docs: Phase 5 finalize contract, add release notes, sync fixtures

docs/schedule-api-contract.md

@@ -497,8 +497,9 @@ and is recorded under [Open items](#open-items).
 
 ## Open items
 
-Recorded ambiguities and conservative choices. Each is subject to change in a
-later phase.
+Recorded ambiguities, conservative choices, and remaining known limitations.
+Items 1–21 were resolved or restated during Phases 1–4; items 22–24 are Phase 5
+findings. Everything marked "Resolved" is settled for this overhaul.
 
 1. **Phase numbering.** The brief names Phases 3 (CRUD) and 4 (copy) only;
    Phase 1 (Kiosk) and Phase 2 (System Name) are assumed here.
@@ -564,6 +565,27 @@ later phase.
     tests that a copied payload (new Block IDs, same type/times/audio/refs) is
     parsed and evaluated identically to any other; **no Kiosk changes were
     required**.
+22. **Phase 3 migration down is lossy for new-model data.** The `up` migration
+    (`20260929130000_move_schedule_to_license_key`) is additive and safe. Its
+    `down` path is **reversible in structure but lossy in data**: the down SQL
+    drops `Schedule.licenseKeyId`/`type` and `Block.day`, then deletes
+    `Schedule` rows whose `userId IS NULL`. Any schedule created under the
+    per-License-Key model (which sets `licenseKeyId` and leaves `userId` NULL)
+    is therefore **deleted** by a down-migration. Consequences:
+    - Back up `Schedule`/`Block`/`BlockProclamations` before any down-migration.
+    - Rolling back past Phase 3 requires restoring that data from backup; it is
+      **not** a data-preserving rollback.
+    - Rollback guidance is in
+      [scheduler-overhaul-release-notes.md](scheduler-overhaul-release-notes.md).
+23. **Kiosk UI/E2E on real hardware not run here.** The verification ran the
+    Portal and the Kiosk schedule logic (engine, client, cache) via the test
+    harness and real HTTP against a locally running Portal; the SDL Kiosk UI was
+    not driven interactively because the build environment has no display. See
+    the manual checklist in the release notes and the Phase 5 report.
+24. **Unauthenticated Kiosk endpoints remain a known limitation** (restated from
+    item 6): the key-only schedule and system-name endpoints authenticate by
+    License Key alone, mitigated only by the 10/min/IP rate limit. Authentication
+    is out of scope for this overhaul.
 
 ---
 
@@ -587,3 +609,11 @@ later phase.
   and Proclamation order, scoped to the caller's account, and validated before
   commit. Endpoint (e) is finalized; open items 20 and 21 record the copy
   semantics and the Kiosk no-change verification.
+- 2026-09-29 — Phase 5 (final). End-to-end verification against a locally
+  running Portal on a fresh database: schedule create/type/copy services and
+  the Kiosk-facing HTTP endpoints (validation with/without `systemName`,
+  system-name PUT, key-only schedule GET with ETag/304/404, legacy endpoint
+  parity, cross-account rejection) all pass; old-client compatibility confirmed;
+  migrations verified up/down (the down path is lossy, see open item 22). Adds
+  open items 22–24 (lossy down-migration, unrun UI-on-hardware checks, and the
+  restated unauthenticated-endpoint limitation) and the release notes.