Record the operator's rulings of 2026-10-01: decisions 54-56 (monthly re-test owner and scope, two controller versions per box)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/09-update-architecture.md

@@ -605,6 +605,22 @@ R-636's louder repeated alarm.
     faults found live on 9202). The one-time sweep: 9202 26.6 → 5.7 GB, demo-hp 24.3 → 13.5 GB, the N100 6.15 → 6.07 GB,
     every app healthy. Old CONTROLLER images are outside this decision and stay (R-745).
 
+### 2026-10-01 — three operator rulings (recorded before the work)
+
+54. **The monthly re-test (decision 52) is run by a CC session the operator starts** with the standing brief
+    `claude/MONTHLY-security-retest.md` (in the planning project) — not by an unattended job — *operator ruling
+    2026-10-01 (R-743, option 1A).* **Why:** the runbook's reasons hold (a fresh bench, 9202 on the drill catalog, a drill
+    reset, pushes to the live catalog — nothing of that should run with nobody watching). STATUS carries a standing line:
+    "Monthly security re-test: last run <date>, next due <date>".
+55. **The monthly re-test covers every app with a proven ladder, not only the database and redis lines** — *operator
+    ruling 2026-10-01 (R-743, option 2A).* `--engines-only` stays as a switch, not the default. **Why:** the database
+    containers are not reachable from the internet; the web apps are — a same-name fix to an exposed app matters at least
+    as much. **Cost, stated:** linuxserver images are rebuilt weekly under the same tag, so their apps come up most months.
+56. **A box keeps the controller image it runs and the one before it** (the self-update's roll-back target); older
+    controller images are deleted by the same in-use rule as decision 53 — *operator ruling 2026-10-01 (R-745, option 3A).*
+    **Why:** about 50 old controller versions sat on each demo box (R-745); a release is ~400 MB unpacked and several ship
+    a day. Registry tags are never deleted by this.
+
 ### 2026-09-30 (day) — operator notes, recorded before the work
 
 - **The day brief runs by day.** Every backup and automatic-update test is started by hand — the night chain's debug