I've been stopping and starting my mongod and this time after shutting it down successfully on startup it told me there was bad checksum in one of the collection files.

WiredTiger will run recovery any time it is started with a journal enabled. If the preceding shutdown was clean, and used the journal, recovery will be a noop. If the preceding shutdown did not use a journal, but an old log still exists, then I think recovery could overwrite changes made while the journal was disabled.

My concern is that when WiredTiger writes a checkpoint, it records the current position in the log (a "log sequence number" or LSN). When the journal is disabled, we don't have an LSN to record, so after a restart with the journal enabled, I think we could be running recovery when we don't want to.

WiredTiger doesn't attempt to drain the logs (what WT calls "log archive") if the journal is disabled. A simpler fix for this issue would be to record a special LSN for checkpoints if the journal is disabled, and skip recovery if we see that LSN when restarting with a journal enabled.