Model-check protocols with TLA+, prove invariants with Lean 4, and check bounded Rust functions with Kani.
2 in the Claude listing