The application surface: enumerate, subscribe, and device-list (M18.3)

Applications ask the device manager for the tree (enumerate: a header
plus ChildEntry records) and subscribe to published add/remove events by
handing their endpoint over as the call's capability — the input-service
pattern; events are the same ChildAdded/ChildRemoved structs the bus
drivers send, one encoding in both directions. device-list is the first
client: it prints the tree, subscribes, and narrates the events through
a driver restart. The protocol's message maximum is capped at the
kernel's IPC MESSAGE_MAXIMUM (256 bytes, ten entries per reply; paging
joins the protocol when a tree outgrows one message). The startUserTask
debug print is gone: it wrote to serial unserialized against user-space
lines and sheared concurrent log markers in half — the root cause of the
scenario flakes.

docs/device-manager.md

@@ -7,8 +7,10 @@ cap are in — usb-xhci-bus is the first conforming driver, and the
 Tree reports are built too (M18.2, 2026-07-13): the xHCI driver scans its
 root-hub ports and reports each connected device (`child_added`); the manager
 mirrors them and prunes a dead reporter's children, and the `usb-report`
-scenario proves report → prune → respawn → re-report. The application surface
-(M18.3) remains design. The primitives underneath are real ([process-management.md](process-management.md):
+scenario proves report → prune → respawn → re-report. The application surface is built (M18.3, 2026-07-13):
+`enumerate` and `subscribe` over IPC, with `device-list` as the first client —
+the manager is now the one answer to "what devices exist" for applications.
+The primitives underneath are real ([process-management.md](process-management.md):
 spawn/supervise/kill/exit-notification; [driver-model.md](driver-model.md): the device
 table as a capability system; [drivers.md](drivers.md): claim/map/IRQ), and the first
 per-device driver spawn works (the device manager matches the xHCI controller by PCI

docs/m17-m18-plan.md

@@ -58,7 +58,12 @@ only when its definition of green holds.
       register BAR — resource 0 is ECAM — reads CAPLENGTH/HCSPARAMS1, scans
       PORTSC, reports connected ports with speed-class identity; `usb-report`
       scenario proves report → prune → respawn → re-report; suite 53/53)
-- [ ] **M18.3** — app surface: enumerate/subscribe + device-list
+- [x] **M18.3** — app surface: enumerate/subscribe over IPC (subscriber
+      endpoint rides as the call's capability; events are the same structs the
+      buses send); device-list first client; protocol capped at the kernel's
+      IPC MESSAGE_MAXIMUM (256); the startUserTask debug print removed — it
+      sheared concurrent serial lines and was the scenario-flake root cause;
+      `device-list` scenario; suite 54/54)
 - [ ] **merge** `feat/usb-xhci-bus` → main, push — **loop ends here**
 
 ---