Problem

The aggregated Create path claimed every sandbox with a hardcoded TTL of 0 (storage.go: r.store.Claim(ctx, namespace, name, pool, 0)), so sandboxd applied its default lease and every k8s-created Sandbox lived exactly 5 minutes — spec.shutdownTime and any requested lifetime were silently ignored. Nothing is stored on this path, so the claim body is the only moment the node can hear a lifetime.

Change

• Create derives the lease from the submitted object: spec.shutdownTime (the API's own lifecycle field, rounded up to whole seconds) wins; the sandbox.cocoonstack.io/ttl-seconds annotation covers clients that cannot set the field (the same key the vk-sandbox provider reads on pods).
• Unusable lifetimes 400 before a microVM is spent: a shutdownTime already in the past or a malformed/negative annotation is rejected up front instead of silently claiming with the default lease.
• The node-granted deadline is reported back: ClaimResult.Deadline is now a time.Time and rides Assignment.Deadline through claim / gateway / fork / snapshot-claim; Create stamps it as the sandbox.cocoonstack.io/deadline annotation (RFC3339) beside the claim id and address, leaving the submitted spec untouched. The node clamps the ask to its own default and maximum, so the grant — not an echo of the request — is what callers see. InventoryEntry gains an optional deadline so the synthesized Get/List path stamps the identical key once nodes publish it (vk-sandbox follow-up), and a refreshed deadline surfaces as a Modified entry.

Testing

• go test ./... green; make lint (linux + darwin) 0 issues.
• New unit coverage: fixed-clock derivation table (rounding, precedence, reject matrix), Create-level wiring (TTL reaches the store, 400 spends no claim), granted-deadline annotation on Create and on the synthesized read path.
• Follow-up in vk-sandbox after this merges: provider/create.go consumes ClaimResult.Deadline as time.Time, and inventory/publisher.go fills InventoryEntry.Deadline.
• End-to-end on a two-node test cluster running the real sandboxd stack:
  • kubectl create with spec.shutdownTime now+90s → response carried the granted deadline (verified before the switch to the annotation; unit-tested since); node log reaped expired sandbox … 5 s after the deadline, VM process gone.
  • annotation ttl-seconds: "600" → deadline exactly create+600 s.
  • no lifetime → sandboxd default 300 s deadline echoed (behavior unchanged).
  • ttl-seconds: "banana" → 400, no claim spent.