ContextLattice v4.0.5: Stable at Scale.
A running container is not useful uptime when the retrieval path stalls behind an unindexed large-store filter. v4.0.5 hardens the data path, the dashboard, and the release truth that operators actually depend on.
The CLI remains the primary interface. The dashboard, HTTP, and MCP remain companion surfaces.
What Changed
- Qdrant startup hardening creates keyword payload indexes for
projectandtopic_tags, the filters used by real project- and topic-scoped retrieval. - Startup migrations use a bounded, serialized owner so concurrent services do not race the same collection mutation.
- Large-store readiness remains fail closed: the gateway does not advertise the indexed path until the migration contract completes or reports a precise degraded state.
- The dashboard moves from Next.js 16.2.6 to 16.2.11, Auth.js to 4.24.15, and Sharp to 0.35.0; the resulting production dependency tree has no known npm audit findings.
- The dashboard's final responsive cascade restores the intended single-column metric flow below 680px without changing the desktop design system.
- Visual gates now cover the core console, overview, status, mind-map, account, pricing, billing, and download surfaces at desktop and mobile sizes.
- Live-data captures wait for an explicit settled state and fail on document-level horizontal overflow or mobile metric-grid regression.
- macOS download surfaces identify the DMG as an unsigned technical preview until Developer ID signing and notarization credentials are configured.
Evidence Boundary
The large-store canary exercised bounded read/write behavior against a live Qdrant collection with more than 707,000 points. The verified window retained stable gateway identity, zero container restarts, zero OOM kills, and the required project and topic_tags keyword indexes.
That proof establishes the tested local runtime and exact release tree. It does not turn a hosted check, an unsigned installer, or a container health response by itself into retrieval proof.
What Did Not Change
- The CLI-first agent contract.
- Public local mode remains account-free; hosted authentication remains opt-in through
AUTH_REQUIRED=true. - The public Apache-2.0 and commercial BUSL-1.1 source boundary.
- Aggregate Signal remains a controlled activation preview under its existing privacy and utility gates.
- No Apple signing identity or notarization credential is bundled or implied.
Upgrade
Existing v4 installations can update normally. No manual data migration is required. The first startup may spend bounded time ensuring the large-store payload indexes exist before the affected retrieval path is considered ready.