@@ -0,0 +1,8 @@
+---
+"ftw": patch
+---
+
+Retry a driver that fails to start, for example a USB P1 meter that is not
+ready at boot. FTW tries again after 10 s and doubles the wait up to 5 min
+until the driver starts, leaves the config or is removed. Before, the site
+stayed without control until a restart or a settings save.
@@ -122,6 +122,9 @@ type Registry struct {
 	lifecycleHook    func(name string)
 	lifecycleMu      sync.Mutex
 	lifecycleGates   map[string]*lifecycleGate
+	spawnRetries     map[string]*spawnRetry
+	spawnInflight    map[string]struct{}
+	spawnRetryClosed bool
 }
 
 // lifecycleGate serializes every lifecycle transition for one driver name.
@@ -536,7 +539,7 @@ func legacyDriverRequiresDefaultMode(path string, hasCommand bool) (bool, error)
 // add is the shared driver construction path. The caller must hold the
 // lifecycle gate for cfg.Name. startupDefault is false only for connection
 // probes; operational drivers use the startup safety gate.
-func (r *Registry) add(ctx context.Context, cfg config.Driver, startupDefault bool) error {
+func (r *Registry) add(ctx context.Context, cfg config.Driver, startupDefault bool) (err error) {
 	if ctx == nil {
 		ctx = context.Background()
 	}
@@ -546,6 +549,15 @@ func (r *Registry) add(ctx context.Context, cfg config.Driver, startupDefault bo
 		return fmt.Errorf("driver %q already registered", cfg.Name)
 	}
 	r.mu.Unlock()
+	if startupDefault {
+		prevDelay := r.takeSpawnRetry(cfg.Name)
+		retryCfg := cfg
+		defer func() {
+			if err != nil {
+				r.scheduleSpawnRetry(retryCfg, prevDelay, err)
+			}
+		}()
+	}
 
 	if cfg.Lua == "" {
 		return fmt.Errorf("driver %q: must specify `lua` path", cfg.Name)
@@ -1206,6 +1218,7 @@ func (r *Registry) remove(name string, skipDefault bool) {
 // lets Restart and Reload keep the old generation and its replacement in one
 // serialized transition instead of opening an Add/Remove gap.
 func (r *Registry) removeLocked(name string, skipDefault bool) {
+	r.takeSpawnRetry(name)
 	skipDefault = skipDefault || r.controlBlocked()
 	r.mu.Lock()
 	rd, ok := r.rec[name]
@@ -1441,6 +1454,11 @@ func (r *Registry) Names() []string {
 
 // ShutdownAll stops every driver. Blocks until all poll loops exit.
 func (r *Registry) ShutdownAll() {
+	// An attempt in flight holds its gate and tears its driver down itself
+	// once it sees the registry closed. Wait for it.
+	for _, n := range r.closeSpawnRetries() {
+		r.acquireLifecycle(n)()
+	}
 	r.mu.Lock()
 	names := make([]string, 0, len(r.rec))
 	for n := range r.rec {
@@ -1467,6 +1485,14 @@ func (r *Registry) Reload(ctx context.Context, newDrivers []config.Driver, troub
 		}
 		active = append(active, d)
 	}
+	// Stop retrying a driver that failed to start and has left the config.
+	for _, n := range r.pendingSpawnRetries() {
+		if _, ok := findDriver(active, n); !ok {
+			release := r.acquireLifecycle(n)
+			r.removeLocked(n, false)
+			release()
+		}
+	}
 
 	r.mu.Lock()
 	troubleshootingChanged := r.troubleshootingMode != troubleshootingMode
 
