GPU Memory Tiering and Migration
Skill navigation
Load linked skills only when their trigger applies. Do not duplicate their full workflow here.
Core principle
Choose placement and movement from measured capacity, topology, working-set, and transfer evidence. Treat device, peer, host, storage, and remote memory as candidates with directional costs, not as one universal speed ranking.
Do not assume asynchronous movement is hidden. A transfer is beneficial only when capacity relief or future access savings exceeds exposed movement, staging, contention, consistency, and prediction-error costs.
Treat data classification, permitted destinations, and movement authorization as feasibility constraints. Performance evidence cannot authorize a tier or path that the resource's ownership and protection contract forbids.
This skill decides where a logical object should reside and which movement actions are permitted. gpu-memory-scheduling decides their exact order and overlap.
Tier and residency audit
Build one tier inventory for the deployment topology.
| Tier field |
Record |
| Capacity |
Physical capacity, safe capacity, reserve, staging peak, fragmentation margin |
| Access |
Direct access semantics, registration or setup requirements, failure behavior |
| Performance |
Directional latency distribution, sustainable bandwidth, variance, concurrency limit |
| Topology |
Direct or staged paths, intermediate nodes, shared links, contention domains |
| Accounting |
Owner, replicas, dirty bytes, metadata, placement granularity |
| Policy |
Data classification, permitted destinations, authorized movers and readers, required protection and sanitization |
| Evidence |
Measurement method, workload scope, concurrency, confidence, timestamp |
Do not substitute rated link bandwidth for measured sustainable bandwidth under representative contention.
Working-set inventory
For each resource or resource class, record:
- bytes and residency granularity;
- logical lifetime and retention requirement;
- current authoritative owner and valid replicas;
- next-use distribution and deadline;
- reuse distance and access count;
- read, write, and dirty-byte volume;
- reconstruction alternative and cost;
- transfer slack and staging demand;
- prediction confidence and fallback;
- data classification, permitted tiers and paths, movement authority, isolation, required protection, consistency, and failure-recovery requirements.
Model the active working set over time. Total allocated bytes do not identify the bytes that must be resident in the next decision window.
Define a residency state machine
Use explicit logical states when movement can overlap execution:
unknown
absent
capacity-reserved
inbound
resident-valid
resident-authoritative-dirty
replicated-valid
outbound
stale-or-invalid
failed-or-reconciling
Require these invariants:
- reserve destination capacity before admitting inbound movement;
- authorize the destination, path, mover, and intended readers before reserving or copying data;
- publish validity only after confirmed completion;
- permit reads only from a valid version;
- maintain one authoritative dirty owner unless an explicit consistency protocol permits otherwise;
- preserve a recoverable owner or rollback path during movement;
- preserve required protection in transit, at rest, and during staging, then sanitize released copies when the contract requires it;
- invalidate, revoke, and sanitize incomplete destination or staging copies after cancellation or failure as required by the protection contract;
- release reservations and reconcile ownership after cancellation or failure.
Express transition preconditions and postconditions here. Delegate exact events, queues, and ordering to the scheduling and runtime specialists.
Audit migration quality
Track:
- movement bytes by source, destination, and direction;
- demand misses and exposed stall time;
- on-time, late, and unused prefetch bytes;
- writeback and reload bytes;
- post-eviction reacquisition rate;
- promotion-demotion reversals;
- residence time before reversal;
- peak staging memory;
- per-link utilization and contention;
- median and tail latency effects.
Use byte-weighted prediction metrics:
prefetch_precision = useful_prefetched_bytes / prefetched_bytes
miss_coverage = avoided_miss_bytes / baseline_miss_bytes
movement_amplification = all_movement_bytes / useful_accessed_bytes
Guard zero denominators and report the raw byte counts with each ratio.
Decision workflow
- Declare the target metric, capacity objective, latency constraints, and workload scope.
- Inventory all relevant tiers and directional paths.
