refactor: move EC2 compute and storage packages to the EC2 domain

Move handlers/ec2/{instance,volume,snapshot,image,tags} to domains/ec2/<resource>, each named after its directory and imported as ec2<resource>, which empties handlers/ec2. The daemon's e2e suite selection now lists the moved EC2 resource paths in place of handlers/ec2, so EC2-only changes select the daemon suites again.
2026-10-19 10:52:04 +00:00 · 2026-10-07 09:39:09 +10:00
parent 5cd11a9842
commit 5d60184e89
128 changed files with 334 additions and 318 deletions
@@ -49,12 +49,28 @@ services:
    # forwards to vpcd / viperblockd / predastore.
    #
    # Source layout: spinifex/runtime/roles/spinifex (entry), spinifex/daemon
-    # (subscribe registration), spinifex/handlers/{ec2,elbv2,iam} (per-
-    # subject handler bodies). Selector treats all four paths as belonging
+    # (subscribe registration), spinifex/domains/ec2/<resource> and spinifex/handlers/{elbv2,iam} (per-
+    # subject handler bodies). Selector treats these paths as belonging
    # to this service via the `additional_paths` field.
    additional_paths:
      - spinifex/daemon
-      - spinifex/handlers/ec2
+      - spinifex/domains/ec2/account
+      - spinifex/domains/ec2/eigw
+      - spinifex/domains/ec2/eip
+      - spinifex/domains/ec2/igw
+      - spinifex/domains/ec2/image
+      - spinifex/domains/ec2/instance
+      - spinifex/domains/ec2/key
+      - spinifex/domains/ec2/launchtemplate
+      - spinifex/domains/ec2/natgw
+      - spinifex/domains/ec2/placementgroup
+      - spinifex/domains/ec2/routetable
+      - spinifex/domains/ec2/snapshot
+      - spinifex/domains/ec2/spotinstance
+      - spinifex/domains/ec2/tags
+      - spinifex/domains/ec2/volume
+      - spinifex/domains/ec2/volumestate
+      - spinifex/domains/ec2/vpc
      - spinifex/handlers/elbv2
      - spinifex/domains/acm
      - spinifex/handlers/iam
@@ -73,7 +73,7 @@ func (d *Daemon) buildBedrockServiceDeps() ochre.ServiceDeps {

 // daemonGPUSnapshotter adapts *gpu.Manager to domains/ochre's Snapshot-only
 // capacity-check surface, keeping the gpu package out of that handler package
-// the same way daemonGPUClaimer keeps it out of handlers_ec2_instance.
+// the same way daemonGPUClaimer keeps it out of ec2instance.
 //
 // It holds the daemon rather than the manager because applyGPUConfig swaps
 // d.gpuManager on a passthrough toggle. Capturing the pointer here would leave
@@ -46,13 +46,18 @@ import (
 	ec2eigw "github.com/mulgadc/spinifex/spinifex/domains/ec2/eigw"
 	ec2eip "github.com/mulgadc/spinifex/spinifex/domains/ec2/eip"
 	ec2igw "github.com/mulgadc/spinifex/spinifex/domains/ec2/igw"
+	ec2image "github.com/mulgadc/spinifex/spinifex/domains/ec2/image"
+	ec2instance "github.com/mulgadc/spinifex/spinifex/domains/ec2/instance"
 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/instancetypes"
 	ec2key "github.com/mulgadc/spinifex/spinifex/domains/ec2/key"
 	ec2launchtemplate "github.com/mulgadc/spinifex/spinifex/domains/ec2/launchtemplate"
 	ec2natgw "github.com/mulgadc/spinifex/spinifex/domains/ec2/natgw"
 	ec2placementgroup "github.com/mulgadc/spinifex/spinifex/domains/ec2/placementgroup"
 	ec2routetable "github.com/mulgadc/spinifex/spinifex/domains/ec2/routetable"
+	ec2snapshot "github.com/mulgadc/spinifex/spinifex/domains/ec2/snapshot"
 	ec2spotinstance "github.com/mulgadc/spinifex/spinifex/domains/ec2/spotinstance"
+	ec2tags "github.com/mulgadc/spinifex/spinifex/domains/ec2/tags"
+	ec2volume "github.com/mulgadc/spinifex/spinifex/domains/ec2/volume"
 	ec2vpc "github.com/mulgadc/spinifex/spinifex/domains/ec2/vpc"
 	handlers_ecr "github.com/mulgadc/spinifex/spinifex/domains/ecr"
 	"github.com/mulgadc/spinifex/spinifex/domains/network/external"
@@ -66,11 +71,6 @@ import (
 	"github.com/mulgadc/spinifex/spinifex/foundation/state/clustersize"
 	"github.com/mulgadc/spinifex/spinifex/foundation/state/kvutil"
 	"github.com/mulgadc/spinifex/spinifex/foundation/telemetry"
-	handlers_ec2_image "github.com/mulgadc/spinifex/spinifex/handlers/ec2/image"
-	handlers_ec2_instance "github.com/mulgadc/spinifex/spinifex/handlers/ec2/instance"
-	handlers_ec2_snapshot "github.com/mulgadc/spinifex/spinifex/handlers/ec2/snapshot"
-	handlers_ec2_tags "github.com/mulgadc/spinifex/spinifex/handlers/ec2/tags"
-	handlers_ec2_volume "github.com/mulgadc/spinifex/spinifex/handlers/ec2/volume"
 	handlers_ecs "github.com/mulgadc/spinifex/spinifex/handlers/ecs"
 	handlers_eks "github.com/mulgadc/spinifex/spinifex/handlers/eks"
 	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
@@ -143,19 +143,19 @@ type Daemon struct {
 	config            *config.Config
 	natsConn          *nats.Conn
 	resourceMgr       *ResourceManager
-	instanceService   *handlers_ec2_instance.InstanceServiceImpl
+	instanceService   *ec2instance.InstanceServiceImpl
 	dnsWriter         *dns.Writer
 	dnsReconciler     *dns.Reconciler
 	dnsBaseDomain     string
 	dnsInternalDomain string
 	keyService        *ec2key.KeyServiceImpl
-	imageService      *handlers_ec2_image.ImageServiceImpl
-	volumeService     *handlers_ec2_volume.VolumeServiceImpl
+	imageService      *ec2image.ImageServiceImpl
+	volumeService     *ec2volume.VolumeServiceImpl
 	// ebsProvider is the sole EBS backend, set once during startup.
 	ebsProvider           ebsprovider.EBSProvider
 	accountService        *ec2account.AccountSettingsServiceImpl
-	snapshotService       *handlers_ec2_snapshot.SnapshotServiceImpl
-	tagsService           *handlers_ec2_tags.TagsServiceImpl
+	snapshotService       *ec2snapshot.SnapshotServiceImpl
+	tagsService           *ec2tags.TagsServiceImpl
 	eigwService           *ec2eigw.EgressOnlyIGWServiceImpl
 	igwService            *ec2igw.IGWServiceImpl
 	placementGroupService *ec2placementgroup.PlacementGroupServiceImpl
@@ -1756,20 +1756,20 @@ func (d *Daemon) startCluster() error {

 	// Create services before loading/launching instances, since LaunchInstance depends on them
 	store := objectstore.NewS3ObjectStoreFromConfig(netaddr.DialTarget(d.config.Predastore.Host), d.config.Predastore.Region, d.config.Predastore.AccessKey, d.config.Predastore.SecretKey)
-	d.instanceService = handlers_ec2_instance.NewInstanceServiceImpl(d.config, d.resourceMgr.instanceTypes, d.natsConn, store, d.vmMgr, d.resourceMgr, d.jsManager)
+	d.instanceService = ec2instance.NewInstanceServiceImpl(d.config, d.resourceMgr.instanceTypes, d.natsConn, store, d.vmMgr, d.resourceMgr, d.jsManager)
 	d.dnsWriter = dns.NewWriter(d.config, d.clusterConfig, d.natsConn)
 	d.dnsReconciler = dns.NewReconciler(d.config, d.clusterConfig, d.natsConn, d.dnsWriter, d.dnsDesiredSet, d.dnsWatchSources()...)
 	d.dnsBaseDomain = dns.ResolveBaseDomain(d.config)
 	d.dnsInternalDomain = dns.ResolveInternalDomain(d.config)
 	d.keyService = ec2key.NewKeyServiceImpl(d.config)
-	d.imageService = handlers_ec2_image.NewImageServiceImpl(d.config, d.natsConn)
+	d.imageService = ec2image.NewImageServiceImpl(d.config, d.natsConn)

 	type snapResult struct {
-		svc *handlers_ec2_snapshot.SnapshotServiceImpl
+		svc *ec2snapshot.SnapshotServiceImpl
 		kv  jetstream.KeyValue
 	}
 	snap, err := initServiceWithRetry("snapshot service", func() (snapResult, error) {
-		svc, kv, err := handlers_ec2_snapshot.NewSnapshotServiceImplWithNATS(d.ctx, d.config, d.natsConn)
+		svc, kv, err := ec2snapshot.NewSnapshotServiceImplWithNATS(d.ctx, d.config, d.natsConn)
 		return snapResult{svc, kv}, err
 	})
 	if err != nil {
@@ -1777,7 +1777,7 @@ func (d *Daemon) startCluster() error {
 	}
 	d.snapshotService = snap.svc

-	d.volumeService = handlers_ec2_volume.NewVolumeServiceImpl(d.config, d.natsConn, snap.kv)
+	d.volumeService = ec2volume.NewVolumeServiceImpl(d.config, d.natsConn, snap.kv)
 	if err := d.configureEBSProvider(); err != nil {
 		return fmt.Errorf("configure EBS provider: %w", err)
 	}
@@ -1786,12 +1786,12 @@ func (d *Daemon) startCluster() error {
 		if jsErr != nil {
 			return nil, fmt.Errorf("jetstream handle: %w", jsErr)
 		}
-		return handlers_ec2_tags.GetOrCreateTagsBucket(d.ctx, tagsJS)
+		return ec2tags.GetOrCreateTagsBucket(d.ctx, tagsJS)
 	})
 	if err != nil {
 		return fmt.Errorf("failed to get tags KV bucket: %w", err)
 	}
-	d.tagsService = handlers_ec2_tags.NewTagsServiceImpl(d.config, tagsKV)
+	d.tagsService = ec2tags.NewTagsServiceImpl(d.config, tagsKV)
 	// Key pairs keep their creation tags in their own metadata; project them so
 	// describe-tags sees them, and clear them when the key pair is deleted.
 	d.keyService.SetCentralTagStore(d.tagsService)
@@ -1939,8 +1939,8 @@ func (d *Daemon) startCluster() error {
 	// the concrete value over only once init succeeded — otherwise the service's
 	// own nil checks pass and the allocate path derefs a nil receiver.
 	var (
-		ipAllocator handlers_ec2_instance.PublicIPAllocator
-		ipReleaser  handlers_ec2_instance.PublicIPReleaser
+		ipAllocator ec2instance.PublicIPAllocator
+		ipReleaser  ec2instance.PublicIPReleaser
 	)
 	if d.externalIPAM != nil {
 		ipAllocator = d.externalIPAM
@@ -3218,9 +3218,9 @@ func (rm *ResourceManager) deallocate(instanceType *ec2.InstanceTypeInfo) {
 	rm.updateInstanceSubscriptions()
 }

-var _ handlers_ec2_instance.InstanceTypeAllocator = (*ResourceManager)(nil)
+var _ ec2instance.InstanceTypeAllocator = (*ResourceManager)(nil)

-// Allocate, Deallocate, CanAllocate satisfy handlers_ec2_instance.InstanceTypeAllocator.
+// Allocate, Deallocate, CanAllocate satisfy ec2instance.InstanceTypeAllocator.
 func (rm *ResourceManager) Allocate(it *ec2.InstanceTypeInfo) error { return rm.allocate(it) }
 func (rm *ResourceManager) Deallocate(it *ec2.InstanceTypeInfo)     { rm.deallocate(it) }
 func (rm *ResourceManager) CanAllocate(it *ec2.InstanceTypeInfo, count int) int {
@@ -8,8 +8,8 @@ import (

 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/mulgadc/spinifex/spinifex/admin"
+	ec2image "github.com/mulgadc/spinifex/spinifex/domains/ec2/image"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_ec2_image "github.com/mulgadc/spinifex/spinifex/handlers/ec2/image"
 	"github.com/mulgadc/spinifex/spinifex/providers/objectstore"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
 	"github.com/nats-io/nats.go"
@@ -162,7 +162,7 @@ func (d *Daemon) handleEC2CreateImage(msg *nats.Msg) string {
 		return outcomeError
 	}

