Idempotency: charged exactly once, however many clicks

Why a client can't tell a lost request from a lost response, and how idempotency keys make the Day 1 payment service safe to retry: the processing, completed and failed record, who makes the key, how long to keep it, checking the bank after a timeout, double clicks, crashes, partial completion, and defence in depth.