Flip the Stable Addresses of a Move that carries no data #667

Part of #324.

What to build

A Move with no method, that is a stateless Application changing namespace or Project, resolves and renders its source and target Instances, but no step Jobs (#335, #334). So nothing performs its flip: updating the Stable Addresses (<app>-<surface> ExternalName Services in estate-system) to point at the target.

Decide which image runs the flip for a Move with no method, and render a flip Job (and a reverse Job if the Move is reversible) for it, run as <process>-move with the same resourceNames-scoped Role the method-based Move uses.

Options to weigh:

• a small flip image published by the delivery repo and locked like any other;
• the Release Gate performing the flip itself, so no Job is rendered.

Acceptance criteria

• A stateless Move renders a step that flips its Stable Addresses, or the spec says who performs the flip instead.
• Chapter 55's step list and the worked example cover it.
• npm run verify passes.

Blocked by

• Move an Application between Projects by declaring it in the new one first #334

Decisions (the maintainer, 2026-10-27)

• A flip image flips every Move. The Platform document gains an optional delivery.move.flip: {image: move-flip}. The delivery repo publishes the image, and it is locked in the images lock like any other. Engine method images no longer perform the flip step: chapter 14's method contract, 0095 (rewritten in place) and CONTEXT.md's Move method entry change with it.
• Two Jobs per Move: flip and flip-back, both suspended, both the flip image with the direction as the step, run as <process>-move under the same resourceNames-scoped Role. The gate unsuspends flip-back when a step fails or the timeout expires; the flip Jobs stay the Stable Addresses' only writers.
• A Move with no data is one step, flip. The Release Gate unsuspends it only once the target Instance is ready, reading readiness as it already does for consumers; it still writes nothing but suspend, and the flip Job needs no read Role.
• No flip image declared: a derived Move is E_MOVE_UNSUPPORTED at composition, so a Move that could never finish is never started. The field stays optional, so it is additive.
• When: the first 1.x minor, before any live Move. Not in 1.0.0.

Resume here (updated 2026-10-27)

State: decided, not started.

Next step: after 1.0.0, a spec change (chapters 14, 20 and 55, the flip/flip-back step rows, 0095 rewritten, CONTEXT.md), then the render, then a delivery-repo ticket for the move-flip image.

Blocked by: 1.0.0 (#379).