From 2a867b53f266c52601ca94ce9f914e2d9dd5d6e9 Mon Sep 17 00:00:00 2001
From: Onur Solmaz <2453968+osolmaz@users.noreply.github.com>
Date: Wed, 9 Sep 2026 12:59:47 +0800
Subject: [PATCH 1/2] fix(control): disable broken sandbox idle timeout

Co-Authored-By: GPT-5.6 Sol <noreply@pi.dev>
Generated-By: pi 0.85.1 (https://pi.dev)
---
 apps/control-web/e2e/control.spec.ts          |  2 +-
 apps/control-web/src/launch-draft.ts          |  4 ++-
 apps/control-web/src/launch-page.tsx          | 24 ++++++++++++++---
 apps/control-web/test/App.test.tsx            |  2 +-
 apps/control-web/test/launch.test.tsx         |  6 ++---
 ...9-04-simplification-implementation-spec.md | 13 ++++++---
 docs/CONFIGURABLE_LAUNCH.md                   |  9 +++++--
 docs/DESIGN_PRINCIPLES.md                     |  9 ++++++-
 .../schemas/benchmark-preset-v1.schema.json   |  2 +-
 .../src/generated/benchmark-preset-v1.ts      |  2 +-
 packages/contracts/test/contracts.test.ts     |  2 +-
 packages/control-core/src/direct-config.ts    | 18 ++++++++++---
 packages/control-core/test/control.test.ts    |  6 ++---
 .../control-core/test/direct-config.test.ts   | 27 ++++++++++++++++---
 .../terminal-bench-2-1-all-tasks-1-trial.json |  2 +-
 ...terminal-bench-2-1-all-tasks-5-trials.json |  2 +-
 .../terminal-bench-2-1-one-task-1-trial.json  |  2 +-
 17 files changed, 99 insertions(+), 33 deletions(-)

diff --git a/apps/control-web/e2e/control.spec.ts b/apps/control-web/e2e/control.spec.ts
index d6c8ab3f..735da4d8 100644
--- a/apps/control-web/e2e/control.spec.ts
+++ b/apps/control-web/e2e/control.spec.ts
@@ -28,7 +28,7 @@ const presets = {
         n_concurrent_trials: 1,
         environment: {
           type: "hf-sandbox",
-          kwargs: { flavor: "cpu-upgrade", job_timeout: "30m" },
+          kwargs: { flavor: "cpu-upgrade", job_timeout: "none" },
         },
       },
     },
diff --git a/apps/control-web/src/launch-draft.ts b/apps/control-web/src/launch-draft.ts
index ddf081e8..c1f6bd97 100644
--- a/apps/control-web/src/launch-draft.ts
+++ b/apps/control-web/src/launch-draft.ts
@@ -13,7 +13,9 @@ export function initialDraft(): NativeObject {
     agents: [],
     environment: {
       type: "hf-sandbox",
-      kwargs: { flavor: "cpu-basic", job_timeout: "30m" },
+      // Temporary stopgap for https://github.com/huggingface/sandbox-server/pull/21.
+      // Remove after the fixed server passes a foreground canary longer than 30 minutes.
+      kwargs: { flavor: "cpu-basic", job_timeout: "none" },
     },
   };
 }
diff --git a/apps/control-web/src/launch-page.tsx b/apps/control-web/src/launch-page.tsx
index 8c355bb1..8084800d 100644
--- a/apps/control-web/src/launch-page.tsx
+++ b/apps/control-web/src/launch-page.tsx
@@ -750,11 +750,14 @@ function LaunchForm({ search }: { search: string }) {
                 })
               }
             />
-            <label className="text-sm">
-              Sandbox idle timeout
+            <div>
+              <label className="text-sm" htmlFor="sandbox-idle-timeout">
+                Sandbox idle timeout
+              </label>
               <input
                 className={inputClass}
-                value={String(envKwargs.job_timeout ?? "30m")}
+                id="sandbox-idle-timeout"
+                value={String(envKwargs.job_timeout ?? "none")}
                 onChange={(event) =>
                   change({
                     ...draft,
@@ -766,7 +769,20 @@ function LaunchForm({ search }: { search: string }) {
                   })
                 }
               />
-            </label>
+              <span className="mt-1 block text-xs text-slate-400">
+                Keep this set to <code>none</code> until the fixed Sandbox server is
+                deployed. See{" "}
+                <a
+                  className="underline"
+                  href="https://github.com/huggingface/sandbox-server/pull/21"
+                  rel="noreferrer"
+                  target="_blank"
+                >
+                  sandbox-server PR 21
+                </a>
+                .