-	params := handlers_ec2_image.CreateImageParams{
+	params := ec2image.CreateImageParams{
 		Input:         input,
 		RootVolumeID:  rootVolumeID,
 		SourceImageID: sourceImageID,
@@ -12,8 +12,8 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/mulgadc/spinifex/contracts/ec2/v1"
+	ec2instance "github.com/mulgadc/spinifex/spinifex/domains/ec2/instance"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_ec2_instance "github.com/mulgadc/spinifex/spinifex/handlers/ec2/instance"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
 	"github.com/nats-io/nats.go"
 	"go.opentelemetry.io/otel"
@@ -45,14 +45,14 @@ func (d *Daemon) handleSetInstanceTags(ctx context.Context, msg *nats.Msg, comma
 			missingRecord = true
 			return
 		}
-		newTags = handlers_ec2_instance.ApplyInstanceTagMutation(v.Instance.Tags, data, remove)
+		newTags = ec2instance.ApplyInstanceTagMutation(v.Instance.Tags, data, remove)
 	})
 	if missingRecord {
 		return respondErrorOutcome(d.node, msg, awserrors.ErrorServerInternal)
 	}

 	accountID := natsmsg.AccountIDFromMsg(msg)
-	if err := d.tagsService.PutResourceTags(ctx, accountID, instance.ID, handlers_ec2_instance.TagsToMap(newTags)); err != nil {
+	if err := d.tagsService.PutResourceTags(ctx, accountID, instance.ID, ec2instance.TagsToMap(newTags)); err != nil {
 		slog.ErrorContext(ctx, "SetInstanceTags: central tag store write failed",
 			"instanceId", instance.ID, "err", err)
 		return respondErrorOutcome(d.node, msg, awserrors.ErrorServerInternal)
@@ -62,7 +62,7 @@ func (d *Daemon) handleSetInstanceTags(ctx context.Context, msg *nats.Msg, comma
 		if v.Instance == nil {
 			return false
 		}
-		v.Instance.Tags = handlers_ec2_instance.ApplyInstanceTagMutation(v.Instance.Tags, data, remove)
+		v.Instance.Tags = ec2instance.ApplyInstanceTagMutation(v.Instance.Tags, data, remove)
 		return true
 	})
 	if err != nil {
@@ -231,7 +231,7 @@ func (d *Daemon) handleEC2RunInstances(msg *nats.Msg) string {
 			continue
 		}
 		if err := d.tagsService.PutResourceTags(ctx, accountID, instance.ID,
-			handlers_ec2_instance.TagsToMap(instance.Instance.Tags)); err != nil {
+			ec2instance.TagsToMap(instance.Instance.Tags)); err != nil {
 			slog.Error("handleEC2RunInstances: launch tag central store write failed",
 				"instanceId", instance.ID, "err", err)
 		}
@@ -8,9 +8,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/mulgadc/spinifex/contracts/ec2/v1"
+	ec2instance "github.com/mulgadc/spinifex/spinifex/domains/ec2/instance"
+	ec2tags "github.com/mulgadc/spinifex/spinifex/domains/ec2/tags"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_ec2_instance "github.com/mulgadc/spinifex/spinifex/handlers/ec2/instance"
-	handlers_ec2_tags "github.com/mulgadc/spinifex/spinifex/handlers/ec2/tags"
 	"github.com/mulgadc/spinifex/spinifex/providers/objectstore"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
 	vmmock "github.com/mulgadc/spinifex/spinifex/runtime/compute/vm/mock"
@@ -30,10 +30,10 @@ func tagTestDaemon(t *testing.T, instanceID string, initial map[string]string) *
 func tagTestDaemonWithStopped(t *testing.T, instanceID string, initial map[string]string) (*Daemon, *vmmock.StateStore) {
 	t.Helper()
 	d := createTestDaemon(t, sharedNATSURL)
-	d.tagsService = handlers_ec2_tags.NewTagsServiceImplWithStore(d.config, objectstore.NewMemoryObjectStore(), testTagsKV(t))
+	d.tagsService = ec2tags.NewTagsServiceImplWithStore(d.config, objectstore.NewMemoryObjectStore(), testTagsKV(t))

 	stopped := vmmock.New()
-	d.instanceService = handlers_ec2_instance.NewInstanceServiceImpl(
+	d.instanceService = ec2instance.NewInstanceServiceImpl(
 		d.config, d.resourceMgr.instanceTypes, d.natsConn,
 		objectstore.NewMemoryObjectStore(), d.vmMgr, d.resourceMgr, stopped)

@@ -9,8 +9,8 @@ import (

 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
+	ec2instance "github.com/mulgadc/spinifex/spinifex/domains/ec2/instance"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_ec2_instance "github.com/mulgadc/spinifex/spinifex/handlers/ec2/instance"
 	"github.com/mulgadc/spinifex/spinifex/providers/objectstore"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
 	vmmock "github.com/mulgadc/spinifex/spinifex/runtime/compute/vm/mock"
@@ -34,7 +34,7 @@ func daemonWithFakeStateStore(t *testing.T, store *vmmock.StateStore) *Daemon {
 	t.Helper()
 	d := createTestDaemon(t, sharedNATSURL)
 	d.stateStore = store
-	d.instanceService = handlers_ec2_instance.NewInstanceServiceImpl(
+	d.instanceService = ec2instance.NewInstanceServiceImpl(
 		d.config, d.resourceMgr.instanceTypes, d.natsConn,
 		objectstore.NewMemoryObjectStore(), d.vmMgr, d.resourceMgr, store,
 	)
@@ -90,7 +90,7 @@ func TestHandleEC2StartStoppedInstance_LoadError(t *testing.T) {
 	store.LoadStoppedErr = errors.New("kv unavailable")
 	d := daemonWithFakeStateStore(t, store)

-	body, _ := json.Marshal(handlers_ec2_instance.StartStoppedInstanceInput{InstanceID: "i-load-fail"})
+	body, _ := json.Marshal(ec2instance.StartStoppedInstanceInput{InstanceID: "i-load-fail"})
 	reply := requestHandler(t, d.natsConn, "ec2.start.test1", asMsgHandler(d.handleEC2StartStoppedInstance), testAccountID, body)
 	assert.Equal(t, awserrors.ErrorServerInternal, decodeError(t, reply.Data)["Code"])
 }
@@ -99,7 +99,7 @@ func TestHandleEC2StartStoppedInstance_StateStoreNil(t *testing.T) {
 	d := createTestDaemon(t, sharedNATSURL)
 	// d.stateStore intentionally left nil.

-	body, _ := json.Marshal(handlers_ec2_instance.StartStoppedInstanceInput{InstanceID: "i-no-store"})
+	body, _ := json.Marshal(ec2instance.StartStoppedInstanceInput{InstanceID: "i-no-store"})
 	reply := requestHandler(t, d.natsConn, "ec2.start.test2", asMsgHandler(d.handleEC2StartStoppedInstance), testAccountID, body)
 	assert.Equal(t, awserrors.ErrorServerInternal, decodeError(t, reply.Data)["Code"])
 }
@@ -109,7 +109,7 @@ func TestHandleEC2StartStoppedInstance_CrossTenantRejected(t *testing.T) {
 	store.Stopped["i-foreign"] = stoppedVMFixture("i-foreign", "999988887777")
 	d := daemonWithFakeStateStore(t, store)

-	body, _ := json.Marshal(handlers_ec2_instance.StartStoppedInstanceInput{InstanceID: "i-foreign"})
+	body, _ := json.Marshal(ec2instance.StartStoppedInstanceInput{InstanceID: "i-foreign"})
 	reply := requestHandler(t, d.natsConn, "ec2.start.test3", asMsgHandler(d.handleEC2StartStoppedInstance), testAccountID, body)
 	assert.Equal(t, awserrors.ErrorInvalidInstanceIDNotFound, decodeError(t, reply.Data)["Code"])

@@ -126,7 +126,7 @@ func TestHandleEC2StartStoppedInstance_InstanceTypeUnknown(t *testing.T) {
 	store.Stopped[v.ID] = v
 	d := daemonWithFakeStateStore(t, store)

-	body, _ := json.Marshal(handlers_ec2_instance.StartStoppedInstanceInput{InstanceID: v.ID})
+	body, _ := json.Marshal(ec2instance.StartStoppedInstanceInput{InstanceID: v.ID})
 	reply := requestHandler(t, d.natsConn, "ec2.start.test4", asMsgHandler(d.handleEC2StartStoppedInstance), testAccountID, body)
 	assert.Equal(t, awserrors.ErrorInsufficientInstanceCapacity, decodeError(t, reply.Data)["Code"])
 }
@@ -165,7 +165,7 @@ func TestHandleEC2StartStoppedInstance_ForwardTimeoutFallsBackLocally(t *testing
 	require.NoError(t, err)
 	t.Cleanup(func() { _ = silentSub.Unsubscribe() })

-	body, _ := json.Marshal(handlers_ec2_instance.StartStoppedInstanceInput{InstanceID: v.ID})
+	body, _ := json.Marshal(ec2instance.StartStoppedInstanceInput{InstanceID: v.ID})
 	reply := requestHandler(t, d.natsConn, "ec2.start.test5", asMsgHandler(d.handleEC2StartStoppedInstance), testAccountID, body)
 	assert.Equal(t, awserrors.ErrorInsufficientInstanceCapacity, decodeError(t, reply.Data)["Code"],
 		"a forward timeout must fall back to a local start attempt, not a bare ServerInternal")
@@ -197,7 +197,7 @@ func TestHandleEC2StartStoppedInstance_ForwardTimeoutAfterRemoteClaim_NoDoubleSt
 	require.NoError(t, err)
 	t.Cleanup(func() { _ = claimingSub.Unsubscribe() })

-	body, _ := json.Marshal(handlers_ec2_instance.StartStoppedInstanceInput{InstanceID: v.ID})
+	body, _ := json.Marshal(ec2instance.StartStoppedInstanceInput{InstanceID: v.ID})
 	reply := requestHandler(t, d.natsConn, "ec2.start.test6", asMsgHandler(d.handleEC2StartStoppedInstance), testAccountID, body)

 	assert.Equal(t, awserrors.ErrorInvalidInstanceIDNotFound, decodeError(t, reply.Data)["Code"],
@@ -213,7 +213,7 @@ func TestHandleEC2TerminateStoppedInstance_LoadError(t *testing.T) {
 	store.LoadStoppedErr = errors.New("kv unavailable")
 	d := daemonWithFakeStateStore(t, store)

-	body, _ := json.Marshal(handlers_ec2_instance.TerminateStoppedInstanceInput{InstanceID: "i-load-fail"})
+	body, _ := json.Marshal(ec2instance.TerminateStoppedInstanceInput{InstanceID: "i-load-fail"})
 	reply := requestHandler(t, d.natsConn, "ec2.terminate.test1", asMsgHandler(handleNATSRequest(d.node, d.instanceService.TerminateStoppedInstance)), testAccountID, body)
 	assert.Equal(t, awserrors.ErrorServerInternal, decodeError(t, reply.Data)["Code"])
 }
@@ -221,7 +221,7 @@ func TestHandleEC2TerminateStoppedInstance_LoadError(t *testing.T) {
 func TestHandleEC2TerminateStoppedInstance_StateStoreNil(t *testing.T) {
 	d := createTestDaemon(t, sharedNATSURL)

-	body, _ := json.Marshal(handlers_ec2_instance.TerminateStoppedInstanceInput{InstanceID: "i-no-store"})
+	body, _ := json.Marshal(ec2instance.TerminateStoppedInstanceInput{InstanceID: "i-no-store"})
 	reply := requestHandler(t, d.natsConn, "ec2.terminate.test2", asMsgHandler(handleNATSRequest(d.node, d.instanceService.TerminateStoppedInstance)), testAccountID, body)
 	assert.Equal(t, awserrors.ErrorServerInternal, decodeError(t, reply.Data)["Code"])
 }
@@ -235,7 +235,7 @@ func TestHandleEC2TerminateStoppedInstance_WriteTerminatedFailureAborts(t *testi
 	store.Stopped[v.ID] = v
 	d := daemonWithFakeStateStore(t, store)

-	body, _ := json.Marshal(handlers_ec2_instance.TerminateStoppedInstanceInput{InstanceID: v.ID})
+	body, _ := json.Marshal(ec2instance.TerminateStoppedInstanceInput{InstanceID: v.ID})
 	reply := requestHandler(t, d.natsConn, "ec2.terminate.test3", asMsgHandler(handleNATSRequest(d.node, d.instanceService.TerminateStoppedInstance)), testAccountID, body)
 	assert.Equal(t, awserrors.ErrorServerInternal, decodeError(t, reply.Data)["Code"])

@@ -256,7 +256,7 @@ func TestHandleEC2TerminateStoppedInstance_DeleteRetrySucceeds(t *testing.T) {
 	store.Stopped[v.ID] = v
 	d := daemonWithFakeStateStore(t, store)

