Citrine Market asks you to investigate duplicate charges after network timeouts. The fictional checkout rate is 120/s. Deliver a payment intent model, status API and provider reconciliation board. The accepted design must handle repeated clicks, lost responses, duplicate provider events and a late pending event after confirmation.
Citrine Market needs to stop duplicate charges without treating a timeout as a declined payment. A provider may accept a charge and lose its response. The customer's next click can then look like a new attempt even though money has already moved. Start with a durable payment intent whose identity survives both clicks.
The provider and your order database don't share a transaction. Keep the payment state machine explicit: created, pending, confirmed, declined or uncertain. A webhook can arrive before the synchronous response, and the webhook itself may repeat. You'll model the intent, build the provider boundary and choose a reconciliation policy. Confirm the order only from a verified payment outcome, then preserve the ledger evidence needed to explain the result later.