pub proof fn axiom_fresh_vm_io_id_not_in_dom<'a>(m: Map<VmIoId, VmIoEntry>)
!m.dom().contains(fresh_vm_io_id(m)),