diff --git a/README.md b/README.md
index 87004ca..50ef022 100644
--- a/README.md
+++ b/README.md
@@ -301,7 +301,7 @@ Production uses `workers=1` (PTY state is process-local), `threads=16` (concurre
 <summary><strong>📁 Project Structure</strong></summary>
 
 ```
-coding-agents-in-databricks/
+coding-agents-databricks-apps/
 ├── app.py                       # Flask backend + PTY management + setup orchestration
 ├── app_state.py                 # Shared app state (setup progress, session registry)
 ├── app.yaml.template            # Databricks Apps deployment config template
diff --git a/app.py b/app.py
index 514c4bc..71ac4f4 100644
--- a/app.py
+++ b/app.py
@@ -43,6 +43,7 @@
 SESSION_TIMEOUT_SECONDS = 86400      # No poll for 24 hours = dead session
 CLEANUP_INTERVAL_SECONDS = 900       # Check for stale sessions every 15 min
 GRACEFUL_SHUTDOWN_WAIT = 3          # Seconds to wait after SIGHUP before SIGKILL
+MAX_CONCURRENT_SESSIONS = int(os.environ.get("MAX_CONCURRENT_SESSIONS", "5"))
 
 # Logging setup
 logging.basicConfig(level=logging.INFO)
@@ -604,7 +605,7 @@ def read_pty_output(session_id, fd):
         try:
             readable, _, errors = select.select([fd], [], [fd], 0.05)
             if readable or errors:
-                output = os.read(fd, 4096)
+                output = os.read(fd, 65536)
                 if not output:
                     # EOF — process exited
                     break
@@ -956,6 +957,11 @@ def configure_pat():
 @app.route("/api/session", methods=["POST"])
 def create_session():
     """Create a new terminal session."""
+    # Quick reject before forking a PTY (approximate — authoritative check below)
+    with sessions_lock:
+        if len(sessions) >= MAX_CONCURRENT_SESSIONS:
+            return jsonify({"error": f"Maximum {MAX_CONCURRENT_SESSIONS} concurrent sessions reached. Close an existing session first."}), 429
+
     data = request.get_json(silent=True) or {}
     label = data.get("label", "")
     try:
@@ -997,6 +1003,15 @@ def create_session():
         session_id = str(uuid.uuid4())
 
         with sessions_lock:
+            # Authoritative check under the same lock as insertion — prevents
+            # TOCTOU race where two concurrent requests both pass the early check.
+            if len(sessions) >= MAX_CONCURRENT_SESSIONS:
+                os.close(master_fd)
+                try:
+                    os.kill(pid, signal.SIGKILL)
+                except OSError:
+                    pass
+                return jsonify({"error": f"Maximum {MAX_CONCURRENT_SESSIONS} concurrent sessions reached. Close an existing session first."}), 429
             sessions[session_id] = {
                 "master_fd": master_fd,
                 "pid": pid,
diff --git a/app.yaml b/app.yaml
index e6bb8cd..5596e08 100644
--- a/app.yaml
+++ b/app.yaml
@@ -12,3 +12,5 @@ env:
     value: databricks-gpt-5-3-codex
   - name: CLAUDE_CODE_DISABLE_AUTO_MEMORY
     value: 0
+  - name: MAX_CONCURRENT_SESSIONS
+    value: "5"
diff --git a/docs/deployment.md b/docs/deployment.md
index 09959da..36267c6 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -11,7 +11,7 @@ The simplest way — no CLI, no cloning, everything stays in the Databricks UI.
 1. Go to **Databricks → Apps → Create App**
 2. Choose **Custom App** and connect this Git repo:
    ```
-   https://github.com/datasciencemonkey/coding-agents-in-databricks.git
+   https://github.com/datasciencemonkey/coding-agents-databricks-apps.git
    ```
 3. Click **Deploy**
 4. Open the app — on first terminal session, paste a short-lived PAT when prompted
@@ -30,8 +30,8 @@ If you prefer working from the terminal or need more control:
 
 ```bash
 databricks repos create \
-  --url https://github.com/datasciencemonkey/coding-agents-in-databricks.git \
-  --path /Workspace/Users/<your-email>/apps/coding-agents-in-databricks
+  --url https://github.com/datasciencemonkey/coding-agents-databricks-apps.git \
+  --path /Workspace/Users/<your-email>/apps/coding-agents-databricks-apps
 ```
 
 ### 2. Configure `app.yaml`
@@ -56,7 +56,7 @@ No secrets or resources to configure. On first terminal session, paste a short-l
 
 ```bash
 databricks apps deploy <your-app-name> \
-  --source-code-path /Workspace/Users/<your-email>/apps/coding-agents-in-databricks
+  --source-code-path /Workspace/Users/<your-email>/apps/coding-agents-databricks-apps
 ```
 
 > **Tip:** To update later, just `git pull` in the workspace repo and re-deploy.
