The oplog fetcher always appends afterClusterTime to the find commands it runs against the primary in a replica set. The task executor it uses does have the LogicalTimeMetadataHook attached, but the hook only attaches $clusterTime to requests if the LogicalTimeValidator is set, which it won't be before a shard server has initialized its sharding state. This allows afterClusterTime reads to be sent without $clusterTime, which I don't think is normally allowed (at least for clients).

This may not be such a problem in practice though, because this is only before sharding initialization, and the fetcher only sends requests to the primary, using an afterClusterTime based off the opTimes it has already fetched, which I believe the primary should always have.

If we decide to change this but still need to send afterClusterTime in every fetcher's find, we may be able to change the LogicalTimeMetadata hook to always send $clusterTime even when the validator isn't enabled, since we don't authenticate times for __system connections anyway, like those between replica set members.