# K1376–K1379 shared user ring contract

A fixed sixteen-slot ring carries ordered 64-bit messages. The producer may
advance only after writing a free slot; the consumer reads only a published
slot. The distance between producer and consumer is at most sixteen. Every
index used to address a slot is reduced modulo sixteen only after the raw
header has passed range and monotonicity checks. Full rings reject a new
message without changing counters or slots.

An untrusted producer index greater than the number of slots available from
the current consumer index is `Invalid`. A producer index behind the current
published index is `Stale`. Rejected headers leave the entire ring snapshot,
including the kernel-side canary, unchanged. The guest adapter must copy and
validate an untrusted user header before any index-derived memory access and
must keep the ring inside user-owned pages. A thousand-message host test and
mutant rejection are local development evidence, not product acceptance.