The technical design says "a new server parameter will be introduced which governs the maximum amount of time for a split operation." Add this timeout, and write tests proving that a shard split operation actually times out.