[AZ-509][AZ-510][AZ-511] Cycle 3 closure: deploy + retro + state

Steps 16 (Deploy) and 17 (Retrospective) outputs for cycle 3.

- 03_implementation/deploy_cycle3_report.md — ui/ dev pushed
  (15838c5..09449bd, 5 commits); stage/prod cutover deferred
  per push-scope gate option A.
- 06_metrics/retro_2026-05-13_cycle3.md — cycle 3 retro: 6/9
  pts shipped (AZ-510, AZ-511); AZ-512 deferred to backlog
  at cross-workspace prereq gate (AZ-513 filed on admin/).
- 06_metrics/structure_2026-05-13.md — structural snapshot
  referenced by retro.
- LESSONS.md — appended 3 cycle-3 lessons (process x2,
  architecture x1).
- _autodev_state.md — cycle 3 closed; cycle 4 Step 9 not
  started.

Co-authored-by: Cursor <cursoragent@cursor.com>

_docs/LESSONS.md

@@ -8,6 +8,36 @@ Categories: estimation · architecture · testing · dependencies · tooling ·
 
 ---
 
+- [2026-05-13] [process] When a task spec defines a Cross-Workspace Verification
+  BLOCKING gate and the user skips the choice prompt, the autodev MUST default
+  to the most conservative spec-aligned option (Option A: file prerequisite
+  ticket on the sibling workspace, park the task in `backlog/`) — never invent
+  a workaround that bypasses the missing dependency, never silently ship a UI
+  affordance against a non-existent endpoint, and always preserve the user's
+  ability to override at the next invocation (AZ-512 → AZ-513 pattern).
+  Source: _docs/06_metrics/retro_2026-05-13_cycle3.md
+
+- [2026-05-13] [architecture] Introducing a module-scoped state guard in
+  production source (e.g., a top-level `let bootstrapInflight: Promise | null
+  = null` for React 18 StrictMode dedupe) requires the same batch to ship 4
+  coupled changes — (a) a test-only reset hook re-exported via the public
+  barrel (STC-ARCH-01 compliance), (b) an `afterEach` reset in
+  `tests/setup.ts`, (c) a defensive default-fixture invariant check (e.g.,
+  MSW handler must seed required nullable fields the helper consumes), (d) a
+  planned ripple swap in handler mocks for any HTTP method or wire-shape
+  change — skipping any one costs a separate test-stabilization loop, as
+  AZ-510's ~4-attempt arc demonstrated.
+  Source: _docs/06_metrics/retro_2026-05-13_cycle3.md
+
+- [2026-05-13] [process] Track "user-action backlog at cycle close" as a
+  first-class retrospective metric (count of leftover items broken down by
+  manual-third-party / cross-workspace-prerequisite / cross-workspace-deploy
+  / push-pending categories) — backlog grew monotonically 0 → 3 → 7 across
+  cycles 1-3 and that accumulation is a process-shape signal, not noise;
+  surfacing it makes the cost of conservative-path defaults visible per
+  cycle and creates pressure for an explicit drain mechanism.
+  Source: _docs/06_metrics/retro_2026-05-13_cycle3.md
+
 - [2026-05-12] [process] When externalizing a committed API key, always follow
   the 4-step rotation discipline: (a) extract to env-var via a service module
   so unit tests can stub it, (b) add a literal-scan static gate (STC-SECx)