test: harden malformed client handling

docs/ferese-window-manager-spec.md

@@ -1347,6 +1347,10 @@ Events include `window-opened`, `window-closed`, `window-focused`,
 Subscribers have bounded queues. The server MUST disconnect a subscriber whose
 queue overflows rather than block the compositor.
 
+The IPC server MUST bound concurrent connection workers as well as queued
+requests. Reaching either limit rejects the excess client without blocking the
+compositor event loop or allocating another worker thread.
+
 ## 14. Input
 
 Ferese MUST support click-to-focus, configurable focus-follows-pointer, floating

docs/native-soak-testing.md

@@ -2,9 +2,11 @@
 
 The M6 soak runner repeatedly creates and destroys native Wayland clients while
 exercising focus, resize, column width, fullscreen, floating, and workspace
-paths. Every tenth iteration also terminates a client abruptly. The runner
-checks that the compositor and authenticated IPC socket remain responsive and
-records compositor RSS growth.
+paths. Every tenth iteration also terminates a client abruptly and opens three
+isolated connections that send malformed Wayland messages. The runner requires
+Ferese to disconnect each malformed client and then checks that the compositor
+and authenticated IPC socket remain responsive. It also records compositor RSS
+growth.
 
 Build Ferese and `feresectl`, start the compositor, and run:
 
@@ -30,12 +32,24 @@ FERESE_SOAK_SECONDS=300 \
 ./scripts/soak-native.sh
 ```
 
+The malformed-client check can also be run independently against a disposable
+Ferese session:
+
+```bash
+WAYLAND_DISPLAY=wayland-1 cargo run -p ferese-malformed-client
+target/debug/feresectl get-outputs
+```
+
+Do not point the malformed-client probe at the host compositor socket.
+
 Environment controls:
 
 - `FERESE_SOAK_SECONDS`: run duration, default `86400`;
 - `FERESE_SOAK_DELAY`: delay between operations, default `0.15` seconds;
 - `FERESE_SOAK_CLIENT`: native client executable, default `foot`;
 - `FERESECTL`: path to `feresectl`, default `target/debug/feresectl`;
+- `FERESE_MALFORMED_CLIENT`: path to the malformed protocol probe, default
+  `target/debug/ferese-malformed-client`;
 - `FERESE_PID`: compositor PID; automatic lookup is only a fallback;
 - `FERESE_SOAK_LOG`: result log, default `/tmp/ferese-soak-<pid>.log`.