What TLA+ can and can't check