PROPOSED TENANT PLACEMENT CUTOVER REVIEW

Before movement
[ ] Tenant identity is trusted independently of hostname.
[ ] Source and destination identifiers and epochs are recorded.
[ ] Final mutation checks ownership atomically.
[ ] A stale router and a resumed source worker cannot bypass the guard.
[ ] The source write-stop and drain completion are observable.
[ ] Final data position and verification criteria are agreed.
[ ] One coordinator owns the transition; conflicting commands are rejected.

Activation
[ ] Source stays fenced while destination receives the next epoch.
[ ] Directory changes only after destination readiness is established.
[ ] Repeated activation requests converge on the same transition.

Abort and return
[ ] Abort is permitted only before destination accepts mutations.
[ ] After destination writes, reconciliation precedes a new ownership transition.
[ ] Cached-route behavior and expiry during a control-plane failure are documented.

This is a review artifact, not a tested migration implementation.