diff --git a/docs/dev/catalog.md b/docs/dev/catalog.md
index b947304..b38cf60 100644
--- a/docs/dev/catalog.md
+++ b/docs/dev/catalog.md
@@ -510,8 +510,11 @@ Failures increment `attempts` and set `not_before` to an exponential backoff. Af
 count the job is marked failed and attached to its image as a typed error (NFR-ARCH-4) — one
 corrupt file does not stall the queue, and the user can see which files failed and why.
 
-**A job runner never touches the UI executor**, and `Interactive` work runs on the decode pool with
-the I/O pool behind it (ARCH §7.1).
+**A job runner never touches the UI executor**, and `Interactive` work runs on the decode executor
+with the I/O executor behind it (ARCH §7.1). Those are named rather than pooled today: thumbnails
+on demand start as `decode:thumbs` and the sweeps as `decode:thumb-sweep` and `decode:metadata`,
+through `dr_ui::executors::spawn` and each on a thread of its own, and the thread counts §7.1 gives
+are a budget nothing yet enforces (NFR-ARCH-1).
 
 ---
 
diff --git a/docs/dev/outstanding.md b/docs/dev/outstanding.md
index b2bf348..d3196a9 100644
--- a/docs/dev/outstanding.md
+++ b/docs/dev/outstanding.md
@@ -171,7 +171,7 @@ place.
 
 ---
 
-## 4. The render path — FR-DSP-2, FR-DSP-4, NFR-RES-2
+## 4. The render path — FR-DSP-2, FR-DSP-4, NFR-RES-2, NFR-ARCH-1
 
 **FR-DSP-2 — Tiled computation. Unbuilt, and under challenge.** [architecture.md §6.2](architecture.md)
 calls for tiling "from day one" on the grounds that retrofitting it is a rewrite. It was not built,
@@ -210,6 +210,17 @@ and no spill. Spike S6 — a tiled pipeline on a
 mid-range Android device with an image larger than available GPU memory — is the one that would
 settle both this and FR-DSP-2, and there is no evidence it has run.
 
+**NFR-ARCH-1 — Named executors. Named and guarded, not bounded.** `dr_ui::executors` names the
+five executors of [architecture.md §7.1](architecture.md) with their thread counts, every
+long-lived worker in `dr-ui` and the Android entry point starts through its `spawn` as
+`<executor>:<role>`, and `net_runtime`'s `block_on` fails a debug or test build on the UI thread.
+The counts are a budget and not yet a limit: each job still gets a thread of its own, and a pool
+sized from `Executor::threads` is where NFR-ARCH-2's priority classes would live. The guard covers
+`block_on` only — not a synchronous file read or a catalog query on the UI thread, which the library
+and People screens make on a click by design ([catalog.md §1](catalog.md)). The two mask workers in
+`masks_ui.rs` still call `std::thread::spawn`, and the threads the core crates start are outside the
+module.
+
 ---
 
 ## 4a. Develop, masks and the keyboard — what the 0.15.0 and 0.16.0 work left open