refactor: relocate handlers/elbv2 to domains/elbv2 (#1269 )

* refactor: relocate handlers/elbv2 to domains/elbv2 Mechanical move per the amended ADR-0001 handlers/elbv2 row. Package renamed handlers_elbv2 -> elbv2; importers alias elbv2domain. APIs, NATS subjects, storage and behaviour unchanged. Layering debt entries retargeted; Q-30 data-plane boundary stays deferred debt. * docs: cite spinifex#1269 in the ELBv2 relocation row * docs: match citation style in the ELBv2 relocation row
refactor: relocate lbagent to agents/elbv2 (#1268 )
2026-10-26 05:59:41 +00:00 · 2026-10-26 15:23:17 +10:00 · 2026-10-26 14:34:13 +10:00 · 2026-10-26 13:45:35 +10:00
301 changed files with 518 additions and 518 deletions
@@ -10,28 +10,28 @@ type allowance struct {
 // docs/PACKAGE_BOUNDARY_MIGRATION.md. It only shrinks: delete an entry as soon
 // as its use is gone, and never add one to make a new consumer pass.
 var allowlist = []allowance{
-	{File: "spinifex/daemon/daemon.go", Symbol: "daemon.LocalStatePath", Inv: "INV-01"},
-	{File: "spinifex/daemon/daemon.go", Symbol: "daemon.ReadLocalState", Inv: "INV-01"},
-	{File: "spinifex/daemon/daemon.go", Symbol: "daemon.MarshalLocalState", Inv: "INV-01"},
-	{File: "spinifex/daemon/daemon.go", Symbol: "daemon.WriteLocalStateBytes", Inv: "INV-01"},
-	{File: "spinifex/daemon/daemon.go", Symbol: "JetStreamManager.InitKVBucket", Inv: "INV-02"},
-	{File: "spinifex/daemon/daemon.go", Symbol: "JetStreamManager.InitTerminatedInstanceBucket", Inv: "INV-02"},
-	{File: "spinifex/daemon/daemon.go", Symbol: "JetStreamManager.WriteNodeMarkerBestEffort", Inv: "INV-03"},
-	{File: "spinifex/daemon/daemon.go", Symbol: "JetStreamManager.WriteRunningSet", Inv: "INV-03"},
-	{File: "spinifex/daemon/instance_record_repair.go", Symbol: "JetStreamManager.WriteRunningSet", Inv: "INV-03"},
-	{File: "spinifex/daemon/daemon.go", Symbol: "JetStreamManager.ListTerminatedInstances", Inv: "INV-04"},
+	{File: "spinifex/runtime/daemon/daemon.go", Symbol: "daemon.LocalStatePath", Inv: "INV-01"},
+	{File: "spinifex/runtime/daemon/daemon.go", Symbol: "daemon.ReadLocalState", Inv: "INV-01"},
+	{File: "spinifex/runtime/daemon/daemon.go", Symbol: "daemon.MarshalLocalState", Inv: "INV-01"},
+	{File: "spinifex/runtime/daemon/daemon.go", Symbol: "daemon.WriteLocalStateBytes", Inv: "INV-01"},
+	{File: "spinifex/runtime/daemon/daemon.go", Symbol: "JetStreamManager.InitKVBucket", Inv: "INV-02"},
+	{File: "spinifex/runtime/daemon/daemon.go", Symbol: "JetStreamManager.InitTerminatedInstanceBucket", Inv: "INV-02"},
+	{File: "spinifex/runtime/daemon/daemon.go", Symbol: "JetStreamManager.WriteNodeMarkerBestEffort", Inv: "INV-03"},
+	{File: "spinifex/runtime/daemon/daemon.go", Symbol: "JetStreamManager.WriteRunningSet", Inv: "INV-03"},
+	{File: "spinifex/runtime/daemon/instance_record_repair.go", Symbol: "JetStreamManager.WriteRunningSet", Inv: "INV-03"},
+	{File: "spinifex/runtime/daemon/daemon.go", Symbol: "JetStreamManager.ListTerminatedInstances", Inv: "INV-04"},

-	{File: "spinifex/daemon/vm_adapters.go", Symbol: "JetStreamManager.LoadState", Inv: "INV-05"},
-	{File: "spinifex/daemon/vm_adapters.go", Symbol: "JetStreamManager.WriteStoppedInstance", Inv: "INV-05"},
-	{File: "spinifex/daemon/vm_adapters.go", Symbol: "JetStreamManager.LoadStoppedInstance", Inv: "INV-05"},
-	{File: "spinifex/daemon/vm_adapters.go", Symbol: "JetStreamManager.DeleteStoppedInstance", Inv: "INV-05"},
-	{File: "spinifex/daemon/vm_adapters.go", Symbol: "JetStreamManager.UpdateStoppedInstance", Inv: "INV-05"},
-	{File: "spinifex/daemon/vm_adapters.go", Symbol: "JetStreamManager.ClaimStoppedInstance", Inv: "INV-05"},
-	{File: "spinifex/daemon/vm_adapters.go", Symbol: "JetStreamManager.ListStoppedInstances", Inv: "INV-05"},
-	{File: "spinifex/daemon/vm_adapters.go", Symbol: "JetStreamManager.WriteTerminatedInstance", Inv: "INV-05"},
-	{File: "spinifex/daemon/vm_adapters.go", Symbol: "JetStreamManager.UpdateTerminatedInstance", Inv: "INV-05"},
-	{File: "spinifex/daemon/vm_adapters.go", Symbol: "JetStreamManager.ListTerminatedInstances", Inv: "INV-05"},
-	{File: "spinifex/daemon/vm_adapters.go", Symbol: "JetStreamManager.DeleteTerminatedInstance", Inv: "INV-05"},
+	{File: "spinifex/runtime/daemon/vm_adapters.go", Symbol: "JetStreamManager.LoadState", Inv: "INV-05"},
+	{File: "spinifex/runtime/daemon/vm_adapters.go", Symbol: "JetStreamManager.WriteStoppedInstance", Inv: "INV-05"},
+	{File: "spinifex/runtime/daemon/vm_adapters.go", Symbol: "JetStreamManager.LoadStoppedInstance", Inv: "INV-05"},
+	{File: "spinifex/runtime/daemon/vm_adapters.go", Symbol: "JetStreamManager.DeleteStoppedInstance", Inv: "INV-05"},
+	{File: "spinifex/runtime/daemon/vm_adapters.go", Symbol: "JetStreamManager.UpdateStoppedInstance", Inv: "INV-05"},
+	{File: "spinifex/runtime/daemon/vm_adapters.go", Symbol: "JetStreamManager.ClaimStoppedInstance", Inv: "INV-05"},
+	{File: "spinifex/runtime/daemon/vm_adapters.go", Symbol: "JetStreamManager.ListStoppedInstances", Inv: "INV-05"},
+	{File: "spinifex/runtime/daemon/vm_adapters.go", Symbol: "JetStreamManager.WriteTerminatedInstance", Inv: "INV-05"},
+	{File: "spinifex/runtime/daemon/vm_adapters.go", Symbol: "JetStreamManager.UpdateTerminatedInstance", Inv: "INV-05"},
+	{File: "spinifex/runtime/daemon/vm_adapters.go", Symbol: "JetStreamManager.ListTerminatedInstances", Inv: "INV-05"},
+	{File: "spinifex/runtime/daemon/vm_adapters.go", Symbol: "JetStreamManager.DeleteTerminatedInstance", Inv: "INV-05"},

 	{File: "spinifex/runtime/compute/vm/migrate.go", Symbol: "JetStreamManager.WriteStoppedInstance", Inv: "INV-06"},
 	{File: "spinifex/runtime/compute/vm/migrate.go", Symbol: "JetStreamManager.WriteTerminatedInstance", Inv: "INV-06"},
@@ -50,23 +50,23 @@ var allowlist = []allowance{
 	{File: "spinifex/domains/ec2/instance/service_impl.go", Symbol: "JetStreamManager.WriteTerminatedInstance", Inv: "INV-07"},
 	{File: "spinifex/domains/ec2/instance/service_impl.go", Symbol: "JetStreamManager.DeleteStoppedInstance", Inv: "INV-07"},

-	{File: "spinifex/daemon/daemon_handlers_image.go", Symbol: "JetStreamManager.LoadStoppedInstance", Inv: "INV-08"},
-	{File: "spinifex/daemon/daemon_handlers_image.go", Symbol: "JetStreamManager.UpdateStoppedInstance", Inv: "INV-08"},
+	{File: "spinifex/runtime/daemon/daemon_handlers_image.go", Symbol: "JetStreamManager.LoadStoppedInstance", Inv: "INV-08"},
+	{File: "spinifex/runtime/daemon/daemon_handlers_image.go", Symbol: "JetStreamManager.UpdateStoppedInstance", Inv: "INV-08"},

-	{File: "spinifex/daemon/instance_recovery.go", Symbol: "vm.InstanceRecord", Inv: "INV-10"},
-	{File: "spinifex/daemon/instance_recovery.go", Symbol: "JetStreamManager.ListInstanceRecords", Inv: "INV-10"},
-	{File: "spinifex/daemon/instance_recovery.go", Symbol: "JetStreamManager.ClaimRecoverableInstance", Inv: "INV-10"},
-	{File: "spinifex/daemon/instance_recovery.go", Symbol: "JetStreamManager.ReleaseRecoveredInstance", Inv: "INV-10"},
-	{File: "spinifex/daemon/instance_recovery.go", Symbol: "JetStreamManager.AbandonRecovery", Inv: "INV-10"},
-	{File: "spinifex/daemon/instance_recovery.go", Symbol: "JetStreamManager.LoadInstanceRecord", Inv: "INV-10"},
+	{File: "spinifex/runtime/daemon/instance_recovery.go", Symbol: "vm.InstanceRecord", Inv: "INV-10"},
+	{File: "spinifex/runtime/daemon/instance_recovery.go", Symbol: "JetStreamManager.ListInstanceRecords", Inv: "INV-10"},
+	{File: "spinifex/runtime/daemon/instance_recovery.go", Symbol: "JetStreamManager.ClaimRecoverableInstance", Inv: "INV-10"},
+	{File: "spinifex/runtime/daemon/instance_recovery.go", Symbol: "JetStreamManager.ReleaseRecoveredInstance", Inv: "INV-10"},
+	{File: "spinifex/runtime/daemon/instance_recovery.go", Symbol: "JetStreamManager.AbandonRecovery", Inv: "INV-10"},
+	{File: "spinifex/runtime/daemon/instance_recovery.go", Symbol: "JetStreamManager.LoadInstanceRecord", Inv: "INV-10"},

-	{File: "spinifex/daemon/dns_reconcile.go", Symbol: "daemon.InstanceRecordPrefix", Inv: "INV-11"},
-	{File: "spinifex/daemon/dns_reconcile.go", Symbol: "daemon.InstanceStateBucket", Inv: "INV-11"},
-	{File: "spinifex/daemon/dns_reconcile.go", Symbol: "JetStreamManager.ListInstanceRecords", Inv: "INV-11"},
+	{File: "spinifex/runtime/daemon/dns_reconcile.go", Symbol: "daemon.InstanceRecordPrefix", Inv: "INV-11"},
+	{File: "spinifex/runtime/daemon/dns_reconcile.go", Symbol: "daemon.InstanceStateBucket", Inv: "INV-11"},
+	{File: "spinifex/runtime/daemon/dns_reconcile.go", Symbol: "JetStreamManager.ListInstanceRecords", Inv: "INV-11"},

-	{File: "spinifex/daemon/eni_orphan_reaper.go", Symbol: "vm.InstanceRecord", Inv: "INV-12"},
-	{File: "spinifex/daemon/eni_orphan_reaper.go", Symbol: "JetStreamManager.ListInstanceRecords", Inv: "INV-12"},
-	{File: "spinifex/daemon/eni_orphan_reaper.go", Symbol: "JetStreamManager.ListTerminatedInstanceRecords", Inv: "INV-12"},
+	{File: "spinifex/runtime/daemon/eni_orphan_reaper.go", Symbol: "vm.InstanceRecord", Inv: "INV-12"},
+	{File: "spinifex/runtime/daemon/eni_orphan_reaper.go", Symbol: "JetStreamManager.ListInstanceRecords", Inv: "INV-12"},
+	{File: "spinifex/runtime/daemon/eni_orphan_reaper.go", Symbol: "JetStreamManager.ListTerminatedInstanceRecords", Inv: "INV-12"},

