docs: record standalone EC2 resource moves

docs/PACKAGE_BOUNDARY_MIGRATION.md

@@ -259,6 +259,7 @@ while the branch is in flight; they do not describe the umbrella repository's
 | `2b6131e21` | `spinifex/gateway/bedrock/hfhub` | `spinifex/domains/ochre/hfhub` | The Hugging Face Hub client resolves and streams model weights for Ochre and has no dependency on the rest of `gateway/bedrock`; its only caller is `spx admin ochre` weights pull. Package name unchanged. The rest of `gateway/bedrock` is not moved: it holds Ochre domain state, stores and the inference engine alongside the Bedrock action layer, and `domains/ochre` imports it, so moving it to `domains/ochre/awsapi` would invert the domain-to-adapter direction. It is recorded as dependency-rule debt. Full preflight apart from the known vulnerability-scan finding, focused hfhub and CLI tests, and tagged integration/E2E compilation passed. |
 | `40964815b` | `spinifex/utils` (`MergeTagsMut`, `ApplyTagRemovals`, `RemoveTagsMut`, `UpdateKVRecordTags`, `MirrorKVRecordTags`) | `spinifex/domains/ec2/tagmirror` | EC2-wide AWS tag mutation over resource KV records is EC2 domain behaviour and imports only foundation packages. The EC2 tags resource package was not used because it imports the instance, key and VPC resources that call these helpers, which would create a resource-to-resource cycle. Twelve EC2 resource packages now call `tagmirror`; a stale `utils.ParseNBDURI` comment in the VM device code now names `nbd.ParseNBDURI`. Full preflight apart from the known vulnerability-scan finding, focused EC2, utils and VM tests, and tagged integration/E2E compilation passed. |
 | `7003168bc` | `spinifex/network/*` (all 15 packages) | `spinifex/domains/network/*` | Network control, policy, topology, OVN, external and host realisation are network-domain ownership. The packages move as one enclosing move because the L0–L5 invariants classify layers by trimming a single `networkRoot` prefix; a partial move would silently drop moved packages out of S1. Package names, layer assignments, reconciliation authority and the vpcd boundary are unchanged. Invariant scan roots, the RG-10 sudo allow-list path, `.github/CODEOWNERS` and the IMDS netns unit test's repo-root walk follow the new path. Injected `host`→`topology` and L3 `CreateLogicalSwitch` violations failed S1 and S5 at the new paths, confirming the invariants still scan the moved packages; `domains/network/systemvpc` now also falls inside the host-containment and NAT-mode scans and passes them. Full preflight apart from the known vulnerability-scan finding, focused network, invariant, host-command and vpcd suites, `setup-ovn_test.sh`, `manifest-check` and tagged integration/E2E compilation passed. |
+| `d8ab4017a` | `spinifex/handlers/ec2/{account,key,launchtemplate,placementgroup,spotinstance,volumestate}` | `spinifex/domains/ec2/<resource>` | These EC2 resources import no other EC2 handler package, so they move first as EC2 domain resources with their responsibilities unchanged. Each package is named after its directory and callers import it as `ec2<resource>`, because the bare names collide with common local identifiers; `volumestate` already carried its directory name. No package name appears in error text, KV keys or metrics. Path comments were updated. Full preflight apart from the known vulnerability-scan finding, focused EC2 domain, EC2 gateway, account-teardown and remaining EC2 handler suites, and tagged integration/E2E compilation passed. |
 
 The EC2 contract row is intentionally different from the directory moves: it creates
 a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS
@@ -318,7 +319,7 @@ changing their behaviour in a structural slice:
 The guest-metadata move keeps every existing import unchanged, so the domain package now shows these breaks of the target dependency rules.
 Each needs a consumer-owned capability, projection or versioned contract before the dependency lint (ADR step 8) can be enabled.
 
-- `domains/ec2/guestmetadata` imports the DNS, EC2 instance, EC2 key, IAM and STS implementations, which breaks rule 3 (no domain reads another domain's implementation).
+- `domains/ec2/guestmetadata` imports the DNS, IAM and STS implementations, which breaks rule 3 (no domain reads another domain's implementation). Its EC2 key and instance imports are same-domain once those resources sit under `domains/ec2`; they remain resource-to-resource implementation imports for the EC2 decomposition to review.
 - `domains/ec2/guestmetadata` imports `runtime/compute/vm` for instance records and VM reconstruction, the first domain-to-runtime edge; runtime is meant to compose domains, not be imported by them.
 
 ### Dependency-rule debt to clear after the moves