There is something wrong with how circuit_expire_building() applies timeouts to hidden services. There's some rather funky switch statements in there that grant hidden services a pass from timeout at certain stages in their handshaking, but not others. However, the end result seems to be that hidden service timeouts are actually *more* common than they should be for some reason. See my comments in legacy/trac#7157 for slightly more detail (though not much).