refactor Coq proofs