V4.7 final scope changes

docs/ver4.7/scope_boundary_v4_7.md

@@ -98,6 +98,8 @@ What remains is the `ExecutionAttempt` cluster, moved to **`services/evidence.py
 
 Expected result: `sources.py` lands near **900 lines**.
 
+**`.github/instructions/services.instructions.md` is revised as part of this item** (review log [59]), after the move rather than before. The instruction file's line 11 rule, `1 service class per data model`, is table-shaped rather than aggregate-shaped and is the measured cause of the 1,389-line module this item exists to break up; leaving it unchanged would license the same growth again. The file is also silent on `job_source` and `document_person`, the junctions where the four core components intersect, so ownership of those has never been written down. Sequencing the revision after the decomposition makes the refactor the empirical test of the rule: if the new rule is right, the resulting module boundaries follow from it, and if the code has to be bent to fit, the rule is wrong.
+
 ### 4. Run-Time Measurement Window (review log [55])
 
 `services/workflows.py:221` sets `monotonic_started_at` **before** provider-input preparation and the `session.commit()` at line 228. Line 251 computes `elapsed_seconds` from it. But the `asyncio.wait_for` timeout at lines 240-249 wraps **only** `_call_transcriber`.
@@ -169,6 +171,7 @@ All schema and data changes land in a single `tools/migrate_v46_to_v47.py`: idem
 - The `processing_artifact` table, its model, and its service cluster no longer exist.
 - Newly uploaded images are stored upright with no EXIF orientation tag, and the 58 pre-existing rotated images have been backfilled.
 - `services/sources.py` is materially smaller, with `ExecutionAttempt` responsibilities in `services/evidence.py` and `update_job_source_transcription` unmoved.
+- `services.instructions.md` states an aggregate-shaped ownership rule, names an owning service for every model including the junctions, and no longer contradicts itself on multi-table operations.
 - The recorded duration reflects only the operation the timeout governs.
 - A programming error in the worker loop is distinguishable from a provider fault.
 - `ruff check` reports no findings; `ty check` reports **0 diagnostics**, the V4.6 exit state.