correctness invariant to dir