diff --git a/docs/PACKAGE_BOUNDARY_MIGRATION.md b/docs/PACKAGE_BOUNDARY_MIGRATION.md
index 3beac644a..19b690315 100644
--- a/docs/PACKAGE_BOUNDARY_MIGRATION.md
+++ b/docs/PACKAGE_BOUNDARY_MIGRATION.md
@@ -305,3 +305,4 @@ Spinifex commit.
 | `931d86d5c` | `spinifex/services/awsgw` | `spinifex/runtime/roles/awsgw` | The AWS gateway process is a named runtime role and its composition root wires every domain, which runtime may do. The quota reconcile loop (`runQuotaReconcile`, `quotaKeyFor`) moved with it unchanged but belongs to `domains/admission/quota`, and the EKS token-verify responder belongs with STS or EKS identity; both are recorded residuals, so the role is not yet thin. Service-interface manifest, design doc and architecture diagram paths were updated. Full preflight (excluding the pre-existing containerd advisory), focused role, role-catalogue and CLI suites, `manifest-check` and tagged integration/E2E compilation passed. |
 | `745338563` | `spinifex/utils` (`GenerateErrorPayload`, `GenerateErrorPayloadWithMessage`, `ValidateErrorPayload`, `UnmarshalJsonPayload`) | `spinifex/foundation/aws/errors` | The JSON error envelope every domain exchanges over NATS carries the shared AWS error vocabulary, so it sits beside the codes it encodes rather than in a per-domain contract. Behaviour is unchanged. Full preflight (excluding the pre-existing containerd advisory), focused error and caller suites and tagged integration/E2E compilation passed. |
 | `02e0dd0dc` | `spinifex/utils` (`GlobalAccountID`, `IsAccountID`) | `spinifex/foundation/aws/identifiers` | The 12-digit account ID check and the system account ID constant are AWS identifier vocabulary and sit beside resource ID generation; no account policy changed. Full preflight (excluding the pre-existing containerd advisory), focused identifier and caller suites and tagged integration/E2E compilation passed. |
+| `b5806ce63` | `spinifex/utils` (NATS connect/retry, request/serve, gather, headers, `PublishEvent`, trace propagation) | `spinifex/foundation/messaging/nats` (package `natsmsg`) | Generic NATS transport primitives are shared machinery with no resource owner; the package name avoids colliding with `nats.go` at every caller. The OTel instrumentation scope keeps its `spinifex/utils` value so existing APM queries still match. vpcd's request/ack protocol (`RequestEvent`, `AddNAT`, `PublishNATEvent`) stays in `utils/vpcd_event.go` for a future network contract, and `SubjectEnsureDefaultVpc` stays in `utils/ec2_subject.go` for an EC2 contract; both were split out byte-identical. Full preflight (excluding the pre-existing containerd advisory), focused transport and caller suites and tagged integration/E2E compilation passed. |