Verifying strong eventual consistency in distributed systems