-	body, _ := json.Marshal(handlers_ec2_instance.TerminateStoppedInstanceInput{InstanceID: v.ID})
+	body, _ := json.Marshal(ec2instance.TerminateStoppedInstanceInput{InstanceID: v.ID})
 	reply := requestHandler(t, d.natsConn, "ec2.terminate.test4", asMsgHandler(handleNATSRequest(d.node, d.instanceService.TerminateStoppedInstance)), testAccountID, body)

 	var resp map[string]string
@@ -281,7 +281,7 @@ func TestHandleEC2TerminateStoppedInstance_DeleteAlwaysFailsKeepsTerminated(t *t
 	store.Stopped[v.ID] = v
 	d := daemonWithFakeStateStore(t, store)

-	body, _ := json.Marshal(handlers_ec2_instance.TerminateStoppedInstanceInput{InstanceID: v.ID})
+	body, _ := json.Marshal(ec2instance.TerminateStoppedInstanceInput{InstanceID: v.ID})
 	reply := requestHandler(t, d.natsConn, "ec2.terminate.test5", asMsgHandler(handleNATSRequest(d.node, d.instanceService.TerminateStoppedInstance)), testAccountID, body)

 	var resp map[string]string
@@ -297,7 +297,7 @@ func TestHandleEC2TerminateStoppedInstance_CrossTenantRejected(t *testing.T) {
 	store.Stopped["i-foreign-term"] = stoppedVMFixture("i-foreign-term", "999988887777")
 	d := daemonWithFakeStateStore(t, store)

-	body, _ := json.Marshal(handlers_ec2_instance.TerminateStoppedInstanceInput{InstanceID: "i-foreign-term"})
+	body, _ := json.Marshal(ec2instance.TerminateStoppedInstanceInput{InstanceID: "i-foreign-term"})
 	reply := requestHandler(t, d.natsConn, "ec2.terminate.test6", asMsgHandler(handleNATSRequest(d.node, d.instanceService.TerminateStoppedInstance)), testAccountID, body)
 	assert.Equal(t, awserrors.ErrorInvalidInstanceIDNotFound, decodeError(t, reply.Data)["Code"])

@@ -10,8 +10,8 @@ import (

 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
+	ec2instance "github.com/mulgadc/spinifex/spinifex/domains/ec2/instance"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_ec2_instance "github.com/mulgadc/spinifex/spinifex/handlers/ec2/instance"
 	"github.com/mulgadc/spinifex/spinifex/providers/objectstore"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
 	vmmock "github.com/mulgadc/spinifex/spinifex/runtime/compute/vm/mock"
@@ -26,7 +26,7 @@ func monitoringTestDaemon(t *testing.T, instanceID string, enabled bool) (*Daemo
 	d := createTestDaemon(t, sharedNATSURL)

 	stopped := vmmock.New()
-	d.instanceService = handlers_ec2_instance.NewInstanceServiceImpl(
+	d.instanceService = ec2instance.NewInstanceServiceImpl(
 		d.config, d.resourceMgr.instanceTypes, d.natsConn,
 		objectstore.NewMemoryObjectStore(), d.vmMgr, d.resourceMgr, stopped)

@@ -28,17 +28,17 @@ import (
 	ec2eigw "github.com/mulgadc/spinifex/spinifex/domains/ec2/eigw"
 	ec2eip "github.com/mulgadc/spinifex/spinifex/domains/ec2/eip"
 	ec2igw "github.com/mulgadc/spinifex/spinifex/domains/ec2/igw"
+	ec2image "github.com/mulgadc/spinifex/spinifex/domains/ec2/image"
+	ec2instance "github.com/mulgadc/spinifex/spinifex/domains/ec2/instance"
 	ec2key "github.com/mulgadc/spinifex/spinifex/domains/ec2/key"
 	ec2placementgroup "github.com/mulgadc/spinifex/spinifex/domains/ec2/placementgroup"
 	ec2routetable "github.com/mulgadc/spinifex/spinifex/domains/ec2/routetable"
+	ec2snapshot "github.com/mulgadc/spinifex/spinifex/domains/ec2/snapshot"
+	ec2tags "github.com/mulgadc/spinifex/spinifex/domains/ec2/tags"
+	ec2volume "github.com/mulgadc/spinifex/spinifex/domains/ec2/volume"
 	ec2vpc "github.com/mulgadc/spinifex/spinifex/domains/ec2/vpc"
 	"github.com/mulgadc/spinifex/spinifex/domains/network/external"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_ec2_image "github.com/mulgadc/spinifex/spinifex/handlers/ec2/image"
-	handlers_ec2_instance "github.com/mulgadc/spinifex/spinifex/handlers/ec2/instance"
-	handlers_ec2_snapshot "github.com/mulgadc/spinifex/spinifex/handlers/ec2/snapshot"
-	handlers_ec2_tags "github.com/mulgadc/spinifex/spinifex/handlers/ec2/tags"
-	handlers_ec2_volume "github.com/mulgadc/spinifex/spinifex/handlers/ec2/volume"
 	"github.com/mulgadc/spinifex/spinifex/providers/objectstore"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/qmp"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
@@ -60,7 +60,7 @@ func testTagsKV(t *testing.T) jetstream.KeyValue {
 	t.Helper()
 	_, nc, _ := testutil.StartTestJetStream(t)
 	js := testutil.NewJetStream(t, nc)
-	kv, err := handlers_ec2_tags.GetOrCreateTagsBucket(t.Context(), js)
+	kv, err := ec2tags.GetOrCreateTagsBucket(t.Context(), js)
 	require.NoError(t, err)
 	return kv
 }
@@ -82,10 +82,10 @@ func createFullTestDaemonWithStore(t *testing.T, natsURL string) (*Daemon, *obje
 	cfg := daemon.config

 	daemon.keyService = ec2key.NewKeyServiceImplWithStore(memStore, cfg.Predastore.Bucket)
-	daemon.imageService = handlers_ec2_image.NewImageServiceImplWithStore(memStore, cfg.Predastore.Bucket)
-	daemon.volumeService = handlers_ec2_volume.NewVolumeServiceImplWithStore(cfg, memStore, daemon.natsConn)
-	daemon.snapshotService = handlers_ec2_snapshot.NewSnapshotServiceImplWithStore(cfg, memStore, daemon.natsConn)
-	daemon.tagsService = handlers_ec2_tags.NewTagsServiceImplWithStore(cfg, memStore, testTagsKV(t))
+	daemon.imageService = ec2image.NewImageServiceImplWithStore(memStore, cfg.Predastore.Bucket)
+	daemon.volumeService = ec2volume.NewVolumeServiceImplWithStore(cfg, memStore, daemon.natsConn)
+	daemon.snapshotService = ec2snapshot.NewSnapshotServiceImplWithStore(cfg, memStore, daemon.natsConn)
+	daemon.tagsService = ec2tags.NewTagsServiceImplWithStore(cfg, memStore, testTagsKV(t))
 	wireTestEBSProvider(daemon, memStore)
 	initAccountServiceForTest(t, daemon)

@@ -144,7 +144,7 @@ func createFullTestDaemonWithJetStream(t *testing.T, natsURL string) *Daemon {

 	// Re-bind the instance service so describe-stopped/terminated handlers see
 	// the KV that was just initialised.
-	daemon.instanceService = handlers_ec2_instance.NewInstanceServiceImpl(
+	daemon.instanceService = ec2instance.NewInstanceServiceImpl(
 		daemon.config, daemon.resourceMgr.instanceTypes, daemon.natsConn,
 		objectstore.NewMemoryObjectStore(),
 		daemon.vmMgr, daemon.resourceMgr, daemon.jsManager,
@@ -551,7 +551,7 @@ func TestHandleEC2RunInstances_ServiceErrorPropagated(t *testing.T) {
 	// The resourceMgr still has instance types, so the daemon-level check passes,
 	// but RunInstance() will fail with ErrorInvalidInstanceType.
 	emptyTypes := map[string]*ec2.InstanceTypeInfo{}
-	daemon.instanceService = handlers_ec2_instance.NewInstanceServiceImpl(
+	daemon.instanceService = ec2instance.NewInstanceServiceImpl(
 		daemon.config, emptyTypes, daemon.natsConn,
 		objectstore.NewMemoryObjectStore(),
 		daemon.vmMgr, daemon.resourceMgr, nil,
@@ -591,7 +591,7 @@ func runInstancesAndCheckENISGs(t *testing.T, mutator func(input *ec2.RunInstanc

 	memStore := objectstore.NewMemoryObjectStore()
 	bucket := daemon.config.Predastore.Bucket
-	daemon.imageService = handlers_ec2_image.NewImageServiceImplWithStore(memStore, bucket)
+	daemon.imageService = ec2image.NewImageServiceImplWithStore(memStore, bucket)
 	daemon.keyService = ec2key.NewKeyServiceImplWithStore(memStore, bucket)
 	seedTestAMI(t, memStore, bucket, "ami-sgprop")
 	daemon.instanceService.SetRunInstancesDeps(daemon.imageService, daemon.keyService, &daemonENICreator{d: daemon}, nil)
@@ -1380,7 +1380,7 @@ func TestHandleEC2DescribeStoppedInstances_WithFilter(t *testing.T) {
 // --- handleEC2TerminateStoppedInstance wrapper smoke test ---
 //
 // Detailed logic coverage lives in
-// handlers/ec2/instance/service_impl_test.go (TestTerminateStoppedInstance_*).
+// domains/ec2/instance/service_impl_test.go (TestTerminateStoppedInstance_*).
 // The wrapper smoke case is TestHandleEC2TerminateStoppedInstance_WritesToTerminatedKV
 // further below; it confirms the NATS → handleNATSRequest → service round-trip
 // stays intact end-to-end against real JetStream KV.
@@ -1550,7 +1550,7 @@ func TestAttachVolume_ZoneMismatch(t *testing.T) {
 // --- handleEC2ModifyInstanceAttribute wrapper smoke test ---
 //
 // Detailed logic coverage lives in
-// handlers/ec2/instance/service_impl_test.go (TestModifyInstanceAttribute_*).
+// domains/ec2/instance/service_impl_test.go (TestModifyInstanceAttribute_*).
 // This case keeps one end-to-end NATS → handleNATSRequest → service round-trip
 // to confirm the daemon wiring stays intact.

@@ -2007,7 +2007,7 @@ func TestDelegateHandlers_RoundTrip(t *testing.T) {

 	// DeleteTags' no-owner path falls back to the shared stopped store; give
 	// the service an empty one so an absent instance resolves to NotFound.
-	daemon.instanceService = handlers_ec2_instance.NewInstanceServiceImpl(
+	daemon.instanceService = ec2instance.NewInstanceServiceImpl(
 		daemon.config, daemon.resourceMgr.instanceTypes, daemon.natsConn,
 		objectstore.NewMemoryObjectStore(), daemon.vmMgr, daemon.resourceMgr,
 		vmmock.New())
@@ -3483,7 +3483,7 @@ func TestHandleEC2TerminateStoppedInstance_WritesToTerminatedKV(t *testing.T) {
 	require.NoError(t, err)
 	defer sub.Unsubscribe()

