# Virtio status lifecycle contract (K1476–K1480)

This transport-neutral model follows [Virtio 1.3, sections 2.1, 2.4 and 3.1](https://docs.oasis-open.org/virtio/virtio/v1.3/virtio-v1.3.html). A validated MMIO v2 or PCI common configuration owner supplies physical status and queue-enable readbacks.

- A generation-tagged claim starts only after device status and queue enable are both observed as zero. It advances through ACKNOWLEDGE (`1`), DRIVER (`3`), FEATURES_OK (`0xb`), and DRIVER_OK (`0xf`). Each write preserves all earlier driver status bits; the model never authorizes a bit-clearing write except reset to zero.
- The FEATURES_OK readback must retain that bit. A rejected status write moves the claim to recovery; the caller cannot continue initialization from an uncertain physical state.
- Queue memory may be marked live after FEATURES_OK and before DRIVER_OK. DRIVER_OK requires an observed enabled queue. The driver may set FAILED without clearing earlier bits. A device-observed DEVICE_NEEDS_RESET forces recovery; neither path permits more initialization or release before physical reset.
- Reset completion requires observed status zero **and** queue enable zero. Only then may queue memory and the status claim be released. A stale generation cannot operate on a later claim. Invalid local calls leave the snapshot unchanged.
- The local model records ordered status readbacks and ownership; it cannot prove physical register access or DMA quiescence. K1480 requires six direct and UEFI development guests at 256, 512 and 1024 MiB to show live status, a forced FAILED or DEVICE_NEEDS_RESET recovery path, reset readbacks, returned queue frames and released ownership. Product release acceptance remains separate.