Problem: segmenttree_build

Your task is to implement the build operation for a Range Maximum Segment Tree and verify its correctness in Dafny . The operation constructs a valid, balanced segment tree for a given range $[l, r)$ where every position is initialized to 0, proceeding recursively: (1) Base Case: if the range represents a single element ($l + 1 == r$), create a leaf node containing the value 0; (2) Recursive Step: otherwise, calculate the midpoint, recursively build the left and right subtrees, and create a new internal node whose value is the maximum of its children's values. Specifically, you must prove (1) Functional Correctness: the resulting tree corresponds exactly to the requested range $[l, r)$ and represents an abstract view where every index $k$ in that range maps to 0, and (2) Invariant Establishment: the resulting data structure satisfies the is_segment_tree invariant, guaranteeing valid ranges, structural integrity, and the Max property at every node.

// Following is the block for necessary definitions
// <preamble>
datatype Option<T> = Some(value: T) | None

datatype Node = Node(
    val: int,            // Stores the Max value for the current range (u64)
    low: int,            // Range lower bound (inclusive)
    high: int,           // Range upper bound (exclusive)
    left: Option<Node>,
    right: Option<Node>
) {
    // The view returns a Map from index -> value
    ghost function view(): map<int, int>
        decreases this
    {
        var left_view := match this.left {
            case Some(l) => l.view()
            case None => map[]
        };
        var right_view := match this.right {
            case Some(r) => r.view()
            case None => map[]
        };
        
        // We construct the union. Since domains are disjoint in a valid segment tree,
        // map union (+) is sufficient.
        // For a leaf (left=None, right=None), we implicitly represent the point 'low'.
        // However, the recursive logic below relies on 'is_segment_tree' to enforce leaf structure.
        // A strictly structural view definition:
        if left.None? && right.None? then
            map[low := val] // Leaf logic implicit in Verus spec via "leaf -> true" and view consistency check
        else
            left_view + right_view
    }

    // Checks structural integrity and the Max property
    ghost predicate is_segment_tree()
        decreases this
    {
        // 1. Basic Range Validity (and u64 constraints)
        && 0 <= this.low < this.high
        && 0 <= this.val
        
        // 2. Structural Recursion
        && (match (this.left, this.right) {
            case (Some(l), Some(r)) => 
                // Internal Node
                var mid := (this.low + this.high) / 2;
                
                // Child ranges must line up exactly
                && l.low == this.low && l.high == mid
                && r.low == mid && r.high == this.high
                
                // Recursive validity
                && l.is_segment_tree()
                && r.is_segment_tree()
                
                // The Max Property: Node val must be max of children
                && this.val == (if l.val > r.val then l.val else r.val)

            case (None, None) => 
                // Leaf Node
                // Must represent a single point
                && this.high == this.low + 1
                // Implicitly, val is the value of this leaf, which is consistent
                && true

            case _ => false // Segment trees are full binary trees (0 or 2 children)
        })
        
        // 3. View Consistency (The view domain matches the range)
        && (forall k :: k in this.view() <==> this.low <= k < this.high)
        // 4. Value Consistency (The stored val is >= all items in view)
        && (forall k :: k in this.view() ==> this.view()[k] <= this.val)
    }
}
// </preamble>

// Following is the block for potential helper specifications
// <helpers>

// </helpers>

// Following is the block for proofs of lemmas
// <proofs>

// </proofs>

// Following is the block for the main specification
// <spec>
method build(l: int, r: int) returns (res: Node)
    // Constraint: unsigned integers
    requires 0 <= l < r
    ensures 
        && res.is_segment_tree()
        && res.low == l
        && res.high == r
        // All values in the map are initialized to 0
        && (forall k :: l <= k < r ==> k in res.view() && res.view()[k] == 0)
// </spec>
// <code>
{
    // Implement and verify the build function for segment tree construction
}
// </code>

method main() {}