# Read-only block timeout and cancellation contract (K1511–K1515)

The `os-block-requests` model is copied into the development kernel as
`kernel/src/runtime/block_io.rs`. A published read retains its DMA buffer when
the deadline expires. `timeout` changes Published → TimedOut only at or after
the fixed deadline. `cancel` changes Published or TimedOut → CancelRequested.
Neither operation frees the buffer or decrements the live request count.

A late used element for a TimedOut or CancelRequested request returns
`LateCompletion` and cannot deliver data or release ownership. An invalid
deadline, duplicate cancel, wrong token, or old device generation changes no
state. Only hardware status = 0, QueueReady = 0, and a newer generation permit
`observe_reset` to clear live requests. The driver may return DMA frames to the
allocator after that observation and matching resets of its descriptor,
completion, index, and budget tables.

Local tests require an unanswered read to keep one live buffer at timeout,
and a completion after cancellation to be rejected without any partial state
change. K1515 must exercise a real guest MMIO device reset, compare frame counts
before acquisition and after release, and prove a later healthy read succeeds.