diff --git a/pyproject.toml b/pyproject.toml
index 02cb9ca..774238c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "coda"
-version = "0.16.7"
+version = "0.17.0"
 description = "CoDA - Coding Agents on Databricks Apps"
 requires-python = ">=3.10"
 dependencies = [
@@ -9,8 +9,7 @@ dependencies = [
     "simple-websocket>=1.0",
     "claude-agent-sdk",
     "databricks-sdk>=0.20.0",
-    "mlflow-tracing>=3.4",
-    "opentelemetry-exporter-otlp-proto-grpc",
+    "mlflow-skinny==3.10.1",
     "requests",
     "cryptography>=46.0.6",
 ]
diff --git a/requirements.txt b/requirements.txt
index b7f405c..46f445a 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,5 +1,7 @@
 # This file was autogenerated by uv via the following command:
 #    uv pip compile pyproject.toml -o requirements.txt
+annotated-doc==0.0.4
+    # via fastapi
 annotated-types==0.7.0
     # via pydantic
 anyio==4.13.0
@@ -20,7 +22,7 @@ blinker==1.9.0
     #   flask
     #   flask-socketio
 cachetools==7.0.5
-    # via mlflow-tracing
+    # via mlflow-skinny
 certifi==2026.2.25
     # via
     #   httpcore
@@ -36,7 +38,10 @@ click==8.3.1
     # via
     #   flask
     #   flask-socketio
+    #   mlflow-skinny
     #   uvicorn
+cloudpickle==3.1.2
+    # via mlflow-skinny
 cryptography==46.0.6
     # via
     #   coda (pyproject.toml)
@@ -45,19 +50,21 @@ cryptography==46.0.6
 databricks-sdk==0.102.0
     # via
     #   coda (pyproject.toml)
-    #   mlflow-tracing
+    #   mlflow-skinny
+fastapi==0.135.3
+    # via mlflow-skinny
 flask==3.1.3
     # via
     #   coda (pyproject.toml)
     #   flask-socketio
 flask-socketio==5.6.1
     # via coda (pyproject.toml)
+gitdb==4.0.12
+    # via gitpython
+gitpython==3.1.46
+    # via mlflow-skinny
 google-auth==2.49.1
     # via databricks-sdk
-googleapis-common-protos==1.73.1
-    # via opentelemetry-exporter-otlp-proto-grpc
-grpcio==1.80.0
-    # via opentelemetry-exporter-otlp-proto-grpc
 h11==0.16.0
     # via
     #   httpcore
@@ -75,7 +82,9 @@ idna==3.11
     #   httpx
     #   requests
 importlib-metadata==8.7.1
-    # via opentelemetry-api
+    # via
+    #   mlflow-skinny
+    #   opentelemetry-api
 itsdangerous==2.2.0
     # via flask
 jinja2==3.1.6
@@ -93,36 +102,25 @@ markupsafe==3.0.3
     #   werkzeug
 mcp==1.26.0
     # via claude-agent-sdk
-mlflow-tracing==3.10.1
+mlflow-skinny==3.10.1
     # via coda (pyproject.toml)
 opentelemetry-api==1.40.0
     # via
-    #   mlflow-tracing
-    #   opentelemetry-exporter-otlp-proto-grpc
+    #   mlflow-skinny
     #   opentelemetry-sdk
     #   opentelemetry-semantic-conventions
-opentelemetry-exporter-otlp-proto-common==1.40.0
-    # via opentelemetry-exporter-otlp-proto-grpc
-opentelemetry-exporter-otlp-proto-grpc==1.40.0
-    # via coda (pyproject.toml)
 opentelemetry-proto==1.40.0
-    # via
-    #   mlflow-tracing
-    #   opentelemetry-exporter-otlp-proto-common
-    #   opentelemetry-exporter-otlp-proto-grpc
+    # via mlflow-skinny
 opentelemetry-sdk==1.40.0
-    # via
-    #   mlflow-tracing
-    #   opentelemetry-exporter-otlp-proto-grpc
+    # via mlflow-skinny
 opentelemetry-semantic-conventions==0.61b0
     # via opentelemetry-sdk
 packaging==26.0
-    # via mlflow-tracing
+    # via mlflow-skinny
 protobuf==6.33.6
     # via
     #   databricks-sdk
-    #   googleapis-common-protos
-    #   mlflow-tracing
+    #   mlflow-skinny
     #   opentelemetry-proto
 pyasn1==0.6.3
     # via pyasn1-modules
@@ -132,8 +130,9 @@ pycparser==3.0
     # via cffi
 pydantic==2.12.5
     # via
+    #   fastapi
     #   mcp
-    #   mlflow-tracing
+    #   mlflow-skinny
     #   pydantic-settings
 pydantic-core==2.41.5
     # via pydantic
@@ -142,13 +141,17 @@ pydantic-settings==2.13.1
 pyjwt==2.12.1
     # via mcp
 python-dotenv==1.2.2
-    # via pydantic-settings
+    # via
+    #   mlflow-skinny
+    #   pydantic-settings
 python-engineio==4.13.1
     # via python-socketio
 python-multipart==0.0.22
     # via mcp
 python-socketio==5.16.1
     # via flask-socketio
+pyyaml==6.0.3
+    # via mlflow-skinny
 referencing==0.37.0
     # via
     #   jsonschema
@@ -157,6 +160,7 @@ requests @ git+https://github.com/psf/requests@bc04dfd6dad4cb02cd92f5daa81eb562d
     # via
     #   coda (pyproject.toml)
     #   databricks-sdk
+    #   mlflow-skinny
 rpds-py==0.30.0
     # via
     #   jsonschema
@@ -165,19 +169,24 @@ simple-websocket==1.1.0
     # via
     #   coda (pyproject.toml)
     #   python-engineio
+smmap==5.0.3
+    # via gitdb
+sqlparse==0.5.5
+    # via mlflow-skinny
 sse-starlette==3.3.4
     # via mcp
 starlette==1.0.0
     # via
+    #   fastapi
     #   mcp
     #   sse-starlette
 typing-extensions==4.15.0
     # via
     #   anyio
-    #   grpcio
+    #   fastapi
     #   mcp
+    #   mlflow-skinny
     #   opentelemetry-api
-    #   opentelemetry-exporter-otlp-proto-grpc
     #   opentelemetry-sdk
     #   opentelemetry-semantic-conventions
     #   pydantic
@@ -187,13 +196,16 @@ typing-extensions==4.15.0
     #   typing-inspection
 typing-inspection==0.4.2
     # via
+    #   fastapi
     #   mcp
     #   pydantic
     #   pydantic-settings
 urllib3==2.6.3
     # via requests
 uvicorn==0.42.0
-    # via mcp
+    # via
+    #   mcp
+    #   mlflow-skinny
 werkzeug==3.1.7
     # via
     #   flask
diff --git a/static/index.html b/static/index.html
index bb7eecf..d27965e 100644
--- a/static/index.html
+++ b/static/index.html
@@ -142,6 +142,11 @@
       border-color: rgba(100,150,255,0.25);
       box-shadow: 0 0 8px rgba(100,150,255,0.1);
     }
+    #session-count-label {
+      margin-left: auto; padding: 0 12px;
+      font-size: 11px; color: rgba(255,255,255,0.4);
+      white-space: nowrap; flex-shrink: 0;
+    }
     #toolbar .font-size-row {
