establishment: block stops being a name, and enumerate learns to page

P2 of docs/establishment-planes-plan.md. usb-storage serves nameless — one
process per stick cannot share an exclusive bind, and a second stick used to
die silently on -EBUSY before ever helloing. Its one hello now moves both
directions at once: the block-serving endpoint up, its controller channel
down. fat finds its volume through the manager — a new `.consumer` role asks
for the channel of the driver BOUND TO a device (distinct from the device's
reporter), found by enumerating the tree for the mass-storage identity.
fat stays single-volume; the boot-volume-by-content choice is M21.

The conversion immediately caught a live truncation of exactly the audit's
shape: ChildEntry grew to 32 bytes, one enumerate reply holds ~7, and a real
tree carries a dozen ACPI nodes before the first USB child — the storage
entry silently never fit (the protocol comment already said "paging joins
the protocol if a tree ever outgrows one packet"). enumerate is now paged:
Header.target is the start cursor, a short page is the end; device-list's
page-0 read is unchanged.

Grant rows move with the code: the block bind and fat's block open die, fat
gains open device-manager. Gate: 18 cases green including the registry
trio, device-list, and both IOMMU storage variants.

system/services/fat/build.zig

@@ -10,8 +10,10 @@ pub fn build(b: *std.Build) void {
         .name = "fat",
         .root_source_file = b.path("fat.zig"),
         .imports = &.{
-            "block",   "envelope", "file-system", "ipc",  "logging", "memory", "process",
-            "service", "time",     "vfs-protocol",
+            "block",                    "channel", "device-manager-protocol", "driver",
+            "envelope",                 "file-system", "ipc",                 "logging",
+            "memory",                   "process", "service",                 "time",
+            "vfs-protocol",
         },
     });
     b.installArtifact(exe);

system/services/fat/fat.zig

@@ -10,6 +10,9 @@
 //! it.
 
 const std = @import("std");
+const channel = @import("channel");
+const device_manager_protocol = @import("device-manager-protocol");
+const driver = @import("driver");
 const ipc = @import("ipc");
 const process = @import("process");
 const service = @import("service");
@@ -116,6 +119,56 @@ const mount_retry_ms = 500;
 
 var mounted = false;
 var service_endpoint: ipc.Handle = 0;
+/// The one channel to the device manager, opened on first need and kept — the
+/// poll retries on it, never spending a handle-table slot per attempt.
+var manager_handle: ?ipc.Handle = null;
+
+/// Find the volume's provider through the device manager (establishment by
+/// lineage, communication.md "Establishment: two planes" — `block` is not a
+/// registry name; one storage process serves each stick): enumerate the
+/// manager's tree, take the FIRST usb mass-storage child by enumeration order
+/// (deterministic within a boot; single-volume by construction, and choosing
+/// the BOOT volume by content when two sticks are present is the M21 remount
+/// track), and consumer-hello for the channel of the driver bound to it.
+/// Null until the chain is up — the caller's poll retries.
+fn acquireVolume() ?block.Device {
+    const manager = manager_handle orelse opened: {
+        const handle = channel.openEndpoint("device-manager") orelse return null;
+        manager_handle = handle;
+        break :opened handle;
+    };
+
+    // The envelope's reserved `enumerate` verb, PAGED: one reply carries only
+    // a handful of entries and a real tree (a dozen ACPI nodes before the
+    // first USB child) is bigger, so `Header.target` is the start cursor and
+    // a short page is the end. Identity is the bus's native triple, for USB
+    // (base << 16) | (class << 8) | protocol — mass storage is base 0x08,
+    // subclass 0x06 (SCSI transparent), the same key devices.csv matches on.
+    const Entry = device_manager_protocol.ChildEntry;
+    var start: u64 = 0;
+    while (true) {
+        const enumerate = envelope.Header{ .operation = envelope.operation_enumerate, .target = start };
+        var reply: [device_manager_protocol.message_maximum]u8 = undefined;
+        const length = ipc.call(manager, std.mem.asBytes(&enumerate), &reply) catch return null;
+        const status = envelope.statusOf(reply[0..length]) orelse return null;
+        if (status.status != 0) return null;
+
+        const carried = @min(@as(usize, status.len), length -| envelope.prefix_size);
+        const tail = reply[envelope.prefix_size..][0..carried];
+        const count = tail.len / @sizeOf(Entry);
+        if (count == 0) return null; // the tree is exhausted; no volume yet
+        var index: usize = 0;
+        while (index < count) : (index += 1) {
+            const entry = std.mem.bytesToValue(Entry, tail[index * @sizeOf(Entry) ..][0..@sizeOf(Entry)]);
+            if (entry.device_id == device_manager_protocol.no_device) continue;
+            if ((entry.identity >> 16) & 0xff != 0x08 or (entry.identity >> 8) & 0xff != 0x06) continue;
+            const exchanged = driver.helloOn(manager, .consumer, entry.device_id, null, true) orelse return null;
+            const provider = exchanged.channel orelse continue; // its driver not up yet — next tick
+            return .{ .endpoint = provider };
+        }
+        start += count;
+    }
+}
 
 fn initialise(endpoint: ipc.Handle) bool {
     service_endpoint = endpoint;
@@ -133,7 +186,7 @@ fn initialise(endpoint: ipc.Handle) bool {
 /// `mounted` on success; a failure leaves everything untouched for the next tick.
 fn tryBringUp() void {
     if (mounted) return;
-    const device = block.tryOpen() orelse return;
+    const device = acquireVolume() orelse return;
     const geometry = device.geometry() orelse {
         _ = logging.write("/system/services/fat: block geometry unavailable\n");
         return;