lol, reminds me of the common misreading "provably safe" / "probably safe"
replyTLA+ doesnt prove the code. if they never read the proof, then how do we k ow that it proved the right things?
replyAnd you still have to make sure all the real constraints are in. I had to fix a proven correct distributed algorithm that just happened to believe updates were done atomically and with no latency.
reply