Problem: maxheap_popmax

Your task is to implement the Pop Max operation for a binary max-heap and verify its correctness in Lean. The operation removes the root (max element), moves the last element to the root, and bubbles it down. Postconditions: Returns max element, heap size decreases by 1, multiset view is view - {max}, and heap invariant is preserved.


import Mathlib

structure BinaryMaxHeap where
  storage : List Int
deriving Inhabited

namespace BinaryMaxHeap

def len (h : BinaryMaxHeap) : Nat :=
  h.storage.length

def get (h : BinaryMaxHeap) (i : Nat) : Int :=
  h.storage.getD i 0

def parent (i : Nat) : Nat := (i - 1) / 2

def is_heap (h : BinaryMaxHeap) : Prop :=
  ∀ i, 0 < i ∧ i < h.len → h.get i ≤ h.get (parent i)

def view (h : BinaryMaxHeap) : Multiset Int :=
  Multiset.ofList h.storage

-- Precondition definitions
@[reducible, simp]
def pop_max_precond (h : BinaryMaxHeap) : Prop :=
  -- !benchmark @start precond
  is_heap h ∧ h.len > 0
  -- !benchmark @end precond

-- !benchmark @start auxcode
-- !benchmark @end auxcode

-- Main function definition
-- Returns (new_heap, popped_max)
def pop_max (h : BinaryMaxHeap)
    (h_precond : pop_max_precond h) : BinaryMaxHeap × Int :=
  -- !benchmark @start code
  sorry
  -- !benchmark @end code

-- Postcondition definitions
@[reducible, simp]
def pop_max_postcond (h : BinaryMaxHeap) (result : BinaryMaxHeap × Int)
    (_ : pop_max_precond h) : Prop :=
  -- !benchmark @start postcond
  let (new_h, max_val) := result
  is_heap new_h ∧
  new_h.len = h.len - 1 ∧
  (∀ x ∈ h.view, max_val ≥ x) ∧
  new_h.view = h.view - {max_val}
  -- !benchmark @end postcond

-- !benchmark @start lemma
-- !benchmark @end lemma

-- Proof content
theorem pop_max_postcond_satisfied (h : BinaryMaxHeap)
    (h_precond : pop_max_precond h) :
    pop_max_postcond h (pop_max h h_precond) h_precond := by
  -- !benchmark @start proof
  sorry
  -- !benchmark @end proof

end BinaryMaxHeap