# Owned read-only block request contract (K1506–K1510)

`Requests<N>` in `os-block-requests/src/lib.rs` owns a bounded table of request
records. The development Image copies it to `kernel/src/runtime/block_io.rs`.
Each record binds an
opaque, monotonically increasing request ID to one queue head, 512-byte aligned
DMA buffer, LBA, absolute counter deadline, and device generation. The caller
owns the actual DMA frame; this model never dereferences it. The driver checks
sector geometry and DMA lease boundaries before `prepare`.

The only normal transitions are absent → prepared → published → absent after a
matching successful used element. A prepared request may be aborted if no
descriptor was published. A published request remains live on timeout, device
failure, wrong head, wrong ID, or stale generation; DMA may be reclaimed only
after valid completion or an observed device reset. The reset requires both
device status and QueueReady to be zero and a strictly newer generation.

`prepare`, `publish`, and `complete` fail without changing the table on invalid
input. Old device generations return `StaleDevice`; unrelated tokens or used
heads return `WrongCompletion`. A second request may coexist on another head,
and two sequential reads may reuse one head only with distinct IDs. The guest
probe must observe two real reads, reject an old generation before publication,
reject a foreign completion while the correct request stays live, and return
all DMA frames after reset in both boot paths.