restic-backup: dry-run exclude verification, tmpfs-cache rejection, arc_min initramfs + headroom caveat

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ks4/restic-backup.md

@@ -100,6 +100,17 @@ excluding them shrinks walk and churn dramatically:
 
 Seafile: no excludes — the block store *is* the data.
 
+Verify excludes before the seed: count the win with
+`find .../appdata_* -path '*/preview/*' | wc -l`, then
+`restic backup --dry-run -vv --exclude-file ...` prints every
+include/exclude decision without uploading. (Per-user `<user>/cache/`
+dirs are a further regenerable candidate if the count justifies it.)
+
+Cache on tmpfs was considered and rejected: the cache exists to avoid
+*network* metadata re-fetches; tmpfs loses it at reboot (forcing a
+full re-download), eats the RAM the ARC needs, and buys nothing —
+disk-backed cache reads are ARC-warm after first touch anyway.
+
 ## 3. Install + init (root on ks4)
 
 ```sh
@@ -121,9 +132,14 @@ Order matters:
 1. **Bump the ARC floor first** so metadata walks stay warm between
    nightly runs (also helps the plakar legs):
    ```sh
-   echo $((8*1024*1024*1024)) > /sys/module/zfs/parameters/zfs_arc_min
+   echo 8589934592 > /sys/module/zfs/parameters/zfs_arc_min
    echo "options zfs zfs_arc_min=8589934592" > /etc/modprobe.d/zfs-arc.conf
+   update-initramfs -u    # zfs loads from the initramfs
+   awk '/^c_min/ {printf "%.1f GiB\n", $3/1073741824}' /proc/spl/kstat/zfs/arcstats
    ```
+   ⚠️ the floor is defended even under memory pressure — real
+   headroom becomes ~31G − services − 8G; revisit before adding any
+   fat new service.
 2. **nextcloud** (proven ~22 MiB/s from the live pool → ~8 h), in a
    screen:
    ```sh