Yes, this is a very good point.  (And your passing test is worthwhile, you are correct.)  

People are expected to be able to write handlers, so clearly the timeout API needs to be documented, if for no other reason than to keep a handler writer from stomping on the timeout attribute inappropriately.  

But there is a code smell to this "API", and I wonder if it is worth someone taking time to think it all through again to see if there is a better way to do it :(