correct inductive invariants misunderstanding