invariant proof completed