ZFS gets its own tab, with scheduled snapshots and a retention period

Pools, datasets and snapshots move out of Disks — Disks is the hardware, this is the
filesystem on top of it. New: snapshot schedules, hourly to monthly, with a retention
period and a floor that keeps the newest few whatever their age.

The naming is zfSnap's, deliberately. grid has run zfSnap from root cron since before this
repo existed and it works, so rather than invent a second convention this writes and reads
exactly what zfSnap does: 2026-09-24_02.30.01--6w, with the retention in the name. Ham Lab
can therefore show and expire the snapshots zfSnap already took, the two cannot disagree
about what a snapshot is, and changing a schedule never re-dates old ones — each carries
the rule it was taken under. An existing cron job is detected and shown on the page, with a
warning if a Ham Lab schedule is running as well.

Nothing is destroyed unseen. Every schedule answers what it would delete, with the list,
before Run now touches anything, and only names that parse as a stamp and a TTL are ever
candidates. A snapshot taken by hand is invisible to it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

PLAN.md

@@ -553,6 +553,40 @@ something long in one, switch away and back, refresh — it's all still there.
   item names the heavier pieces (multi-select and bulk actions, folder download, resumable
   uploads, a gallery, search) — worth doing the two together, since they are the same tab.
 
+- **A KVM tab** — asked for 2026-09-24, not started. **Dead simple is the brief**: paste one
+  HTTP link, the tab shows whatever UI that KVM serves, and the keyboard goes to it. **This
+  is KVM the keyboard-video-mouse switch, not KVM the hypervisor** — the Virtualization item
+  above means the other one.
+  - **The device**: a **Sipeed NanoKVM** attached to `grid` at **`10.0.0.217`** (MAC
+    `48:da:35:6f:d0:31`), web UI on port 80. The only one so far, so store a list, not one URL.
+  - **Framing works.** Probed 2026-09-24: it sends **no `X-Frame-Options` and no
+    `frame-ancestors`**, so it does not refuse to be embedded. No fallback needed.
+  - **Proxy it through the daemon — that is what makes the simple version possible.** The
+    KVM is **HTTP only**, and Ham Lab is served over TLS, so a bare `http://…` iframe is
+    blocked as mixed content and the "just paste a link" idea dies there. Serving it from Ham
+    Lab's own origin (`/api/kvm/<id>/…`, on the `proxyNode` machinery, which already carries
+    WebSockets — exactly what the video and input streams are) fixes three things at once:
+    no mixed content, the KVM sits behind **Ham Lab's** login rather than a second one
+    (`/api/vm/info` answers 401, so it has its own, which the hub can hold once), and the
+    iframe becomes **same-origin**, which matters for the keyboard below.
+  - **The keyboard needs less than it sounds.** A parent page *cannot* capture keys and
+    forward them into a **cross-origin** iframe — the browser forbids synthetic events across
+    origins — but it does not need to: an iframe with focus receives keystrokes directly, and
+    the NanoKVM's own page already handles them. So "capture and give it to the iframe" is
+    really: click-to-focus, keep focus there, and stop the console's own shortcuts from
+    eating keys while it is focused. What is genuinely worth adding is **fullscreen** plus
+    `navigator.keyboard.lock()`, which is what stops the *browser* swallowing Escape, Tab and
+    Ctrl-W so they reach the guest — note it is Chromium-only, so Firefox and iOS Safari get
+    the plain version. Proxying makes the iframe same-origin anyway, so real forwarding stays
+    available if some KVM ever needs it.
+  - **Where the list lives is the one real design decision.** A KVM earns its keep when the
+    machine is *down* — no OS, a bad kernel, a BIOS screen — which is when that host's Ham Lab
+    cannot answer. So it is **hub-side** and must work for machines running no Ham Lab at all.
+    A `kvm_url` in each node's own `config.json` would fail in exactly the case it is for.
+  - **Do not give it an NPM host** without deciding to: `*.bigham.dev` is a wildcard to the
+    public IP, so that would put BIOS-level control of `grid` on the internet behind only the
+    KVM's own login. Behind Ham Lab's proxy it inherits Ham Lab's auth instead.
+
 ## Open questions
 
 - Idle-session reaping policy (never / after N days) — leaning never; it's a

internal/api/server.go

@@ -137,6 +137,7 @@ func New(cfg *config.Config, sessions *auth.Sessions, mgr *term.Manager, col *me
 		go s.keepFleetInStep()
 	}
 	go s.watchForUpdates(context.Background())
+	go s.runSchedules(context.Background())
 
 	m := http.NewServeMux()
 	m.HandleFunc("GET /healthz", func(w http.ResponseWriter, _ *http.Request) { w.WriteHeader(204) })
@@ -251,6 +252,12 @@ func New(cfg *config.Config, sessions *auth.Sessions, mgr *term.Manager, col *me
 	m.HandleFunc("GET /api/storage/zfs/snapshots", s.auth(s.zfsSnapshots))
 	m.HandleFunc("POST /api/storage/zfs/scrub/{pool}/{action}", s.auth(s.zfsScrub))
 	m.HandleFunc("POST /api/storage/zfs/snapshot", s.auth(s.zfsSnapshot))
+	m.HandleFunc("GET /api/zfs", s.auth(s.zfsOverview))
+	m.HandleFunc("PUT /api/zfs/schedules", s.auth(s.zfsPolicyPut))
+	m.HandleFunc("DELETE /api/zfs/schedules/{id}", s.auth(s.zfsPolicyDelete))
+	m.HandleFunc("GET /api/zfs/schedules/{id}/expired", s.auth(s.zfsPreview))
+	m.HandleFunc("POST /api/zfs/schedules/{id}/run", s.auth(s.zfsRunNow))
+	m.HandleFunc("POST /api/zfs/snapshots/delete", s.auth(s.zfsSnapshotDelete))
 	m.HandleFunc("GET /api/space", s.auth(s.spaceOverview))
 	m.HandleFunc("GET /api/space/{disk}", s.auth(s.spaceStatus))
 	m.HandleFunc("POST /api/space/{disk}/scan", s.auth(s.spaceScan))

