Tenant access blockers are installed on all donor nodes prior to executing a split operation. These access blockers are eventually removed from the recipient when the recipient primary steps up and deletes the state document. However, it's possible that requests are rerouted to the recipient before it has had a chance to delete the state document, so we should remove the access blockers as soon as we successfully apply the recipient config.