[SaladDay]

Summary

The pinned Idempotency-Key of POST /agents/sessions/{session_id}/events is optional and takes 1–256 bytes. Core capped it at 128 bytes and replaced an empty header with a random key.

• One rule, sessions.ValidateIdempotencyKey: 1–256 bytes. It replaces the three copies (events, Session creation, standalone Environment creation) and the whitespace check, which never applied over HTTP because header values arrive trimmed.
• Events: an empty header returns 400, as standalone Environment creation already does. A missing header still makes the request new.
• Session creation, which the pin gives no Idempotency-Key, keeps treating an empty header as no key and now takes up to 256 bytes.
• Docs in EN and zh: wire-semantics.md, sessions-events.md, public-agent-api.md.

Checks

• go vet ./...; tests of sessions, api, execution, automations and the integration subset for keys, events, inputs, creation and Automations pass with a database.
• The boundary test fails with the old 128-byte cap, and the events test fails when an empty header gets a random key again.
• pnpm --dir website check-translations passes.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}