Starting in 4.0 we do recovery at startup (for everything but the oplog) by replaying the oplog instead of by journaling. However this is not done by default if a replica set member is started standalone, so we can lose committed writes in this case. Restarting a replica set member standalone is a common documented maintenance procedure, so losing committed writes in this case seems possibly problematic. This is also a change in behavior from 3.6.

There is an undocumented parameter to do oplog replay when started as standalone; suggest that this should be enabled by default.