Survive primary failover without lost writes or split-brain

An account service writes to a replicated database with async replication and unfenced failover.

The primary crashes at 4.5 ms: unshipped writes are lost (ackedWriteLost) and the old leader briefly accepts writes (splitBrainWrite). Fix both.