fix: update paths left stale by the package moves

The MariaDB image stamp test read the RDS engine from
handlers/rds/engine_mariadb.go, so test-images failed in CI; it now reads
domains/rds/engine/mariadb.go. Comments citing moved files now name
their new locations.

scripts/images/rds-mariadb/rds-engine-stamp_test.sh

@@ -13,7 +13,7 @@ set -eu
 SCRIPT_DIR=$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)
 REPO_ROOT=$(CDPATH='' cd -- "${SCRIPT_DIR}/../../.." && pwd)
 ENGINE="mariadb"
-ENGINE_GO="${REPO_ROOT}/spinifex/handlers/rds/engine_mariadb.go"
+ENGINE_GO="${REPO_ROOT}/spinifex/domains/rds/engine/mariadb.go"
 
 FAILS=0
 fail() { echo "FAIL: $*" >&2; FAILS=$((FAILS + 1)); }

spinifex/daemon/daemon_test.go

@@ -1685,7 +1685,7 @@ func TestInstanceCleanerAdapter_DeleteVolumes_NonBootNonDoTVolumeDetachedNotDele
 // go-forward self-heal: a stopped-terminate that stamped
 // Teardown[volumes]=failed on a transient error (deleteInstanceVolumes,
 // domains/ec2/instance/service_impl.go) is retried by
-// TerminatedTeardownReaper.Sweep (vm/teardown_reaper.go) through the real
+// TerminatedTeardownReaper.Sweep (runtime/compute/vm/teardown_reaper.go) through the real
 // instanceCleanerAdapter, which stage 1 rerouted through
 // DeleteVolumeOnTerminate. The retry clears the stale attachment, the delete
 // now succeeds, and the mark flips to done — without abandoning the record.

spinifex/daemon/gpu_pool_reconciler.go

@@ -23,7 +23,7 @@ var gpuPoolLiveStates = map[vm.InstanceState]bool{
 
 // gpuPoolReconciler frees GPU pool entries whose owning instance is absent
 // or has settled in a terminal, non-running state. It is the backstop for
-// the synchronous release in vm/crash_recovery.go: a node-down mid-cascade,
+// the synchronous release in runtime/compute/vm/crash_recovery.go: a node-down mid-cascade,
 // or any other gap that skips the synchronous release, would otherwise leak
 // the slot forever, since nothing else reclaims it. Node-local vm.Reaper run
 // by the GarbageCollector backstop, mirroring eniReconciler.

spinifex/daemon/state_test.go

@@ -1384,7 +1384,7 @@ func TestMarkInstanceFailed_AlreadyTerminated(t *testing.T) {
 
 // LaunchTime reset for restored instances (Pending and Provisioning) is
 // covered deterministically by classifyRestoredInstances tests in
-// vm/restore_test.go. The previous daemon-side test went through the full
+// runtime/compute/vm/restore_test.go. The previous daemon-side test went through the full
 // Restore() pipeline including async relaunchAll → MarkFailed cleanup,
 // which made the post-restore state racy: the instance might or might not
 // be in the local map by the time the test ran assertions, and a t.Skip

spinifex/daemon/vm_adapters_invariants_test.go

@@ -13,8 +13,8 @@ import (
 
 // TestUnmountNeverReleasesBootVolume locks the stop/crash attachment-persistence
 // contract: Unmount seals the block map but must NOT mark a boot/root volume
-// "available". Unmount is driven by stop (vm/shutdown.go) and crash recovery
-// (vm/crash_recovery.go), where the instance keeps its attachment and restarts —
+// "available". Unmount is driven by stop (runtime/compute/vm/shutdown.go) and crash recovery
+// (runtime/compute/vm/crash_recovery.go), where the instance keeps its attachment and restarts —
 // only DetachVolume and terminate release a boot volume. Releasing it here while
 // the instance still owns it splits the volume-state record (describe-instances
 // "attached" vs describe-volumes "available"). EFI is not a

spinifex/domains/acm/service_impl_test.go

@@ -320,7 +320,7 @@ func TestDescribeCertificate_DoesNotLeakPrivateKey(t *testing.T) {
 // Precedent: TestSensitiveDataNotLogged_MasterKey in
 // handlers/iam/service_impl_test.go.
 // fakeCertAuthority is a minimal CertAuthority for testing RequestCertificate's
-// PRIVATE_CA path without the real tenant CA implementation (handlers/acm/privateca.go
+// PRIVATE_CA path without the real tenant CA implementation (domains/acm/privateca.go
 // lives on a separate branch).
 type fakeCertAuthority struct {
 	permitted map[string]bool
@@ -465,7 +465,7 @@ func TestRequestCertificate_PrivateCA_IssuesSynchronously(t *testing.T) {
 }
 
