Equivalence Checks: Proving a Refactor Preserved the KPI