stacks: remember where a container's bind mounts pointed

Every stack on core and grid is labelled with a path inside Dockhand's
filesystem — /app/data/stacks/… — because Dockhand ran compose from inside its
own container. Ham Lab resolves those by walking the bind mounts of running
containers, which works right up until the container doing the mounting is
removed. Retiring Dockhand would, in one step, make seventeen stacks on core
and five on grid unfindable.

So the mounts are written down as they are seen, and a path no live container
explains is looked for in what was seen before. A remembered mount resolves
with no container to run in, which is the right answer: compose runs on the
host, against the host's own copy of the file.

The same problem bites a scheduled update, which captures how to invoke
compose when it is made so the cron job never has to rediscover the world at
3am. repoint() checks the named container is still running and falls back the
same way if it is not — and pointedly leaves the spec alone if nothing
explains the path, so it fails loudly rather than deploying a guess.

Out in cron the record is read and never added to: the daemon owns state.json
and would clobber anything written from there.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/api/dockersched.go

@@ -18,6 +18,7 @@ import (
 	"crypto/rand"
 	"encoding/hex"
 	"encoding/json"
+	"errors"
 	"io"
 	"log"
 	"net/http"
@@ -137,10 +138,38 @@ func (s *Server) dsSyncCron(ctx context.Context, d dockerSchedState) error {
 	return s.storage.WriteRootFile(ctx, dockerCronFile, text)
 }
 
+// repoint keeps a schedule working when what deployed its stack has been removed.
+//
+// A schedule captures how to invoke compose at the moment it is made, so the cron job never
+// has to rediscover the world at 3am. But "run compose inside this container" stops being
+// true the day that container is deleted — which is exactly what happens when an
+// orchestrator is retired, and would otherwise break every schedule made before it went.
+// So: if the container named is not running, the files are looked up again, through live
+// mounts and remembered ones both, and compose runs on the host instead.
+func repoint(ctx context.Context, db *store.Store, spec compose.Spec) compose.Spec {
+	if spec.Via == "" || db == nil {
+		return spec
+	}
+	if out, err := dockerRun(ctx, "inspect", "-f", "{{.State.Running}}", spec.Via); err == nil && strings.TrimSpace(string(out)) == "true" {
+		return spec
+	}
+	st := stack{Name: spec.Project, File: spec.Files[0], Files: spec.Files}
+	st.resolve(mountsSeen(ctx, db)) // read-only: this also runs from cron, where the daemon owns state.json
+	if !st.Editable || st.Via != "" {
+		return spec // still only reachable through a container, or not reachable at all
+	}
+	log.Printf("docker schedule %s: %s is gone, running compose here against %s", spec.Project, spec.Via, st.HostFiles[0])
+	spec.Files, spec.Via = st.HostFiles, ""
+	return spec
+}
+
 // RunUpdate pulls, and deploys when the schedule says to. Shared with the CLI so the button
 // and the cron line cannot drift apart.
-func RunUpdate(ctx context.Context, j UpdateJob, tool string) (string, error) {
-	spec := j.Spec.toSpec(tool)
+func RunUpdate(ctx context.Context, db *store.Store, j UpdateJob, tool string) (string, error) {
+	if len(j.Spec.Files) == 0 {
+		return "", errors.New("this schedule has no compose file recorded — open it in the Docker tab and save it again")
+	}
+	spec := repoint(ctx, db, j.Spec.toSpec(tool))
 	var log strings.Builder
 	run := func(args ...string) error {
 		cmd := compose.Cmd(ctx, spec, args...)
@@ -299,7 +328,7 @@ func (s *Server) dsRun(w http.ResponseWriter, r *http.Request) {
 	// Outliving the request: a pull the browser gave up on still finishes, but not forever.
 	ctx, cancel := context.WithTimeout(context.WithoutCancel(r.Context()), 30*time.Minute)
 	defer cancel()
-	out, err := RunUpdate(ctx, job, dockerTool())
+	out, err := RunUpdate(ctx, s.store, job, dockerTool())
 	rec := storage.RunRecord{At: time.Now(), Taken: job.Stack}
 	if err != nil {
 		rec.Error = err.Error()