 1fnat:ℕ → ℕhf2:∀ i ≥ 1, 3 * hilbert_length i ≤ 4 * fnat i ∧ 4 * fnat i < (3 + 1) * hilbert_length if:ℕ → ℝ := fun i => ↑(fnat i) / ↑(hilbert_length i)f_tendsto:Filter.Tendsto f Filter.atTop (nhds t)f_def:f = fun i => ↑(fnat i) / ↑(hilbert_length i)lhs_tendsto:Filter.Tendsto (fun i => normalized_hilbert_curve (i + 1) (f i)) Filter.atTop (nhds (limit_hilbert_curve t))rhs_tendsto:Filter.Tendsto (fun i => (T3_real i) (normalized_hilbert_curve i (4 * f i - 3))) Filter.atTop
  (nhds (T3_real_lim (limit_hilbert_curve (4 * t - 3))))⊢ ∀ b ≥ 1,
  (fun i => normalized_hilbert_curve (i + 1) (f i)) b =
    (fun i => (T3_real i) (normalized_hilbert_curve i (4 * f i - 3))) b
    intro i ihht:ℝh:t ∈ Set.Icc (3 / 4) 1fnat:ℕ → ℕhf2:∀ i ≥ 1, 3 * hilbert_length i ≤ 4 * fnat i ∧ 4 * fnat i < (3 + 1) * hilbert_length if:ℕ → ℝ := fun i => ↑(fnat i) / ↑(hilbert_length i)f_tendsto:Filter.Tendsto f Filter.atTop (nhds t)f_def:f = fun i => ↑(fnat i) / ↑(hilbert_length i)lhs_tendsto:Filter.Tendsto (fun i => normalized_hilbert_curve (i + 1) (f i)) Filter.atTop (nhds (limit_hilbert_curve t))rhs_tendsto:Filter.Tendsto (fun i => (T3_real i) (normalized_hilbert_curve i (4 * f i - 3))) Filter.atTop
  (nhds (T3_real_lim (limit_hilbert_curve (4 * t - 3))))i:ℕih:i ≥ 1⊢ (fun i => normalized_hilbert_curve (i + 1) (f i)) i =
  (fun i => (T3_real i) (normalized_hilbert_curve i (4 * f i - 3))) i
    rw [f_def]ht:ℝh:t ∈ Set.Icc (3 / 4) 1fnat:ℕ → ℕhf2:∀ i ≥ 1, 3 * hilbert_length i ≤ 4 * fnat i ∧ 4 * fnat i < (3 + 1) * hilbert_length if:ℕ → ℝ := fun i => ↑(fnat i) / ↑(hilbert_length i)f_tendsto:Filter.Tendsto f Filter.atTop (nhds t)f_def:f = fun i => ↑(fnat i) / ↑(hilbert_length i)lhs_tendsto:Filter.Tendsto (fun i => normalized_hilbert_curve (i + 1) (f i)) Filter.atTop (nhds (limit_hilbert_curve t))rhs_tendsto:Filter.Tendsto (fun i => (T3_real i) (normalized_hilbert_curve i (4 * f i - 3))) Filter.atTop
  (nhds (T3_real_lim (limit_hilbert_curve (4 * t - 3))))i:ℕih:i ≥ 1⊢ (fun i => normalized_hilbert_curve (i + 1) ((fun i => ↑(fnat i) / ↑(hilbert_length i)) i)) i =
  (fun i => (T3_real i) (normalized_hilbert_curve i (4 * (fun i => ↑(fnat i) / ↑(hilbert_length i)) i - 3))) i
    dsimpht:ℝh:t ∈ Set.Icc (3 / 4) 1fnat:ℕ → ℕhf2:∀ i ≥ 1, 3 * hilbert_length i ≤ 4 * fnat i ∧ 4 * fnat i < (3 + 1) * hilbert_length if:ℕ → ℝ := fun i => ↑(fnat i) / ↑(hilbert_length i)f_tendsto:Filter.Tendsto f Filter.atTop (nhds t)f_def:f = fun i => ↑(fnat i) / ↑(hilbert_length i)lhs_tendsto:Filter.Tendsto (fun i => normalized_hilbert_curve (i + 1) (f i)) Filter.atTop (nhds (limit_hilbert_curve t))rhs_tendsto:Filter.Tendsto (fun i => (T3_real i) (normalized_hilbert_curve i (4 * f i - 3))) Filter.atTop
  (nhds (T3_real_lim (limit_hilbert_curve (4 * t - 3))))i:ℕih:i ≥ 1⊢ normalized_hilbert_curve (i + 1) (↑(fnat i) / ↑(hilbert_length i)) =
  (T3_real i) (normalized_hilbert_curve i (4 * (↑(fnat i) / ↑(hilbert_length i)) - 3))
    have : get_quadrant i (4*(fnat i)) = Quadrant.BOTTOM_RIGHT := byt:ℝh:t ∈ Set.Icc (3 / 4) 1⊢ limit_hilbert_curve t = T3_real_lim (limit_hilbert_curve (4 * t - 3))
      rw [bottom_right_eq]t:ℝh:t ∈ Set.Icc (3 / 4) 1fnat:ℕ → ℕhf2:∀ i ≥ 1, 3 * hilbert_length i ≤ 4 * fnat i ∧ 4 * fnat i < (3 + 1) * hilbert_length if:ℕ → ℝ := fun i => ↑(fnat i) / ↑(hilbert_length i)f_tendsto:Filter.Tendsto f Filter.atTop (nhds t)f_def:f = fun i => ↑(fnat i) / ↑(hilbert_length i)lhs_tendsto:Filter.Tendsto (fun i => normalized_hilbert_curve (i + 1) (f i)) Filter.atTop (nhds (limit_hilbert_curve t))rhs_tendsto:Filter.Tendsto (fun i => (T3_real i) (normalized_hilbert_curve i (4 * f i - 3))) Filter.atTop
  (nhds (T3_real_lim (limit_hilbert_curve (4 * t - 3))))i:ℕih:i ≥ 1⊢ 3 * hilbert_length i ≤ 4 * fnat i
      exact (hf2 i ih).1All goals completed! 🐙
    rw [<-mul_div_assoc]ht:ℝh:t ∈ Set.Icc (3 / 4) 1fnat:ℕ → ℕhf2:∀ i ≥ 1, 3 * hilbert_length i ≤ 4 * fnat i ∧ 4 * fnat i < (3 + 1) * hilbert_length if:ℕ → ℝ := fun i => ↑(fnat i) / ↑(hilbert_length i)f_tendsto:Filter.Tendsto f Filter.atTop (nhds t)f_def:f = fun i => ↑(fnat i) / ↑(hilbert_length i)lhs_tendsto:Filter.Tendsto (fun i => normalized_hilbert_curve (i + 1) (f i)) Filter.atTop (nhds (limit_hilbert_curve t))rhs_tendsto:Filter.Tendsto (fun i => (T3_real i) (normalized_hilbert_curve i (4 * f i - 3))) Filter.atTop
  (nhds (T3_real_lim (limit_hilbert_curve (4 * t - 3))))i:ℕih:i ≥ 1this:get_quadrant i (4 * fnat i) = Quadrant.BOTTOM_RIGHT⊢ normalized_hilbert_curve (i + 1) (↑(fnat i) / ↑(hilbert_length i)) =
  (T3_real i) (normalized_hilbert_curve i (4 * ↑(fnat i) / ↑(hilbert_length i) - 3))
    rw [normalized_recurse_bottom_right this]ht:ℝh:t ∈ Set.Icc (3 / 4) 1fnat:ℕ → ℕhf2:∀ i ≥ 1, 3 * hilbert_length i ≤ 4 * fnat i ∧ 4 * fnat i < (3 + 1) * hilbert_length if:ℕ → ℝ := fun i => ↑(fnat i) / ↑(hilbert_length i)f_tendsto:Filter.Tendsto f Filter.atTop (nhds t)f_def:f = fun i => ↑(fnat i) / ↑(hilbert_length i)lhs_tendsto:Filter.Tendsto (fun i => normalized_hilbert_curve (i + 1) (f i)) Filter.atTop (nhds (limit_hilbert_curve t))rhs_tendsto:Filter.Tendsto (fun i => (T3_real i) (normalized_hilbert_curve i (4 * f i - 3))) Filter.atTop
  (nhds (T3_real_lim (limit_hilbert_curve (4 * t - 3))))i:ℕih:i ≥ 1this:get_quadrant i (4 * fnat i) = Quadrant.BOTTOM_RIGHT⊢ (T3_real i) (normalized_hilbert_curve i ((4 * ↑(fnat i) - 3 * ↑(hilbert_length i)) / ↑(hilbert_length i))) =
  (T3_real i) (normalized_hilbert_curve i (4 * ↑(fnat i) / ↑(hilbert_length i) - 3))
    have : ((4 : ℝ) * fnat i - (3 : ℝ) * (hilbert_length i)) / ↑(hilbert_length i) =
      (4 : ℝ) * fnat i / (hilbert_length i) - (3 : ℝ) := byt:ℝh:t ∈ Set.Icc (3 / 4) 1⊢ limit_hilbert_curve t = T3_real_lim (limit_hilbert_curve (4 * t - 3))
      have := hilbert_length_pos it:ℝh:t ∈ Set.Icc (3 / 4) 1fnat:ℕ → ℕhf2:∀ i ≥ 1, 3 * hilbert_length i ≤ 4 * fnat i ∧ 4 * fnat i < (3 + 1) * hilbert_length if:ℕ → ℝ := fun i => ↑(fnat i) / ↑(hilbert_length i)f_tendsto:Filter.Tendsto f Filter.atTop (nhds t)f_def:f = fun i => ↑(fnat i) / ↑(hilbert_length i)lhs_tendsto:Filter.Tendsto (fun i => normalized_hilbert_curve (i + 1) (f i)) Filter.atTop (nhds (limit_hilbert_curve t))rhs_tendsto:Filter.Tendsto (fun i => (T3_real i) (normalized_hilbert_curve i (4 * f i - 3))) Filter.atTop
  (nhds (T3_real_lim (limit_hilbert_curve (4 * t - 3))))i:ℕih:i ≥ 1this✝:get_quadrant i (4 * fnat i) = Quadrant.BOTTOM_RIGHTthis:0 < hilbert_length i⊢ (4 * ↑(fnat i) - 3 * ↑(hilbert_length i)) / ↑(hilbert_length i) = 4 * ↑(fnat i) / ↑(hilbert_length i) - 3
      field_simpt:ℝh:t ∈ Set.Icc (3 / 4) 1fnat:ℕ → ℕhf2:∀ i ≥ 1, 3 * hilbert_length i ≤ 4 * fnat i ∧ 4 * fnat i < (3 + 1) * hilbert_length if:ℕ → ℝ := fun i => ↑(fnat i) / ↑(hilbert_length i)f_tendsto:Filter.Tendsto f Filter.atTop (nhds t)f_def:f = fun i => ↑(fnat i) / ↑(hilbert_length i)lhs_tendsto:Filter.Tendsto (fun i => normalized_hilbert_curve (i + 1) (f i)) Filter.atTop (nhds (limit_hilbert_curve t))rhs_tendsto:Filter.Tendsto (fun i => (T3_real i) (normalized_hilbert_curve i (4 * f i - 3))) Filter.atTop
  (nhds (T3_real_lim (limit_hilbert_curve (4 * t - 3))))i:ℕih:i ≥ 1this✝:get_quadrant i (4 * fnat i) = Quadrant.BOTTOM_RIGHTthis:0 < hilbert_length i⊢ 3 * ↑(hilbert_length i) = ↑(hilbert_length i) * 3; ringAll goals completed! 🐙
    rw [this]All goals completed! 🐙
  rw [Filter.tendsto_congr' lhs_eq_rhs] at lhs_tendstointro.introt:ℝh:t ∈ Set.Icc (3 / 4) 1fnat:ℕ → ℕhf2:∀ i ≥ 1, 3 * hilbert_length i ≤ 4 * fnat i ∧ 4 * fnat i < (3 + 1) * hilbert_length if:ℕ → ℝ := fun i => ↑(fnat i) / ↑(hilbert_length i)f_tendsto:Filter.Tendsto f Filter.atTop (nhds t)f_def:f = fun i => ↑(fnat i) / ↑(hilbert_length i)lhs_tendsto:Filter.Tendsto (fun i => (T3_real i) (normalized_hilbert_curve i (4 * f i - 3))) Filter.atTop
  (nhds (limit_hilbert_curve t))rhs_tendsto:Filter.Tendsto (fun i => (T3_real i) (normalized_hilbert_curve i (4 * f i - 3))) Filter.atTop
  (nhds (T3_real_lim (limit_hilbert_curve (4 * t - 3))))lhs_eq_rhs:(fun i => normalized_hilbert_curve (i + 1) (f i)) =ᶠ[Filter.atTop] fun i =>
  (T3_real i) (normalized_hilbert_curve i (4 * f i - 3))⊢ limit_hilbert_curve t = T3_real_lim (limit_hilbert_curve (4 * t - 3))
  apply tendsto_nhds_unique lhs_tendsto rhs_tendstoAll goals completed! 🐙