 	{File: "spinifex/domains/ec2/instance/state/imds_readers.go", Symbol: "daemon.LocalState", Inv: "INV-13"},
 	{File: "spinifex/domains/ec2/instance/state/imds_readers.go", Symbol: "daemon.LocalStatePath", Inv: "INV-13"},
@@ -95,7 +95,7 @@ const faultSource = `package %s
 import (
 	"encoding/json"

-	spxd "github.com/mulgadc/spinifex/spinifex/daemon"
+	spxd "github.com/mulgadc/spinifex/spinifex/runtime/daemon"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
 )

@@ -176,11 +176,11 @@ func TestADR0007_S6_RatchetDetectsFaults(t *testing.T) {
 // must see those too.
 func TestADR0007_S6_RatchetSeesBareIdentifiersInOwnerPackages(t *testing.T) {
 	src := map[string]string{
-		"spinifex/daemon/new_consumer.go":           "package daemon\n\nfunc f() string { return InstanceStateBucket + LocalStatePath(\"\") }\n",
+		"spinifex/runtime/daemon/new_consumer.go":   "package daemon\n\nfunc f() string { return InstanceStateBucket + LocalStatePath(\"\") }\n",
 		"spinifex/runtime/compute/vm/new_reader.go": "package vm\n\nfunc g(r *InstanceRecord) *VM { return VMFromRecord(r) }\n",
 	}
 	want := map[string][]string{
-		"spinifex/daemon/new_consumer.go":           {"daemon.InstanceStateBucket", "daemon.LocalStatePath"},
+		"spinifex/runtime/daemon/new_consumer.go":   {"daemon.InstanceStateBucket", "daemon.LocalStatePath"},
 		"spinifex/runtime/compute/vm/new_reader.go": {"vm.InstanceRecord", "vm.VMFromRecord"},
 	}
 	for rel, code := range src {
@@ -20,9 +20,9 @@ import (
 )

 const (
-	daemonPath = "github.com/mulgadc/spinifex/spinifex/daemon"
+	daemonPath = "github.com/mulgadc/spinifex/spinifex/runtime/daemon"
 	vmPath     = "github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
-	daemonDir  = "spinifex/daemon"
+	daemonDir  = "spinifex/runtime/daemon"
 	vmDir      = "spinifex/runtime/compute/vm"
 )

@@ -69,12 +69,12 @@ var literals = set(`"spinifex-instance-state"`, `"spinifex-terminated-instances"
 // ownerFiles define the symbols above. They are the implementation being
 // migrated, not consumers of it, and are listed so a deleted one is noticed.
 var ownerFiles = []string{
-	"spinifex/daemon/instance_membership.go",
-	"spinifex/daemon/instance_records.go",
-	"spinifex/daemon/instance_records_migrate.go",
-	"spinifex/daemon/instance_running_set.go",
-	"spinifex/daemon/jetstream.go",
-	"spinifex/daemon/local_state.go",
+	"spinifex/runtime/daemon/instance_membership.go",
+	"spinifex/runtime/daemon/instance_records.go",
+	"spinifex/runtime/daemon/instance_records_migrate.go",
+	"spinifex/runtime/daemon/instance_running_set.go",
+	"spinifex/runtime/daemon/jetstream.go",
+	"spinifex/runtime/daemon/local_state.go",
 	"spinifex/runtime/compute/vm/record.go",
 }

@@ -32,7 +32,7 @@ var allowlist = []allowance{
 	{From: "cmd/aws-model-coverage", To: "domains/acm/awsapi", Debt: "cmd/aws-model-coverage", Reason: "reads declared ECR/ACM inventories; named exception, must not construct a registration"},
 	{From: "cmd/aws-model-coverage", To: "domains/ecr/awsapi", Debt: "cmd/aws-model-coverage", Reason: "reads declared ECR/ACM inventories; named exception, must not construct a registration"},

-	{From: "daemon", To: "domains/ec2/awsapi/instance", Debt: "Instance adapter consumers outside EC2", Reason: "daemon/eks_cp_control.go and rds_deps.go call the instance adapter; needs an EC2 capability"},
+	{From: "runtime/daemon", To: "domains/ec2/awsapi/instance", Debt: "Instance adapter consumers outside EC2", Reason: "runtime/daemon/eks_cp_control.go and rds_deps.go call the instance adapter; needs an EC2 capability"},

 	{From: "domains/acm", To: "domains/iam", Debt: "ACM: the IAM AES-GCM helper import (ACM relocation residual)", Reason: "IAM AES-GCM helpers; needs a shared crypto boundary"},

@@ -66,7 +66,7 @@ var allowlist = []allowance{
 	{From: "domains/ec2/instance", To: "domains/network/topology", Debt: "EC2 → network implementation", Reason: "EC2 reads network implementation; clears with the EC2-owned projection"},
 	{From: "domains/ec2/instance", To: "runtime/compute/gpu", Debt: "domains/ec2/instance", Reason: "VM/GPU runtime state read directly; needs a domain-owned projection"},
 	{From: "domains/ec2/instance", To: "runtime/compute/vm", Debt: "domains/ec2/instance", Reason: "VM/GPU runtime state read directly; needs a domain-owned projection"},
-	{From: "domains/ec2/instance/state", To: "daemon", Debt: "domains/ec2/instance/state (dependency, IMDS readers)", Reason: "wraps the daemon's local-file reader and JetStreamManager bucket open unchanged for vpcd's IMDS lookup"},
+	{From: "domains/ec2/instance/state", To: "runtime/daemon", Debt: "domains/ec2/instance/state (dependency, IMDS readers)", Reason: "wraps the daemon's local-file reader and JetStreamManager bucket open unchanged for vpcd's IMDS lookup"},
 	{From: "domains/ec2/instance/state", To: "runtime/compute/vm", Debt: "domains/ec2/instance/state (dependency)", Reason: "the vpcd IMDS local reader returns vm.VM"},

 	{From: "domains/ec2/volume", To: "runtime/compute/vm", Debt: "Domain → runtime", Reason: "VM runtime state read directly; needs a domain-owned projection"},
@@ -128,7 +128,7 @@ var allowlist = []allowance{
 	{From: "handlers/ecs", To: "domains/ec2/ebs/metadata", Debt: "close-out: handlers/ecs (ADR-0004 blocked-dependency list; inventory-ecs boundary imports)", Reason: "legacy ECS calls another domain's implementation as an internal API"},
 	{From: "handlers/ecs", To: "domains/ec2/eip", Debt: "close-out: handlers/ecs (ADR-0004 blocked-dependency list; inventory-ecs boundary imports)", Reason: "legacy ECS calls another domain's implementation as an internal API"},
 	{From: "handlers/ecs", To: "domains/ec2/instancetypes", Debt: "close-out: handlers/ecs (ADR-0004 blocked-dependency list; inventory-ecs boundary imports)", Reason: "legacy ECS calls another domain's implementation as an internal API"},
-	{From: "handlers/ecs", To: "handlers/elbv2", Debt: "close-out: handlers/ecs (ADR-0004 blocked-dependency list; inventory-ecs boundary imports)", Reason: "legacy ECS calls another domain's implementation as an internal API"},
+	{From: "handlers/ecs", To: "domains/elbv2", Debt: "close-out: handlers/ecs (ADR-0004 blocked-dependency list; inventory-ecs boundary imports)", Reason: "legacy ECS calls another domain's implementation as an internal API"},
 	{From: "handlers/ecs", To: "domains/iam", Debt: "close-out: handlers/ecs (ADR-0004 blocked-dependency list; inventory-ecs boundary imports)", Reason: "legacy ECS calls another domain's implementation as an internal API"},

 	{From: "domains/eks/cluster", To: "domains/dns", Debt: "close-out: handlers/eks (ADR-0004 blocked-dependency list; inventory-eks boundary imports)", Reason: "legacy EKS calls another domain's or runtime implementation directly"},
@@ -140,13 +140,13 @@ var allowlist = []allowance{
 	{From: "domains/eks/cluster", To: "domains/iam", Debt: "close-out: handlers/eks (ADR-0004 blocked-dependency list; inventory-eks boundary imports)", Reason: "legacy EKS calls another domain's or runtime implementation directly"},
 	{From: "domains/eks/cluster", To: "runtime/compute/vm", Debt: "close-out: handlers/eks (ADR-0004 blocked-dependency list; inventory-eks boundary imports)", Reason: "legacy EKS calls another domain's or runtime implementation directly"},

-	{From: "handlers/elbv2", To: "domains/acm", Debt: "handlers/elbv2 (cross-domain)", Reason: "legacy ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
-	{From: "handlers/elbv2", To: "domains/dns", Debt: "handlers/elbv2 (cross-domain)", Reason: "legacy ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
-	{From: "handlers/elbv2", To: "domains/ec2/systeminstance", Debt: "handlers/elbv2 (cross-domain)", Reason: "legacy ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
-	{From: "handlers/elbv2", To: "domains/ec2/vpc", Debt: "handlers/elbv2 (cross-domain)", Reason: "legacy ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
-	{From: "handlers/elbv2", To: "domains/network/topology", Debt: "handlers/elbv2 (cross-domain)", Reason: "legacy ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
-	{From: "handlers/elbv2", To: "domains/iam", Debt: "IAM implementation consumers in STS, Ochre and ELBv2", Reason: "system-instance role ensurer; needs an IAM capability"},
-	{From: "handlers/elbv2", To: "lbagent", Debt: "handlers/elbv2/{agent_types,haproxy,health_checker,nginx}.go import lbagent", Reason: "health-report and cert/PID-path vocabulary; needs a guest/controller contract"},
+	{From: "domains/elbv2", To: "domains/acm", Debt: "domains/elbv2 (cross-domain)", Reason: "ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
+	{From: "domains/elbv2", To: "domains/dns", Debt: "domains/elbv2 (cross-domain)", Reason: "ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
+	{From: "domains/elbv2", To: "domains/ec2/systeminstance", Debt: "domains/elbv2 (cross-domain)", Reason: "ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
+	{From: "domains/elbv2", To: "domains/ec2/vpc", Debt: "domains/elbv2 (cross-domain)", Reason: "ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
+	{From: "domains/elbv2", To: "domains/network/topology", Debt: "domains/elbv2 (cross-domain)", Reason: "ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
+	{From: "domains/elbv2", To: "domains/iam", Debt: "IAM implementation consumers in STS, Ochre and ELBv2", Reason: "system-instance role ensurer; needs an IAM capability"},
+	{From: "domains/elbv2", To: "agents/elbv2", Debt: "domains/elbv2/{agent_types,haproxy,health_checker,nginx}.go import lbagent", Reason: "health-report and cert/PID-path vocabulary; needs a guest/controller contract"},

 	{From: "domains/rds/instance", To: "domains/dns", Debt: "close-out: handlers/rds (ADR-0004 blocked-dependency list; inventory-rds boundary imports)", Reason: "legacy RDS calls another domain's or runtime implementation directly"},
 	{From: "domains/rds/instance", To: "domains/ec2/instance", Debt: "close-out: handlers/rds (ADR-0004 blocked-dependency list; inventory-rds boundary imports)", Reason: "legacy RDS calls another domain's or runtime implementation directly"},
@@ -159,6 +159,5 @@ var allowlist = []allowance{
 	{From: "domains/sts", To: "domains/iam", Debt: "IAM implementation consumers in STS, Ochre and ELBv2", Reason: "STS reads IAM service, trust-policy and OIDC-provider state; needs an IAM capability"},

 	{From: "operator/cli", To: "accountteardown", Debt: "operator/cli (dependency)", Reason: "command tree imports implementations; needs public capabilities"},
-	{From: "operator/cli", To: "daemon", Debt: "operator/cli (dependency)", Reason: "command tree imports implementations; needs public capabilities"},
 	{From: "operator/cli", To: "gateway", Debt: "operator/cli (dependency)", Reason: "command tree imports implementations; needs public capabilities"},
 }
@@ -191,3 +191,21 @@ func TestADR0001_LayeringCheckerDetectsFaults(t *testing.T) {
 		t.Errorf("allow-listed cross-domain edge %s was not detected by R3, so the allowlist entry would read as stale", allowedEdge)
 	}
 }
+
+// TestADR0001_InterimDaemonDirectionCoversRuntimeDaemon: the daemon left its
+// legacy root, so the interim guardrail must still reject handlers and gateway
+// importing it at runtime/daemon.
+func TestADR0001_InterimDaemonDirectionCoversRuntimeDaemon(t *testing.T) {
+	r := ruleByID("Interim_DaemonGatewayHandlersDirection")
+	daemon, _ := classify("spinifex/runtime/daemon")
+	for _, from := range []string{"spinifex/gateway", "spinifex/handlers/ecs"} {
+		f, _ := classify(from)
+		if !r.subject(f, from) || !r.forbids(f, daemon, from) {
+			t.Errorf("%s -> runtime/daemon is not rejected", from)
+		}
+	}
+	other, _ := classify("spinifex/runtime/host/process")
+	if gw, _ := classify("spinifex/gateway"); r.forbids(gw, other, "spinifex/gateway") {
+		t.Error("gateway -> runtime/host/process is rejected, but it is not the daemon")
+	}
+}
@@ -42,6 +42,7 @@ type class struct {
 	legacy string // legacy root name when layer is layerLegacy
 	domain string // owning domain for domain-shaped and agent packages
 	kind   domainKind
+	daemon bool // runtime/daemon, the interim daemon -> gateway -> handlers root
 }

 func (c class) domainShaped() bool { return c.kind != notDomain }
@@ -59,8 +60,8 @@ func (c class) isLegacy(roots ...string) bool {

 // legacyRoots are pre-ADR-0001 application roots still standing.
 var legacyRoots = map[string]bool{
-	"handlers": true, "gateway": true, "daemon": true,
-	"accountteardown": true, "lbagent": true,
+	"handlers": true, "gateway": true,
+	"accountteardown": true,
 }

 // gatewayDomains names the domain each gateway/<service> adapter belongs to;
@@ -70,12 +71,8 @@ var gatewayDomains = map[string]string{
 	"rds": "rds", "sts": "sts",
 }

-// runtimeLegacy and operatorLegacy are the legacy roots whose ADR-0001 target
-// is runtime/ and operator/ respectively.
-var (
-	runtimeLegacy  = []string{"daemon"}
-	operatorLegacy = []string{"accountteardown"}
-)
+// operatorLegacy are the legacy roots whose ADR-0001 target is operator/.
+var operatorLegacy = []string{"accountteardown"}

 // classify maps a module-relative package directory to its layer. ok is false
 // for a package that has no deliberate classification.
@@ -112,7 +109,7 @@ func classifyApp(app []string) (class, bool) {
 	case "ingress":
 		return class{layer: layerIngress}, true
 	case "runtime":
-		return class{layer: layerRuntime}, true
+		return class{layer: layerRuntime, daemon: len(app) >= 2 && app[1] == "daemon"}, true
 	case "operator":
 		return class{layer: layerOperator}, true
 	case "providers":
@@ -11,19 +11,16 @@ import (
 // completed move whose line must be deleted.
 var frozenLegacyPackages = []string{
 	"accountteardown",
-	"daemon",
 	"gateway",
 	"gateway/ecs",
 	"gateway/elbv2",
 	"gateway/spx",
 	"handlers/ecs",
-	"handlers/elbv2",
-	"lbagent",
 }

 // retiredLegacyRoots were legacy roots whose every package has moved to its
 // ADR-0001 target; recreating one would reopen a closed migration row.
-var retiredLegacyRoots = []string{"admin", "services", "utils", "vpcd"}
+var retiredLegacyRoots = []string{"admin", "daemon", "lbagent", "services", "utils", "vpcd"}

 // TestADR0001_LegacyRootsFrozen: the current-to-target map gives every legacy
 // root a destination, so none may gain a package and no retired root may return.
@@ -73,7 +73,7 @@ var rules = []rule{
 		subject: func(f class, _ string) bool { return f.domainShaped() },
 		forbids: func(f, t class, _ string) bool {
 			return f.domainShaped() && (isLayer(t, layerRuntime, layerOperator) ||
-				t.isLegacy(runtimeLegacy...) || t.isLegacy(operatorLegacy...))
+				t.isLegacy(operatorLegacy...))
 		},
 	},
 	{
@@ -121,7 +121,7 @@ var rules = []rule{
 				return false
 			}
 			switch {
-			case t.layer == layerAgents || t.isLegacy("lbagent"):
+			case t.layer == layerAgents:
 				return true
 			case t.layer == layerIngress:
 				return f.kind != domainAWSAPI && f.kind != legacyAdapter
@@ -137,9 +137,9 @@ var rules = []rule{
 		id:      "Agents_ImportNoDomainOrLegacyImplementation",
 		clause:  "area table: agents/<domain> own in-guest and service-role behaviour, not tenant API authority or another domain's private state",
 		hint:    "move the shared wire vocabulary behind a guest/controller contract under contracts/",
-		subject: func(f class, _ string) bool { return f.layer == layerAgents || f.isLegacy("lbagent") },
+		subject: func(f class, _ string) bool { return f.layer == layerAgents },
 		forbids: func(f, t class, _ string) bool {
-			return (f.layer == layerAgents || f.isLegacy("lbagent")) && (t.domainShaped() || t.isLegacy())
+			return f.layer == layerAgents && (t.domainShaped() || t.isLegacy())
 		},
 	},
 	{
@@ -160,9 +160,9 @@ var rules = []rule{
 		forbids: func(f, t class, _ string) bool {
 			switch {
 			case f.isLegacy("handlers"):
-				return t.isLegacy("gateway", "daemon")
+				return t.isLegacy("gateway") || t.daemon
 			case f.isLegacy("gateway"):
-				return t.isLegacy("daemon")
+				return t.daemon
 			}
 			return false
 		},
@@ -19,7 +19,7 @@ import (
 	"syscall"

 	"github.com/mulgadc/bluebottle/pkg/otelsetup"
-	"github.com/mulgadc/spinifex/spinifex/lbagent"
+	lbagent "github.com/mulgadc/spinifex/spinifex/agents/elbv2"

 	_ "github.com/mulgadc/bluebottle/pkg/fipsboot"
 )
@@ -17,7 +17,7 @@ func TestVolumeAbandonSubject_BothForms(t *testing.T) {
 	assert.Equal(t, "ebs.abandon", viperblocklegacyv1.VolumeAbandonSubject(""))
 }

-// TestVolumeAbandonRequest_JSON pins the request daemon/vm_adapters.go sends
+// TestVolumeAbandonRequest_JSON pins the request runtime/daemon/vm_adapters.go sends
 // on the abandon route.
 func TestVolumeAbandonRequest_JSON(t *testing.T) {
 	golden := `{"volume":"vol-1","reason":"instance owned by another node"}`
@@ -50,14 +50,12 @@ Request routing (`spinifex/gateway/gateway.go`):
 1. **Authentication**: SigV4 middleware validates AWS credentials and resolves the account ID
 2. **Throttling**: Per-account+action token bucket rejects bursts post-auth
 3. **Service Detection**: Extracts service name from the Authorization header
-4. **Action Dispatch**: Routes to service-specific handler. A service registered through the ingress dispatch registry (`ingress/aws/dispatch`, wired by `runtime/roles/awsgw`) is dispatched by its registration; currently that is ECR's control plane, registered from `domains/ecr/awsapi`. Every other service uses the legacy switch:
+4. **Action Dispatch**: Routes to service-specific handler. A service registered through the ingress dispatch registry (`ingress/aws/dispatch`, wired by `runtime/roles/awsgw`) is dispatched by its registration; currently those are the ECR and ACM control planes, registered from `domains/ecr/awsapi` and `domains/acm/awsapi`. Every other service uses the legacy switch:

 ```go
 switch svc {
 case "ec2":
    err = gw.EC2_Request(w, r)
-case "account":
-    err = gw.Account_Request(w, r)
 case "iam":
    err = gw.IAM_Request(w, r)
 case "sts":
@@ -66,10 +64,13 @@ case "elasticloadbalancing":
    err = gw.ELBv2_Request(w, r)
 case "eks":
    err = gw.EKS_Request(w, r)
+case "bedrock":
+    err = gw.Bedrock_Request(w, r)
+// ... bedrock-runtime, bedrock-agent, bedrock-agent-runtime
 case "ecs":
    err = gw.ECS_Request(w, r)
-case "acm":
-    err = gw.ACM_Request(w, r)
+case "rds":
+    err = gw.RDS_Request(w, r)
 case "tagging":
    err = gw.Tagging_Request(w, r)
 case "spinifex":
@@ -79,14 +80,15 @@ case "spinifex":

 ### 3. EC2 Handler

-The EC2 handler (`spinifex/gateway/ec2.go`) parses the `Action` parameter and delegates to specific handlers via a generic `ec2Handler` wrapper. The account ID resolved by SigV4 auth is threaded into every handler so requests are scoped per IAM principal:
+The EC2 handler (`spinifex/gateway/ec2.go`) parses the `Action` parameter and delegates to specific handlers via the generic `ec2Handler` and `ec2HandlerWithReq` wrappers. The account ID resolved by SigV4 auth is threaded into every handler so requests are scoped per IAM principal:

 ```go
-"RunInstances": ec2Handler(func(input *ec2.RunInstancesInput, gw *GatewayConfig, accountID string) (any, error) {
-    return ec2instanceapi.RunInstances(input, gw.NATSConn, accountID)
+"RunInstances": ec2HandlerWithReq(func(ctx context.Context, input *ec2.RunInstancesInput, gw *GatewayConfig, accountID string, r *http.Request) (any, error) {
+    // ... PassRole and launch-quota checks, then the vCPU quota charge
+    return ec2instanceapi.RunInstances(ctx, input, gw.NATSConn, gw.IAMService, accountID, passRoleCheck, launchQuotaCheck, gw.ExpectedNodes)
 }),
-"DescribeInstances": ec2Handler(func(input *ec2.DescribeInstancesInput, gw *GatewayConfig, accountID string) (any, error) {
-    return ec2instanceapi.DescribeInstances(input, gw.NATSConn, gw.DiscoverActiveNodes(), accountID)
+"DescribeInstances": ec2Handler(func(ctx context.Context, input *ec2.DescribeInstancesInput, gw *GatewayConfig, accountID string) (any, error) {
+    return ec2instanceapi.DescribeInstancesChecked(ctx, input, gw.NATSConn, 0, gw.NodeIDs, accountID)
 }),
 // ... + volumes, snapshots, VPCs, subnets, route tables, IGWs, NAT gateways,
 // security groups, network interfaces, elastic IPs, placement groups, key pairs,
@@ -98,13 +100,13 @@ The EC2 handler (`spinifex/gateway/ec2.go`) parses the `Action` parameter and de
 The gateway communicates with daemons via NATS request/response. Most calls go through `natsmsg.NATSRequest`, which marshals the input, attaches the account ID as a NATS header, and unmarshals the typed response:

 ```go
-func (s *NATSInstanceService) RunInstances(input *ec2.RunInstancesInput, accountID string) (*ec2.Reservation, error) {
+func (s *NATSInstanceService) RunInstances(ctx context.Context, input *ec2.RunInstancesInput, accountID string) (*ec2.Reservation, error) {
    topic := fmt.Sprintf("ec2.RunInstances.%s", aws.StringValue(input.InstanceType))
-    return natsmsg.NATSRequest[ec2.Reservation](s.natsConn, topic, input, 5*time.Minute, accountID)
+    return natsmsg.NATSRequest[ec2.Reservation](ctx, s.natsConn, topic, input, 5*time.Minute, accountID)
 }
 ```

-`RunInstances` uses a per-instance-type subject so NATS only delivers the request to a node with spare capacity for that type — no application-level reject-and-retry.
+The gateway's `RunInstances` places instances itself (`domains/ec2/awsapi/instance/placement.go`): it gathers capacity from every node on `spinifex.node.status`, spreads the launch across eligible nodes, and sends each node its share on the node-targeted subject `ec2.RunInstances.{type}.{nodeId}`, rolling back on partial failure.

 ### Cross-Process Contract Ownership

@@ -124,14 +126,14 @@ refactor. It needs a versioned successor or an explicit compatibility plan.

 ### 5. Daemon Processing

-Daemons (`spinifex/daemon/daemon.go`) subscribe to NATS topics and handle requests. A table-driven `subscribeAll()` registers the static EC2/ELBv2 surface at startup:
+Daemons (`spinifex/runtime/daemon/daemon.go`) subscribe to NATS topics and handle requests. A table-driven `subscribeAll()` registers the static EC2/ELBv2 surface at startup:

 ```go
 // Queue group → load-balanced (one daemon handles each request)
-{"ec2.CreateKeyPair", d.handleEC2CreateKeyPair, "spinifex-workers"},
+{"ec2.CreateKeyPair", handleNATSRequest(d.node, d.keyService.CreateKeyPair), "spinifex-workers"},

 // No queue group → fan-out (every daemon responds)
-{"ec2.DescribeInstanceTypes", d.handleEC2DescribeInstanceTypes, ""},
+{"ec2.DescribeInstanceTypes", handleNATSRequest(d.node, d.instanceService.DescribeInstanceTypes), ""},
 ```

 `ec2.RunInstances` is dynamic: `ResourceManager` subscribes to `ec2.RunInstances.{type}` only while the node has capacity for that type, and unsubscribes when full. The node-targeted subject `ec2.RunInstances.{type}.{nodeId}` stays subscribed even at full capacity — the launch-time `allocate()` enforces limits there. Per-instance commands flow over `ec2.cmd.{instanceID}`, subscribed only by the owning node.
@@ -144,20 +146,17 @@ When a daemon handles `RunInstances`:

 1. **Resource Check**: Validates CPU/memory availability via `ResourceManager`
 2. **Volume Generation**: Creates boot and EFI volumes via Viperblock
-3. **Volume Mount**: Sends `ebs.mount` request to Viperblock, receives NBD URI
+3. **Volume Mount**: Sends a mount request to the colocated Viperblock worker on `ebs.{node}.mount`, receives NBD URI
 4. **QEMU Launch**: Builds and executes QEMU command with NBD-backed disks
 5. **QMP Monitoring**: Establishes QEMU Machine Protocol connection for VM management
 6. **Command subscription**: Subscribes to `ec2.cmd.{instanceID}` for subsequent commands on this VM

 ```go
-// Volume mounting via NATS
-msg, err := d.natsConn.Request("ebs.mount", ebsMountRequest, 10*time.Second)
+// Volume mounting via NATS (runtime/daemon/vm_adapters.go)
+reply, err := ebsRequestWithTrace(ctx, a.nc, instance.AccountID, viperblocklegacyv1.MountSubject(a.node), ebsMountRequest, 30*time.Second)

-// QEMU launch with NBD storage
-cmd := exec.Command("qemu-system-x86_64",
-    "-drive", fmt.Sprintf("file=nbd:%s,format=raw", nbdURI),
-    // ... additional QEMU args
-)
+// QEMU launch with NBD-backed drives in args (runtime/compute/vm/vm.go)
+cmd := exec.Command(qemuArchitecture, args...) // qemu-system-x86_64 or qemu-system-aarch64
 ```

 ## Key Components
@@ -199,33 +198,17 @@ type ResourceManager struct {

 ### Multi-Node Aggregation

-For operations that need data from all nodes (like `DescribeInstances`), the gateway uses inbox-based fan-out (`spinifex/domains/ec2/awsapi/instance/DescribeInstances.go`):
+For operations that need data from all nodes (like `DescribeInstances`), the gateway uses the scatter-gather helper `natsmsg.Gather` (`spinifex/foundation/messaging/nats/nats.go`), called from `spinifex/domains/ec2/awsapi/instance/DescribeInstances.go`:

 ```go
-func DescribeInstances(...) {
-    // Create unique inbox for collecting responses
-    inbox := nats.NewInbox()
-    sub, _ := natsConn.SubscribeSync(inbox)
-
-    // Publish to all nodes (no queue group = all daemons respond).
-    // Account ID is propagated as a NATS header so each daemon scopes its response.
-    pubMsg := nats.NewMsg("ec2.DescribeInstances")
-    pubMsg.Reply = inbox
-    pubMsg.Data = jsonData
-    pubMsg.Header.Set(natsmsg.AccountIDHeader, accountID)
-    _ = natsConn.PublishMsg(pubMsg)
-
-    // Collect responses, returning early once expectedNodes have replied
-    // or the 3s timeout is hit.
-    for {
-        msg, err := sub.NextMsg(3 * time.Second)
-        allReservations = append(allReservations, nodeOutput.Reservations...)
-    }
-
-    return allReservations
-}
+// Publish to every node (no queue group = all daemons respond) and collect
+// the replies. The account ID travels as a NATS header so each daemon scopes
+// its response.
+frames, sum, err := natsmsg.Gather(ctx, natsConn, "ec2.DescribeInstances", jsonData, gatherOpts)
 ```

+Given the configured node IDs, `Gather` checks each reply's `X-Node-ID` header against them, and `DescribeInstancesChecked` fails closed rather than returning a partial listing when a node is missing, duplicated or unidentified.
+
 ## Storage Integration

 ### Viperblock (EBS)
@@ -240,6 +223,7 @@ type EBSRequest struct {
    Boot      bool    // Boot volume flag
    EFI       bool    // EFI boot volume
    NBDURI    string  // NBD URI returned from mount
+    // ... + DeviceName, DeleteOnTermination, hotplug port and host block-device fields
 }
 ```

@@ -298,6 +282,7 @@ type Config struct {
    Predastore PredastoreConfig // S3 endpoint + service credentials
    Viperblock ViperblockConfig
    VPCD       VPCDConfig       // OVN/OVS endpoints
+    // ... + EBS, Northstar, RDS, ACM, Bedrock, OchreVector
 }
 ```