-	reqData, _ := json.Marshal(handlers_ec2_instance.TerminateStoppedInstanceInput{InstanceID: stoppedVM.ID})
+	reqData, _ := json.Marshal(ec2instance.TerminateStoppedInstanceInput{InstanceID: stoppedVM.ID})
 	reply, err := natsRequest(daemon.natsConn, "ec2.terminate", reqData, 30*time.Second)
 	require.NoError(t, err)
 	assert.Contains(t, string(reply.Data), "terminated")
@@ -11,8 +11,8 @@ import (
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/mulgadc/spinifex/contracts/ec2/v1"
 	viperblocklegacyv1 "github.com/mulgadc/spinifex/contracts/viperblockd/legacy/v1"
+	ec2snapshot "github.com/mulgadc/spinifex/spinifex/domains/ec2/snapshot"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_ec2_snapshot "github.com/mulgadc/spinifex/spinifex/handlers/ec2/snapshot"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
 	"github.com/nats-io/nats.go"
 )
@@ -174,7 +174,7 @@ func (d *Daemon) handleDrainVolume(ctx context.Context, msg *nats.Msg, command e
 	// A missing or unresponsive socket under a running instance means the writes
 	// cannot be made current, so the caller must fail its snapshot rather than
 	// read a stale checkpoint.
-	if err = handlers_ec2_snapshot.DrainVolumeSocket(d.config.DataDir, volumeID); err != nil {
+	if err = ec2snapshot.DrainVolumeSocket(d.config.DataDir, volumeID); err != nil {
 		slog.ErrorContext(ctx, "DrainVolume: drain failed", "volumeId", volumeID, "instanceId", command.ID, "err", err)
 		return respondErrorOutcome(d.node, msg, awserrors.ErrorServerInternal)
 	}
@@ -139,7 +139,7 @@ func (d *Daemon) LaunchSystemInstance(input *handlers_elbv2.SystemInstanceInput)
 	instance.Reservation.SetReservationId(awsidentifiers.GenerateResourceID("r"))
 	instance.Reservation.SetOwnerId(accountID)
 	instance.Reservation.Instances = []*ec2.Instance{ec2Instance}
-	// Mirror the customer-instance path (handlers/ec2/instance/service_impl.go:334)
+	// Mirror the customer-instance path (domains/ec2/instance/service_impl.go:334)
 	// so consumers reading instance.Instance (e.g. onInstanceUpHook's NAT
 	// republish, device_map, volumes) see the same metadata for system VMs.
 	instance.Instance = ec2Instance
@@ -38,17 +38,17 @@ import (
 	ec2eigw "github.com/mulgadc/spinifex/spinifex/domains/ec2/eigw"
 	ec2eip "github.com/mulgadc/spinifex/spinifex/domains/ec2/eip"
 	ec2igw "github.com/mulgadc/spinifex/spinifex/domains/ec2/igw"
+	ec2image "github.com/mulgadc/spinifex/spinifex/domains/ec2/image"
+	ec2instance "github.com/mulgadc/spinifex/spinifex/domains/ec2/instance"
 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/instancetypes"
 	ec2natgw "github.com/mulgadc/spinifex/spinifex/domains/ec2/natgw"
 	ec2placementgroup "github.com/mulgadc/spinifex/spinifex/domains/ec2/placementgroup"
 	ec2routetable "github.com/mulgadc/spinifex/spinifex/domains/ec2/routetable"
+	ec2snapshot "github.com/mulgadc/spinifex/spinifex/domains/ec2/snapshot"
 	ec2spotinstance "github.com/mulgadc/spinifex/spinifex/domains/ec2/spotinstance"
+	ec2volume "github.com/mulgadc/spinifex/spinifex/domains/ec2/volume"
 	ec2vpc "github.com/mulgadc/spinifex/spinifex/domains/ec2/vpc"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_ec2_image "github.com/mulgadc/spinifex/spinifex/handlers/ec2/image"
-	handlers_ec2_instance "github.com/mulgadc/spinifex/spinifex/handlers/ec2/instance"
-	handlers_ec2_snapshot "github.com/mulgadc/spinifex/spinifex/handlers/ec2/snapshot"
-	handlers_ec2_volume "github.com/mulgadc/spinifex/spinifex/handlers/ec2/volume"
 	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/providers/objectstore"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/gpu"
@@ -131,8 +131,8 @@ func createTestDaemon(t *testing.T, natsURL string) *Daemon {
 	// jsManager is nil here; pass a nil literal to keep the StoppedInstanceStore
 	// interface itself nil (rather than a typed-nil pointer) so the service can
 	// short-circuit cleanly when no KV is available.
-	daemon.instanceService = handlers_ec2_instance.NewInstanceServiceImpl(cfg, daemon.resourceMgr.instanceTypes, nc, objectstore.NewMemoryObjectStore(), daemon.vmMgr, daemon.resourceMgr, nil)
-	daemon.volumeService = handlers_ec2_volume.NewVolumeServiceImplWithStore(cfg, objectstore.NewMemoryObjectStore(), nc)
+	daemon.instanceService = ec2instance.NewInstanceServiceImpl(cfg, daemon.resourceMgr.instanceTypes, nc, objectstore.NewMemoryObjectStore(), daemon.vmMgr, daemon.resourceMgr, nil)
+	daemon.volumeService = ec2volume.NewVolumeServiceImplWithStore(cfg, objectstore.NewMemoryObjectStore(), nc)

 	// Wire the minimum vm.Deps that handler tests rely on. Lifecycle (Run/Start/
 	// Stop/Terminate) tests still set up their own deps; this gives the
@@ -1571,7 +1571,7 @@ func TestInstanceCleanerAdapter_DeleteVolumes_BootVolumeDeletedAfterAttachmentCl
 		Bucket: "snap-kv-" + strings.ReplaceAll(t.Name(), "/", "-"),
 	})
 	require.NoError(t, err)
-	daemon.volumeService = handlers_ec2_volume.NewVolumeServiceImplWithStore(daemon.config, store, daemon.natsConn, snapKV)
+	daemon.volumeService = ec2volume.NewVolumeServiceImplWithStore(daemon.config, store, daemon.natsConn, snapKV)
 	daemon.volumeService.SetEBSProvider(daemon.ebsProvider)

 	volumeID := "vol-root-attached"
@@ -1684,7 +1684,7 @@ func TestInstanceCleanerAdapter_DeleteVolumes_NonBootNonDoTVolumeDetachedNotDele
 // TestTerminatedTeardownReaper_SelfHealsFailedVolumeTeardown proves the
 // go-forward self-heal: a stopped-terminate that stamped
 // Teardown[volumes]=failed on a transient error (deleteInstanceVolumes,
-// handlers/ec2/instance/service_impl.go) is retried by
+// domains/ec2/instance/service_impl.go) is retried by
 // TerminatedTeardownReaper.Sweep (vm/teardown_reaper.go) through the real
 // instanceCleanerAdapter, which stage 1 rerouted through
 // DeleteVolumeOnTerminate. The retry clears the stale attachment, the delete
@@ -1706,7 +1706,7 @@ func TestTerminatedTeardownReaper_SelfHealsFailedVolumeTeardown(t *testing.T) {
 		Bucket: "snap-kv-" + strings.ReplaceAll(t.Name(), "/", "-"),
 	})
 	require.NoError(t, err)
-	daemon.volumeService = handlers_ec2_volume.NewVolumeServiceImplWithStore(daemon.config, store, daemon.natsConn, snapKV)
+	daemon.volumeService = ec2volume.NewVolumeServiceImplWithStore(daemon.config, store, daemon.natsConn, snapKV)
 	daemon.volumeService.SetEBSProvider(daemon.ebsProvider)

 	volumeID := "vol-root-self-heal"
@@ -4508,10 +4508,10 @@ func TestAssertNoClusterServicesInitialised_PerField(t *testing.T) {
 	cases := []fieldCase{
 		{name: "natsConn", set: func(d *Daemon) { d.natsConn = &nats.Conn{} }, wantMsg: "natsConn"},
 		{name: "jsManager", set: func(d *Daemon) { d.jsManager = &JetStreamManager{} }, wantMsg: "jsManager"},
-		{name: "instanceService", set: func(d *Daemon) { d.instanceService = &handlers_ec2_instance.InstanceServiceImpl{} }, wantMsg: "instanceService"},
-		{name: "imageService", set: func(d *Daemon) { d.imageService = &handlers_ec2_image.ImageServiceImpl{} }, wantMsg: "imageService"},
-		{name: "snapshotService", set: func(d *Daemon) { d.snapshotService = &handlers_ec2_snapshot.SnapshotServiceImpl{} }, wantMsg: "snapshotService"},
-		{name: "volumeService", set: func(d *Daemon) { d.volumeService = &handlers_ec2_volume.VolumeServiceImpl{} }, wantMsg: "volumeService"},
+		{name: "instanceService", set: func(d *Daemon) { d.instanceService = &ec2instance.InstanceServiceImpl{} }, wantMsg: "instanceService"},
+		{name: "imageService", set: func(d *Daemon) { d.imageService = &ec2image.ImageServiceImpl{} }, wantMsg: "imageService"},
+		{name: "snapshotService", set: func(d *Daemon) { d.snapshotService = &ec2snapshot.SnapshotServiceImpl{} }, wantMsg: "snapshotService"},
+		{name: "volumeService", set: func(d *Daemon) { d.volumeService = &ec2volume.VolumeServiceImpl{} }, wantMsg: "volumeService"},
 		{name: "eigwService", set: func(d *Daemon) { d.eigwService = &ec2eigw.EgressOnlyIGWServiceImpl{} }, wantMsg: "eigwService"},
 		{name: "igwService", set: func(d *Daemon) { d.igwService = &ec2igw.IGWServiceImpl{} }, wantMsg: "igwService"},
 		{name: "placementGroupService", set: func(d *Daemon) { d.placementGroupService = &ec2placementgroup.PlacementGroupServiceImpl{} }, wantMsg: "placementGroupService"},
@@ -4562,10 +4562,10 @@ func newEBSProviderTestDaemon(t *testing.T, provider string) *Daemon {
 		config:          cfg,
 		natsConn:        nc,
 		jsManager:       jsManager,
-		instanceService: &handlers_ec2_instance.InstanceServiceImpl{},
-		imageService:    handlers_ec2_image.NewImageServiceImplWithStore(store, cfg.Predastore.Bucket),
-		snapshotService: handlers_ec2_snapshot.NewSnapshotServiceImplWithStore(cfg, store, nc),
-		volumeService:   handlers_ec2_volume.NewVolumeServiceImplWithStore(cfg, store, nc),
+		instanceService: &ec2instance.InstanceServiceImpl{},
+		imageService:    ec2image.NewImageServiceImplWithStore(store, cfg.Predastore.Bucket),
+		snapshotService: ec2snapshot.NewSnapshotServiceImplWithStore(cfg, store, nc),
+		volumeService:   ec2volume.NewVolumeServiceImplWithStore(cfg, store, nc),
 	}
 }

@@ -13,8 +13,8 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/mulgadc/spinifex/contracts/ec2/v1"
+	ec2instance "github.com/mulgadc/spinifex/spinifex/domains/ec2/instance"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_ec2_instance "github.com/mulgadc/spinifex/spinifex/handlers/ec2/instance"
 	handlers_eks "github.com/mulgadc/spinifex/spinifex/handlers/eks"
 	"github.com/nats-io/nats.go"
 )
@@ -147,7 +147,7 @@ func (d *Daemon) terminateWorkerInstance(ctx context.Context, instanceID, accoun
 // NotFound payload — or no responder at all — means the instance is already
 // gone, which a retried teardown treats as idempotent success.
 func (d *Daemon) terminateStoppedWorker(ctx context.Context, instanceID, accountID string) error {
-	req, err := json.Marshal(handlers_ec2_instance.TerminateStoppedInstanceInput{InstanceID: instanceID})
+	req, err := json.Marshal(ec2instance.TerminateStoppedInstanceInput{InstanceID: instanceID})
 	if err != nil {
 		return fmt.Errorf("marshal stopped-terminate request: %w", err)
 	}
@@ -9,8 +9,8 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/mulgadc/spinifex/contracts/ec2/v1"
+	ec2instance "github.com/mulgadc/spinifex/spinifex/domains/ec2/instance"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_ec2_instance "github.com/mulgadc/spinifex/spinifex/handlers/ec2/instance"
 	"github.com/nats-io/nats.go"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -122,7 +122,7 @@ func TestTerminateWorkerInstances_StoppedFallbackToEC2Terminate(t *testing.T) {

 	gotID := make(chan string, 1)
 	sub, err := nc.Subscribe("ec2.terminate", func(msg *nats.Msg) {
-		var req handlers_ec2_instance.TerminateStoppedInstanceInput
+		var req ec2instance.TerminateStoppedInstanceInput
 		_ = json.Unmarshal(msg.Data, &req)
 		gotID <- req.InstanceID
 		_ = msg.Respond([]byte(`{"status":"terminated"}`))
@@ -4,18 +4,18 @@ import (
 	"errors"
 	"fmt"

-	handlers_ec2_instance "github.com/mulgadc/spinifex/spinifex/handlers/ec2/instance"
+	ec2instance "github.com/mulgadc/spinifex/spinifex/domains/ec2/instance"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/gpu"
 )

 // daemonGPUClaimer adapts the daemon's gpu.Manager + GPUModelOverrides config to
-// the transport-neutral handlers_ec2_instance.GPUClaimer surface. Keeps the gpu
+// the transport-neutral ec2instance.GPUClaimer surface. Keeps the gpu
 // package out of the instance service.
 type daemonGPUClaimer struct {
 	d *Daemon
 }

-var _ handlers_ec2_instance.GPUClaimer = (*daemonGPUClaimer)(nil)
+var _ ec2instance.GPUClaimer = (*daemonGPUClaimer)(nil)

 func (g *daemonGPUClaimer) manager() *gpu.Manager {
 	g.d.mu.Lock()
@@ -10,9 +10,9 @@ import (
 	"slices"
 	"time"

+	ec2instance "github.com/mulgadc/spinifex/spinifex/domains/ec2/instance"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
 	"github.com/mulgadc/spinifex/spinifex/foundation/telemetry"
-	handlers_ec2_instance "github.com/mulgadc/spinifex/spinifex/handlers/ec2/instance"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/cache"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
 	"go.opentelemetry.io/otel"
@@ -301,7 +301,7 @@ func (f recoveryFault) stateReasonCode() string {

