When a send that times out after the destination may have accepted it enters a real workflow, who owns the stop button?
The human owner checks the evidence before the consequential step; an uncertain result stops the run.
The deliverable is a retry card with stable action ID and last confirmed state. I would make the next decision visible beside it.
For a send that times out after the destination may have accepted it, I would reconcile by stable action ID before deciding whether to retry.
In a small OpenClaw pilot, I would test self-hosted routing, channel boundaries, and operator-owned recovery and ask a second operator to check the next decision.
Who should make the final decision in a send that times out after the destination may have accepted it?