@@ -320,15 +305,14 @@ spinifex/
 │   ├── ingress/             # AWS protocol ingress: query/REST parsing, dispatch registry, rate limiting
 │   ├── runtime/
 │   │   ├── roles/           # Long-running service roles (awsgw, spinifex, vpcd, nats, predastore, ...)
+│   │   ├── daemon/          # Per-node daemon and its NATS subscription table
 │   │   └── compute/         # VM lifecycle, QMP, NBD, GPU
 │   ├── bootstrap/           # Cluster and node configuration structures, preflight checks
 │   ├── operator/            # spx CLI commands, admin use cases, installer, upgrade
-│   ├── agents/              # In-guest agent libraries (ecs, eks, rds)
+│   ├── agents/              # In-guest agent libraries (ecs, eks, elbv2, rds)
 │   ├── gateway/             # Legacy root: HTTP route assembly, SigV4 auth, legacy per-service dispatch
-│   ├── handlers/            # Legacy root: ecs, eks, elbv2, iam, rds, sts service implementations
-│   ├── daemon/              # Legacy root: per-node daemon and its NATS subscription table
-│   ├── accountteardown/     # Legacy root: account deletion cleanup
-│   └── lbagent/             # Legacy root: load-balancer agent
+│   ├── handlers/            # Legacy root: ecs service implementation
+│   └── accountteardown/     # Legacy root: account deletion cleanup
 ├── internal/                # In-guest SigV4 clients, AWS Smithy models and test kits
 ├── architecture/            # Executable architecture rules (package layering)
 ├── build/                   # systemd units, node helper scripts, microVM build
@@ -338,7 +322,7 @@ spinifex/
    └── e2e/                 # Live-cluster suites (see docs/testing/e2e-coverage.md)
 ```

-The five legacy roots predate ADR-0001 and are frozen: they may shrink but not gain packages.
+The three remaining legacy roots predate ADR-0001 and are frozen: they may shrink but not gain packages.
 [`PACKAGE_BOUNDARY_MIGRATION.md`](PACKAGE_BOUNDARY_MIGRATION.md) records what remains in each and what blocks its move.

 ## Development
@@ -346,6 +346,9 @@ while the branch is in flight; they do not describe the umbrella repository's
 | `spinifex#1264` | `spinifex/handlers/eks` | `spinifex/domains/eks/cluster` (`cluster`, imported as `ekscluster`) | A mechanical relocation of the remaining EKS implementation, nodegroups included; APIs, NATS subjects, KV buckets and behaviour are unchanged and only the package name changed from `handlers_eks`. The frozen-legacy entry is removed, the allowlist entries naming `handlers/eks` now name `domains/eks/cluster`, and the `operator/cli` entry is removed because an operator importing a domain package no longer breaks the legacy rule. Nodegroup service extraction is deferred. |
 | `spinifex#1265` | `spinifex/gateway/{iam,sts,eks,rds}` | `spinifex/domains/{iam,sts,eks,rds}/awsapi` (`awsapi`, imported as `iamawsapi`, `stsawsapi`, `eksawsapi`, `rdsawsapi`) | A mechanical relocation of the IAM, STS, EKS and RDS AWS action adapters to their ADR-0001 domain homes; APIs, NATS subjects, KV buckets and behaviour are unchanged. The root `gateway` dispatch still imports each package, recorded as `gateway` (service registration) debt. `gateway/bedrock` stays: ADR-0001 moves only its action adapters, and the package also holds the Ochre domain core, stores and inference engine. |
 | `spinifex#1266` | `spinifex/gateway/bedrock` | `spinifex/domains/ochre` (merged into package `ochre`) | A mechanical whole-package relocation: the Ochre domain core, stores, inference engine and Bedrock action layer join the existing `domains/ochre` package with their package-private code and tests intact. No identifier, API, NATS subject, KV bucket, metric, error string or behaviour changes; `domains/ochre` no longer imports a legacy package. Separating the action adapters into `domains/ochre/awsapi` is deferred, recorded as `domains/ochre` (action adapters) debt. |
+| `spinifex#1267` | `spinifex/daemon` | `spinifex/runtime/daemon` | A mechanical whole-package relocation under the 2026-10-26 ADR-0001 amendment: the per-node daemon keeps package name `daemon`, its files, tests and current dependencies. No identifier, API, NATS subject, KV bucket, metric, error string or behaviour changes. The interim daemon → gateway → handlers guardrail now matches `runtime/daemon`. Q-28's ownership and deployment refactor is deferred, recorded as `runtime/daemon` (Q-28 ownership and deployment) debt. |
+| `spinifex#1268` | `spinifex/lbagent` | `spinifex/agents/elbv2` (package `elbv2`) | A mechanical whole-package relocation under the 2026-10-26 ADR-0001 amendment: the load-balancer agent keeps its files, tests and current dependencies, and importers alias it `lbagent` so call sites are unchanged. No identifier, API, NATS subject, file path on the guest, metric, error string or behaviour changes; `cmd/lb-agent` stays the thin main. Q-30's data-plane boundary is deferred, recorded as `agents/elbv2` (Q-30 data-plane boundary) debt. |
+| `spinifex#1269` | `spinifex/handlers/elbv2` | `spinifex/domains/elbv2` (package `elbv2`) | A mechanical whole-package relocation under the 2026-10-26 ADR-0001 amendment: the ELBv2 control plane keeps its files, tests and current dependencies, and importers alias it `elbv2domain`. No identifier, API, NATS subject, KV bucket, metric, error string or behaviour changes. Its allowlist entries are now sourced from `domains/elbv2`. Q-30's data-plane boundary stays deferred, recorded as `agents/elbv2` (Q-30 data-plane boundary) debt. |
 The EC2 contract row is intentionally different from the directory moves: it creates
 a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS
 subscription and permission shape, while callers use
@@ -419,14 +422,15 @@ These residuals were recorded by individual slices and must be resolved once the
 - The public `/keys` endpoint (root `gateway`, `oidc_discovery.go`) serves malformed stored JWKS bytes with HTTP 200. Removal condition: validate before serving, or record it as accepted.
 - The public discovery and `/keys` endpoints return 404 for KV read errors, including timeouts; only a bucket-open failure returns 500. Removal condition: distinguish dependency failure from not-found.
 - The root `gateway` package imports `domains/eks/cluster` directly (`gateway/oidc_discovery.go`: `AccountBucketName`, `GetClusterMeta`). The layering rules don't see it because the root gateway has no domain classification, so it has no allowlist entry. Removal condition: the public OIDC discovery and JWKS endpoints consume an EKS-owned resolver injected at composition, the same pattern as STS, leaving the root gateway with no `domains/eks/cluster` import.
- `handlers/elbv2/{agent_types,haproxy,health_checker,nginx}.go` import `lbagent` (`HealthReport`, `ServerStatus`, `CertDir`, `NginxPIDPath`, `NginxCertDir`), a domain reading an agent's implementation package rather than a declared wire contract. Removal condition: the health-report and cert/PID-path vocabulary moves behind a guest/controller contract the domain and the agent both consume.
- `domains/ec2/instance/state/imds_readers.go` (dependency, IMDS readers) imports `daemon` for `LocalState`, `ReadLocalState`, `LocalStatePath`, `NewJetStreamManager` and `InstanceStateBucket`. The local-file reader and the instance-record loader's `JetStreamManager` open, which `vpcd/imds_instance_state.go` held directly, moved here unchanged and are now injected into `vpcd` through `guestmetadata.LocalStateReader` and `guestmetadata.RecordLoader`. The readers already live in `domains/ec2/instance/state`. Removal condition: the legacy dependencies they call are extracted from `daemon` — `LocalStatePath`, `ReadLocalState` and `LocalState`, the instance bucket constants, and `JetStreamManager` with its bucket initialisation (`InitKVBucket`) — leaving `domains/ec2/instance/state` with no `daemon` import.
+- `domains/elbv2/{agent_types,haproxy,health_checker,nginx}.go` import `agents/elbv2` (`HealthReport`, `ServerStatus`, `CertDir`, `NginxPIDPath`, `NginxCertDir`), a domain reading an agent's implementation package rather than a declared wire contract. Removal condition: the health-report and cert/PID-path vocabulary moves behind a guest/controller contract the domain and the agent both consume.
+- `agents/elbv2` (Q-30 data-plane boundary): the agent moved whole, keeping its current dependencies and the `domains/elbv2` import above. Q-30's data-plane boundary and the common agent layout remain deferred by ADR-0001 and are not paid by the move.
+- `domains/ec2/instance/state/imds_readers.go` (dependency, IMDS readers) imports `runtime/daemon` for `LocalState`, `ReadLocalState`, `LocalStatePath`, `NewJetStreamManager` and `InstanceStateBucket`. The local-file reader and the instance-record loader's `JetStreamManager` open, which `vpcd/imds_instance_state.go` held directly, moved here unchanged and are now injected into `vpcd` through `guestmetadata.LocalStateReader` and `guestmetadata.RecordLoader`. The readers already live in `domains/ec2/instance/state`. Removal condition: the legacy dependencies they call are extracted from `daemon` — `LocalStatePath`, `ReadLocalState` and `LocalState`, the instance bucket constants, and `JetStreamManager` with its bucket initialisation (`InitKVBucket`) — leaving `domains/ec2/instance/state` with no `daemon` import.
 - Advisory: 27 production files across `domains/{acm,dns,ec2/*,network/host,network/ovn,ochre}` import `bootstrap/config` directly rather than through typed constructor inputs, which ADR-0001's `config` row expects. `bootstrap/preflight/preflight.go:15` imports `runtime/host/command` and `services.go:13` imports `operator/host/systemd`; both are expected bootstrap-to-runtime/operator edges for startup validation and are not domain-rule violations.
 - Operator bootstrap credential generation: `operator/cli/admin.go` mints the bootstrap admin and Northstar access keys and secrets directly with `awscredentials` and writes them into config, rather than asking an IAM bootstrap capability to issue them. `awscredentials` only formats the values. Removal condition: a real IAM bootstrap capability issues these credentials and `operator/cli` calls it.
 - `domains/dns`: imports `runtime/compute/vm` (domain-to-runtime), `domains/network/reconcile` for the reconcile lock and `bootstrap/config` for node configuration.
 - ACM: the IAM AES-GCM helper import (ACM relocation residual).
 - `runtime/roles/awsgw`: the quota reconcile loop belongs to `domains/admission/quota`, and the EKS token-verify responder belongs with STS or EKS identity.
- `runtime/roles/awsgw` → `handlers/elbv2` (inherited from `gateway/tagging`): this is a new physical import in AWSGW that inherits the former `gateway/tagging` dependency, because the `elbv2Lister` adapter builds its client with `handlers_elbv2.NewNATSELBv2Service` and calls the `ELBv2Service` interface. It is permitted temporarily because AWSGW is the composition root, which may wire legacy packages, so the layering test needs no allowlist row. Removal condition: it must clear when ELBv2 exposes a domain-owned boundary (its NATS client or contract under its domain owner) and the adapter consumes that instead.
+- `runtime/roles/awsgw` → `domains/elbv2` (inherited from `gateway/tagging`): this is a new physical import in AWSGW that inherits the former `gateway/tagging` dependency, because the `elbv2Lister` adapter builds its client with `elbv2domain.NewNATSELBv2Service` and calls the `ELBv2Service` interface. AWSGW is the composition root, so the layering test needs no allowlist row. Removal condition: it must clear when ELBv2 exposes a domain-owned boundary (its NATS client or contract under its domain owner) and the adapter consumes that instead.
 - `runtime/roles/vpcd` (placement): the role still mixes process/role supervision with network-controller responsibilities. `lease_reaper.go` (orphaned external-pool DHCP lease sweep), `ovn_controller_watchdog.go` (OVN controller liveness and restart), `host_eip_loop.go` (host-EIP reconcile loop) and `lease_datapath_reconcile.go` (lease datapath reconcile) are periodic network-control loops, not role wiring; `vpcd.go` itself also carries bridge-mode detection and verification, chassis-list parsing, external-CIDR resolution, DHCP manager startup and lease/IP-change handling, and gateway/host-EIP allocator and neighbour flush/prime construction alongside `Service.Start`. The future placement question is whether these belong in `domains/network`. Removal condition: an accepted decision on network-controller placement, and extraction of those loops and helpers behind the role.
 - ECR control-plane registration: `awsapi.Deps.NATS` is a raw `*nats.Conn`, not a narrow capability. Every NATS-backed `Handler` passes it to `domains/ecr.NewNATSMetaStore`, which calls `natsmsg.NATSRequest`, so narrowing it means changing the exported `Handler` type, every handler and the meta store; it must not be broadened further meanwhile.
 - ACM control-plane registration: `domains/acm/awsapi.Deps.NATS` (`registration.go`) is likewise a raw `*nats.Conn` carried by every `Handler`, for the same reason; it must not be broadened further meanwhile.
@@ -448,7 +452,7 @@ These residuals were recorded by individual slices and must be resolved once the
 - `operator/installer/firstboot` (security): `Config.InstallCallback` is rendered into `spinifex-firstboot.sh`, which is world-readable (0755). The field is currently unused (`fireInstallCallback` reads `SPINIFEX_INSTALL_CALLBACK` from the environment instead), but any future wiring must not place secrets or tokenised callback URLs in the generated script; sensitive callback credentials should reach first boot through a protected channel such as a 0600 file or a credential store.
 - `operator/cli` (known security risk): `spx admin join` contacts the formation server with `InsecureSkipVerify`, sends the join token as a bearer credential and receives the cluster CA certificate and key, master key, Viperblock key and shared credentials, so an on-path attacker during formation can capture the token and the cluster root secrets or substitute a CA. This predates the move; lint surfaced it when the tree left `cmd/`. It is accepted for now and carries a line-level gosec annotation stating it is not a false positive. Removal condition: authenticate formation TLS with a pinned key or certificate delivered with the join material, or an out-of-band CA, with tests proving a mismatched server certificate fails before credentials are sent.
