ContextLattice v4.0.4: Recovery Without Collateral Damage.

A self-healer should restore the service, not repeatedly stop the machine beneath it. v4.0.4 turns ContextLattice host recovery into a fail-closed, explicitly bounded state machine.

The CLI remains the primary interface. The dashboard, HTTP, and MCP remain companion surfaces.

What Changed

• Periodic host supervision is non-destructive by default. Health-only failure and high CPU never stop OrbStack.
• Every Docker probe and container action uses the configured explicit Docker context.
• Gateway forward repair waits for three consecutive health failures, targets only the labeled gateway container, and runs once per health outage.
• OrbStack VM restart remains disabled unless an operator explicitly opts in.
• Opt-in VM recovery requires five consecutive Docker failures, startup grace, post-restart grace, a 15-minute cooldown, a one-attempt-per-outage latch, and a one-attempt-per-hour circuit breaker.
• VM recovery uses only a graceful orb stop followed by orb start. Force-stop and process-kill paths no longer exist.
• Concurrent triggers are single-flight, preventing competing state writes or duplicate recovery actions.
• Health validation parses the root JSON ok boolean instead of substring-matching response text.
• stop now verifies that launchd unloaded the exact job; failure preserves the plist and returns a real error.
• Ordinary global-tool upgrades refresh the host helper and safely migrate an already-loaded supervisor without enabling one for users who never installed it.
• The live supervisor no longer depends on Python for health, timeout, state, or JSON handling.

Safety Boundary

ContextLattice does not auto-enable periodic host supervision. Installing or upgrading the product copies the helper; an existing loaded runner is migrated to fail-closed defaults, while an absent runner remains absent.

Container shedding is also disabled by default. Enabling VM recovery does not remove the failure threshold, grace periods, outage latch, cooldown, circuit breaker, single-flight lock, or graceful-stop-only invariant.

What Did Not Change

• The CLI-first agent contract.
• Gateway, retrieval, storage, session, runner, inference, or memory semantics.
• Public local mode remains account-free; hosted authentication remains opt-in through AUTH_REQUIRED=true.
• The public Apache-2.0 and commercial BUSL-1.1 source boundary.
• Aggregate Signal remains a controlled activation preview under its existing privacy and utility gates.

Upgrade

Existing v4 installations can update normally. No data migration or new required service is introduced.