In the event of a replica set failover, if a hidden secondary is more current that the visible secondaries, one of the visible secondaries will not be immediately elected primary, but will instead catch up to the hidden secondary before one of them is elected primary.

The same is true for a secondary with priority of 0, even if not hidden.

This behaviour is implied, but not spelt out explicitly, in the Replication Internals - Elections documentation:

A member of the set will veto an election under the following conditions:

• <snip/>
• If the member seeking an election is not up-to-date with the most recent operation accessible in the replica set.

It warrants explicit mention, however, as users could easily incorrectly assume that the behaviour is otherwise: that the visible secondary becomes primary immediately and hence data is lost (data that the hidden secondary had and the visible secondary did not).

I suggest documenting it in the following pages:

• Replication Internals - Elections
• Replica Set Administration - Troubleshooting - Failover and Recovery