This story is a bit complicated. There was a bug on 3.6 where change streams could behave incorrectly when used as part of a session. This bug was fixed on 3.6.8 in BACKPORT-3830. Separately, this change committed as part of 4.0.3 relaxes an assertion so that the bug fixed in 3.6.8 has no impact.
The end story is that if you use change streams within a session you will be able to upgrade from any 3.6 version to 4.0.3+ and from any 3.6.8+ version to any 4.0 version, but specifically not from 3.6.7 or earlier to 4.0.2 or earlier.
Feel free to reach out if you have questions!
Engineering Ticket Description:
Starting in 4.0 we validate that if a cursor was opened within a session then each getMore should include the same session id. Unfortunately, on 3.6 versions (up to the one in which
SERVER-34204 is backported, if that happens), there is a known issue where a change stream will not include the lsid. This can cause problems when upgrading to 4.0, when your mongos is old and subject to this bug (which as far as I know doesn't have much of a user impact, maybe just that it doesn't ping the session to keep it alive as frequently?), but the shards will be more strict and cause the operation to fail.
To guard against this unpleasant upgrade scenario, we should only assert the getMore has a matching LSID if the FCV is at least 4.0.