Here's probably the most important thing everyone should know before using the migration toolkit: you must add accout the toolkit will be running under into the TFS Service Accounts group. Here's the command for doing that:

 tfssecurity.exe /server:http://yourserver:8080 /g+ srv: domain\account

Work items synchronization disables validation of rules when updating the TFS side, and this works only for members of the Service Accounts group. We're trying to recreate history of changes from the opposite side, and validating these changes against the most recent work item type definition is not the best thing to do here.