work on coq proof of lemma