diff --git a/docs/PACKAGE_BOUNDARY_MIGRATION.md b/docs/PACKAGE_BOUNDARY_MIGRATION.md
index 99d31acc6..aeb421e42 100644
--- a/docs/PACKAGE_BOUNDARY_MIGRATION.md
+++ b/docs/PACKAGE_BOUNDARY_MIGRATION.md
@@ -240,6 +240,7 @@ while the branch is in flight; they do not describe the umbrella repository's
 | `366e2c2e4` | `spinifex/utils` (image catalogue, checksum verification, disk-image extraction) | `spinifex/operator/imagecatalog` | The published image catalogue and its download verification serve only `spx admin` image import, an operator use case. The package is named `imagecatalog` because the command tree already uses `images` as a local identifier. Moved tests reach repository fixtures one directory deeper; script and documentation pointers to the catalogue file were updated. Full preflight (excluding the pre-existing containerd advisory), focused catalogue and CLI suites, and tagged integration/E2E (including GPU) compilation passed. |
 | `53f13f213` | `spinifex/utils` (`GenerateResourceID`) | `spinifex/foundation/aws/identifiers` | AWS-style `{prefix}-{17 hex}` resource-ID generation joins the AWS identifier foundation beside request-ID normalisation; callers use the established `awsidentifiers` alias, which also avoids the network-identifier package name. Format and CSPRNG failure handling are unchanged. Full preflight (excluding the pre-existing containerd advisory), focused tests and tagged integration/E2E compilation passed. |
 | `eab631b42` | `spinifex/services/predastore` | `spinifex/runtime/roles/predastore` | Predastore process configuration and startup are a named runtime role; the package holds no S3 resource semantics. The service manifest path moved with it. Full preflight (excluding the pre-existing containerd advisory), focused role, role-catalogue and CLI suites, and tagged integration/E2E compilation passed. Commit `796fb52d4` separately corrects the manifest's stale `handlers/acm` path left by the ACM relocation; `manifest-check` now passes. |
+| `ad6a158f8` | `spinifex/services/northstar` | `spinifex/runtime/roles/northstar` | Northstar process startup and reload are a named runtime role. `BootstrapBaseZone` moved with it unchanged but is DNS control-plane work (it imports `handlers/dns`); it belongs to `domains/dns` when that domain moves, so the role is not yet thin. Full preflight (excluding the pre-existing containerd advisory), focused role, role-catalogue and CLI suites, `manifest-check` and tagged integration/E2E compilation passed. |
 
 The EC2 contract row is intentionally different from the directory moves: it creates
 a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS