Problem: maxheap_push

Your task is to implement the Push operation for a binary max-heap (the maximum value is stored at the root) stored in a sequence and verify its correctness in Dafny. When a new value is added, it is initially placed at the first available position at the end of the sequence to maintain the tree's complete binary structure. However, this may violate the heap property if the new value is larger than its parent. To restore the invariant, you must perform a "bubble-up" (or sift-up) process, iteratively swapping the new node with its parent until it is either at the root or its parent is greater than or equal to it.  Specifically, you must prove the following: (1) Multiset Inclusion: The mathematical multiset of values in the heap after the operation must be exactly equal to the original multiset plus the new element. This ensures that no existing data is corrupted and the new value is successfully integrated. (2) Heap Invariant Preservation: For every node in the resulting sequence (except the root), the value at index $i$ must be less than or equal to the value at its parent index $(i - 1) / 2$. You must prove that swapping a node upwards restores the property locally without breaking it for the node's siblings or descendants. (3) Size and Capacity Bounds: The operation must maintain the structure of a complete binary tree. You must prove that the new length is exactly one greater than the original length and that it does not exceed the defined maximum capacity of 1023.

// Following is the block for necessary definitions
// <preamble>
class BinaryMaxHeap {
    var storage: seq<int>
    var len: int

    function max_capacity(): int { 1023 }

    predicate is_heap()
        reads this
    {
        len <= max_capacity() &&
        0 <= len <= |storage| &&
        // Heap Property: Child <= Parent
        // Parent index of i is (i - 1) / 2
        // Added {:trigger} to prevent matching loops in verification
        (forall i {:trigger storage[i]} :: 1 <= i < len ==> storage[i] <= storage[(i - 1) / 2])
    }

    function view(): multiset<int>
        reads this
        requires 0 <= len <= |storage|
    {
        multiset(storage[..len])
    }
// </preamble>

// Following is the block for potential helper specifications
// <helpers>

// </helpers>

// Following is the block for proofs of lemmas
// <proofs>

// </proofs>

// Following is the block for the main specification
// <spec>
    method push(v: int)
        requires is_heap()
        requires len < max_capacity()
        // Ensure there is physical space in the storage sequence
        requires |storage| > len
        modifies this
        ensures is_heap()
        ensures len == old(len) + 1
        ensures view() == old(view()) + multiset{v}
// </spec>
// <code>
    {
        // Implement and verify the push operation for the max-heap here.
    }
// </code>
}