correctness-proof