Problem: trie_insert

Your task is to implement the Insert operation for a Byte-based Trie data structure (Prefix Tree) and verify its correctness in Dafny. This operation takes a tree (which may be None) and a key (seq<int> where elements are 0-255), traverses the path corresponding to the bytes, and marks the destination node as an endpoint. If the path does not exist, the implementation must allocate new nodes, initializing their children sequences with 256 None values. Specifically, you must prove the following: (1) Set Update: The abstract view of the resulting tree must be exactly the union of the original tree's view and the new key. Existing keys must be preserved. (2) Well-Formedness Preservation: The resulting tree must satisfy the well_formed invariant. This includes ensuring all node sequences are correctly sized (256) and that the tree structure is valid. (3) Non-Empty Guarantee: You must prove that the result is a valid Node (never None) and is not "empty" (useless), as the insertion guarantees at least one active key exists in the structure.

// Following is the block for necessary definitions
// <preamble>
datatype Option<T> = Some(value: T) | None

datatype Node = Node(
    is_end: bool,
    // A sequence of children, representing bytes 0..255
    children: seq<Option<Node>>
) {
    // A node is "empty" (useless) if it marks no key and leads to no keys.
    predicate is_empty() 
        requires |this.children| == 256
    {
        !this.is_end && (forall i: int {:trigger this.children[i]} :: 0 <= i < 256 ==> this.children[i].None?)
    }

    // Standard structural integrity + The Pruning Invariant
    predicate well_formed() 
        decreases this
    {
        // 1. Must have exactly 256 slots (for u8)
        && |this.children| == 256
        // 2. Recursive check for all children
        && (forall i: int {:trigger this.children[i]} :: 0 <= i < 256 ==> 
            match this.children[i] {
                case Some(child) => 
                    // The child must be structurally valid
                    && child.well_formed()
                    // CRITICAL: The child must not be useless.
                    && !child.is_empty()
                case None => true
            }
        )
    }

    // Recursive definition of containment
    function contains(key: seq<int>): bool
        decreases |key|
    {
        if |key| == 0 then
            this.is_end
        else
            var char_idx := key[0];
            if 0 <= char_idx < |this.children| then
                match this.children[char_idx] {
                    case Some(child) => child.contains(key[1..])
                    case None => false
                }
            else
                false
    }

    // View as a Set of byte sequences
    ghost function view(): iset<seq<int>> {
        iset key: seq<int> | this.contains(key)
    }
}

ghost function opt_view(node: Option<Node>): iset<seq<int>> {
    match node {
        case Some(n) => n.view()
        case None => iset{}
    }
}

predicate opt_well_formed(node: Option<Node>) {
    match node {
        case Some(n) => 
            // The node structure is valid
            && n.well_formed() 
            // The root itself must not be useless (if it is, the tree should be None)
            && !n.is_empty()
        case None => true
    }
}
// </preamble>

// Following is the block for potential helper specifications
// <helpers>

// </helpers>

// Following is the block for proofs of lemmas
// <proofs>

// </proofs>

// Following is the block for the main specification
// <spec>
method insert(tree: Option<Node>, key: seq<int>) returns (res: Node)
    requires opt_well_formed(tree)
    // Constraint: Input key elements must represent bytes (u8)
    requires forall k :: k in key ==> 0 <= k < 256
    ensures 
        // The result must satisfy the pruning invariant
        && res.well_formed()
        && !res.is_empty() // Insert always results in a non-empty tree
        && res.view() == opt_view(tree) + iset{key}
// </spec>
// <code>
{
    // Implement and verify the `insert` function for Trie data structure
}
// </code>

method main() {}