Some use cases and bugs are not amenable to proof. For example, how do you mathematically prove that your rendering engine is cutting off the bottom of the g of your new font?
Not all requirements of a system can be expressed a priori. I think proofs will never be enough to make a bug free system. Working as intended is a very frustrating response to a perceived bug for a user.