rewrite loop invariant (not yet verified)
update proof for simplified loop invariant