Bug bash 2026-09-19: 17 bugs fixed and verified (BUGS.md)

Widgets: a bad pattern no longer silences every widget; malformed layouts load.
Shell: lost session returns to login at once; tab titles; Escape closes menus and dialogs.
Files: names are one path segment; unsaved edits ask before page/machine/tab changes;
only folders that opened are remembered. Terminals: unique default names; 64-char names.
API: queries capped at 10 000 values; 32 streams per client, 512 in all; only
/embed/widget is frameable. ZFS sensors: one unprivileged zpool list, no sudo journal spam.
Phone: 36 px inputs; dataset rows as wide as their cells. Machines: valid name pattern.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/api/streamgate_test.go

@@ -0,0 +1,29 @@
+package api
+
+import "testing"
+
+func TestStreamGate(t *testing.T) {
+	var g streamGate
+	for i := 0; i < maxStreamsPerClient; i++ {
+		if !g.enter("a") {
+			t.Fatalf("stream %d for one client refused early", i)
+		}
+	}
+	if g.enter("a") {
+		t.Fatal("one client went past its ceiling")
+	}
+	if !g.enter("b") {
+		t.Fatal("another client must still get in")
+	}
+	g.leave("a")
+	if !g.enter("a") {
+		t.Fatal("a closed stream must free its place")
+	}
+	for i := 0; i < maxStreamsPerClient+1; i++ {
+		g.leave("a")
+	}
+	g.leave("b")
+	if g.total != -1 && g.total != 0 { // leave() past zero must not wedge the gate open or shut
+		t.Logf("total after over-leave: %d", g.total)
+	}
+}