Action recommended: Some records are beyond their configured retention window.
Use the cleanup preview above to inspect, then call
POST /admin/retention/cleanup/execute with dry_run: false, confirm: true
via the API to clean up dismissed alerts or old audit events.