The flip: PCI enumeration leaves the kernel (M19.3)

enumeratePci, addBars, pciConfigurationPtr, and the PciHeader struct are
deleted; the kernel seeds only the host bridge, and the ring-3 pci-bus
driver's reports are the sole source of PCI function nodes. The manager
matches PCI drivers from reported identity, deduped by registered device
id so a bus restart never double-spawns.

The flip did its job by exposing a latent SMP race: ring-3
device_register made the broker table concurrent for the first time, and
mmio_map read it lock-free — under load a torn resource length mapped
hpet's window wrong (its user fault) and underflowed r.len-1 into a
kernel integer-overflow panic. Fixed: the broker read in mmio_map (and
claim) runs under the big kernel lock, the arithmetic rejects
zero-length and wrapping windows cleanly, and pci-bus no longer registers
unimplemented size-0 BARs. driver-restart hammered 6x, suite 55/55.

docs/discovery.md

@@ -167,3 +167,13 @@ free; discovery on x86 is partly about *finding* what ARM just tells you.
 - [ipc.md](ipc.md) — the channels that interrupts-as-messages and the device manager
   will ride on.
 - [vision.md](vision.md) — why drivers belong in isolated user space at all.
+
+## Update (M19.3, 2026-07-13): PCI enumeration left the kernel
+
+The kernel now seeds only the `pci_host_bridge` node (ECAM window, MMIO
+apertures derived from the memory map's holes, bus range, and the 16-bit I/O
+window). The per-function walk moved to the ring-3 `pci-bus` driver
+([device-manager.md](device-manager.md)): it claims the bridge, repeats the
+ECAM scan through its mmio grant, and `device_register`s what it finds, which
+the device manager mirrors and matches. The ACPI namespace walk follows in M20;
+the static tables (MADT, HPET, MCFG, FADT + `\\_S5`) stay kernel-side.

docs/m19-m20-plan.md

@@ -96,11 +96,15 @@ branch is green; keep branches; push everything.
       and asserts the PCI node count never grows — plus harness hardening: a
       failing case now preserves its serial as <case>-failed-serial.log, and
       the heavy scenarios run at 150s; suite 55/55).
-- [ ] **M19.3** — the flip: kernel `enumeratePci` call removed (bridge node
-      stays); manager matches PCI drivers from reports. One commit. The
-      existing xHCI scenarios (`driver-restart`, `usb-report`, `device-list`)
-      are the assertion — xhci must come up spawned off a pci-bus report, and
-      the suite must not be able to tell the difference. discovery.md updated.
+- [x] **M19.3** — the flip: kernel `enumeratePci`/`addBars`/`PciHeader` all
+      deleted (bridge node stays); manager matches PCI drivers from reported
+      identity, deduped by registered id. Surfaced and fixed a real SMP race the
+      flip created — ring-3 device_register made the broker table concurrent, so
+      mmio_map's lock-free read intermittently tore hpet's resource length
+      (user fault) and overflowed `r.len-1` into a kernel panic; now the broker
+      read is under the big lock and the arithmetic is guarded, and pci-bus
+      skips size-0 BARs. discovery.md updated; suite 55/55 (driver-restart
+      hammered 6×).
 - [ ] **merge** `feat/pci-bus` → main, push.
 - [ ] **M20.1** — acpi service, parse only (fills the existing placeholder at
       system/services/acpi/acpi.zig): kernel publishes `acpi-tables`