+              </span>
+            </div>
             <label className="text-sm">
               Post-trial cost limit (USD)
               <input
diff --git a/apps/control-web/test/App.test.tsx b/apps/control-web/test/App.test.tsx
index 7a1c39b4..59faf608 100644
--- a/apps/control-web/test/App.test.tsx
+++ b/apps/control-web/test/App.test.tsx
@@ -124,7 +124,7 @@ const presets: PresetsResponse = {
         n_concurrent_trials: 1,
         environment: {
           type: "hf-sandbox",
-          kwargs: { flavor: "cpu-upgrade", job_timeout: "30m" },
+          kwargs: { flavor: "cpu-upgrade", job_timeout: "none" },
         },
       },
     },
diff --git a/apps/control-web/test/launch.test.tsx b/apps/control-web/test/launch.test.tsx
index f7f5f84d..cda4628d 100644
--- a/apps/control-web/test/launch.test.tsx
+++ b/apps/control-web/test/launch.test.tsx
@@ -32,7 +32,7 @@ const draft = {
   ],
   environment: {
     type: "hf-sandbox",
-    kwargs: { flavor: "cpu-upgrade", job_timeout: "30m" },
+    kwargs: { flavor: "cpu-upgrade", job_timeout: "none" },
   },
 };
 const catalog = {
@@ -331,7 +331,7 @@ describe("launch page", () => {
             n_concurrent_trials: 1,
             environment: {
               type: "hf-sandbox",
-              kwargs: { flavor: "cpu-basic", job_timeout: "15m" },
+              kwargs: { flavor: "cpu-basic", job_timeout: "none" },
             },
           },
         },
@@ -358,7 +358,7 @@ describe("launch page", () => {
       target: { value: "0.5" },
     });
     expect(loadDraft().environment).toMatchObject({
-      kwargs: { flavor: "cpu-upgrade", job_timeout: "15m" },
+      kwargs: { flavor: "cpu-upgrade", job_timeout: "none" },
     });
     fireEvent.change(screen.getByLabelText("Native environment"), {
       target: { value: '{"type":"hf-sandbox","kwargs":{"flavor":"cpu-basic"}}' },
diff --git a/docs/2026-09-04-simplification-implementation-spec.md b/docs/2026-09-04-simplification-implementation-spec.md
index 9058afd6..93fd7cf1 100644
--- a/docs/2026-09-04-simplification-implementation-spec.md
+++ b/docs/2026-09-04-simplification-implementation-spec.md
@@ -102,7 +102,7 @@ A preset submission creates this immutable record:
       "import_path": "harbor_hf_agents.hf_sandbox:LabeledHFSandboxEnvironment",
       "kwargs": {
         "flavor": "cpu-basic",
-        "job_timeout": "30m",
+        "job_timeout": "none",
         "run_label": "run-19ecb4608a42c1e9f4610f25"
       }
     }
@@ -210,9 +210,14 @@ A benchmark preset contains `schema_version`, `benchmark`, `preset`,
 `n_concurrent_trials` and the native `environment` object. The environment type
 is `hf-sandbox`. Its native `kwargs.flavor` value is limited to `cpu-basic` or
 `cpu-upgrade`, so a preset cannot select paid accelerator hardware. The
-environment also keeps the reviewed native `kwargs.job_timeout` value. The job
-can contain timeout multipliers, `retry` and `artifacts`. It cannot set paths,
-agents, credentials, user agents, custom environments or source jobs.
+environment also keeps the reviewed native `kwargs.job_timeout` value. This
+value is temporarily `none` because
+[huggingface/sandbox-server#21](https://github.com/huggingface/sandbox-server/pull/21)
+is not yet deployed. Remove this stopgap only after the correction is merged,
+the fixed server is deployed, and a foreground command runs for more than 30
+minutes in a canary. The job can contain timeout multipliers, `retry` and
+`artifacts`. It cannot set paths, agents, credentials, user agents, custom
+environments or source jobs.
