@@ -1560,10 +1560,24 @@ impl ComputeRuntime {
                 return Ok(current);
             }
             let automatic_restart = is_automatic_restart_transition(&current);
-            if !matches!(phase, SandboxPhase::Ready | SandboxPhase::Stopping) && !automatic_restart
+            // Timeout cleanup owns reclamation while the record remains Error.
+            // Its later start may recreate missing compute; an ordinary stop must
+            // not replace that recovery state with Stopping or Stopped.
+            if phase == SandboxPhase::Error && provisioning_deadline::timed_out(&current) {
+                return Err(Status::failed_precondition(
+                    "sandbox provisioning timed out; retry start after timeout cleanup completes",
+                ));
+            }
+            // Error does not prove compute has stopped. Use the normal driver stop
+            // and session cleanup before a subsequent start renews authentication
+            // and repeats configuration admission for the retained sandbox.
+            if !matches!(
+                phase,
+                SandboxPhase::Ready | SandboxPhase::Stopping | SandboxPhase::Error
+            ) && !automatic_restart
             {
                 return Err(Status::failed_precondition(format!(
-                    "sandbox must be Ready or in an automatic restart to stop (current phase: {phase:?})"
+                    "sandbox must be Ready, Error, or in an automatic restart to stop (current phase: {phase:?})"
                 )));
             }
 
@@ -1775,8 +1789,13 @@ impl ComputeRuntime {
             ) && !is_failed_main_process_result(&current)
                 && !provisioning_timeout
             {
+                let recovery_hint = if phase == SandboxPhase::Error {
+                    "; stop the sandbox before retrying start"
+                } else {
+                    ""
+                };
                 return Err(Status::failed_precondition(format!(
-                    "sandbox must be Stopped, Completed, or a failed main-process Error to start (current phase: {phase:?})"
+                    "sandbox must be Stopped, Completed, or a failed main-process Error to start (current phase: {phase:?}){recovery_hint}"
                 )));
             }
             if phase == SandboxPhase::Completed || is_failed_main_process_result(&current) {
@@ -7390,6 +7409,8 @@ pub fn new_test_runtime_with_driver(
 
 #[cfg(test)]
 mod tests {
+    mod error_recovery;
+
     use super::*;
     use futures::stream;
     use openshell_core::proto::compute::v1::{
 
