A leader and two asynchronous followers, F1 (200ms behind) and F2 (4s behind, slow disk). The leader accepts a write and crashes one second later with no time to ask it anything. Which follower do you promote, what happens to the last write, and what has to be true before the old leader can rejoin?

Promote F1 — 200ms of lag means it's missing at most the last 200ms of writes, while F2 at 4 seconds is missing far more. But "safer" isn't "safe": the write accepted one second before the crash almost certainly isn't in F1's log either, since F1 was 200ms behind at the moment of the crash, so anything written in the roughly 800ms before that is also missing from F1 — that write is gone, permanently, the moment F1 starts accepting new writes. This is the deliberate trade asynchronous replication makes: lower write latency in exchange for exactly this durability gap. Before the old leader can rejoin, it has to be fenced — prevented from acting as a leader again with data F1 doesn't have — otherwise you get split brain, two nodes both believing they're the source of truth.