V4.7 final scope changes

docs/ver4.7/implementation_plan_v4_7.md

@@ -110,10 +110,16 @@ Tasks:
 4. Update `ServiceBundle` to construct and expose the new service via the `from_session_factory` constructor added in V4.6.
 5. Update call sites in `sources_page.py` and `workflows.py`.
 6. Run `ruff check --fix` **in the same pass** as the import edits - autofix removes imports that are unused at that moment.
+7. **Revise `.github/instructions/services.instructions.md` to describe the boundaries this decomposition actually produced** (review log [59]). Do this *after* the move, not before - the refactor is the empirical test of the rule, and a rule written in advance would have to be bent to fit. Known defects to correct:
+   - **Line 11, `1 service class per data model`** - the rule is table-shaped rather than aggregate-shaped, and is the measured cause of `sources.py` reaching 1,389 lines. Replace with aggregate ownership.
+   - **No home for junction tables.** The rule names the four core components (Document, Source, Job, Person) but is silent on `job_source` and `document_person`, where they intersect. Add an explicit model-ownership table naming the owning service for every model, including junctions and `ExecutionAttempt`.
+   - **Lines 30-32**, mandatory CRUD for every model, is already false: `prompts.py` does not comply. Soften to describe intent rather than mandate a method set.
+   - **Line 13 vs lines 75-77** read as contradictory on whether a service may touch more than one table. Reword the composition section so the ownership rule and the multi-table-operation guidance agree.
+   - **Line 77** typo: `picutre`.
 
 Note that line numbers above are pre-Phase-1 positions and will have shifted. Locate by symbol, not by line.
 
-Exit: suite green **with no test logic changes** beyond import paths, `ty check` at 0. Walk every `/ui/*` page and confirm a 200, since `lazy="raise"` turns a missed eager load into a runtime error rather than a slow query.
+Exit: suite green **with no test logic changes** beyond import paths, `ty check` at 0, and `services.instructions.md` consistent with the post-refactor module layout. Walk every `/ui/*` page and confirm a 200, since `lazy="raise"` turns a missed eager load into a runtime error rather than a slow query.
 
 ### 4. Run-Time Measurement Window (review log [55])
 
@@ -182,7 +188,7 @@ Tasks:
 
 1. Ingest normalization and `ProcessingArtifact` removal
 2. Evidence model simplification
-3. Stage B - `evidence.py`
+3. Stage B - `evidence.py`, then revise `services.instructions.md` to match
 4. Measurement window
 5. Worker exception handling
 6. CI enforcement

docs/ver4.7/scope_boundary_v4_7.md

@@ -98,6 +98,8 @@ What remains is the `ExecutionAttempt` cluster, moved to **`services/evidence.py
 
 Expected result: `sources.py` lands near **900 lines**.
 
+**`.github/instructions/services.instructions.md` is revised as part of this item** (review log [59]), after the move rather than before. The instruction file's line 11 rule, `1 service class per data model`, is table-shaped rather than aggregate-shaped and is the measured cause of the 1,389-line module this item exists to break up; leaving it unchanged would license the same growth again. The file is also silent on `job_source` and `document_person`, the junctions where the four core components intersect, so ownership of those has never been written down. Sequencing the revision after the decomposition makes the refactor the empirical test of the rule: if the new rule is right, the resulting module boundaries follow from it, and if the code has to be bent to fit, the rule is wrong.
+
 ### 4. Run-Time Measurement Window (review log [55])
 
 `services/workflows.py:221` sets `monotonic_started_at` **before** provider-input preparation and the `session.commit()` at line 228. Line 251 computes `elapsed_seconds` from it. But the `asyncio.wait_for` timeout at lines 240-249 wraps **only** `_call_transcriber`.
@@ -169,6 +171,7 @@ All schema and data changes land in a single `tools/migrate_v46_to_v47.py`: idem
 - The `processing_artifact` table, its model, and its service cluster no longer exist.
 - Newly uploaded images are stored upright with no EXIF orientation tag, and the 58 pre-existing rotated images have been backfilled.
 - `services/sources.py` is materially smaller, with `ExecutionAttempt` responsibilities in `services/evidence.py` and `update_job_source_transcription` unmoved.
+- `services.instructions.md` states an aggregate-shaped ownership rule, names an owning service for every model including the junctions, and no longer contradicts itself on multi-table operations.
 - The recorded duration reflects only the operation the timeout governs.
 - A programming error in the worker loop is distinguishable from a provider fault.
 - `ruff check` reports no findings; `ty check` reports **0 diagnostics**, the V4.6 exit state.