 
 An agent preset contains `schema_version`, `agent`, `version`, `harbor_agent`,
 `reasoning_option` and `reasoning_values`. `harbor_agent` selects `name` or
diff --git a/docs/CONFIGURABLE_LAUNCH.md b/docs/CONFIGURABLE_LAUNCH.md
index 44fad1a6..3ce902b0 100644
--- a/docs/CONFIGURABLE_LAUNCH.md
+++ b/docs/CONFIGURABLE_LAUNCH.md
@@ -90,8 +90,13 @@ receive neither the control credential nor the canonical Bucket mount.
 ## HF restrictions
 
 - Sandbox flavors: `cpu-basic` and `cpu-upgrade`.
-- `environment.kwargs.job_timeout` is an **idle timeout**, for example `30m`.
-  It does not replace agent, trial, or parent wall-clock limits.
+- `environment.kwargs.job_timeout` must be `none` as a temporary stopgap for
+  [huggingface/sandbox-server#21](https://github.com/huggingface/sandbox-server/pull/21).
+  The current server can stop a running foreground command when its idle timer
+  expires. Remove this restriction only after the correction is merged, the fixed
+  server is deployed, and a foreground command runs for more than 30 minutes in a
+  canary. Harbor phase timeouts, cleanup, and the Hugging Face 24-hour Job limit
+  still bound the work.
 - Each task needs a prebuilt Docker image. Image builds, resource overrides, and
   enforced network allowlists are not offered by this page.
 - There are no separate hosted maximums for source count, agent count, attempts,
diff --git a/docs/DESIGN_PRINCIPLES.md b/docs/DESIGN_PRINCIPLES.md
index 443e4158..f9ceb2f4 100644
--- a/docs/DESIGN_PRINCIPLES.md
+++ b/docs/DESIGN_PRINCIPLES.md
@@ -180,9 +180,16 @@ environment:
   type: hf-sandbox
   kwargs:
     flavor: cpu-upgrade
-    job_timeout: 30m
+    job_timeout: none
 ```
 
+The `none` value is a temporary stopgap for
+[huggingface/sandbox-server#21](https://github.com/huggingface/sandbox-server/pull/21).
+The current Sandbox server can stop a running foreground command when its idle
+timer expires. Remove the stopgap only after the correction is merged, the fixed
+server is deployed, and a foreground command runs for more than 30 minutes in a
+canary. Harbor phase timeouts and cleanup still bound the work during this period.
+
 Harbor-HF MAY replace `type: hf-sandbox` with its labeled environment adapter
 when it compiles the final job. The compiler MUST preserve the native
 environment arguments and MUST add only the `run_label` argument required by
diff --git a/packages/contracts/schemas/benchmark-preset-v1.schema.json b/packages/contracts/schemas/benchmark-preset-v1.schema.json
index 0cccb23b..491fc640 100644
--- a/packages/contracts/schemas/benchmark-preset-v1.schema.json
+++ b/packages/contracts/schemas/benchmark-preset-v1.schema.json
@@ -53,7 +53,7 @@
               "required": ["flavor", "job_timeout"],
               "properties": {
                 "flavor": { "enum": ["cpu-basic", "cpu-upgrade"] },
-                "job_timeout": { "const": "30m" }
+                "job_timeout": { "const": "none" }
               }
             }
           }
diff --git a/packages/contracts/src/generated/benchmark-preset-v1.ts b/packages/contracts/src/generated/benchmark-preset-v1.ts
index c450c40a..3f45b314 100644
--- a/packages/contracts/src/generated/benchmark-preset-v1.ts
+++ b/packages/contracts/src/generated/benchmark-preset-v1.ts
@@ -42,7 +42,7 @@ environment: {
 type: "hf-sandbox"
 kwargs: {
 flavor: ("cpu-basic" | "cpu-upgrade")
-job_timeout: "30m"
+job_timeout: "none"
 }
 }
 timeout_multiplier?: number
diff --git a/packages/contracts/test/contracts.test.ts b/packages/contracts/test/contracts.test.ts
index 4bc2e323..3e6a4aa4 100644
--- a/packages/contracts/test/contracts.test.ts
+++ b/packages/contracts/test/contracts.test.ts
@@ -87,7 +87,7 @@ describe("contracts", () => {
         n_concurrent_trials: 1,
         environment: {
           type: "hf-sandbox",
-          kwargs: { flavor: "cpu-upgrade", job_timeout: "30m" },
+          kwargs: { flavor: "cpu-upgrade", job_timeout: "none" },
         },
       },
     } as const;
