Small changes. Better testing.

Self-hosted instances behind a private certificate authority no longer need the CA file copied onto every station: the instance publishes its CA bundle, the dashboard puts the bundle's fingerprint into the install command, and the CLI refuses the bundle unless the fingerprint matches before it trusts anything.

• Added SSL_CA_CERT_PATH to the self-hosting deploy script, which validates the bundle, publishes it on the instance and checks the dashboard, storage and realtime hosts against it
• Added tofupilot login --ca-cert-sha256, carried by the station install card and the Studio connect screen, with the CA subject and expiry shown next to the command
• Improved CA handling on stations: a rotated CA is adopted automatically over the existing connection, tofupilot whoami shows the CA in effect, certificate errors name the fix, and the CLI's own updates never trust a customer CA

A station that was offline when a deployment was pushed kept running the previous deployment after it came back online: the dashboard's deployment command is sent once, and a station whose link was down never received it. The dashboard showed the new deployment as ready while runs kept using the old one.

• Added a deployment check every time the station's dashboard link comes up, on start and after every reconnect; when nothing changed it is a single request
• Fixed the station not noticing a dropped dashboard link, so "Connection lost" and "Reconnected" now show on a real drop and telemetry pauses while the link is down
• A check that lands during a run is staged and applied between runs, as for a deployment pushed from the dashboard

On a station, the run that started the station-scoped plugs kept the dashboard live feed open after it ended: the plugs' log stream was still attached to that run, so its events only stopped after a 10 second timeout, and later runs' plug logs were written into the first run's log.

• Fixed station plug logs to follow the run currently using the plugs instead of the one that started them
• Fixed the run log and the dashboard feed of the first run closing as soon as it ends

The CLI's dependencies were updated following recent security advisories, with a few related fixes to how procedure files are read.

• Fixed four security advisories in the TLS library used for uploads, the dashboard link and the station connection.
• Added a warning, in the console, in Studio and at the top of the run logs, for .inf and .nan values and for two layouts a future version will refuse (a quoted text continued at its key's column, a comment touching its value). Procedures using them keep running as before.
• Fixed procedure files starting with a byte order mark, as some Windows editors save them, failing to load.
• Fixed in and not in validators on a list mixing numbers and text, which never matched a measured number.
• Updated plug config to refuse a key written twice, at its line, like the rest of the procedure file.

The first Run again after a station booted could take three times longer than the following ones, because the run start reopened the station's local state file four times while the previous run's upload was still writing to disk.

• Fixed the run start to open the local state file once, so Run again takes about 220 ms from the click to the first prompt, first cycle included
• Reduced disk writes at every run start, which also spares the SD card on Raspberry Pi stations

On Windows stations the kiosk ran inside Edge, so operators saw translate prompts, Copilot, image search buttons and could open tabs with Ctrl+T.

• Added a dedicated kiosk window on Windows and macOS: full screen, no tabs, no address bar, no browser shortcuts, no translate prompt, no sidebar; navigation is limited to the station itself and the window closes when the station stops. Windows needs the WebView2 runtime, which current Windows 10 and 11 editions include.
• Updated the Linux kiosk to run on Chromium only, with translate, autofill and spellcheck prompts turned off and a per-launch profile that is cleaned up automatically. Firefox, Edge and Brave are no longer launched on Linux.
• Added the TofuPilot icon to the kiosk window on every platform.

On a real bench, a teardown that ran after a failure showed as stopped, exhausted retries kept the run going, and a phase could read another phase's results only when scheduling happened to allow it. Each case now behaves the same way every run.

• Fixed teardown phases to report their own outcome after a stop, so a power-off that crashed shows ERROR with its message instead of a silent STOP
• Fixed then: retry so a phase whose retries run out follows on_first_failure, and so a setup phase retries before cancelling the run
• Changed phase.stop() after a failed measurement to read FAIL, so the defective unit enters the failure statistics
• Changed phase results to be visible only to phases that declare the dependency with depends_on or run in a later stage; procedures that read a sibling phase without declaring it must add the entry
• Updated the framework docs: outcome order, when to fail or raise, data sharing between phases, previous attempt on retry, retry exhaustion, phase start order and workers

Between two runs on a station, the next run only started after its Python workers had spawned and each plug had started in turn, so an operator clicking Run again waited on work that could have overlapped.

• Improved run start: the worker pool now spawns while the unit is identified and the plugs start, and plugs of the same scope start together instead of one after another
• Measured on a demo station: Run again to the first prompt went from about 500 ms to 300-420 ms, and a cold start with three plugs from about 1.1 s to 0.7 s
• Fixed a worker that cannot start being reported as a phase error instead of a run initialization error

On a station, clicking Run again or New run on the outcome screen waited for the previous run's upload to the dashboard before the next run could start, and Stop and form responses queued behind it.

• Fixed the next run starting only after the previous upload finished: the upload now completes in the background, so the next run starts as soon as the previous one has released its instruments
• Fixed a 10 second stall after each run on an idle outcome screen that delayed the dashboard's live feed and the station exit
• Fixed a late upload of a previous run stamping its dashboard link on the run that followed, and kept the per-run log complete up to the upload result

A station logged in to a self-hosted instance with --ca-cert showed online, but its run uploads never reached the server: the upload path did not trust the private CA unless it was also installed in the OS trust store.

• Fixed run uploads, the offline upload queue and tofupilot link to trust the certificate passed with --ca-cert, as login and the live link already did
• Improved CA file handling: the file is read once per process and a missing or malformed file warns once instead of on every upload
• Added a build-time guard so every network client in the CLI carries the configured CA