internal/api/zfs.go

@@ -0,0 +1,301 @@
+package api
+
+// The ZFS tab: pools, datasets, snapshots, and a schedule for taking and expiring them.
+//
+// grid already runs zfSnap from root cron and has done for longer than this repo has
+// existed, so this does not replace it. It reads the same snapshot names, expires by the
+// same rule, and surfaces the cron job that drives it — so what is on screen is the truth
+// about the machine, whether Ham Lab or zfSnap is doing the work. A Ham Lab schedule is for
+// a machine that has no such tool, and the page says plainly when both are running.
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"io"
+	"log"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	"hamlab/internal/storage"
+	"hamlab/internal/store"
+)
+
+type zfsState struct {
+	Policies []storage.Policy `json:"policies"`
+}
+
+type zfsEngine struct {
+	s  *Server
+	mu sync.Mutex
+}
+
+func (s *Server) zfsLoad() zfsState {
+	var raw json.RawMessage
+	s.store.View(func(st *store.State) { raw = st.ZFS })
+	var z zfsState
+	if len(raw) > 0 {
+		_ = json.Unmarshal(raw, &z)
+	}
+	if z.Policies == nil {
+		z.Policies = []storage.Policy{}
+	}
+	return z
+}
+
+func (s *Server) zfsSave(z zfsState) error {
+	b, err := json.Marshal(z)
+	if err != nil {
+		return err
+	}
+	return s.store.Update(func(st *store.State) { st.ZFS = b })
+}
+
+// externalSnapshotJob finds a cron job that is already taking snapshots on this machine, so
+// the page can say so rather than let two schedules quietly double up.
+func (s *Server) externalSnapshotJob(ctx context.Context) map[string]any {
+	if s.cron == nil {
+		return nil
+	}
+	ov := s.cron.Overview(ctx)
+	for _, j := range ov.Jobs {
+		if !j.Enabled {
+			continue
+		}
+		c := strings.ToLower(j.Command)
+		if !strings.Contains(c, "zfsnap") && !strings.Contains(c, "zfs-auto-snapshot") && !strings.Contains(c, "sanoid") &&
+			!(strings.Contains(c, "zfs ") && strings.Contains(c, "snapshot")) {
+			continue
+		}
+		return map[string]any{
+			"tool": toolName(c), "schedule": j.Schedule, "command": j.Command,
+			"user": j.User, "source": j.Source, "id": j.ID, "next": j.Next, "last": j.Last,
+		}
+	}
+	return nil
+}
+
+func toolName(cmd string) string {
+	switch {
+	case strings.Contains(cmd, "zfsnap"):
+		return "zfSnap"
+	case strings.Contains(cmd, "zfs-auto-snapshot"):
+		return "zfs-auto-snapshot"
+	case strings.Contains(cmd, "sanoid"):
+		return "sanoid"
+	}
+	return "a cron job"
+}
+
+// randomID is a short opaque id for a schedule.
+func randomID() (string, error) {
+	b := make([]byte, 6)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(b), nil
+}
+
+// ---- the schedule runs itself ----
+
+// runSchedules takes the snapshots that are due. Every 30 s, which is fine for a schedule
+// whose finest grain is hourly, and cheap when nothing is due.
+func (s *Server) runSchedules(ctx context.Context) {
+	t := time.NewTicker(30 * time.Second)
+	defer t.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+		}
+		z := s.zfsLoad()
+		now := time.Now()
+		changed := false
+		for i := range z.Policies {
+			p := &z.Policies[i]
+			if !p.Due(now) {
+				continue
+			}
+			res, err := s.storage.Run(ctx, p)
+			p.LastRun = now
+			p.LastTaken, p.Pruned = res.Taken, len(res.Pruned)
+			if err != nil {
+				p.LastError = err.Error()
+				log.Printf("zfs schedule %q: %v", p.Name, err)
+			} else {
+				p.LastError = ""
+				log.Printf("zfs schedule %q: took %s, expired %d", p.Name, res.Taken, len(res.Pruned))
+			}
+			changed = true
+		}
+		if changed {
+			if err := s.zfsSave(z); err != nil {
+				log.Printf("zfs schedule: saving: %v", err)
+			}
+		}
+	}
+}
+
+// ---- endpoints ----
+
+func (s *Server) zfsOverview(w http.ResponseWriter, r *http.Request) {
+	z := s.zfsLoad()
+	now := time.Now()
+	out := make([]map[string]any, 0, len(z.Policies))
+	for i := range z.Policies {
+		p := z.Policies[i]
+		m := map[string]any{"policy": p}
+		if p.Enabled {
+			m["next"] = p.NextRun(now)
+		}
+		out = append(out, m)
+	}
+	jsonOK(w, 200, map[string]any{
+		"zfs": s.storage.ZFS(r.Context()), "policies": out, "external": s.externalSnapshotJob(r.Context()),
+	})
+}
+
+func (s *Server) zfsPolicyPut(w http.ResponseWriter, r *http.Request) {
+	var p storage.Policy
+	if err := json.NewDecoder(io.LimitReader(r.Body, 16<<10)).Decode(&p); err != nil {
+		jsonErr(w, 400, "bad request")
+		return
+	}
+	if err := p.Validate(); err != nil {
+		jsonErr(w, 400, err.Error())
+		return
+	}
+	z := s.zfsLoad()
+	found := false
+	for i := range z.Policies {
+		if z.Policies[i].ID == p.ID && p.ID != "" {
+			p.LastRun, p.LastError, p.LastTaken, p.Pruned = z.Policies[i].LastRun, z.Policies[i].LastError, z.Policies[i].LastTaken, z.Policies[i].Pruned
+			z.Policies[i] = p
+			found = true
+		}
+	}
+	if !found {
+		if p.ID == "" {
+			id, err := randomID()
+			if err != nil {
+				jsonErr(w, 500, err.Error())
+				return
+			}
+			p.ID = id
+		}
+		z.Policies = append(z.Policies, p)
+	}
+	if err := s.zfsSave(z); err != nil {
+		jsonErr(w, 500, err.Error())
+		return
+	}
+	log.Printf("zfs schedule %q saved by %s (%s, %s, keep %s)", p.Name, clientIP(r), p.Dataset, p.Every, p.KeepFor)
+	jsonOK(w, 200, p)
+}
+
+func (s *Server) zfsPolicyDelete(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	z := s.zfsLoad()
+	kept := z.Policies[:0]
+	found := false
+	for _, p := range z.Policies {
+		if p.ID == id {
+			found = true
+			continue
+		}
+		kept = append(kept, p)
+	}
+	if !found {
+		jsonErr(w, 404, "no such schedule")
+		return
+	}
+	z.Policies = kept
+	if err := s.zfsSave(z); err != nil {
+		jsonErr(w, 500, err.Error())
+		return
+	}
+	log.Printf("zfs schedule %s removed by %s (its snapshots are left alone)", id, clientIP(r))
+	w.WriteHeader(204)
+}
+
+func (s *Server) zfsPolicy(id string) (storage.Policy, bool) {
+	for _, p := range s.zfsLoad().Policies {
+		if p.ID == id {
+			return p, true
+		}
+	}
+	return storage.Policy{}, false
+}
+
+// zfsPreview is what this schedule would destroy if it ran now. Nothing is deleted.
+func (s *Server) zfsPreview(w http.ResponseWriter, r *http.Request) {
+	p, ok := s.zfsPolicy(r.PathValue("id"))
+	if !ok {
+		jsonErr(w, 404, "no such schedule")
+		return
+	}
+	doomed, err := s.storage.Doomed(r.Context(), &p)
+	if err != nil {
+		jsonErr(w, 500, err.Error())
+		return
+	}
+	if doomed == nil {
+		doomed = []storage.Snapshot{}
+	}
+	jsonOK(w, 200, map[string]any{"expired": doomed})
+}
+
+func (s *Server) zfsRunNow(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	p, ok := s.zfsPolicy(id)
+	if !ok {
+		jsonErr(w, 404, "no such schedule")
+		return
+	}
+	res, err := s.storage.Run(r.Context(), &p)
+	now := time.Now()
+	z := s.zfsLoad()
+	for i := range z.Policies {
+		if z.Policies[i].ID == id {
+			z.Policies[i].LastRun, z.Policies[i].LastTaken, z.Policies[i].Pruned = now, res.Taken, len(res.Pruned)
+			z.Policies[i].LastError = ""
+			if err != nil {
+				z.Policies[i].LastError = err.Error()
+			}
+		}
+	}
+	_ = s.zfsSave(z)
+	if err != nil {
+		jsonErr(w, 500, err.Error())
+		return
+	}
+	log.Printf("zfs schedule %q run by %s: took %s, expired %d", p.Name, clientIP(r), res.Taken, len(res.Pruned))
+	jsonOK(w, 200, res)
+}
+
+// zfsSnapshotDelete removes one snapshot, named in full and typed back by the caller.
+func (s *Server) zfsSnapshotDelete(w http.ResponseWriter, r *http.Request) {
+	var body struct {
+		Name      string `json:"name"`
+		Confirm   string `json:"confirm"`
+		Recursive bool   `json:"recursive"`
+	}
+	if err := json.NewDecoder(io.LimitReader(r.Body, 4096)).Decode(&body); err != nil {
+		jsonErr(w, 400, "bad request")
+		return
+	}
+	if body.Confirm != body.Name {
+		jsonErr(w, 400, "type the snapshot's full name to confirm")
+		return
+	}
+	if err := s.storage.DestroySnapshot(r.Context(), body.Name, body.Recursive); err != nil {
+		jsonErr(w, 500, err.Error())
+		return
+	}
+	log.Printf("zfs snapshot %s destroyed by %s%s", body.Name, clientIP(r), map[bool]string{true: " (recursive)", false: ""}[body.Recursive])
+	w.WriteHeader(204)
+}

