rewrite proof code compiles, but needs testing