"A timeout means I don't know, not failed" is the line I'd pin above every payments handler.

The same idea shows up on subscription renewals, where nobody taps Pay again: the gateway retries on its own schedule over days. So "not paid yet" needs its own state with its own rule for access, rather than being read as failed (cut them off) or as fine (ignore it). Otherwise the app either locks out a customer whose card is about to clear, or keeps serving one whose retries have all run out.