pub open spec fn set_prop_mutual_exclusion<A>(s: Set<A>, f: FnSpec<(A,), bool>) -> bool
{ forall |x: A, y: A| { #[trigger] s.contains(x) && #[trigger] s.contains(y) && x != y ==> !(f(x) && f(y)) } }