A fill arrives for an order your system has already marked cancelled. What do you do?
Book the fill. The venue decides what happened, so a fill against a cancelled order means your state was wrong, and the position, risk headroom and client record all have to be corrected from the venue's version. The design fix is to make cancelled a state only the venue can grant.