docs: record EC2 compute and storage moves

docs/PACKAGE_BOUNDARY_MIGRATION.md

@@ -261,6 +261,7 @@ while the branch is in flight; they do not describe the umbrella repository's
 | `7003168bc` | `spinifex/network/*` (all 15 packages) | `spinifex/domains/network/*` | Network control, policy, topology, OVN, external and host realisation are network-domain ownership. The packages move as one enclosing move because the L0–L5 invariants classify layers by trimming a single `networkRoot` prefix; a partial move would silently drop moved packages out of S1. Package names, layer assignments, reconciliation authority and the vpcd boundary are unchanged. Invariant scan roots, the RG-10 sudo allow-list path, `.github/CODEOWNERS` and the IMDS netns unit test's repo-root walk follow the new path. Injected `host`→`topology` and L3 `CreateLogicalSwitch` violations failed S1 and S5 at the new paths, confirming the invariants still scan the moved packages; `domains/network/systemvpc` now also falls inside the host-containment and NAT-mode scans and passes them. Full preflight apart from the known vulnerability-scan finding, focused network, invariant, host-command and vpcd suites, `setup-ovn_test.sh`, `manifest-check` and tagged integration/E2E compilation passed. |
 | `d8ab4017a` | `spinifex/handlers/ec2/{account,key,launchtemplate,placementgroup,spotinstance,volumestate}` | `spinifex/domains/ec2/<resource>` | These EC2 resources import no other EC2 handler package, so they move first as EC2 domain resources with their responsibilities unchanged. Each package is named after its directory and callers import it as `ec2<resource>`, because the bare names collide with common local identifiers; `volumestate` already carried its directory name. No package name appears in error text, KV keys or metrics. Path comments were updated. Full preflight apart from the known vulnerability-scan finding, focused EC2 domain, EC2 gateway, account-teardown and remaining EC2 handler suites, and tagged integration/E2E compilation passed. |
 | `20b5deb5c` | `spinifex/handlers/ec2/{vpc,eigw,eip,igw,natgw,routetable}` | `spinifex/domains/ec2/<resource>` | VPC, egress-only and internet gateways, Elastic IPs, NAT gateways and route tables are EC2 API resources and keep their responsibilities. `vpc` moves whole; splitting it along VPC, subnet, ENI and security-group boundaries remains EC2 decomposition work. Packages are named after their directories and imported as `ec2<resource>`; one test's local `vpc` alias was kept. The reconcile drift-watch test located bucket constants by matching the `handlers_ec2_` qualifier text, so its pattern now matches `ec2<resource>`; removing `ec2eip.KVBucketEIPs` from the watched list made it fail as intended. `domains/network`'s imports of these packages are now visible domain-to-domain edges, already listed in the dependency-rule debt. Full preflight apart from the known vulnerability-scan finding, focused EC2 and network domain, EC2 gateway, handler, daemon and CLI suites, and tagged integration/E2E compilation passed. |
+| `5d60184e8` | `spinifex/handlers/ec2/{instance,volume,snapshot,image,tags}` | `spinifex/domains/ec2/<resource>` | Instances, volumes, snapshots, images and tags are EC2 API resources and keep their responsibilities; `handlers/ec2` is now empty. Packages are named after their directories and imported as `ec2<resource>`; one test's local `instance` alias was kept. `docs/service-interfaces.yaml` mapped `spinifex/handlers/ec2` to the daemon for e2e suite selection, so since the first EC2 slice an EC2-only change fell back to the default suites; a throwaway commit changing only a `domains/ec2/key` file selected `e2e-cert e2e-lb` with the old manifest and the daemon suites with the new one, which lists the 17 moved resource paths rather than all of `domains/ec2` so selection is unchanged. The move exposes `domains/ec2/instance`'s runtime and DNS imports, recorded in the dependency-rule debt. Full preflight apart from the known vulnerability-scan finding, focused domain, EC2 gateway, handler, daemon, account-teardown, CLI and selector suites, `manifest-check` and tagged integration/E2E compilation passed. |
 
 The EC2 contract row is intentionally different from the directory moves: it creates
 a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS
@@ -337,7 +338,8 @@ These residuals were recorded by individual slices and must be resolved once the
 - `domains/ec2/systeminstance`: managed-service parent metadata is only the `ManagedBy` tag value.
 - `gateway/bedrock`: holds the Ochre domain core (model catalogue, provisioned throughput, guardrail, access, credential, usage, price, logging and weights stores), the inference engine (provider, vLLM, Anthropic, embeddings, reranker, admission) and the Bedrock action layer in one package with internal cycles. `domains/ochre` imports it, which is the ADR step 7 Ochre gateway import. Splitting it needs a plan: domain core and stores to `domains/ochre/<resource>`, inference to an Ochre-owned package, and only the action layer to `domains/ochre/awsapi`. The top-level `gateway/bedrock*.go` HTTP handlers additionally wait for the ingress registration seam.
 - `spinifex/migrate`: the KV engine already lives in `foundation/state/migrate`, but the remaining config-file and object-store migration engine is not a move into it. It is an operator upgrade concern used only by `spx admin upgrade`, both packages define `Registry`, `NewRegistry` and `DefaultRegistry` with distinct registry models, and its object migrations would give foundation a dependency on `providers/objectstore`. Its eventual owner is deferred; no subpackage is created to satisfy the directory map.
-- `domains/network`: imports the EC2 `vpc`, `igw`, `routetable`, `natgw` and `eip` implementations, which breaks rule 3 once both sit under `domains/`, and imports `runtime/compute/vm` and `runtime/host/command` (domain-to-runtime). Direction is unchanged by the move; resolving it needs EC2-owned projections or contracts.
+- `domains/network`: `reconcile/intent.go` builds desired network state by reading EC2's KV buckets and decoding EC2's private VPC, subnet, ENI, route-table, gateway, EIP, NAT and security-group records, and `reconcile/drift.go` watches those buckets. ADR-0001 names this pair explicitly: EC2 and network communicate through a capability/projection or versioned contract, never by one being the other's KV reader. Step 7 fix: an EC2-owned `domains/ec2/projection` exposing network intent with list and watch (it may stay KV-backed, so no data moves); a narrow intent interface declared by `reconcile`; wiring at the composition root; and the duplicated `PurposeEIP`/`PurposeIGWLRP` constants and mirrored `SGRule`/`SGEvent` folded into the projection or `contracts/ec2/v1`. The drift-watch coverage test and reconcile scenario tests are the evidence the projection must keep. `domains/network` also imports `runtime/compute/vm` and `runtime/host/command` (domain-to-runtime).
+- `domains/ec2/instance`: imports `runtime/compute/vm` and `runtime/compute/gpu` (domain-to-runtime) and `domains/dns` (cross-domain implementation import).
 - Merge-time follow-up in the umbrella repository: the `Makefile` `invariants-check` target, the `docs-pr.yml` clause cross-check, `.claude/hooks/architecture-traps.sh` and a `check-invariants.sh` comment hard-code `spinifex/spinifex/network/invariants`. They must change with the pointer bump that brings in this branch, or the docs-pr cross-check silently skips. Live specs and proposals citing `spinifex/network/` will report unresolved citations until updated.
 
 ## Recording rule