Record the operator's rulings 61 (calibre-web generated login name) and 62 (registry retention rule)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CONTEXT.md

@@ -16,6 +16,11 @@
 > and holds nothing of its own; this file does hold its own content, namely the standing rulings below.
 
 
+> **Rulings 2026-10-01 (late afternoon, operator) — `09` §3 decisions 61, 62, recorded before the work.** **61 (R-752 A):**
+> calibre-web's admin login name is generated at install and shown on the app page; the lock stays. **62 (R-750 A):** the
+> registry prune keeps the newest 20 per image plus every version the vouched golden, the floor, `agent_version` and
+> `min_agent` name (and the golden's controller image); never scheduled; `--apply` is a person's act.
+
 > **2026-10-01 (afternoon) — strangers and lockouts (R-752), the one address behind the tunnel (R-753), the registry (R-750).**
 > Decisions 58–60 (decided by CC unattended — operator may reverse): wger `AXES_LOCKOUT_PARAMETERS=username`,
 > `AXES_COOLOFF_TIME=5`, database handler (catalog `82fff32`); BookStack and Grafana unchanged (1 and 5 min, measured).

documentation/architecture/09-update-architecture.md

@@ -637,6 +637,18 @@ R-636's louder repeated alarm.
     every hour. Catalog `a4597cd`.
     **Operator, 2026-10-01 (afternoon): kept** — mealie stays on the 1-hour lock; no secret login name (option d not taken).
 
+### 2026-10-01 (late afternoon) — two operator rulings (recorded before the work)
+
+61. **calibre-web: the box generates the admin LOGIN NAME at install** and shows it on the app page next to the generated
+    password, so a stranger cannot aim the per-name lock at it — *operator ruling 2026-10-01 (R-752, option A).* The lock
+    itself stays (the guessing guard is kept). **Why:** calibre-web locks a NAME for a day after 40 wrong tries
+    (`cps/web.py:2218`, measured), has no knob for that length, and its default name `admin` is public.
+62. **Registry retention: the prune keeps the newest 20 versions of each image, plus every version named by the vouched
+    golden, the controller floor and the vouched agent** (`golden_version`, the floor, `agent_version`, `min_agent`) **and
+    the controller image the golden names** — *operator ruling 2026-10-01 (R-750, option A).* It never runs on a schedule
+    unless the operator says so; `--apply` is a person's act. **Why:** a manual `--keep 7` run (HM-024, August) kept about
+    a day of controller releases and protected nothing in use.
+
 ### 2026-10-01 (afternoon) — decided by CC unattended, operator may reverse (R-752)
 
 The question for all three: how long may a stranger's wrong passwords, aimed at a PUBLIC login name, keep the household