@@ -0,0 +1,272 @@
+// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+//! Explicit recovery must stop retained compute before issuing a fresh launch.
+
+use super::*;
+use crate::auth::sandbox_session::PersistedSandboxIdentity;
+use openshell_core::proto::ConfigurationAdmissionState;
+
+async fn stored(runtime: &ComputeRuntime, id: &str) -> Sandbox {
+    runtime
+        .store
+        .get_message::<Sandbox>(id)
+        .await
+        .unwrap()
+        .unwrap()
+}
+
+#[tokio::test]
+async fn failed_gateway_start_can_be_stopped_and_retried() {
+    let driver = ControlledDriver::new();
+    driver.set_start_outcome(ControlledLifecycleOutcome::Error(
+        "supervisor endpoint unavailable",
+    ));
+    driver.set_runtime_identity("retained-runtime");
+    let mut runtime =
+        test_runtime_with_gateway_managed_lifecycle(driver.clone(), "test-driver").await;
+    enable_runtime_identity_binding(&mut runtime);
+    let mut sandbox = sandbox_record("retained-id", "retained", SandboxPhase::Ready);
+    sandbox.spec = Some(SandboxSpec {
+        template: Some(SandboxTemplate {
+            image: "example.test/workload:retained".into(),
+            ..Default::default()
+        }),
+        command: vec!["sleep".into(), "3600".into()],
+        ..Default::default()
+    });
+    sandbox.status.as_mut().unwrap().configuration_activated = Some(true);
+    set_compute_runtime_binding(&mut sandbox, "retained-runtime");
+    runtime.store.put_message(&sandbox).await.unwrap();
+
+    // Exercise the production startup sweep rather than inventing its failure record.
+    runtime.start_persisted_sandboxes().await.unwrap();
+    let failed = stored(&runtime, sandbox.object_id()).await;
+    assert_eq!(failed.phase(), SandboxPhase::Error as i32);
+    assert_eq!(ready_condition(&failed).unwrap().reason, "StartFailed");
+    driver.set_start_outcome(ControlledLifecycleOutcome::Ok);
+    runtime.start_persisted_sandboxes().await.unwrap();
+    assert_eq!(
+        driver.start_calls(),
+        1,
+        "gateway restart does not retry this Error"
+    );
+    let error = runtime
+        .start_sandbox("default", "retained")
+        .await
+        .unwrap_err();
+    assert_eq!(error.code(), Code::FailedPrecondition);
+    assert!(
+        error
+            .message()
+            .contains("stop the sandbox before retrying start")
+    );
+
+    let session = ssh_session_record("old-session", sandbox.object_id());
+    runtime.store.put_message(&session).await.unwrap();
+    register_test_supervisor_session(&runtime, sandbox.object_id());
+    let stopped = runtime.stop_sandbox("default", "retained").await.unwrap();
+    assert_eq!(stopped.phase(), SandboxPhase::Stopped as i32);
+    assert_eq!(stopped.object_id(), sandbox.object_id());
+    assert_eq!(stopped.object_workspace(), sandbox.object_workspace());
+    assert_eq!(stopped.spec, sandbox.spec);
+    assert_eq!(
+        sandbox_compute_runtime_identity(&stopped),
+        "retained-runtime"
+    );
+    assert_eq!(
+        driver.stop_requests(),
+        vec![("retained-id".into(), "retained".into())]
+    );
+    assert_eq!(driver.delete_calls(), 0);
+    assert!(!runtime.supervisor_sessions.has_session(sandbox.object_id()));
+    assert!(
+        runtime
+            .store
+            .get_message::<SshSession>(session.object_id())
+            .await
+            .unwrap()
+            .is_none()
+    );
+
+    let authority = test_session_authority();
+    let starting = runtime
+        .start_sandbox_authenticated("default", "retained", Some(&authority))
+        .await
+        .unwrap();
+    assert_eq!(starting.phase(), SandboxPhase::Starting as i32);
+    assert_eq!(starting.object_id(), sandbox.object_id());
+    assert_eq!(starting.spec, sandbox.spec);
+    let before =
+        PersistedSandboxIdentity::read(&failed.metadata.as_ref().unwrap().annotations).unwrap();
+    let after =
+        PersistedSandboxIdentity::read(&starting.metadata.as_ref().unwrap().annotations).unwrap();
+    assert_eq!(after.runtime_generation, before.runtime_generation);
+    assert_eq!(after.auth_epoch.get(), before.auth_epoch.get() + 1);
+    assert_ne!(after.gateway_token_id, before.gateway_token_id);
+    assert_eq!(
+        driver.start_expected_runtime_identities(),
