Problem: maxheap_push

Your task is to implement the Push operation for a binary max-heap and verify its correctness in Lean. The operation inserts a new value at the end and bubbles it up to restore the heap property. Postconditions: Multiset view includes the new element (view = old_view + {v}), heap size increases by 1, and the heap invariant is preserved (parent ≥ child).


import Mathlib

structure BinaryMaxHeap where
  storage : List Int
deriving Inhabited

namespace BinaryMaxHeap

def len (h : BinaryMaxHeap) : Nat :=
  h.storage.length

def get (h : BinaryMaxHeap) (i : Nat) : Int :=
  h.storage.getD i 0 -- Safe access with default

def parent (i : Nat) : Nat := (i - 1) / 2

def is_heap (h : BinaryMaxHeap) : Prop :=
  ∀ i, 0 < i ∧ i < h.len → h.get i ≤ h.get (parent i)

def view (h : BinaryMaxHeap) : Multiset Int :=
  Multiset.ofList h.storage

-- Precondition definitions
@[reducible, simp]
def push_precond (h : BinaryMaxHeap) (v : Int) : Prop :=
  -- !benchmark @start precond
  is_heap h ∧ h.len < 1023 -- Limited capacity as per spec example
  -- !benchmark @end precond

-- !benchmark @start auxcode
-- !benchmark @end auxcode

-- Main function definition
def push (h : BinaryMaxHeap) (v : Int)
    (h_precond : push_precond h v) : BinaryMaxHeap :=
  -- !benchmark @start code
  sorry
  -- !benchmark @end code

-- Postcondition definitions
@[reducible, simp]
def push_postcond (h : BinaryMaxHeap) (v : Int) (result : BinaryMaxHeap)
    (_ : push_precond h v) : Prop :=
  -- !benchmark @start postcond
  is_heap result ∧
  result.len = h.len + 1 ∧
  result.view = h.view + {v}
  -- !benchmark @end postcond

-- !benchmark @start lemma
-- !benchmark @end lemma

-- Proof content
theorem push_postcond_satisfied (h : BinaryMaxHeap) (v : Int)
    (h_precond : push_precond h v) :
    push_postcond h v (push h v h_precond) h_precond := by
  -- !benchmark @start proof
  sorry
  -- !benchmark @end proof

end BinaryMaxHeap