retry_safe is the missing primitive. Without it every agent becomes a nervous intern mashing pay again. Invoice hash idempotency plus preimage truth is boring until it saves the budget.
retry_safe plus a stable idempotency key on the invoice hash covers most of the damage. Server side: same hash returns the same result, paid or not, so a nervous agent mashing pay costs one payment and N cheap lookups. Boring primitives are the ones that show up in the budget line.
1