diff --git a/packages/control-core/src/direct-config.ts b/packages/control-core/src/direct-config.ts
index 287cb85a..09e69265 100644
--- a/packages/control-core/src/direct-config.ts
+++ b/packages/control-core/src/direct-config.ts
@@ -10,6 +10,10 @@ import {
   ROUTER_URL,
 } from "./hf-config.js";
 
+const SANDBOX_IDLE_TIMEOUT_STOPGAP = "none";
+const SANDBOX_IDLE_TIMEOUT_FIX =
+  "https://github.com/huggingface/sandbox-server/pull/21";
+
 function record(value: unknown, label: string): Record<string, unknown> {
   if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error(`${label} must be an object`);
@@ -121,11 +125,10 @@ export function prepareDirectJobConfig(
     throw new Error("HF Sandbox flavor must be a string");
   if (
     kwargs.job_timeout !== undefined &&
-    (typeof kwargs.job_timeout !== "string" ||
-      !/^[1-9][0-9]*(s|m|h)$/.test(kwargs.job_timeout))
+    kwargs.job_timeout !== SANDBOX_IDLE_TIMEOUT_STOPGAP
   )
     throw new Error(
-      "Sandbox idle timeout must be a positive duration, for example 30m",
+      `Sandbox idle timeout must stay disabled with job_timeout="none" until ${SANDBOX_IDLE_TIMEOUT_FIX} is merged and deployed`,
     );
   const verifier = record(input.verifier ?? {}, "verifier");
   admittedEnvironment(verifier.env);
@@ -139,7 +142,14 @@ export function prepareDirectJobConfig(
     environment: {
       import_path: LABELED_ENVIRONMENT,
       env: admittedEnvironment(environment.env),
-      kwargs: { flavor: "cpu-basic", job_timeout: "30m", ...kwargs, run_label: runId },
+      // Remove this stopgap after the fixed Sandbox server is deployed and a
+      // foreground command has passed a canary longer than 30 minutes.
+      kwargs: {
+        flavor: "cpu-basic",
+        job_timeout: SANDBOX_IDLE_TIMEOUT_STOPGAP,
+        ...kwargs,
+        run_label: runId,
+      },
     },
   });
 }
diff --git a/packages/control-core/test/control.test.ts b/packages/control-core/test/control.test.ts
index 5500d3e2..0f82e35d 100644
--- a/packages/control-core/test/control.test.ts
+++ b/packages/control-core/test/control.test.ts
@@ -111,7 +111,7 @@ describe("run submission", () => {
       presets.benchmark("terminal-bench-2-1", "one-task-1-trial").job.environment,
     ).toEqual({
       type: "hf-sandbox",
-      kwargs: { flavor: "cpu-upgrade", job_timeout: "30m" },
+      kwargs: { flavor: "cpu-upgrade", job_timeout: "none" },
     });
     const result = await submit();
     expect(result.created).toBe(true);
@@ -132,7 +132,7 @@ describe("run submission", () => {
         import_path: "harbor_hf_agents.hf_sandbox:LabeledHFSandboxEnvironment",
         kwargs: {
           flavor: "cpu-upgrade",
-          job_timeout: "30m",
+          job_timeout: "none",
           run_label: result.run.run_id,
         },
       },
@@ -246,7 +246,7 @@ describe("run submission", () => {
       n_attempts: 1,
       n_concurrent_trials: 8,
       environment: {
-        kwargs: { flavor: "cpu-upgrade", job_timeout: "30m" },
+        kwargs: { flavor: "cpu-upgrade", job_timeout: "none" },
       },
     });
   });
diff --git a/packages/control-core/test/direct-config.test.ts b/packages/control-core/test/direct-config.test.ts
index c3f6c8d4..b4c1fc94 100644
--- a/packages/control-core/test/direct-config.test.ts
+++ b/packages/control-core/test/direct-config.test.ts
@@ -12,7 +12,7 @@ const config = {
   agents: [agent],
   environment: {
     type: "hf-sandbox",
-    kwargs: { flavor: "cpu-upgrade", job_timeout: "15m" },
+    kwargs: { flavor: "cpu-upgrade", job_timeout: "none" },
     env: { LANG: "C.UTF-8" },
   },
   n_attempts: 2,
@@ -30,7 +30,28 @@ describe("direct native configuration", () => {
         ...config,
         environment: { ...config.environment, kwargs: { flavor: "a100-large" } },
       }).environment,
-    ).toMatchObject({ kwargs: { flavor: "a100-large" } });
+    ).toMatchObject({
+      kwargs: { flavor: "a100-large", job_timeout: "none" },
+    });
+  });
+  it("disables the Sandbox idle timeout until the upstream fix is deployed", () => {
