proof of correctness (missing why trace can be constructed, unique send/receive)