# Bounded, read-only GPT contract (K1526–K1530)

The first GPT implementation accepts 512-byte logical sectors. The caller
supplies the physical device capacity, the primary header from LBA 1, the
backup header from the last LBA, and each header's entry-array bytes. The
caller owns all block/DMA buffers; the parser borrows them and performs no
disk writes. A protective MBR and non-512-byte sector support are separate
device-discovery concerns and are not claimed by this parser.

Both headers must identify GPT revision 1.0, have a size from 92 to 512 bytes,
have zero reserved bytes, and have a valid IEEE CRC-32 computed across the
declared header size with its CRC field zeroed. Their `MyLBA` and
`AlternateLBA` fields must point to LBA 1 and the last device LBA in opposite
directions. The disk GUID, usable LBA range, entry count, entry size, and
entry-array CRC must agree. The primary entry array lies after LBA 1 and
before the first usable LBA; the backup array lies after the last usable LBA
and before the backup header. Arithmetic is checked before slicing or reading.

The first supported layout has exactly 128 entries of 128 bytes, occupying
32 sectors per copy. This provides the GPT minimum 16 KiB entry-array space
while bounding memory and disk reads. Any other count or size, including an
oversized entry count, returns `UnsupportedLayout` before an entry-array read.
The CRC covers exactly the 16 KiB entry array. Active entries have nonzero
type and unique GUIDs, an inclusive LBA range within the common usable range,
and no pairwise overlap. Empty entries have a zero type GUID. A bounded
published table may contain at most 16 active partitions; excess active
partitions return `TooManyPartitions` without publication.

The result is either a complete validated table or an explicit error. The
mount state changes only after both headers, both entry arrays, and all
partition ranges pass validation and the generation increment succeeds.
Malformed CRC, size, entry count, range, or inconsistent primary/backup data
leaves the previous mount unchanged. There is no repair or write path. A
future recovery policy for a valid single GPT copy requires its own contract
and guest evidence.

K1528 and K1529 require positive primary/backup fixtures and negative CRC,
oversized-count, and transactional-mount assertions. K1530 requires the same
product Image to read a real disk through Virtio, report an explicit parser
refusal for corrupt metadata, show no disk write, return ownership, and pass
direct and UEFI boot at 256, 512, and 1024 MiB with serial and QMP evidence.

Format reference: UEFI Specification 2.10, section 5.3, GUID Partition Table
Disk Layout: https://uefi.org/specs/UEFI/2.10/05_GUID_Partition_Table_Format.html