internal/cron/cron.go

@@ -1,3 +1,6 @@
+// Package cron reads and writes what the UI calls the **Jobs** tab (named "Cron" until
+// 2026-09-24; the package and its /api/cron endpoints kept the old name).
+//
 // Package cron reads every scheduled job on the host into one list: /etc/crontab,
 // /etc/cron.d/*, per-user crontabs, the run-parts directories they drive, and systemd
 // timers. It computes next runs from the cron expressions, pulls last runs from the

internal/metrics/metrics.go

@@ -90,6 +90,15 @@ type FS struct {
 	Type  string `json:"type"`
 	Size  uint64 `json:"size"`
 	Used  uint64 `json:"used"`
+	// Remote is set when the filesystem lives on another machine — a CIFS or NFS share,
+	// sshfs, and so on. Its bytes are somebody else's disk, so a panel about this machine's
+	// hardware leaves it out, while the sensor stays for anyone who does want it.
+	Remote bool `json:"remote,omitempty"`
+	// Disk is the physical drive these bytes are on ("nvme0", "sda"), named as the sampler
+	// names it; empty when that cannot be
+	// said honestly: a ZFS pool or an md array spreads a filesystem over several drives, and
+	// a remote mount is on none of them.
+	Disk string `json:"disk,omitempty"`
 }
 
