
A single passing test proves only that one path through the machine was walked.
To trust a system absolutely, every reachable state must be visited, not sampled. The checker does not stop at plausibility; it exhausts the entire tree of possible futures.
Only when no counterexample remains anywhere in that vastness does the invariant become a proof.
This is model checking: not a sample of confidence, but an exhaustive walk of every state a system could ever reach.