pub broadcast proof fn axiom_iset_is_empty<A>(s: ISet<A>)
!(#[trigger] s.is_empty()),
exists |a: A| s.contains(a),