The orders a venue encoded into a corked connection.
Between cork() and uncork() a frame is only queued, so a failed uncork() means none of them reached the venue and the venue must reject them instead of leaving the engine with orders it believes are live. Only the fields a reject needs are kept, because the ring slots are released before uncork() runs.
An order whose frame filled the send buffer mid-batch did leave (send_frame() flushes then), and gets rejected here too. That is the safe error: uncork() only fails when the connection failed, and the venue answers that by cancelling everything over the control path.