Lessons from Formally Verified Deployed Software Systems | Synapse