Problem
The ingestion oversized-chunk guardrail (IngestionService.resolveEmbeddingInputGuardrail + the typed skip at ~line 1487-1509, per #17070) admits any chunk that fits the engine slot (localModels.embedding.contextLimitTokens / safeProcessingLimitTokens, 32768/28672-class on current planes). But fit is not serviceability: on a CPU-only lane measured at ~26 tok/s, a slot-legal chunk can require ~6-21 minutes of service time while the binding caller clocks are 47s-300s. Every chunk in that band is legal but undeliverable — it grinds, its caller abandons, and it is re-submitted. The admission decision uses the wrong authority.
Acceptance Criteria
- The admission ceiling derives from declared lane throughput × the binding caller deadline (with margin), consuming the provider-lane declaration channel shipped in #17069/#17107 — not from slot capacity alone.
- A chunk above the serviceability ceiling is split (preferred) or typed-refused before dispatch; it never reaches the provider as a single request.
- The ceiling and its derivation inputs are visible on the lane's diagnostic surface (shape verification reports fit vs serviceability, both).
- Spec matrix: slot-legal/serviceable, slot-legal/unserviceable (split path + refuse path), overslot — none of the unserviceable shapes dispatches whole.
Evidence class
Live engine task log (multi-minute slot-legal chunk) + measured lane throughput on a constrained CPU-only plane, 2026-08-14; source-bound to the guardrail call sites. Builds directly on #17069/#17070/#17107.
Part of epic #17072.
Problem
The ingestion oversized-chunk guardrail (
IngestionService.resolveEmbeddingInputGuardrail+ the typed skip at ~line 1487-1509, per #17070) admits any chunk that fits the engine slot (localModels.embedding.contextLimitTokens/safeProcessingLimitTokens, 32768/28672-class on current planes). But fit is not serviceability: on a CPU-only lane measured at ~26 tok/s, a slot-legal chunk can require ~6-21 minutes of service time while the binding caller clocks are 47s-300s. Every chunk in that band is legal but undeliverable — it grinds, its caller abandons, and it is re-submitted. The admission decision uses the wrong authority.Acceptance Criteria
Evidence class
Live engine task log (multi-minute slot-legal chunk) + measured lane throughput on a constrained CPU-only plane, 2026-08-14; source-bound to the guardrail call sites. Builds directly on #17069/#17070/#17107.
Part of epic #17072.