Definition of the invariant: the DAG of each correct validator is backward-closed.
Theorem:
(defthm backward-closed-p-necc (implies (backward-closed-p systate) (implies (in val (correct-addresses systate)) (dag-closedp (validator-state->dag (get-validator-state val systate))))))
Theorem:
(defthm booleanp-of-backward-closed-p (b* ((yes/no (backward-closed-p systate))) (booleanp yes/no)) :rule-classes :rewrite)
Theorem:
(defthm backward-closed-p-of-system-state-fix-systate (equal (backward-closed-p (system-state-fix systate)) (backward-closed-p systate)))
Theorem:
(defthm backward-closed-p-system-state-equiv-congruence-on-systate (implies (system-state-equiv systate systate-equiv) (equal (backward-closed-p systate) (backward-closed-p systate-equiv))) :rule-classes :congruence)