Lower Bound (via testing) vs. Upper Bound (via proof) for Correctness

Chris Smith's article "What to know before debating type systems" contains the following unexplained statement:

Testing: establishes upper bounds on correctness
Proof: establishes lower bounds on correctness

The context is comparing the benefits of proving program correctness (e.g. with a type-checker) vs. testing program behaviour (e.g. with TDD in a dynamically typed language).

What are the "upper" and "lower" bounds on correctness in this context?