A payments service writes with the driver's default write concern, and after a primary failover, a write the client had already gotten a success response for is gone. What actually happened, and what write concern change closes the gap?

w: 1 (the primary only) acknowledges a write as soon as the primary itself has it — before any secondary has copied it. If the primary fails before a secondary tails the oplog far enough to have that write, and a secondary that never received it wins the election, the new primary genuinely never had the write; when the old primary rejoins the set, it rolls back the write to match the new primary, and it's simply gone, even though the client got a success response for it. w: "majority" closes this gap because it doesn't acknowledge until a majority of voting members have the write in their own oplog — and a write a majority holds is, by construction, a write any newly elected primary (itself needing a majority of votes) must have seen, so it can never be the one thing rolled back.