Broker agent event ingestion is not idempotent across durable Relay retries

[khaliqgant]

Summary

Relay PR AgentWorkforce/relay#1750 is making short-lived worker exit publication durable and retryable. Relaycast currently appends a new session event for every POST /v1/agents/:name/events, so an ambiguous committed response or Relay retry creates duplicate agent_exited rows for the same worker generation.

This is the server half of the at-least-once delivery contract required by AgentWorkforce/relay#1603.

Current behavior

• packages/sdk-rust/src/relay.rs sends EmitSessionEventRequest { type, payload } to POST /v1/agents/{name}/events.
• packages/engine/src/routes/agent.ts accepts the request without an idempotency key.
• packages/engine/src/engine/sessionEvent.ts allocates MAX(sequence) + 1 for every call.
• session_events is unique only on (agent_id, sequence).

A duplicate request with the same logical agent_exited generation therefore appends another event.

Acceptance criteria

• Add an explicit stable event identity for broker-originated session events, preferably the standard Idempotency-Key request contract scoped to workspace, agent, and payload.
• Replaying the same key and identical payload returns the original response and stores exactly one event.
• Reusing the same key with a different payload fails closed with a typed conflict.
• Preserve backward compatibility for existing callers that omit the key.
• Extend the Rust SDK so Relay can preserve one key across retries.
• Add conformance tests for committed-response loss and same-key/different-payload conflict.
• Prove the deployed engine contract with Relay #1750 before claiming durable hosted visibility.

Related

• SDK retry audit: idempotency is still missing on spawn, upload, and create/append POSTs #356
• Agents spawned on remote fleet nodes die young and produce nothing, while spawn reports success relay#1603
• fix(broker): persist correlated worker exits relay#1750

[khaliqgant]

PR #425 merged at exact reviewed head 1074d43 (merge da7e0d9), but this issue is intentionally reopened until the fix is published, consumed by relaycast-cloud, deployed, and the hosted duplicate/replay boundary is proven end to end. Local/full-suite and CI evidence are green; hosted release evidence remains outstanding.