 type UPS struct {
@@ -766,6 +775,15 @@ func foldNVMe(devs []Disk) []Disk {
 
 // Kernel/virtual filesystems that aren't storage. Anything else that's mounted is
 // shown, so new real filesystems (bcachefs, exotic FUSE) work without a code change.
+// remoteFS is every filesystem type whose storage is not in this machine.
+var remoteFS = map[string]bool{
+	"cifs": true, "smb3": true, "smbfs": true, "nfs": true, "nfs4": true, "afs": true,
+	"ceph": true, "glusterfs": true, "9p": true, "afpfs": true, "davfs": true,
+	"fuse.sshfs": true, "sshfs": true, "fuse.rclone": true, "fuse.s3fs": true,
+	"fuse.davfs2": true, "fuse.curlftpfs": true, "fuse.gcsfuse": true, "beegfs": true,
+	"lustre": true, "orangefs": true, "pvfs2": true, "coda": true, "ncpfs": true,
+}
+
 var pseudoFS = map[string]bool{
 	"proc": true, "sysfs": true, "devtmpfs": true, "devpts": true, "tmpfs": true, "ramfs": true,
 	"cgroup": true, "cgroup2": true, "pstore": true, "bpf": true, "securityfs": true, "debugfs": true,
@@ -812,7 +830,7 @@ func filesystems() []FS {
 				return
 			}
 			bs := uint64(st.Bsize)
-			done <- FS{Mount: mount, Type: fs[2], Size: st.Blocks * bs, Used: (st.Blocks - st.Bfree) * bs}
+			done <- FS{Mount: mount, Type: fs[2], Size: st.Blocks * bs, Used: (st.Blocks - st.Bfree) * bs, Remote: remoteFS[fs[2]], Disk: diskOf(fs[0])}
 		}()
 		select {
 		case r := <-done:
@@ -820,12 +838,52 @@ func filesystems() []FS {
 				out = append(out, r)
 			}
 		case <-time.After(3 * time.Second):
-			out = append(out, FS{Mount: mount, Type: fs[2]}) // unreachable: size 0 signals it
+			out = append(out, FS{Mount: mount, Type: fs[2], Remote: remoteFS[fs[2]]}) // unreachable: size 0 signals it
 		}
 	}
 	return out
 }
 
+// diskOf names the physical drive a mount's source device sits on — "/dev/nvme0n1p2" is on
+// "nvme0n1". It follows one layer of device-mapper or md (LUKS on a partition, say) but
+// gives up when a thing spans several drives, because then no single drive is the answer.
+func diskOf(source string) string {
+	if !strings.HasPrefix(source, "/dev/") {
+		return "" // a ZFS pool, a network share, a tmpfs: not a block device at all
+	}
+	d := parentDisk(strings.TrimPrefix(source, "/dev/"), 0)
+	// the sampler reports one drive per NVMe controller, so name it the same way
+	if m := nsRe.FindStringSubmatch(d); m != nil {
+		return m[1]
+	}
+	return d
+}
+
+func parentDisk(name string, depth int) string {
+	if name == "" || depth > 4 || strings.Contains(name, "/") {
+		return ""
+	}
+	base := "/sys/class/block/" + name
+	if _, err := os.Stat(base); err != nil {
+		return ""
+	}
+	// a partition: its parent directory in sysfs is the whole drive
+	if _, err := os.Stat(base + "/partition"); err == nil {
+		if target, err := os.Readlink(base); err == nil {
+			return filepath.Base(filepath.Dir(target))
+		}
+		return ""
+	}
+	// device-mapper or md: one drive underneath is an answer, several is not
+	if ents, err := os.ReadDir(base + "/slaves"); err == nil && len(ents) > 0 {
+		if len(ents) > 1 {
+			return ""
+		}
+		return parentDisk(ents[0].Name(), depth+1)
+	}
+	return name // a whole drive, used without partitioning
+}
+
 // ---- UPS ----
 
 func runOut(args ...string) (string, bool) {

internal/metrics/sensors.go

@@ -117,9 +117,18 @@ func flatten(s Sample, want func(id string) bool) []sensors.Sensor {
 
 	for _, x := range s.FS {
 		p := "fs." + sensors.Seg(x.Mount)
-		f.add(p+".size", x.Mount+" size", "bytes", "B", float64(x.Size), s.fsT, none, "mount", x.Mount, "fstype", x.Type)
-		f.add(p+".used", x.Mount+" used", "bytes", "B", float64(x.Used), s.fsT, upTo(float64(x.Size)), "mount", x.Mount, "fstype", x.Type)
-		f.add(p+".used_pct", x.Mount+" used", "usage", "%", ratio(x.Used, x.Size), s.fsT, pct, "mount", x.Mount, "fstype", x.Type)
+		// remote says the bytes are on another machine (a CIFS or NFS share), so a view of
+		// this machine's hardware can leave it out without losing the sensor
+		lbl := []string{"mount", x.Mount, "fstype", x.Type}
+		if x.Remote {
+			lbl = append(lbl, "remote", "1")
+		}
+		if x.Disk != "" {
+			lbl = append(lbl, "disk", x.Disk)
+		}
+		f.add(p+".size", x.Mount+" size", "bytes", "B", float64(x.Size), s.fsT, none, lbl...)
+		f.add(p+".used", x.Mount+" used", "bytes", "B", float64(x.Used), s.fsT, upTo(float64(x.Size)), lbl...)
+		f.add(p+".used_pct", x.Mount+" used", "usage", "%", ratio(x.Used, x.Size), s.fsT, pct, lbl...)
 	}
 
 	if u := s.UPS; u != nil {

internal/space/walk.go

@@ -1,4 +1,6 @@
-// Package space measures what is using a disk: a parallel walk of the filesystems a disk
+// Package space measures what is using a disk — it is what the UI calls the **Usage** tab
+// (renamed from "Space" on 2026-09-24; the package and its /api/space endpoints kept the
+// old name rather than churn a working API): a parallel walk of the filesystems a disk
 // backs, kept as a tree of directories and the files worth seeing, the way WizTree does it.
 //
 // The walk never crosses a filesystem boundary by itself — /proc, /sys, another disk's

