StorageRepairObserver::onRepairDone calls StorageRepairObserver::_invalidateReplConfigIfNeeded , which writes out a document and then calls waitUntilDurable(). We must hold a lock for the data write, but should not for the waitUntilDurable() call, as we are trying to add an invariant against holding locks for a potentially long I/O call in waitUntilDurable() in SERVER-39591.

repairDatabasesAndCheckVersion currently holds a global exclusive lock across all of its work. Perhaps elevate the waitUntilDurable() call to the repairDatabasesAndCheckVersion level, or even a level higher, somehow, outside the lock or while the lock is momentarily released.