Clarify timeout and retries

spec.md

@@ -395,6 +395,23 @@ These limits apply for messages generated by both COs and plugins.
 
 Scalar fields, even REQUIRED ones, will be defaulted if not specified, and any field set to the defaul value will not be serialized over the wire as per [proto3](https://developers.google.com/protocol-buffers/docs/proto3#default).
 
+#### Timeouts
+
+Any of the RPCs defined in this spec MAY timeout and MAY be retried.
+The CO MAY chooses the maximum time it is willing to wait for a call,
+how long it waits between retries, and how many time it retries (these
+values are not negotiated between plugin and CO).
+
+Idempotency requirements ensure that a retried call with the same fields
+continues where it left off when retried. The only way to cancel a call
+is to issue a "negation" call if one exists (for example, issue a
+`ControllerUnpublishVolume` call to cancel a pending
+`ControllerPublishVolume` operation, etc.). In some cases, a CO MAY not
+be able to cancel a pending operation, because it depends on the result
+of the pending operation in order to execute the "negation" call (for
+example, if a `CreateVolume` call never completes, a CO may not have the
+`volume_id` to call `DeleteVolume` with).
+
 ### Error Scheme
 
 All CSI API calls defined in this spec MUST return a [standard gRPC status](https://github.com/grpc/grpc/blob/master/src/proto/grpc/status/status.proto).