- Build the working-set and residency-state records.
- Reproduce the baseline misses, transfers, stalls, and capacity pressure.
- Enumerate no movement, promotion, demotion, prefetch, offload, migration, and replication alternatives.
- Reject actions that violate capacity, ownership, validity, destination policy, authorization, protection, isolation, or recoverability.
- Estimate directional transfer, staging, contention, consistency, and prediction-error costs.
- Compare each action with the no-movement alternative under uncertainty.
- Define triggers, hysteresis, minimum dwell, cancellation, fallback, and rollback conditions.
- Hand readiness windows and transfer constraints to
gpu-memory-scheduling.
- Measure the realized path and reclassify the bottleneck.
Capacity and oversubscription
For tier i:
C_safe(i) = C_physical(i) - C_reserve(i) - C_fragmentation(i) - C_staging(i)
excess_i(t) = max(0, planned_residency_i(t) - C_safe(i))
Derive reserve and fragmentation margins from measured variance and backing evidence. Do not invent a universal safety fraction.
Treat transient oversubscription as feasible only when scheduled outbound movement or reclamation completes before the capacity deadline.
Directional path cost
For resource x on link e, measure the realized per-hop cost, not the nominal isolated latency:
T_e(x) = L_e + bytes_e(x) / B_effective(e) + Q_e
where Q_e is only the queueing/staging component observable on that link; it does not by itself capture cross-link contention, registration, mapping, or multi-hop dependency.
For a multi-hop path, max_e T_e and sum_e T_e are useful structural reference points only when the per-hop costs are measured under compatible conditions. They are not universal lower and upper bounds once queueing, shared-link contention, staging dependencies, retries, or pipelining alter the costs:
max_e T_e <= T_path <= sum_e T_e + T_setup
(valid only under no-shared-contention, no-staging-dependency, no-retry, no-pipelining assumptions)
With pipelining, T_path may approach the slowest stage rather than the sum. With shared or serially-staged links, it can approach or exceed the naive sum. Prefer measured path time, and model the realized path explicitly:
T_path_realized = T_setup
+ T_dependency_wait
+ T_queue
+ T_copy_pipeline
+ T_sync
where T_copy_pipeline is computed from topology and the actual overlap achieved, not from a single-hop nominal figure.
Transfer budget and exposed cost
For window W:
U(e, W) = sum_a bytes(a, e) / [B_sustainable(e) * W]
Set the allowed utilization from workload headroom, not a fixed constant.
Estimate exposed movement. Distinguish three quantities — they are not interchangeable:
T_transfer_isolated: copy/migration latency measured alone, with no competition. Baseline data only.
T_transfer_realized: actual transfer completion time, including queueing, staging, registration, mapping, shared-link contention, bandwidth interference, source readiness, destination-capacity wait, synchronization, and multi-hop path dependency. This is the quantity to schedule against.
T_exposed: how much the transfer delays the critical consumer's readiness — the end-to-end quantity that matters.
Define the consumer's readiness with and without the move:
consumer_ready_without_move = R0
consumer_ready_with_move = R1
T_exposed = max(0, R1 - R0)
For planning-phase estimates only, model the realized transfer time from measured or modeled cost components rather than from the post-execution realized value:
T_transfer_realized_est = T_setup + T_dependency_wait + T_queue + T_copy_pipeline + T_sync (each term modeled)
T_exposed_est ≈ max(0, T_transfer_realized_est - usable_slack)
T_transfer_realized_est is the planning counterpart of T_transfer_realized; T_exposed_est is a planning estimate and must be confirmed against T_exposed once the path is realized.
Reject an offload or prefetch when the inactive interval (or usable slack) is shorter than T_transfer_realized — or its planning estimate T_transfer_realized_est before the path is realized — and the affected consumer is critical, unless a different schedule creates enough verified slack. Reserve T_exposed for post-execution validation of the realized schedule.