internal/storage/snapshots.go

@@ -0,0 +1,351 @@
+package storage
+
+// Scheduled snapshots with a retention period: take a snapshot of a dataset on a schedule,
+// and drop the ones that have aged out.
+//
+// **The naming is zfSnap's, deliberately.** grid has run zfSnap v1.11.1 from root cron since
+// before this repo existed and it works well, so rather than invent a second convention and
+// have two tools disagree about what a snapshot is, this writes and reads exactly what
+// zfSnap does: `<dataset>@2026-09-24_02.30.01--6w`, with the retention encoded in the name.
+// That has three consequences worth knowing. Ham Lab can show and manage the snapshots
+// zfSnap already took. The two can run side by side without fighting, because both only
+// ever destroy snapshots that have passed the expiry written into their own name. And
+// changing a policy's retention does not retroactively re-date old snapshots — each one
+// carries the rule it was taken under, which is the behaviour you want from a backup.
+//
+// Two rules make this safe to run unattended. Only a snapshot whose name parses as a stamp
+// and a TTL is ever a candidate — anything taken by hand or named anything else is invisible
+// to it. And every policy can be asked what it would delete, before it deletes anything.
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// stampLayout is zfSnap's timestamp: 2026-09-24_02.30.01.
+const stampLayout = "2006-01-02_15.04.05"
+
+// ttlSep separates the stamp from the retention in a snapshot name, as zfSnap writes it.
+const ttlSep = "--"
+
+// Policy is a standing instruction: snapshot this dataset on this schedule, keep the
+// snapshots this long.
+type Policy struct {
+	ID      string `json:"id"`
+	Name    string `json:"name"`
+	Dataset string `json:"dataset"`
+	// Recursive takes one atomic snapshot of the dataset and everything under it (zfs -r).
+	Recursive bool `json:"recursive"`
+	// Every is hourly | daily | weekly | monthly. At is "HH:MM" (the minute alone is used
+	// for hourly). Weekday is 0=Sunday, Day is 1–28.
+	Every   string `json:"every"`
+	At      string `json:"at"`
+	Weekday int    `json:"weekday"`
+	Day     int    `json:"day"`
+	// KeepFor is how long a snapshot lives: "6w", "30d", "12h". It is written into the
+	// snapshot's own name, zfSnap-style, so each one carries the rule it was taken under.
+	// KeepMin is a floor — that many newest snapshots survive however old they are, so a
+	// dataset is never left with none.
+	KeepFor string `json:"keep_for"`
+	KeepMin int    `json:"keep_min"`
+	Prefix  string `json:"prefix"`
+	Enabled bool   `json:"enabled"`
+
+	LastRun   time.Time `json:"last_run,omitempty"`
+	LastError string    `json:"last_error,omitempty"`
+	LastTaken string    `json:"last_taken,omitempty"` // the snapshot the last run made
+	Pruned    int       `json:"pruned,omitempty"`     // how many the last run destroyed
+}
+
+func (p *Policy) prefix() string { return strings.TrimSpace(p.Prefix) }
+
+// Validate reports what is wrong with a policy, or nil.
+func (p *Policy) Validate() error {
+	if !datasetRe.MatchString(p.Dataset) {
+		return errors.New("dataset: a pool or pool/dataset name")
+	}
+	if pre := p.prefix(); pre != "" && (!snapRe.MatchString(pre) || strings.Contains(pre, ttlSep)) {
+		return errors.New("prefix: letters, digits, . _ : and - only, and no --")
+	}
+	switch p.Every {
+	case "hourly", "daily", "weekly", "monthly":
+	default:
+		return errors.New("every: hourly, daily, weekly or monthly")
+	}
+	if _, _, err := p.clock(); err != nil {
+		return err
+	}
+	if p.Every == "weekly" && (p.Weekday < 0 || p.Weekday > 6) {
+		return errors.New("weekday: 0 (Sunday) to 6")
+	}
+	if p.Every == "monthly" && (p.Day < 1 || p.Day > 28) {
+		return errors.New("day: 1 to 28, so every month has one")
+	}
+	if p.KeepFor != "" {
+		if _, err := ParseAge(p.KeepFor); err != nil {
+			return err
+		}
+	}
+	if p.KeepMin < 0 {
+		return errors.New("keep at least: 0 or more")
+	}
+	if p.KeepFor == "" {
+		return errors.New("a retention period is required — it is written into each snapshot's name, and is what lets it be cleaned up later")
+	}
+	return nil
+}
+
+func (p *Policy) clock() (hour, min int, err error) {
+	at := strings.TrimSpace(p.At)
+	if at == "" {
+		return 0, 0, nil
+	}
+	h, m, ok := strings.Cut(at, ":")
+	if !ok {
+		return 0, 0, errors.New("at: HH:MM")
+	}
+	hour, err = strconv.Atoi(h)
+	if err == nil {
+		min, err = strconv.Atoi(m)
+	}
+	if err != nil || hour < 0 || hour > 23 || min < 0 || min > 59 {
+		return 0, 0, errors.New("at: HH:MM, 00:00 to 23:59")
+	}
+	return hour, min, nil
+}
+
+// ParseAge reads "6w", "30d", "12h", "90m" as a duration. Weeks and days are what a
+// retention period is actually written in, and time.ParseDuration knows neither.
+func ParseAge(s string) (time.Duration, error) {
+	s = strings.TrimSpace(strings.ToLower(s))
+	if s == "" {
+		return 0, errors.New("empty period")
+	}
+	unit := s[len(s)-1]
+	n, err := strconv.Atoi(s[:len(s)-1])
+	if err != nil || n <= 0 {
+		return 0, fmt.Errorf("%q: a number and a unit, like 6w, 30d or 12h", s)
+	}
+	switch unit {
+	case 'm':
+		return time.Duration(n) * time.Minute, nil
+	case 'h':
+		return time.Duration(n) * time.Hour, nil
+	case 'd':
+		return time.Duration(n) * 24 * time.Hour, nil
+	case 'w':
+		return time.Duration(n) * 7 * 24 * time.Hour, nil
+	}
+	return 0, fmt.Errorf("%q: the unit is m, h, d or w", s)
+}
+
+// lastDue is the most recent moment this policy was supposed to run, at or before now.
+// A policy whose LastRun is older than that is due — so a machine that was off through
+// its window takes one snapshot when it comes back, rather than skipping silently.
+func (p *Policy) lastDue(now time.Time) time.Time {
+	hour, min, _ := p.clock()
+	y, mo, d := now.Date()
+	loc := now.Location()
+	switch p.Every {
+	case "hourly":
+		t := time.Date(y, mo, d, now.Hour(), min, 0, 0, loc)
+		if t.After(now) {
