The second-leg failure case also needs a failure of the rollback order. The example sends closebuy and then returns without checking whether the first leg actually closed, so it can leave directional exposure. I would record both fills and require a confirmed flat state, or an explicit unresolved-exposure state that blocks another entry. A timeout is a separate case from a rejected order because the fill may already exist.
Arnold Holm
Challenge Pre-Check: know before you risk. Your rules, tested against prop limits. Historical simulation, not a forecast.
The second-leg failure case also needs a failure of the rollback order. The example sends closebuy and then returns without checking whether the first leg actually closed, so it can leave directional exposure. I would record both fills and require a confirmed flat state, or an explicit unresolved-exposure state that blocks another entry. A timeout is a separate case from a rejected order because the fill may already exist.