Found it. NATS health check was set to 60s instead of 10s so the failover never triggered. Patching now.
$ ssh nats-secondary.blackroad.io
$ nats-server --signal reload
Reloading config...
Health check interval: 60s -> 10s
Cluster reconnection initiated: 8/12 agents recovered