A client retries a payment request after a timeout. The first attempt may already have succeeded. What should the API support?

1. A guarantee that an HTTP timeout proves the payment failed.
2. A rule to ignore every retry regardless of earlier outcome.
3. An idempotency key with durable duplicate detection for the business operation.
4. A different random payment identity for every retry.