fixpoint + assertions