Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

docs/architecture/BACKUP_AND_RECOVERY.md

@@ -95,6 +95,15 @@ newest *n* verified backups (`minimum_verified_backups`, default 2) are protecte
 age, milestone and legal-hold backups are never expired, and retention refuses to run at all while
 a restore is in flight.
 
+The admin-only `GET /api/v1/admin/recovery/retention/preview` evaluates the same policy and returns
+the exact backup IDs it would retain or expire, with each decision's reason and the observation
+time. It is read-only: it does not flush pending ORM changes, commit, write an audit event or touch
+backup files, and its response contains no encryption key or destination metadata. The run endpoint
+uses the same decision logic and continues to append `BACKUP_EXPIRED` audit events for each state
+transition. Applying retention evaluates the current rows and policy again, so an older preview is
+not an execution guarantee. `EXPIRED` is a journal state; this retention operation does not
+physically delete backup payloads.
+
 ## Capacity
 
 Backups check headroom before writing rather than discovering it by filling a disk. The estimate