Verifying Mutable Systems