docs: record ECR control-plane registration

docs/PACKAGE_BOUNDARY_MIGRATION.md

@@ -283,6 +283,7 @@ while the branch is in flight; they do not describe the umbrella repository's
 | `7047f6b36` | — | — | ADR-0002 phase 0: characterization tests pin the ECR control plane as it behaves today before dispatch moves. Full-pipeline tests fix the 400/501 error envelopes, JSON 1.1 content type and `X-Amzn-Errortype`, 413 before dispatch for an oversized body, 503 for stub and composed actions when NATS is down, and authorization before a composed action. Unit tests fix target parsing (dispatch and telemetry agree on every malformed form), the stub and inventory sets, `GetAuthorizationToken` ignoring body-supplied identity, and the action reaching the throttle key, trace span and audit record. Mutation of the target parser, the authorization gate and the audit action each failed the new tests. Test-only; full preflight passed. |
 | `89364c100` | — | `spinifex/ingress/aws/dispatch`, `spinifex/ingress/aws/invariants` | ADR-0002 phase 1: the registration contract. A startup `Builder` validates and seals registrations into an immutable `Registry` keyed by credential-scope service, with aliases, an inventory name, an advisory action resolver, the dispatcher, the error envelope and the operation inventory; `Invocation` carries the bounded request, account, Region, an `AuthorizeFunc` and a lazy `ActorFunc`. It imports only `foundation/aws/errors` and Bluebottle's `iampolicy` condition-key vocabulary, and no domain moved. `TestS4_IngressAWSImportsNoDomainOrRuntimeImplementation` binds ADR-0002 S4 for all of `ingress/aws` and failed on an injected domain import. Contract tests at 100% statement coverage under `-race`; full preflight passed. |
 | `86a2de3ff` | `spinifex/gateway` (dispatch switch) | `spinifex/gateway` consuming `spinifex/ingress/aws/dispatch` | ADR-0002 phase 2: the gateway consumes the registry with no service registered. A registered service passes the auth gate, resolves its own action label, renders errors in its declared envelope through one `gw.jsonErrorService` method, and is dispatched with an `Invocation` whose `Authorize` calls the existing policy check and whose lazy `Actor` reuses `buildCallerARN`. The NATS-unavailable guard still runs ahead of both paths; every existing service takes the unchanged switch, now named the legacy path that must only shrink. The awsgw role wires an empty registry and fails startup on any overlap with the legacy table. Fake JSON, XML and resolver-less registrations prove dispatch, telemetry labels, authorisation deny/allow, the verified actor, both envelopes, the 503 and unknown-service paths and the overlap guard through the full pipeline; four production mutations were each caught. Phase 0 ECR characterisation and the unserved-service tests passed unchanged; full preflight passed. |
+| `6c48ab6b7` | `spinifex/gateway` (`ECR_Request`, `ecrActionFromTarget`, `ecrAuthorizationPrincipal`, the four `ECR*` `GatewayConfig` fields, the `ecr` legacy table/switch entries) | `spinifex/domains/ecr/awsapi` (`NewRegistration`, `OperationInventory`), wired by `spinifex/runtime/roles/awsgw` | ADR-0002 phase 3: ECR's AWS JSON 1.1 control plane registers from its domain. The dispatcher reproduces the removed gateway path step for step (error codes and order, one bounded body read feeding scope and invocation, `Authorize` before every use case, nil capability as ServerInternal, the token principal from the verified `Actor`, the JSON writer). The gateway no longer imports `domains/ecr/awsapi`; the OCI `/v2` route is unchanged. Operation coverage reads the pure `OperationInventory()` that the registration uses verbatim, proved equal by `TestRegistrationInventoryIsTheDeclaredInventory`; `coverage.json` and every coverage page were byte-identical. `TestS4_OnlyAWSGWRoleImportsDispatchAndECRAWSAPI` binds acceptance item 3, with `cmd/aws-model-coverage` as the only named, non-serving tool exception. Five mutations (authorise after use, prefix-strict resolver, inventory drop, body-derived token principal, probe import) were each caught; Phase 0 characterisation kept every assertion except one rebound from the deleted parser to the registration's resolver; full preflight passed. Remaining temporary edge: `Deps.NATS` is a raw `*nats.Conn`. |
 
 The EC2 contract row is intentionally different from the directory moves: it creates
 a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS
@@ -354,6 +355,8 @@ These residuals were recorded by individual slices and must be resolved once the
 - `domains/dns`: imports `runtime/compute/vm` (domain-to-runtime), `domains/network/reconcile` for the reconcile lock and `bootstrap/config` for node configuration.
 - ACM: the IAM AES-GCM helper import and gateway-owned action dispatch (ACM relocation residuals).
 - `runtime/roles/awsgw`: the quota reconcile loop belongs to `domains/admission/quota`, and the EKS token-verify responder belongs with STS or EKS identity.
+- ECR control-plane registration: `awsapi.Deps.NATS` is a raw `*nats.Conn`, not a narrow capability. Every NATS-backed `Handler` passes it to `handlers_ecr.NewNATSMetaStore`, which calls `natsmsg.NATSRequest`, so narrowing it means changing the exported `Handler` type, every handler and the meta store; it must not be broadened further meanwhile.
+- `cmd/aws-model-coverage` imports both `ingress/aws/dispatch` and `domains/ecr/awsapi` to read ECR's declared inventory. It is a non-serving tool and the only named exception to the ADR-0002 composition invariant; it must not construct a registration.
 - `utils`: `vpcd_event.go` (vpcd request/ack protocol and NAT helpers) awaits a network contract, `ec2_subject.go` awaits an EC2 contract, and `encryption.go` (the Viperblock master-key loader) awaits a Viperblock adapter owner, since `providers/ebs` is provider-neutral.
 - `runtime/compute/cache.New`: two construction-time panics carry a lint exemption pending a constructor that returns an error.
 - `domains/ec2/systeminstance`: managed-service parent metadata is only the `ManagedBy` tag value.