@@ -8,14 +8,54 @@ Newest first. `Unreleased` is what is on `main` and not yet tagged.
 
 ## Unreleased
 
-### A sandboxed component cannot be saved with a blank title
-
-`POST /api/sandboxed` accepted a title of spaces. The slug has a pattern of its own and refuses one,
-but the title is a separate field with no check, so the component reached the grid with nothing to
-read: an administrator could not tell it from the next one, and a Bot granted it was told the
-component is called "   ". The title is now trimmed, and one that is only whitespace is refused the
-way a missing one always was. The two endpoints of the same shape, `POST /api/servers/custom` and
-`POST /api/skills`, already did this.
+### Wiping a computer is recorded even if clearing its stored state fails
+
+Resetting a computer destroys the profile first and wrote the audit row last, after two Postgres
+deletes. A connection reset, a failover or a statement timeout in either delete threw before the row
+was written, so the most destructive button in the product could leave a wiped computer -- every
+login gone, no undo -- with nothing on the trail to say who wiped it or when. The row is now written
+as soon as the profile is gone, which is the point after which nothing can be put back. A failure in
+either delete is still reported to the caller.
+### Pressing Stop is recorded as a stop, not as a computer that is not running
+
+The computer transport answered a Stop correctly only when it arrived before the request left. The
+caller's signal is handed to `fetch` precisely so a Stop can also land mid-action, and a fetch
+aborted that way rejects with an `AbortError`, which fell through to the message for a computer that
+cannot be reached. The person was told their own click had failed because the assistant's computer
+was not running, and the gateway wrote that sentence into the action's audit row as its failure --
+so a deliberate stop read back as an outage. A genuinely unreachable computer and a timeout still
+say what they said.
+### A component the server refused is no longer drawn anyway
+
+A sandboxed component asks the server at call time whether the Bot may still use it, and a refusal
+is recorded so the drawing can be replaced with a card saying so. The renderer looked that refusal
+up under `props.toolCall.id`, which is the shape a tool HANDLER is given; a renderer's props carry
+the id flat, as `toolCallId`. The lookup key was therefore always undefined, the refusal was never
+found, and the component rendered as though it had been allowed -- so revoking a component from a
+Bot did not take effect on screen until the five-second grant poll caught up, and a failed decision
+request showed nothing at all.
+### A component whose name has a stray space is the same component
+
+The catalogue announcement asked whether each component's `name`, `title`, `kind` and `description`
+were more than whitespace, and then published the untrimmed strings. A `name` is a component's
+identity -- it is what `syncCatalogue` compares against what is already published, what `decide` and
+`listForAgent` look up, and what a grant names -- so a build shipping `" weatherPanel "` added a
+second catalogue row beside `weatherPanel`: published, ungranted by anybody, and impossible to hold
+a Bot back from under the name people use. The four fields are now stored as the strings the guard
+approved.
+### A password with a `%` in it says so, instead of failing as `URI error`
+
+`DATABASE_URL` is taken apart before it reaches Bun, and each part is percent-decoded. A part
+holding a `%` that starts no escape -- `postgres://openbot:100%pure@host:5432/openbot`, which a
+generated password produces often enough -- is a string `new URL` accepts and `decodeURIComponent`
+rejects, so the server stopped with `URIError: URI error` and named neither the variable nor the
+part. It now refuses with the same kind of sentence as every other malformed address: which part is
+wrong, and that a literal `%` must be written `%25`.
+
+A correctly encoded password is unaffected.
+### An empty Bot `PORT` is unset, so NaN never reaches Bun.serve
+
+`PORT=` on `agent-bot` and `agent-langgraph` used to parse as `NaN` (`??` does not treat empty as absent) and `Bun.serve` bound an ephemeral port while compose still published 4200/4201. A prefix typo (`42o0`) started on 42. Empty now means the shipped default; anything that is not a whole port number refuses to start.
 