This rule assumes atomic / all-or-nothing readiness. For streamable or chunked resources, model chunk/tile readiness, pipeline fill/drain, and consumer service rate; an offload can remain fully or partially hidden when the first-chunk deadline and steady-state producer/consumer throughput are met, even if full-object transfer exceeds the inactive interval.
Cost model
Evaluate actions as value relative to no movement:
- Prefetch value: expected on-time miss cost avoided minus transfer, unused bytes, staging, and contention.
- Migration value: expected future access savings minus movement, writeback, capacity opportunity, and consistency.
- Replication value: locality benefit minus copy, holding capacity, update, invalidation, and interference.
- Offload value: capacity-relief value minus writeout, expected reload, exposed latency, and contention.
Use compatible units or a declared objective order. Do not add latency, bytes, and failure risk with invented weights.
When future access savings per use is positive, a break-even estimate can rank experiments:
N_break_even = [T_move + C_consistency + C_contention + C_capacity]
/ [access_cost_current - access_cost_target]
Treat the result as a hypothesis. Use sensitivity analysis when future access probability or link cost is uncertain.
Select only actions that remain beneficial under conservative uncertainty and fit every capacity and transfer budget.
Control prediction error and thrashing
Use separate promotion and demotion thresholds. Derive hysteresis and minimum dwell from measured amortization and reversal behavior.
Fall back to conservative demand placement or no movement when prediction confidence drops. Do not deepen speculation simply because a previous trace was predictable.
Reject a policy when movement amplification, late prefetches, unused bytes, or rapid reacquisition erase the predicted benefit.
Specialist handoffs
| Handoff |
Contract |
gpu-virtual-memory-fragmentation |
Required capacity, granularity, legal backing paths, mapping needs, and fragmentation risk |
gpu-state-reuse-eviction |
Treat its selected logical set, retention value, validity, eviction eligibility, dirty obligations, and reconstruction alternatives as required inputs; do not derive them here |
gpu-memory-scheduling |
Source, destination, mode, earliest start, readiness deadline, dependencies, transfer budget, and completion conditions |
gpu-performance-evidence |
Missing path measurements, transfer attribution, prediction metrics, and falsifying experiment |
gpu-optimization-validation |
Residency invariants, workload matrix, predicted outcomes, and rollback criteria |
Do not infer physical feasibility from logical desirability. Do not prescribe exact movement ordering in the residency policy.
Failure modes and counterexamples
- Nominal capacity fits while reserve, staging, or fragmentation causes exhaustion.
- Rated bandwidth hides setup, asymmetry, queueing, or shared-link contention.
- An asynchronous call is assumed to create overlap.
- Prefetch arrives late or remains unused.
- Dirty movement creates writeback amplification.
- Replication consumes more capacity or update traffic than it saves.
- A multi-hop route bottlenecks on an intermediate link.
- A faster destination or intermediate path is prohibited by data classification, authorization, or protection requirements.
- Movement steals bandwidth from the primary workload.
- Prediction noise causes promotion-demotion oscillation.
- Failed movement leaves ambiguous ownership or stale replicas.
- Cancellation or rollback leaves readable partial copies, stale mappings, or unauthorized staging data.
- Coarse granularity transfers mostly unused bytes.
- Mean throughput improves while tail latency violates the target.
- Logical cache eviction is confused with physical residency eviction.
- A fixed tier order, threshold, or recency rule substitutes convention for evidence.
Residency decision record
Record:
- objective, workload scope, capacity and latency constraints;
- resource class, current owner, replicas, and residency state;
- candidate tiers, paths, actions, and no-movement alternative;
- size, granularity, dirty bytes, staging, and reserve requirements;
- directional path measurements and shared contention domains;
- working-set, next-use, reuse, and prediction evidence;
- formula inputs, units, source, confidence, and sensitivity;
- consistency, invalidation, cancellation, and failure-recovery contract;
- data classification, permitted destinations and paths, movement authority, protection, and sanitization contract;
- trigger, hysteresis, minimum dwell, and rollback condition;
- scheduling constraints without exact ordering;
- rejected alternatives and falsifying measurements;
- disposition: measured finding, guarded policy, rejected, or unresolved.
Acceptance gate
Keep a placement or migration policy only when:
- every relevant tier is evaluated or excluded with evidence;
- safe capacity includes reserve, fragmentation, and peak staging;
- directional paths satisfy transfer budgets under representative concurrency;
- residency transitions preserve ownership, validity, isolation, and recovery;
- every destination, path, mover, and reader is permitted and required protection survives transfer, staging, residency, and release;
- cancellation, rollback, and fallback revoke stale access and sanitize incomplete or released copies when required;
- prediction quality survives representative and stress workloads;
- measured hysteresis and dwell prevent thrashing;
- movement amplification stays below the measured break-even limit;
- the selected action beats no movement after uncertainty and contention;
- exact ordering remains delegated with sufficient readiness constraints;
- end-to-end targets improve without unacceptable capacity or tail regression;
- missing evidence produces a hypothesis or rejection, never a default offload or prefetch claim.
1---2name: gpu-memory-tiering-migration3description: Load this skill and follow it when placing or moving GPU resources across device memory, peer devices, host memory, storage, or remote tiers, including residency, prefetch, offload, replication, migration, and oversubscription.4---56# GPU Memory Tiering and Migration78## Skill navigation910- Parent router: [gpu-code-optimizer](../gpu-code-optimizer/SKILL.md)11- Evidence: [gpu-performance-evidence](../gpu-performance-evidence/SKILL.md)12- Physical backing: [gpu-virtual-memory-fragmentation](../gpu-virtual-memory-fragmentation/SKILL.md)13- Logical retention: [gpu-state-reuse-eviction](../gpu-state-reuse-eviction/SKILL.md)14- Ordering: [gpu-memory-scheduling](../gpu-memory-scheduling/SKILL.md)15- Validation: [gpu-optimization-validation](../gpu-optimization-validation/SKILL.md)1617Load linked skills only when their trigger applies. Do not duplicate their full workflow here.1819## Core principle2021Choose placement and movement from measured capacity, topology, working-set, and transfer evidence. Treat device, peer, host, storage, and remote memory as candidates with directional costs, not as one universal speed ranking.2223Do not assume asynchronous movement is hidden. A transfer is beneficial only when capacity relief or future access savings exceeds exposed movement, staging, contention, consistency, and prediction-error costs.2425Treat data classification, permitted destinations, and movement authorization as feasibility constraints. Performance evidence cannot authorize a tier or path that the resource's ownership and protection contract forbids.2627This skill decides where a logical object should reside and which movement actions are permitted. `gpu-memory-scheduling` decides their exact order and overlap.2829## Tier and residency audit3031Build one tier inventory for the deployment topology.3233| Tier field | Record |34|---|---|35| Capacity | Physical capacity, safe capacity, reserve, staging peak, fragmentation margin |36| Access | Direct access semantics, registration or setup requirements, failure behavior |37| Performance | Directional latency distribution, sustainable bandwidth, variance, concurrency limit |38| Topology | Direct or staged paths, intermediate nodes, shared links, contention domains |39| Accounting | Owner, replicas, dirty bytes, metadata, placement granularity |40| Policy | Data classification, permitted destinations, authorized movers and readers, required protection and sanitization |41| Evidence | Measurement method, workload scope, concurrency, confidence, timestamp |4243Do not substitute rated link bandwidth for measured sustainable bandwidth under representative contention.4445### Working-set inventory4647For each resource or resource class, record:4849- bytes and residency granularity;50- logical lifetime and retention requirement;51- current authoritative owner and valid replicas;52- next-use distribution and deadline;53- reuse distance and access count;54- read, write, and dirty-byte volume;55- reconstruction alternative and cost;56- transfer slack and staging demand;57- prediction confidence and fallback;58- data classification, permitted tiers and paths, movement authority, isolation, required protection, consistency, and failure-recovery