In 2.0.x, oplog entries are applied one at a time on each secondary. Thus, on a restart after a shutdown, only a single op can be applied twice. In 2.2.0, ops are applied in batches, so on a restart, potentially all the ops in the last batch can be reapplied. There are certain sequences of ops that violate idempotency guarantees needed to insure proper replication. In 2.2.0, if we detect such a sequence, the secondary halts replication and shuts down, unable to come back online.