Pauses, wakes, restarts and stops are in the audit log
Each pause, wake, restart and stop of a sandbox is an audit log entry (resource.paused, resource.woken, resource.restarted, resource.stopped) with who asked; one Runtime did itself says why: it sat idle, it reached its time limit, credit ran out or a spending limit was hit. A volume inside the free 10 GiB, and a job on an account without credit, now read funding: trial, not paid. See the audit log.