diff --git a/_docs/_autodev_state.md b/_docs/_autodev_state.md
index 6e3f6b3..98fc79d 100644
--- a/_docs/_autodev_state.md
+++ b/_docs/_autodev_state.md
@@ -2,8 +2,8 @@
 
 ## Current Step
 flow: existing-code
-step: 15
-name: Performance Test
+step: 16
+name: Deploy
 status: not_started
 sub_step:
   phase: 0
diff --git a/_docs/_process_leftovers/2026-05-11_perf-pt07-harness.md b/_docs/_process_leftovers/2026-05-11_perf-pt07-harness.md
index 1ac8571..a9a9e2f 100644
--- a/_docs/_process_leftovers/2026-05-11_perf-pt07-harness.md
+++ b/_docs/_process_leftovers/2026-05-11_perf-pt07-harness.md
@@ -31,6 +31,17 @@ When the next cycle's autodev runs, before any new tracker write or before re-en
 
 The AZ-488 commit added PT-08 (UAV tile batch upload latency) to `_docs/02_document/tests/performance-tests.md` with Status `Deferred` because it reuses the same harness expansion as PT-07 (baseline capture + p95 ratio). When PT-07's runner-script scenario is implemented in step 1 above, add the PT-08 scenario in the **same commit** — the integration-test fixtures already exist (`SatelliteProvider.IntegrationTests/UavUploadTests` happy-path JWT + `UavTileImageFactory.CreateRandomJpeg`). After PT-08 runs, flip the Status line in `performance-tests.md` from `Deferred` to active. This keeps cycle 1 retro Action 2 satisfied for both NFRs.
 
+## AZ-487 follow-on: scripts/run-performance-tests.sh attaches no Bearer token (cycle 2 carry-over)
+
+Cycle 2's Step 15 (Performance Test) skip-decision uncovered an additional latent blocker: `scripts/run-performance-tests.sh` calls every `/api/satellite/*` endpoint without an `Authorization` header. Post-AZ-487 every such call returns HTTP 401 — the script is currently broken end-to-end, not just for PT-07/PT-08. Whoever picks up the harness work in step 1 above MUST also:
+
+1. Read `JWT_SECRET` from the host env (the same value used by `docker-compose.yml`).
+2. Mint a short-lived HS256 token at the top of the script (mirror `SatelliteProvider.IntegrationTests/JwtTestHelpers.MintValidToken` — small `python3 -c` or `jwt` CLI call; do not commit the dev placeholder secret).
+3. Add the token to every `curl` invocation via `-H "Authorization: Bearer $JWT"`.
+4. Skip-the-test-cleanly when `JWT_SECRET` is unset rather than running and failing on every call.
+
+This is purely script work; no production code needs to change. Tracking it here so PT-01..PT-06 are runnable again the same cycle PT-07/PT-08 are activated.
+
 ## Tracker action (none required this cycle)
 
 This leftover does NOT require a Jira ticket on its own — it tracks deferred process work, not user-visible scope. If the perf comparison reveals a regression next cycle, that finding will create a Jira bug; until then there is nothing to file.