A stock change-stream consumer drops events on replica-set failover. Here's why, and how to build one that doesn't.