@@ -0,0 +1,131 @@
+package drivers
+
+import (
+	"context"
+	"log/slog"
+	"time"
+
+	"github.com/srcfl/ftw/go/internal/config"
+)
+
+// A driver whose start fails (a serial node not yet enumerated, a device
+// still booting after a power cut) is retried with this backoff until it
+// starts, leaves the config, or the registry shuts down. Running drivers are
+// never torn down here.
+const (
+	spawnRetryMinDelay = 10 * time.Second
+	spawnRetryMaxDelay = 5 * time.Minute
+)
+
+// spawnRetry is one pending retry. The map entry is the claim: an Add,
+// Restart, Reload or Remove for the same name replaces or deletes it under the
+// lifecycle gate, so a timer that fires late finds a different entry and stops.
+type spawnRetry struct {
+	cfg        config.Driver
+	delay      time.Duration
+	attempting bool
+	timer      *time.Timer
+}
+
+// takeSpawnRetry removes the pending retry for name and returns the delay the
+// next failure should double, or 0 when this attempt did not come from the
+// retry timer. The caller holds the lifecycle gate for name.
+func (r *Registry) takeSpawnRetry(name string) time.Duration {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	e := r.spawnRetries[name]
+	if e == nil {
+		return 0
+	}
+	delete(r.spawnRetries, name)
+	e.timer.Stop()
+	if e.attempting {
+		return e.delay
+	}
+	return 0
+}
+
+func (r *Registry) scheduleSpawnRetry(cfg config.Driver, prev time.Duration, cause error) {
+	delay := spawnRetryMinDelay
+	if prev > 0 {
+		delay = min(2*prev, spawnRetryMaxDelay)
+	}
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if r.spawnRetryClosed {
+		return
+	}
+	if r.spawnRetries == nil {
+		r.spawnRetries = make(map[string]*spawnRetry)
+	}
+	e := &spawnRetry{cfg: cfg, delay: delay}
+	e.timer = time.AfterFunc(delay, func() { r.retrySpawn(cfg.Name, e) })
+	r.spawnRetries[cfg.Name] = e
+	slog.Warn("driver failed to start; will retry", "name", cfg.Name, "retry_in", delay, "err", cause)
+}
+
+func (r *Registry) retrySpawn(name string, e *spawnRetry) {
+	release := r.acquireLifecycle(name)
+	defer release()
+	r.mu.Lock()
+	if r.spawnRetries[name] != e {
+		r.mu.Unlock()
+		return
+	}
+	e.attempting = true
+	// add deletes the map entry before the driver reaches r.rec. Until add
+	// returns, the in-flight mark is what lets Reload and ShutdownAll find
+	// this name and wait on its gate.
+	if r.spawnInflight == nil {
+		r.spawnInflight = make(map[string]struct{})
+	}
+	r.spawnInflight[name] = struct{}{}
+	r.mu.Unlock()
+	err := r.add(context.Background(), e.cfg, true)
+	r.mu.Lock()
+	delete(r.spawnInflight, name)
+	closed := r.spawnRetryClosed
+	r.mu.Unlock()
+	if err != nil {
+		return
+	}
+	if closed {
+		// Shutdown began while this attempt ran and may have missed it.
+		r.removeLocked(name, false)
+		return
+	}
+	slog.Info("driver started on retry", "name", name)
+}
+
+// pendingSpawnRetries lists names with a scheduled retry or one in flight.
+func (r *Registry) pendingSpawnRetries() []string {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	out := make([]string, 0, len(r.spawnRetries)+len(r.spawnInflight))
+	for n := range r.spawnRetries {
+		out = append(out, n)
+	}
+	for n := range r.spawnInflight {
+		if _, dup := r.spawnRetries[n]; !dup {
+			out = append(out, n)
+		}
+	}
+	return out
+}
+
+// closeSpawnRetries stops every pending retry, refuses new ones and returns
+// the names whose attempt is still in flight.
+func (r *Registry) closeSpawnRetries() []string {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.spawnRetryClosed = true
+	for _, e := range r.spawnRetries {
+		e.timer.Stop()
+	}
+	r.spawnRetries = nil
+	inflight := make([]string, 0, len(r.spawnInflight))
+	for n := range r.spawnInflight {
+		inflight = append(inflight, n)
+	}
+	return inflight
+}
@@ -0,0 +1,135 @@
+package drivers
+
+import (
+	"context"
+	"errors"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/srcfl/ftw/go/internal/config"
