From kCommitStart onward, the migrate thread may be inside acquireRecoverableCriticalSectionBlockWrites. Cancelling the opCtx there interrupts the acquisition mid-flight and leaves a stale recovery document. The donor then loops indefinitely retrying _recvChunkReleaseCritSec, which always fails with "Recipient migration recovery document still exists.

The previous guard (_state < kEnteredCritSec) was too wide. Tighten to _kCommitStart.