pub broadcast proof fn axiom_is_empty_len0<A>(s: Set<A>)
#[trigger] s.is_empty() <==> (s.finite() && s.len() == 0),