+    expect(
+      prepare({
+        ...config,
+        environment: { type: "hf-sandbox", kwargs: { flavor: "cpu-basic" } },
+      }).environment,
+    ).toMatchObject({
+      kwargs: { flavor: "cpu-basic", job_timeout: "none" },
+    });
+    expect(() =>
+      prepare({
+        ...config,
+        environment: {
+          type: "hf-sandbox",
+          kwargs: { flavor: "cpu-basic", job_timeout: "30m" },
+        },
+      }),
+    ).toThrow("https://github.com/huggingface/sandbox-server/pull/21");
   });
   it("preserves hardware, native options, sources, agents, retries, and false values", () => {
     const input = {
@@ -49,7 +70,7 @@ describe("direct native configuration", () => {
       agents: input.agents,
       tasks: input.tasks,
       environment: {
-        kwargs: { flavor: "cpu-upgrade", job_timeout: "15m", run_label: id },
+        kwargs: { flavor: "cpu-upgrade", job_timeout: "none", run_label: id },
         env: { LANG: "C.UTF-8" },
       },
     });
diff --git a/presets/benchmarks/terminal-bench-2-1-all-tasks-1-trial.json b/presets/benchmarks/terminal-bench-2-1-all-tasks-1-trial.json
index fd3c79d5..574e668e 100644
--- a/presets/benchmarks/terminal-bench-2-1-all-tasks-1-trial.json
+++ b/presets/benchmarks/terminal-bench-2-1-all-tasks-1-trial.json
@@ -16,7 +16,7 @@
       "type": "hf-sandbox",
       "kwargs": {
         "flavor": "cpu-upgrade",
-        "job_timeout": "30m"
+        "job_timeout": "none"
       }
     },
     "agent_timeout_multiplier": 4,
diff --git a/presets/benchmarks/terminal-bench-2-1-all-tasks-5-trials.json b/presets/benchmarks/terminal-bench-2-1-all-tasks-5-trials.json
index 7b064a97..854b6c8b 100644
--- a/presets/benchmarks/terminal-bench-2-1-all-tasks-5-trials.json
+++ b/presets/benchmarks/terminal-bench-2-1-all-tasks-5-trials.json
@@ -16,7 +16,7 @@
       "type": "hf-sandbox",
       "kwargs": {
         "flavor": "cpu-upgrade",
-        "job_timeout": "30m"
+        "job_timeout": "none"
       }
     },
     "agent_timeout_multiplier": 4,
diff --git a/presets/benchmarks/terminal-bench-2-1-one-task-1-trial.json b/presets/benchmarks/terminal-bench-2-1-one-task-1-trial.json
index 6898e10b..c54002a0 100644
--- a/presets/benchmarks/terminal-bench-2-1-one-task-1-trial.json
+++ b/presets/benchmarks/terminal-bench-2-1-one-task-1-trial.json
@@ -17,7 +17,7 @@
       "type": "hf-sandbox",
       "kwargs": {
         "flavor": "cpu-upgrade",
-        "job_timeout": "30m"
+        "job_timeout": "none"
       }
     },
     "agent_timeout_multiplier": 4,

From d89f226048dcc1eb11da714d2ab25d40b74dc2d3 Mon Sep 17 00:00:00 2001
From: Onur Solmaz <2453968+osolmaz@users.noreply.github.com>
Date: Wed, 9 Sep 2026 13:13:21 +0800
Subject: [PATCH 2/2] docs: add sandbox stopgap removal checklist [skip ci]

Co-Authored-By: GPT-5.6 Sol <noreply@pi.dev>
Generated-By: pi 0.85.1 (https://pi.dev)
---
 ...9-04-simplification-implementation-spec.md |   4 +-
 ...09-sandbox-idle-timeout-stopgap-removal.md | 114 ++++++++++++++++++
 docs/CONFIGURABLE_LAUNCH.md                   |   6 +-
 docs/DESIGN_PRINCIPLES.md                     |   4 +-
 4 files changed, 124 insertions(+), 4 deletions(-)
 create mode 100644 docs/2026-09-09-sandbox-idle-timeout-stopgap-removal.md

diff --git a/docs/2026-09-04-simplification-implementation-spec.md b/docs/2026-09-04-simplification-implementation-spec.md
index 93fd7cf1..b16cbc6e 100644
--- a/docs/2026-09-04-simplification-implementation-spec.md
+++ b/docs/2026-09-04-simplification-implementation-spec.md
@@ -215,7 +215,9 @@ value is temporarily `none` because
 [huggingface/sandbox-server#21](https://github.com/huggingface/sandbox-server/pull/21)
 is not yet deployed. Remove this stopgap only after the correction is merged,
 the fixed server is deployed, and a foreground command runs for more than 30
-minutes in a canary. The job can contain timeout multipliers, `retry` and
+minutes in a canary. Follow the
+[stopgap removal checklist](2026-09-09-sandbox-idle-timeout-stopgap-removal.md).