 ### The server connects to Postgres on Windows, and `localhost` is no longer a coin toss
 
 
@@ -3,6 +3,7 @@ import { EventEncoder } from "@ag-ui/encoder";
 import { serve } from "bun";
 import OpenAI from "openai";
 import { hasManagedAgentToken } from "../../shared/agent-authorisation";
+import { listenPort } from "../../shared/listen-port";
 import { toProviderMessages } from "./history";
 
 /**
@@ -16,7 +17,12 @@ import { toProviderMessages } from "./history";
  * running where its effects are visible to the person watching.
  */
 
-const PORT = Number.parseInt(process.env.PORT ?? "4200", 10);
+const resolvedPort = listenPort(process.env.PORT, 4200);
+if (!resolvedPort.ok) {
+  console.error(resolvedPort.reason);
+  process.exit(1);
+}
+const PORT = resolvedPort.port;
 const MANAGED_AGENT_TOKEN = process.env.MANAGED_AGENT_TOKEN?.trim();
 if (!MANAGED_AGENT_TOKEN) {
   console.error(
 
@@ -12,6 +12,7 @@ import {
 import { ChatOpenAI } from "@langchain/openai";
 import { serve } from "bun";
 import { hasManagedAgentToken } from "../../shared/agent-authorisation";
+import { listenPort } from "../../shared/listen-port";
 import { toLangChainMessages } from "./history";
 import { readReasoningEffort } from "./model-options";
 import { streamRun } from "./stream";
@@ -36,7 +37,12 @@ import { streamRun } from "./stream";
  * The graph provides model orchestration without changing that contract.
  */
 
-const PORT = Number.parseInt(process.env.PORT ?? "4201", 10);
+const resolvedPort = listenPort(process.env.PORT, 4201);
+if (!resolvedPort.ok) {
+  console.error(resolvedPort.reason);
+  process.exit(1);
+}
+const PORT = resolvedPort.port;
 const MANAGED_AGENT_TOKEN = process.env.MANAGED_AGENT_TOKEN?.trim();
 if (!MANAGED_AGENT_TOKEN) {
   console.error(
 
@@ -64,18 +64,30 @@ export function LiveScreen({ computerId, driving, onProblem }: Props) {
     };
 
     socket.onmessage = async (event) => {
-      let message: {
+      let parsed: unknown;
+      try {
+        parsed = JSON.parse(String(event.data));
+      } catch {
+        return;
+      }
+      // A frame that is not an object (`null`, a number, a string, an array) has
+      // no `type` to read: reaching for it throws a `TypeError` inside this
+      // handler and stops the live view from drawing further frames. Drop it.
+      if (
+        typeof parsed !== "object" ||
+        parsed === null ||
+        Array.isArray(parsed)
+      ) {
+        return;
+      }
+      const message = parsed as {
         type: string;
         data?: string;
         width?: number;
         height?: number;
         error?: string;
       };
-      try {
-        message = JSON.parse(String(event.data));
-      } catch {
-        return;
-      }
+      if (typeof message.type !== "string") return;
       if (message.type === "error") {
         onProblem?.(message.error ?? "The screen could not be shown.");
         return;
 
@@ -75,13 +75,20 @@ function SandboxedTool({
   const isHeld = description !== undefined;
 
   const render = useCallback(
+    // `toolCallId`, not `toolCall.id`: a renderer's props carry the id flat,
+    // which is the shape gallery-tools and computer-tools already read and
+    // the one the library's own DefaultToolCallRenderer destructures. The
+    // handler below is the other shape, `context.toolCall.id`, and reading
+    // that one here meant the key was always undefined -- so a refusal the
+    // server had just recorded was never found, and the component the server
+    // refused was drawn instead of the card saying it was not allowed.
     (props: {
       args?: Record<string, unknown>;
       status?: string;
-      toolCall?: { id?: string };
+      toolCallId?: string;
     }) => {
-      const refusal = props.toolCall?.id
-        ? refusals.get(props.toolCall.id)
+      const refusal = props.toolCallId
+        ? refusals.get(props.toolCallId)
         : undefined;
       if (refusal) {
         return <RefusedCard reason={refusal} title={component.name} />;
 
@@ -1,5 +1,6 @@
 import { describe, expect, test } from "bun:test";
 import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
 import { parse } from "yaml";
 import { SKILL_CREATOR_SLUG } from "@/lib/skills/proposal";
 
