Tenant migration donor instances own several promises which can be set either by the instance's main run() chain or when interrupted on stepdown/shutdown. To avoid double setting a promise, wherever each promise is set, the donor should have locked its mutex.