Orders are stored in a linked list. Could lead to quadratic time complexity. Checking signatures one by one would require quadratic time too.
Sadly it didn't work on our test (n=16, k=10).
Init query (with four zeroes) is not protected from replay.
There is no way to merge queries offline.
And no way to find orders (un)signed by some owner.

accept_message() is called after ALL signatures are checked. It is very likely than it won't be enough gas_credit to handle orders with multiple signatures

You made a silly mistake accepting incoming message with 4 zeroes at the start. But other than that, I couldn't find an issue in your linked cells.

Although list of pending orders is controlled by 4 flags, I could not find a way to mess with it. And because signatures sign contract's seqno there isn't much room to replay anything. But they have to be sent immediately, unless they can agree on some future seqno.