sync(restic): pull live esh-docker-vm + irv-ml1 profiles into the repo

Both hosts had live improvements the repo never recorded:
- esh-docker-vm excludes ESPHome's 539 MB of PlatformIO cache (2026-09-14).
- irv-ml1 runs /etc/restic/arbo-checkpoint.sh before the backup, a non-fatal
  SQLite online-backup of arbo's gallery DB. That script is added here too.
The live copies were correct and are the source for the next change. (Also fixes
the fv-ml1 augaman removal time to ~0130 PT.)

configs/restic/esh-docker-vm/profiles.yaml

@@ -56,6 +56,14 @@ default:
       # sidecars retired fleet-wide; no more offen-scratch volumes exist.
       # Ephemeral / regenerable
       - /opt/docker/compose/*/logs
+      # ESPHome PlatformIO toolchain + build artifacts (added 2026-09-14 with
+      # the config relocation). The CONFIG is 5 files / 3 KB and is the whole
+      # point of pulling this dir into coverage; these two subtrees are 539 MB
+      # of regenerable cache -- a 45x inflation of the /opt/docker source,
+      # which this profile's own comment budgets at ~12 MB. PlatformIO
+      # re-downloads them on demand.
+      - /opt/docker/conf/esphome/.esphome/platformio
+      - /opt/docker/conf/esphome/.esphome/build
       - "**/*.log"
       - "**/*.log.*"
       - "**/*.pid"

configs/restic/irv-ml1/arbo-checkpoint.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+# Consistent SQLite snapshot of the arbo gallery DB, run before the restic backup.
+# Uses SQLite's online-backup API (safe under concurrent writes) to write
+# gallery.sqlite.bak INSIDE the arbo_db volume — which is already a restic
+# source (/var/lib/docker/volumes), so the consistent copy rides the daily run.
+# NON-FATAL by design: a failure here (e.g. container down) must NOT abort the
+# host's sole backup, hence the trailing `|| true`.
+docker exec arbo python -c 'import sqlite3; s=sqlite3.connect("/data/gallery.sqlite"); d=sqlite3.connect("/data/gallery.sqlite.bak"); s.backup(d); d.close(); s.close()' || true

configs/restic/irv-ml1/profiles.yaml

@@ -20,7 +20,8 @@
 #     source. Only /opt/docker is backed up (compose files + configs,
 #     once Docker is installed following the fleet convention).
 #
-# No DB dumps needed — this host's workloads don't store relational data.
+# DB: arbo (catalog engine) keeps a SQLite gallery DB in the arbo_db volume;
+# run-before checkpoints it (gallery.sqlite.bak) so the daily volume backup is consistent.
 
 version: "1"
 
@@ -40,6 +41,8 @@ default:
 
   backup:
     verbose: 1
+    run-before:
+      - /etc/restic/arbo-checkpoint.sh   # consistent SQLite snapshot of the arbo gallery DB
     run-after:
       - date +%s > /var/lib/restic/last-success
     source:

persistent-memory.md

@@ -155,7 +155,7 @@ _As of 2026-09-26 ~1620 PT._
   survived the recreate and was then deleted, so the gallery is empty and ready for real
   enrollments. `/recognize` p50 186 ms (1080p, one face). The detector-latency follow-up
   is theirs. Their next release pins the container gid to 10001; nothing is owed by infra-ops.
-- **The fv-ml1 instance was REMOVED by Prime on 2026-09-27 (0125 PT)** after the bench. esh-ml1 is the only
+- **The fv-ml1 instance was REMOVED by Prime on 2026-09-27 (~0130 PT)** after the bench. esh-ml1 is the only
   instance: in the house, backed up, 48 ms per face on v0.1.3.
 - **v0.1.3 live on BOTH hosts (2026-09-27 ~0105 PT).** Speed bench (`docs/pfi/augaman-speed-bench/`),
   server-side one face, v0.1.2 → v0.1.3: esh GPU 144 → 48 ms, fv GPU 75 → 27 ms. CPU mode

stacks/augaman/README.md

@@ -16,7 +16,7 @@ first, then re-mirror it here.
 | **VRAM** | ~0.74 GB on v0.1.3 (measured after the bench; 0.51 GB on v0.1.2) |
 
 **One instance: esh-ml1.** A second, fixtures-only instance ran on fv-ml1's GPU 1
-(`GPU_ID=1`) from 2026-09-27 0017 to 0125 PT, for the speed comparison in
+(`GPU_ID=1`) from 2026-09-27 0017 to ~0130 PT, for the speed comparison in
 [`docs/pfi/augaman-speed-bench/`](../../docs/pfi/augaman-speed-bench/README.md).
 **Prime removed it** after v0.1.3 put esh-ml1 at ~48 ms per face: it is in the house
 next to the cameras and it holds the verified backup. `GPU_ID` / `CARD_SUFFIX` stay in