Guarantees

These are contractual behaviors, not aspirations. Each one exists because we watched teams pay for its absence somewhere else.

Typed failure causes. Every terminal state names its cause: user_image_build_failed · user_oom · user_timeout · provider_capacity · provider_infra · policy_killed_ttl. Error responses carry the same causes. No string matching, ever.
provider_* is free. Seconds lost to causes we own are never billed and are reported transparently (unbilled_provider_fault_usd in the usage API).
Hard TTLs. expires_at is absolute and enforced server-side within seconds. No idle heuristics: an upload or build in progress never reads as idle, and an orphan never outlives its deadline.
Teardown proof. Destroy returns teardown_proof.verified_absent, issued only after the data plane confirms absence. Customers do not write reapers.
Export survives death. Artifact export runs host-side and works during the run, after exit, after OOM, after TTL kill.
Idempotent create. A repeated launch_tokenreplays the original sandbox. Worker retries cannot double fleets.
Visible, reservable capacity. Insufficient capacity is a typed 409 up front. Reservations hold what a sweep needs.
Non-preemptible, always. No spot tier, no eviction, no migration mid-run. Only you, your TTL, or your suspend call stops an environment.
Real Docker inside. Every environment has a rootful daemon; compose stacks run as written. No docker-in-docker.