I only did the bottom left and bottom right case, because that's sufficient to prove it isn't injective. That proof in particular is a bit boring.

Additional Directions

Like every formalization project, it ends up being a lot more than you expect. Not only was it more involved, technical, time-consuming, and plain difficult, but it was also more rewarding. I have run out formalization steam, so these will remain informal until AI takes over or whatever. By the end, I had a lot better grasp on some more non-trivial facts:

I would consider any one of these to be a pretty decent puzzle.

Symmetry

After thinking about the symmetry relations of the Hilbert curve, I realized:

Any function satisfying the same symmetry law is the Hilbert curve.

Suppose you have some t \in [0, 1]. This t is in one of 4 quadrants, [0, \frac{1}{4}], [\frac{1}{4}, \frac{1}{2}], etc. We know that transformation symmetry applies on each quadrant, and it matches at each boundary. Our symmetry also tells us that f(t) lies in that smaller square as long as it lies in [0, 1] \times [0, 1]. Each iteration, additional information from t reduces this square to a square with \frac{1}{2} the size. At this point, we have a sequence of nested squares. We can pick a point from each square and use the completeness of \mathbb{R} \times \mathbb{R}, or we can intersect the sequence of compact sets using Cantor's intersection theorem to get a point in the limit.

Any uniform collection of contractions will eventually converge to a point like this, so our assumption that f(t) \in [0, 1] \times [0, 1] or that these are squares is unnecessary.

Hölder continuity

Early on, I wanted to hope that the final curve was Lipschitz or something, but a simple estimate suggests that any bound will get broken as you \tilde{H}_i(t) speeds up by a factor of 2 each iteration at t = 0. However, I know from the Cauchy bound that it doesn't get too far away. As each iteration divides a segment into segments 1/4 the size that move 1/2 as far, this suggests that we are looking for a square-root.

This immediately suggests (to me) that we use Hölder continuity

\lVert f(t) - f(s) \rVert \le C \lVert t - s \rVert^\alpha

where \alpha = \frac{1}{2}.

We can do some plots (in Lean of course) to validate the exact the constant.

I tested different values until C = 2 looked appropriate when I increased the iteration. I suspect this proof is just another tedious application of each transformation, so I leave it up to anyone else to prove this.

It turns out any Hölder continuous map from a set s with exponent 1/d can have dimension at most d \, \mathrm{dim}\, s, so in our case, we know that since the image of the Hilbert curve has dimension 2, then it can't be Hölder continuous with exponent > 1/2, and in particular, it can't be Lipschitz or differentiable.

Oddly enough, this fact actually IS in Lean already!

L-Systems

The symmetry structure plus making sure everything connects up seems like it is actually sufficient for continuity, so there may be some related facts that show that any L-system satisfies some nice continuity relations. I suspect the "space-filling" depends on the exact fractal nature of those systems.

