correct implementation of value restriction