If the query model ("read model") is stored in a full-fledged transactional database, normally you do not have to care about such things, because "reparing a corrupted read model" should be possible by the backup/restore mechanism of your database. So lets assume this is not the case (maybe you backup your read model only once per night), whilst your command model is fully backuped (maybe in some kind of sequential log). This means a repair of the read model will be include a restore from the latest backup and afterwards executing the commands from the command model. (Note that transactional database internally work with a transaction log which works exactly like that, allowing you to restore your "read model" up to the point immediately before a system crash).
I am not an expert on CQRS, but when I understood that concept right, there is a time lag to expect between the state of the data in the "query model" (which you call "read model") and the state of the data implied by the command model. So your system should be able to handle eventual consistency anyway, which is what you have to deal with when choosing an asynchronous repair process. Therefore, option 2 is a viable solution, as well as option 1.
The difference is that option 2 might bring your system faster on-line back again after a corruption of the read model, for the price of a bigger time lag until the query model and the command model are in-sync again. Option 1 will block your system during the repair process, but when the system goes on-line again, the consistency time lag between the two models is (hopefully) much smaller.
So what you pick depends on the acceptable trade-off between availability and consistency for the particular system, and how much time the actual "repair process" for the system will take. The latter will also depend on speed of the backup/restore process of the databases involved, the amount of data to process, the number of users, the traffic involved, and so on.