pub broadcast proof fn lemma_u8_pow2_ilog2(e: u32)
pow2(e as nat) <= u8::MAX,
#[trigger] (pow2(e as nat) as u8).ilog2() == e,