Payment confirmation (3rd's party point of view)
Why not require the merchant to have a unique address and not allow reuse? They could give you an xpub so you can generate them yourself if that's easier. You don't care if the buyer reuses her address.

I'd be careful with depending on time frames. That sounds fragile.