CDC bugs escape simulation and show up as once-a-month field failures. What CDC verification flow caught your real bugs - formal tools, lint rules, or just disciplined design review?