+The job can contain timeout multipliers, `retry` and
 `artifacts`. It cannot set paths, agents, credentials, user agents, custom
 environments or source jobs.
 
diff --git a/docs/2026-09-09-sandbox-idle-timeout-stopgap-removal.md b/docs/2026-09-09-sandbox-idle-timeout-stopgap-removal.md
new file mode 100644
index 00000000..082658f4
--- /dev/null
+++ b/docs/2026-09-09-sandbox-idle-timeout-stopgap-removal.md
@@ -0,0 +1,114 @@
+---
+title: Remove the Sandbox idle-timeout stopgap
+author: Harbor-HF maintainers
+date: 2026-09-09
+tags: [sandbox, timeout, maintenance]
+---
+
+# Remove the Sandbox idle-timeout stopgap
+
+## Purpose
+
+Harbor-HF temporarily forces native Harbor configuration to use:
+
+```yaml
+environment:
+  type: hf-sandbox
+  kwargs:
+    job_timeout: none
+```
+
+The deployed Sandbox server can treat a live foreground command as idle and stop
+it after 30 minutes. [sandbox-server PR 21] corrects the server activity check.
+[Harbor-HF PR 191] adds this stopgap without adding a keepalive loop or a second
+lifecycle implementation.
+
+This stopgap disables the Sandbox idle limit. Harbor phase timeouts, cancellation,
+cleanup, and the Hugging Face 24-hour Job limit still bound work.
+
+[sandbox-server PR 21]: https://github.com/huggingface/sandbox-server/pull/21
+[Harbor-HF PR 191]: https://github.com/huggingface/harbor-hf/pull/191
+
+## Ownership
+
+- Hugging Face Sandbox owns the server correction and deployment.
+- Harbor owns `environment.kwargs.job_timeout` and its timeout semantics.
+- Harbor-HF only sets and reviews the native Harbor value.
+
+Do not add provider, model, agent, harness, or benchmark conditions. Do not add a
+keepalive request loop.
+
+## Removal gates
+
+Complete all checks before removal:
+
+- [ ] Merge sandbox-server PR 21, or an equivalent correction. Record the merged
+      commit.
+- [ ] Build and deploy a Sandbox server release that contains the correction.
+      Record the release version and immutable commit or image digest.
+- [ ] Confirm from runtime evidence that a new HF Sandbox starts that exact fixed
+      server build. A merge or mutable download URL is not deployment evidence.
+- [ ] Run one foreground command for more than 30 minutes with no keepalive API
+      traffic. Confirm that it stays alive, returns complete output, exits normally,
+      and has no idle-shutdown log.
+- [ ] Run a true-idle canary with a finite timeout. Confirm that the server still
+      removes an inactive Sandbox.
+- [ ] Confirm that Harbor cancellation, phase timeouts, and Sandbox cleanup still
+      work with the fixed server.
+
+If a gate fails, keep `job_timeout: none` and record the exact server revision,
+command, duration, and logs. Do not restore a finite timeout from merge status
+alone.
+
+## Removal changes
+
+After all gates pass, restore the reviewed `30m` idle timeout in one hard cutover:
+
+1. Change `job_timeout` from `none` to `30m` in all files under
+   `presets/benchmarks/`.
