It seems that XMLHttpRequest.readyState == 2 doesn't just refer to requests which work. State 2 is supposed to occur after send() has been called and the header is available. However, if a timeout occurs, that's still state 2 - even though the site headers aren't available. So what that give us is a good way of trapping timeout errors:
httpReadyStateChange: function(){ if(Update.httpReq.readyState == 2){ try{ Update.httpReq.status; }catch(e){ Update.httpReq.abort(); Update.gochangeit(-10000); return; } } }