chore: WIP pre-implement cycle 14 baseline

Co-authored-by: Cursor <cursoragent@cursor.com>

_docs/03_implementation/deploy_cycle13.md

@@ -0,0 +1,72 @@
+# Deploy Report — Cycle 13 (AZ-1126)
+
+**Date**: 2026-06-26
+**Cycle**: 13
+**Scope**: Migrate UAV upload `capturedAt` to `DateTimeOffset` (F-AZ810-2 closure).
+
+## What is shipping
+
+### Code changes
+
+| Area | Change |
+|------|--------|
+| `UavTileMetadata.CapturedAt` | `DateTime` → `DateTimeOffset` |
+| `UtcOffsetRequiredDateTimeOffsetConverter` | **New** — rejects offset-less ISO-8601 at deserialization |
+| `UavTileMetadataValidator` | Freshness rules use `UtcDateTime` without `DateTimeKind` branching |
+| `UavTileQualityGate` / `UavTileUploadHandler` | UTC comparisons without manual kind normalization |
+| `UavUploadValidationFilter` | Propagates converter `JsonException.Message` for metadata parse failures |
+| Unit + integration tests | Offset-less rejection + backward-compatible `Z` / `+00:00` happy paths |
+| `uav-tile-upload.md` | v1.2.0 → **v1.2.1** (offset requirement documented) |
+
+### Database migrations
+
+**None.**
+
+### Configuration changes
+
+| Setting | Change |
+|---------|--------|
+| New env vars | **None** |
+| Container image | Rebuild only — same `aspnet:10.0` base; no Dockerfile changes |
+| Consumer contracts | `uav-tile-upload.md` patch bump — wire shape unchanged for offset-aware clients |
+
+### Contract changes (consumer-visible)
+
+| Contract | Change | Consumer action |
+|----------|--------|-----------------|
+| `uav-tile-upload.md` v1.2.1 | `capturedAt` must include explicit UTC offset (`Z` or `+00:00`); offset-less strings → HTTP 400 | UAV upload clients sending `"2026-06-26T12:00:00"` without offset must add `Z` or `+00:00` |
+| REST / gRPC wire shapes (other) | Unchanged | No action |
+
+## Verification gates passed in this cycle
+
+| Gate | Result | Evidence |
+|------|--------|----------|
+| Step 11 — Functional tests | **PASS** | Full suite via `./scripts/run-tests.sh` (mode=full) |
+| Step 12 — Test-Spec Sync | **PASS** | Traceability AZ-1126 AC-1..AC-4 |
+| Step 13 — Update Docs | **PASS** | `ripple_log_cycle13.md`, module + contract docs |
+| Step 14 — Security Audit | **PASS** (delta) | `security_report_cycle13.md`; F-AZ810-2 **resolved** |
+| Step 15 — Performance Test | **PASS** | `perf_2026-06-26_cycle13.md` — 11/11 thresholds |
+
+## Security carry-overs (post-cycle-13)
+
+| ID | Status |
+|----|--------|
+| F-AZ810-2 | **Resolved** (AZ-1126) |
+| D-AZ795-1 | Open — FluentValidation 12.0.0 → 12.1.1 |
+| D2-cy4 | Open — test SDK JWT advisory (test-runtime only) |
+
+## Operator runbook
+
+1. **Commit and push** cycle-13 changes to `origin/dev`; confirm Woodpecker `01-test` + `02-build-push` green.
+2. **No migration** — deploy new API image only.
+3. **Smoke-test** after deploy:
+   - POST `/api/satellite/upload` with valid JPEG + `capturedAt` lacking offset → HTTP 400 referencing `capturedAt`
+   - POST with `capturedAt` as ISO-8601 UTC (`...Z` or `...+00:00`) → HTTP 200 on otherwise valid payload
+   - Region, route, inventory, gRPC tile delivery happy paths unchanged
+4. **Notify UAV upload consumers** (`gps-denied-onboard`, mission planner) of the offset requirement per contract v1.2.1.
+
+## Release note
+
+`/release` prerequisites (`scripts/deploy.sh`, `_docs/04_release/`) are **not present** in this repo — production promotion remains operator-driven (image build + compose on target host). Step 16.5 should be **skipped** unless release infrastructure is onboarded.
+
+**Verdict**: Cleared for retrospective (Step 17). Release (16.5) skipped — no release execution harness.