Why Timeouts go wrong (and how to do them properly)