Shard merge stores the list of donor tenants to be migrated in R state document. So, on node restart and rollback, the recovery procedure builds the in-memory tenant access blocker for each tenant listed in the state document.