Formalizing Determinacy of Concurrent Revisions