diff --git a/docs/PACKAGE_BOUNDARY_MIGRATION.md b/docs/PACKAGE_BOUNDARY_MIGRATION.md
index 2f040a4c1..bc1fa025e 100644
--- a/docs/PACKAGE_BOUNDARY_MIGRATION.md
+++ b/docs/PACKAGE_BOUNDARY_MIGRATION.md
@@ -257,6 +257,7 @@ while the branch is in flight; they do not describe the umbrella repository's
 | `2c467988d` | `spinifex/handlers/bedrock` | `spinifex/domains/ochre` | Ochre is the platform service and owns model serving placement, launch, readiness, capacity and reaping; the Bedrock name now marks only the AWS API surface, per the amended ADR-0001 map row. Package renamed from `handlers_bedrock` to `ochre`, callers drop the alias, and KV bucket names, NATS subjects, metric names and error strings keep their `bedrock` names. The comment in the shipped `bedrock-serve` image script still names the old path because editing it changes image build input. Full preflight apart from the known govulncheck finding, focused Ochre, vector, Bedrock gateway, daemon, account teardown, awsgw, config and CLI tests, and tagged integration/E2E compilation passed. |
 | `93f101c0f` | `spinifex/handlers/ochrevector` | `spinifex/domains/ochre/vector` | The tenant vector store (pgvector backend, KV index registry, ingest, jobs, backup and appliance orchestration) is Ochre domain state and now sits under the Ochre domain as the ADR-0001 map requires. Package renamed from `handlers_ochrevector` to `vector` with its existing package comment; callers use the `ochrevector` alias because `vector` is a common local identifier in the gateway, daemon and CLI. Error strings keep their `ochrevector:` prefix. The service-interface manifest names the new path. Full preflight apart from the known vulnerability-scan finding, focused Ochre, gateway, daemon, awsgw and CLI tests, tagged integration/E2E compilation and the manifest check passed. |
 | `2b6131e21` | `spinifex/gateway/bedrock/hfhub` | `spinifex/domains/ochre/hfhub` | The Hugging Face Hub client resolves and streams model weights for Ochre and has no dependency on the rest of `gateway/bedrock`; its only caller is `spx admin ochre` weights pull. Package name unchanged. The rest of `gateway/bedrock` is not moved: it holds Ochre domain state, stores and the inference engine alongside the Bedrock action layer, and `domains/ochre` imports it, so moving it to `domains/ochre/awsapi` would invert the domain-to-adapter direction. It is recorded as dependency-rule debt. Full preflight apart from the known vulnerability-scan finding, focused hfhub and CLI tests, and tagged integration/E2E compilation passed. |
+| `40964815b` | `spinifex/utils` (`MergeTagsMut`, `ApplyTagRemovals`, `RemoveTagsMut`, `UpdateKVRecordTags`, `MirrorKVRecordTags`) | `spinifex/domains/ec2/tagmirror` | EC2-wide AWS tag mutation over resource KV records is EC2 domain behaviour and imports only foundation packages. The EC2 tags resource package was not used because it imports the instance, key and VPC resources that call these helpers, which would create a resource-to-resource cycle. Twelve EC2 resource packages now call `tagmirror`; a stale `utils.ParseNBDURI` comment in the VM device code now names `nbd.ParseNBDURI`. Full preflight apart from the known vulnerability-scan finding, focused EC2, utils and VM tests, and tagged integration/E2E compilation passed. |
 
 The EC2 contract row is intentionally different from the directory moves: it creates
 a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS
@@ -328,10 +329,11 @@ These residuals were recorded by individual slices and must be resolved once the
 - `domains/dns`: imports `runtime/compute/vm` (domain-to-runtime), `network/reconcile` for the reconcile lock and `bootstrap/config` for node configuration.
 - ACM: the IAM AES-GCM helper import and gateway-owned action dispatch (ACM relocation residuals).
 - `runtime/roles/awsgw`: the quota reconcile loop belongs to `domains/admission/quota`, and the EKS token-verify responder belongs with STS or EKS identity.
-- `utils`: `vpcd_event.go` (vpcd request/ack protocol and NAT helpers) awaits a network contract, `ec2_subject.go` awaits an EC2 contract, and `encryption.go` and `tagmirror.go` await the EC2/EBS slices.
+- `utils`: `vpcd_event.go` (vpcd request/ack protocol and NAT helpers) awaits a network contract, `ec2_subject.go` awaits an EC2 contract, and `encryption.go` (the Viperblock master-key loader) awaits a Viperblock adapter owner, since `providers/ebs` is provider-neutral.
 - `runtime/compute/cache.New`: two construction-time panics carry a lint exemption pending a constructor that returns an error.
 - `domains/ec2/systeminstance`: managed-service parent metadata is only the `ManagedBy` tag value.
 - `gateway/bedrock`: holds the Ochre domain core (model catalogue, provisioned throughput, guardrail, access, credential, usage, price, logging and weights stores), the inference engine (provider, vLLM, Anthropic, embeddings, reranker, admission) and the Bedrock action layer in one package with internal cycles. `domains/ochre` imports it, which is the ADR step 7 Ochre gateway import. Splitting it needs a plan: domain core and stores to `domains/ochre/<resource>`, inference to an Ochre-owned package, and only the action layer to `domains/ochre/awsapi`. The top-level `gateway/bedrock*.go` HTTP handlers additionally wait for the ingress registration seam.
+- `spinifex/migrate`: the KV engine already lives in `foundation/state/migrate`, but the remaining config-file and object-store migration engine is not a move into it. It is an operator upgrade concern used only by `spx admin upgrade`, both packages define `Registry`, `NewRegistry` and `DefaultRegistry` with distinct registry models, and its object migrations would give foundation a dependency on `providers/objectstore`. Its eventual owner is deferred; no subpackage is created to satisfy the directory map.
 
 ## Recording rule