Design a Donation Service with Reliable Payment and Payout Tracking

Design a donation service that collects funds from users and sends payouts to charities. Include a payment service provider and handle payment failure, disconnection, and duplicate requests. ### Constraints & Assumptions Focus on technical payment state and reliable integration. Supported methods, currencies, payout timing, refunds, and charity eligibility requirements must be clarified rather than assumed. Do not equate a browser success page with settled funds. ### Clarifying Questions What state authorizes a charity payout? Can the provider report asynchronously? What identifiers support idempotency? How are failed or reversed collections and failed payouts reconciled? ### What a Strong Answer Covers Separate donation/payment/payout records, durable state transitions, idempotency, provider webhooks and reconciliation, ledger evidence, and clear user-visible status. ### Follow-up Questions What if the provider commits but the response is lost? What if a webhook arrives twice or out of order? How do you prevent paying a charity twice while retrying a failed request?