Bug bash 2026-09-19: 17 bugs fixed and verified (BUGS.md)

Widgets: a bad pattern no longer silences every widget; malformed layouts load.
Shell: lost session returns to login at once; tab titles; Escape closes menus and dialogs.
Files: names are one path segment; unsaved edits ask before page/machine/tab changes;
only folders that opened are remembered. Terminals: unique default names; 64-char names.
API: queries capped at 10 000 values; 32 streams per client, 512 in all; only
/embed/widget is frameable. ZFS sensors: one unprivileged zpool list, no sudo journal spam.
Phone: 36 px inputs; dataset rows as wide as their cells. Machines: valid name pattern.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

web/src/api.ts

@@ -38,6 +38,9 @@ async function req<T>(method: string, path: string, body?: unknown, local = fals
   track(-1)
   if (r.status === 502 && mach) downUntil[mach] = Date.now() + 5000
   if (r.status === 401) {
+    // The hub itself said no: the session is gone. (A 401 relayed from a managed machine is that
+    // machine rejecting the hub, which is not ours to fix by logging in again.)
+    if (!mach && target !== '/api/login') window.dispatchEvent(new Event('hamlab:unauthenticated'))
     let msg = 'unauthenticated'
     try { msg = (await r.json()).error ?? msg } catch { /* ignore */ }
     throw new Unauthenticated(msg)