       display: flex; align-items: center; gap: 4px;
     }
@@ -375,6 +380,7 @@ <h3>General</h3>
 
   <div id="tab-bar">
     <button id="new-tab-btn" title="New tab (Ctrl+Shift+T)">+</button>
+    <span id="session-count-label"></span>
   </div>
   <!-- Tab pane containers are created dynamically by createTab() -->
 
@@ -383,6 +389,7 @@ <h3>General</h3>
   <script src="/static/lib/addon-web-links.js"></script>
   <script src="/static/lib/addon-search.js"></script>
   <script src="/static/lib/addon-image.js"></script>
+  <script src="/static/lib/addon-clipboard.js"></script>
   <script src="/static/lib/socket.io.min.js"></script>
   <script>
     // ── Platform-aware shortcut labels ──────────────────────────────
@@ -885,6 +892,42 @@ <h3>General</h3>
       }
     }, true);  // capture phase — fire before xterm.js
 
+    // ── Write Batching (prevents escape sequence fragmentation) ────
+    // PTY output arrives in fixed-size chunks that can split multi-byte
+    // escape sequences. Batching per animation frame (~16ms) lets split
+    // sequences rejoin before xterm.js parses them.
+    function createWriteBatcher(term) {
+      let pending = '';
+      let rafId = null;
+      let altExitTimer = null;
+      function flush() {
+        if (pending) {
+          const data = pending;
+          pending = '';
+          term.write(data);
+          // Detect alternate screen buffer exit (e.g. Claude Code no-flicker, vim).
+          // After exit, the restored main screen has stale content overlapping with
+          // the app's exit output. Clear after a short delay to let exit output
+          // finish, then the shell redraws a clean prompt.
+          if (data.includes('\x1b[?1049l')) {
+            clearTimeout(altExitTimer);
+            altExitTimer = setTimeout(() => term.write('\x1b[2J\x1b[H'), 150);
+          }
+        }
+        rafId = null;
+      }
+      function batchWrite(data) {
+        pending += data;
+        if (!rafId) { rafId = requestAnimationFrame(flush); }
+      }
+      batchWrite.cancel = function() {
+        clearTimeout(altExitTimer);
+        if (rafId) { cancelAnimationFrame(rafId); rafId = null; }
+        pending = '';
+      };
+      return batchWrite;
+    }
+
     // ── Session / IO (parameterized by sessionId) ──────────────────
     const status = document.getElementById('status');
 
@@ -988,10 +1031,12 @@ <h3>General</h3>
       });
 
       // Receive terminal output pushed from server (AC-8)
+      // Output is batched per-animation-frame to prevent escape sequence
+      // fragmentation when PTY chunks split mid-sequence (e.g. no-flicker mode).
       socket.on('terminal_output', (data) => {
         const pane = getAllPanes().find(p => p.sessionId === data.session_id);
         if (pane && data.output) {
-          pane.term.write(data.output);
+          pane.batchWrite(data.output);
         }
       });
 
@@ -1063,7 +1108,7 @@ <h3>General</h3>
           if (data.timeout_warning) {
             pane.term.write('\r\n\x1b[33m\u26A0 Session idle \u2014 will terminate soon if no activity.\x1b[0m\r\n');
           }
-          if (data.output) pane.term.write(data.output);
+          if (data.output) pane.batchWrite(data.output);
           break;
         }
         case 'session_ended':
@@ -1112,6 +1157,7 @@ <h3>General</h3>
     });
 
     function cleanupPane(pane) {
+      if (pane.batchWrite && pane.batchWrite.cancel) pane.batchWrite.cancel();
       pollWorker.postMessage({ type: 'stop_poll', paneId: pane.id });
       if (pane.sessionId) {
         // Leave WebSocket room — session stays alive for reattach
@@ -1120,6 +1166,10 @@ <h3>General</h3>
         }
         pane.sessionId = null;
       }
+      // Update immediately, then again after backend finishes cleanup
+      // (terminate_session has a 3s SIGKILL wait before popping the session).
+      updateSessionBadge();
+      setTimeout(updateSessionBadge, 4000);
     }
 
     function cleanupAllPanes() {
@@ -1177,6 +1227,7 @@ <h3>General</h3>
               }).then(() => {
                 sessions.splice(num - 1, 1);
                 pendingDelete = false;
+                updateSessionBadge();
                 if (sessions.length === 0) {
                   disposable.dispose();
                   createSession().then(sid => resolve({ sid, reattached: false }));
@@ -1218,7 +1269,7 @@ <h3>General</h3>
                 headers: { 'Content-Type': 'application/json' },
                 body: JSON.stringify({ session_id: s.session_id })
               })
-            )).then(() => createSession().then(sid => resolve({ sid, reattached: false })));
+            )).then(() => { updateSessionBadge(); return createSession().then(sid => resolve({ sid, reattached: false })); });
           } else if (data === 'q' || data === 'Q' || data === '\x1b') {
             disposable.dispose();
             resolve({ sid: null, reattached: false, cancelled: true });
@@ -1234,13 +1285,16 @@ <h3>General</h3>
         body: JSON.stringify({ session_id: sessionId })
       });
       const data = await resp.json();
-      term.write('\x1b[2J\x1b[H');  // clear
-      if (data.output && data.output.length > 0) {
-        data.output.forEach(line => term.write(line));
-      }
-      // Show reattach message at the bottom without overwriting buffer content
-      // Tell PTY the current terminal size so it redraws correctly
-      await sendResize(term.cols, term.rows, sessionId);
+      // Send a resize to trigger the running app (bash, Claude Code, vim) to
+      // redraw from scratch via SIGWINCH. We skip buffer replay because it
+      // contains raw escape sequences that produce garbled output.
