docs: record ingress dispatch registry consumption

docs/PACKAGE_BOUNDARY_MIGRATION.md

@@ -282,6 +282,7 @@ while the branch is in flight; they do not describe the umbrella repository's
 | — | `cmd/dhcptest`, `cmd/spx-loadgen` | unchanged | Both already conform to ADR-0001's tooling row: the load engine is `internal/testkit/loadgen` and the DHCP probe's shared pieces come from the network domain's `dhcp` package. What remains in each `main` is its own flag parsing and one-off orchestration that nothing else imports, so extracting it would create a package solely to satisfy the directory map. No source change. |
 | `7047f6b36` | — | — | ADR-0002 phase 0: characterization tests pin the ECR control plane as it behaves today before dispatch moves. Full-pipeline tests fix the 400/501 error envelopes, JSON 1.1 content type and `X-Amzn-Errortype`, 413 before dispatch for an oversized body, 503 for stub and composed actions when NATS is down, and authorization before a composed action. Unit tests fix target parsing (dispatch and telemetry agree on every malformed form), the stub and inventory sets, `GetAuthorizationToken` ignoring body-supplied identity, and the action reaching the throttle key, trace span and audit record. Mutation of the target parser, the authorization gate and the audit action each failed the new tests. Test-only; full preflight passed. |
 | `89364c100` | — | `spinifex/ingress/aws/dispatch`, `spinifex/ingress/aws/invariants` | ADR-0002 phase 1: the registration contract. A startup `Builder` validates and seals registrations into an immutable `Registry` keyed by credential-scope service, with aliases, an inventory name, an advisory action resolver, the dispatcher, the error envelope and the operation inventory; `Invocation` carries the bounded request, account, Region, an `AuthorizeFunc` and a lazy `ActorFunc`. It imports only `foundation/aws/errors` and Bluebottle's `iampolicy` condition-key vocabulary, and no domain moved. `TestS4_IngressAWSImportsNoDomainOrRuntimeImplementation` binds ADR-0002 S4 for all of `ingress/aws` and failed on an injected domain import. Contract tests at 100% statement coverage under `-race`; full preflight passed. |
+| `86a2de3ff` | `spinifex/gateway` (dispatch switch) | `spinifex/gateway` consuming `spinifex/ingress/aws/dispatch` | ADR-0002 phase 2: the gateway consumes the registry with no service registered. A registered service passes the auth gate, resolves its own action label, renders errors in its declared envelope through one `gw.jsonErrorService` method, and is dispatched with an `Invocation` whose `Authorize` calls the existing policy check and whose lazy `Actor` reuses `buildCallerARN`. The NATS-unavailable guard still runs ahead of both paths; every existing service takes the unchanged switch, now named the legacy path that must only shrink. The awsgw role wires an empty registry and fails startup on any overlap with the legacy table. Fake JSON, XML and resolver-less registrations prove dispatch, telemetry labels, authorisation deny/allow, the verified actor, both envelopes, the 503 and unknown-service paths and the overlap guard through the full pipeline; four production mutations were each caught. Phase 0 ECR characterisation and the unserved-service tests passed unchanged; full preflight passed. |
 
 The EC2 contract row is intentionally different from the directory moves: it creates
 a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS