Small changes. Better testing.

Uninstalling the GitHub App from GitHub left the dashboard showing the account as connected, with a Manage button pointing at a page that no longer existed and no way to install the App again.

• Fixed the GitHub settings page so an App uninstalled from GitHub reads as not installed and the Install button comes back. A suspended App stays visible with a Suspended badge and a pointer to the GitHub App settings, and Manage now opens the right page for organization installs.
• Added a warning on the Repository section of a procedure when the provider of the linked repository is suspended, has lost its token or was disconnected. The repository and its Unlink button stay visible so you can always move on.
• Improved how a missed GitHub notification is caught up: the dashboard re-checks the installation with GitHub when you open the GitHub settings page, and records a suspended or removed App the moment a repository listing fails because of it.

A Git push to a branch other than your production branch used to roll out to every station linked to the procedure, so work in progress could replace the code running on your line.

• Fixed branch pushes so they still build a preview deployment but no longer reach any station. Only pushes to the production branch roll out automatically.
• Kept the manual path: open a preview deployment in the dashboard and push it to the station you choose when you want to test a branch on real hardware.
• Fixed a deployment that could stay pending forever when its build could not be queued. It now shows as failed, and the other procedures fed by the same repository still get their build.
• Updated the Deployments and Environments docs to describe when a push is built, when it is skipped, and how previews reach a station.

A read query that runs past the 20 second limit is stopped and answered with a 408 timeout. Until now that status was missing from the API reference, so the SDKs reported it as an unknown error with nothing to catch.

• Added the 408 timeout to every read endpoint of the V2 API reference, with the message that tells you to narrow the date range or the filters and try again
• Added a typed timeout error to the Python and C# SDKs (ErrorTIMEOUT and RequestTimeoutException) so you can handle it without parsing the error text
• Documented the timeout in the REST API error table and in the SDK READMEs

A call that fails now leaves your workspace exactly as it was before you made it, on both API versions.

• Fixed failed calls so any record already written during the call is removed instead of kept.
• Stopped a fully failed import from leaving an empty entry in your import history.
• Kept the failed call visible in API Logs, so you can still see what went wrong.

Preventive security maintenance. We patched the 16 advisories published on 8 September against dependencies TofuPilot ships, two of them rated critical upstream.

• CVE-2026-75604, CVSS 9.0, unauthenticated remote code execution on Windows filesystems.
• GHSA-2xp9-vwfh-vxw4, CVSS 9.5, unauthenticated remote code execution through the image optimization path. No CVE assigned.
• Fourteen further advisories rated high, covering XML parsing, YAML parsing and image decoding.

TofuPilot Cloud requires no action. Self-hosted instances pick these updates up on the next image pull, and updating is recommended.

Measurement Control could take more than a minute to answer on procedures with very high run volume, and the page sometimes stopped loading altogether before any chart appeared.

• Fixed the page stalling on procedures with hundreds of thousands of measurements. The heaviest query dropped from 106 seconds to 5 seconds, and opening a measurement now answers in well under a second.
• Improved the cold page load so the sidebar filter counts wait for the main chart instead of competing with it, which is what made every query on the page slow down at once.
• Added a clear message asking you to narrow the date range or the filters when a query is too broad, in place of a page that never finished loading.

A single unreadable block on a station's disk used to stop every TofuPilot command, including the update that would have fixed it.

• Fixed a damaged local state file stopping the CLI entirely. It is now set aside automatically and rebuilt, and the station stays logged in because credentials are stored separately.
• Added the operating system's own error name and one concrete action to filesystem failures during a pull, so a full disk or a damaged volume names itself instead of looking like a TofuPilot bug.
• Improved the recovery warning, which now points to the copy of the damaged file kept on disk for support.

Some corporate networks block the tofupilot.sh domain, so a station could not install or update the CLI without an IT ticket. Everything a station needs now lives under one domain that stations already reach for the API.

• Moved the CLI installer to curl -fsSL https://tofupilot.app/install | sh (and install.ps1 for Windows), with binaries, updates and the Python runtime mirror served from dl.tofupilot.app and get.tofupilot.app
• Moved the self-hosted deploy script to curl -fsSL https://www.tofupilot.com/deploy | bash, the domain the license check already uses
• Updated the station page, Orbit, docs and FAQ to the new commands; the firewall allowlist for a station is now *.tofupilot.app

The tofupilot.sh commands keep working, and installed stations update themselves without any change.

Filter lists on the runs, phases and measurements pages show at most 30 values, and the cut was silent, so a part number or measurement name past the 30th row looked like it did not exist.

• Added a footer under every cut filter list that stays visible while you scroll and points you to the search box, so you know more values exist and how to reach them
• Added the real total where it is known, for example "Showing 30 of 1,800" on the Measurement Control and Phase Pareto filters and on every environment, deployment and version filter
• Improved row counts in filter lists so digits are grouped the same way as in the command bar

Long multi-slot runs on shared instruments now stop the way an operator expects.

• Added a graceful stop on Ctrl-C, Ctrl-Break, SIGTERM and station stop: running phases are interrupted, the execution-scoped teardown (your power-off) runs, and every slot's run is queued as ABORTED with what it measured
• Added a second-signal escalation to force, ignored inside 3 s of the first so a reflex double Ctrl-C cannot cut a power-off in progress
• Fixed operator stops on multi-slot runs, where the shared plugs were released before the teardown could use them
• Fixed shared plug processes outliving the CLI and holding their instrument session after a crash or kill
• Fixed the operator screen showing idle after a reconnect hours into a run
• Changed phase deadlines to a monotonic clock, so a time sync no longer shortens a timeout

Closing the console window on Windows is best-effort inside the 5 s the OS grants; use Ctrl-C to stop a run, and an instrument-side watchdog for fixture safety.