Why Buran Had Four Computers, Not Three

Buran's redundant flight computer ran four identical channels, rated for two failures. A Rust model of its voter, proved in Lean, and what that misses.