v2.1.0

Upgrading once now finishes the job: macOS carries a single backend, a reinstall moves the running control plane onto it, and a release is one pushed tag.

• The macOS app no longer carries a second backend; installing the CLI is installing the backend. The app used to bundle a whole Python runtime, and opening it pinned the background service to that copy. uv tool install --force . then replaced the package on disk while the running process stayed on the app's older code, so a backend change survived any number of reinstalls. The app is now only the interface. If you never installed the CLI separately, the app names the command to run rather than quietly failing to start. Building the app also drops from minutes to seconds.
• A reinstall now moves the running control plane onto the new version. Deciding whether a process was stale relied on a hand-maintained capability list, so the same version number could sit in front of an older process indefinitely with nothing to show for it. A version or capability mismatch now restarts it.
• MCP says so when it reaches a control plane that has not been restarted. A new tool hitting an older API used to return an ordinary HTTP error that gave no hint an upgrade was pending. It now names both versions, the missing capabilities, and the restart.
• Releasing is one pushed tag. Pushing the tag creates the GitHub Release, and the Windows archive is uploaded as before. If the version has been bumped and the changelog entry sealed but the tag is missing, CI now fails and names the next step — 2.0.0 sat in exactly that state: commits pushed, CI green, no tag and no release, with nothing to catch it.
• serverpilot doctor lists the versions in play. Control plane, local CLI, MCP entry point, and each server's collector, and it names the next step — restart the control plane, or reinstall the collector on a specific machine — when they disagree. That was previously a per-machine guess.
• The server collection entry point reports its own version. An older script that omits the field keeps working, so a partially upgraded fleet does not start refusing allocations.
• A local plugin on the wrong contract no longer disappears without a word. A plugin still on the old protocol was skipped during discovery and looked simply absent; it now surfaces as an explicit error in doctor.
• History charts stop drawing the same card twice. A server whose GPUs changed — a rebuilt container, for instance — leaves the old cards in the database, and history returned them too, so an eight-card machine drew sixteen lines and every card appeared twice in the legend. History now returns only the cards currently on the machine, and a line with no data in the selected window no longer takes a legend slot.
• The server detail sheet is no longer sparse and over-tall. The group card stacked every field into one column and left most of the width empty; it now fills the width with the same layout the host card uses, with long paths and notes on their own rows.
• Two easily confused card counts were renamed. "At most 4 cards" and "per-lease ceiling 8 cards" used to sit side by side and read as a contradiction. They are now the number available on this machine right now (which moves) and the ceiling one apply can reach (which does not); when they agree only one is shown, and an unknown ceiling is left blank rather than invented.
• An upgrade checklist collects the steps that cannot be automated. Confirming the control-plane process actually changed version, reconnecting MCP in the client so the tool list refreshes, reinstalling the agent policy, and upgrading the collection entry point and occupancy helper on each server.
• When the local control plane is up, serverpilot daemon status reports it live instead of following a system proxy or HTTP_PROXY into a false dead state. CLI, MCP, and the Windows desktop bridge no longer send 127.0.0.1 through an environment or OS HTTP proxy. On macOS, Python still reads the System Configuration proxy when the process has no proxy variables; those probes used to go through it, so curl could succeed while the CLI said the service was down.
• gpu_status(server_id=…) no longer includes groups you did not ask about, and no longer reports those groups as a 0-card ceiling. The rule that a group without per-card inventory must still appear was also matching groups that were only out of scope for this call; an empty member set then aggregated the one-apply limit to 0, so an agent or the desktop would treat a cluster with free cards as empty. A delegated cluster still appears when the query is not narrowed — it has a member, just not per-card rows. A direct group that is genuinely full still reports largest_allocatable_block 0.