I could not immediately figure out the usage of gateways to get what you wanted but I will explore exclusive event based gateways further. Perhaps the experts will get in on the act.
I think your approach has the potential to get a little messy and difficult to follow at the business process level and at the tech developer level.

Consider using a timer exception on the business process . I have done that in my version of your project. The final notification is on success rather than timeout (to me that is a better practice in the business process).

Note , as is , you will get some user-hostile responses when a user interacts with a timed-out process. This will need some consideration of error traps.