Proving correctness of refactoring tuples to records