docs: record error envelope extraction

docs/PACKAGE_BOUNDARY_MIGRATION.md

@@ -284,6 +284,7 @@ while the branch is in flight; they do not describe the umbrella repository's
 | `89364c100` | — | `spinifex/ingress/aws/dispatch`, `spinifex/ingress/aws/invariants` | ADR-0002 phase 1: the registration contract. A startup `Builder` validates and seals registrations into an immutable `Registry` keyed by credential-scope service, with aliases, an inventory name, an advisory action resolver, the dispatcher, the error envelope and the operation inventory; `Invocation` carries the bounded request, account, Region, an `AuthorizeFunc` and a lazy `ActorFunc`. It imports only `foundation/aws/errors` and Bluebottle's `iampolicy` condition-key vocabulary, and no domain moved. `TestS4_IngressAWSImportsNoDomainOrRuntimeImplementation` binds ADR-0002 S4 for all of `ingress/aws` and failed on an injected domain import. Contract tests at 100% statement coverage under `-race`; full preflight passed. |
 | `86a2de3ff` | `spinifex/gateway` (dispatch switch) | `spinifex/gateway` consuming `spinifex/ingress/aws/dispatch` | ADR-0002 phase 2: the gateway consumes the registry with no service registered. A registered service passes the auth gate, resolves its own action label, renders errors in its declared envelope through one `gw.jsonErrorService` method, and is dispatched with an `Invocation` whose `Authorize` calls the existing policy check and whose lazy `Actor` reuses `buildCallerARN`. The NATS-unavailable guard still runs ahead of both paths; every existing service takes the unchanged switch, now named the legacy path that must only shrink. The awsgw role wires an empty registry and fails startup on any overlap with the legacy table. Fake JSON, XML and resolver-less registrations prove dispatch, telemetry labels, authorisation deny/allow, the verified actor, both envelopes, the 503 and unknown-service paths and the overlap guard through the full pipeline; four production mutations were each caught. Phase 0 ECR characterisation and the unserved-service tests passed unchanged; full preflight passed. |
 | `6c48ab6b7` | `spinifex/gateway` (`ECR_Request`, `ecrActionFromTarget`, `ecrAuthorizationPrincipal`, the four `ECR*` `GatewayConfig` fields, the `ecr` legacy table/switch entries) | `spinifex/domains/ecr/awsapi` (`NewRegistration`, `OperationInventory`), wired by `spinifex/runtime/roles/awsgw` | ADR-0002 phase 3: ECR's AWS JSON 1.1 control plane registers from its domain. The dispatcher reproduces the removed gateway path step for step (error codes and order, one bounded body read feeding scope and invocation, `Authorize` before every use case, nil capability as ServerInternal, the token principal from the verified `Actor`, the JSON writer). The gateway no longer imports `domains/ecr/awsapi`; the OCI `/v2` route is unchanged. Operation coverage reads the pure `OperationInventory()` that the registration uses verbatim, proved equal by `TestRegistrationInventoryIsTheDeclaredInventory`; `coverage.json` and every coverage page were byte-identical. `TestS4_OnlyAWSGWRoleImportsDispatchAndECRAWSAPI` binds acceptance item 3, with `cmd/aws-model-coverage` as the only named, non-serving tool exception. Five mutations (authorise after use, prefix-strict resolver, inventory drop, body-derived token principal, probe import) were each caught; Phase 0 characterisation kept every assertion except one rebound from the deleted parser to the registration's resolver; full preflight passed. Remaining temporary edge: `Deps.NATS` is a raw `*nats.Conn`. |
+| `5f66bd2a3` | `spinifex/gateway` (`GenerateEC2ErrorResponse`, `GenerateIAMErrorResponse`, `GenerateS3ErrorResponse`, `requestSignalsJSONProtocol`, `jsonErrorType`, error content types), `spinifex/gateway/eks` (`GenerateEKSErrorResponse`) | `spinifex/ingress/aws/envelope` | ADR-0002 phase 4, error rendering: pure EC2, IAM-style and S3 XML builders, the AWS JSON 1.1 body and error type, the header-only JSON-protocol detector and content types, importing only the standard library. `ErrorHandler`, the cluster-unavailable, throttle and SigV4 writers and the legacy service-to-envelope selection stay in `gateway`. A 140-case golden of status, headers and body across 14 service cases and every error writer was identical before and after; two mutations were caught; the S4 ingress import invariant scans the new package; full preflight passed. |
 
 The EC2 contract row is intentionally different from the directory moves: it creates
 a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS