Record the operator's rulings 61 (calibre-web generated login name) and 62 (registry retention rule)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/09-update-architecture.md

@@ -637,6 +637,18 @@ R-636's louder repeated alarm.
     every hour. Catalog `a4597cd`.
     **Operator, 2026-10-01 (afternoon): kept** — mealie stays on the 1-hour lock; no secret login name (option d not taken).
 
+### 2026-10-01 (late afternoon) — two operator rulings (recorded before the work)
+
+61. **calibre-web: the box generates the admin LOGIN NAME at install** and shows it on the app page next to the generated
+    password, so a stranger cannot aim the per-name lock at it — *operator ruling 2026-10-01 (R-752, option A).* The lock
+    itself stays (the guessing guard is kept). **Why:** calibre-web locks a NAME for a day after 40 wrong tries
+    (`cps/web.py:2218`, measured), has no knob for that length, and its default name `admin` is public.
+62. **Registry retention: the prune keeps the newest 20 versions of each image, plus every version named by the vouched
+    golden, the controller floor and the vouched agent** (`golden_version`, the floor, `agent_version`, `min_agent`) **and
+    the controller image the golden names** — *operator ruling 2026-10-01 (R-750, option A).* It never runs on a schedule
+    unless the operator says so; `--apply` is a person's act. **Why:** a manual `--keep 7` run (HM-024, August) kept about
+    a day of controller releases and protected nothing in use.
+
 ### 2026-10-01 (afternoon) — decided by CC unattended, operator may reverse (R-752)
 
 The question for all three: how long may a stranger's wrong passwords, aimed at a PUBLIC login name, keep the household