+			t = t.Add(-time.Hour)
+		}
+		return t
+	case "daily":
+		t := time.Date(y, mo, d, hour, min, 0, 0, loc)
+		if t.After(now) {
+			t = t.AddDate(0, 0, -1)
+		}
+		return t
+	case "weekly":
+		t := time.Date(y, mo, d, hour, min, 0, 0, loc)
+		back := (int(t.Weekday()) - p.Weekday + 7) % 7
+		t = t.AddDate(0, 0, -back)
+		if t.After(now) {
+			t = t.AddDate(0, 0, -7)
+		}
+		return t
+	case "monthly":
+		t := time.Date(y, mo, p.Day, hour, min, 0, 0, loc)
+		if t.After(now) {
+			t = t.AddDate(0, -1, 0)
+		}
+		return t
+	}
+	return time.Time{}
+}
+
+// NextRun is when this policy runs next, for the UI to show.
+func (p *Policy) NextRun(now time.Time) time.Time {
+	last := p.lastDue(now)
+	switch p.Every {
+	case "hourly":
+		return last.Add(time.Hour)
+	case "daily":
+		return last.AddDate(0, 0, 1)
+	case "weekly":
+		return last.AddDate(0, 0, 7)
+	case "monthly":
+		return last.AddDate(0, 1, 0)
+	}
+	return time.Time{}
+}
+
+// Due reports whether the policy should run now.
+func (p *Policy) Due(now time.Time) bool {
+	if !p.Enabled {
+		return false
+	}
+	d := p.lastDue(now)
+	return !d.IsZero() && p.LastRun.Before(d)
+}
+
+// SnapTime reads a snapshot's name in zfSnap's convention and returns when it was taken,
+// when it expires, and whether the name parsed at all. A name without a TTL never expires.
+// An optional prefix in front of the stamp is allowed, so a policy can label its own.
+func SnapTime(name string) (taken time.Time, expires time.Time, ok bool) {
+	_, snap, cut := strings.Cut(name, "@")
+	if !cut {
+		return
+	}
+	body, ttl, hasTTL := strings.Cut(snap, ttlSep)
+	// an optional "<prefix>-" before the stamp
+	stamp := body
+	if len(body) > len(stampLayout) {
+		stamp = body[len(body)-len(stampLayout):]
+	}
+	t, err := time.ParseInLocation(stampLayout, stamp, time.Local)
+	if err != nil {
+		return time.Time{}, time.Time{}, false
+	}
+	taken, ok = t, true
+	if hasTTL {
+		if d, err := ParseAge(ttl); err == nil {
+			expires = t.Add(d)
+		}
+	}
+	return
+}
+
+// Doomed is which of this dataset's snapshots have passed the expiry written into their own
+// names, oldest first — exactly what zfSnap -d would remove. This is what the UI shows
+// before anything is deleted, and what Run then acts on. KeepMin holds back that many of the
+// newest whatever their names say, so a dataset is never left with none.
+func (m *Manager) Doomed(ctx context.Context, p *Policy) ([]Snapshot, error) {
+	if err := p.Validate(); err != nil {
+		return nil, err
+	}
+	all, err := m.Snapshots(ctx, p.Dataset)
+	if err != nil {
+		return nil, err
+	}
+	var dated []Snapshot
+	expiry := map[string]time.Time{}
+	for _, s := range all {
+		taken, exp, ok := SnapTime(s.Name)
+		if !ok || exp.IsZero() {
+			continue // hand-made, or kept forever: not ours to remove
+		}
+		_ = taken
+		dated = append(dated, s)
+		expiry[s.Name] = exp
+	}
+	sort.Slice(dated, func(i, j int) bool { return dated[i].Created > dated[j].Created }) // newest first
+	now := time.Now()
+	var doomed []Snapshot
+	for i, s := range dated {
+		if i < p.KeepMin {
+			continue // the floor: these survive however old they are
+		}
+		if expiry[s.Name].Before(now) {
+			doomed = append(doomed, s)
+		}
+	}
+	sort.Slice(doomed, func(i, j int) bool { return doomed[i].Created < doomed[j].Created }) // oldest first
+	return doomed, nil
+}
+
+// DestroySnapshot removes one snapshot. recursive also removes the same-named snapshot on
+// every dataset beneath it, which is what a recursive policy created.
+func (m *Manager) DestroySnapshot(ctx context.Context, full string, recursive bool) error {
+	dataset, snap, ok := strings.Cut(full, "@")
+	if !ok || !datasetRe.MatchString(dataset) || !snapRe.MatchString(snap) {
+		return errors.New("bad snapshot name")
+	}
+	args := []string{"zfs", "destroy"}
+	if recursive {
+		args = append(args, "-r")
+	}
+	out, code, err := m.run(ctx, append(args, full)...)
+	if err != nil {
+		return err
+	}
+	if code != 0 {
+		return errors.New(strings.TrimSpace(string(out)))
+	}
+	return nil
+}
+
+// SnapshotRecursive takes dataset@name, optionally of everything beneath it too.
+func (m *Manager) SnapshotRecursive(ctx context.Context, dataset, name string, recursive bool) error {
+	if !datasetRe.MatchString(dataset) || !snapRe.MatchString(name) {
+		return errors.New("bad snapshot name")
+	}
+	args := []string{"zfs", "snapshot"}
+	if recursive {
+		args = append(args, "-r")
+	}
+	out, code, err := m.run(ctx, append(args, dataset+"@"+name)...)
+	if err != nil {
+		return err
+	}
+	if code != 0 {
+		return errors.New(strings.TrimSpace(string(out)))
+	}
+	return nil
+}
+
+// RunResult is what one pass of a policy did.
+type RunResult struct {
+	Taken   string   `json:"taken"`
+	Pruned  []string `json:"pruned"`
+	Skipped int      `json:"skipped"` // snapshots that are not this policy's, left alone
+}
+
+// Run takes the snapshot and prunes what has aged out. It is the same code the scheduler
+// calls, so "Run now" and the timer cannot drift apart.
+func (m *Manager) Run(ctx context.Context, p *Policy) (RunResult, error) {
+	var res RunResult
+	if err := p.Validate(); err != nil {
+		return res, err
+	}
+	name := time.Now().Format(stampLayout)
+	if pre := strings.TrimSpace(p.Prefix); pre != "" {
+		name = pre + "-" + name
+	}
+	if p.KeepFor != "" {
+		name += ttlSep + strings.TrimSpace(strings.ToLower(p.KeepFor)) // zfSnap's convention: the retention lives in the name
+	}
+	if err := m.SnapshotRecursive(ctx, p.Dataset, name, p.Recursive); err != nil {
+		return res, err
+	}
+	res.Taken = p.Dataset + "@" + name
+	doomed, err := m.Doomed(ctx, p)
+	if err != nil {
+		return res, err // the snapshot was taken; the prune is what failed
+	}
+	for _, s := range doomed {
+		if err := m.DestroySnapshot(ctx, s.Name, p.Recursive); err != nil {
+			return res, fmt.Errorf("destroying %s: %w", s.Name, err)
+		}
+		res.Pruned = append(res.Pruned, s.Name)
+	}
+	return res, nil
+}

internal/storage/snapshots_test.go

@@ -0,0 +1,107 @@
+package storage
+
+import (
+	"testing"
+	"time"
+)
+
+func TestSnapTimeReadsZfSnapNames(t *testing.T) {
+	// the real thing off grid
+	taken, exp, ok := SnapTime("tank@2026-09-24_02.30.01--6w")
+	if !ok {
+		t.Fatal("zfSnap's own name must parse")
+	}
+	if taken.Format("2006-01-02 15:04:05") != "2026-09-24 02:30:01" {
+		t.Fatalf("taken = %v", taken)
+	}
+	if got := exp.Sub(taken); got != 6*7*24*time.Hour {
+		t.Fatalf("ttl = %v, want 6w", got)
+	}
+	// a labelled one from a policy with a prefix
+	if _, e, ok := SnapTime("tank/apps@nightly-2026-09-24_02.30.01--30d"); !ok || e.IsZero() {
+		t.Fatal("a prefixed name must parse and expire")
+	}
+	// no TTL: never expires
+	if _, e, ok := SnapTime("tank@2026-09-24_02.30.01"); !ok || !e.IsZero() {
+		t.Fatal("a name without a TTL must parse and never expire")
+	}
+	// things that are not ours
+	for _, n := range []string{"tank@before-upgrade", "tank@manual", "tank", "tank@2026-13-45_99.99.99--6w"} {
+		if _, _, ok := SnapTime(n); ok {
+			t.Errorf("%q must not parse as a scheduled snapshot", n)
+		}
+	}
+}
+
+func TestScheduleIsDueAndNext(t *testing.T) {
+	now := time.Date(2026, 9, 24, 9, 15, 0, 0, time.Local)
+	daily := &Policy{Every: "daily", At: "02:30", Enabled: true}
+	if d := daily.lastDue(now); d.Hour() != 2 || d.Day() != 24 {
+		t.Fatalf("daily lastDue = %v", d)
+	}
+	if !daily.Due(now) {
+		t.Fatal("never run: must be due")
+	}
+	daily.LastRun = now.Add(-time.Hour) // ran at 08:15 today, after 02:30
+	if daily.Due(now) {
+		t.Fatal("already ran since the window: not due")
+	}
+	if n := daily.NextRun(now); n.Day() != 25 || n.Hour() != 2 {
+		t.Fatalf("daily NextRun = %v", n)
+	}
+	// a machine that was off through its window runs once when it comes back, not never
+	daily.LastRun = now.AddDate(0, 0, -2)
+	if !daily.Due(now) {
+		t.Fatal("a missed window must still be due")
+	}
+	// disabled never runs
+	daily.Enabled = false
+	if daily.Due(now) {
+		t.Fatal("disabled must never be due")
+	}
+	weekly := &Policy{Every: "weekly", At: "04:00", Weekday: int(time.Sunday), Enabled: true}
+	if d := weekly.lastDue(now); d.Weekday() != time.Sunday || d.After(now) {
+		t.Fatalf("weekly lastDue = %v (%v)", d, d.Weekday())
+	}
+	hourly := &Policy{Every: "hourly", At: "00:30", Enabled: true}
+	if d := hourly.lastDue(now); d.Minute() != 30 || d.Hour() != 8 {
+		t.Fatalf("hourly lastDue at 09:15 with minute 30 = %v, want 08:30", d)
+	}
+}
+
+func TestValidateRefusesNonsense(t *testing.T) {
+	ok := Policy{Dataset: "tank/apps", Every: "daily", At: "02:30", KeepFor: "6w"}
+	if err := ok.Validate(); err != nil {
+		t.Fatalf("a sane policy: %v", err)
+	}
+	bad := []Policy{
+		{Dataset: "", Every: "daily", At: "02:30", KeepFor: "6w"},
+		{Dataset: "tank", Every: "yearly", At: "02:30", KeepFor: "6w"},
+		{Dataset: "tank", Every: "daily", At: "25:00", KeepFor: "6w"},
+		{Dataset: "tank", Every: "daily", At: "02:30"},                          // no retention
+		{Dataset: "tank", Every: "daily", At: "02:30", KeepFor: "6 weeks"},      // unparseable
+		{Dataset: "tank", Every: "monthly", At: "02:30", Day: 31, KeepFor: "6w"}, // not every month has one
+		{Dataset: "tank", Every: "daily", At: "02:30", KeepFor: "6w", Prefix: "a--b"},
+	}
+	for i, p := range bad {
+		if err := p.Validate(); err == nil {
+			t.Errorf("bad policy %d was accepted: %+v", i, p)
+		}
+	}
+}
+
+func TestParseAge(t *testing.T) {
+	for s, want := range map[string]time.Duration{
+		"6w": 6 * 7 * 24 * time.Hour, "30d": 30 * 24 * time.Hour,
+		"12h": 12 * time.Hour, "90m": 90 * time.Minute,
+	} {
+		if got, err := ParseAge(s); err != nil || got != want {
+			t.Errorf("ParseAge(%q) = %v, %v; want %v", s, got, err, want)
+		}
+	}
+	for _, s := range []string{"", "6", "w", "-1d", "0w", "6y", "six weeks"} {
+		if _, err := ParseAge(s); err == nil {
+			t.Errorf("ParseAge(%q) should fail", s)
+		}
+	}
+}

