Owns one optional subtree of an instance (dispatch, storage, lifecycle, metrics, or one of the secondary listeners) and never escalates its failure.

A plain child of Ankusa.Instance shares the root's restart budget: a subtree that crashes in a loop (a sink whose adapter keeps raising at boot, a port another process took) exhausts it and takes the whole instance down — edge listener included, so the node stops acking hooks because something it did not need to ack them is broken. This manager starts the subtree under its own :one_for_one supervisor and, when that supervisor gives up (its restart intensity is exhausted), does not exit. It waits and starts the subtree again, backing off from :base_backoff_ms doubling up to :max_backoff_ms while restarts keep failing, and starting over once the subtree has stayed up for a minute.

A child that cannot start when the instance boots still fails the boot: a misconfigured listener or sink should stop a deploy, not be retried quietly.

Every outage emits [:ankusa, :instance, :subtree_down] and every recovery [:ankusa, :instance, :subtree_up] (see Ankusa.Telemetry).

Options

• :instance — the instance name (required)
• :domain — an atom naming the domain, e.g. :dispatch (required)
• :children — the child specs of the subtree (required)
• :base_backoff_ms — first restart delay, default 1_000
• :max_backoff_ms — restart delay ceiling, default 60_000

The two backoff options exist for tests.