Close full operational audit findings

backend/README.md

@@ -1680,3 +1680,31 @@ DatasetService/VectorFeatureService, creates new temporal Datasets and retains
 all previous snapshots. Do not add `--force` to this coordinator; a source
 refetch remains a separate deliberate recovery action in the lower-level
 operators.
+
+## Safe project lifecycle cleanup
+
+Operational validation, calibration and benchmark runs can create technical
+projects. The default project API now returns active workspaces only, while
+archived workspaces remain queryable with `GET /api/v1/projects?status=archived`.
+Use the packaged cleanup command to archive only the strict technical-name
+allowlist:
+
+```bash
+# Dry-run: inspect the number of matches without changing the database.
+python scripts/archive_technical_projects.py
+
+# Apply the exact allowlisted plan.
+python scripts/archive_technical_projects.py --apply
+```
+
+Inside the all-in-one Unraid container:
+
+```bash
+docker exec geointel python /app/scripts/archive_technical_projects.py
+docker exec geointel python /app/scripts/archive_technical_projects.py --apply
+```
+
+The command never deletes projects or related datasets, jobs, analyses,
+quality checks and exports. It always preserves `Kempen Regional Workbench`
+and `Mol Municipality Workbench`, defaults to dry-run and can print every
+matched name with `--show-names`.