Graceful shutdown timeouts

This change allows graceful shutdown attempts to time out. If we're closing connections more because we suspect they might be dead, it stands to reason that sending a known-bad notification to shut down might leave connections in limbo, too.

This depends on #116.
Following up on our in-person conversation, I added some comments to clear up what's going on here in 8d06356. Thanks for the sanity check!