Why is `restart: on-failure` not equivalent to high availability?

It only handles the case where the process crashes on the same host and that host remains available to restart it; it does nothing to protect against the host itself failing, and it doesn't eliminate the downtime gap that occurs during the restart (cold start, dependency reconnection, cache warm-up).