Bug bash 2026-09-19: 17 bugs fixed and verified (BUGS.md)

Widgets: a bad pattern no longer silences every widget; malformed layouts load.
Shell: lost session returns to login at once; tab titles; Escape closes menus and dialogs.
Files: names are one path segment; unsaved edits ask before page/machine/tab changes;
only folders that opened are remembered. Terminals: unique default names; 64-char names.
API: queries capped at 10 000 values; 32 streams per client, 512 in all; only
/embed/widget is frameable. ZFS sensors: one unprivileged zpool list, no sudo journal spam.
Phone: 36 px inputs; dataset rows as wide as their cells. Machines: valid name pattern.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/sensors/sensors_test.go

@@ -75,3 +75,21 @@ func TestWriteProm(t *testing.T) {
 		}
 	}
 }
+
+func TestShapeBudget(t *testing.T) {
+	all := make([]Sensor, 300)
+	for i := range all {
+		all[i] = Sensor{ID: "s." + strings.Repeat("x", i%7) + string(rune('a'+i%26)) + strings.Repeat("y", i/26), Value: 1.0}
+	}
+	q := map[string]string{}
+	for i := 0; i < 40; i++ { // 40 × 300 = 12 000 values
+		q["k"+strings.Repeat("z", i)] = "*"
+	}
+	b, _ := json.Marshal(q)
+	if _, err := Shape(all, b, false); err == nil {
+		t.Fatal("a query returning more than MaxValues must be refused")
+	}
+	if _, err := Shape(all, json.RawMessage(`{"a":"*","b":"*"}`), false); err != nil {
+		t.Fatalf("an ordinary query must pass: %v", err)
+	}
+}