Where is the TLA+ proof?

TLA+ does not do what you think it does.