On verifying stateful dataflow processing services in large-scale cloud systems