hr correctness-invariant