Move a session to another region without a gap

When a region degrades, sessions must move to a healthy one. A move that copies state without fencing can leave two regions both believing they own the same session, and a delayed message from the old region then lands on the new one.

Carry the state, then confirm

Move the session state to the target first, confirm the target can serve the next turn, and only then release the old region.

Fence the old owner

Give the new region a token the old one cannot hold. Any message carrying the old token is rejected, so a straggler cannot act on a session it no longer owns.

def failover(session, target, token):
    if not target.can_serve(session):
        return "held"
    session.fence = token
    return "moved"

Drain before retiring

Stop new work in the old region and let in flight turns finish, so a move does not cut a turn in half.