C4: verified transactional objects