+        vec!["retained-runtime", "retained-runtime"]
+    );
+    let status = starting.status.as_ref().unwrap();
+    assert_eq!(status.configuration_activated, Some(true));
+    assert_eq!(
+        status.configuration_admission.as_ref().unwrap().state,
+        ConfigurationAdmissionState::Pending as i32
+    );
+
+    // A live driver and connected supervisor cannot skip fresh configuration admission.
+    register_test_supervisor_session(&runtime, sandbox.object_id());
+    let snapshot = ready_driver_sandbox(sandbox.object_id(), sandbox.object_name());
+    driver.set_get_outcome(ControlledGetOutcome::Sandbox(Box::new(snapshot.clone())));
+    runtime.apply_sandbox_update(snapshot).await.unwrap();
+    assert_eq!(
+        stored(&runtime, sandbox.object_id()).await.phase(),
+        SandboxPhase::Starting as i32
+    );
+    assert_eq!(driver.delete_calls(), 0);
+}
+
+#[tokio::test]
+async fn explicit_stop_accepts_driver_error_reasons_without_an_allowlist() {
+    for reason in ["ProcessExited", "ContainerExited", "DriverSpecificFailure"] {
+        let driver = ControlledDriver::new();
+        let runtime = test_runtime(driver.clone()).await;
+        let sandbox = error_sandbox_record("error-id", "errored", reason);
+        runtime.store.put_message(&sandbox).await.unwrap();
+
+        let stopped = runtime.stop_sandbox("default", "errored").await.unwrap();
+        assert_eq!(stopped.phase(), SandboxPhase::Stopped as i32, "{reason}");
+        assert_eq!(
+            driver.stop_calls(),
+            1,
+            "Error is not proof that compute stopped"
+        );
+        assert_eq!(driver.delete_calls(), 0);
+    }
+}
+
+#[tokio::test]
+async fn pending_driver_operation_blocks_error_recovery_without_mutation() {
+    let driver = ControlledDriver::new();
+    let runtime = test_runtime(driver.clone()).await;
+    let mut sandbox = error_sandbox_record("pending-id", "pending", "StartFailed");
+    let mut operation = provisioning_deadline::new_record(openshell_core::time::now_ms());
+    operation.driver_operation_pending = true;
+    operation.driver_operation_id = "owned-operation".into();
+    sandbox.status.as_mut().unwrap().provisioning = Some(operation);
+    runtime.store.put_message(&sandbox).await.unwrap();
+    let before = stored(&runtime, sandbox.object_id()).await;
+
+    let error = runtime
+        .stop_sandbox("default", "pending")
+        .await
+        .unwrap_err();
+    assert_eq!(error.code(), Code::FailedPrecondition);
+    assert!(error.message().contains("operation is still pending"));
+    assert_eq!(stored(&runtime, sandbox.object_id()).await, before);
+    assert_eq!(driver.stop_calls(), 0);
+    assert_eq!(driver.delete_calls(), 0);
+}
+
+#[tokio::test]
+async fn timeout_stop_preserves_cleanup_and_direct_start_recovery() {
+    for cleanup_complete in [false, true] {
+        let driver = ControlledDriver::new();
+        driver.set_start_outcome(ControlledLifecycleOutcome::NotFound);
+        driver.track_compute.store(true, Ordering::SeqCst);
+        let runtime = test_runtime(driver.clone()).await;
+        let mut sandbox = error_sandbox_record("timeout-id", "timeout", "ProvisioningTimedOut");
+        let mut operation = provisioning_deadline::new_record(0);
+        operation.timeout_time = openshell_core::time::timestamp_from_millis(300_000).ok();
+        operation.cleanup_retry_time = openshell_core::time::timestamp_from_millis(310_000).ok();
+        if cleanup_complete {
+            operation.cleanup_completed_time =
+                openshell_core::time::timestamp_from_millis(320_000).ok();
+        }
+        sandbox.status.as_mut().unwrap().provisioning = Some(operation);
+        runtime.store.put_message(&sandbox).await.unwrap();
+        let before = stored(&runtime, sandbox.object_id()).await;
+
+        let error = runtime
+            .stop_sandbox("default", "timeout")
+            .await
+            .unwrap_err();
+        assert_eq!(error.code(), Code::FailedPrecondition);
+        assert!(error.message().contains("start"));
+        assert_eq!(stored(&runtime, sandbox.object_id()).await, before);
+        assert_eq!(driver.stop_calls(), 0, "timeout cleanup owns reclamation");
+
+        let result = runtime.start_sandbox("default", "timeout").await;
+        if cleanup_complete {
