The second-leg failure case also needs a failure of the rollback order. The example sends closebuy and then returns without checking whether the first leg actually closed, so it can leave directional exposure. I would record both fills and require a confirmed flat state, or an explicit unresolved-exposure state that blocks another entry. A timeout is a separate case from a rejected order because the fill may already exist.