Steps:

1. Migration initiated.
2. Migration cloneLocs phase complete.
3. Destination finished cloning.
4. New write comes in.
5. New write passes shard version check inside the OpObserver hook.
6. MigrationSourceManager::enterCriticalSection.
7. Donor sends commit command to destination.
8. Destination sends _transferMods and gets an empty response, so it is ready to cleanup and complete the destination side of the migration.
9. Doc _id of write is stored in transferMods buffer.
10. New write returns success.

I believe the problem is because when we enter the critical section, we take IS lock on the ns:

https://github.com/mongodb/mongo/blob/r3.4.0-rc2/src/mongo/db/s/migration_source_manager.cpp#L246

That means that it can run in parallel with the new write that came in since it is compatible with IX.