Snapshot schedules are real cron jobs, written and owned by Ham Lab

A schedule is now a line in /etc/cron.d/hamlab-zfs, which Ham Lab owns and rewrites whole
whenever the schedules change; the line calls `hamlab zfs-snapshot <id>` as the account Ham
Lab runs as, reaching zfs through sudo exactly as the daemon does. The daemon's own ticker
is gone. Snapshots are backup-shaped and should not stop because a web console is down,
being upgraded, or uninstalled — and a cron line is greppable by anyone looking at the
machine the normal way, which a schedule hidden inside a daemon is not.

A cron expression is now the single description of when a schedule fires: the four common
shapes render to one, a custom schedule states it outright, and the next run is read back
with the same evaluator the Jobs tab uses on everyone else's lines. So the page, the file
and the prediction cannot disagree.

Schedules gain a custom cron expression and an optional snapshot name prefix. What a run
did moves out of the policy into zfs-runs/<id>.json beside the config, because the cron job
is a separate process and must never write state.json behind the daemon's back.

The detected external job can be adopted: its schedule, retention and dataset are read out
of the cron line into a new Ham Lab schedule, ready to check rather than retype.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/storage/snapshots_test.go

@@ -1,8 +1,11 @@
 package storage
 
 import (
+	"strings"
 	"testing"
 	"time"
+
+	"hamlab/internal/cron"
 )
 
 func TestSnapTimeReadsZfSnapNames(t *testing.T) {
@@ -33,39 +36,62 @@ func TestSnapTimeReadsZfSnapNames(t *testing.T) {
 	}
 }
 
-func TestScheduleIsDueAndNext(t *testing.T) {
+func TestCronExprAndNextRun(t *testing.T) {
 	now := time.Date(2026, 9, 24, 9, 15, 0, 0, time.Local)
-	daily := &Policy{Every: "daily", At: "02:30", Enabled: true}
-	if d := daily.lastDue(now); d.Hour() != 2 || d.Day() != 24 {
-		t.Fatalf("daily lastDue = %v", d)
+	for _, c := range []struct {
+		p    Policy
+		want string
+	}{
+		{Policy{Every: "daily", At: "02:30"}, "30 2 * * *"},
+		{Policy{Every: "hourly", At: "00:30"}, "30 * * * *"},
+		{Policy{Every: "weekly", At: "04:00", Weekday: 0}, "0 4 * * 0"},
+		{Policy{Every: "monthly", At: "05:15", Day: 12}, "15 5 12 * *"},
+		{Policy{Every: "custom", Cron: "*/15  9-17 * * 1-5"}, "*/15 9-17 * * 1-5"},
+	} {
+		got, err := c.p.CronExpr()
+		if err != nil || got != c.want {
+			t.Errorf("CronExpr(%+v) = %q, %v; want %q", c.p.Every, got, err, c.want)
+		}
 	}
-	if !daily.Due(now) {
-		t.Fatal("never run: must be due")
+	// the next run is read with the same evaluator the Jobs tab uses
+	daily := Policy{Every: "daily", At: "02:30"}
+	if n := daily.NextRun(now); n.Hour() != 2 || n.Minute() != 30 || n.Day() != 25 {
+		t.Fatalf("NextRun = %v, want 25th 02:30", n)
 	}
-	daily.LastRun = now.Add(-time.Hour) // ran at 08:15 today, after 02:30
-	if daily.Due(now) {
-		t.Fatal("already ran since the window: not due")
+	// a custom expression that does not parse is refused, not silently ignored
+	if _, err := (&Policy{Every: "custom", Cron: "not a schedule"}).CronExpr(); err == nil {
+		t.Fatal("a bad cron expression must be refused")
 	}
-	if n := daily.NextRun(now); n.Day() != 25 || n.Hour() != 2 {
-		t.Fatalf("daily NextRun = %v", n)
+	if _, err := (&Policy{Every: "custom", Cron: "@reboot"}).CronExpr(); err == nil {
+		t.Fatal("@reboot is not a snapshot schedule")
 	}
-	// a machine that was off through its window runs once when it comes back, not never
-	daily.LastRun = now.AddDate(0, 0, -2)
-	if !daily.Due(now) {
-		t.Fatal("a missed window must still be due")
+}
+
+func TestCronFileText(t *testing.T) {
+	ps := []Policy{
+		{ID: "abc", Name: "tank nightly", Dataset: "tank", Every: "daily", At: "02:30", KeepFor: "6w", Enabled: true},
+		{ID: "def", Name: "paused one", Dataset: "tank/apps", Every: "hourly", At: "00:05", KeepFor: "2d"},
 	}
-	// disabled never runs
-	daily.Enabled = false
-	if daily.Due(now) {
-		t.Fatal("disabled must never be due")
+	text, err := CronFileText(ps, "core", "/usr/local/bin/hamlab", "/home/core/apps/hamlab/config.json")
+	if err != nil {
+		t.Fatal(err)
 	}
-	weekly := &Policy{Every: "weekly", At: "04:00", Weekday: int(time.Sunday), Enabled: true}
-	if d := weekly.lastDue(now); d.Weekday() != time.Sunday || d.After(now) {
-		t.Fatalf("weekly lastDue = %v (%v)", d, d.Weekday())
+	if !strings.Contains(text, "30 2 * * * core /usr/local/bin/hamlab -config /home/core/apps/hamlab/config.json zfs-snapshot abc") {
+		t.Fatalf("the enabled schedule is missing or malformed:\n%s", text)
 	}
-	hourly := &Policy{Every: "hourly", At: "00:30", Enabled: true}
-	if d := hourly.lastDue(now); d.Minute() != 30 || d.Hour() != 8 {
-		t.Fatalf("hourly lastDue at 09:15 with minute 30 = %v, want 08:30", d)
+	if strings.Contains(text, "zfs-snapshot def") {
+		t.Fatalf("a paused schedule must not be scheduled:\n%s", text)
+	}
+	// every line cron will read must parse as a schedule
+	for _, line := range strings.Split(text, "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" || strings.HasPrefix(line, "#") || strings.Contains(line, "=") {
+			continue
+		}
+		f := strings.Fields(line)
+		if err := cron.ValidSchedule(strings.Join(f[:5], " ")); err != nil {
+			t.Errorf("line %q: %v", line, err)
+		}
 	}
 }
 
@@ -77,6 +103,8 @@ func TestValidateRefusesNonsense(t *testing.T) {
 	bad := []Policy{
 		{Dataset: "", Every: "daily", At: "02:30", KeepFor: "6w"},
 		{Dataset: "tank", Every: "yearly", At: "02:30", KeepFor: "6w"},
+		{Dataset: "tank", Every: "custom", KeepFor: "6w"},
+		{Dataset: "tank", Every: "custom", Cron: "not a schedule", KeepFor: "6w"},
 		{Dataset: "tank", Every: "daily", At: "25:00", KeepFor: "6w"},
 		{Dataset: "tank", Every: "daily", At: "02:30"},                          // no retention
 		{Dataset: "tank", Every: "daily", At: "02:30", KeepFor: "6 weeks"},      // unparseable