[AZ-1132] [AZ-1133] Cycle 15 closeout and cycle 16 task setup

Doc ripple for FluentValidation bump, cycle 15 retro, and AZ-1133
perf preflight task queued for cycle 16.

Co-authored-by: Cursor <cursoragent@cursor.com>

_docs/02_document/tests/traceability-matrix.md

@@ -226,7 +226,8 @@
 | Cycle 12 — AZ-1124 PT-10 gRPC stream perf (perf harness + unit) | 1 perf (PT-10) + 3 unit (`PerfBootstrapPt10Tests`) + integration bootstrap (`SatelliteProvider.IntegrationTests --run-pt10`) | 6/6 in-scope (AZ-1124 AC-1..AC-6); 1 AC gated at Step 15 (AC-3); 1 doc-verified at Step 13 (AC-5) | — |
 | Cycle 13 — AZ-1126 capturedAt DateTimeOffset (integration + unit + blackbox + contract patch) | 1 integration method (`UavUploadValidationTests.ItemCapturedAtOffsetLess_Returns400`) + 4 unit files (`UtcOffsetRequiredDateTimeOffsetConverterTests`, updated UAV validator/gate/handler tests) + 1 blackbox (BT-34 with 2 sub-cases) + `uav-tile-upload.md` v1.2.1 patch | 4/4 in-scope (AZ-1126 AC-1..AC-4); 1 doc-verified at Step 13 (AC-4); closes F-AZ810-2 | — |
 | Cycle 14 — AZ-1131 environment.md integration command (doc-only) | doc-only (`environment.md`, `README.md`, `AGENTS.md` integration-test orchestration) | 3/3 in-scope (AZ-1131 AC-1..AC-3); doc-verified at Step 13; smoke regression Step 11 | — |
-| **Total** | **174** | **137/137 in-scope (100%); 3 ACs gated at Step 15 (2 AZ-504 + 1 AZ-1124 AC-3); 14 prior-cycle ACs doc-verified at Step 13 (2 cycle-7 + 8 cycle-8 + 1 AZ-1124 AC-5 + 3 AZ-1131); 2 advisory non-tested (cycle-8 AZ-809 AC-9/AC-10)** | **8/8 (100%)** |
+| Cycle 15 — AZ-1132 FluentValidation bump (dependency + security) | structural (`SatelliteProvider.Api.csproj` pins) + validator unit regression (`SatelliteProvider.Tests/Validators/*`) + validation integration regression (inventory, region, route, upload, latlon) + security scan artifacts | 5/5 in-scope (AZ-1132 AC-1..AC-5); AC-5 in `_docs/05_security/` cycle-15 artifacts; full suite Step 11 | — |
+| **Total** | **174** | **142/142 in-scope (100%); 3 ACs gated at Step 15 (2 AZ-504 + 1 AZ-1124 AC-3); 14 prior-cycle ACs doc-verified at Step 13 (2 cycle-7 + 8 cycle-8 + 1 AZ-1124 AC-5 + 3 AZ-1131); 2 advisory non-tested (cycle-8 AZ-809 AC-9/AC-10)** | **8/8 (100%)** |
 
 **Coverage shape notes (Cycle 5 — AZ-503 foundation):**
 - AZ-503 was split mid-cycle (Option C, autodev Step 10 batch 2): 7 of 12 original ACs land here; 5 (AC-5, AC-6, AC-9, AC-10, AC-12) are deferred to AZ-505 with a `Blocks` link in Jira and an entry in `_docs/02_tasks/_dependencies_table.md`. The deferred rows above are marked `◐ deferred → AZ-505` so the matrix surfaces the scope boundary explicitly.
@@ -299,6 +300,17 @@
 | AZ-1131 AC-1 | `environment.md` § Test Execution matches `run-tests.sh` Step 2 (`docker-compose.tests.yml` only) | doc-state AC; `rg` zero stale dual-compose matches; verified at Step 13 | ✓ |
 | AZ-1131 AC-2 | `README.md` + `AGENTS.md` point to `./scripts/run-tests.sh` (no stale dual-compose) | doc-state AC; `rg` zero stale dual-compose matches; verified at Step 13 | ✓ |
 | AZ-1131 AC-3 | No runtime change — smoke regression unchanged | `./scripts/run-tests.sh --smoke` Step 11 (EXIT:0) | ✓ |
+| AZ-1132 AC-1 | Both FluentValidation packages pinned to 12.1.1 in `SatelliteProvider.Api.csproj` | Structural: csproj `PackageReference` versions; lockstep bump of `FluentValidation` + `FluentValidation.DependencyInjectionExtensions` | ✓ |
+| AZ-1132 AC-2 | Validator unit tests pass unchanged | `SatelliteProvider.Tests/Validators/*` at Step 11 (144 passed per batch report) | ✓ |
+| AZ-1132 AC-3 | Validation integration tests pass unchanged | Inventory, region, route, upload, latlon validation integration suites at Step 11 full `./scripts/run-tests.sh` (457 unit + integration) | ✓ |
+| AZ-1132 AC-4 | Production FluentValidation absent from vulnerable-package scan | `dotnet list SatelliteProvider.sln package --vulnerable` (batch closure); `dependency_scan_cycle15.md` | ✓ |
+| AZ-1132 AC-5 | Security finding D-AZ795-1 resolved | `_docs/05_security/dependency_scan_cycle15.md` + `security_report_cycle15.md` — Resolved, references AZ-1132 | ✓ |
+
+**Coverage shape notes (Cycle 15 — AZ-1132 FluentValidation bump):**
+- Dependency-only patch bump (12.0.0 → 12.1.1) — no new HTTP routes, wire contracts, validation rules, or perf/security harness scenarios. Closes the last open Low production dependency carry-over from the AZ-795 epic footprint (D-AZ795-1).
+- No new blackbox, perf, or security test scenarios. Existing BT-27..BT-34 + SEC-* rows remain the binding functional evidence; Step 11 full suite is the regression gate for AC-2/AC-3.
+- The `AZ-795 (epic)` row above still names FluentValidation 12.0.0 as the cycle-7 baseline pin — preserved per cycle-update rule 4. AZ-1132 supersedes the production pin to 12.1.1 without changing observable validation behavior.
+- Step 14 (Security) and Step 15 (Performance) appropriately **skipped** — no new attack surface or latency-sensitive path (per cycles 11/14 precedent for dependency/doc-only themes).
 
 **Coverage shape notes (Cycle 14 — AZ-1131 environment.md integration command):**
 - Documentation-only cycle — closes cycle 12/13 retro carry-over (stale `docker-compose.yml` + `docker-compose.tests.yml` dual-file command in operator docs while `run-tests.sh` uses self-contained `docker-compose.tests.yml`).