docs: record migrate move to operator/upgrade

docs/PACKAGE_BOUNDARY_MIGRATION.md

@@ -312,6 +312,8 @@ while the branch is in flight; they do not describe the umbrella repository's
 | `4e822fa34` | — | — | EKS add-on v1 compatibility characterization: pins which owner (`domains/eks/addon`) writes drop unknown record and manifest fields, that reads and deletes ignore or erase them, that one undecodable stored entry fails a listing rather than the whole set, and that `contracts/eks/v1` and `agents/eks/gatewayfetch` wire consumers ignore extra fields. Test-only; no conformance claimed. |
 | `7e504c1dd` | — | — | Stale paths left by the moves: `.gitignore` un-ignores the moved `runtime/roles/spinifexui/frontend/dist/`, UI CI and the Dependabot npm job point at the moved frontend, the depguard `ec2-control-plane` rule covers `domains/**` as well as `handlers/**`, and CODEOWNERS names the network-layer proposal rather than an accepted ADR. |
 | `d5849c6b3` | `spinifex/handlers/quota` | `spinifex/domains/admission/quota` | ADR-0001's `handlers/quota` current-to-target map row. Package renamed to `quota` (imported as `admissionquota` where a local `quota` identifier exists); KV buckets, subjects and error codes unchanged. Its existing debt edges moved with it and are recorded below; `runQuotaReconcile` stays in `runtime/roles/awsgw`. Full preflight passed apart from the recorded Go 1.27.0 advisory exception. |
+| `8cd9cff75` | `spinifex/migrate/migrate_test.go` (the `Registry`/`RunKV` tests and their NATS helpers) | `spinifex/foundation/state/migrate/kv_test.go` | The KV migration engine's only tests lived in the operator upgrade package's test file. They move to the package that owns the engine before the workflow moves, so `operator/upgrade` does not hold another package's test suite. No test name, assertion or behaviour changed. |
+| `919d5bfa6` | `spinifex/migrate` | `spinifex/operator/upgrade` | Owner decision: the operator-driven config-file and object-store upgrade workflow behind `spx admin upgrade` belongs to `operator/upgrade`, distinct from `foundation/state/migrate`. Package renamed to `upgrade`; no registry types, migration names, versions, file formats or command names changed. It imports only `foundation/state/{kvutil,migrate}`, `providers/objectstore` and jetstream, so it carries no layering debt. `scripts/diff-coverage.sh` and `VERSIONS.md` point at the new path. Full preflight passed apart from the recorded Go 1.27.0 advisory exception. |
 
