I found that tenant_migration_donor_op_observer.cpp (shared by MTM protocol and shard merge) doesn’t register onRollback hook  (to release Servereless lock and uninstall mtab) on secondaries with the following argument.

            // onRollback is not registered on secondaries since secondaries should not fail to
            // apply the write.

And,  that’s completely not true. On secondaries, if the WriteUnitOfWork(WUOW) fails with WriteConflictException (WCE), we would retry the WUOW (see here). In case of other failures, secondaries don’t retry the WOUW, instead we would crash the server.

So, if the secondaries  retry applying the insert state doc oplog entry due to WCE,  it  will try to reacquire the Serverless lock and would crash the server due to this invariant failure.  The fix will be to register onRollback() hook even for secondaries. This is a problem for MTM (multi-tenant migration) , merge and split.