Shadow Objects: A Programming Model for Control Replication in Distributed Systems