 // TestRequestCertificate_PrivateCA_RealTenantCA_IssuesAndChains exercises the
-// PRIVATE_CA path against a real *TenantCA (handlers/acm/privateca.go), not
+// PRIVATE_CA path against a real *TenantCA (domains/acm/privateca.go), not
 // fakeCertAuthority above — this is what daemon wiring actually plugs in, and
 // the daemon-wiring slice adds no coverage for the seam between
 // RequestCertificate and the real implementation without a test like this one.

spinifex/domains/ec2/instance/service_impl.go

@@ -2864,7 +2864,7 @@ func (s *InstanceServiceImpl) deleteInstanceVolumes(ctx context.Context, instanc
 
 	// Tracks whether every DeleteOnTermination volume was actually deleted, so
 	// Teardown[vm.TeardownVolumes] below mirrors markTeardownResult's
-	// done/failed semantics (vm/teardown.go) — the same mark the
+	// done/failed semantics (runtime/compute/vm/teardown.go) — the same mark the
 	// running-instance path already stamps via terminateCleanup. Without this,
 	// TerminateStoppedInstance never touches Teardown at all, so
 	// daemon.leakedVolumeInstances() and VolumeLeakReaper can never see a

spinifex/domains/ec2/instance/service_impl_test.go

@@ -1986,7 +1986,7 @@ func TestTerminateStoppedInstance_UserVolumeDeleted(t *testing.T) {
 // TestTerminateStoppedInstance_StampsTeardownVolumesDone locks the
 // fix: TerminateStoppedInstance must stamp Teardown[vm.TeardownVolumes] on
 // success, mirroring the running-instance path's markTeardownResult
-// (vm/shutdown.go). Without this, daemon.leakedVolumeInstances() and
+// (runtime/compute/vm/shutdown.go). Without this, daemon.leakedVolumeInstances() and
 // VolumeLeakReaper can never see a stopped-path leak because
 // TerminateStoppedInstance previously never touched Teardown at all.
 func TestTerminateStoppedInstance_StampsTeardownVolumesDone(t *testing.T) {

spinifex/domains/network/topology/dhcp_options.go

@@ -52,7 +52,7 @@ func SubnetMTU(underlayMTU int, ipsecEnabled bool) int {
 // by the live manager and reconciler to prevent dns_server drift. IMDS is not
 // steered via option 121: a guest either routes to it via the gateway, where the
 // br-imds ingress demux catches it, or resolves it on-link, where the per-tap ARP
-// responder answers. Both live in network/host/imds_datapath.go.
+// responder answers. Both live in domains/network/host/imds_datapath.go.
 func BuildSubnetDHCPOptions(gwIP, routerMAC, dnsServer string, underlayMTU int, ipsecEnabled bool) map[string]string {
 	return map[string]string{
 		"server_id":  gwIP,

spinifex/handlers/elbv2/cert_inuse_test.go

@@ -497,7 +497,7 @@ func TestACMReimport_FansOutToInUseLoadBalancer(t *testing.T) {
 // final set contains exactly all N — lives at the store layer, where the
 // property actually belongs: see
 // TestAddInUseBy_ConcurrentDistinctResourcesAllSurvive in
-// handlers/acm/store_test.go. An earlier version of this test asserted only
+// domains/acm/store_test.go. An earlier version of this test asserted only
 // "no errors/panics" across a concurrent re-import/ModifyListener race,
 // which cannot detect a lost index entry: a dropped update produces a
 // correct-looking record with a missing entry, not an error, so that

spinifex/operator/imagecatalog/images.go

@@ -605,7 +605,7 @@ var AvailableImages = map[string]Images{
 		ChecksumType: "sha256",
 		// Ubuntu 26.04 is built GPT/EFI-only; legacy BIOS finds no bootable MBR
 		// bootloader and hangs at firmware with zero serial output (no OVMF/pflash
-		// is attached unless BootMode is uefi/uefi-preferred, see vm/lifecycle.go).
+		// is attached unless BootMode is uefi/uefi-preferred, see runtime/compute/vm/lifecycle.go).
 		BootMode: "uefi",
 		Tags:     map[string]string{"spinifex:managed-by": "eks", "gpu-vendor": "nvidia"},
 	},
@@ -642,7 +642,7 @@ var AvailableImages = map[string]Images{
 		ChecksumType: "sha256",
 		// Ubuntu 26.04 is built GPT/EFI-only; legacy BIOS finds no bootable MBR
 		// bootloader and hangs at firmware with zero serial output (no OVMF/pflash
-		// is attached unless BootMode is uefi/uefi-preferred, see vm/lifecycle.go).
+		// is attached unless BootMode is uefi/uefi-preferred, see runtime/compute/vm/lifecycle.go).
 		BootMode: "uefi",
 		Tags:     map[string]string{"spinifex:managed-by": "ecs", "gpu-vendor": "nvidia"},
 	},

spinifex/runtime/compute/vm/volume_state_account_test.go

@@ -27,7 +27,7 @@ const stateAccountID = "000000000042"
 // that does not exist and leaves the attachment record stranded. These tests
 // are the only thing asserting that argument.
 
