Small changes. Better testing.

A phase that waits for its operator now behaves predictably when the operator answers late, when two threads wait at once, or when an answer is incomplete.

• Fixed an answer submitted after a phase timed out being recorded as a measurement of that phase
• Fixed a phase hanging when two of its threads waited for the operator at the same time; the second wait now fails with a clear error
• Improved error messages: a wait without a screen or a duplicate wait reads as a procedure error, and an incomplete answer no longer says the operator cancelled
• Fixed the terminal UI moving a refreshed prompt to the back of the queue

The first test run on a new machine, or right after a CLI update, could fail before any phase ran, and only a second run worked.

• Fixed the first run after installing or updating the CLI skipping all of its phases and ending FAIL with "Worker failed to start".
• Added checks that a local run without --upload is never uploaded, for YAML, pytest, OpenHTF and Robot Framework procedures.

When Windows blocked the CLI, the installer still said it was not code-signed, which sent IT looking for a fix that already exists.

• Updated the Windows installer's error messages to show the file's signature and give IT one line to act on: allow the publisher TofuPilot SA.
• Added guidance for unsigned preview builds, altered downloads, and files a security tool keeps locked.

A station that started before its network was up could download a CLI update yet keep running the old version until someone restarted it by hand.

• Fixed station self-updates so the station restarts into the new version on its own, and checks again every few minutes after starting offline instead of waiting 4 hours.
• Fixed Windows stations closing their window, or exiting with "already running", after an automatic update.
• Improved deployment updates: instruments are released before a new bundle is swapped in, a failed swap keeps the previous deployment, and a deployment pushed during a test is applied as soon as the test ends.

A phase can now ask the operator for input while it runs and react to the answer, so a calibration loop no longer needs one phase per try.

• Added ui.wait() to the TofuPilot Framework: the phase blocks until the operator clicks Continue, then gets the answer with numbers, switches and multiple choices already typed. Each call shows the phase's screen again with the last answer and the values the phase set since.
• Changed Esc in the terminal UI to cancel a phase prompt on every screen: the phase ends in error instead of continuing on an empty answer, and a phase blocked in ui.wait() gets ui.WaitCancelled.
• Changed --ui-values to answer the first prompt of a phase only, so a phase that loops on ui.wait() asks the following ones.
• Updated Studio and the dashboard operator view to replace a waiting phase's previous prompt with its new one.

Running a procedure on a laptop no longer opens the full-screen kiosk window, and the way the operator UI is shown is one flag instead of a flag and an environment variable.

• Added --ui kiosk|browser|headless to tofupilot run: full screen for a station, a tab in your browser for developing a procedure, or just the printed URL for agents, CI and SSH port-forwards. --no-ui serves no UI.
• Removed --kiosk, --no-kiosk and TOFUPILOT_NO_BROWSER; scripts using them must switch to --ui and --no-ui.
• Changed local-path runs to follow their flags only: they no longer inherit the station's kiosk and terminal UI settings on a machine that is also a station. Deployment runs and the station service still follow the dashboard settings.
• Fixed a station running as a root service opening its own operator UI server for every run.

A measurement that records a value but has no validators now passes, as in OpenHTF and TestStand, instead of showing Unset.

• Fixed the outcome of a measurement with a value and no validators: it is PASS again in the Framework, the station kiosk and the Robot Framework connector. A measurement with no value and no validators stays Unset.
• Fixed TestStand and WATS imports: a step reported as Done now imports as PASS, as ATML imports already did.
• Updated the API reference and the Python, C#, Rust and C++ clients to describe the new rule.

Robot Framework runs now end PASS, FAIL or ERROR by what actually happened, so a failed check is never mistaken for a broken station and the reverse.

• Fixed passing suites without a Suite Setup ending FAIL.
• Fixed failed BuiltIn checks (Should Be Equal, Should Be True, Fail) ending ERROR: they now end FAIL like a failed Measure limit, while crashes and setup failures stay ERROR. A failed check also stands when the test teardown fails afterwards, and errors ignored with Run Keyword And Ignore Error no longer decide the outcome.
• Fixed empty suites ending FAIL as a crash: they now end ERROR with Robot Framework's own reason.

Workflows can now post to Slack, so a failed run or a new batch reaches your team's channel without anyone watching the dashboard.

• Added a Send Slack Message action, available to every organization: paste a Slack incoming webhook URL, write the message with {{variable}} placeholders, and it posts whenever the workflow fires.
• Improved Slack and Discord messages: run data can no longer trigger channel-wide mentions or disguised links, rate limits are retried automatically, and the step error now names the reason Slack or Discord gave.
• Added a username and avatar override to the Discord action, and webhook URLs are now hidden from members with the Viewer role and from execution logs.

Invitations no longer get lost: invitees land back on the invitation after signing in, and unanswered invites get a nudge.

• Added a reminder to invitees 3 days after the invitation, and a notice to the inviter when an invitation expires.
• Added Resend and expired invitations to Settings › Members, plus suggestions of colleagues on your company domain who already use TofuPilot.
• Improved the invitation email and page: they now name who invited you, your role and the expiry date, and you can decline an invitation.
• Fixed sign-in losing the invitation link, and added a banner when you have a pending invitation to another organization.
• Improved security of the MCP connection and the Linear integration. Existing MCP clients reconnect once.