+      // The kernel only sends SIGWINCH when the size actually changes, so we
+      // force a 1-column shrink first, then restore the real size. This
+      // guarantees two SIGWINCH signals even if the terminal size hasn't changed.
+      const cols = term.cols;
+      const rows = term.rows;
+      await sendResize(Math.max(1, cols - 1), rows, sessionId);
+      await sendResize(cols, rows, sessionId);
       return sessionId;
     }
 
@@ -1257,6 +1311,94 @@ <h3>General</h3>
       return Math.floor(seconds / 3600) + 'h';
     }
 
+    // ── Session Creation Prompt ───────────────────────────────────
+    async function promptExistingSessions(term, sessions) {
+      // Lightweight prompt shown before creating a new session when others exist.
+      // Returns { action: 'reuse', sessionId } or { action: 'new' }
+      return new Promise((resolve) => {
+        term.write('\x1b[2J\x1b[H');  // clear
+        term.write('\r\n');
+        const n = sessions.length;
+        term.write('\x1b[1;36m  You have ' + n + ' active session' + (n > 1 ? 's' : '') + ':\x1b[0m\r\n\r\n');
+
+        const attachedIds = new Set(getAllPanes().map(p => p.sessionId).filter(Boolean));
+        sessions.forEach((s, i) => {
+          const name = (s.label || s.process || 'bash').padEnd(14);
+          const proc = s.label ? ' \x1b[90m[' + (s.process || 'bash') + ']\x1b[0m' : '';
+          const ago = _formatAge(s.created_at);
+          const idle = s.idle_seconds > 60 ? ', idle ' + _formatDuration(s.idle_seconds) : '';
+          const open = attachedIds.has(s.session_id) ? ' \x1b[1;33m(open)\x1b[0m' : '';
+          term.write('  \x1b[1;32m' + (i + 1) + '\x1b[0m  ');
+          term.write('\x1b[1;37m' + name + '\x1b[0m');
+          term.write('\x1b[90m(' + ago + idle + ')\x1b[0m' + proc + open + '\r\n');
+        });
+
+        term.write('\r\n  \x1b[1;33mn\x1b[0m  New session\r\n');
+        term.write('\r\n\x1b[90m  Select:\x1b[0m ');
+
+        const disposable = term.onData(data => {
+          const num = parseInt(data);
+          if (num >= 1 && num <= sessions.length) {
+            const picked = sessions[num - 1];
+            const openPanes = getAllPanes().filter(p => p.sessionId === picked.session_id);
+            if (openPanes.length > 0) {
+              term.write(data + '\r\n\x1b[1;33m  Already open in another pane. Pick another:\x1b[0m ');
+              return;
+            }
+            disposable.dispose();
+            resolve({ action: 'reuse', sessionId: picked.session_id });
+          } else if (data === 'n' || data === 'N') {
+            disposable.dispose();
+            term.write('\r\n');
+            resolve({ action: 'new' });
+          } else if (data === 'q' || data === 'Q' || data === '\x1b') {
+            disposable.dispose();
+            term.write('\r\n');
+            resolve({ action: 'new' });  // default to new session on cancel
+          }
+        });
+      });
+    }
+
+    async function getOrPromptSession(term, label, skipPrompt) {
+      // Check for existing sessions and prompt user before creating a new one.
+      if (!skipPrompt) {
+        try {
+          const resp = await fetch('/api/sessions');
+          const existing = (await resp.json()).filter(s => !s.exited);
+          if (existing.length > 0) {
+            const choice = await promptExistingSessions(term, existing);
+            if (choice.action === 'reuse') {
+              await _doAttach(term, choice.sessionId);
+              return { sid: choice.sessionId, reattached: true };
+            }
+          }
+        } catch (e) { /* session list failed — just create new */ }
+      }
+      try {
+        const sid = await createSession(label);
+        return { sid, reattached: false };
+      } catch (e) {
+        if (e.message && e.message.includes('Maximum')) {
+          term.write('\r\n\x1b[1;31m  ' + e.message + '\x1b[0m\r\n');
+          term.write('\x1b[90m  Increase MAX_CONCURRENT_SESSIONS in app.yaml or close a session (Ctrl+Shift+S).\x1b[0m\r\n\r\n');
+        } else {
+          term.write('\r\n\x1b[1;31m  Failed to create session: ' + e.message + '\x1b[0m\r\n');
+        }
+        throw e;
+      }
+    }
+
+    async function updateSessionBadge() {
+      try {
+        const resp = await fetch('/api/sessions');
+        const active = (await resp.json()).filter(s => !s.exited);
+        const label = document.getElementById('session-count-label');
+        const n = active.length;
+        label.textContent = n === 0 ? 'No active sessions' : n + ' active session' + (n > 1 ? 's' : '');
+      } catch (e) { /* ignore */ }
+    }
+
     // ── Pane Management ────────────────────────────────────────────
     async function createPane(tab, opts = {}) {
       const id = 'pane-' + (++paneIdCounter);
@@ -1288,6 +1430,9 @@ <h3>General</h3>
       const fitAddon = new FitAddon.FitAddon();
       term.loadAddon(fitAddon);
       term.loadAddon(new WebLinksAddon.WebLinksAddon());
+      if (typeof ClipboardAddon !== 'undefined') {
+        term.loadAddon(new ClipboardAddon.ClipboardAddon());
+      }
 
       let searchAddon = null;
       if (typeof SearchAddon !== 'undefined') {
@@ -1421,11 +1566,9 @@ <h3>General</h3>
                 }
             }
         }
-        var sid = await createSession(tab.label);
-        var reattached = false;
+        var { sid, reattached } = await getOrPromptSession(term, tab.label, opts.skipPrompt);
       } else if (!opts.newSession) {
-        // PAT is valid, initial page load — always create a fresh session.
