verifying-stateful-and-side-effecting-programs-using-dependent-types