+2. Change the `job_timeout` constant from `none` to `30m` in
+   `packages/contracts/schemas/benchmark-preset-v1.schema.json`.
+3. Regenerate `packages/contracts/src/generated/benchmark-preset-v1.ts`.
+4. In `packages/control-core/src/direct-config.ts`:
+   - remove `SANDBOX_IDLE_TIMEOUT_STOPGAP` and `SANDBOX_IDLE_TIMEOUT_FIX`;
+   - remove the temporary rejection of finite values;
+   - restore positive duration validation such as `30m`;
+   - restore `30m` as the default native value; and
+   - remove the stopgap comments.
+5. In `apps/control-web/src/launch-draft.ts`, restore `30m` as the new draft
+   default and remove the stopgap comments.
+6. In `apps/control-web/src/launch-page.tsx`, restore the `30m` fallback and
+   remove the stopgap notice and upstream link.
+7. Update the related contract, control-core, browser, and end-to-end tests:
+   - `packages/contracts/test/contracts.test.ts`;
+   - `packages/control-core/test/control.test.ts`;
+   - `packages/control-core/test/direct-config.test.ts`;
+   - `apps/control-web/test/App.test.tsx`;
+   - `apps/control-web/test/launch.test.tsx`; and
+   - `apps/control-web/e2e/control.spec.ts`.
+8. Remove the temporary stopgap text and links from:
+   - `docs/DESIGN_PRINCIPLES.md`;
+   - `docs/CONFIGURABLE_LAUNCH.md`; and
+   - `docs/2026-09-04-simplification-implementation-spec.md`.
+9. Delete this TODO document in the same removal pull request. Put the completed
+   gate evidence in that pull request description.
+
+## Removal verification
+
+Run these checks after the cutover:
+
+```bash
+npm run format:check
+npm run lint
+npm run typecheck
+npm test
+npm run build
+npm run check:generated
+npm run test:e2e
+uv run python scripts/check_public_privacy.py .
+git diff --check
+```
+
+Also run the foreground and true-idle canaries from the removal gates against the
+fixed deployed server. CI must pass its AMD64 Docker and secret-backed privacy
+checks before merge.
diff --git a/docs/CONFIGURABLE_LAUNCH.md b/docs/CONFIGURABLE_LAUNCH.md
index 3ce902b0..104a9336 100644
--- a/docs/CONFIGURABLE_LAUNCH.md
+++ b/docs/CONFIGURABLE_LAUNCH.md
@@ -95,8 +95,10 @@ receive neither the control credential nor the canonical Bucket mount.
   The current server can stop a running foreground command when its idle timer
   expires. Remove this restriction only after the correction is merged, the fixed
   server is deployed, and a foreground command runs for more than 30 minutes in a
-  canary. Harbor phase timeouts, cleanup, and the Hugging Face 24-hour Job limit
-  still bound the work.
+  canary. Follow the
+  [stopgap removal checklist](2026-09-09-sandbox-idle-timeout-stopgap-removal.md).
+  Harbor phase timeouts, cleanup, and the Hugging Face 24-hour Job limit still
+  bound the work.
 - Each task needs a prebuilt Docker image. Image builds, resource overrides, and
   enforced network allowlists are not offered by this page.
 - There are no separate hosted maximums for source count, agent count, attempts,
diff --git a/docs/DESIGN_PRINCIPLES.md b/docs/DESIGN_PRINCIPLES.md
index f9ceb2f4..cbb19fe4 100644
--- a/docs/DESIGN_PRINCIPLES.md
+++ b/docs/DESIGN_PRINCIPLES.md
@@ -188,7 +188,9 @@ The `none` value is a temporary stopgap for
 The current Sandbox server can stop a running foreground command when its idle
 timer expires. Remove the stopgap only after the correction is merged, the fixed
 server is deployed, and a foreground command runs for more than 30 minutes in a
-canary. Harbor phase timeouts and cleanup still bound the work during this period.
+canary. Follow the
+[stopgap removal checklist](2026-09-09-sandbox-idle-timeout-stopgap-removal.md).
+Harbor phase timeouts and cleanup still bound the work during this period.
 
 Harbor-HF MAY replace `type: hf-sandbox` with its labeled environment adapter
 when it compiles the final job. The compiler MUST preserve the native