Currently tenant migration donor instances will retry commands that fail against the donor if they failed with certain error codes, so an unexpected code will lead the donor to stop retrying. This should be safe because either the command will fail before having made the decision to commit, so the donor can safely abort, or the command will fail during the forget migration logic, which leads the proxy to enter the CLEANUP_FAILED state and notify an operator. For an innocuous error (which I assume an unexpected code is likely to be), this can lead to throwing away a lot of work or unnecessarily requiring manual intervention, so instead the donor should invert its retry logic to always retry except for certain error codes known to be non-retryable.