It looks like there is a case where we need both a donor and recipient TenantMigrationAccessBlocker.  This is when we do a successful migration of A->B, then immediately (before the garbage collection period has elapsed) do a migration of B->C.  The migration B->C currently would fail due to conflicting migration errors (until after the garbage collection period). We can handle this by

1. Immediately GCing the recipient mtab (but this opens up old reads)
   • We could instead replace the recipient mtab with a donor mtab (with a special flag?) that also block old reads
2. Combining the two access blockers
3. Allowing both to exist simultaneously

But before we do any of these, we should confirm with Cloud on whether this is something Cloud is expected to do.