Moving a Live Connection Between Kernels Without the Client Noticing

A long-lived WebSocket or proxy tunnel dies every time the infrastructure under it deploys, and the usual answer is to make the client rebuild it. The other answer is to move the connection: pick up an established socket with its TCP sequence state, its TLS keys and its half-parsed frame, and put it down inside a different process, pod, or kernel. This is the theory of how that works, the practice of doing it on Linux, and the measurements that killed three of our original assumptions, including what a frozen socket really does when you think it has gone silent.