sketchy but complete proof of subformula property