The late-response case is the one I would have missed. Most timeout tests stop at proving the call aborts, but your point that the server may still be processing and can answer just after the abort is the dangerous part: if the client applies that late result, you get a double apply on stale state. Pinning the mock latency just past the threshold on both sides is a neat way to make that deterministic instead of flaky. I also appreciated the distinction between connect, read, and idle timeouts, since each needs different cleanup, and the rule about not blindly retrying a POST without an idempotency key. Do you treat the loading-state reset and timer cleanup as separate assertions, or fold them into one post-abort state check?