-        // Reattaching to a previous session is intentional (Ctrl+Shift+S).
+        // PAT is valid, initial page load — check for existing sessions first.
         const setupResp2 = await fetch('/api/setup-status');
         const setupData2 = await setupResp2.json();
         if (setupData2.status !== 'complete' && setupData2.status !== 'error') {
@@ -1444,12 +1587,10 @@ <h3>General</h3>
             }
           }
         }
-        var sid = await createSession(tab.label);
-        var reattached = false;
+        var { sid, reattached } = await getOrPromptSession(term, tab.label, opts.skipPrompt);
       } else {
-        // Split pane or new tab — always create fresh session
-        var sid = await createSession(tab.label);
-        var reattached = false;
+        // Split pane or new tab — check for existing sessions first
+        var { sid, reattached } = await getOrPromptSession(term, tab.label, opts.skipPrompt);
       }
 
       if (!reattached) {
@@ -1480,7 +1621,8 @@ <h3>General</h3>
         term.write('\r\n');
       }
 
-      const pane = { id, element, term, fitAddon, searchAddon, sessionId: sid };
+      const pane = { id, element, term, fitAddon, searchAddon, sessionId: sid,
+        batchWrite: createWriteBatcher(term) };
       term.onData(data => sendInput(data, pane.sessionId));
 
       // Join WebSocket room if connected; otherwise start HTTP polling (AC-11, AC-16)
@@ -1496,6 +1638,7 @@ <h3>General</h3>
       tab.panes.push(pane);
       focusPane(id);
 
+      updateSessionBadge();
       return pane;
     }
 
@@ -1848,6 +1991,7 @@ <h3>General</h3>
             pollWorker.postMessage({ type: 'start_poll', paneId: pane.id, sessionId: prevSessionId });
           }
         }
+        updateSessionBadge();
         return;
       }
 
@@ -1859,6 +2003,7 @@ <h3>General</h3>
       } else {
         pollWorker.postMessage({ type: 'start_poll', paneId: pane.id, sessionId: sid });
       }
+      updateSessionBadge();
     });
 
     // ── Toast Notification ──────────────────────────────────────────
@@ -1991,6 +2136,7 @@ <h3>General</h3>
         initWebSocket();
 
         await createTab();
+        updateSessionBadge();
 
         status.textContent = 'Connected!';
         setTimeout(() => { status.style.display = 'none'; }, 1000);
diff --git a/static/lib/addon-clipboard.js b/static/lib/addon-clipboard.js
new file mode 100644
index 0000000..0b4313e
--- /dev/null
+++ b/static/lib/addon-clipboard.js
@@ -0,0 +1,2 @@
+!function(t,e){"object"==typeof exports&&"object"==typeof module?module.exports=e():"function"==typeof define&&define.amd?define([],e):"object"==typeof exports?exports.ClipboardAddon=e():t.ClipboardAddon=e()}(self,(()=>(()=>{var t={812:function(t,e,r){"undefined"!=typeof self?self:"undefined"!=typeof window?window:void 0!==r.g&&r.g,t.exports=function(){"use strict";var t,e="3.7.8",r=e,n="function"==typeof Buffer,o="function"==typeof TextDecoder?new TextDecoder:void 0,i="function"==typeof TextEncoder?new TextEncoder:void 0,u=Array.prototype.slice.call("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="),a=(t={},u.forEach((function(e,r){return t[e]=r})),t),c=/^(?:[A-Za-z\d+\/]{4})*?(?:[A-Za-z\d+\/]{2}(?:==)?|[A-Za-z\d+\/]{3}=?)?$/,s=String.fromCharCode.bind(String),f="function"==typeof Uint8Array.from?Uint8Array.from.bind(Uint8Array):function(t){return new Uint8Array(Array.prototype.slice.call(t,0))},d=function(t){return t.replace(/=/g,"").replace(/[+\/]/g,(function(t){return"+"==t?"-":"_"}))},l=function(t){return t.replace(/[^A-Za-z0-9\+\/]/g,"")},p=function(t){for(var e,r,n,o,i="",a=t.length%3,c=0;c<t.length;){if((r=t.charCodeAt(c++))>255||(n=t.charCodeAt(c++))>255||(o=t.charCodeAt(c++))>255)throw new TypeError("invalid character found");i+=u[(e=r<<16|n<<8|o)>>18&63]+u[e>>12&63]+u[e>>6&63]+u[63&e]}return a?i.slice(0,a-3)+"===".substring(a):i},h="function"==typeof btoa?function(t){return btoa(t)}:n?function(t){return Buffer.from(t,"binary").toString("base64")}:p,b=n?function(t){return Buffer.from(t).toString("base64")}:function(t){for(var e=[],r=0,n=t.length;r<n;r+=4096)e.push(s.apply(null,t.subarray(r,r+4096)));return h(e.join(""))},y=function(t,e){return void 0===e&&(e=!1),e?d(b(t)):b(t)},x=function(t){if(t.length<2)return(e=t.charCodeAt(0))<128?t:e<2048?s(192|e>>>6)+s(128|63&e):s(224|e>>>12&15)+s(128|e>>>6&63)+s(128|63&e);var e=65536+1024*(t.charCodeAt(0)-55296)+(t.charCodeAt(1)-56320);return s(240|e>>>18&7)+s(128|e>>>12&63)+s(128|e>>>6&63)+s(128|63&e)},A=/[\uD800-\uDBFF][\uDC00-\uDFFFF]|[^\x00-\x7F]/g,g=function(t){return