# Virtio completion ownership contract (K1491–K1495)

Each live split-queue head names exactly one request and one DMA owner.
Submission records a fresh generation and the maximum number of writable
bytes. A used element may complete live heads in any order. The used ID must
identify exactly one live head; its length must be nonzero and within that
head's writable span. Virtio block status is 0 (OK), 1 (IOERR), or 2
(UNSUPP). A valid completion retires that head and returns its owner token.

Foreign IDs, repeated IDs, malformed lengths, and unknown status values leave
the table unchanged. A reused head gets a new generation. Device reset may
retire outstanding ownership only after status and queue readiness are both
observed as zero; callers quarantine DMA until then. The local model covers
out-of-order and rejected completions. K1495 must bind these checks to
physical used entries and DMA lifetimes in direct and UEFI guests.