Formal bijection Proof