fix: pm running apps grow (death-bit bound 60); spawntest stress: 30 files open, apps until BUSY then room comes back; docs: limits and why

docs/ipc.md

@@ -365,6 +365,30 @@ registers are saved when a trap finds them changed and loaded whenever it
 runs; a thread without them runs with the FPU off, so it can never read
 another's. The kernel itself never uses the FPU.
 
+## Limits
+
+What is fixed, and why (the rest grows with the server's memory):
+
+- **Kernel tables** (a kernel without a heap): processes 64, threads 256
+  (4 a process), endpoints 256, notifications 128, regions 256, 255
+  capability slots a process (`CapSlot`, a byte with room for
+  `start_arg`'s plus one). Kani proves the same code with tiny tables.
+- **What owns a big resource is counted by it**: a window is a pixel
+  buffer of the display's (`types::display::window::MAX_WINDOWS`, 8), a
+  storage connection a buffer of storage's (`types::storage::MAX_CLIENTS`,
+  16); those budgets are computed from the counts, in one place, and the
+  address layouts are checked against them when built.
+- **Bits**: init has a death bit per spawned child (16) and per supervised
+  program; the permission manager one per running app (60); both are
+  checked when built.
+- **Grown, not counted**: storage's handles, open files and grants, the
+  permission manager's running apps. They stop where the server's memory
+  or its spawn allowance does, and say so: storage answers `FULL`, init
+  `STORAGE_BUSY`, the permission manager `BUSY`.
+
+The self-test pushes past the old counts (30 files open, as many apps as
+the allowance holds, a stack overflow), so a regression shows.
+
 ## Budgets
 
 Every process has a budget: frames (its pages, page tables and regions'