Timer cancellation is not reliable #1780

We detect whether the timer was canceled in ad-hoc ways.
Especially, if a lock is involved, the situation is not desirable.
This commit addresses that: 96f7f94

We need a regular mechanism to know fired timeout is canceled, not by ad-hoc devised ways if we can't control it.