proof by loop invariant - Search
Refresh