The acpi service evaluates _CRS/_STA in ring 3 and reports devices (M20.2)

AML method evaluation now runs in userspace touching real hardware: the
service builds an interpreter with a ring-3 Hal (port I/O routed through
its claimed acpi-tables node; a scratch page backs SystemMemory maps so a
stray OperationRegion degrades to zeros instead of faulting a process
that cannot map arbitrary physical memory). It walks the namespace and,
for each present _HID device that is not a PCI root, evaluates _CRS,
registers it under acpi-tables, and reports it with its EISA-decoded hid.

Containment for this needed the broker's irq check to become range-based
— an interrupt line is still indivisible, but a parent may own a range,
so the acpi-tables node's broad irq window contains its children's legacy
lines (a length-1 range is exactly the old equality, so single-irq
parents are unaffected). ChildAdded gained a hid field for firmware
string identity. Matching those reports to drivers stays off until M20.3,
so ps2-bus still comes up via the kernel path — no regression. The
acpi-report scenario proves the PS/2 keyboard (io 0x60/0x64 + IRQ) and
mouse (IRQ) are reported with their resources. Suite 57/57.

docs/m19-m20-plan.md

@@ -114,11 +114,15 @@ branch is green; keep branches; push everything.
       deterministic via argv, no log-scraping); the manager spawns `discovery`
       at startup. Parse-only touches no hardware. Suite 56/56.
 
-- [ ] **M20.2** — register + report: namespace devices with `_HID` + `_CRS`
-      resources registered under `acpi-tables` (its io_port + the memory-map
-      holes give containment), reported to the manager. Spawn-from-reports for
-      ACPI matches stays off. Scenario: the reported set includes the PS/2
-      keyboard and mouse nodes with their IRQ resources.
+- [x] **M20.2** — register + report: the service evaluates `_STA`/`_CRS` in
+      ring 3 (interpreter Hal = port I/O over the claimed node; a scratch page
+      backs SystemMemory maps so a stray region can't fault it) and registers +
+      reports each present `_HID` device under `acpi-tables`. Containment: the
+      broker's irq check became range-based (len-1 == the old equality) so the
+      node's broad irq window covers children's legacy lines; io ports fall in
+      the broad io grant. ChildAdded gained `hid`. Matching stays off. The
+      `acpi-report` scenario asserts the PS/2 keyboard (3 resources) and mouse
+      (1 resource) among the reports. Suite 57/57.
 - [ ] **M20.3** — the flip: kernel DSDT device-node building removed (static
       tables + `\_S5` stay, decision 1); manager matches ACPI-hid drivers
       (ps2-bus) from reports. The `input` and `device-manager` scenarios are