I don't know whether this particular proof models IO timeouts - might have a poke at it and see what it's doing if I have time later. More generally, Coq is "j

I don't know whether this particular proof models IO timeouts - might have a poke at it and see what it's doing if I have time later. More generally, Coq is "just" a well integrated proof tool & I can't see any reason why you couldn't include such features but at some point you have to draw the line and be explicit about what it is that you're actually proving: if your proof assumes data store responsiveness then it's OK for it to do that so long as you're explicit about the resulting limitations IMO. The goal of ever increasing model fidelity is a rabbit hole from which the programmer/prover might never return otherwise :)