diff --git a/docs/PACKAGE_BOUNDARY_MIGRATION.md b/docs/PACKAGE_BOUNDARY_MIGRATION.md
index 11fc58139..2da31f647 100644
--- a/docs/PACKAGE_BOUNDARY_MIGRATION.md
+++ b/docs/PACKAGE_BOUNDARY_MIGRATION.md
@@ -329,7 +329,7 @@ while the branch is in flight; they do not describe the umbrella repository's
 | `38fbd1499` | (characterisation only) | — | ADR-0007 slice 0: pins the local file's exact bytes and schema failure modes, the instance bucket configuration, the `i.<id>` key and wire form, the bucket version gate, generation preservation across every KV writer and the VM conversion, and what a returning node does with a missing, foreign, terminal or unreadable canonical record. Current behaviour, not the ADR target; see the slice 0 section below. |
 | `6fa09d336` | (governance only) | — | ADR-0007 slice 0 ratchet at `architecture/instancestate`: freezes the 73 direct production uses of raw instance state found by the inventory below. |
 | `2a196f9ba` | (governance only) | — | ADR-0007 slice 0 ratchet narrowed to instance-state access: the `JetStreamManager` type and constructor are no longer matched, the cluster-state consumers INV-09 and INV-19 leave the allowlist, and 67 entries remain. |
-| (uncommitted; hash added at commit) | (revert only) | — | The ADR-0007 slice 1a design and slice 1b step 1 codec stack (`e9e11d531` to `c3f302423`) leaves this ADR-0001 checkpoint: no production reader or writer called the codec, so carrying it would ship dormant lifecycle implementation. `record_codec.go`, its tests and `docs/package-boundary/instance-state-transition-record-design.md` are removed, with the codec's instance-state ratchet owner-file line and the record rows and section describing them. The slice 0 evidence (`38fbd1499`, `6fa09d336`, `c04222b27`, `2a196f9ba`, `830f70489`) stays, and `domains/ec2/instance/state` stays for the vpcd IMDS readers. The stack is reapplied on a fresh ADR-0007 branch from `dev` after this checkpoint merges. |
+| `09646388e` | (revert only) | — | The ADR-0007 slice 1a design and slice 1b step 1 codec stack (`e9e11d531` to `c3f302423`) leaves this ADR-0001 checkpoint: no production reader or writer called the codec, so carrying it would ship dormant lifecycle implementation. `record_codec.go`, its tests and `docs/package-boundary/instance-state-transition-record-design.md` are removed, with the codec's instance-state ratchet owner-file line and the record rows and section describing them. The slice 0 evidence (`38fbd1499`, `6fa09d336`, `c04222b27`, `2a196f9ba`, `830f70489`) stays, and `domains/ec2/instance/state` stays for the vpcd IMDS readers. The stack is reapplied on a fresh ADR-0007 branch from `dev` after this checkpoint merges. |
 | `e40e699e5` | `spinifex/vpcd/imds_instance_state.go` | `spinifex/domains/ec2/instance/state/imds_readers.go` | The local-file reader (`LocalVMReader`/`NewLocalVMReader`, formerly `localVMStateReader`) and the instance-record loader opener (`OpenInstanceRecordLoader`, formerly `newInstanceRecordLoader`) move unchanged to the instance-state boundary; `vpcd.Config` gains `LocalVMs guestmetadata.LocalStateReader` and `OpenInstanceRecords func(ctx, nc) (guestmetadata.RecordLoader, error)`, wired by `operator/cli` with `state.NewLocalVMReader(nodeConfig.DataDir)` and `state.OpenInstanceRecordLoader`, so `vpcd` no longer imports `daemon` directly. `guestmetadata`'s own narrow interfaces are exported (`LocalStateReader`, `RecordLoader`) with no semantic change so `vpcd.Config` can name them. The opener's absence is now a fatal startup error rather than an unchecked call, matching the existing mandatory-open behaviour. The instance-state ratchet's INV-13 entries move with the file; `OpenInstanceRecordLoader` returning `guestmetadata.RecordLoader` directly (so the two packages' function types match exactly) removes the file's local `recordLoader` interface and its `vm.InstanceRecord` reference, so INV-13 now cites 5 symbols rather than 6. `vpcd` still runs the legacy bucket-opening path (`InitKVBucket`, the version gate and the instance migrations) through the injected opener; that is ADR-0007 debt (INV-13) and is deliberately not fixed here. Full preflight passed except the recorded Go 1.27.0 advisories. |
 | `7bf6c10d7` | `spinifex/vpcd` | `spinifex/runtime/roles/vpcd` | The whole vpcd role moves unchanged to its ADR-0001 runtime-role target: all sixteen production and test files (`vpcd.go`, the lease reaper, the OVN controller watchdog, the host-EIP loop, lease datapath reconcile and their tests), with no split and no lifecycle-behaviour change. The package name stays `vpcd`. `operator/cli/service.go` and `runtime/service/{service,service_test}.go` update their import path. `docs/service-interfaces.yaml`'s `vpcd` service entry, `.github/CODEOWNERS` and the real-manifest case in `tests/e2e/select-suites/selector_test.go` follow the new path; that package's own synthetic `testManifest()` fixture keeps its illustrative `spinifex/vpcd` string by design, decoupled from the real manifest. The network invariant scan roots in `domains/network/invariants/{nat_mode,nats_subjects,names}_test.go` and the S3 exemption for `vpcd.go` follow the new path; injected `UplinkMode()` and `vpc-`-prefixed concat faults in moved files failed S3 and S4 respectively, confirming the scan still covers them, and were reverted by hand. `ingress/aws/invariants/deps_test.go` keeps `vpcd` in its `forbiddenRoots` as defence in depth: `runtime` already rejects an import of the new path, confirmed by an injected import of `runtime/roles/vpcd` into an `ingress/aws` file, and the retained entry still rejects an ingress import of a recreated legacy `vpcd` directly. The layering package drops `vpcd` from `legacyRoots`, `runtimeLegacy` and `frozenLegacyPackages` and adds it to `retiredLegacyRoots`, so `runtime/roles/vpcd` classifies as runtime automatically and a revived `spinifex/vpcd` directory fails the frozen-root guard, both confirmed by fault injection and reverted; the stale `operator/cli` → `vpcd` allowlist entry is deleted rather than repointed, because operator already imports other `runtime/roles/*` packages with no allowlist entry and no rule forbids it. The instance-state ratchet's allowlist cites no vpcd path and is unchanged. |
 | `a130f6b8e` | `spinifex/handlers/ecs/bus` | `contracts/ecs/v1` (`ecsv1`) | The ECS scheduler-agent wire vocabulary moves with no legacy shim: five subject builders and the message types (`RegisterInstance`, `Heartbeat`, `Assign`, `AssignContainer`, `StopDirective`, `TaskState`, `ContainerStatus`, `InstanceCapacity`, `PortMapping`, `SystemControl`, status constants). Subject strings, JSON fields and types are byte-identical; the old-agent `AssignContainer` compatibility test moves unchanged and new golden pins cover every message type that had none. A trace found only `service-reconcile` live on the bus (`handlers/ecs/instances.go` publishes, the scheduler leader subscribes); the agent reuses `Assign`, `StopDirective` and `TaskState` as payloads of the gateway's `PollAssignments` and `SubmitTaskStateChange` actions, and the README route table and type comments say so. `docs/service-interfaces.yaml` lists `ecs.bus.*` and the contract path under the daemon. The layering package drops the stale `agents/ecs/agent` → `handlers/ecs/bus` allowlist entry and the frozen-package entry. |