What POST /v1/workspaces/{id}/migration/confirmation is being asked about.
The destination, and not the origin. The gateway reads the origin from the catalog; a caller that named it could name a stale one, and a token bound to the wrong pair would refuse a move that is perfectly fine.
