This comment is misleading and it's not entirely true. We create recipient tenant access blocker at the start of the migration (i,e state doc state is 'kStarted') and not just after the cloning phase completes. But, if the recipient primary receives a recipientForgetMigration before recipientSyncData cmd, we start the instance with state as kDone to avoid creating unnecessary access blocker for the tenant. In such cases, mtab might not present for the tenant while deleting that state document.