A timeout does not stop downstream work

A timeout bounds how long a caller waits, but it does not necessarily cancel work already running downstream. Propagate a deadline or cancellation signal, then check it at safe points in the handler. Otherwise, timed-out requests can keep using resources.