Mention that f is an endofunction
Reword loop invariant (second branch) a bit