indeed. that's why we continuously _empirically_ prove that we are in fact safe - https://vectorized.io/validating-consistency/ https://vectorized.io/validating

indeed. that's why we continuously _empirically_ prove that we are in fact safe - https://vectorized.io/validating-consistency/ https://vectorized.io/validating-consistency/ there is no substitute to testing tho there are 2 levels here. 1) raft has a proof (and a great phd dissertation from diego), but what matters is if we actually implemented it correctly. so 2) is we need to continuously test it. Denis did a lot of similar work at CosmosDB (microsoft) and has spent his career working on consensus. Hopefully these eases some concerns.