Function quorum_survives_any_single_site_loss 

pub fn quorum_survives_any_single_site_loss(voters_per_site: &[i64]) -> bool

true if the surviving KRaft voters still form a strict majority after the loss of any one site.

voters_per_site[k] is the count of KRaft voters in site k. The check asks for every site k whether 2 * (total - voters_per_site[k]) > total holds, where total is the sum of the slice. A strict majority is what a KRaft quorum needs to elect a leader and to commit a metadata record, so a cluster that fails this check stops its metadata writes when it loses a site.

Two sites never pass this check. Any split of the voters over two sites leaves one site with half of them or more, and the loss of that site leaves half or less. This is why a third site must hold at least one voter. A data-bearing witness is the smallest form of that third site: it holds one voter, so [1, 1, 1] passes the check, and it holds a replica as well, so it also counts toward min.insync.replicas.

An empty slice returns true. There is no site to lose, so the condition holds for every site of the empty set.

The preconditions bound the slice at 1024 sites and each site at 1024 voters. The total is then 1048576 at most, and 2 * total cannot overflow.