Small changes. Better testing.

A read query that runs past the 20 second limit is stopped and answered with a 408 timeout. Until now that status was missing from the API reference, so the SDKs reported it as an unknown error with nothing to catch.

• Added the 408 timeout to every read endpoint of the V2 API reference, with the message that tells you to narrow the date range or the filters and try again
• Added a typed timeout error to the Python and C# SDKs (ErrorTIMEOUT and RequestTimeoutException) so you can handle it without parsing the error text
• Documented the timeout in the REST API error table and in the SDK READMEs

A call that fails now leaves your workspace exactly as it was before you made it, on both API versions.

• Fixed failed calls so any record already written during the call is removed instead of kept.
• Stopped a fully failed import from leaving an empty entry in your import history.
• Kept the failed call visible in API Logs, so you can still see what went wrong.

Preventive security maintenance. We patched the 16 advisories published on 8 September against dependencies TofuPilot ships, two of them rated critical upstream.

• CVE-2026-75604, CVSS 9.0, unauthenticated remote code execution on Windows filesystems.
• GHSA-2xp9-vwfh-vxw4, CVSS 9.5, unauthenticated remote code execution through the image optimization path. No CVE assigned.
• Fourteen further advisories rated high, covering XML parsing, YAML parsing and image decoding.

TofuPilot Cloud requires no action. Self-hosted instances pick these updates up on the next image pull, and updating is recommended.

Measurement Control could take more than a minute to answer on procedures with very high run volume, and the page sometimes stopped loading altogether before any chart appeared.

• Fixed the page stalling on procedures with hundreds of thousands of measurements. The heaviest query dropped from 106 seconds to 5 seconds, and opening a measurement now answers in well under a second.
• Improved the cold page load so the sidebar filter counts wait for the main chart instead of competing with it, which is what made every query on the page slow down at once.
• Added a clear message asking you to narrow the date range or the filters when a query is too broad, in place of a page that never finished loading.

A single unreadable block on a station's disk used to stop every TofuPilot command, including the update that would have fixed it.

• Fixed a damaged local state file stopping the CLI entirely. It is now set aside automatically and rebuilt, and the station stays logged in because credentials are stored separately.
• Added the operating system's own error name and one concrete action to filesystem failures during a pull, so a full disk or a damaged volume names itself instead of looking like a TofuPilot bug.
• Improved the recovery warning, which now points to the copy of the damaged file kept on disk for support.

Some corporate networks block the tofupilot.sh domain, so a station could not install or update the CLI without an IT ticket. Everything a station needs now lives under one domain that stations already reach for the API.

• Moved the CLI installer to curl -fsSL https://tofupilot.app/install | sh (and install.ps1 for Windows), with binaries, updates and the Python runtime mirror served from dl.tofupilot.app and get.tofupilot.app
• Moved the self-hosted deploy script to curl -fsSL https://www.tofupilot.com/deploy | bash, the domain the license check already uses
• Updated the station page, Orbit, docs and FAQ to the new commands; the firewall allowlist for a station is now *.tofupilot.app

The tofupilot.sh commands keep working, and installed stations update themselves without any change.

Filter lists on the runs, phases and measurements pages show at most 30 values, and the cut was silent, so a part number or measurement name past the 30th row looked like it did not exist.

• Added a footer under every cut filter list that stays visible while you scroll and points you to the search box, so you know more values exist and how to reach them
• Added the real total where it is known, for example "Showing 30 of 1,800" on the Measurement Control and Phase Pareto filters and on every environment, deployment and version filter
• Improved row counts in filter lists so digits are grouped the same way as in the command bar

Long multi-slot runs on shared instruments now stop the way an operator expects.

• Added a graceful stop on Ctrl-C, Ctrl-Break, SIGTERM and station stop: running phases are interrupted, the execution-scoped teardown (your power-off) runs, and every slot's run is queued as ABORTED with what it measured
• Added a second-signal escalation to force, ignored inside 3 s of the first so a reflex double Ctrl-C cannot cut a power-off in progress
• Fixed operator stops on multi-slot runs, where the shared plugs were released before the teardown could use them
• Fixed shared plug processes outliving the CLI and holding their instrument session after a crash or kill
• Fixed the operator screen showing idle after a reconnect hours into a run
• Changed phase deadlines to a monotonic clock, so a time sync no longer shortens a timeout

Closing the console window on Windows is best-effort inside the 5 s the OS grants; use Ctrl-C to stop a run, and an instrument-side watchdog for fixture safety.

Multi-slot procedures no longer need one YAML entry per slot.

• Added an integer shorthand for execution.slots: slots: 80 expands to slots slot_01 to slot_80, zero-padded so they sort in order everywhere
• Kept the list form for custom slot keys and names
• Improved load errors: a wrong count or type says what was expected, and a bad entry in the list keeps its own message
• Updated Studio to open procedures that use the shorthand

Operator entries used to be checked differently by the kiosk, the web console and the terminal, and a serial the server would refuse was only caught at upload, after the test had already run.

• Added: every submission is now judged by the station itself; a rejected entry keeps the form open with a plain-language message under the field (“Remove the space (character 3) — allowed: uppercase letters, digits, -”, “Must be exactly 4 digits — you typed 2”), and the raw pattern is never shown to the operator
• Added: prefix and suffix on unit fields and text inputs, displayed locked around the input and composed into the recorded value, so the operator scans only the variable part and pattern never has to repeat the fixed one
• Added: pattern_message for patterns that cannot explain themselves; patterns now match the whole entry (SN-[0-9]+ rejects SCRAP SN-0042 XX, anchors optional), and serial, part, revision and batch fields default to the server's allowed characters so a bad scan fails at the form, not at upload
• Improved: one shared form for phase prompts and unit identification with keyboard-first flow, Ctrl/⌘+Enter submit and password managers suppressed; the Studio editor refuses a pattern the station cannot compile while you type, nudges you to add a message when one cannot be derived, and screen previews use the exact verdict a run would give
• Fixed: “Run again” no longer crashes when the unit config changed between two runs; the docs for text inputs and unit under test cover the new fields (Studio desktop keeps the previous client-side checks for now)