Allocate Beyond What You See: Calibrated Resource Allocation Under Endogenous Censoring

A deployed resource allocator censors its own training data: a job given too little memory or wall-clock is killed before finishing, so its true requirement is right-censored at the allocator’s own decision, and calibrated prediction silently breaks under this feedback. We give three results. First, because the censoring level is a known decision, an exact finite-sample, distribution-free safe-allocation rule follows from a censored-implies-exceedance completion of split conformal, valid under exchangeability alone whenever the censored fraction is below the risk level. Second, deploying such a rule closes a loop that erases the upper tail. We prove that every support-confined estimator collapses to sub-nominal coverage, including a valid one-sided safe Kaplan–Meier band, whereas a completion that allocates beyond the observed support covers every round: conservatism inside the support cannot hold coverage, and what beyond-support reveals buy back is not coverage (the completion always covers) but non-vacuity. Third, a control arm restores identifiability and, via performative prediction, contracts retraining above f* = 1−1/κ, which we measure on both a convex surrogate and the deployed gradient boosted model. On a real 336K-job high-performance-computing (HPC) trace the method restores 95% per-partition coverage where naive conformal reaches 59–84% (a 16–41% out-of-memory rate, 3–8×the 5% budget; as low as 38% per partition), and an online adaptive-conformal-inference (ACI) margin reaches eaches 95–97% on the deployed model. Deployed to general availability (80% treated, a permanent control arm above the required f∗), it holds treated out-of-memory at 0.06–0.09% across accrual windows (signature cluster-robust 95% CI far under the 5% guardrail ceiling; an absolute before/after safety result, the treated-versus-control gap unidentified on a quiet cluster), reclaiming terabytes of over-reserved memory, and reproduces a failure the theory predicts: a coverage-only margin recalibrates into the trivial allocate-the-request policy unless floored at an operating point.