Yeah, I think that would be a reasonable alternate approach. It's not really "safer", though. None of the replicas are guaranteed to have all of the messages t

Yeah, I think that would be a reasonable alternate approach. It's not really "safer", though. None of the replicas are guaranteed to have all of the messages that reached the old leader (some of those might never have been replicated anywhere). So clients that didn't receive acknowledgements might need to retry on the new leader, no matter what. Since the clients have to have retry logic anyway, there's no safety issue with discarding some of the messages that weren't yet acknowledged. Your suggestion would try to minimize the number of necessary retries, but at the cost of adding delay and complexity to the leader election process.