 // classifyRecoveryFault reads what the launch refused with.
 func classifyRecoveryFault(err error) recoveryFault {
-	if errors.Is(err, handlers_ec2_instance.ErrVolumeHeldElsewhere) {
+	if errors.Is(err, ec2instance.ErrVolumeHeldElsewhere) {
 		return recoveryFaultLeaseHeld
 	}
 	if code, ok := awserrors.ResolveErrorCode(err); ok && code == awserrors.ErrorInsufficientInstanceCapacity {
@@ -16,9 +16,9 @@ import (
 	"time"

 	"github.com/mulgadc/spinifex/spinifex/bootstrap/config"
+	ec2instance "github.com/mulgadc/spinifex/spinifex/domains/ec2/instance"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
 	"github.com/mulgadc/spinifex/spinifex/foundation/lifecycle/resource"
-	handlers_ec2_instance "github.com/mulgadc/spinifex/spinifex/handlers/ec2/instance"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/cache"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
 	"github.com/stretchr/testify/assert"
@@ -224,7 +224,7 @@ func TestWhatStopsTheLoopStarting(t *testing.T) {
 				node:            "node-1",
 				clusterConfig:   &config.ClusterConfig{Nodes: map[string]config.Config{"node-1": {}, "node-2": {}}},
 				jsManager:       &JetStreamManager{},
-				instanceService: &handlers_ec2_instance.InstanceServiceImpl{},
+				instanceService: &ec2instance.InstanceServiceImpl{},
 			}
 		}},
 	}
@@ -374,7 +374,7 @@ func TestWhatTheLaunchRefusalMeansForTheNextAttempt(t *testing.T) {
 		{
 			name: "the old owner still holds the volume lease",
 			err: fmt.Errorf("mount refused: %w", fmt.Errorf("%w: %w",
-				handlers_ec2_instance.ErrVolumeHeldElsewhere,
+				ec2instance.ErrVolumeHeldElsewhere,
 				awserrors.Errorf(awserrors.ErrorIncorrectState, "volume is leased by another owner: node-1"))),
 			want: recoveryFaultLeaseHeld,
 			code: "Server.HostRecoveryFailed",
@@ -4,49 +4,49 @@ import (
 	"context"

 	"github.com/aws/aws-sdk-go/service/ec2"
-	handlers_ec2_instance "github.com/mulgadc/spinifex/spinifex/handlers/ec2/instance"
+	ec2instance "github.com/mulgadc/spinifex/spinifex/domains/ec2/instance"
 )

 // daemonENICreator adapts the daemon's VPCServiceImpl to the
-// handlers_ec2_instance.ENICreator interface so RunInstances can stay free of
+// ec2instance.ENICreator interface so RunInstances can stay free of
 // the wider VPC service surface. Returned subnet records are translated to
-// handlers_ec2_instance.SubnetInfo to avoid a cyclic instance↔vpc import.
+// ec2instance.SubnetInfo to avoid a cyclic instance↔vpc import.
 type daemonENICreator struct {
 	d *Daemon
 }

-var _ handlers_ec2_instance.ENICreator = (*daemonENICreator)(nil)
+var _ ec2instance.ENICreator = (*daemonENICreator)(nil)

-func (a *daemonENICreator) GetDefaultSubnet(_ context.Context, accountID string) (*handlers_ec2_instance.SubnetInfo, error) {
+func (a *daemonENICreator) GetDefaultSubnet(_ context.Context, accountID string) (*ec2instance.SubnetInfo, error) {
 	rec, err := a.d.vpcService.GetDefaultSubnet(accountID)
 	if err != nil {
 		return nil, err
 	}
-	return &handlers_ec2_instance.SubnetInfo{
+	return &ec2instance.SubnetInfo{
 		SubnetID:            rec.SubnetId,
 		VpcID:               rec.VpcId,
 		MapPublicIpOnLaunch: rec.MapPublicIpOnLaunch,
 	}, nil
 }

-func (a *daemonENICreator) GetSubnet(_ context.Context, accountID, subnetID string) (*handlers_ec2_instance.SubnetInfo, error) {
+func (a *daemonENICreator) GetSubnet(_ context.Context, accountID, subnetID string) (*ec2instance.SubnetInfo, error) {
 	rec, err := a.d.vpcService.GetSubnet(accountID, subnetID)
 	if err != nil {
 		return nil, err
 	}
-	return &handlers_ec2_instance.SubnetInfo{
+	return &ec2instance.SubnetInfo{
 		SubnetID:            rec.SubnetId,
 		VpcID:               rec.VpcId,
 		MapPublicIpOnLaunch: rec.MapPublicIpOnLaunch,
 	}, nil
 }

-func (a *daemonENICreator) GetENI(_ context.Context, accountID, eniID string) (*handlers_ec2_instance.ENIInfo, error) {
+func (a *daemonENICreator) GetENI(_ context.Context, accountID, eniID string) (*ec2instance.ENIInfo, error) {
 	rec, err := a.d.vpcService.GetENIRecord(accountID, eniID)
 	if err != nil {
 		return nil, err
 	}
-	return &handlers_ec2_instance.ENIInfo{
+	return &ec2instance.ENIInfo{
 		NetworkInterfaceID: rec.NetworkInterfaceId,
 		SubnetID:           rec.SubnetId,
 		VpcID:              rec.VpcId,
@@ -81,14 +81,14 @@ func (a *daemonENICreator) ENIHasEIP(ctx context.Context, accountID, eniID strin
 	return a.d.vpcService.ENIHasEIP(ctx, accountID, eniID)
 }

-func (a *daemonENICreator) ListInstanceENIs(_ context.Context, accountID, instanceID string) ([]handlers_ec2_instance.ENIInfo, error) {
+func (a *daemonENICreator) ListInstanceENIs(_ context.Context, accountID, instanceID string) ([]ec2instance.ENIInfo, error) {
 	records, err := a.d.vpcService.ListInstanceENIs(accountID, instanceID)
 	if err != nil {
 		return nil, err
 	}
-	out := make([]handlers_ec2_instance.ENIInfo, 0, len(records))
+	out := make([]ec2instance.ENIInfo, 0, len(records))
 	for _, rec := range records {
-		out = append(out, handlers_ec2_instance.ENIInfo{
+		out = append(out, ec2instance.ENIInfo{
 			NetworkInterfaceID: rec.NetworkInterfaceId,
 			SubnetID:           rec.SubnetId,
 			VpcID:              rec.VpcId,
@@ -9,7 +9,7 @@ import (

 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
-	handlers_ec2_instance "github.com/mulgadc/spinifex/spinifex/handlers/ec2/instance"
+	ec2instance "github.com/mulgadc/spinifex/spinifex/domains/ec2/instance"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
 )

@@ -80,7 +80,7 @@ func (l *localInstanceLookup) describe(ctx context.Context, accountID, instanceI
 			return nil, err
 		}
 	}
-	if v == nil || !handlers_ec2_instance.IsInstanceVisibleToCaller(accountID, v) {
+	if v == nil || !ec2instance.IsInstanceVisibleToCaller(accountID, v) {
 		return nil, nil // not present, or not visible to the caller
 	}
 	return instanceFactsFromVM(v), nil
@@ -1,4 +1,4 @@
-package handlers_ec2_image
+package image

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_image
+package image

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_image_test
+package image_test

 import (
 	"context"
@@ -14,8 +14,8 @@ import (
 	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/mulgadc/spinifex/internal/testkit/recordingstore"
 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/ebs/metadata"
+	ec2image "github.com/mulgadc/spinifex/spinifex/domains/ec2/image"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_ec2_image "github.com/mulgadc/spinifex/spinifex/handlers/ec2/image"
 	"github.com/mulgadc/spinifex/spinifex/providers/objectstore"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -68,7 +68,7 @@ func TestDescribeImagesByID_ReadsOnlyTheNamedDocument(t *testing.T) {
 	for _, catalog := range []int{1, 500} {
 		t.Run("catalog"+strconv.Itoa(catalog), func(t *testing.T) {
 			store := recordingstore.New()
-			svc := handlers_ec2_image.NewImageServiceImplWithStore(store, byIDBucket)
+			svc := ec2image.NewImageServiceImplWithStore(store, byIDBucket)
 			putByIDAMI(t, store, byIDAMIDoc(byIDImage, byIDAccount))
 			seedByIDCatalog(t, store, catalog)

@@ -90,7 +90,7 @@ func TestDescribeImagesByID_ReadsOnlyTheNamedDocument(t *testing.T) {
 // matched each document once however often the request named it.
 func TestDescribeImagesByID_MultipleAndDuplicateIDs(t *testing.T) {
 	store := recordingstore.New()
-	svc := handlers_ec2_image.NewImageServiceImplWithStore(store, byIDBucket)
+	svc := ec2image.NewImageServiceImplWithStore(store, byIDBucket)
 	putByIDAMI(t, store, byIDAMIDoc("ami-a", byIDAccount))
 	putByIDAMI(t, store, byIDAMIDoc("ami-b", byIDAccount))

@@ -125,7 +125,7 @@ func TestDescribeImagesByID_HiddenAndMissingAreIndistinguishable(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			store := recordingstore.New()
-			svc := handlers_ec2_image.NewImageServiceImplWithStore(store, byIDBucket)
+			svc := ec2image.NewImageServiceImplWithStore(store, byIDBucket)
 			if tt.seedImage {
 				putByIDAMI(t, store, byIDAMIDoc(byIDImage, tt.seedOwner))
 			}
@@ -146,7 +146,7 @@ func TestDescribeImagesByID_HiddenAndMissingAreIndistinguishable(t *testing.T) {
 // account before any owner comparison and stays visible to every tenant.
 func TestDescribeImagesByID_SystemAMIIsVisibleToEveryAccount(t *testing.T) {
 	store := recordingstore.New()
-	svc := handlers_ec2_image.NewImageServiceImplWithStore(store, byIDBucket)
+	svc := ec2image.NewImageServiceImplWithStore(store, byIDBucket)
 	putByIDAMI(t, store, byIDAMIDoc(byIDImage, "amazon"))

 	out, err := svc.DescribeImages(t.Context(), &ec2.DescribeImagesInput{
@@ -175,7 +175,7 @@ func TestDescribeImagesByID_SystemAMIRendersPublicAmazon(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			store := recordingstore.New()
-			svc := handlers_ec2_image.NewImageServiceImplWithStore(store, byIDBucket)
+			svc := ec2image.NewImageServiceImplWithStore(store, byIDBucket)
 			putByIDAMI(t, store, byIDAMIDoc(byIDImage, tt.ownerAlias))

 			out, err := svc.DescribeImages(t.Context(), &ec2.DescribeImagesInput{
@@ -217,7 +217,7 @@ func TestDescribeImagesByID_OwnerFilters(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			store := recordingstore.New()
-			svc := handlers_ec2_image.NewImageServiceImplWithStore(store, byIDBucket)
+			svc := ec2image.NewImageServiceImplWithStore(store, byIDBucket)
 			putByIDAMI(t, store, byIDAMIDoc(byIDImage, tt.ownerAlias))

 			out, err := svc.DescribeImages(t.Context(), &ec2.DescribeImagesInput{
@@ -257,7 +257,7 @@ func TestDescribeImagesByID_AttributeFilters(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			store := recordingstore.New()
-			svc := handlers_ec2_image.NewImageServiceImplWithStore(store, byIDBucket)
+			svc := ec2image.NewImageServiceImplWithStore(store, byIDBucket)
 			putByIDAMI(t, store, byIDAMIDoc(byIDImage, byIDAccount))

 			out, err := svc.DescribeImages(t.Context(), &ec2.DescribeImagesInput{
@@ -284,7 +284,7 @@ func TestDescribeImagesByID_AttributeFilters(t *testing.T) {
 // unreadable document fails the call instead of reporting it as absent.
 func TestDescribeImagesByID_CorruptDocumentFailsTheCall(t *testing.T) {
 	store := recordingstore.New()
-	svc := handlers_ec2_image.NewImageServiceImplWithStore(store, byIDBucket)
+	svc := ec2image.NewImageServiceImplWithStore(store, byIDBucket)
 	_, err := store.PutObject(t.Context(), &s3.PutObjectInput{
 		Bucket: aws.String(byIDBucket),
 		Key:    aws.String(amiKey(t, byIDImage)),
@@ -321,7 +321,7 @@ func (s *getFailingStore) GetObject(ctx context.Context, input *s3.GetObjectInpu
 func TestDescribeImagesByID_StoreErrorIsInternal(t *testing.T) {
 	memory := objectstore.NewMemoryObjectStore()
 	store := &getFailingStore{MemoryObjectStore: memory, failKey: amiKey(t, byIDImage)}
-	svc := handlers_ec2_image.NewImageServiceImplWithStore(store, byIDBucket)
+	svc := ec2image.NewImageServiceImplWithStore(store, byIDBucket)
 	putByIDAMI(t, memory, byIDAMIDoc(byIDImage, byIDAccount))

