Problem: llrbt_rotateright

Your task is to implement and verify a right rotation (fixup_rotate_right) for a Left-Leaning Red-Black Tree (LLRBT) in Lean. Verification Specification: (1) Preconditions: The node must have a left child that is Red, and that left child must also have a left child that is Red (Double Red on Left). (2) Postconditions: Functional Correctness (view/set is preserved) and Invariant Maintenance (BST order is preserved, Black Height is preserved, and colors are rotated: the new root takes the old root's color, the old root becomes Red and takes the right position). This fixes the "Double Red" violation by lifting the middle node.


import Mathlib

inductive Color
| Red
| Black
deriving Inhabited, BEq

inductive Node
| Empty : Node
| Tree  (color : Color) (val : Int) (left : Node) (right : Node) : Node
deriving Inhabited

def view (t : Node) : Set Int :=
  match t with
  | Node.Empty => ∅
  | Node.Tree _ v l r => view l ∪ view r ∪ {v}

def is_red (t : Node) : Bool :=
  match t with
  | Node.Tree Color.Red _ _ _ => true
  | _ => false

def get_color (t : Node) : Color :=
  match t with
  | Node.Tree c _ _ _ => c
  | Node.Empty => Color.Black -- Empty nodes are black

def is_bst (t : Node) : Prop :=
  match t with
  | Node.Empty => True
  | Node.Tree _ v l r =>
    (∀ x ∈ view l, x < v) ∧
    is_bst l ∧
    (∀ x ∈ view r, x > v) ∧
    is_bst r

-- Black Height: Returns -1 if invalid
def black_height (t : Node) : Int :=
  match t with
  | Node.Empty => 1
  | Node.Tree c _ l r =>
    let lh := black_height l
    let rh := black_height r
    if lh ≠ -1 ∧ rh ≠ -1 ∧ lh = rh then
      if c == Color.Black then lh + 1 else lh
    else
      -1

def get_left (t : Node) : Option Node :=
  match t with | Node.Tree _ _ l _ => some l | _ => none

def get_right (t : Node) : Option Node :=
  match t with | Node.Tree _ _ _ r => some r | _ => none

def is_not_empty (t : Node) : Prop :=
  match t with | Node.Empty => False | _ => True

-- Precondition definitions
@[reducible, simp]
def rotate_right_precond (t : Node) : Prop :=
  -- !benchmark @start precond
  match t with
  | Node.Tree _ _ l _ =>
    -- Strictly match Dafny/Verus: Only require Left child to be Red.
    -- The Double-Red context is checked by the caller (insert), not this helper.
    is_red l
  | _ => False
  -- !benchmark @end precond

-- !benchmark @start auxcode
-- !benchmark @end auxcode

-- Main function definition
def rotate_right (t : Node) 
    (h_precond : rotate_right_precond t) : Node :=
  -- !benchmark @start code
  sorry
  -- !benchmark @end code

-- Postcondition definitions
@[reducible, simp]
def rotate_right_postcond (t : Node) (result : Node)
    (_ : rotate_right_precond t) : Prop :=
  -- !benchmark @start postcond
  view result = view t ∧
  is_bst t → is_bst result ∧
  match result, t with
  | Node.Tree c' _ _ r', Node.Tree c _ _ _ =>
      -- New root color matches old root color
      c' = c ∧
      -- New right child is Red
      (match r' with
       | Node.Tree Color.Red _ _ _ => True
       | _ => False) ∧
      -- Black height preservation
      (black_height t ≠ -1 → black_height result = black_height t)
  | _, _ => False
  -- !benchmark @end postcond

-- !benchmark @start lemma
-- !benchmark @end lemma

-- Proof content
theorem rotate_right_postcond_satisfied (t : Node)
    (h_precond : rotate_right_precond t) :
    rotate_right_postcond t (rotate_right t h_precond) h_precond := by
  -- !benchmark @start proof
  sorry
  -- !benchmark @end proof