 - `domains/eks/cluster` (potential security risk): `ClusterMeta.ControlPlaneTemplate` (`domains/eks/cluster/service_impl.go`) clears the template's credentials but keeps `OIDCPrivateKeyPEM` and the k3s `JoinToken`, so both are persisted in the `eks-account-{acct}` cluster record, which the gateway also reads. Whether that record is encrypted at rest is unconfirmed; if it is not, a reader of the bucket can forge service-account tokens for the cluster's OIDC issuer and join nodes to it. This predates the refactor and is not fixed in it. Removal condition: the key and token are held by a dedicated secret store (a future KMS or Secrets Manager capability is the likely owner) and the cluster record keeps only a reference, with a test proving the persisted record contains neither secret.
- `operator/cli` (dependency): the command tree still imports domain and service implementations directly (`handlers/{iam,eks}`, `domains/admission/quota`, `gateway`, `domains/ochre`, `daemon`, `vpcd`, `accountteardown`, the Viperblock adapter and runtime roles). The ADR's `cmd/spinifex` current-to-target map row requires command packages to reach domains through public capabilities; splitting supported use cases into `operator/*` packages is later work.
+- `operator/cli` (dependency): the command tree still imports domain and service implementations directly (`handlers/{iam,eks}`, `domains/admission/quota`, `gateway`, `domains/ochre`, `vpcd`, `accountteardown`, the Viperblock adapter and runtime roles). The ADR's `cmd/spinifex` current-to-target map row requires command packages to reach domains through public capabilities; splitting supported use cases into `operator/*` packages is later work.
 - `providers/ebs/viperblock` → `runtime/compute/nbd` and `runtime/host/process` (dependency, moved unchanged from `services/viperblockd`): the adapter formats NBD endpoints and manages nbdkit processes through runtime packages. ADR-0001 does not list providers → runtime as forbidden and the layering test does not enforce it (same category as `providers/ebs/conformance` → `runtime/compute/nbd`), but a provider should not depend on node runtime. Clears when NBD endpoint naming has a provider-facing home (a candidate for `contracts/ebs/v1`) and process supervision is injected by the role. The adapter also imports `providers/objectstore`, a provider-to-provider edge that is allowed.
 - `gateway/ec2.go` (registration): the EC2 dispatch map stays a `GatewayConfig` method in `gateway` and imports every `domains/ec2/awsapi/*` package; `gateway/ec2_idempotency.go` also imports `domains/ec2/awsapi/idem` (`KVBucket`, `TTL`, `TokenAndParams`) for the dispatch-time idempotency wrapper. ADR-0001 makes the domain own its action registration; moving the map waits on the generic ingress registration seam and must not be done as a package move.
 - `gateway` (service registration): the root `gateway` dispatch for IAM, STS, EKS and RDS imports `domains/{iam,sts,eks,rds}/awsapi`, which only AWSGW may wire. It clears when each service registers through the ADR-0002 ingress registration seam; as with EC2, moving the dispatch must not be done as a package move.
@@ -457,7 +461,8 @@ These residuals were recorded by individual slices and must be resolved once the
 - `domains/admission/quota` (dependency, moved from `handlers/quota` unchanged): `live.go` imports `gateway/elbv2` and `domains/rds/instance` for its live ELBv2 and RDS counters; `records.go` imports `runtime/compute/vm` for the instance-record vCPU sweep; `live.go`, `vcpu.go` and `storage.go` call `domains/ec2/awsapi/{vpc,eip,volume}` describe adapters to count VPCs, subnets, addresses and volumes, as they did under `gateway/ec2`. The ADR's `handlers/quota` current-to-target map row replaces these with reader capabilities once their final locations exist.
 - `domains/ec2/awsapi/instance` (dependency): imports `domains/iam` (`IAMService` in `DescribeInstances.go`, `RunInstances.go` and `IamInstanceProfileAssociation.go`; `InstanceProfile` in the latter two), `runtime/compute/cache` (`NodeState`, `NodeUnknown`, `NodeLive`) and `runtime/compute/vm` (`VM`), both in `status_synthesis.go`. The IAM edge needs an IAM capability; the runtime edges are domain-to-runtime and need the instance record and node liveness exposed through an EC2-owned projection.
 - `domains/ec2/awsapi/spotinstance` (dependency): imports `domains/iam.IAMService` and `domains/admission/quota.Service` in `RequestSpotInstances.go`.
- Instance adapter consumers outside EC2: `domains/rds/awsapi/enginecatalog.go`, `daemon/eks_cp_control.go`, `daemon/rds_deps.go`, `domains/admission/quota`'s `vcpu.go` and `gateway/iam.go` (`CountInstanceProfileAssociations`) call `domains/ec2/awsapi/instance` directly; each needs an EC2 capability rather than the AWS action adapter.
+- Instance adapter consumers outside EC2: `domains/rds/awsapi/enginecatalog.go`, `runtime/daemon/eks_cp_control.go`, `runtime/daemon/rds_deps.go`, `domains/admission/quota`'s `vcpu.go` and `gateway/iam.go` (`CountInstanceProfileAssociations`) call `domains/ec2/awsapi/instance` directly; each needs an EC2 capability rather than the AWS action adapter.
+- `runtime/daemon` (Q-28 ownership and deployment): the daemon moved whole, keeping its current ownership, deployment and `daemon → gateway → handlers` dependencies. Q-28's write-side consolidation and any daemon decomposition or split remain deferred by ADR-0001 and are not paid by the move.

 Enforcement: the owner decided the layering test is blocking now, with a ratchet. Its allowlist mirrors this debt list exactly, each edge carrying its owner and removal condition; any new unrecorded forbidden edge fails local preflight and CI, and an allowlisted edge that no longer exists must be removed from the list.
 - `domains/rds/instance` → `domains/rds/subnetgroup` (legacy edges): `instanceReferences` binds `Dependants` by scanning instance records, and `tags.go` writes the group record through its generic tag registry. The first clears when the RDS instance gains its own owner and answers `Dependants` from it. The second clears when tagging invokes a subnet-group-owned tag/untag capability rather than writing the record; moving the tagging adapter to `domains/rds/awsapi` alone does not clear it.
@@ -470,8 +475,8 @@ Enforcement: the owner decided the layering test is blocking now, with a ratchet
 - `agents/rds/agent` (dependency, narrowed): engine metadata now arrives through the agent-declared `EngineCatalog`, but the agent still imports `domains/rds/instance` for the command protocol, wire and record types (`Command*`, `Parameter`, `EngineHealth*`, `BootstrapMode*`) and API output types. This clears when those move behind a guest/controller wire contract.
 - `domains/rds/awsapi` → `domains/rds/instance` (`InstanceSizing`): the gateway obtains its `Sizing` through the RDS handler package's adapter rather than its own composition root. This clears when the gateway's RDS composition moves to `runtime/roles/awsgw` and builds `Sizing` there.
 - `domains/admission/quota` → `domains/ec2/instancetypes`: `reconcile.go`, `records.go` and `vcpu.go` read `DefaultVCPUs` to size instances without a recorded vCPU count. This clears when quota receives vCPU sizing through a consumer-owned capability or an EC2 projection.
- IAM implementation consumers in STS, Ochre and ELBv2: `domains/sts` imports `domains/iam` across five files (`IAMService`, `SessionRevoker`, `EncryptSecret`/`DecryptSecret`, `AccessKeyStatusActive`, `ValidateTrustPolicyDocument`, `PolicyEffectAllow`/`PolicyEffectDeny`, `IAMAccountBucketName`, `OIDCProviderARN`, `OIDCProviderKey`), not only `oidc_jwks.go`; `domains/sts/awsapi/GetCallerIdentity.go` takes `IAMService`; `domains/ochre/credentials.go` uses `EncryptSecret`/`DecryptSecret`; and `handlers/elbv2/{lb_role,service_impl}.go` use `EnsureSystemInstanceProfile` and `SystemInstanceRoleEnsurer`. Each clears when its consumer receives a narrow IAM capability, or a shared crypto boundary for the secret helpers, rather than importing the IAM implementation.
- `handlers/elbv2` (cross-domain): `service_impl.go` imports `domains/acm` (`Store`, `NewStore`), `domains/dns` (`ELBChanges`, `ELBName`, `Change`, `ActionUpsert`, `ResolveBaseDomain`), `domains/ec2/vpc` (`VPCServiceImpl`) and `domains/network/topology` (`Port`), and `launcher.go` re-exports `domains/ec2/systeminstance` launch types as aliases. These clear when ELBv2 is extracted and each edge becomes a consumer-owned capability, which ADR-0001 sequences after the ELBv2 data-plane boundary is settled.
+- IAM implementation consumers in STS, Ochre and ELBv2: `domains/sts` imports `domains/iam` across five files (`IAMService`, `SessionRevoker`, `EncryptSecret`/`DecryptSecret`, `AccessKeyStatusActive`, `ValidateTrustPolicyDocument`, `PolicyEffectAllow`/`PolicyEffectDeny`, `IAMAccountBucketName`, `OIDCProviderARN`, `OIDCProviderKey`), not only `oidc_jwks.go`; `domains/sts/awsapi/GetCallerIdentity.go` takes `IAMService`; `domains/ochre/credentials.go` uses `EncryptSecret`/`DecryptSecret`; and `domains/elbv2/{lb_role,service_impl}.go` use `EnsureSystemInstanceProfile` and `SystemInstanceRoleEnsurer`. Each clears when its consumer receives a narrow IAM capability, or a shared crypto boundary for the secret helpers, rather than importing the IAM implementation.
+- `domains/elbv2` (cross-domain): `service_impl.go` imports `domains/acm` (`Store`, `NewStore`), `domains/dns` (`ELBChanges`, `ELBName`, `Change`, `ActionUpsert`, `ResolveBaseDomain`), `domains/ec2/vpc` (`VPCServiceImpl`) and `domains/network/topology` (`Port`), and `launcher.go` re-exports `domains/ec2/systeminstance` launch types as aliases. These clear when each edge becomes a consumer-owned capability.
 - `docs/service-interfaces.yaml` (ECS coverage gap, closed): the traced `ecs.bus.*` family and the ECS AWS-API action subjects are both listed. The action subjects are declared as `ecs.*`, the same wildcard convention as `rds.*`: `handlers/ecs/service_nats.go` publishes them from the gateway and `daemon/daemon.go` subscribes to them. Declaring `ecs.bus.*` alone had made `ecs` a managed prefix, so `manifest-lint` failed CI on all 34 undeclared action subjects until this was added.
 - `contracts/ecs/v1` (dead routes): four of five bus subjects have no producer. The scheduler leader still subscribes to `instance-register`, `instance-heartbeat` and `task-state`, which can never fire, and `assign` has neither producer nor consumer; only `service-reconcile` is live. Removal condition: an owner decision to retire these routes (a successor contract under the compatibility rules) or to adopt them in the agent.

@@ -662,35 +667,35 @@ series above; "needs decision" is open.
 | `handlers/ecs` | Task, service and capacity resources (`taskdefinition` already extracted to `domains/ecs/taskdefinition`). | Deferred: ADR-0004 blocked-dependency list — `iam:PassRole` in the gateway adapter and EC2/ELBv2/EIP adapters called as internal APIs. |
 | `handlers/eks` | — | Done for the relocation: the remaining EKS implementation moved to `domains/eks/cluster` (package `cluster`) in `spinifex#1264` with no API, NATS subject, storage or behaviour change, alongside the already-extracted `access` and `addon` packages. Deferred follow-on: nodegroup service extraction. The nodegroup operations are methods on the shared `EKSServiceImpl` and use its private state, so moving them to their own resource package needs a nodegroup owner and interfaces, which is decomposition work, not a move. The ADR-0004 blocked-dependency imports (IAM role/instance-profile creation, Bluebottle `auth`, the NATS CA, and EKS identity: token review, OIDC) remain dependency-rule debt, with their allowlist entries now sourced from `domains/eks/cluster`. |
 | `handlers/rds` | — | Done. The remaining RDS instance resource moved to `domains/rds/instance` (package `instance`) in `spinifex#1251` with no API, NATS subject, storage or behaviour change, fulfilling ADR-0001's organise-by-resource condition alongside the already-extracted subnet group, parameter group and engine catalogue. The ADR-0004 blocked-dependency imports (quota admission, the duplicated expected-node fan-out, the IAM ensurer and the Bluebottle master key) remain dependency-rule debt, with their allowlist entries now sourced from `domains/rds/instance`. |
-| `handlers/elbv2` | Everything; not yet touched. | Deferred: ADR-0001 sequences this after the ELBv2 data-plane boundary is settled. Needs decision: what evidence establishes that boundary is settled. |
+| `handlers/elbv2` | — | Done. The implementation moved to `domains/elbv2` (package `elbv2`) with no API, NATS subject, storage or behaviour change. Q-30's data-plane boundary remains deferred debt; the amended ADR-0001 row makes it not a relocation prerequisite. Its cross-domain, IAM and `agents/elbv2` imports remain dependency-rule debt, with their allowlist entries now sourced from `domains/elbv2`. |
 | `handlers/iam/mock` | — | Done. Moved with the implementation to `domains/iam/mock`. |
 | `gateway` (root) | Generic HTTP route assembly, SigV4/registry authentication, the policy gate, request-audit middleware, request-context keys, and the legacy per-service dispatch switch for every service not yet registered. | Deferred: the ADR-0002 phases above (auth/IAM and request-context boundary design) gate moving the audit, context-key and legacy-dispatch mechanics. |
 | `gateway/bedrock` | — | Done. The whole package moved into `domains/ochre` in `spinifex#1266` with its package-private core and tests intact and no behaviour change. Separating the action adapters into `domains/ochre/awsapi` remains deferred, recorded as `domains/ochre` (action adapters) debt above. |
 | `gateway/{iam,sts,eks,rds}` | — | Done. The action adapters moved to `domains/{iam,sts,eks,rds}/awsapi` in `spinifex#1265` with no API, NATS subject, storage or behaviour change. ADR-0001 does not make ADR-0002 registration a prerequisite for relocating a domain's adapters, as the EC2 adapter moves already showed; the root `gateway` dispatch that still imports them is recorded `gateway` (service registration) debt. |
-| `gateway/{ecs,elbv2}` | Each service's AWS action adapters and dispatch, not yet registered through ADR-0002. | Deferred: each follows its `handlers/<svc>`, because a new-path `awsapi` cannot import a legacy handler. |
