# Bounded INIT service restart (K1251–K1255)

The policy permits one initial service start and at most `max_restarts`
restarts. Each restart waits at least `base_delay`; later attempts double the
delay up to `max_delay`. A stopped service or exhausted budget cannot restart.

The controller owns one adapter handle while running. Exit first releases
that owner. A failed stop retains the handle and blocks restart until release
succeeds. A failed restart consumes one attempt and schedules another only
when budget remains. The adapter must keep a handle retriable after stop error.

This is a `no_std` policy model. K1255 exercises it in a real EL0 execution
using an in-memory adapter token. Service process lifecycle, driver activity,
clock provenance, process ownership and product release need separate evidence.