pub broadcast proof fn lemma_iset_difference2<A>(s1: ISet<A>, s2: ISet<A>, a: A)Expand description
ensures
s2.contains(a) ==> !s1.difference(s2).contains(a),If set s2 contains element a, then the set difference of s1 and s2 does not contain a.