We cannot rely on primary-only service recovery because recipient shards may choose to read from a donor shard secondary and so secondaries need to re-pin their oldest_timestamp too. Dan Gottlieb suggested a home for where to add this to startup:

https://github.com/mongodb/mongo/blob/f36403d9057c00586489a8c688f8faaa602f8d2e/src/mongo/db/mongod_main.cpp#L496-L498

You should be able to read from collections internally prior to that line at startup. My patch (I just added a new patchset) should keep the oldest timestamp pinned until that line. So if you add a pin prior to the call, it should be obeyed.