+| `gateway/ecs` | The ECS AWS action adapters and dispatch, not yet registered through ADR-0002. | Deferred: it follows `handlers/ecs`, because a new-path `awsapi` cannot import a legacy handler. |
+| `gateway/elbv2` | The ELBv2 AWS action adapters and dispatch, not yet registered through ADR-0002. | Not moved. Its handler is now `domains/elbv2`, so the follows-its-handler blocker no longer applies. |
 | `gateway/spx` | `promote_image.go` and `spx.go` dispatch (`storage.go` already consumes `contracts/operator/v1`). | Needs decision: which package owns operator-plane action dispatch registration — an `ingress/aws`-style seam for the operator plane, or `gateway` stays its home. |
 | `gateway/tagging` | — | Done. `domains/tagging` owns the read-only cross-resource `GetResources` aggregation and its API semantics (`0d830e901`, `aedd0b2c4`); AWSGW composes the owner listers, the EC2 tag index and ELBv2 (`f3545e3ea`); the root `gateway` keeps only the legacy dispatch in `gateway/tagging.go`. The package is removed, and its two allowlist rows and frozen-legacy entry are gone. Owner tag mutation capabilities remain future direction, so the RDS and ECS tag-writing edges above stay open. |
 | `services/viperblockd` | — | Done. The adapter is `providers/ebs/viperblock` (with the read-only `dirty` reader), the shared vocabulary is `contracts/viperblockd/legacy/v1`, and the role is `runtime/roles/viperblockd`. `services/` is empty. |
 | `utils` | — | Done and deleted. `ec2_subject.go` went to `contracts/ec2/v1`, the vpcd protocol to `contracts/network/v1` with the typed client in `domains/network/projection`, and the master-key loader to `domains/ec2/ebs/encryption`. |
 | `vpcd` | — | Done. The IMDS local-file reader and record-space opener moved to `domains/ec2/instance/state` and are injected through `guestmetadata.LocalStateReader`/`RecordLoader` (recorded above), so `vpcd` no longer imports `daemon` directly; its inter-process boundary now exists (`contracts/network/v1`, with `domains/network/subscribers` as the consumer and `domains/network/projection` as the producer client). The package moved unchanged to `runtime/roles/vpcd` (recorded below), and the legacy directory is removed. |
-| `daemon` | Reserved as `runtime/daemon`'s home only; not split or moved. | Deferred: Q-28's write-side consolidation is a prerequisite ADR-0001 names explicitly. |
+| `daemon` | `runtime/daemon` (whole-package move, above) | Done. Q-28's ownership and deployment refactor remains deferred debt; the amended ADR-0001 row makes it not a relocation prerequisite. |
 | `admin` | — | Done and deleted. The operator use cases moved to `operator/admin`, image promotion to `domains/ec2/image`, the bootstrap account identifiers to `foundation/aws/identifiers`, and the credential-format generators to `foundation/aws/credentials` (recorded above). Operator bootstrap's direct credential generation stays recorded as debt. |
 | `accountteardown` | The whole package, a frozen legacy root. Its direct cleanup calls into `domains/ec2/awsapi/*` action adapters, other domain and handler services, the object-store provider, raw NATS subjects and a raw KV bucket stay as recorded debt. | Assessed for relocation and not moved. ADR-0001's `accountteardown` row requires conversion to domain-owned cleanup capabilities before moving, and ADR-0008 does not authorise a mechanical rename. It remains a legacy root until its direct cleanup calls are converted to domain-owned capabilities; its destination after that conversion is `operator/accountlifecycle`. |
-| `lbagent` | The whole package; `handlers/elbv2` imports it as a domain-to-agent implementation edge (recorded above). | Deferred: Q-30 reserves `agents/elbv2` as its destination but forbids moving it as an isolated rename ahead of the common-agent design. |
+| `lbagent` | `agents/elbv2` (whole-package move, above) | Done. Q-30's data-plane boundary remains deferred debt; the amended ADR-0001 row makes it not a relocation prerequisite. The `domains/elbv2` import stays recorded debt. |
 | `migrate` | Nothing at the old path. | Split, not an exact ADR row: ADR-0001 maps `migrate` to `foundation/state/migrate`, but the package held two responsibilities. The KV migration engine and its tests are in `foundation/state/migrate` (`8cd9cff75`); the config-file and object-store upgrade workflow moved to `operator/upgrade` (`919d5bfa6`) by owner decision. Needs an ADR-0001 map clarification before this row can be claimed as target conformance. |

 ### Remaining legacy roots by blocker class

-Five legacy roots remain: `accountteardown`, `daemon`, `gateway`, `handlers` and `lbagent`.
+Three legacy roots remain: `accountteardown`, `gateway` and `handlers`.
 The rows above give each path's blocker; this summary groups them so a deferral is not mistaken for unfinished mechanical work.
 ADR-0001 completion is structural, so none of these is cleared by remediating service lifecycle behaviour.

 | Class | Paths | Status |
 |---|---|---|
-| Explicitly deferred by ADR-0001 | `daemon` (Q-28), `lbagent` (Q-30) | Closed for this refactor; the ADR names the prerequisite. |
 | No missing boundary (candidate moves) | `handlers/ecs/bus` → `contracts/ecs/v1` (`a130f6b8e`); `admin/images_promote.go` → `domains/ec2/image` (`263c58167`); `admin` bootstrap account identifiers → `foundation/aws/identifiers` (`3fdaa54d9`); `admin` credential-format generators → `foundation/aws/credentials` `0368e861a`, retiring `admin` | Done. |
 | One narrow missing boundary | Done: `handlers/sts` EKS JWKS lookup → `handlers/eks` `ClusterJWKSResolver` (`254d898a3`); `gateway/tagging` → `domains/tagging` with AWSGW-composed listers (`0d830e901`, `f3545e3ea`, `aedd0b2c4`). Open: `gateway/spx` (owner of operator-plane dispatch registration) | Each needs one decision or one capability, then a mechanical move. |
-| Broader boundary or follows another package | `handlers/{ecs,eks,rds}` (ADR-0004 blocked-dependency lists); `handlers/elbv2` (data-plane boundary evidence); `accountteardown` (domain cleanup capabilities); `gateway` root (ADR-0002 auth and request-context phase); `gateway/{ecs,elbv2}` (each follows its `handlers/<svc>`, because a new-path `awsapi` cannot import a legacy handler) | Recorded debt with removal conditions above. |
+| Broader boundary or follows another package | `handlers/{ecs,eks,rds}` (ADR-0004 blocked-dependency lists); `accountteardown` (domain cleanup capabilities); `gateway` root (ADR-0002 auth and request-context phase); `gateway/ecs` (follows `handlers/ecs`, because a new-path `awsapi` cannot import a legacy handler) | Recorded debt with removal conditions above. |

 Per-consumer IAM capabilities are the widest unblocker: they gate STS's IAM reads, Ochre's IAM reads, the ELBv2 role path and the ECS, EKS and RDS ensurers.

@@ -50,13 +50,13 @@ services:
    # Translates VPC / EBS / S3 operations into vpc.* / ebs.* / s3.* and
    # forwards to vpcd / viperblockd / predastore.
    #
-    # Source layout: spinifex/runtime/roles/spinifex (entry), spinifex/daemon
+    # Source layout: spinifex/runtime/roles/spinifex (entry), spinifex/runtime/daemon
    # (subscribe registration), spinifex/domains/<domain> and the legacy
    # spinifex/handlers/{ecs,eks,elbv2,iam,rds} packages (per-subject handler
    # bodies). Selector treats these paths as belonging to this service via
    # the `additional_paths` field.
    additional_paths:
-      - spinifex/daemon
+      - spinifex/runtime/daemon
      - spinifex/domains/ec2/account
      - spinifex/domains/ec2/eigw
      - spinifex/domains/ec2/eip
@@ -74,7 +74,7 @@ services:
      - spinifex/domains/ec2/volume
      - spinifex/domains/ec2/volumestate
      - spinifex/domains/ec2/vpc
-      - spinifex/handlers/elbv2
+      - spinifex/domains/elbv2
      - spinifex/domains/acm
      - spinifex/domains/iam
      - spinifex/handlers/ecs
@@ -136,7 +136,7 @@ services:
      - "spinifex.cluster.shutdown.infra"
      # Operator-plane Predastore topology contract (contracts/operator/v1).
      - "spinifex.storage.config"
-      # ELBv2 control plane (handlers/elbv2/service_nats.go topic map).
+      # ELBv2 control plane (domains/elbv2/service_nats.go topic map).
      - "elbv2.CreateLoadBalancer"
      - "elbv2.DeleteLoadBalancer"
      - "elbv2.DescribeLoadBalancers"
@@ -403,7 +403,7 @@ suites:
  e2e-lb:
    path: tests/e2e/lb
    covers: [awsgw, spinifex_daemon, vpcd, viperblockd, predastore]
-    # Exercises full ELBv2 control plane (handlers/elbv2) + data plane
+    # Exercises full ELBv2 control plane (domains/elbv2) + data plane
    # (LB agent on the system VM). ELBv2 is part of spinifex_daemon in
    # this manifest; revisit if it splits into a standalone service.

@@ -5,7 +5,7 @@ import (

 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elbv2"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -15,7 +15,7 @@ import (
 // groups, so it has to go before either can be deleted. Target groups follow
 // their balancers because a group still referenced by a listener refuses.
 func ELBv2Reapers(nc *nats.Conn) []Reaper {
-	svc := handlers_elbv2.NewNATSELBv2Service(nc)
+	svc := elbv2domain.NewNATSELBv2Service(nc)
 	return []Reaper{
 		&loadBalancerReaper{svc: svc},
 		&targetGroupReaper{svc: svc},
@@ -23,7 +23,7 @@ func ELBv2Reapers(nc *nats.Conn) []Reaper {
 }

 type loadBalancerReaper struct {
-	svc handlers_elbv2.ELBv2Service
+	svc elbv2domain.ELBv2Service
 }

 func (r *loadBalancerReaper) Kind() string { return "load-balancer" }
@@ -58,7 +58,7 @@ func (r *loadBalancerReaper) Delete(ctx context.Context, accountID string, resou
 }

 type targetGroupReaper struct {
-	svc handlers_elbv2.ELBv2Service
+	svc elbv2domain.ELBv2Service
 }

 func (r *targetGroupReaper) Kind() string { return "target-group" }
@@ -10,7 +10,7 @@ import (

 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elbv2"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -18,7 +18,7 @@ import (
 // The embedded interface is nil, so a reaper reaching for anything beyond the
 // four methods below panics rather than passing.
 type fakeELBv2 struct {
-	handlers_elbv2.ELBv2Service
+	elbv2domain.ELBv2Service

 	loadBalancers []*elbv2.LoadBalancer
 	targetGroups  []*elbv2.TargetGroup
@@ -1,7 +1,7 @@
-// Package lbagent implements the LB config agent that runs inside load balancer VMs.
+// Package elbv2 implements the LB config agent that runs inside load balancer VMs.
 // It polls the AWS gateway for config updates and reports health via heartbeats.
 // All communication uses SigV4-signed HTTP requests to the gateway.
-package lbagent
+package elbv2

 import (
 	"bytes"
@@ -57,7 +57,7 @@ const (
 	registrationGrace = 60 * time.Second
 )

-// Data-plane engine names (duplicated from handlers/elbv2 to avoid an import cycle).
+// Data-plane engine names (duplicated from domains/elbv2 to avoid an import cycle).
 const (
 	EngineHAProxy = "haproxy"
 	EngineNginx   = "nginx"
@@ -1,4 +1,4 @@
-package lbagent
+package elbv2

 import (
 	"os"
@@ -1,4 +1,4 @@
-package lbagent
+package elbv2

 import (
 	"bytes"
@@ -1,4 +1,4 @@
-package lbagent
+package elbv2

 import (
 	"bufio"
@@ -1,4 +1,4 @@
-package lbagent
+package elbv2

 import (
 	"fmt"
@@ -1,4 +1,4 @@
-package lbagent
+package elbv2

 import (
 	"crypto/tls"
@@ -1,4 +1,4 @@
-package lbagent
+package elbv2

 import (
 	"net"
@@ -82,7 +82,7 @@ type ACMServiceImpl struct {
 	// SAN) by deriveValidationMode. Wired by the daemon post-construction
 	// (mirroring CertMaterialUpdated below) to domains/dns.HostsZone. A func
 	// field stands in for a direct import of domains/dns, the same pattern
-	// CertMaterialUpdated uses for handlers/elbv2, so this package and its
+	// CertMaterialUpdated uses for domains/elbv2, so this package and its
 	// tests stay decoupled from domains/dns's S3/northstar-config
 	// dependencies. Nil means "northstar hosts nothing" — the safe default for
 	// tests and any deployment that never wires it, so an unwired service can
@@ -91,7 +91,7 @@ type ACMServiceImpl struct {

 	// CertMaterialUpdated, when set, is invoked after new certificate material
 	// is written under an existing ARN so the caller can re-render every load
-	// balancer that references it (see handlers/elbv2.UpdateStoredConfigForCert).
+	// balancer that references it (see domains/elbv2.UpdateStoredConfigForCert).
 	// Wired by the daemon post-construction to avoid an elbv2 -> acm import
 	// cycle; nil-safe — skipped in tests and whenever ELBv2 isn't wired up.
 	// Fan-out errors are logged, never propagated: a rendering problem on one
@@ -106,7 +106,7 @@ type CertRecord struct {
 	ImportedAt       time.Time         `json:"imported_at"`
 	Tags             map[string]string `json:"tags,omitempty"`
 	// InUseBy is the set of load balancer ARNs whose listeners currently
-	// reference this certificate. Maintained by handlers/elbv2 as listeners are
+	// reference this certificate. Maintained by domains/elbv2 as listeners are
 	// created, modified and deleted; also surfaces as the public
 	// CertificateDetail.InUseBy field.
 	InUseBy []string `json:"in_use_by,omitempty"`
@@ -443,7 +443,7 @@ const maxInUseByCASAttempts = 50
 // No-op if the certificate does not exist or already lists resourceArn.
 //
 // InUseBy is the sole mechanism by which a re-imported certificate reaches
-// the data plane (see UpdateStoredConfigForCert in handlers/elbv2), so a lost
+// the data plane (see UpdateStoredConfigForCert in domains/elbv2), so a lost
 // update here is not a cosmetic race: it silently drops a load balancer from
 // fan-out, and that load balancer's certificate expires in HAProxy while ACM
 // still reports it as renewed. Two listeners on different load balancers can
@@ -2918,7 +2918,7 @@ func (s *InstanceServiceImpl) deleteInstanceVolumes(ctx context.Context, instanc
 		}
 		// Terminate implies detach: DeleteVolumeOnTerminate clears the stale
 		// AttachedInstance left over from Stop (Unmount deliberately never
-		// clears a Boot volume, daemon/vm_adapters.go) before deleting, so
+		// clears a Boot volume, runtime/daemon/vm_adapters.go) before deleting, so
 		// DeleteVolume's in-use guard does not reject an otherwise-legitimate
 		// delete. The resulting error is surfaced into lastErr, not swallowed.
 		if err := s.volumeDeleter.DeleteVolumeOnTerminate(ctx, ebsRequest.Name, instance.AccountID); err != nil {
