We cannot rely on primary-only service recovery because recipient shards may choose to read from a donor shard secondary and so secondaries need to re-pin their oldest_timestamp too. Dan Gottlieb suggested a home for where to add this to startup:
You should be able to read from collections internally prior to that line at startup. My patch (I just added a new patchset) should keep the oldest timestamp pinned until that line. So if you add a pin prior to the call, it should be obeyed.