[SaladDay]

A Provider can leave an allocation's compute pending or failed forever: Create settles but the sandbox never runs, GetInfo keeps failing, or a node never confirms. Core waited indefinitely, called no Kill, and a standalone Environment stayed pending because the pinned API has no Environment delete.

• A 10-minute compute start deadline in the common flow, the same for every Provider. Past it, an allocation Core has not observed running with a completed bootstrap fails its Environment, and the existing cleanup path calls Kill and releases it once Create is settled. Eligibility is decided under the cleanup lock by the database clock; an allocation that ever ran is never affected.
• Cleanup Core has already authorized reaches Kill even when GetInfo keeps failing; Kill verifies ownership itself, an ownership mismatch still refuses, and release still requires a settled Create. This also unblocks Session deletion on an unreachable Provider.
• No protocol, setting, API field or schema change.

The Provider guide's timeouts table owns the value; the Environments lifecycle links to it (en/zh).

Tests: TestComputeThatNeverStartsFailsStandaloneEnvironmentAtDeadline (fails without either change), TestRunningAllocationIsNeverFailedByStartDeadline, and the cleanup tests for an unavailable or unknown observation now expect Kill while the allocation stays retained and its Create unsettled.

Generated with Claude Code