[AZ-491] [AZ-492] [AZ-493] [AZ-494] [AZ-495] [AZ-496] Cycle 3 Step 15 skip + Step 16 deploy report

Step 15 (Performance Test): SKIPPED. User skipped the optional gate
question. Per meta-rule.mdc, performance tests require explicit
approval; a skipped question is not approval. Recorded as leftover at
_docs/_process_leftovers/2026-05-12_perf-cycle3-harness-execution.md
for replay at next /autodev invocation.

Step 16 (Deploy): COMPLETED. Produced deploy_cycle3.md mirroring the
cycle-2 shape. Covers:
  - 9 cycle-3 commits + zero DB migration
  - Config changes (JWT_ISSUER/JWT_AUDIENCE env vars w/ fail-fast,
    8.0.25 package bumps, new TestSupport project)
  - Pre-deploy gate recap (Steps 11-15)
  - Cycle-3 operational risks R1-R4 (admin-team iss/aud confirm,
    cross-repo doc deferral, cycle-2 R1/R3 carry-overs, test-runner
    log line)
  - Rollback plan, post-deploy verification (incl. wrong-iss / wrong-
    aud smoke probes), CI/CD push policy
  - Resolved this cycle: F-AUTH-2, D1, D3, PT-07/PT-08 leftover
  - Follow-up backlog: D4 NU1902 bump, F-DBR-2 third guard, F-PERF-1
    token-history hardening, image-fixture consolidation, AC-7 cross-
    repo write, no-revocation-list residual

Next: Step 17 (Retrospective, cycle-end mode).
Co-authored-by: Cursor <cursoragent@cursor.com>

_docs/_process_leftovers/2026-05-12_perf-cycle3-harness-execution.md

@@ -0,0 +1,44 @@
+# Leftover — Cycle 3 perf harness execution
+
+**Timestamp**: 2026-05-12T00:00:00Z (UTC+3 wallclock 2026-05-12 ~03:00)
+**Reason for deferral**: User skipped the Step 15 (Performance Test) gate. Per `meta-rule.mdc`, performance tests require explicit approval; a skipped question is not approval. Defaulted to skip + record-as-leftover to avoid blocking the autodev's progress through Steps 16-17.
+
+## What was deferred
+
+Execution of `scripts/run-performance-tests.sh` against the cycle-3 build. The harness was made runnable by AZ-492 and would exercise:
+
+- **PT-01..PT-06** — regression probes (latency / status checks for the existing endpoints with JWT attach, post-AZ-487 + post-AZ-494)
+- **PT-07** — cold + warm region-tile distribution (cold p50/p95 vs warm p50/p95; fails if warm p95 ≥ cold p95)
+- **PT-08** — UAV batch upload distribution (batch p50/p95 + per-item proxy; gated at AZ-488 NFR of batch p95 ≤ 2000 ms)
+
+## Pre-requisites for replay
+
+The harness needs the same env vars that the cycle-3 test run consumes:
+
+- `JWT_SECRET` — ≥ 32 bytes; already in `.env`
+- `JWT_ISSUER` — already in `.env` as DEV-ONLY (AZ-494)
+- `JWT_AUDIENCE` — already in `.env` as DEV-ONLY (AZ-494)
+- `GOOGLE_MAPS_API_KEY` — already in `.env`
+
+Optionally:
+- `PERF_REPEAT_COUNT` (default 20)
+- `PERF_UAV_BATCH_SIZE` (default 10)
+
+## How to replay
+
+```bash
+./scripts/run-performance-tests.sh
+```
+
+(brings up its own docker-compose stack; cleans up on exit; ~3-5 minutes for default counts)
+
+## Why this is NOT a hard blocker
+
+- The cycle-3 implementation report and code review verdicts already note that the perf harness was statically verified (script grep + integration-test compile + AZ-492 AC-1/AC-4/AC-5/AC-6 covered).
+- The AZ-488 batch-p95 threshold was set in cycle 2 and existing integration tests do NOT regress at the cycle-3 build (Step 11 full suite all-green).
+- No cycle-3 change altered the production hot paths beyond JWT validation (AZ-494 adds two string comparisons per request — sub-microsecond).
+- The cycle-2 deploy also skipped this gate (Option B) without negative consequences.
+
+## Replay obligation
+
+Per `tracker.mdc` Leftovers Mechanism: at the start of the next `/autodev` invocation, this leftover should be replayed by running the perf harness, then either deleted (if it passes) or updated with the failure detail.