It looks like there is a case where we need both a donor and recipient TenantMigrationAccessBlocker. This is when we do a successful migration of A->B, then immediately (before the garbage collection period has elapsed) do a migration of B->C. The migration B->C currently would fail due to conflicting migration errors (until after the garbage collection period). We can handle this by
- Immediately GCing the recipient mtab (but this opens up old reads)
- We could instead replace the recipient mtab with a donor mtab (with a special flag?) that also block old reads
- Combining the two access blockers
- Allowing both to exist simultaneously
But before we do any of these, we should confirm with Cloud on whether this is something Cloud is expected to do.