can we enforce that if they don’t put in a timeout using either mechanism, some other timeout is used?