fix: the ML dial offered slots the machine had no cores to feed (4295)

Operator's 2026-09-23 log: embed_image taking 107-246s each, ~49 slots in
flight by Little's law, and the daily CCIP sweep dying on its 1800s soft
limit in a numpy matmul. The billiard/pool.py frame in that traceback is
the soft-timeout signal handler, not a pool fault.

Two causes, both mine.

1. `derived_ceiling` computed the ML lane from MEMORY ALONE. Meanwhile
   `embedder.py` carried `_INTRA_OP_THREADS = 4` beside a comment reading
   "keep N_replicas x this within the cores allotted to ML" — a constraint
   stated where nothing could act on it. A large-memory host offered ~49
   slots, the operator took what the dial offered, and the lane asked the
   box for ~200 torch threads.

   The number moves onto the lane as `threads_per_slot`, the embedder
   reads it rather than restating it, and the ceiling is now the smaller
   of the two bounds. They fail differently on purpose: too little memory
   is honestly zero, because the first task would OOM the container; too
   few cores is merely slow, so it floors at one rather than making the
   lane unreachable on a small box.

2. `scheduled_ccip_auto_apply` scored one image per matmul, over every
   image in the library, on every daily run — ~119k products each too
   small to pay for its own BLAS setup. `char_maxima` does the same
   arithmetic in blocks bounded by elements, so its memory stays flat as
   either axis grows.

   Batching changes no arithmetic: a character's score for an image is a
   max over that image's figures AND that character's prototypes, and max
   does not care how it is grouped. Pinned against the old loop written
   out longhand, and against itself with the blocking forced to split
   every row.

The UI copy said the ML ceiling came from memory; it says cores or
memory, whichever runs out first.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LVjrnpQjRgHdvq95rASoiR

tests/test_worker_lanes.py

@@ -153,10 +153,60 @@ def test_v1_sentinel_is_recognised_as_unlimited(monkeypatch, tmp_path):
 
 def test_ml_ceiling_is_memory_divided_by_per_slot_cost(monkeypatch, tmp_path):
     # 2 GiB reserved for web and the other lanes, then 4 GiB per model copy.
+    # Cores pinned high so the memory bound is the one being read here.
     _point_memory_at(monkeypatch, tmp_path, str(14 * wl.GIB))
+    monkeypatch.setattr(wl, "container_cpu_count", lambda: 32)
     assert wl.derived_ceiling(wl.LANES_BY_NAME["ml"]) == 3
 
 
+def test_ml_is_bounded_by_cores_as_well_as_memory(monkeypatch, tmp_path):
+    """The bug of 2026-09-23, in one assertion.
+
+    The ML ceiling was memory ALONE. On the operator's large-memory host that
+    offered ~49 slots; they took them, and each slot asks torch for
+    `threads_per_slot` cores — so the lane ran ~200 threads over a box that
+    has nowhere near that many. Embeds that should be seconds took 107-246s,
+    and the daily CCIP sweep sharing that pool died on its 1800s soft limit.
+
+    Memory here says 49. The cores say 8 / 4 = 2, and the smaller bound is the
+    only honest one: a control must not offer a number the machine cannot
+    feed.
+    """
+    _point_memory_at(monkeypatch, tmp_path, str(200 * wl.GIB))
+    monkeypatch.setattr(wl, "container_cpu_count", lambda: 8)
+
+    ml = wl.LANES_BY_NAME["ml"]
+    assert ml.threads_per_slot == 4
+    assert wl.derived_ceiling(ml) == 2
+
+
+def test_a_few_cores_still_offer_one_ml_slot_rather_than_none(
+    monkeypatch, tmp_path,
+):
+    """The two bounds fail differently, deliberately. Too little MEMORY is
+    honestly zero — the first task would OOM the container. Too few CORES is
+    merely slow, which is a trade an operator may want, so it floors at one
+    rather than making the lane unreachable on a small box."""
+    _point_memory_at(monkeypatch, tmp_path, str(200 * wl.GIB))
+    monkeypatch.setattr(wl, "container_cpu_count", lambda: 1)
+    assert wl.derived_ceiling(wl.LANES_BY_NAME["ml"]) == 1
+
+
+def test_the_embedder_asks_for_exactly_what_the_ceiling_budgeted(monkeypatch):
+    """The two halves of the same number, tied.
+
+    `threads_per_slot` is only meaningful because `embedder.load()` calls
+    `torch.set_num_threads` with it. It lived in the embedder as a private 4
+    beside a comment saying "keep N_replicas x this within the cores allotted
+    to ML" — a constraint stated where nothing could enforce it, and nothing
+    did. If these two ever drift, the ceiling is budgeting cores for a demand
+    the worker does not make, and nothing else would notice.
+    """
+    from backend.app.services.ml import embedder
+
+    assert embedder._INTRA_OP_THREADS == wl.LANES_BY_NAME["ml"].threads_per_slot
+
+
 def test_a_small_box_is_told_it_cannot_run_tagging(monkeypatch, tmp_path):
     """Honestly zero rather than a floor of one. A 4GB box cannot hold a model
     alongside the web process, and offering a slot that OOMs the container the
@@ -206,6 +256,7 @@ def test_the_ceiling_is_computed_not_stored(monkeypatch, tmp_path):
     ceiling when the container's limits change, with no row edit. A stored
     ceiling would keep authorising what the box no longer has."""
     lane = wl.LANES_BY_NAME["ml"]
+    monkeypatch.setattr(wl, "container_cpu_count", lambda: 32)
     _point_memory_at(monkeypatch, tmp_path, str(34 * wl.GIB))
     big = wl.derived_ceiling(lane)
     (tmp_path / "memory.max").write_text(str(10 * wl.GIB))