post condition - changed require to ensure