Record where the named executors stand

NFR-ARCH-1's register note says what b1d1c472 and 7be1efff met and what
they left, but outstanding.md, which exists to show the distance between
the register and the binary, had no entry, and catalog.md §6 still said
interactive work runs "on the decode pool with the I/O pool behind it"
when there are no pools.

outstanding.md §4 gains the entry: named and guarded, not bounded — the
counts are a budget, the guard covers block_on only, the two mask
workers and the core crates' threads are outside the module. catalog.md
names the executors the thumbnail and metadata work starts on and says
the counts are not yet enforced.

docs/dev/catalog.md

@@ -510,8 +510,11 @@ Failures increment `attempts` and set `not_before` to an exponential backoff. Af
 count the job is marked failed and attached to its image as a typed error (NFR-ARCH-4) — one
 corrupt file does not stall the queue, and the user can see which files failed and why.
 
-**A job runner never touches the UI executor**, and `Interactive` work runs on the decode pool with
-the I/O pool behind it (ARCH §7.1).
+**A job runner never touches the UI executor**, and `Interactive` work runs on the decode executor
+with the I/O executor behind it (ARCH §7.1). Those are named rather than pooled today: thumbnails
+on demand start as `decode:thumbs` and the sweeps as `decode:thumb-sweep` and `decode:metadata`,
+through `dr_ui::executors::spawn` and each on a thread of its own, and the thread counts §7.1 gives
+are a budget nothing yet enforces (NFR-ARCH-1).
 
 ---
 

docs/dev/outstanding.md

@@ -171,7 +171,7 @@ place.
 
 ---
 
-## 4. The render path — FR-DSP-2, FR-DSP-4, NFR-RES-2
+## 4. The render path — FR-DSP-2, FR-DSP-4, NFR-RES-2, NFR-ARCH-1
 
 **FR-DSP-2 — Tiled computation. Unbuilt, and under challenge.** [architecture.md §6.2](architecture.md)
 calls for tiling "from day one" on the grounds that retrofitting it is a rewrite. It was not built,
@@ -210,6 +210,17 @@ and no spill. Spike S6 — a tiled pipeline on a
 mid-range Android device with an image larger than available GPU memory — is the one that would
 settle both this and FR-DSP-2, and there is no evidence it has run.
 
+**NFR-ARCH-1 — Named executors. Named and guarded, not bounded.** `dr_ui::executors` names the
+five executors of [architecture.md §7.1](architecture.md) with their thread counts, every
+long-lived worker in `dr-ui` and the Android entry point starts through its `spawn` as
+`<executor>:<role>`, and `net_runtime`'s `block_on` fails a debug or test build on the UI thread.
+The counts are a budget and not yet a limit: each job still gets a thread of its own, and a pool
+sized from `Executor::threads` is where NFR-ARCH-2's priority classes would live. The guard covers
+`block_on` only — not a synchronous file read or a catalog query on the UI thread, which the library
+and People screens make on a click by design ([catalog.md §1](catalog.md)). The two mask workers in
+`masks_ui.rs` still call `std::thread::spawn`, and the threads the core crates start are outside the
+module.
+
 ---
 
 ## 4a. Develop, masks and the keyboard — what the 0.15.0 and 0.16.0 work left open