Function min_insync_is_site_loss_safe 

pub fn min_insync_is_site_loss_safe(
    rf: i64,
    sites: i64,
    min_insync: i64,
) -> bool

true if min_insync keeps acks=all writes durable and available through the loss of any one site.

Two bounds define the safe range, and the contract states both against every site of the round-robin placement, round_robin_load.

The lower bound is that no single site holds min_insync replicas. min.insync.replicas is a count and not a placement: the leader accepts an acks=all write as soon as that many in-sync replicas hold it, wherever they sit. If one site can hold min_insync of them, then the in-sync set can shrink to that one site, and the leader then acknowledges a write that only that site holds. The loss of that site loses an acknowledged write, and the surviving sites still hold the voter majority, so they elect a leader that never saw it. The shrink needs no second site loss to get there: one site down and one lagging replica is enough, and a witness on a cheap link is the replica most likely to lag.

The upper bound is that the loss of any one site leaves at least min_insync replicas, so the leader keeps accepting acks=all writes. The fewest that a site loss leaves is site_loss_survivors.

The lower bound implies min_insync >= 2, because one site always holds at least one replica. It is therefore the whole of the durability condition, and 2 is not stated separately.

For three replicas on three sites each site holds one, so the bounds are min_insync > 1 and min_insync <= 2: they meet, and 2 is the only safe value. Four replicas on three sites have no safe value at all, because one site holds two of them: the bounds become min_insync > 2 and min_insync <= 2. Three replicas on two sites have none either, for the same reason. A witness site closes that gap. It holds a replica of its own, so three replicas spread one per site over three sites again.