PBFT
Why cannot we commit after Prepared(m,n,i) becomes true?

1. When a replica commits a message for a sequence number (m,n), the same
message should be committed eventually by all non-faulty replicas.

2. After committed-local(m,n,i) becomes true at a replica i (it might 
be possible that committed-local is true only for replica i),

        (1) when the primary is non-faulty, and there is no view change,
eventually every non-faulty replica should commit the same message with
the same sequence number in this view;

        (2) if there is a view change, the proof for Prepared(m,n,i) for
at least one replica i can be propagated to the new view, so the message
will be prepared again in the new view and eventually will be committed
with the same sequence number.

3. It is possible that Prepared(m,n,i) is true for only one replica i in a
view (or on less than 2f+1 replicas, or less than f+1 non-faulty replicas, 
both will lead to the following). Think about why.

4. If we commit (m,n) after Prepared(m,n,i) is true at some replica i. This
Prepared(m,n,i) may not be propagated to the new view. If we propagate
Prepare messages Prepare(m,n,i), there may be two Prepare messages such as
Prepare(m,n,i), Prepare(m',n,j). In the new view, we wouldn't know whether m
or m' should be prepared.