 	_, err := svc.DescribeImages(t.Context(), &ec2.DescribeImagesInput{
@@ -338,7 +338,7 @@ func TestDescribeImagesByID_StoreErrorIsInternal(t *testing.T) {
 func TestDescribeImagesByID_StoreErrorOutranksAMissingID(t *testing.T) {
 	memory := objectstore.NewMemoryObjectStore()
 	store := &getFailingStore{MemoryObjectStore: memory, failKey: amiKey(t, byIDImage)}
-	svc := handlers_ec2_image.NewImageServiceImplWithStore(store, byIDBucket)
+	svc := ec2image.NewImageServiceImplWithStore(store, byIDBucket)
 	putByIDAMI(t, memory, byIDAMIDoc(byIDImage, byIDAccount))

 	_, err := svc.DescribeImages(t.Context(), &ec2.DescribeImagesInput{
@@ -353,7 +353,7 @@ func TestDescribeImagesByID_StoreErrorOutranksAMissingID(t *testing.T) {
 // reads as "this image does not exist".
 func TestDescribeImagesByID_CancelledContextFails(t *testing.T) {
 	store := recordingstore.New()
-	svc := handlers_ec2_image.NewImageServiceImplWithStore(store, byIDBucket)
+	svc := ec2image.NewImageServiceImplWithStore(store, byIDBucket)
 	putByIDAMI(t, store, byIDAMIDoc(byIDImage, byIDAccount))
 	ctx, cancel := context.WithCancel(t.Context())
 	cancel()
@@ -371,7 +371,7 @@ func TestDescribeImagesByID_CancelledContextFails(t *testing.T) {
 // rather than a missing image, and reads nothing to find that out.
 func TestDescribeImagesByID_OnlyNilIDs(t *testing.T) {
 	store := recordingstore.New()
-	svc := handlers_ec2_image.NewImageServiceImplWithStore(store, byIDBucket)
+	svc := ec2image.NewImageServiceImplWithStore(store, byIDBucket)
 	putByIDAMI(t, store, byIDAMIDoc(byIDImage, byIDAccount))

 	out, err := svc.DescribeImages(t.Context(), &ec2.DescribeImagesInput{ImageIds: []*string{nil}}, byIDAccount)
@@ -1,4 +1,4 @@
-package handlers_ec2_image
+package image

 import (
 	"context"
@@ -21,7 +21,7 @@ import (

 const drainImageInstanceID = "i-image-drain-host"

-// setupDrainImageService mirrors handlers/ec2/snapshot's setupDrainService: a
+// setupDrainImageService mirrors domains/ec2/snapshot's setupDrainService: a
 // reachable (but rejecting) Predastore host so a drained volume falls through
 // into the real snapshot path and fails fast, a data dir with no local drain
 // socket, and a NATS connection to route the drain to the hosting node.
@@ -1,4 +1,4 @@
-package handlers_ec2_image
+package image

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_image
+package image

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_image
+package image

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_image
+package image

 import (
 	"context"
@@ -18,11 +18,11 @@ import (
 	"github.com/mulgadc/spinifex/spinifex/bootstrap/config"
 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/ebs/metadata"
 	ec2platform "github.com/mulgadc/spinifex/spinifex/domains/ec2/platform"
+	ec2snapshot "github.com/mulgadc/spinifex/spinifex/domains/ec2/snapshot"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
 	awsfilters "github.com/mulgadc/spinifex/spinifex/foundation/aws/filters"
 	awsidentifiers "github.com/mulgadc/spinifex/spinifex/foundation/aws/identifiers"
 	awstags "github.com/mulgadc/spinifex/spinifex/foundation/aws/tags"
-	handlers_ec2_snapshot "github.com/mulgadc/spinifex/spinifex/handlers/ec2/snapshot"
 	"github.com/mulgadc/spinifex/spinifex/providers/ebs"
 	"github.com/mulgadc/spinifex/spinifex/providers/objectstore"
 	"github.com/mulgadc/spinifex/spinifex/utils"
@@ -517,7 +517,7 @@ func (s *ImageServiceImpl) CreateImageFromInstance(params CreateImageParams, acc
 // snapshotRunningVolume creates a snapshot of a running instance's volume by
 // draining it to the node hosting it (so any writes buffered there reach S3),
 // then reading the live checkpoint written by nbdkit on every NBD Flush. This
-// shares handlers/ec2/snapshot's DrainVolume with ec2.CreateSnapshot so the two
+// shares domains/ec2/snapshot's DrainVolume with ec2.CreateSnapshot so the two
 // live-snapshot paths cannot diverge on when a drain is required.
 func (s *ImageServiceImpl) snapshotRunningVolume(volumeID, snapshotID, accountID string) error {
 	if s.config == nil {
@@ -535,7 +535,7 @@ func (s *ImageServiceImpl) snapshotRunningVolume(volumeID, snapshotID, accountID
 	// predating e.g. a guest-triggered GPT rewrite (growpart on first boot). An
 	// attached volume that cannot be drained fails here rather than silently
 	// producing an image from a stale checkpoint.
-	if err := handlers_ec2_snapshot.DrainVolume(context.Background(), s.config, s.store, s.natsConn, volumeID, volMeta.State, volMeta.AttachedInstance, accountID); err != nil {
+	if err := ec2snapshot.DrainVolume(context.Background(), s.config, s.store, s.natsConn, volumeID, volMeta.State, volMeta.AttachedInstance, accountID); err != nil {
 		slog.Error("snapshotRunningVolume: drain failed", "volumeId", volumeID, "err", err)
 		return errors.New(awserrors.ErrorServerInternal)
 	}
@@ -1,4 +1,4 @@
-package handlers_ec2_image
+package image

 import (
 	"crypto/rand"
@@ -1,4 +1,4 @@
-package handlers_ec2_image
+package image

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_image
+package image

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_image
+package image

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_image
+package image

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_instance_test
+package instance_test

 import (
 	"context"
@@ -9,7 +9,7 @@ import (
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/mulgadc/bluebottle/pkg/safecast"
 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/ebs/metadata"
-	handlers_ec2_instance "github.com/mulgadc/spinifex/spinifex/handlers/ec2/instance"
+	ec2instance "github.com/mulgadc/spinifex/spinifex/domains/ec2/instance"
 	"github.com/mulgadc/spinifex/spinifex/providers/ebs"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
 	"github.com/stretchr/testify/assert"
@@ -51,9 +51,9 @@ func (f *fakeVolumeCreator) DeleteVolume(_ context.Context, input *ec2.DeleteVol

 // dataVolumeService builds an instance service with a metadata store and the
 // fake creator wired in, which is all the data-volume path touches.
-func dataVolumeService(t *testing.T, creator *fakeVolumeCreator) *handlers_ec2_instance.InstanceServiceImpl {
+func dataVolumeService(t *testing.T, creator *fakeVolumeCreator) *ec2instance.InstanceServiceImpl {
 	t.Helper()
-	svc := handlers_ec2_instance.NewProviderRootVolumeTestService(t)
+	svc := ec2instance.NewProviderRootVolumeTestService(t)
 	creator.metadata = svc.MetadataStore()
 	svc.SetVolumeCreator(creator)
 	return svc
@@ -80,7 +80,7 @@ func dataMappingInput(devices ...string) *ec2.RunInstancesInput {
 func TestPrepareDataVolumes_CreatesOnePerMapping(t *testing.T) {
 	creator := &fakeVolumeCreator{}
 	svc := dataVolumeService(t, creator)
-	instance := &vm.VM{AccountID: handlers_ec2_instance.TestRootAccount}
+	instance := &vm.VM{AccountID: ec2instance.TestRootAccount}

 	infos, err := svc.PrepareDataVolumes(context.Background(), dataMappingInput("/dev/sdf", "/dev/sdg"), instance)
 	require.NoError(t, err)
@@ -91,7 +91,7 @@ func TestPrepareDataVolumes_CreatesOnePerMapping(t *testing.T) {
 	require.Len(t, creator.created, 2)
 	assert.Equal(t, int64(4), aws.Int64Value(creator.created[0].Size))
 	assert.Equal(t, int64(5), aws.Int64Value(creator.created[1].Size))
-	assert.Equal(t, handlers_ec2_instance.TestRootAZ, aws.StringValue(creator.created[0].AvailabilityZone))
+	assert.Equal(t, ec2instance.TestRootAZ, aws.StringValue(creator.created[0].AvailabilityZone))

 	require.Len(t, instance.EBSRequests.Requests, 2)
 	for i, req := range instance.EBSRequests.Requests {
@@ -105,7 +105,7 @@ func TestPrepareDataVolumes_CreatesOnePerMapping(t *testing.T) {
 func TestPrepareDataVolumes_NoMappingsCreatesNothing(t *testing.T) {
 	creator := &fakeVolumeCreator{}
 	svc := dataVolumeService(t, creator)
-	instance := &vm.VM{AccountID: handlers_ec2_instance.TestRootAccount}
+	instance := &vm.VM{AccountID: ec2instance.TestRootAccount}

 	infos, err := svc.PrepareDataVolumes(context.Background(), dataMappingInput(), instance)
 	require.NoError(t, err)
@@ -119,7 +119,7 @@ func TestPrepareDataVolumes_NoMappingsCreatesNothing(t *testing.T) {
 func TestPrepareDataVolumes_UnwindsWhatItCreated(t *testing.T) {
 	creator := &fakeVolumeCreator{failFrom: 1}
 	svc := dataVolumeService(t, creator)
-	instance := &vm.VM{AccountID: handlers_ec2_instance.TestRootAccount}
+	instance := &vm.VM{AccountID: ec2instance.TestRootAccount}

 	_, err := svc.PrepareDataVolumes(context.Background(), dataMappingInput("/dev/sdf", "/dev/sdg"), instance)
 	require.Error(t, err)
@@ -132,7 +132,7 @@ func TestPrepareDataVolumes_UnwindsWhatItCreated(t *testing.T) {
 func TestPrepareDataVolumes_RecordsDeleteOnTermination(t *testing.T) {
 	creator := &fakeVolumeCreator{}
 	svc := dataVolumeService(t, creator)
-	instance := &vm.VM{AccountID: handlers_ec2_instance.TestRootAccount}
+	instance := &vm.VM{AccountID: ec2instance.TestRootAccount}

 	input := dataMappingInput("/dev/sdf")
 	input.BlockDeviceMappings[1].Ebs.DeleteOnTermination = aws.Bool(false)
@@ -143,16 +143,16 @@ func TestPrepareDataVolumes_RecordsDeleteOnTermination(t *testing.T) {
 	require.Len(t, instance.EBSRequests.Requests, 1)
 	assert.False(t, instance.EBSRequests.Requests[0].DeleteOnTermination)

-	doc, err := svc.MetadataStore().GetVolume(context.Background(), handlers_ec2_instance.TestRootAccount, infos[0].VolumeId)
+	doc, err := svc.MetadataStore().GetVolume(context.Background(), ec2instance.TestRootAccount, infos[0].VolumeId)
 	require.NoError(t, err)
 	assert.False(t, doc.DeleteOnTermination)

 	kept := &fakeVolumeCreator{}
 	keptSvc := dataVolumeService(t, kept)
-	keptInfos, err := keptSvc.PrepareDataVolumes(context.Background(), dataMappingInput("/dev/sdf"), &vm.VM{AccountID: handlers_ec2_instance.TestRootAccount})
+	keptInfos, err := keptSvc.PrepareDataVolumes(context.Background(), dataMappingInput("/dev/sdf"), &vm.VM{AccountID: ec2instance.TestRootAccount})
 	require.NoError(t, err)
 	require.Len(t, keptInfos, 1)
-	doc, err = keptSvc.MetadataStore().GetVolume(context.Background(), handlers_ec2_instance.TestRootAccount, keptInfos[0].VolumeId)
+	doc, err = keptSvc.MetadataStore().GetVolume(context.Background(), ec2instance.TestRootAccount, keptInfos[0].VolumeId)
 	require.NoError(t, err)
 	assert.True(t, doc.DeleteOnTermination)
 }
@@ -166,7 +166,7 @@ func TestParseDataVolumeParams_SkipsRootAndEphemeral(t *testing.T) {
 			{DeviceName: aws.String("/dev/sdb"), VirtualName: aws.String("ephemeral0")},
 		},
 	}
-	params := handlers_ec2_instance.ParseDataVolumeParams(input)
+	params := ec2instance.ParseDataVolumeParams(input)
 	require.Len(t, params, 1)
 	assert.Equal(t, "/dev/sdf", params[0].DeviceName)
 	assert.Equal(t, int64(4), params[0].SizeGiB)
@@ -1,4 +1,4 @@
-package handlers_ec2_instance
+package instance

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_instance
+package instance

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_instance
+package instance

 import (
 	"testing"
@@ -2,7 +2,7 @@
 //stoppedStore field set, so the stopped path is exercised without standing up
 //the rest of the service.

