Ready is a real boundary

Shared referencereadiness boundarynot crossed ↕ crossed

Branch A

Before-ready load failure

No automatic restart path

startingchild launched
load failure before readystartup contract incomplete
stopped before readinesscapability unavailable

The path ends at the square bar. It does not connect to the active-crash restart bays.

Branch B

Unexpected exit after active

Initial launch + three automatic restarts

Plugin child processactive runtimeruntime unavailable

initial launchlaunch 1 of up to 4
readyboundary crossed
activecapability available
crashunexpected exit

Amp-owned cleanupcapability withdrawnNo unregister message comes from the child.

backoff · no timing encodedrestart 1
quiet gaprestart 2
quiet gaprestart 3cap

Amp capability statenot yet availablecapability availablecapability withdrawn

The three restart labels follow the initial launch, allowing up to four launches total. Recovery is bounded; success is not guaranteed.

Two distinct failure contracts

Before ready

A load failure prevents readiness. The capability never becomes available, the path stops before the gate, and this scene shows no automatic restart continuation.

After active

An unexpected exit after active state makes the runtime unavailable. Amp-owned registry cleanup withdraws the capability, then Amp may launch the child three more times: restart 1, restart 2, and restart 3.

The initial launch is not a restart. The complete active-crash path therefore permits up to four launches. Backoff is shown as unlabeled quiet space; no exact schedule or guaranteed recovery is claimed.