Comment by sharkjacobs

People treating this as a scaling problem are skipping the part where verification runs into undecidability fast.

Proving a small pure function is one thing, but once the code touches syscalls, a stateful network protocol, time, randomness, or messy I/O semantics, the work shifts from 'verify the program' to 'model the world well enough that the proof means anything,' and that is where the wheels come off.