Harden desktop recovery and pre-release stability checks

Bound IPC transport deadlines while preserving portal leases, supervise desktop helper and agent recovery, and reserve final floating window geometry during placement.

Stabilize CLI output and isolated tests, expand workspace CI, resolve formatting and lint failures, and bundle the MIT license with installer compatibility.

docs/development.md

@@ -6,12 +6,21 @@ Install the [build dependencies](installation.md#requirements), then run:
 cargo build --release --locked --workspace
 cargo test --workspace --locked
 cargo fmt --all --check
+cargo clippy --workspace --all-targets --locked -- -D warnings
+cargo build --workspace --locked
+python3 -m unittest discover -s scripts/tests -v
 ```
 
 Use release builds for performance and animation checks. Preview changes in a
 [nested session](installation.md#preview-and-logs) before testing hardware behavior.
 Keep another desktop available for direct-session recovery.
 
+CI checks formatting, lints and tests across the whole workspace, including the
+shell, settings, portal and CLI. The Fedora workspace job also builds desktop
+binaries and runs installer, session-recovery and private portal-contract checks. The
+compositor job runs offscreen capture regressions with software Mesa. Opt-in
+nested and hardware checks remain separate.
+
 ## Test guides
 
 - [Desktop reconciliation](desktop-reconciliation.md): topology publication, hardware failure and presentation ownership.

docs/installation.md

@@ -199,6 +199,14 @@ For greetd, set this as the session command after authentication; see the [greet
 documentation](https://sr.ht/~kennylevinsen/greetd/). The launcher starts the
 compositor, shell and session services together.
 
+The session launcher supervises the desktop helper. If the shell exits, Ferese
+restarts the helper with fresh private Wayland connections after a delay of one
+second. Repeated failures increase that delay up to 30 seconds; a minute of
+uptime resets it. The polkit agent recovers independently, and shell recovery
+does not repeat desktop autostart. Compositor shutdown cancels pending restarts
+and stops the helper. Standalone clients passed to `ferese -- COMMAND` are only
+supervised when `--supervise-client` is explicitly supplied before `--`.
+
 ### From a TTY
 
 Log out of your graphical session and switch to a local console with **Ctrl+Alt+F2**, or

docs/ipc.md

@@ -76,6 +76,15 @@ Clients launched by a nested compositor inherit its `FERESE_SOCKET`, so
 `feresectl outputs` inside that session connects to that instance.
 `autostart` launches desktop entries locally and does not use IPC.
 
+## Connection lifetimes
+
+The server permits 64 simultaneous connections. A new connection must begin its
+first request within five seconds; each frame then has five seconds to finish.
+Ordinary connections close after 30 idle seconds and blocked response writes
+expire after two seconds. These bounds release slots held by stalled clients.
+Accepted portal leases remain connected while idle, and pending long polls and
+event subscriptions do not have the ordinary idle deadline.
+
 ## Follow changes
 
 ```sh