diff --git a/scripts/check-backup-freshness.sh b/scripts/check-backup-freshness.sh
index 39ee726..7b6dafd 100755
--- a/scripts/check-backup-freshness.sh
+++ b/scripts/check-backup-freshness.sh
@@ -59,6 +59,20 @@ declare -A NS_NODE=(
 declare -A NS_JOBS=()      # ns → one "enabled|all|vmids|excludes" line per job
 declare -A NS_KNOWN=()     # ns → 1 once coverage was successfully read
 
+# WHY each policy-excluded guest is out of the backup jobs (2026-10-05). The
+# exclusion is derived from jobs.cfg coverage; the REASON is standing policy
+# and lives here so the report can say why instead of asking the reader to
+# remember. Keep one line per guest with its paper trail; if an entry shows up
+# in the policy section with no reason, that is the flag: undocumented hole.
+declare -A EXCLUDE_WHY=(
+  [ana-pve/vm/101]="retired/shut down — Prime ruling 2026-10-04 (bus 01M44MEXG60); last snapshots kept"
+  [nh3-pve/vm/104]="retired/shut down (nh3-laser) — Prime ruling 2026-10-04 (bus 01M44MEXG60); last snapshots kept"
+  [ana-pve/ct/114]="subnet-router (ana-scale) — vzdump lock risk; ESH-scale lock once blackholed the site; rebuildable from config (docs/pfi/proxmox-inventory-2026-10-02.md)"
+  [nh3-pve/ct/107]="subnet-router (nh3-scale) — same scale-router class as ana/esh-scale; rebuildable from config"
+  [esh-pve/ct/108]="subnet-router (esh-scale) — its vzdump lock blackholed the ESH site; rebuildable from config"
+  [esh-pve/vm/102]="Windows Parsec/RDP sandbox, no needed state — Prime ruling 2026-09-19 (playbooks/esh-exclude-vm102-from-backup.yaml)"
+)
+
 # Every PVE node whose vzdump TASK RESULTS we read. Unlike jobs.cfg this is
 # per-NODE, not cluster-wide, so both ESH nodes appear. sfsrv is absent: tenant.
 PVE_NODES=(
@@ -201,7 +215,7 @@ if [ -z "$pbs" ]; then errors+=("PBS-ANA: unreachable or no snapshots"); else
     is_covered "$ns" "$vmid"
     case $? in
       1) excluded+=("pbs/$guest: no enabled vzdump job covers it$(
-           [ -n "$ep" ] && printf ' (last snapshot %s)' "$(date -d "@$ep" '+%Y-%m-%d' 2>/dev/null)")") ;;
+           [ -n "$ep" ] && printf ' (last snapshot %s)' "$(date -d "@$ep" '+%Y-%m-%d' 2>/dev/null)") — ${EXCLUDE_WHY[$guest]:-⚠ NO DOCUMENTED REASON — check this exclusion is intentional}") ;;
       *) report "pbs/$guest" "$ep" ;;
     esac
   done <<<"$pbs"