-package handlers_ec2_instance
+package instance

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_instance
+package instance

 import (
 	"context"
@@ -3,7 +3,7 @@
 // surface: it is driven by the recovery reconciler, not by a request.
 //
 //test:in-package — the service's dependencies and launchClaimedInstance itself are unexported.
-package handlers_ec2_instance
+package instance

 import (
 	"testing"
@@ -1,4 +1,4 @@
-package handlers_ec2_instance
+package instance

 import (
 	"errors"
@@ -1,4 +1,4 @@
-package handlers_ec2_instance
+package instance

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_instance
+package instance

 import (
 	"errors"
@@ -1,7 +1,7 @@
 //test:in-package — extends projection_test.go's in-package fullVM fixture and
 // projects through the unexported field set it builds.

-package handlers_ec2_instance
+package instance

 import (
 	"testing"
@@ -1,4 +1,4 @@
-package handlers_ec2_instance
+package instance

 import (
 	"testing"
@@ -1,4 +1,4 @@
-package handlers_ec2_instance
+package instance

 import (
 	"bytes"
@@ -1,4 +1,4 @@
-package handlers_ec2_instance
+package instance

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_instance
+package instance

 import (
 	"context"
@@ -101,13 +101,13 @@ type StoppedInstanceStore interface {

 // InstanceTagWriter projects an instance record's full tag set into the
 // central tag store, and removes it on terminate. Implemented by
-// handlers/ec2/tags.TagsServiceImpl.
+// domains/ec2/tags.TagsServiceImpl.
 type InstanceTagWriter interface {
 	PutResourceTags(ctx context.Context, accountID, resourceID string, tags map[string]string) error
 	DeleteAllTags(ctx context.Context, accountID, resourceID string) error
 }

-// VolumeDeleter deletes EBS volumes. Implemented by handlers/ec2/volume's
+// VolumeDeleter deletes EBS volumes. Implemented by domains/ec2/volume's
 // VolumeServiceImpl (used by the daemon).
 type VolumeDeleter interface {
 	DeleteVolume(ctx context.Context, input *ec2.DeleteVolumeInput, accountID string) (*ec2.DeleteVolumeOutput, error)
@@ -126,7 +126,7 @@ type VolumeDeleter interface {
 }

 // VolumeCreator creates the volumes a launch names beyond the root device, and
-// deletes them again when the launch fails. Implemented by handlers/ec2/volume's
+// deletes them again when the launch fails. Implemented by domains/ec2/volume's
 // VolumeServiceImpl.
 type VolumeCreator interface {
 	CreateVolume(ctx context.Context, input *ec2.CreateVolumeInput, accountID string) (*ec2.Volume, error)
@@ -1,4 +1,4 @@
-package handlers_ec2_instance
+package instance

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_instance
+package instance

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_instance
+package instance

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_instance
+package instance

 import (
 	"context"
@@ -3,7 +3,7 @@
 // did to the address before the launch it then fails.
 //
 //test:in-package — every dependency it substitutes is an unexported field.
-package handlers_ec2_instance
+package instance

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_instance
+package instance

 import (
 	"log/slog"
@@ -1,4 +1,4 @@
-package handlers_ec2_instance
+package instance

 //test:in-package — volumeHeldElsewhereError is unexported, and exporting it
 //would widen the handler API for a test rather than for a caller.
@@ -51,7 +51,7 @@ type KeyServiceImpl struct {
 }

 // CentralTagStore keeps the central tag index in step with key-pair records, so
-// DescribeTags sees creation tags. Implemented by handlers/ec2/tags.TagsServiceImpl.
+// DescribeTags sees creation tags. Implemented by domains/ec2/tags.TagsServiceImpl.
 type CentralTagStore interface {
 	PutResourceTags(ctx context.Context, accountID, resourceID string, tags map[string]string) error
 	DeleteAllTags(ctx context.Context, accountID, resourceID string) error
@@ -1,4 +1,4 @@
-package handlers_ec2_snapshot_test
+package snapshot_test

 import (
 	"context"
@@ -12,7 +12,7 @@ import (
 	"github.com/mulgadc/spinifex/internal/testkit/pagedstore"
 	"github.com/mulgadc/spinifex/spinifex/bootstrap/config"
 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/ebs/metadata"
-	handlers_ec2_snapshot "github.com/mulgadc/spinifex/spinifex/handlers/ec2/snapshot"
+	ec2snapshot "github.com/mulgadc/spinifex/spinifex/domains/ec2/snapshot"
 	"github.com/mulgadc/spinifex/spinifex/providers/ebs"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -34,7 +34,7 @@ func TestDeleteSnapshot_RemovesEveryObjectAcrossMultiplePages(t *testing.T) {
 			AccessKey: "test-owner-123",
 		},
 	}
-	svc := handlers_ec2_snapshot.NewSnapshotServiceImplWithStore(cfg, store, nil)
+	svc := ec2snapshot.NewSnapshotServiceImplWithStore(cfg, store, nil)
 	provider := ebsprovider.NewMemoryProvider(ebsprovider.Capabilities{})
 	svc.SetEBSProvider(provider)

@@ -1,4 +1,4 @@
-package handlers_ec2_snapshot_test
+package snapshot_test

 import (
 	"context"
@@ -14,8 +14,8 @@ import (
 	"github.com/mulgadc/spinifex/internal/testkit/recordingstore"
 	"github.com/mulgadc/spinifex/spinifex/bootstrap/config"
 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/ebs/metadata"
+	ec2snapshot "github.com/mulgadc/spinifex/spinifex/domains/ec2/snapshot"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_ec2_snapshot "github.com/mulgadc/spinifex/spinifex/handlers/ec2/snapshot"
 	"github.com/mulgadc/spinifex/spinifex/providers/objectstore"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -31,9 +31,9 @@ const (

 // newByIDService builds a snapshot service over store, with no EBS provider:
 // every test here answers out of the metadata documents alone.
-func newByIDService(store objectstore.ObjectStore) *handlers_ec2_snapshot.SnapshotServiceImpl {
+func newByIDService(store objectstore.ObjectStore) *ec2snapshot.SnapshotServiceImpl {
 	cfg := &config.Config{Predastore: config.PredastoreConfig{Bucket: byIDBucket}}
-	return handlers_ec2_snapshot.NewSnapshotServiceImplWithStore(cfg, store, nil)
+	return ec2snapshot.NewSnapshotServiceImplWithStore(cfg, store, nil)
 }

 func putByIDSnapshot(t *testing.T, store objectstore.ObjectStore, snapshot ebsmetadata.Snapshot) {
@@ -1,4 +1,4 @@
-package handlers_ec2_snapshot_test
+package snapshot_test

 import (
 	"context"
@@ -10,8 +10,8 @@ import (
 	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/mulgadc/spinifex/spinifex/bootstrap/config"
 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/ebs/metadata"
+	ec2snapshot "github.com/mulgadc/spinifex/spinifex/domains/ec2/snapshot"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_ec2_snapshot "github.com/mulgadc/spinifex/spinifex/handlers/ec2/snapshot"
 	"github.com/mulgadc/spinifex/spinifex/providers/objectstore"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -52,10 +52,10 @@ func (s *slowMetadataStore) GetObject(ctx context.Context, input *s3.GetObjectIn
 	return s.ObjectStore.GetObject(ctx, input)
 }

-func seedSnapshots(t *testing.T, store objectstore.ObjectStore, n int) *handlers_ec2_snapshot.SnapshotServiceImpl {
+func seedSnapshots(t *testing.T, store objectstore.ObjectStore, n int) *ec2snapshot.SnapshotServiceImpl {
 	t.Helper()
 	cfg := &config.Config{Predastore: config.PredastoreConfig{Bucket: "test-bucket"}}
-	svc := handlers_ec2_snapshot.NewSnapshotServiceImplWithStore(cfg, store, nil)
+	svc := ec2snapshot.NewSnapshotServiceImplWithStore(cfg, store, nil)
 	metadata := ebsmetadata.NewStore(store, "test-bucket")
 	for i := range n {
 		id := "snap-fanout" + string(rune('a'+i%26)) + string(rune('a'+i/26))
@@ -1,4 +1,4 @@
-package handlers_ec2_snapshot
+package snapshot

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_snapshot
+package snapshot

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_snapshot
+package snapshot

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_snapshot
+package snapshot

 import (
 	"context"
@@ -311,7 +311,7 @@ func (s *SnapshotServiceImpl) drainVolume(ctx context.Context, volumeID string,

 // DrainVolume flushes the volume's in-flight writes to S3 before a live
 // checkpoint is read from there. Shared by ec2.CreateSnapshot and
-// ec2.CreateImage's running-instance path (handlers/ec2/image) so the two
+// ec2.CreateImage's running-instance path (domains/ec2/image) so the two
 // live-snapshot call sites cannot diverge on when a drain is required.
 //
 // The drain socket lives on the node serving the volume, but both callers are
@@ -1,4 +1,4 @@
-package handlers_ec2_snapshot
+package snapshot

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_snapshot
+package snapshot

 import (
 	"context"
@@ -2,7 +2,7 @@
 // createTestVolume, all package-internal.
 //
 //test:in-package
-package handlers_ec2_snapshot
+package snapshot

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_tags_test
+package tags_test

 import (
 	"testing"
@@ -8,7 +8,7 @@ import (
 	"github.com/mulgadc/spinifex/internal/testkit"
 	"github.com/mulgadc/spinifex/spinifex/bootstrap/config"
 	ec2key "github.com/mulgadc/spinifex/spinifex/domains/ec2/key"
-	handlers_ec2_tags "github.com/mulgadc/spinifex/spinifex/handlers/ec2/tags"
+	ec2tags "github.com/mulgadc/spinifex/spinifex/domains/ec2/tags"
 	"github.com/mulgadc/spinifex/spinifex/providers/objectstore"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -19,13 +19,13 @@ const (
 	testED25519PubKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl"
 )

-func newTagsService(t *testing.T) *handlers_ec2_tags.TagsServiceImpl {
+func newTagsService(t *testing.T) *ec2tags.TagsServiceImpl {
 	t.Helper()
 	_, nc, _ := testutil.StartTestJetStream(t)
-	kv, err := handlers_ec2_tags.GetOrCreateTagsBucket(t.Context(), testutil.NewJetStream(t, nc))
+	kv, err := ec2tags.GetOrCreateTagsBucket(t.Context(), testutil.NewJetStream(t, nc))
 	require.NoError(t, err)
 	cfg := &config.Config{Predastore: config.PredastoreConfig{Bucket: "test-bucket"}}
-	return handlers_ec2_tags.NewTagsServiceImplWithStore(cfg, objectstore.NewMemoryObjectStore(), kv)
+	return ec2tags.NewTagsServiceImplWithStore(cfg, objectstore.NewMemoryObjectStore(), kv)
 }

 func keyPairTagSpec(tags map[string]string) []*ec2.TagSpecification {
@@ -36,7 +36,7 @@ func keyPairTagSpec(tags map[string]string) []*ec2.TagSpecification {
 	return []*ec2.TagSpecification{spec}
 }

-func describeKeyPairTags(t *testing.T, svc *handlers_ec2_tags.TagsServiceImpl) map[string]map[string]string {
+func describeKeyPairTags(t *testing.T, svc *ec2tags.TagsServiceImpl) map[string]map[string]string {
 	t.Helper()
 	out, err := svc.DescribeTags(t.Context(), &ec2.DescribeTagsInput{
 		Filters: []*ec2.Filter{{Name: aws.String("resource-type"), Values: []*string{aws.String("key-pair")}}},
@@ -1,4 +1,4 @@
-package handlers_ec2_tags
+package tags

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_tags
+package tags

 import (
 	"context"
@@ -16,13 +16,13 @@ import (
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/mulgadc/spinifex/spinifex/bootstrap/config"
+	ec2instance "github.com/mulgadc/spinifex/spinifex/domains/ec2/instance"
 	ec2key "github.com/mulgadc/spinifex/spinifex/domains/ec2/key"
 	ec2vpc "github.com/mulgadc/spinifex/spinifex/domains/ec2/vpc"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/arn"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
 	awsfilters "github.com/mulgadc/spinifex/spinifex/foundation/aws/filters"
 	"github.com/mulgadc/spinifex/spinifex/foundation/state/kvutil"
-	handlers_ec2_instance "github.com/mulgadc/spinifex/spinifex/handlers/ec2/instance"
 	"github.com/mulgadc/spinifex/spinifex/providers/objectstore"
 	"github.com/nats-io/nats.go/jetstream"
 )
@@ -31,7 +31,7 @@ import (
 var _ TagsService = (*TagsServiceImpl)(nil)

