The current implementation of the shardCollection command enters the critical section, creates the configuration entry to the config server, then leaves the critical section.

Between the collections creation and release of the critical section events, the newly created collection could be taken into account by the balancer (moveChunk command) which would not be able to enter the critical section.

A possible solution consists in creating the collection entry with the allowMigrations flag set, then unset it with the _configsvrSetAllowMigrations once the critical section is left. Note this flag must be unset in a phase of the shardCollection that is resilient to stepdown/shutdown.