+	"github.com/srcfl/ftw/go/internal/telemetry"
+)
+
+// blockingSerialRegistry fails the first open, then blocks every later open
+// until the test sends a result.
+func blockingSerialRegistry(t *testing.T) (*Registry, chan struct{}, chan error) {
+	t.Helper()
+	entered := make(chan struct{}, 4)
+	result := make(chan error)
+	first := true
+	r := NewRegistry(telemetry.NewStore())
+	r.SerialFactory = func(name string, c *config.SerialConfig) (SerialCap, error) {
+		if first {
+			first = false
+			return nil, errors.New("no such device")
+		}
+		entered <- struct{}{}
+		if err := <-result; err != nil {
+			return nil, err
+		}
+		return fakeSerial{}, nil
+	}
+	t.Cleanup(r.ShutdownAll)
+	return r, entered, result
+}
+
+// startInflightRetry fails a boot Add, then runs its retry until it blocks
+// in the serial open. The returned channel closes when the retry returns.
+func startInflightRetry(t *testing.T, r *Registry, cfg config.Driver, entered chan struct{}) chan struct{} {
+	t.Helper()
+	if err := r.Add(context.Background(), cfg); err == nil {
+		t.Fatal("expected first Add to fail")
+	}
+	e := pendingSpawnRetry(r, cfg.Name)
+	if e == nil {
+		t.Fatal("no retry scheduled")
+	}
+	e.timer.Stop()
+	done := make(chan struct{})
+	go func() { r.retrySpawn(cfg.Name, e); close(done) }()
+	select {
+	case <-entered:
+	case <-time.After(5 * time.Second):
+		t.Fatal("retry did not reach the serial open")
+	}
+	return done
+}
+
+// returnsWithin reports whether done closes within d.
+func returnsWithin(done chan struct{}, d time.Duration) bool {
+	select {
+	case <-done:
+		return true
+	case <-time.After(d):
+		return false
+	}
+}
+
+// The user disables a failing driver while a retry runs, and the retry then
+// succeeds. The disabled driver must not be left running.
+func TestReloadDuringInflightRetrySuccessStopsDriver(t *testing.T) {
+	r, entered, result := blockingSerialRegistry(t)
+	cfg := serialRetryDriver(t)
+	done := startInflightRetry(t, r, cfg, entered)
+
+	reloadDone := make(chan struct{})
+	go func() {
+		disabled := cfg
+		disabled.Disabled = true
+		r.Reload(context.Background(), []config.Driver{disabled}, false)
+		close(reloadDone)
+	}()
+	if returnsWithin(reloadDone, 300*time.Millisecond) {
+		t.Error("Reload returned while the retry attempt was still in flight")
+	}
+	result <- nil
+	<-done
+	<-reloadDone
+	if slices.Contains(r.Names(), "p1") {
+		t.Fatalf("driver disabled in config is running after an in-flight retry: %v", r.Names())
+	}
+	if e := pendingSpawnRetry(r, "p1"); e != nil {
+		t.Fatalf("retry scheduled for a disabled driver: %+v", e)
+	}
+}
+
+// Same, but the retry fails. No further retry may be scheduled.
+func TestReloadDuringInflightRetryFailureStopsRetrying(t *testing.T) {
+	r, entered, result := blockingSerialRegistry(t)
+	cfg := serialRetryDriver(t)
+	done := startInflightRetry(t, r, cfg, entered)
+
+	reloadDone := make(chan struct{})
+	go func() {
+		r.Reload(context.Background(), nil, false)
+		close(reloadDone)
+	}()
+	returnsWithin(reloadDone, 300*time.Millisecond)
+	result <- errors.New("still missing")
+	<-done
+	<-reloadDone
+	if e := pendingSpawnRetry(r, "p1"); e != nil {
+		t.Fatalf("retry still scheduled (in %v) for a driver removed from config", e.delay)
+	}
+}
+
+// ShutdownAll blocks until all poll loops exit, so it must wait for a retry
+// that may still start a driver.
+func TestShutdownAllWaitsForInflightRetry(t *testing.T) {
+	r, entered, result := blockingSerialRegistry(t)
+	cfg := serialRetryDriver(t)
+	done := startInflightRetry(t, r, cfg, entered)
+
+	shutDone := make(chan struct{})
+	go func() { r.ShutdownAll(); close(shutDone) }()
+	if returnsWithin(shutDone, 300*time.Millisecond) {
+		t.Error("ShutdownAll returned while a retry attempt was still starting the driver")
+	}
+	result <- nil
+	<-done
+	<-shutDone
+	if slices.Contains(r.Names(), "p1") {
+		t.Fatalf("driver running after shutdown: %v", r.Names())
+	}
+}