@@ -15,7 +16,9 @@ import { SKILL_CREATOR_SLUG } from "@/lib/skills/proposal";
  * Read from the file rather than from a fixture, because the file is what ships.
  */
 
-const packageDir = new URL("../../examples/fintech", import.meta.url).pathname;
+const packageDir = fileURLToPath(
+  new URL("../../examples/fintech", import.meta.url),
+);
 
 const shipped = parse(readFileSync(`${packageDir}/skills.yaml`, "utf8")) as {
   skills: { slug: string; title: string; instructions: string }[];
 
@@ -105,7 +105,19 @@ export function createComponentRoutes(
       ) {
         return [];
       }
-      return [{ name, title, kind, description }];
+      // Trimmed, because that is the string the guard above just approved. A component's `name` is
+      // its identity -- `syncCatalogue` compares it against what is already published, `decide` and
+      // `listForAgent` look it up by it, and a grant names it -- so publishing " weatherPanel "
+      // adds a second component beside `weatherPanel` that nobody has granted and no Bot can be
+      // held back from by the name people use.
+      return [
+        {
+          name: name.trim(),
+          title: title.trim(),
+          kind: kind.trim(),
+          description: description.trim(),
+        },
+      ];
     });
 
     const { added } = await store.syncCatalogue(valid);
 
@@ -63,13 +63,18 @@ export function createSandboxedRoutes(
       sampleArguments?: Record<string, unknown>;
     } | null;
 
-    if (!body?.slug || !body.title?.trim()) {
+    if (
+      typeof body?.slug !== "string" ||
+      !body.slug.trim() ||
+      typeof body?.title !== "string" ||
+      !body.title.trim()
+    ) {
       return context.json({ error: "A name and a title are required." }, 400);
     }
 
     try {
       const component = await store.save({
-        slug: body.slug,
+        slug: body.slug.trim(),
         title: body.title.trim(),
         description: body.description ?? "",
         html: body.html ?? "",
 
@@ -155,6 +155,18 @@ export function createComputerTransport(
           : AbortSignal.timeout(timeoutMs),
       });
     } catch (error) {
+      /*
+       * The caller's own abort is answered first, and says what the check above the fetch says.
+       *
+       * The signal is handed to fetch precisely so a Stop can land mid-flight, and a fetch aborted
+       * that way rejects with an AbortError, which is neither a TimeoutError nor a computer that is
+       * not running. Both of the other answers are statements about the infrastructure, and this
+       * message is not only read by the model: the gateway writes it into the action's audit row as
+       * `failure`, so a person pressing Stop was recorded as an outage.
+       */
+      if (caller?.aborted) {
+        throw new ComputerUnavailableError("The action was stopped.");
+      }
       throw new ComputerUnavailableError(
         error instanceof Error && error.name === "TimeoutError"
           ? "The assistant's computer did not respond in time."
 
@@ -713,6 +713,22 @@ export function createComputerGateway(
      */
     async resetComputer(botId: string, actor: ActionActor) {
       const result = await provider.reset(botId);
+      /*
+       * The row goes in HERE, before the two deletes below, because this line is the point of no
+       * return: the profile is already gone and nothing after it can put the logins back.
+       *
+       * Both clears are Postgres deletes, and a connection reset, a failover or a statement timeout
+       * in either used to throw before the row was written -- leaving a computer wiped with nothing
+       * on the trail to say who wiped it, which is the one outcome the note above rules out. The
+       * failure still propagates, so the caller is told the clears did not finish.
+       */
+      await writeControlEvent(auditStore, "computer.reset", {
+        botId,
+        actor,
+        reason: result.cleared
+          ? "the computer and its saved state were deleted"
+          : "no saved state was present to delete",
+      });
       // The refs the last snapshot handed out describe a page that no longer exists, and a fresh
       // computer counts generations from one again, so the row has to go with the profile.
       await snapshots.clear(botId);
@@ -725,13 +741,6 @@ export function createComputerGateway(
        * anything a person would recognise as private.
        */
       await pageFrames?.clear(botId);
-      await writeControlEvent(auditStore, "computer.reset", {
-        botId,
-        actor,
-        reason: result.cleared
-          ? "the computer and its saved state were deleted"
-          : "no saved state was present to delete",
-      });
       return result;
     },