Isolate nested IPC sockets and define session ownership policy

docs/installation.md

@@ -242,12 +242,20 @@ authentication, idle locking and limits.
 
 ## Preview and logs
 
+`ferese` selects a nested window when `WAYLAND_DISPLAY` or `DISPLAY` is set,
+and DRM otherwise. Nested instances have separate control sockets. Clients
+launched by Ferese inherit that instance’s `FERESE_SOCKET`. Use
+`--backend=nested` or `--backend=drm` to override detection.
+
+Nested previews leave the host activation environment and session target alone.
+They skip XDG autostart and run configured autostart entries only with `nested true`.
+
 To preview a source build before installing, run these commands from the checkout
 inside an existing Wayland desktop:
 
 ```sh
 cargo build --release --locked -p ferese -p ferese-shell -p ferese-settings -p feresectl -p ferese-lock -p xdg-desktop-portal-ferese
-FERESE_ENABLE_SCREENCOPY=1 target/release/ferese --backend nested \
+FERESE_ENABLE_SCREENCOPY=1 target/release/ferese \
   --grant-effects --grant-shell-control -- \
   target/release/ferese-shell
 ```

docs/ipc.md

@@ -45,19 +45,26 @@ its target in this order:
 3. `$XDG_RUNTIME_DIR/ferese/control.sock`
 
 ```sh
-feresectl --socket /tmp/ferese-preview/ferese/control.sock outputs
-FERESE_SOCKET=/tmp/ferese-preview/ferese/control.sock feresectl theme get -j
+feresectl --socket "$XDG_RUNTIME_DIR/ferese/instances/12345-abcdef/control.sock" outputs
+FERESE_SOCKET="$XDG_RUNTIME_DIR/ferese/instances/12345-abcdef/control.sock" feresectl theme get -j
 ```
 
 `--socket` selects an existing server; it does not create one or change where the
-compositor listens. A nested compositor uses its own runtime directory.
+compositor listens. DRM uses `$XDG_RUNTIME_DIR/ferese/control.sock`. Nested
+instances use `$XDG_RUNTIME_DIR/ferese/instances/<id>/control.sock`; copy the
+actual path from the compositor's startup log. Each instance removes its own
+socket and directory on normal shutdown. A forced kill can leave the directory
+behind; later instances allocate a different one.
+
+Clients launched by a nested compositor inherit its `FERESE_SOCKET`, so
+`feresectl outputs` inside that session connects to that instance.
 `autostart` launches desktop entries locally and does not use IPC.
 
 ## Follow changes
 
 ```sh
 feresectl event-stream
-feresectl --socket /tmp/ferese-preview/ferese/control.sock event-stream
+feresectl --socket "$XDG_RUNTIME_DIR/ferese/instances/12345-abcdef/control.sock" event-stream
 ```
 
 `event-stream` writes one JSON value per line and flushes each line. It always