If the recipient fails over before it finishes writing all the oplog entries, the recipient can just throw out its oplog buffer and run the aggregate query again. This is acceptable because the amount of work the recipient will throw out is small compared to the total work for the migration, and failover is relatively rare.