When a shard1 had a failover, the first connection to newly elected primary told it that it was a different shard (shard2). After that it no longer would accept connections from other mongos telling it that it's shard1.

Would be nice if mongod could validate what mongos passes it, which would mean a stray confused mongos will not be able to even connect to mongod successfully if its view of hostnames/etc. is not the same as reality.