Google Cloud Load Balancer Managed SSL Certificates and Cloud DNS: How Long Before PROVISIONING Fails?

Integration boundary

I am terminating HTTPS on a global external Application Load Balancer using a Google-managed SSL certificate, with the domain's DNS hosted in Cloud DNS. The goal is to understand the validation lifecycle between these two components before relying on managed certificates for production cutovers.

Observed behavior and uncertainty

Documentation states the certificate remains in PROVISIONING until the CA validates domain ownership via DNS or load balancer authorization, and that the A/AAAA records must resolve to the load balancer's frontend IP. What is not clearly documented is the exact timeout window: how long the certificate can stay in PROVISIONING before it transitions to FAILED_NOT_VISIBLE, and whether that timer differs between the two authorization methods.

A second concern is post-issuance behavior: some reports suggest global edge propagation can cause intermittent handshake failures immediately after the certificate reaches ACTIVE. I want to know whether this is expected, documented behavior with a bounded window.

Questions

1. What is the documented or empirically observed maximum time a managed certificate remains in PROVISIONING before failing, and does it differ for DNS authorization versus load balancer authorization?
2. After a FAILED_NOT_VISIBLE status caused by slow DNS propagation, must the certificate resource be recreated, or can validation be retried in place?
3. Is there a documented propagation window after ACTIVE during which some edge locations may still fail the TLS handshake?