requirements.5960Model the active working set over time. Total allocated bytes do not identify the bytes that must be resident in the next decision window.6162### Define a residency state machine6364Use explicit logical states when movement can overlap execution:6566- `unknown`67- `absent`68- `capacity-reserved`69- `inbound`70- `resident-valid`71- `resident-authoritative-dirty`72- `replicated-valid`73- `outbound`74- `stale-or-invalid`75- `failed-or-reconciling`7677Require these invariants:7879- reserve destination capacity before admitting inbound movement;80- authorize the destination, path, mover, and intended readers before reserving or copying data;81- publish validity only after confirmed completion;82- permit reads only from a valid version;83- maintain one authoritative dirty owner unless an explicit consistency protocol permits otherwise;84- preserve a recoverable owner or rollback path during movement;85- preserve required protection in transit, at rest, and during staging, then sanitize released copies when the contract requires it;86- invalidate, revoke, and sanitize incomplete destination or staging copies after cancellation or failure as required by the protection contract;87- release reservations and reconcile ownership after cancellation or failure.8889Express transition preconditions and postconditions here. Delegate exact events, queues, and ordering to the scheduling and runtime specialists.9091### Audit migration quality9293Track:9495- movement bytes by source, destination, and direction;96- demand misses and exposed stall time;97- on-time, late, and unused prefetch bytes;98- writeback and reload bytes;99- post-eviction reacquisition rate;100- promotion-demotion reversals;101- residence time before reversal;102- peak staging memory;103- per-link utilization and contention;104- median and tail latency effects.105106Use byte-weighted prediction metrics:107108```text109prefetch_precision = useful_prefetched_bytes / prefetched_bytes110miss_coverage = avoided_miss_bytes / baseline_miss_bytes111movement_amplification = all_movement_bytes / useful_accessed_bytes112```113114Guard zero denominators and report the raw byte counts with each ratio.115116## Decision workflow1171181. Declare the target metric, capacity objective, latency constraints, and workload scope.1192. Inventory all relevant tiers and directional paths.1203. Build the working-set and residency-state records.1214. Reproduce the baseline misses, transfers, stalls, and capacity pressure.1225. Enumerate no movement, promotion, demotion, prefetch, offload, migration, and replication alternatives.1236. Reject actions that violate capacity, ownership, validity, destination policy, authorization, protection, isolation, or recoverability.1247. Estimate directional transfer, staging, contention, consistency, and prediction-error costs.1258. Compare each action with the no-movement alternative under uncertainty.1269. Define triggers, hysteresis, minimum dwell, cancellation, fallback, and rollback conditions.12710. Hand readiness windows and transfer constraints to `gpu-memory-scheduling`.12811. Measure the realized path and reclassify the bottleneck.129130### Capacity and oversubscription131132For tier `i`:133134```text135C_safe(i) = C_physical(i) - C_reserve(i) - C_fragmentation(i) - C_staging(i)136excess_i(t) = max(0, planned_residency_i(t) - C_safe(i))137```138139Derive reserve and fragmentation margins from measured variance and backing evidence. Do not invent a universal safety fraction.140141Treat transient oversubscription as feasible only when scheduled outbound movement or reclamation completes before the capacity deadline.142143### Directional path cost144145For resource `x` on link `e`, measure the *realized* per-hop cost, not the nominal isolated latency:146147```text148T_e(x) = L_e + bytes_e(x) / B_effective(e) + Q_e149```150151where `Q_e` is only the queueing/staging component observable on that link; it does not by itself capture cross-link contention, registration, mapping, or multi-hop dependency.152153For a multi-hop path, `max_e T_e` and `sum_e T_e` are useful **structural reference points only when the per-hop costs are measured under compatible conditions**. They are **not** universal lower and upper bounds once queueing, shared-link contention, staging dependencies, retries, or pipelining alter the costs:154155```text156max_e T_e <= T_path <= sum_e T_e + T_setup157 (valid only under no-shared-contention, no-staging-dependency, no-retry, no-pipelining assumptions)158```159160With pipelining, `T_path` may approach the slowest stage rather than the sum. With shared or serially-staged links, it can approach or exceed the naive sum. Prefer measured path time, and model the realized path explicitly:161162```text163T_path_realized = T_setup164 + T_dependency_wait165 + T_queue166 + T_copy_pipeline167 + T_sync168```169170where `T_copy_pipeline` is computed from topology and the actual overlap achieved, not from a single-hop nominal figure.171172### Transfer budget and exposed cost173174For window `W`:175176```text177U(e, W) = sum_a bytes(a, e) / [B_sustainable(e) * W]178```179180Set the allowed utilization from workload headroom, not a fixed constant.181182Estimate exposed movement. Distinguish three quantities — they are not interchangeable:183184- `T_transfer_isolated`: copy/migration latency measured alone, with no competition. Baseline data only.185- `T_transfer_realized`: actual transfer completion time, including queueing, staging, registration, mapping, shared-link contention, bandwidth interference, source readiness, destination-capacity wait, synchronization, and multi-hop path dependency. This is the quantity to schedule against.186- `T_exposed`: how much the transfer delays the critical consumer's readiness — the end-to-end quantity that matters.187188Define the consumer's readiness with and without the move:189190```text191consumer_ready_without_move = R0192consumer_ready_with_move = R1193T_exposed = max(0, R1 - R0)194```195196For planning-phase estimates only, model the realized transfer time from measured or modeled cost components rather than from the post-execution realized value:197198```text199T_transfer_realized_est = T_setup + T_dependency_wait + T_queue + T_copy_pipeline + T_sync (each term modeled)200T_exposed_est ≈ max(0, T_transfer_realized_est - usable_slack)201```202203`T_transfer_realized_est` is the planning counterpart of `T_transfer_realized`; `T_exposed_est` is a planning estimate and must be confirmed against `T_exposed` once the path is realized.204205Reject an offload or prefetch when the inactive interval (or usable slack) is shorter than `T_transfer_realized` — or its planning estimate `T_transfer_realized_est` before the path is realized — and the affected consumer is critical, unless a different schedule creates enough verified slack. Reserve `T_exposed` for post-execution validation of the realized schedule.206207This rule assumes atomic / all-or-nothing readiness. For streamable or chunked resources, model chunk/tile readiness, pipeline fill/drain, and consumer service rate; an offload can remain fully or partially hidden when the first-chunk deadline and steady-state producer/consumer throughput are met, even if full-object transfer exceeds the inactive interval.208209## Cost model210211Evaluate actions as value relative to no movement:212213- **Prefetch value**: expected on-time miss cost avoided minus transfer, unused bytes, staging, and contention.214- **Migration value**: expected future access savings minus movement, writeback, capacity opportunity, and consistency.215- **Replication value**: locality benefit minus copy, holding capacity, update, invalidation, and interference.216- **Offload value**: capacity-relief value minus writeout, expected reload, exposed latency, and contention.217218Use compatible units or a declared objective order. Do not add latency, bytes, and failure risk with invented weights.219220When future access savings per use is positive, a break-even estimate can rank experiments:221222```text223N_break_even = [T_move + C_consistency + C_contention + C_capacity]224 / [access_cost_current - access_cost_target]225```226227Treat the result as a hypothesis. Use sensitivity analysis when future access probability or link cost is uncertain.228229Select only actions that remain beneficial under conservative uncertainty and fit every capacity and transfer budget.230231### Control prediction error and thrashing232233Use separate promotion and demotion thresholds. Derive hysteresis and minimum dwell from measured amortization and reversal behavior.234235Fall back to conservative demand placement or no movement when prediction confidence drops. Do not deepen speculation simply because a previous