+            assert_eq!(result.unwrap().phase(), SandboxPhase::Starting as i32);
+            assert!(
+                driver.compute_exists.load(Ordering::SeqCst),
+                "start recreates the missing backend after cleanup"
+            );
+            assert_eq!(driver.start_calls(), 1);
+        } else {
+            assert_eq!(result.unwrap_err().code(), Code::FailedPrecondition);
+            assert_eq!(stored(&runtime, sandbox.object_id()).await, before);
+            assert_eq!(driver.start_calls(), 0);
+        }
+        assert_eq!(driver.delete_calls(), 0);
+    }
+}
+
+#[tokio::test]
+async fn failed_error_stop_retains_retryable_state_without_claiming_success() {
+    for observed_error in [false, true] {
+        let driver = ControlledDriver::new();
+        driver.set_stop_outcome(ControlledLifecycleOutcome::Error(
+            "stop response unavailable",
+        ));
+        let runtime = test_runtime(driver.clone()).await;
+        let sandbox = error_sandbox_record("retry-id", "retry", "ProcessExited");
+        if observed_error {
+            let mut snapshot = ready_driver_sandbox("retry-id", "retry");
+            snapshot.status.as_mut().unwrap().conditions = vec![DriverCondition {
+                r#type: "Ready".into(),
+                status: "False".into(),
+                reason: "ProcessExited".into(),
+                message: "runtime exited".into(),
+                ..Default::default()
+            }];
+            driver.set_get_outcome(ControlledGetOutcome::Sandbox(Box::new(snapshot)));
+        } else {
+            // A response for a different sandbox cannot settle this one's stop.
+            driver.set_get_outcome(ControlledGetOutcome::Sandbox(Box::new(
+                ready_driver_sandbox("foreign-id", "retry"),
+            )));
+        }
+        runtime.store.put_message(&sandbox).await.unwrap();
+
+        let error = runtime.stop_sandbox("default", "retry").await.unwrap_err();
+        assert_eq!(error.code(), Code::Internal);
+        let retained = stored(&runtime, sandbox.object_id()).await;
+        assert_eq!(
+            retained.phase(),
+            if observed_error {
+                SandboxPhase::Error
+            } else {
+                SandboxPhase::Stopping
+            } as i32
+        );
+        assert_eq!(retained.object_id(), sandbox.object_id());
+        driver.set_stop_outcome(ControlledLifecycleOutcome::Ok);
+        assert_eq!(
+            runtime
+                .stop_sandbox("default", "retry")
+                .await
+                .unwrap()
+                .phase(),
+            SandboxPhase::Stopped as i32
+        );
+        assert_eq!(
+            driver.stop_requests(),
+            vec![("retry-id".into(), "retry".into()); 2]
+        );
+        assert_eq!(driver.start_calls(), 0);
+        assert_eq!(driver.delete_calls(), 0);
+    }
+}
@@ -943,6 +943,10 @@ command. Starting a fresh instance invalidates SSH sessions issued for the
 previous runtime generation. Delete an inactive sandbox normally when you no
 longer need its retained state.
 
+If an infrastructure failure leaves a sandbox in `Error`, fix the reported cause, then run `sandbox stop` followed by `sandbox start`. Wait for stop to succeed before starting. This retains the sandbox and its persistent workspace on backends that support restarting stopped sandboxes; it cannot recover deleted resources or storage.
+
+For a provisioning timeout, wait for cleanup to finish, then run `sandbox start` directly.
+
 ## Delete Sandboxes
 
 Deleting a sandbox stops all processes, releases resources, and purges injected credentials.
 
@@ -531,6 +531,8 @@ sandbox, even under the same name, creates a different identity. See the
 [sandbox SSH documentation](https://docs.nvidia.com/openshell/latest/how-it-works/sandboxes/overview.md)
 for verification behavior and release compatibility.
 
+For an infrastructure `Error` on a backend that supports restarting stopped sandboxes, fix the reported cause, run `sandbox stop`, and wait for it to succeed before running `sandbox start`. This retains the sandbox and persistent workspace but cannot recover deleted resources or storage. For a provisioning timeout, wait for cleanup to finish, then run `sandbox start` directly.
+
 ---
 
 ## Workflow 4: Policy Iteration Loop