feat(chat): token-scoped chat endpoints, contract, host CLI, old POST retired (v4.6.71 phase B)

- api/chat/{lib,post,poll}.php: thread = sha256(token)[0:16]; flock read-modify-write;
  tmp+rename; ms epoch cursor; per-thread + per-IP windows with retry_after_ms;
  401/413/507/405 carry a machine code, only rate_limited is retryable
- _docs/chat-contract.md: frozen shapes, incl. why the cursor is ms and not ts
- scripts/chat.py: list/show/reply, UTC, locked, atomic replace
- api/debug/agent-replies.php POST -> 410 Gone with pointers (one write path)

Measured: 401 no-token, 201+id, poll 1 msg, poll>since 1 new, data/chat 403,
4001 chars 413 (codepoints), 429 with Retry-After 576, round trip via chat.py.

1 files changed, 14 insertions, 26 deletions

diff --git a/api/debug/agent-replies.php b/api/debug/agent-replies.php
index 070c0e6..2d2e2b2 100644
--- a/api/debug/agent-replies.php
+++ b/api/debug/agent-replies.php
@@ -29,29 +29,17 @@ if ($method !== 'POST') {
     error_response('Method not allowed', 405);
 }
 
-$raw = file_get_contents('php://input');
-if (!$raw) error_response('Empty request body');
-if (strlen($raw) > 16384) error_response('Payload too large (max 16KB)', 413);
-
-$p = json_decode($raw, true);
-if (!is_array($p)) error_response('Invalid JSON');
-
-$body = trim((string)($p['body'] ?? ''));
-if ($body === '') error_response('body is required');
-if (mb_strlen($body) > 2000) $body = mb_substr($body, 0, 2000);
-
-$list = load_json(REPLIES_FILE);
-if (!is_array($list)) $list = [];
-
-$author = (($p['author'] ?? 'hermes') === 'newos4') ? 'newos4' : 'hermes';
-$entry = [
-    'id' => 'REP-' . gmdate('Ymd-His') . '-' . substr(bin2hex(random_bytes(3)), 0, 6),
-    'created_at' => gmdate('c'),
-    'author' => $author,
-    'body' => $body,
-];
-
-$list[] = $entry;
-save_json(REPLIES_FILE, array_slice($list, -200));
-
-json_response(['success' => true, 'id' => $entry['id']], 201);
+// v4.6.71: retired. Two write paths meant two truths — messages written here never
+// reached the chat thread, so they looked like a conversation nobody answered.
+// One write path now: /api/chat/post.php (contract: _docs/chat-contract.md).
+http_response_code(410);
+header('Content-Type: application/json');
+echo json_encode([
+    'success' => false,
+    'code'    => 'gone',
+    'error'   => 'POST /api/debug/agent-replies.php is retired',
+    'use'     => '/spaces/newos4/api/chat/post.php',
+    'contract'=> '/spaces/newos4/_docs/chat-contract.md',
+    'read'    => '/spaces/newos4/api/chat/poll.php',
+]);
+exit;