trace was predictable.236237Reject a policy when movement amplification, late prefetches, unused bytes, or rapid reacquisition erase the predicted benefit.238239## Specialist handoffs240241| Handoff | Contract |242|---|---|243| `gpu-virtual-memory-fragmentation` | Required capacity, granularity, legal backing paths, mapping needs, and fragmentation risk |244| `gpu-state-reuse-eviction` | Treat its selected logical set, retention value, validity, eviction eligibility, dirty obligations, and reconstruction alternatives as required inputs; do not derive them here |245| `gpu-memory-scheduling` | Source, destination, mode, earliest start, readiness deadline, dependencies, transfer budget, and completion conditions |246| `gpu-performance-evidence` | Missing path measurements, transfer attribution, prediction metrics, and falsifying experiment |247| `gpu-optimization-validation` | Residency invariants, workload matrix, predicted outcomes, and rollback criteria |248249Do not infer physical feasibility from logical desirability. Do not prescribe exact movement ordering in the residency policy.250251## Failure modes and counterexamples252253- Nominal capacity fits while reserve, staging, or fragmentation causes exhaustion.254- Rated bandwidth hides setup, asymmetry, queueing, or shared-link contention.255- An asynchronous call is assumed to create overlap.256- Prefetch arrives late or remains unused.257- Dirty movement creates writeback amplification.258- Replication consumes more capacity or update traffic than it saves.259- A multi-hop route bottlenecks on an intermediate link.260- A faster destination or intermediate path is prohibited by data classification, authorization, or protection requirements.261- Movement steals bandwidth from the primary workload.262- Prediction noise causes promotion-demotion oscillation.263- Failed movement leaves ambiguous ownership or stale replicas.264- Cancellation or rollback leaves readable partial copies, stale mappings, or unauthorized staging data.265- Coarse granularity transfers mostly unused bytes.266- Mean throughput improves while tail latency violates the target.267- Logical cache eviction is confused with physical residency eviction.268- A fixed tier order, threshold, or recency rule substitutes convention for evidence.269270## Residency decision record271272Record:273274- objective, workload scope, capacity and latency constraints;275- resource class, current owner, replicas, and residency state;276- candidate tiers, paths, actions, and no-movement alternative;277- size, granularity, dirty bytes, staging, and reserve requirements;278- directional path measurements and shared contention domains;279- working-set, next-use, reuse, and prediction evidence;280- formula inputs, units, source, confidence, and sensitivity;281- consistency, invalidation, cancellation, and failure-recovery contract;282- data classification, permitted destinations and paths, movement authority, protection, and sanitization contract;283- trigger, hysteresis, minimum dwell, and rollback condition;284- scheduling constraints without exact ordering;285- rejected alternatives and falsifying measurements;286- disposition: measured finding, guarded policy, rejected, or unresolved.287288## Acceptance gate289290Keep a placement or migration policy only when:291292- every relevant tier is evaluated or excluded with evidence;293- safe capacity includes reserve, fragmentation, and peak staging;294- directional paths satisfy transfer budgets under representative concurrency;295- residency transitions preserve ownership, validity, isolation, and recovery;296- every destination, path, mover, and reader is permitted and required protection survives transfer, staging, residency, and release;297- cancellation, rollback, and fallback revoke stale access and sanitize incomplete or released copies when required;298- prediction quality survives representative and stress workloads;299- measured hysteresis and dwell prevent thrashing;300- movement amplification stays below the measured break-even limit;301- the selected action beats no movement after uncertainty and contention;302- exact ordering remains delegated with sufficient readiness constraints;303- end-to-end targets improve without unacceptable capacity or tail regression;304- missing evidence produces a hypothesis or rejection, never a default offload or prefetch claim.