[HKcode22]

Direct completion work on owner's time-critical Gate5 G5A

Owner directed measurable one-month aviation ML data collection by Nov4 evening PT, no repeated vendor runway/email loop. #372 is merged: real GitHub-only three-horizon source original→V0076→private V0077→cutoff-safe PRE. Exact source-role credential already installed via #371. This PR implements the previously missing POST half of the amended scientific question: provider-observed schedule revision, not actual runway/wheels-off delay.

Real fixed POST clock, as-of W and bounded cost

• GitHub schedule-only .github/workflows/phase4-gate5-g5a-wsss-real-post.yml starts 2026-11-05 02:10 UTC (Nov4 6:10pm Pacific), with independent GH API verification of exact scheduled job/start and SHA. Three planned WSSS POST FIDS requests at 03:40, 04:10, 04:40 UTC, from wider 01:00–05:00 UTC provider source range, to measure retimes that move outside the original one-hour frame. Pre-registered primary as-of watermark W=first provider-reported scheduled T+2h; final aggregate after 05:01 UTC Nov5 (Nov4 9:01pm Pacific).
• 3×2 units maximum, 6 additional units total under the already existing 24-unit V0076 cohort budget, after up to 18 Tier2 source units. Real PostgreSQL SERIALIZABLE reserved-unit update and deterministic immutable per-slot reservation UUID appended to existing baseline clean.adb_rest_attempt_ledger BEFORE paid GET. A missed slot is UNOBSERVED; no retries, refund or replay, and no later GET can backfill an earlier fixed watermark.
• No V0079/migration. One-time exact SELECT,INSERT metadata-only grant on that existing ledger to already created non-admin G5A source writer role via scripts/v39_phase4_gate5_g5a_post_ledger_exact_grant_once.ts, production operator only after exact reviewed pin. Does not add a new secret or change DB URL. PG16 disposable grant + actual reservation/replay/cap workflow proves the permissions and ledger on a real PostgreSQL instance, never calls provider.
• Use audited FIDS source adapter, stable positive provider operating-leg/route identity across 1h original vs 4h POST source range, append reconstructed raw source with exact physical POST reservation UUID as source hash provenance + normalized population rows, never print flight IDs/content. Under source missing or schedule moving beyond 4h frame, keep UNKNOWN.
• Fixed independent aggregate SQL joins actual PRE source and latest qualified POST source available A_post<=T+2h, never after W; counts per horizon PRE, source baseline, post observed, absolute schedule revision ≥15min or below, UNKNOWN otherwise. This is not observed actual departure time. No training, Phase5/6 automatic release or fake scientific PASS.

Scope & tests

• Extend G5A identity source normalization: provider physical ID/operating flight route independent of mutable provider schedule and differing query window (or the post join would never work).
• Unit tests for real original source envelope/post reservation UUID, stable physical identity across 1h/4h retime, exact scheduled GitHub event-only gating, future year/fork/replay denial, fixed T+2h as-of SQL.
• Dedicated disposable PostgreSQL16 job: real baseline + V0076, exact non-admin role grant, deterministic immutable physical POST slots and per-manifest 24-unit ceiling, replay/gap refusal; no provider HTTP or real GitHub secret.
• Immutable handoff checkpoint data-collection/phase4/2026-11-03_GATE5_G5A_PROSPECTIVE_POST_6_UNIT_SOURCE_AND_LABEL_MEASUREMENT.md.
• Historical Plan f.8 documented OpenAPI v1.15.3.0 real bytes SHA 735620f2d2132c5bf51768f50caa767b7f0b25be8b128679641402666696890a used as documentary provenance, not the G5A protocol-md SHA. This aligns with source correction Gate5: correct source OpenAPI document hash provenance before prospective paid FIDS #373.
• The V0076/V0077/V0078 production migrations are already installed and will NOT be rerun. Owner's prior bounded paid authorization remains in force but real schedule+approved source-use scope is still required. Missingness, independent audit, callback inside/outside/unresolved, costs and original strict actual-only target remain separate; never mark Gate5 PASS from CI.

Action after green merge: one exact pinned, non-provider, non-content Replit shell command for the one table GRANT only; no extra secret, no migrations. Then GH will handle timed POST if source first-horizon prearm and all other requirements actually occur.