The donorAbortMigration command works by cancelling a cancellation source that is checked via token in a tenant migration donor's run() future chain. The donor incorrectly uses a token derived from that source when performing its write to enter the committed state and when waiting for that write to majority commit, so a well timed donorAbortMigration can trigger an exception after the commit decision is locally written, leading the donor to write an abort decision, which triggers an invariant in the op observer that processes the abort write, because the commit decision cannot be made twice.