indeed. that's why we continuously _empirically_ prove that we are in fact safe - https://vectorized.io/validating-consistency/

there is no substitute to testing tho

there are 2 levels here. 1) raft has a proof (and a great phd dissertation from diego), but what matters is if we actually implemented it correctly. so 2) is we need to continuously test it. Denis did a lot of similar work at CosmosDB (microsoft) and has spent his career working on consensus.

Hopefully these eases some concerns.