 The EC2 contract row is intentionally different from the directory moves: it creates
 a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS
@@ -399,7 +401,6 @@ These residuals were recorded by individual slices and must be resolved once the
 - `runtime/compute/cache.New`: two construction-time panics carry a lint exemption pending a constructor that returns an error.
 - `domains/ec2/systeminstance`: managed-service parent metadata is only the `ManagedBy` tag value.
 - `gateway/bedrock`: holds the Ochre domain core (model catalogue, provisioned throughput, guardrail, access, credential, usage, price, logging and weights stores), the inference engine (provider, vLLM, Anthropic, embeddings, reranker, admission) and the Bedrock action layer in one package with internal cycles. `domains/ochre` imports it, which is the ADR step 7 Ochre gateway import. Splitting it needs a plan: domain core and stores to `domains/ochre/<resource>`, inference to an Ochre-owned package, and only the action layer to `domains/ochre/awsapi`. The top-level `gateway/bedrock*.go` HTTP handlers additionally wait for the ingress registration seam.
-- `spinifex/migrate`: the KV engine already lives in `foundation/state/migrate`, but the remaining config-file and object-store migration engine is not a move into it. It is an operator upgrade concern used only by `spx admin upgrade`, both packages define `Registry`, `NewRegistry` and `DefaultRegistry` with distinct registry models, and its object migrations would give foundation a dependency on `providers/objectstore`. Its eventual owner is deferred; no subpackage is created to satisfy the directory map.
 - `domains/network`: `reconcile/intent.go` builds desired network state by reading EC2's KV buckets and decoding EC2's private VPC, subnet, ENI, route-table, gateway, EIP, NAT and security-group records, and `reconcile/drift.go` watches those buckets. ADR-0001 names this pair explicitly: EC2 and network communicate through a capability/projection or versioned contract, never by one being the other's KV reader. Step 7 fix: an EC2-owned `domains/ec2/projection` exposing network intent with list and watch (it may stay KV-backed, so no data moves); a narrow intent interface declared by `reconcile`; wiring at the composition root; and the duplicated `PurposeEIP`/`PurposeIGWLRP` constants and mirrored `SGRule`/`SGEvent` folded into the projection or `contracts/ec2/v1`. The drift-watch coverage test and reconcile scenario tests are the evidence the projection must keep. `domains/network` also imports `runtime/compute/vm` and `runtime/host/command` (domain-to-runtime).
 - `domains/ec2/instance`: imports `runtime/compute/vm` and `runtime/compute/gpu` (domain-to-runtime) and `domains/dns` (cross-domain implementation import).
 - `agents/eks/tokenwebhook`: imports `handlers/eks` for `WebhookTokenReviewResult`, an agent depending on a domain implementation. Temporary: the eventual EKS contract or projection for the token-review reply needs its own design, and no contract is invented to complete the move.
@@ -408,7 +409,7 @@ These residuals were recorded by individual slices and must be resolved once the
 - `operator/installer/firstboot` (security): `Config.InstallCallback` is rendered into `spinifex-firstboot.sh`, which is world-readable (0755). The field is currently unused (`fireInstallCallback` reads `SPINIFEX_INSTALL_CALLBACK` from the environment instead), but any future wiring must not place secrets or tokenised callback URLs in the generated script; sensitive callback credentials should reach first boot through a protected channel such as a 0600 file or a credential store.
 - `operator/cli` (known security risk): `spx admin join` contacts the formation server with `InsecureSkipVerify`, sends the join token as a bearer credential and receives the cluster CA certificate and key, master key, Viperblock key and shared credentials, so an on-path attacker during formation can capture the token and the cluster root secrets or substitute a CA. This predates the move; lint surfaced it when the tree left `cmd/`. It is accepted for now and carries a line-level gosec annotation stating it is not a false positive. Removal condition: authenticate formation TLS with a pinned key or certificate delivered with the join material, or an out-of-band CA, with tests proving a mismatched server certificate fails before credentials are sent.
 - `handlers/eks` (potential security risk): `ClusterMeta.ControlPlaneTemplate` (`handlers/eks/service_impl.go`) clears the template's credentials but keeps `OIDCPrivateKeyPEM` and the k3s `JoinToken`, so both are persisted in the `eks-account-{acct}` cluster record, which the gateway also reads. Whether that record is encrypted at rest is unconfirmed; if it is not, a reader of the bucket can forge service-account tokens for the cluster's OIDC issuer and join nodes to it. This predates the refactor and is not fixed in it. Removal condition: the key and token are held by a dedicated secret store (a future KMS or Secrets Manager capability is the likely owner) and the cluster record keeps only a reference, with a test proving the persisted record contains neither secret.
-- `operator/cli` (dependency): the command tree still imports domain and service implementations directly (`handlers/{iam,eks}`, `domains/admission/quota`, `gateway`, `gateway/bedrock`, `daemon`, `vpcd`, `admin`, `accountteardown`, `migrate`, `services/viperblockd` and runtime roles). The ADR's `cmd/spinifex` current-to-target map row requires command packages to reach domains through public capabilities; splitting supported use cases into `operator/*` packages is later work.
+- `operator/cli` (dependency): the command tree still imports domain and service implementations directly (`handlers/{iam,eks}`, `domains/admission/quota`, `gateway`, `gateway/bedrock`, `daemon`, `vpcd`, `admin`, `accountteardown`, `services/viperblockd` and runtime roles). The ADR's `cmd/spinifex` current-to-target map row requires command packages to reach domains through public capabilities; splitting supported use cases into `operator/*` packages is later work.
 - `gateway/ec2.go` (registration): the EC2 dispatch map stays a `GatewayConfig` method in `gateway` and imports every `domains/ec2/awsapi/*` package. ADR-0001 makes the domain own its action registration; moving the map waits on the generic ingress registration seam and must not be done as a package move.
 - `gateway/requestaudit.go`: the outermost request-audit middleware records AWS fields and is updated from four places in the gateway's authentication flow through the gateway's own context key. Moving it would export about seven names used only by that flow, so it stays in `gateway` until the generic ingress registration seam defines how ingress middleware receives authentication results.
 - `accountteardown` (dependency): its EC2 reapers call `domains/ec2/awsapi/*` action adapters directly, as they did under `gateway/ec2`. The ADR's `accountteardown` current-to-target map row replaces this with domain-owned cleanup capabilities before the package moves.
@@ -501,7 +502,7 @@ series above; "needs decision" is open.
 | `admin` | `DefaultAccountID`/`DefaultAccountName`, `GenerateAWSAccessKey`/`GenerateAWSSecretKey`, `PromoteSystemImage`, `GenerateCACert`/`GenerateSignedCert` (recorded above). | Deferred: each needs its target owner first — IAM/account bootstrap, IAM credentials, the EC2 image domain, and Spinifex certificate issuance respectively. |
 | `accountteardown` | Direct calls into `domains/ec2/awsapi/*` action adapters (recorded above). | Deferred: the ADR's `accountteardown` row replaces this with domain-owned cleanup capabilities. |
 | `lbagent` | The whole package; `handlers/elbv2` imports it as a domain-to-agent implementation edge (recorded above). | Deferred: Q-30 reserves `agents/elbv2` as its destination but forbids moving it as an isolated rename ahead of the common-agent design. |
-| `migrate` | The config-file and object-store migration engine (the KV engine already moved to `foundation/state/migrate`). | Decided: the target owner is `operator/upgrade`, the operator-driven config/object-store upgrade workflow used only by `spx admin upgrade`, distinct from `foundation/state/migrate`'s generic KV engine. |
+| `migrate` | Nothing: moved to `operator/upgrade` in `919d5bfa6` after its KV-engine tests moved to `foundation/state/migrate` in `8cd9cff75`. | Cleared. |
 
 `runtime/roles/awsgw` carries two recorded residuals from its own move (`931d86d5c`
 above) that are not yet re-homed: `runQuotaReconcile`/`quotaKeyFor` belong to