“"dependent types and total functions do not scale. Maintenance is terrible." — el_pollo_diablo, Hacker News, 2026-07-27 (https://news.ycombinator.com/item?id=49066421)”
You know that feeling when the test suite is green, review passed, and you still cannot say the function is right — you can only say nobody found the input that breaks it. Tests sample; they never cover the case you did not think of. That gap got sharper the moment LLMs started producing code faster than you can read it, because now you are reviewing plausible-looking output in volume with no mechanical way to separate correct from convincing. Lean 4's answer is to make correctness something the machine decides rather than something you argue about in a pull request.
Think of a spell-checker that refuses to save the file until every sentence is grammatical — except the rule here is logical rather than grammatical, and there is no 'ignore' button. You write your program and, alongside it, a statement of what it must always do; Lean's kernel, a small checker everything funnels through, either accepts the argument or rejects it. What separates Lean 4 from older provers is that the elaborator, tactic framework and macro system are themselves Lean programs, so an automation tactic you write is a compiled Lean program rather than a plugin in a second language like Rocq's OCaml or Isabelle's ML. The price is bootstrapping: the compiler cannot be built without a compiler, so pre-generated C sits in `stage0/` inside git, stage1 rebuilds the runtime and standard library with it, and stage2 rebuilds stage1's output using stage1 itself. Stage3 exists only as a sanity check and is expected to come out identical to stage2.
If you write cryptography, compilers, authorization logic, or anything where a rare wrong edge case becomes a security incident, Lean 4 gives you a check that testing structurally cannot. It also fits if you are building AI systems and want a mechanical judge for model output rather than a human reviewer reading everything. It is not for you if you need a general-purpose application language today — one practitioner's Lean Zstandard decoder ran 10× slower than command-line zstd — or if your team cannot absorb a language where the type system is the hardest part of the job.
Worth real time if correctness is your product: the repo committed on 2026-07-27, ships stable releases monthly, and Google DeepMind, Harmonic, the Cedar policy specification and ArkLib all build on it. Read the marketing carefully, though — lean-lang.org says the kernel 'guarantees absolute correctness,' while issue #8982, an unsoundness in `unif_hint`, has been open and triaged P-low since 2025-06-24. Budget for a long ramp: the highest-reaction open RFCs describe the `have` tactic as 'an enormous footgun for new users' and have sat unresolved for more than two years.
Deep-dive insight, Easy and Pro modes, plus action playbooks — the full breakdown is one tap away.