fix(newos4): outboxResult scoped, markdown mime, old reply path retired (v4.6.81)

delegateTask declared `const outboxResult` inside the AI branch and returned it outside, so a
delegation with the AI module missing threw 'outboxResult is not defined'. The catch turned that
into _handleAgentFailure: the worker stayed idle with no result while spawn_agent reported ok —
the reported symptom exactly. Now function-scoped, and the no-module path returns
'queued — AI module not loaded, nothing executed' rather than claiming 'completed'.

Also: nginx served _docs/*.md as application/octet-stream (no .md type) — now text/markdown +
nosniff; agent-replies.php returns 410 for GET as well as POST, so there is one reply path.

Verified: with the AI module deleted at runtime, delegateTask returns the queued string and
throws nothing.

1 files changed, 19 insertions, 40 deletions

diff --git a/api/debug/agent-replies.php b/api/debug/agent-replies.php
index 2d2e2b2..b996a29 100644
--- a/api/debug/agent-replies.php
+++ b/api/debug/agent-replies.php
@@ -1,45 +1,24 @@
 <?php
-// api/debug/agent-replies.php — outbound half of the maintenance thread.
-// Hermes (or the operator) writes replies here; the in-page agent reads them with
-// `feedback-inbox`. nginx gates this path behind the WebX11 admin session, so it is
-// owner-only: never expose it in the public debug/course location block.
+// api/debug/agent-replies.php — RETIRED.
+//
+// This was the one-way reply store for the old `feedback` command: a single shared
+// array every browser wrote to and only an admin session could read. It was replaced
+// by the token-scoped chat channel (api/chat/), where each thread belongs to one
+// browser and the writer is `hermes`.
+//
+// Both verbs now answer 410 Gone with a pointer. Keeping GET alive kept a second read
+// path over the same concept — the "one write path, one truth" rule applies to reads
+// too, because two answers to "what did Hermes say" drift apart.
+declare(strict_types=1);
 require_once __DIR__ . '/config.php';
 
-define('REPLIES_DIR', __DIR__ . '/../../data/maintenance');
-define('REPLIES_FILE', REPLIES_DIR . '/replies.json');
-
-if (!is_dir(REPLIES_DIR)) {
-    @mkdir(REPLIES_DIR, 0775, true);
-    @chgrp(REPLIES_DIR, 'www-data');
-}
-
-$method = $_SERVER['REQUEST_METHOD'];
-
-if ($method === 'GET') {
-    $since = $_GET['since'] ?? null;
-    $all = load_json(REPLIES_FILE);
-    if (!is_array($all)) $all = [];
-    if ($since) {
-        $all = array_values(array_filter($all, fn($r) => ($r['created_at'] ?? '') > $since));
-    }
-    json_response(['success' => true, 'replies' => array_slice($all, -100)]);
-}
-
-if ($method !== 'POST') {
-    error_response('Method not allowed', 405);
-}
-
-// v4.6.71: retired. Two write paths meant two truths — messages written here never
-// reached the chat thread, so they looked like a conversation nobody answered.
-// One write path now: /api/chat/post.php (contract: _docs/chat-contract.md).
 http_response_code(410);
-header('Content-Type: application/json');
+header('Content-Type: application/json; charset=utf-8');
 echo json_encode([
-    'success' => false,
-    'code'    => 'gone',
-    'error'   => 'POST /api/debug/agent-replies.php is retired',
-    'use'     => '/spaces/newos4/api/chat/post.php',
-    'contract'=> '/spaces/newos4/_docs/chat-contract.md',
-    'read'    => '/spaces/newos4/api/chat/poll.php',
-]);
-exit;
+    'success'  => false,
+    'code'     => 'gone',
+    'error'    => 'agent-replies.php is retired — the chat channel replaced it',
+    'use'      => '/spaces/newos4/api/chat/post.php and /api/chat/poll.php',
+    'contract' => '/spaces/newos4/_docs/chat-contract.md',
+    'host'     => 'python3 /var/www/webx11.duckdns.org/spaces/newos4/scripts/chat.py list',
+], JSON_UNESCAPED_SLASHES);