# Explicit read-only GPT recovery selection (K1536–K1540)

The recovery reader receives the physical disk capacity and the primary and
backup GPT headers. It borrows a read-only sector callback and publishes no
mount until every selected entry array sector passes CRC, range, overlap, and
entry-limit checks. It owns no DMA buffers and never writes or repairs media.

Two valid, mutually consistent GPT copies produce a `Healthy` mount. A primary
header with a bad signature or header CRC may be bypassed only when the
backup header is valid at the final LBA, its `AlternateLBA` points to LBA 1,
its bounded entry array lies between the last usable LBA and backup header,
and that array passes its CRC and every partition check. This produces a
`DegradedBackup` mount with the primary error retained in the published
status. The status must be visible to the guest acceptance log. The valid
backup remains the sole source of partition metadata; no primary bytes are
silently rewritten.

If both headers pass individually but disagree on disk GUID, usable range,
entry count, entry size, or entry-array CRC, return `InconsistentCopies`
before reading arrays or publishing a mount. A bad backup or unsupported
layout cannot be used as degraded evidence. A failed attempt leaves an
existing healthy mount and generation unchanged. A fresh state stays empty.

K1538 and K1539 require local tests for primary-bad/backup-valid selection,
explicit degraded status, a mutually inconsistent pair, backup CRC failure,
and transactional state. K1540 requires one product Image to read a real
read-only Virtio disk with a deliberately corrupt primary header and valid
backup array, report `DegradedBackup`, prove no disk write or DMA leak, and
measure direct and UEFI boots at 256, 512, and 1024 MiB.

Format and recovery reference: UEFI Specification 2.10, section 5.3:
https://uefi.org/specs/UEFI/2.10/05_GUID_Partition_Table_Format.html