primrec: finished proof