t.replace(A,x)},v=n?function(t){return Buffer.from(t,"utf8").toString("base64")}:i?function(t){return b(i.encode(t))}:function(t){return h(g(t))},B=function(t,e){return void 0===e&&(e=!1),e?d(v(t)):v(t)},C=function(t){return B(t,!0)},m=/[\xC0-\xDF][\x80-\xBF]|[\xE0-\xEF][\x80-\xBF]{2}|[\xF0-\xF7][\x80-\xBF]{3}/g,w=function(t){switch(t.length){case 4:var e=((7&t.charCodeAt(0))<<18|(63&t.charCodeAt(1))<<12|(63&t.charCodeAt(2))<<6|63&t.charCodeAt(3))-65536;return s(55296+(e>>>10))+s(56320+(1023&e));case 3:return s((15&t.charCodeAt(0))<<12|(63&t.charCodeAt(1))<<6|63&t.charCodeAt(2));default:return s((31&t.charCodeAt(0))<<6|63&t.charCodeAt(1))}},T=function(t){return t.replace(m,w)},_=function(t){if(t=t.replace(/\s+/g,""),!c.test(t))throw new TypeError("malformed base64.");var e,r,n;t+="==".slice(2-(3&t.length));for(var o=[],i=0;i<t.length;)e=a[t.charAt(i++)]<<18|a[t.charAt(i++)]<<12|(r=a[t.charAt(i++)])<<6|(n=a[t.charAt(i++)]),64===r?o.push(s(e>>16&255)):64===n?o.push(s(e>>16&255,e>>8&255)):o.push(s(e>>16&255,e>>8&255,255&e));return o.join("")},F="function"==typeof atob?function(t){return atob(l(t))}:n?function(t){return Buffer.from(t,"base64").toString("binary")}:_,U=n?function(t){return f(Buffer.from(t,"base64"))}:function(t){return f(F(t).split("").map((function(t){return t.charCodeAt(0)})))},j=function(t){return U(S(t))},P=n?function(t){return Buffer.from(t,"base64").toString("utf8")}:o?function(t){return o.decode(U(t))}:function(t){return T(F(t))},S=function(t){return l(t.replace(/[-_]/g,(function(t){return"-"==t?"+":"/"})))},E=function(t){return P(S(t))},R=function(t){return{value:t,enumerable:!1,writable:!0,configurable:!0}},O=function(){var t=function(t,e){return Object.defineProperty(String.prototype,t,R(e))};t("fromBase64",(function(){return E(this)})),t("toBase64",(function(t){return B(this,t)})),t("toBase64URI",(function(){return B(this,!0)})),t("toBase64URL",(function(){return B(this,!0)})),t("toUint8Array",(function(){return j(this)}))},D=function(){var t=function(t,e){return Object.defineProperty(Uint8Array.prototype,t,R(e))};t("toBase64",(function(t){return y(this,t)})),t("toBase64URI",(function(){return y(this,!0)})),t("toBase64URL",(function(){return y(this,!0)}))},z={version:e,VERSION:r,atob:F,atobPolyfill:_,btoa:h,btoaPolyfill:p,fromBase64:E,toBase64:B,encode:B,encodeURI:C,encodeURL:C,utob:g,btou:T,decode:E,isValid:function(t){if("string"!=typeof t)return!1;var e=t.replace(/\s+/g,"").replace(/={0,2}$/,"");return!/[^\s0-9a-zA-Z\+/]/.test(e)||!/[^\s0-9a-zA-Z\-_]/.test(e)},fromUint8Array:y,toUint8Array:j,extendString:O,extendUint8Array:D,extendBuiltins:function(){O(),D()},Base64:{}};return Object.keys(z).forEach((function(t){return z.Base64[t]=z[t]})),z}()}},e={};function r(n){var o=e[n];if(void 0!==o)return o.exports;var i=e[n]={exports:{}};return t[n].call(i.exports,i,i.exports,r),i.exports}r.g=function(){if("object"==typeof globalThis)return globalThis;try{return this||new Function("return this")()}catch(t){if("object"==typeof window)return window}}();var n={};return(()=>{"use strict";var t=n;Object.defineProperty(t,"__esModule",{value:!0}),t.Base64=t.BrowserClipboardProvider=t.ClipboardAddon=void 0;const e=r(812);t.ClipboardAddon=class{constructor(t=new i,e=new o){this._base64=t,this._provider=e}activate(t){this._terminal=t,this._disposable=t.parser.registerOscHandler(52,(t=>this._setOrReportClipboard(t)))}dispose(){return this._disposable?.dispose()}_readText(t,e){const r=this._base64.encodeText(e);this._terminal?.input(`]52;${t};${r}`,!1)}_setOrReportClipboard(t){const e=t.split(";");if(e.length<2)return!0;const r=e[0],n=e[1];if("?"===n){const t=this._provider.readText(r);return t instanceof Promise?t.then((t=>(this._readText(r,t),!0))):(this._readText(r,t),!0)}let o="";try{o=this._base64.decodeText(n)}catch{}const i=this._provider.writeText(r,o);return!(i instanceof Promise)||i.then((()=>!0))}};class o{async readText(t){return"c"!==t?Promise.resolve(""):navigator.clipboard.readText()}async writeText(t,e){return"c"!==t?Promise.resolve():navigator.clipboard.writeText(e)}}t.BrowserClipboardProvider=o;class i{encodeText(t){return e.Base64.encode(t)}decodeText(t){const r=e.Base64.decode(t);return e.Base64.isValid(t)&&e.Base64.encode(r)===t?r:""}}t.Base64=i})(),n})()));
+//# sourceMappingURL=addon-clipboard.js.map
\ No newline at end of file
diff --git a/tests/test_clipboard_addon.py b/tests/test_clipboard_addon.py
new file mode 100644
index 0000000..c44f274
--- /dev/null
+++ b/tests/test_clipboard_addon.py
@@ -0,0 +1,76 @@
+"""Tests for xterm.js ClipboardAddon (OSC 52 support).