@@ -2034,7 +2034,7 @@ func TestTerminateStoppedInstance_StampsTeardownVolumesFailedOnDeleteError(t *te

 // TestTerminateStoppedInstance_NonDoTBootVolumeDetachedNotDeleted locks the
 // second half of the terminate-implies-detach fix: a DeleteOnTermination=false
-// Boot volume is never cleared by Stop's Unmount (daemon/vm_adapters.go), so
+// Boot volume is never cleared by Stop's Unmount (runtime/daemon/vm_adapters.go), so
 // without this it would strand attached to the now-gone instance forever.
 // Terminate must still detach it (AWS semantics: it survives as available,
 // it just isn't deleted).
@@ -1,8 +1,8 @@
 package state

 import (
-	"github.com/mulgadc/spinifex/spinifex/daemon"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
+	"github.com/mulgadc/spinifex/spinifex/runtime/daemon"
 )

 // LocalVMReaderForTest is the local instance state reader's consumer-facing
@@ -10,10 +10,10 @@ import (
 	"sync"
 	"time"

-	"github.com/mulgadc/spinifex/spinifex/daemon"
 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/guestmetadata"
 	"github.com/mulgadc/spinifex/spinifex/foundation/state/kvstore"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
+	"github.com/mulgadc/spinifex/spinifex/runtime/daemon"
 	"github.com/nats-io/nats.go"
 )

@@ -4,9 +4,9 @@ import (
 	"os"
 	"testing"

-	"github.com/mulgadc/spinifex/spinifex/daemon"
 	"github.com/mulgadc/spinifex/spinifex/domains/ec2/instance/state"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
+	"github.com/mulgadc/spinifex/spinifex/runtime/daemon"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -382,7 +382,7 @@ func volumeAttachment(ctx context.Context, store objectstore.ObjectStore, bucket
 // volume-to-node resolution is needed here.
 //
 // An attachment record is not proof of a live writer: stop deliberately leaves
-// a boot volume attached (daemon/vm_adapters.go's volumeMounterAdapter.Unmount)
+// a boot volume attached (runtime/daemon/vm_adapters.go's volumeMounterAdapter.Unmount)
 // while tearing down both the NBD plugin and this subscription. The two
 // not-running signals below are therefore the stopped-instance path, not a
 // failure — treating them as one would make every stopped instance's root
@@ -130,7 +130,7 @@ func TestDeleteVolume_CrossAccountDocumentIsStillNotFound(t *testing.T) {
 // UpdateVolumeState succeeds, but the document goes unreadable before
 // DeleteVolume's own read of the same key. That read failure must come back
 // as a non-NotFound error, which is exactly the signal
-// daemon/vm_adapters.go's DeleteVolumes and instance/service_impl.go's
+// runtime/daemon/vm_adapters.go's DeleteVolumes and instance/service_impl.go's
 // deleteInstanceVolumes use to tell a real failure from an already-gone
 // volume (!awserrors.IsNotFound(err) && !objectstore.IsNoSuchKeyError(err)).
 func TestDeleteVolumeOnTerminate_DeleteReadFailureIsNotSuccess(t *testing.T) {
@@ -1742,7 +1742,7 @@ func TestDeleteVolume_EmptyStateUnattachedDeletable(t *testing.T) {
 // TestDeleteVolumeOnTerminate_ClearsAttachmentThenDeletes locks the
 // A DeleteOnTermination root volume left attached to a
 // stopped instance (Stop's Unmount deliberately never clears a Boot volume's
-// AttachedInstance, daemon/vm_adapters.go) hits DeleteVolume's in-use guard
+// AttachedInstance, runtime/daemon/vm_adapters.go) hits DeleteVolume's in-use guard
 // directly — see TestDeleteVolume_VolumeAttachedButAvailable above.
 // DeleteVolumeOnTerminate must clear the stale attachment first (terminate
 // implies detach) so the terminate delete actually succeeds instead of
@@ -1,8 +1,8 @@
-package handlers_elbv2
+package elbv2

 import (
 	"github.com/aws/aws-sdk-go/aws"
-	"github.com/mulgadc/spinifex/spinifex/lbagent"
+	lbagent "github.com/mulgadc/spinifex/spinifex/agents/elbv2"
 )

 // LBAgentHeartbeatInput is sent by the LB agent on each heartbeat tick,
@@ -1,10 +1,10 @@
-package handlers_elbv2
+package elbv2

 import (
 	"testing"

 	"github.com/aws/aws-sdk-go/aws"
-	"github.com/mulgadc/spinifex/spinifex/lbagent"
+	lbagent "github.com/mulgadc/spinifex/spinifex/agents/elbv2"
 	"github.com/stretchr/testify/assert"
 )

@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"testing"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"fmt"
@@ -9,7 +9,7 @@ import (
 	"strings"
 	"text/template"

-	"github.com/mulgadc/spinifex/spinifex/lbagent"
+	lbagent "github.com/mulgadc/spinifex/spinifex/agents/elbv2"
 )

 // All interpolated fields are regex-validated at the input boundary.
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -14,11 +14,11 @@ import (

 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/mulgadc/spinifex/internal/testkit"
+	lbagent "github.com/mulgadc/spinifex/spinifex/agents/elbv2"
 	acmdomain "github.com/mulgadc/spinifex/spinifex/domains/acm"
 	iamdomain "github.com/mulgadc/spinifex/spinifex/domains/iam"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
 	awsxml "github.com/mulgadc/spinifex/spinifex/foundation/aws/xml"
-	"github.com/mulgadc/spinifex/spinifex/lbagent"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"strings"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -7,7 +7,7 @@ import (
 	"log/slog"
 	"sync"

-	"github.com/mulgadc/spinifex/spinifex/lbagent"
+	lbagent "github.com/mulgadc/spinifex/spinifex/agents/elbv2"
 )

 // healthChecker processes target health reports from LB agents pushed via
@@ -1,11 +1,11 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
 	"testing"

 	"github.com/mulgadc/spinifex/internal/testkit"
-	"github.com/mulgadc/spinifex/spinifex/lbagent"
+	lbagent "github.com/mulgadc/spinifex/spinifex/agents/elbv2"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import "github.com/mulgadc/spinifex/spinifex/domains/ec2/systeminstance"

@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"sync"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"log/slog"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	awsidentifiers "github.com/mulgadc/spinifex/spinifex/foundation/aws/identifiers"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"crypto/x509"
@@ -10,7 +10,7 @@ import (
 	"strings"
 	"text/template"

-	"github.com/mulgadc/spinifex/spinifex/lbagent"
+	lbagent "github.com/mulgadc/spinifex/spinifex/agents/elbv2"
 )

 // maxDNSNameLen is the longest legal DNS name, so a map key cannot be padded out
@@ -1,10 +1,10 @@
-package handlers_elbv2
+package elbv2

 import (
 	"strings"
 	"testing"

-	"github.com/mulgadc/spinifex/spinifex/lbagent"
+	lbagent "github.com/mulgadc/spinifex/spinifex/agents/elbv2"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,7 +1,7 @@
-// Package handlers_elbv2 implements the ELBv2 actions for application and
+// Package elbv2 implements the ELBv2 actions for application and
 // network load balancers: the daemon-side JetStream KV implementation, its NATS
 // client, and the HAProxy and nginx configs rendered for the LB VMs.
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -6,8 +6,8 @@ import (

 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elbv2"
+	lbagent "github.com/mulgadc/spinifex/spinifex/agents/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	"github.com/mulgadc/spinifex/spinifex/lbagent"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"github.com/aws/aws-sdk-go/aws"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"testing"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"encoding/json"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"encoding/json"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"context"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"maps"
@@ -1,4 +1,4 @@
-package handlers_elbv2
+package elbv2

 import (
 	"testing"
@@ -35,7 +35,7 @@ func TestS6_FederationIsolated(t *testing.T) {

 	roots := []string{
 		filepath.Join(repoRoot(t), "spinifex", "domains", "network"),
-		filepath.Join(repoRoot(t), "spinifex", "daemon"),
+		filepath.Join(repoRoot(t), "spinifex", "runtime", "daemon"),
 		filepath.Join(repoRoot(t), "spinifex", "handlers"),
 	}
 	type hit struct {
@@ -33,7 +33,7 @@ func TestS2_BridgeModeContainedInL0(t *testing.T) {

 	roots := []string{
 		filepath.Join(repoRoot(t), "spinifex", "domains", "network"),
-		filepath.Join(repoRoot(t), "spinifex", "daemon"),
+		filepath.Join(repoRoot(t), "spinifex", "runtime", "daemon"),
 		filepath.Join(repoRoot(t), "spinifex", "runtime", "compute", "vm"),
 	}
 	type hit struct {
@@ -248,7 +248,7 @@ func s4ScanRoots(t *testing.T) []string {
 	return []string{
 		filepath.Join(root, "spinifex", "domains", "network"),
 		filepath.Join(root, "spinifex", "runtime", "roles", "vpcd"),
-		filepath.Join(root, "spinifex", "daemon"),
+		filepath.Join(root, "spinifex", "runtime", "daemon"),
 		filepath.Join(root, "spinifex", "handlers"),
 		filepath.Join(root, "spinifex", "runtime", "compute", "vm"),
 	}
@@ -34,7 +34,7 @@ func TestS3_NATModeInitTimeConstant(t *testing.T) {
 	roots := []string{
 		filepath.Join(repoRoot(t), "spinifex", "domains", "network"),
 		filepath.Join(repoRoot(t), "spinifex", "runtime", "roles", "vpcd"),
-		filepath.Join(repoRoot(t), "spinifex", "daemon"),
+		filepath.Join(repoRoot(t), "spinifex", "runtime", "daemon"),
 	}
 	for _, root := range roots {
 		err := filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
@@ -34,7 +34,7 @@ func TestS7_NATSSubjectsCarryAZPrefix(t *testing.T) {
 	roots := []string{
 		filepath.Join(repoRoot(t), "spinifex", "domains", "network"),
 		filepath.Join(repoRoot(t), "spinifex", "runtime", "roles", "vpcd"),
-		filepath.Join(repoRoot(t), "spinifex", "daemon"),
+		filepath.Join(repoRoot(t), "spinifex", "runtime", "daemon"),
 		filepath.Join(repoRoot(t), "spinifex", "handlers"),
 		filepath.Join(repoRoot(t), "internal", "testkit"),
 		filepath.Join(repoRoot(t), "contracts", "network"),
@@ -7,10 +7,10 @@ import (
 	"net/http"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
 	awsxml "github.com/mulgadc/spinifex/spinifex/foundation/aws/xml"
 	gateway_elbv2 "github.com/mulgadc/spinifex/spinifex/gateway/elbv2"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/ingress/aws/query"
 )

@@ -118,10 +118,10 @@ var elbv2Actions = map[string]elbv2Action{
 	"RemoveTags": elbv2Handler(func(ctx context.Context, input *elbv2.RemoveTagsInput, gw *GatewayConfig, accountID string) (any, error) {
 		return gateway_elbv2.RemoveTags(ctx, input, gw.NATSConn, accountID)
 	}),
-	"LBAgentHeartbeat": elbv2Handler(func(ctx context.Context, input *handlers_elbv2.LBAgentHeartbeatInput, gw *GatewayConfig, accountID string) (any, error) {
+	"LBAgentHeartbeat": elbv2Handler(func(ctx context.Context, input *elbv2domain.LBAgentHeartbeatInput, gw *GatewayConfig, accountID string) (any, error) {
 		return gateway_elbv2.LBAgentHeartbeat(ctx, input, gw.NATSConn, accountID)
 	}),
-	"GetLBConfig": elbv2Handler(func(ctx context.Context, input *handlers_elbv2.GetLBConfigInput, gw *GatewayConfig, accountID string) (any, error) {
+	"GetLBConfig": elbv2Handler(func(ctx context.Context, input *elbv2domain.GetLBConfigInput, gw *GatewayConfig, accountID string) (any, error) {
 		return gateway_elbv2.GetLBConfig(ctx, input, gw.NATSConn, accountID)
 	}),
 	"ModifyTargetGroup": elbv2Handler(func(ctx context.Context, input *elbv2.ModifyTargetGroupInput, gw *GatewayConfig, accountID string) (any, error) {
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -19,7 +19,7 @@ func AddListenerCertificates(ctx context.Context, input *elbv2.AddListenerCertif
 		return output, errors.New(awserrors.ErrorMissingParameter)
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.AddListenerCertificates(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -20,7 +20,7 @@ func AddTags(ctx context.Context, input *elbv2.AddTagsInput, natsConn *nats.Conn
 		return output, errors.New(awserrors.ErrorMissingParameter)
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.AddTags(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -33,7 +33,7 @@ func CreateListener(ctx context.Context, input *elbv2.CreateListenerInput, natsC
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.CreateListener(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -30,7 +30,7 @@ func CreateLoadBalancer(ctx context.Context, input *elbv2.CreateLoadBalancerInpu
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.CreateLoadBalancer(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -39,7 +39,7 @@ func CreateRule(ctx context.Context, input *elbv2.CreateRuleInput, natsConn *nat
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.CreateRule(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -30,7 +30,7 @@ func CreateTargetGroup(ctx context.Context, input *elbv2.CreateTargetGroupInput,
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.CreateTargetGroup(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -30,7 +30,7 @@ func DeleteListener(ctx context.Context, input *elbv2.DeleteListenerInput, natsC
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.DeleteListener(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -30,7 +30,7 @@ func DeleteLoadBalancer(ctx context.Context, input *elbv2.DeleteLoadBalancerInpu
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.DeleteLoadBalancer(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -30,7 +30,7 @@ func DeleteRule(ctx context.Context, input *elbv2.DeleteRuleInput, natsConn *nat
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.DeleteRule(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -30,7 +30,7 @@ func DeleteTargetGroup(ctx context.Context, input *elbv2.DeleteTargetGroupInput,
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.DeleteTargetGroup(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -33,7 +33,7 @@ func DeregisterTargets(ctx context.Context, input *elbv2.DeregisterTargetsInput,
 		return output, err
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.DeregisterTargets(ctx, input, accountID)
 	if err != nil {
 		return output, err
@@ -5,8 +5,8 @@ import (
 	"errors"

 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	handlers_elbv2 "github.com/mulgadc/spinifex/spinifex/handlers/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -19,7 +19,7 @@ func DescribeListenerCertificates(ctx context.Context, input *elbv2.DescribeList
 		return output, errors.New(awserrors.ErrorMissingParameter)
 	}

-	svc := handlers_elbv2.NewNATSELBv2Service(natsConn)
+	svc := elbv2domain.NewNATSELBv2Service(natsConn)
 	result, err := svc.DescribeListenerCertificates(ctx, input, accountID)
 	if err != nil {
 		return output, err
--- a/Show More
+++ b/Show More