Reproducing the AWS outage race condition with a model checker