So, we had in there that there could be a timeout or some other means of aborting. However, I think we were going down the wrong path... I've routed the "timeout" and the user hitting "esc" down the "user aborts the payment request" path instead. I also removed the "[[updating]]" check to allow for this.

@domenic, if you have time, can you please sanity check this?

Filed bug about de-dupe abort the update and user aborts. #814

As this makes provisions for an optional UI feature (a "cancel" button or user triggered action, like a hitting "esc"), I'm ok with merging this as is. It doesn't really add any new conformance requirements. It just clarifies behavior that matches what browsers already do.