Before the recipient in a tenant migration can return success for a recipientSyncData command that includes a returnAfterReachingDonorTimestamp (set to the blockTimestamp by the tenant migration donor), it must guarantee its logical clock has durably advanced to at least that timestamp (i.e. written an oplog entry with a timestamp >= returnAfterReachingDonorTimestamp). This guarantee should apply across failovers.