Kernel tuning without telemetry

You ship an inference runtime that runs on hardware you do not own. Part of the fleet is in your lab. A growing part is not, and will not be: an air gapped cluster inside a customer's building, a console generation under embargo, a handset accelerator that exists to you as a specification and a vendor compiler. No performance telemetry comes back from any of it. At build time you must emit a schedule per kernel: tile shape, unroll and pipeline depth, memory staging, and the fallback structure. A wrong choice does not crash. It costs a factor on somebody's machine for the life of the release, and nobody tells you.

Search on the target is not available. The customer will not grant a maintenance window for a tuning run, the console vendor will not ship a search, and the handset would spend the user's battery on it. A bounded startup probe is allowed, and if you take it, the probe becomes part of what you have to justify: how many variants you carry, what the probe measures, and how often it selects the wrong one. You may not assume the shape distribution either. The traffic produces sequence lengths and batch shapes you did not enumerate.

Hand in the selection procedure and exactly which facts about the unmeasured part it consumes. Hand in the transfer claim: a bound on slowdown relative to the best schedule for that part, or the argument that no such bound is available in your model together with what you offer instead. Hand in the probe design and its selection error, if you use one. Hand in the detector that runs on the customer's machine and notices a bad choice with no channel back to you. Hand in a held out architecture experiment, and state in advance the result that would make you withdraw the method.

Ties break toward a narrow transfer claim tested by holding an architecture out, over a broad one fitted on everything you had.