Inlay

So model checking gives you a lot more breadth -- show that invariants hold across any kind of adversarial result! -- but much less depth than randomized tests. That is fine. They're both very valuable