diff --git a/docs/PACKAGE_BOUNDARY_MIGRATION.md b/docs/PACKAGE_BOUNDARY_MIGRATION.md
index 32ef7a84c..75a419892 100644
--- a/docs/PACKAGE_BOUNDARY_MIGRATION.md
+++ b/docs/PACKAGE_BOUNDARY_MIGRATION.md
@@ -280,6 +280,8 @@ while the branch is in flight; they do not describe the umbrella repository's
 | `cd9266176` | `gateway/restrouter.go` | `spinifex/ingress/aws/rest` | The REST-JSON router maps method and path to an AWS action and percent-decodes path parameters because ARNs appear in paths, so it is AWS protocol mechanics rather than protocol-neutral HTTP and sits beside `ingress/aws/query`. The exported surface is `Route[H]`, `NewRouter` and `(*Router).Lookup`; pattern parsing stays package-private and tested in place. The Bedrock and EKS route tables and their duplicate-route and completeness assertions stay in `gateway`, which computes the two former helper values inline rather than widening the API. Ingress and gateway tests, the integration and E2E builds, and full preflight passed. |
 | `ba2d59b29` | `gateway/ratelimit.go` | `spinifex/ingress/aws/ratelimit` | Per-IP lockout after repeated failed SigV4 authentication returns AWS `RequestLimitExceeded`, so it is AWS ingress protection. Moved code changes only its package line and the four exports the gateway needs: `MaxFailures`, `Fingerprint`, `TokenDigest` and `Anonymous`; limiter behaviour is unchanged. `gateway` imports it as `authlimit` because it already imports Bluebottle's `ratelimit` throttler. The 14 implementation tests move with the package; the end-to-end gateway tests stay. The session-principal verdict and success-reset tests now read the record table through the lockout boundary instead of the limiter's private fields, and three mutations (success not clearing, double counting, legacy verdict recording) each fail them. Ingress and gateway tests, the integration and E2E builds, and full preflight passed. |
 | — | `cmd/dhcptest`, `cmd/spx-loadgen` | unchanged | Both already conform to ADR-0001's tooling row: the load engine is `internal/testkit/loadgen` and the DHCP probe's shared pieces come from the network domain's `dhcp` package. What remains in each `main` is its own flag parsing and one-off orchestration that nothing else imports, so extracting it would create a package solely to satisfy the directory map. No source change. |
+| `7047f6b36` | — | — | ADR-0002 phase 0: characterization tests pin the ECR control plane as it behaves today before dispatch moves. Full-pipeline tests fix the 400/501 error envelopes, JSON 1.1 content type and `X-Amzn-Errortype`, 413 before dispatch for an oversized body, 503 for stub and composed actions when NATS is down, and authorization before a composed action. Unit tests fix target parsing (dispatch and telemetry agree on every malformed form), the stub and inventory sets, `GetAuthorizationToken` ignoring body-supplied identity, and the action reaching the throttle key, trace span and audit record. Mutation of the target parser, the authorization gate and the audit action each failed the new tests. Test-only; full preflight passed. |
+| `89364c100` | — | `spinifex/ingress/aws/dispatch`, `spinifex/ingress/aws/invariants` | ADR-0002 phase 1: the registration contract. A startup `Builder` validates and seals registrations into an immutable `Registry` keyed by credential-scope service, with aliases, an inventory name, an advisory action resolver, the dispatcher, the error envelope and the operation inventory; `Invocation` carries the bounded request, account, Region, an `AuthorizeFunc` and a lazy `ActorFunc`. It imports only `foundation/aws/errors` and Bluebottle's `iampolicy` condition-key vocabulary, and no domain moved. `TestS4_IngressAWSImportsNoDomainOrRuntimeImplementation` binds ADR-0002 S4 for all of `ingress/aws` and failed on an injected domain import. Contract tests at 100% statement coverage under `-race`; full preflight passed. |
 
 The EC2 contract row is intentionally different from the directory moves: it creates
 a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS