The sharding migration commit protocol does not perform a proper 2-phase commit in order to have the minimum possible latency impact in the steady state. Because of this, the following theoretical sequence of events is possible:

• The current primary of a shard is just about to commit migration against the config server
• A new primary is elected, which refreshes from the config server before the commit from the previous primary has reached it
• The new primary sees old shardVersion (and as a result also filtering metadata) and incorrectly accepts writes which are supposed to go to a different shard

The RangeDeleter project implemented a command to bump a chunk's shard version and also added a check for chunk version equality as part of the migration commit. We should package that logic into an asynchronous task and make sure that forceFilteringMetadataRefresh executes that recovery logic before accepting the shardVersion returned from the config server.