+
+Verifies that:
+- addon-clipboard.js exists in static/lib/
+- The addon file contains the ClipboardAddon class
+- The addon registers an OSC 52 handler
+- index.html loads the addon script
+- index.html initializes the addon on terminal creation
+"""
+
+import os
+import re
+
+import pytest
+
+
+STATIC_LIB = os.path.join(os.path.dirname(__file__), "..", "static", "lib")
+INDEX_HTML = os.path.join(os.path.dirname(__file__), "..", "static", "index.html")
+
+
+class TestClipboardAddonFile:
+
+    def test_addon_file_exists(self):
+        path = os.path.join(STATIC_LIB, "addon-clipboard.js")
+        assert os.path.isfile(path), "addon-clipboard.js missing from static/lib/"
+
+    def test_addon_exports_clipboard_addon(self):
+        path = os.path.join(STATIC_LIB, "addon-clipboard.js")
+        with open(path) as f:
+            content = f.read()
+        assert "ClipboardAddon" in content, "addon-clipboard.js does not export ClipboardAddon"
+
+    def test_addon_handles_osc_52(self):
+        path = os.path.join(STATIC_LIB, "addon-clipboard.js")
+        with open(path) as f:
+            content = f.read()
+        # The addon should register an OSC handler for sequence 52
+        assert re.search(r'registerOscHandler\S*\(52', content), (
+            "addon-clipboard.js does not register an OSC 52 handler"
+        )
+
+    def test_addon_uses_navigator_clipboard(self):
+        path = os.path.join(STATIC_LIB, "addon-clipboard.js")
+        with open(path) as f:
+            content = f.read()
+        assert "navigator.clipboard" in content, "addon should use navigator.clipboard API"
+
+
+class TestClipboardAddonIntegration:
+
+    @pytest.fixture(autouse=True)
+    def _load_html(self):
+        self.html = open(INDEX_HTML).read()
+
+    def test_script_tag_present(self):
+        assert "addon-clipboard.js" in self.html, (
+            "<script> tag for addon-clipboard.js missing from index.html"
+        )
+
+    def test_script_loaded_after_other_addons(self):
+        # addon-clipboard should be loaded after the core addons
+        image_pos = self.html.index("addon-image.js")
+        clipboard_pos = self.html.index("addon-clipboard.js")
+        assert clipboard_pos > image_pos, (
+            "addon-clipboard.js should be loaded after addon-image.js"
+        )
+
+    def test_addon_initialized_in_create_pane(self):
+        assert "ClipboardAddon.ClipboardAddon()" in self.html, (
+            "ClipboardAddon not initialized in createPane()"
+        )
+
+    def test_addon_guarded_by_typeof_check(self):
+        assert "typeof ClipboardAddon" in self.html, (
+            "ClipboardAddon loading should be guarded by typeof check"
+        )
diff --git a/tests/test_session_limit.py b/tests/test_session_limit.py
new file mode 100644
index 0000000..5625c52
--- /dev/null
+++ b/tests/test_session_limit.py
@@ -0,0 +1,223 @@
+"""Tests for MAX_CONCURRENT_SESSIONS cap (issue #118).
+
+Verifies that:
+- MAX_CONCURRENT_SESSIONS defaults to 5
+- Session creation succeeds when under the limit
+- Session creation returns 429 when at the limit
+- Exited sessions don't count toward the limit
+- The 429 response includes an informative error message
+"""
+
+import threading
+import time
+from collections import deque
+from unittest import mock
+
+import pytest
+
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+def _get_app():
+    """Import app with initialize_app mocked out."""
+    with mock.patch("app.initialize_app"):
+        import app as app_module
+        app_module.app.config["TESTING"] = True
+        return app_module
+
+
+def _add_session(app_module, session_id, exited=False):
+    """Insert a fake session into the sessions dict."""
+    session = {
+        "master_fd": 999,
+        "pid": 12345,
+        "output_buffer": deque(maxlen=1000),
+        "lock": threading.Lock(),
+        "last_poll_time": time.time(),
+        "created_at": time.time(),
+        "label": session_id,
+    }
+    if exited:
+        session["exited"] = True
+    with app_module.sessions_lock:
+        app_module.sessions[session_id] = session
+    return session
+
+
+def _cleanup(app_module, *session_ids):
+    with app_module.sessions_lock:
+        for sid in session_ids:
+            app_module.sessions.pop(sid, None)
+
+
+# ---------------------------------------------------------------------------
+# 1. Default constant value
+# ---------------------------------------------------------------------------
+
+class TestSessionLimitConstant:
+
+    def test_default_max_concurrent_sessions_is_5(self):
+        app_module = _get_app()
+        assert app_module.MAX_CONCURRENT_SESSIONS == 5
+
+    def test_max_concurrent_sessions_reads_from_env(self):
+        """Verify that patching the module-level constant changes the cap."""
