TLA+ doesnt prove the code. if they never read the proof, then how do we k ow that it proved the right things?

And you still have to make sure all the real constraints are in. I had to fix a proven correct distributed algorithm that just happened to believe updates were done atomically and with no latency.