The design introduced a new transaction type specifying which secondary node had a right to take a snapshot, along with a wall-clock timeout by which the snapshot must be completed or the secondary abort the snapshot process. I worried about two aspects in particular: primary failure during an active snapshot lease, and new nodes being rehydrated & joining consensus using the same snapshots generated by this process that itself used consensus to generate the snapshots.