The "launch_worker" watches the instance it launches, and waits for the specified timeout, then kills the instance if it's still running.

The instance-side code also shuts itself down as soon as it's finished running and uploading the results.  It should be reasonably safe, the only obvious problem I can see happens if you have a misbehaving job that will run forever in addition to a server that shuts down before its jobs are finished.

I could add some code to the 'terminate-expired-instances.py' script to look for such nodes and kill them too.