 // Ensure TagsServiceImpl can project instance record tags into the store.
-var _ handlers_ec2_instance.InstanceTagWriter = (*TagsServiceImpl)(nil)
+var _ ec2instance.InstanceTagWriter = (*TagsServiceImpl)(nil)

 // Ensure TagsServiceImpl can both project and clear vpc/subnet/sg/eni record tags.
 var _ ec2vpc.CentralTagStore = (*TagsServiceImpl)(nil)
@@ -1,4 +1,4 @@
-package handlers_ec2_tags
+package tags

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_tags
+package tags

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_tags
+package tags

 import (
 	"context"
@@ -2,7 +2,7 @@
 // not tell a migrated resource from one that was never written.
 //
 //test:in-package — the read-through fallback and the key layout are
-package handlers_ec2_tags
+package tags

 import (
 	"bytes"
@@ -1,4 +1,4 @@
-package handlers_ec2_volume
+package volume

 import (
 	"testing"
@@ -1,4 +1,4 @@
-package handlers_ec2_volume
+package volume

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_volume
+package volume

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_volume
+package volume

 //test:in-package — seeding a volume's metadata document is how the attachment
 // under test is created, and the metadata store is unexported.
@@ -1,4 +1,4 @@
-package handlers_ec2_volume
+package volume

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_volume
+package volume

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_volume
+package volume

 import (
 	"io"
@@ -1,4 +1,4 @@
-package handlers_ec2_volume
+package volume

 import (
 	"context"
@@ -10,7 +10,7 @@ import (
 	"github.com/mulgadc/spinifex/spinifex/bootstrap/config"
 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/ebs/metadata"
 	ebspolicy "github.com/mulgadc/spinifex/spinifex/domains/ec2/ebs/policy"
-	handlers_ec2_instance "github.com/mulgadc/spinifex/spinifex/handlers/ec2/instance"
+	ec2instance "github.com/mulgadc/spinifex/spinifex/domains/ec2/instance"
 	"github.com/mulgadc/spinifex/spinifex/providers/ebs"
 	"github.com/mulgadc/spinifex/spinifex/providers/objectstore"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
@@ -135,7 +135,7 @@ func TestDescribeVolumes_Provider_SeesInstanceRootVolume(t *testing.T) {
 	})
 	require.NoError(t, err)

-	instanceSvc := handlers_ec2_instance.NewInstanceServiceImpl(cfg, nil, nil, store, nil, nil, nil)
+	instanceSvc := ec2instance.NewInstanceServiceImpl(cfg, nil, nil, store, nil, nil, nil)
 	instanceSvc.SetEBSProvider(provider)
 	instanceSvc.SetRunInstancesDeps(&fixedAMILoader{
 		meta:           ebsmetadata.AMI{ImageID: "ami-1", SnapshotID: "snap-src", VolumeSizeGiB: 4},
@@ -1,4 +1,4 @@
-package handlers_ec2_volume
+package volume

 import (
 	"bytes"
@@ -1,4 +1,4 @@
-package handlers_ec2_volume
+package volume

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_volume
+package volume

 import (
 	"context"
@@ -20,11 +20,11 @@ import (
 	"github.com/mulgadc/spinifex/spinifex/bootstrap/config"
 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/ebs/metadata"
 	ebspolicy "github.com/mulgadc/spinifex/spinifex/domains/ec2/ebs/policy"
+	ec2instance "github.com/mulgadc/spinifex/spinifex/domains/ec2/instance"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
 	awsfilters "github.com/mulgadc/spinifex/spinifex/foundation/aws/filters"
 	awsidentifiers "github.com/mulgadc/spinifex/spinifex/foundation/aws/identifiers"
 	awstags "github.com/mulgadc/spinifex/spinifex/foundation/aws/tags"
-	handlers_ec2_instance "github.com/mulgadc/spinifex/spinifex/handlers/ec2/instance"
 	"github.com/mulgadc/spinifex/spinifex/providers/ebs"
 	"github.com/mulgadc/spinifex/spinifex/providers/objectstore"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
@@ -40,10 +40,10 @@ var _ VolumeService = (*VolumeServiceImpl)(nil)
 // can call UpdateVolumeState directly without a daemon-side adapter.
 var _ vm.VolumeStateUpdater = (*VolumeServiceImpl)(nil)

-// Ensure VolumeServiceImpl satisfies handlers/ec2/instance's VolumeDeleter so
+// Ensure VolumeServiceImpl satisfies domains/ec2/instance's VolumeDeleter so
 // InstanceServiceImpl can call DeleteVolume/DeleteVolumeOnTerminate through
 // the dependency wired via SetTerminationDeps.
-var _ handlers_ec2_instance.VolumeDeleter = (*VolumeServiceImpl)(nil)
+var _ ec2instance.VolumeDeleter = (*VolumeServiceImpl)(nil)

 // VolumeServiceImpl handles EBS volume operations with S3 storage.
 type VolumeServiceImpl struct {
@@ -1,4 +1,4 @@
-package handlers_ec2_volume
+package volume

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_volume
+package volume

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_volume
+package volume

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_volume
+package volume

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_volume
+package volume

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_ec2_volume
+package volume

 import (
 	"context"
@@ -2,7 +2,7 @@
 // package-internal.
 //
 //test:in-package
-package handlers_ec2_volume
+package volume

 import (
 	"context"
@@ -38,7 +38,7 @@ type VPCService interface {
 // CentralTagStore keeps the central tag index in step with this package's
 // records, so DescribeTags agrees with a resource's own describe for as long as
 // the resource exists and says nothing about it afterwards. Implemented by
-// handlers/ec2/tags.TagsServiceImpl.
+// domains/ec2/tags.TagsServiceImpl.
 type CentralTagStore interface {
 	PutResourceTags(ctx context.Context, accountID, resourceID string, tags map[string]string) error
 	DeleteAllTags(ctx context.Context, accountID, resourceID string) error
@@ -6,8 +6,8 @@ import (
 	"strings"

 	"github.com/aws/aws-sdk-go/service/ec2"
+	ec2image "github.com/mulgadc/spinifex/spinifex/domains/ec2/image"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_ec2_image "github.com/mulgadc/spinifex/spinifex/handlers/ec2/image"
 	"github.com/nats-io/nats.go"
 )

@@ -61,7 +61,7 @@ func CopyImage(ctx context.Context, input *ec2.CopyImageInput, natsConn *nats.Co
 		return output, err
 	}

-	svc := handlers_ec2_image.NewNATSImageService(natsConn, 0)
+	svc := ec2image.NewNATSImageService(natsConn, 0)
 	result, err := svc.CopyImage(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -6,8 +6,8 @@ import (
 	"strings"

 	"github.com/aws/aws-sdk-go/service/ec2"
+	ec2image "github.com/mulgadc/spinifex/spinifex/domains/ec2/image"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_ec2_image "github.com/mulgadc/spinifex/spinifex/handlers/ec2/image"
 	"github.com/nats-io/nats.go"
 )

@@ -40,7 +40,7 @@ func CreateImage(ctx context.Context, input *ec2.CreateImageInput, natsConn *nat
 		return output, err
 	}

-	svc := handlers_ec2_image.NewNATSImageService(natsConn, expectedNodes)
+	svc := ec2image.NewNATSImageService(natsConn, expectedNodes)
 	result, err := svc.CreateImage(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -6,8 +6,8 @@ import (
 	"strings"

 	"github.com/aws/aws-sdk-go/service/ec2"
+	ec2image "github.com/mulgadc/spinifex/spinifex/domains/ec2/image"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_ec2_image "github.com/mulgadc/spinifex/spinifex/handlers/ec2/image"
 	"github.com/nats-io/nats.go"
 )

@@ -28,7 +28,7 @@ func DeregisterImage(ctx context.Context, input *ec2.DeregisterImageInput, natsC
 		return output, err
 	}

-	svc := handlers_ec2_image.NewNATSImageService(natsConn, 0)
+	svc := ec2image.NewNATSImageService(natsConn, 0)
 	result, err := svc.DeregisterImage(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -6,8 +6,8 @@ import (
 	"strings"

 	"github.com/aws/aws-sdk-go/service/ec2"
+	ec2image "github.com/mulgadc/spinifex/spinifex/domains/ec2/image"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_ec2_image "github.com/mulgadc/spinifex/spinifex/handlers/ec2/image"
 	"github.com/nats-io/nats.go"
 )

@@ -45,7 +45,7 @@ func DescribeImageAttribute(ctx context.Context, input *ec2.DescribeImageAttribu
 		return output, err
 	}

-	svc := handlers_ec2_image.NewNATSImageService(natsConn, 0)
+	svc := ec2image.NewNATSImageService(natsConn, 0)
 	result, err := svc.DescribeImageAttribute(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -6,8 +6,8 @@ import (
 	"strings"

 	"github.com/aws/aws-sdk-go/service/ec2"
+	ec2image "github.com/mulgadc/spinifex/spinifex/domains/ec2/image"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_ec2_image "github.com/mulgadc/spinifex/spinifex/handlers/ec2/image"
 	"github.com/nats-io/nats.go"
 )

@@ -33,7 +33,7 @@ func DescribeImages(ctx context.Context, input *ec2.DescribeImagesInput, natsCon
 		return output, err
 	}

-	imageService := handlers_ec2_image.NewNATSImageService(natsConn, 0)
+	imageService := ec2image.NewNATSImageService(natsConn, 0)
 	result, err := imageService.DescribeImages(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -7,8 +7,8 @@ import (

 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
+	ec2image "github.com/mulgadc/spinifex/spinifex/domains/ec2/image"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_ec2_image "github.com/mulgadc/spinifex/spinifex/handlers/ec2/image"
 	"github.com/nats-io/nats.go"
 )

@@ -79,7 +79,7 @@ func ModifyImageAttribute(ctx context.Context, input *ec2.ModifyImageAttributeIn
 		return output, err
 	}

-	svc := handlers_ec2_image.NewNATSImageService(natsConn, 0)
+	svc := ec2image.NewNATSImageService(natsConn, 0)
 	result, err := svc.ModifyImageAttribute(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -6,8 +6,8 @@ import (
 	"strings"

 	"github.com/aws/aws-sdk-go/service/ec2"
+	ec2image "github.com/mulgadc/spinifex/spinifex/domains/ec2/image"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_ec2_image "github.com/mulgadc/spinifex/spinifex/handlers/ec2/image"
 	"github.com/nats-io/nats.go"
 )

@@ -131,7 +131,7 @@ func RegisterImage(ctx context.Context, input *ec2.RegisterImageInput, natsConn
 		return output, err
 	}

-	svc := handlers_ec2_image.NewNATSImageService(natsConn, 0)
+	svc := ec2image.NewNATSImageService(natsConn, 0)
 	result, err := svc.RegisterImage(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -6,8 +6,8 @@ import (
 	"strings"

 	"github.com/aws/aws-sdk-go/service/ec2"
+	ec2image "github.com/mulgadc/spinifex/spinifex/domains/ec2/image"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_ec2_image "github.com/mulgadc/spinifex/spinifex/handlers/ec2/image"
 	"github.com/nats-io/nats.go"
 )

@@ -39,7 +39,7 @@ func ResetImageAttribute(ctx context.Context, input *ec2.ResetImageAttributeInpu
 		return output, err
 	}

-	svc := handlers_ec2_image.NewNATSImageService(natsConn, 0)
+	svc := ec2image.NewNATSImageService(natsConn, 0)
 	result, err := svc.ResetImageAttribute(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -12,10 +12,10 @@ import (

 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/ec2"
+	ec2instance "github.com/mulgadc/spinifex/spinifex/domains/ec2/instance"
 	ec2launchtemplate "github.com/mulgadc/spinifex/spinifex/domains/ec2/launchtemplate"
 	ec2placementgroup "github.com/mulgadc/spinifex/spinifex/domains/ec2/placementgroup"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_ec2_instance "github.com/mulgadc/spinifex/spinifex/handlers/ec2/instance"
 	handlers_iam "github.com/mulgadc/spinifex/spinifex/handlers/iam"
 	"github.com/nats-io/nats.go"
 )
@@ -78,7 +78,7 @@ func ValidateRunInstancesInput(input *ec2.RunInstancesInput) (err error) {
 	// A volume the launch creates beyond the root is empty and sized by the
 	// request, so a mapping asking for anything else is refused by name rather
 	// than served as something it did not ask for.
-	if unserved := handlers_ec2_instance.UnservedBlockDeviceMappings(input.BlockDeviceMappings); len(unserved) > 0 {
+	if unserved := ec2instance.UnservedBlockDeviceMappings(input.BlockDeviceMappings); len(unserved) > 0 {
 		return awserrors.Errorf(awserrors.ErrorInvalidParameterValue, "BlockDeviceMappings: cannot create %s", strings.Join(unserved, ", "))
 	}

--- a/Show More
+++ b/Show More