Small changes. Better testing.

Opening Settings > GitLab in a workspace that had not connected a GitLab group yet showed "Something went wrong" instead of the connect button, so the integration could not be set up from the dashboard.

• Fixed the GitLab and Bitbucket settings pages so they load correctly before an integration is connected
• Added error reporting from the dashboard's error screens, so crashes like this one are detected by the team instead of relying on user reports

Multi-slot stations that share one instrument plug across slots could see phases fail with "Connection reset by peer" when several slots called the plug at the same instant.

• Fixed the plug service dropping simultaneous calls: every call is now accepted immediately and executed one at a time, verified with 80 slots on a single shared power supply
• Improved plug shutdown and health checks so a long-running or abandoned instrument call no longer blocks them
• Added a safeguard that skips a queued call whose phase already timed out, so it never runs late on the instrument

On Windows the station kiosk launched Microsoft Edge with generic full-screen flags, which hide the toolbars but leave an ordinary browser session behind them, so pressing Ctrl+T opened a tab on the MSN start page.

• Fixed the kiosk launch on Windows to use Edge's own kiosk mode, which serves a single site in a private session and blocks new tabs and new windows.
• Pinned the kiosk idle timeout to zero, so the window can never be closed and reset under a running test.
• Rewrote the message shown when the local UI cannot bind its port, which blamed privileged ports on every platform and sent Windows operators looking for administrator rights instead of the reserved port ranges that were the real cause.

When a phase failed under the default stop-on-first-failure setting, the remaining phases were skipped and the whole run was reported as aborted, so a normal failing unit landed in the aborted bucket and a filter on Failed never found it.

• Fixed the outcome of a run stopped by a failed phase, which now reports Failed, or Timeout when the phase timed out, instead of Aborted. The skipped phases after the failure are unchanged.
• Kept Aborted for genuine interruptions: an operator stop or kill, and an explicit stop asked for by a phase. An operator kill during a passing phase used to report Error and now reports Aborted.

A run upload whose response never made it back to the station was re-sent and stored a second time, so one test appeared twice on the dashboard.

• Added an idempotency reference that the CLI mints and saves before its first upload attempt, so every retry of the same run returns the run already created instead of storing another one.
• Removed a redundant retry loop inside the CLI upload queue, which had turned a single queued attempt into up to four uploads.
• Extended the reference to the Python, C#, Rust, C++ and MATLAB clients, and to stations already in the field, which pick it up on upgrade with no re-login.

Re-inviting a pending user, or inviting through the authentication API rather than the dashboard, did not follow the same rules as a regular invitation.

• Fixed re-inviting an already-invited user: the link already shared stays valid and its validity is extended; changing the role or access group now issues a fresh invitation instead
• Fixed plan seat limits and the role ceiling not applying to invitations created through the authentication API
• Unified invitation validity at 30 days across every invite path

Self-hosted instances using Microsoft Entra login could leave invited users locked out: Microsoft does not report emails as verified by default, so invitees never saw their pending invitation and, without an email server configured, administrators had to copy invitation links by hand.

• Fixed invited users signing in with a company Microsoft account now landing directly on their pending invitation
• Fixed previously blocked accounts recovering automatically on their next sign-in

Stations, parts and revisions now carry custom metadata, the same typed key/value pairs runs and units already had, so a station's location or a part's supplier lives in TofuPilot instead of a spreadsheet next to it.

• Added a metadata editor to the station, part and revision pages: string, number and boolean values, up to 50 keys per entity, read-only for viewers.
• Added metadata to the V2 create, get and update endpoints for stations, parts and revisions. Updates are a patch: keys you don't send are kept, a null value deletes a key.
• Added a metadata filter and include_metadata to the station and part list endpoints, with per-key operators (in, contains, gte/lte/gt/lt/eq, boolean eq), so you can list every station in one building or every part from one supplier in a single call.
• Added every metadata change to the entity's timeline with who made it and the old and new value. The station Activity section now shows without a CLI install, since these edits come from the dashboard or the API.
• Shipped the new fields and list parameters in the Python, C#, Rust, C++ and MATLAB SDKs.

The duration histogram in the run filters bucketed every run shorter than ten seconds into a single column, so a fast test was drawn a full second away from its real duration and the slider could not select it.

• Fixed the histogram collapsing short runs into one column — it now spans the real range of the runs you are filtering, down to milliseconds
• Fixed the slider handles not lining up with the bars, and typed values like 0.4s being rounded away to no bound at all
• Fixed the histogram failing to load when the run list was filtered by sample, procedure version or environment

Declaring operated_by at the procedure root prompts the operator on the identify-unit screen, where the field wrongly inherited the serial-number character check and rejected email addresses.

• Fixed the Operated By field rejecting emails and other free-text operator names on the identify-unit screen
• Fixed custom metadata values on the same screen being limited to the serial-number character set
• Added regression tests locking the identify-form validation to unit-identity fields only