+        app_module = _get_app()
+        original = app_module.MAX_CONCURRENT_SESSIONS
+        try:
+            app_module.MAX_CONCURRENT_SESSIONS = 3
+            assert app_module.MAX_CONCURRENT_SESSIONS == 3
+        finally:
+            app_module.MAX_CONCURRENT_SESSIONS = original
+
+
+# ---------------------------------------------------------------------------
+# 2. Session creation under the limit succeeds
+# ---------------------------------------------------------------------------
+
+class TestSessionCreationUnderLimit:
+
+    def test_create_session_with_zero_active(self):
+        app_module = _get_app()
+        client = app_module.app.test_client()
+        # Mock out pty, subprocess, and threading to avoid real PTY creation
+        with mock.patch.object(app_module, "check_authorization", return_value=(True, "test-user")), \
+             mock.patch("pty.openpty", return_value=(10, 11)), \
+             mock.patch("subprocess.Popen") as mock_popen, \
+             mock.patch("os.close"), \
+             mock.patch("threading.Thread") as mock_thread:
+            mock_popen.return_value.pid = 99999
+            mock_thread.return_value.start = mock.Mock()
+            resp = client.post("/api/session", json={"label": "test"})
+        assert resp.status_code == 200
+        data = resp.get_json()
+        assert "session_id" in data
+        # Cleanup the created session
+        _cleanup(app_module, data["session_id"])
+
+    def test_create_session_with_some_active(self):
+        app_module = _get_app()
+        # Add 3 sessions (under default limit of 5)
+        sids = [f"existing-{i}" for i in range(3)]
+        try:
+            for sid in sids:
+                _add_session(app_module, sid)
+            client = app_module.app.test_client()
+            with mock.patch.object(app_module, "check_authorization", return_value=(True, "test-user")), \
+                 mock.patch("pty.openpty", return_value=(10, 11)), \
+                 mock.patch("subprocess.Popen") as mock_popen, \
+                 mock.patch("os.close"), \
+                 mock.patch("threading.Thread") as mock_thread:
+                mock_popen.return_value.pid = 99999
+                mock_thread.return_value.start = mock.Mock()
+                resp = client.post("/api/session", json={"label": "test"})
+            assert resp.status_code == 200
+            data = resp.get_json()
+            assert "session_id" in data
+            sids.append(data["session_id"])
+        finally:
+            _cleanup(app_module, *sids)
+
+
+# ---------------------------------------------------------------------------
+# 3. Session creation at/over the limit returns 429
+# ---------------------------------------------------------------------------
+
+class TestSessionCreationAtLimit:
+
+    def test_create_session_at_limit_returns_429(self):
+        app_module = _get_app()
+        limit = app_module.MAX_CONCURRENT_SESSIONS
+        sids = [f"full-{i}" for i in range(limit)]
+        try:
+            for sid in sids:
+                _add_session(app_module, sid)
+            client = app_module.app.test_client()
+            with mock.patch.object(app_module, "check_authorization", return_value=(True, "test-user")):
+                resp = client.post("/api/session", json={"label": "one-too-many"})
+            assert resp.status_code == 429
+            data = resp.get_json()
+            assert "error" in data
+            assert "Maximum" in data["error"]
+        finally:
+            _cleanup(app_module, *sids)
+
+    def test_429_error_message_includes_limit(self):
+        app_module = _get_app()
+        limit = app_module.MAX_CONCURRENT_SESSIONS
+        sids = [f"msg-{i}" for i in range(limit)]
+        try:
+            for sid in sids:
+                _add_session(app_module, sid)
+            client = app_module.app.test_client()
+            with mock.patch.object(app_module, "check_authorization", return_value=(True, "test-user")):
+                resp = client.post("/api/session", json={})
+            data = resp.get_json()
+            assert str(limit) in data["error"]
+            assert "Close an existing session" in data["error"]
+        finally:
+            _cleanup(app_module, *sids)
+
+
+# ---------------------------------------------------------------------------
+# 4. Removed sessions free up slots (sessions are popped from dict, not marked)
+# ---------------------------------------------------------------------------
+
+class TestRemovedSessionsFreeSlots:
+
+    def test_removing_session_frees_slot(self):
+        """After removing a session from the dict, a new one can be created."""
+        app_module = _get_app()
+        limit = app_module.MAX_CONCURRENT_SESSIONS
+        sids = [f"full-{i}" for i in range(limit)]
+        try:
+            for sid in sids:
+                _add_session(app_module, sid)
+            # At limit — verify rejection
+            client = app_module.app.test_client()
+            with mock.patch.object(app_module, "check_authorization", return_value=(True, "test-user")):
+                resp = client.post("/api/session", json={})
+            assert resp.status_code == 429
+            # Remove one session (simulates terminate_session popping it)
+            _cleanup(app_module, sids[0])
+            sids = sids[1:]
+            # Now creation should succeed
+            with mock.patch.object(app_module, "check_authorization", return_value=(True, "test-user")), \
+                 mock.patch("pty.openpty", return_value=(10, 11)), \
+                 mock.patch("subprocess.Popen") as mock_popen, \
+                 mock.patch("os.close"), \
+                 mock.patch("threading.Thread") as mock_thread:
+                mock_popen.return_value.pid = 99999
+                mock_thread.return_value.start = mock.Mock()
+                resp = client.post("/api/session", json={"label": "after-removal"})
+            assert resp.status_code == 200
+            data = resp.get_json()
+            sids.append(data["session_id"])
+        finally:
+            _cleanup(app_module, *sids)
+
+    def test_count_based_on_dict_size(self):
+        """The cap is based on len(sessions), not an exited flag."""
+        app_module = _get_app()
+        limit = app_module.MAX_CONCURRENT_SESSIONS
+        sids = [f"slot-{i}" for i in range(limit - 1)]
+        try:
+            for sid in sids:
+                _add_session(app_module, sid)
+            # One slot remaining — creation should succeed
+            client = app_module.app.test_client()
+            with mock.patch.object(app_module, "check_authorization", return_value=(True, "test-user")), \
+                 mock.patch("pty.openpty", return_value=(10, 11)), \
+                 mock.patch("subprocess.Popen") as mock_popen, \
+                 mock.patch("os.close"), \
+                 mock.patch("threading.Thread") as mock_thread:
+                mock_popen.return_value.pid = 99999
+                mock_thread.return_value.start = mock.Mock()
+                resp = client.post("/api/session", json={"label": "last-slot"})
+            assert resp.status_code == 200
+            data = resp.get_json()
+            sids.append(data["session_id"])
+        finally:
+            _cleanup(app_module, *sids)