stuck in proof for blame invariance