That is why I prefer correct by construction instead of relying on proofs