I never proved that the L-system definition is equivalent, and it looks like once again, annoying induction.

Base-4 Representation

The symmetry section should also hint that we can look at the curve as splitting a base-4 number into 2 base-2 numbers.

Each digit tells you which quadrant you are in, so define the digits of the base-2 numbers:

0.0... -> (0.0..., 0.0...)
0.1... -> (0.0..., 0.1...)
0.2... -> (0.1..., 0.1...)
0.3... -> (0.1..., 0.0...)

I know that the continuity conditions here amount to any Gray code. The flipping and swapping are still necessary and involve dealing with the digits in a different way depending on earlier digits, but this doesn't appear to be anything more than a technical obstacle.

Partial Computable Inverse

The symmetry-based algorithm not only gives a computable definition for \mathbb{R} \to \mathbb{R}, but it and the injectivity arguments also suggest that there is a partial computable inverse:

When we proved the function is not-injective, we had to pick some inputs which mapped to the boundary \{\frac{1}{2}\} \times [0, \frac{1}{2}]. These are in fact the only places where it is not injective. If (x, y) has irrational coordinates, then each time we "coinduct" and break it down into sections, we get a unique quadrant like t \in [\frac{1}{4}, \frac{1}{2}]. Since this is unique every time, we can get a series of increasing approximations like before, and find the unique t such that H(t) = (x, y).

I'd also like to thank Sam Sartor for first pointing out to me these "grids" fill up the space in a weird way. I guess it was relevant later.

From here, we can refine our surjectivity in a nice way, there is a computable left-inverse on all but a dense set of measure 0.

Hilbert Curve on the Rationals

H(\mathbb{Q}) \subseteq \mathbb{Q} \times \mathbb{Q}

Once I saw the symmetry relations, the digits definition, and I computed a few H(t) "by hand" for a version of the non-injectivity theorem, I realized there was a "sharper" computable algorithm for H.

As an example, let's do \frac{1}{3}, which is how I got into this. By inspecting \frac{1}{3} = \frac{1}{4} + \frac{1}{4}\frac{1}{3}, we know that each iteration, we zoom into the top left corner, and when we do 4 (\frac{1}{3} - \frac{1}{4}) = \frac{1}{3} . This gives us a single transformation: zoom in up and to the left each time. This gives a sequence \frac{1}{2} + \frac{1}{4} + \cdots = 1 for the y-coordinate and 0 for the x-coordinate. Thus H(\frac{1}{3}) = (0, 1).

Suppose we expand t \in \mathbb{Q} into an its base-4 representation: t = 0.t_1 t_2 t_3 \cdots. Eventually, this expansion starts repeating, say at digit n + 1 to n + T. The first n digits will localize us to some smallish square, and then we'll explicit calculate H(t) for some t which immmediately repeats.

For repeating digits 0.t_1 \cdots t_T t_1 \cdots, we can construct a function T_{t_1 t_2 \cdots t_T} which zooms into the appropriate section, which we can iterate to get out final output as the final fixed point. This function T is an affine map, which can be explicitly computed. Since the fixed points of affine maps can be solved for using linear algebra (i.e. A x + b = x is a linear equation), we can solve the appropriate matrix, and then find H(t) without looking at all the digits.

Combining this with our other transformation gives us H(t) for any rational t. Since every transformation here involves rational matrices and solving a rational linear system, we can compute an rational inverse matrix and thus H(t) \in \mathbb{Q}.

I would be interested to learn a proof of this fact which isn't constructive.

Other fractals

Other fractals such as the dragon curve have similar properties, if less well-behaved. (The limit is a dragon, not a square.) Since I broke up continuity into individual specific bounds instead of computations on recursive combinations, the Hilbert curve lemmas have no direct effect on such curves. However, such proof should be computational since a sufficiently "bounded" recursive procedure should tend to a limit in a subsequence. Intuitively, I expect most convergence bounds to be simple enough, while area computations are tractable through infinite series. These procedures seem challenging to implement.

