Right now the split donor waits for blockTimestamp to get applied on all recipient nodes, then sends the splitConfig.

I think the donor should also wait for blockTimestamp to become majority committed in the donor set before sending the splitConfig.

Otherwise the donor could fail over and the new donor primary can choose a new blockTimestamp and try waiting for it to get applied on all recipient nodes, but the recipient nodes are already gone. The donor may hang or abort the split in this case today.