Maybe the solution here is to generate a synthetic custom request with $uac_req() and uac_send_req(), like with method SYNTHETIC_BYE?
The problem is that I cannot populate it with the From URI, Call-ID, etc. because that information is not available in the timeout-triggered route to begin with.