Mathlib additions I would like to do

I would like to add a few lemmas about limits of floors and floor of integer division, which seem easy enough. Edit: Vasilii Nesterovs recently added ⌊n * x⌋ / n = ⌊x⌋ for floor fields already.

Interpolation has too many extensions, so requires more thought, particularly in regards to complex analysis.

Finally, continuous affine maps are a bit of frustration to work with. There are many results that apply to topological vector spaces like much of Mathlib.Analysis.Normed.Module.FiniteDimensional. There are results about slightly different kinds of continuous affine maps in either Mathlib.Topology.Algebra.Affine, which depend on something being a topological group, or Mathlib.Topology.Algebra.ContinuousAffineMap, where they depend on an AddTorsor. Right now, the normed continuous affine maps are the only nice ones, but adding topological vector spaces should clarify much of this theory.

Pros and Cons of using Lean here

Overall, I'm pretty happy I did this formalization. Formalization really pushes you in a way that writing sometimes doesn't. I would suspect that I could have gotten 80% of the insight with 20% of the effort if I actually wrote a blueprint out first, whoops. The computation and casework seems to still be a bit of a nightmare, and in this case, I'm not sure what could really make that part "pleasant". There's a lot of geometric intuition.

Using ProofWidgets was a great idea, since it caught bugs I would have needed some serious formalization to uncover, such as during proving injectivity. I was surprised at (1) how easy it is for AI to autogenerate these and (2) how difficult it was to just write JavaScript mself. ProofWidgets is probably just injecting JavaScript, but Lean makes string-interpolating your own JavaScript indirect. I actually regret not using ProofWidgets more by substituting specific examples when I am doing algebra. The only big impediment is that \mathbb{R} is usually noncomputable, and producing a useful approximation requires "breaking" out of a quotient, so it's usually easier to build out numeric testing separately for \mathbb{R}.

When I tried to use any sort of AI, it usually failed. There was a few really early, basic definitions for the different transformations which Gemini 2.5 did quite well on. It did great on SVG generation and JavaScript. However, the moment you had a mildly complicated proof like "interpolation is continuous", then even the super fancy "DeepSeek-Prover-V2" got stuck in a loop trying to prove t - \lfloor t \rfloor is continuous. Even when they did work, they often produced some of the ugliest proofs I've seen in my life, and it was faster to rewrite them from scratch then clean it up. Many of the provers are trained using only pretraining + pure RL, so they don't look up theorems when they should, they write 10 different tactics in a row and hope it works, they are incapable of running Lean code while generating, they can't simplify or take wrong paths, so overall they end up completely useless for even the amateur mathematician.

The confusion in mathlib's continuous affine map cost me a few days of reading and false starts. I suspect that the ordinary use of uniform continuity is excessive when you really need weaker product continuity results, which is a mismatch I would call in Lean's favor over the informal.

Conclusion

The Hilbert curve has some nice properties in both the integers and the reals, and in my opinion, any finite integer implementation is only correct because of the convergence to the reals. That makes it an interesting verification exercise, since you can't really avoid having to deal with limits. There are plenty of other similar pathological curves with similar constructions (like Whitney's "A function not constant on a connected set of critical points"). I've purposefully ignored looking too hard into the literature here, since I wanted to learn from formalization instead of just formalizing known facts. Even now, I am wary of letting go of some puzzles and looking up an answer.

Ultimately, I am getting bit tired of these kind of "obvious" tasks becoming a 3000 LOC adventure. Frankly, many days weren't enjoyable, and I do this primarily because I find it fun. At some point, I would like to play around with something less obvious and less verbose instead, or at least on work on tackling these usability problems instead of suffering through them. There's plenty of things to work on still.

P.S. Verso is fine

I wrote this blog post by drafting first in Obsidian, and then copying it to Verso.

I don't know if I've gotten better at Lean or if Verso has gotten easier to use, but I needed a lot less boilerplate to get this blog-post in Verso. I have a few notes at https://github.com/josephmckinsey/HilbertCurveBlogPost/blob/main/notes for some of the problems I encountered, but overall I feel like I have a real template for next time here.