Invariant that the set of committed certificates is redundant: proof that it holds in every reachable state.
This completes committed-redundant-def-and-init-and-next by showing that the invariant holds in every reachable state.