The invariant holds in every reachable state.
Theorem: same-committees-p-when-reachable
(defthm same-committees-p-when-reachable (implies (and (system-state-reachablep systate) (system-committees-fault-tolerant-p systate)) (same-committees-p systate)))