Idempotency Is a Client Contract, Not a Server Flag
Retrying a payment is safe only when client and server agree on what counts as the same request. For POST, idempotency is that agreement. The client owns a key, the server keeps a store, and a small set of rules covers replay, conflict, expiry, and recovery.