-// TestAttachVolume_KeysStateOnTheInstanceAccount covers vm/volumes.go:190.
+// TestAttachVolume_KeysStateOnTheInstanceAccount covers runtime/compute/vm/volumes.go:190.
 func TestAttachVolume_KeysStateOnTheInstanceAccount(t *testing.T) {
 	qmpClient, cancel := newMockQMPClient(t, func(cmd qmp.QMPCommand) map[string]any { return nil })
 	defer cancel()
@@ -51,7 +51,7 @@ func TestAttachVolume_KeysStateOnTheInstanceAccount(t *testing.T) {
 }
 
 // TestAttachVolume_RollbackKeysStateOnTheInstanceAccount covers the rollback at
-// vm/volumes.go:213, which runs after device_add fails and is the path that
+// runtime/compute/vm/volumes.go:213, which runs after device_add fails and is the path that
 // would silently leave a volume stuck in-use if it wrote to the wrong key.
 func TestAttachVolume_RollbackKeysStateOnTheInstanceAccount(t *testing.T) {
 	qmpClient, cancel := newMockQMPClient(t, func(cmd qmp.QMPCommand) map[string]any {
@@ -85,7 +85,7 @@ func TestAttachVolume_RollbackKeysStateOnTheInstanceAccount(t *testing.T) {
 	assert.Equal(t, "available", calls[1].State)
 }
 
-// TestDetachVolume_KeysStateOnTheInstanceAccount covers vm/volumes.go:444.
+// TestDetachVolume_KeysStateOnTheInstanceAccount covers runtime/compute/vm/volumes.go:444.
 // Detach only logs an UpdateVolumeState failure, so a wrong account here leaves
 // the document reading in-use with no disk in the guest and no error anywhere.
 func TestDetachVolume_KeysStateOnTheInstanceAccount(t *testing.T) {

spinifex/runtime/roles/qemunbdd/provider.go

@@ -402,7 +402,7 @@ func (p *Provider) ExpandVolume(ctx context.Context, req ebsprovider.ExpandVolum
 	if req.CapacityRange.RequiredBytes < info.VirtualSize {
 		return nil, fmt.Errorf("%w: volume expansion is grow-only", ebsprovider.ErrInvalidArgument)
 	}
-	// ebsprovider/errors.go has no failed-precondition sentinel, so a
+	// providers/ebs/errors.go has no failed-precondition sentinel, so a
 	// published volume this provider cannot expand online is reported as
 	// ErrVolumeInUse, matching memory.go's identical refusal.
 	if _, published := p.published[req.VolumeID]; published && req.CapacityRange.RequiredBytes > info.VirtualSize {

spinifex/runtime/roles/spinifexui/frontend/src/types/rds.ts

@@ -1,7 +1,7 @@
 import type { ApplyMethod } from "@aws-sdk/client-rds"
 import { z } from "zod"
 
-// Mirrors handlers/rds/validate.go and handlers/rds/engine.go so the form
+// Mirrors handlers/rds/validate.go and domains/rds/engine/engine.go so the form
 // rejects what the backend would reject, before the round trip. Engines,
 // versions and instance classes are deliberately absent: those are read from
 // DescribeDBEngineVersions and DescribeOrderableDBInstanceOptions.
@@ -554,7 +554,7 @@ export type CreateDBParameterGroupFormData = z.infer<
   typeof createDBParameterGroupSchema
 >
 
-// handlers/rds/paramcatalog.go. A static parameter is adopted by a restart; a
+// domains/rds/engine/parameters.go. A static parameter is adopted by a restart; a
 // dynamic one by a reload.
 export const APPLY_TYPE_STATIC = "static"
 export const APPLY_METHOD_IMMEDIATE = "immediate" satisfies ApplyMethod

tests/integration/ecr_test.go

@@ -23,7 +23,7 @@ func uniqueRepo(prefix string) string {
 
 // TestECRControlPlane round-trips the ECR control-plane surface: repository
 // CRUD, repository policy, and lifecycle policy. All of it dispatches to
-// ECRRegistry.Meta over NATS (gateway/ecr_createrepository.go and friends), so
+// ECRRegistry.Meta over NATS (domains/ecr/awsapi/create_repository.go and friends), so
 // this needs StartECRDaemonLite subscribed before any call.
 func TestECRControlPlane(t *testing.T) {
 	gw := StartGateway(t)