internal/store/store.go

@@ -51,7 +51,8 @@ type State struct {
 	// UI is the pre-users machine-wide look; on first boot with users it moves to the first
 	// account. Kept so an old state file still reads.
 	UI         json.RawMessage `json:"ui,omitempty"`
-	Alerts     json.RawMessage `json:"alerts,omitempty"`      // rules, channels and recent events (internal/api/alerts.go)
+	Alerts     json.RawMessage `json:"alerts,omitempty"`
+	ZFS        json.RawMessage `json:"zfs,omitempty"`  // snapshot schedules (internal/api/zfs.go)      // rules, channels and recent events (internal/api/alerts.go)
 	SamplerMs  int             `json:"sampler_ms,omitempty"`  // how often this machine samples; the hub keeps every machine on the console's refresh rate
 	HistorySec int             `json:"history_sec,omitempty"` // how far back the graphs reach; the hub keeps every machine on the same one
 }

web/src/Disks.tsx

@@ -1,8 +1,8 @@
 import { useCallback, useEffect, useMemo, useState } from 'react'
-import { api, SmartInfo, StorageDevice, ZFSInfo, ZFSSnapshot } from './api'
+import { api, SmartInfo, StorageDevice } from './api'
 import { fmtBytes, fmtRate } from './fmt'
 import TaskOutput from './TaskOutput'
-import { Btn, Loading, Spinner, askText, toast } from './ui'
+import { askText, Btn, Loading, Meter, Spinner, toast } from './ui'
 import { useRefreshMs } from './prefs'
 import { Sensor, useSensorStream } from './sensors'
 
@@ -11,10 +11,6 @@ const KIND: Record<string, string> = { nvme: 'NVMe', ssd: 'SSD', hdd: 'HDD', usb
 const hours = (h: number) => (h >= 24 * 365 ? `${(h / 8760).toFixed(1)} y` : h >= 48 ? `${Math.round(h / 24)} d` : `${h} h`)
 const ago = (ms: number) => { const s = (Date.now() - ms) / 1000; return s < 3600 ? `${Math.round(s / 60)}m ago` : s < 86400 ? `${Math.round(s / 3600)}h ago` : `${Math.round(s / 86400)}d ago` }
 
-function Meter({ frac, cls }: { frac: number; cls?: string }) {
-  const c = cls ?? (frac >= 0.95 ? 'bad' : frac >= 0.85 ? 'warn' : '')
-  return <div className="meter"><div className={'fill ' + c} style={{ width: `${Math.min(100, Math.max(0, frac * 100))}%` }} /></div>
-}
 
 // ---- SMART panel ----
 function SmartPanel({ dev, rotational }: { dev: string; rotational: boolean }) {
@@ -109,82 +105,9 @@ function DeviceCard({ d, live, forceOpen }: { d: StorageDevice; live?: { read_bp
   )
 }
 
-// ---- ZFS ----
-function PoolCard({ p, onChanged }: { p: ZFSInfo['pools'][number]; onChanged: () => void }) {
-  const scrubbing = /scrub in progress/i.test(p.scan ?? '')
-  const paused = /scrub paused/i.test(p.scan ?? '')
-  const [cfg, setCfg] = useState(false)
-  const act = (a: 'start' | 'pause' | 'stop') => async () => {
-    try { await api.zfsScrub(p.name, a); toast(`scrub ${a}: ok`); onChanged() } catch (e) { toast(e instanceof Error ? e.message : 'failed', 'err') }
-  }
-  return (
-    <section className="card">
-      <div className="sub-head">
-        <span className={'dot ' + (p.health === 'ONLINE' ? 'ok' : p.health === 'DEGRADED' ? 'warn' : 'bad')} />
-        <span className="dname">{p.name}</span>
-        <span className="badge">{p.health}</span>
-        <span className="spacer" />
-        <span className="num">{fmtBytes(p.alloc)} / {fmtBytes(p.size)} · {p.cap}%</span>
-      </div>
-      <Meter frac={p.cap / 100} cls={p.cap >= 90 ? 'bad' : p.cap >= 80 ? 'warn' : ''} />
-      <div className="props" style={{ marginTop: 8 }}>
-        <div><span className="k">Free</span><span>{fmtBytes(p.free)} · fragmentation {p.frag}% · dedup {p.dedup}</span></div>
-        {p.scan && <div><span className="k">Scan</span><span style={{ whiteSpace: 'normal' }}>{p.scan}</span></div>}
-        {p.errors && <div><span className="k">Errors</span><span className={p.errors.startsWith('No known') ? '' : 'warn-text'}>{p.errors}</span></div>}
-      </div>
-      <div className="svc-actions">
-        {!scrubbing && <Btn className="btn" confirm={`Start a scrub of ${p.name}? It reads the whole pool and can take many hours.`} onClick={act('start')}>{paused ? 'Resume scrub' : 'Scrub'}</Btn>}
-        {scrubbing && <Btn className="btn" onClick={act('pause')}>Pause scrub</Btn>}
-        {(scrubbing || paused) && <Btn className="btn" confirm="Stop the scrub?" onClick={act('stop')}>Stop scrub</Btn>}
-        <button className="btn" onClick={() => setCfg(!cfg)}>{cfg ? 'Hide vdevs' : 'Vdevs'}</button>
-      </div>
-      {cfg && <pre className="unit-file">{p.config}</pre>}
-    </section>
-  )
-}
-
-function DatasetRow({ d, onChanged }: { d: ZFSInfo['datasets'][number]; onChanged: () => void }) {
-  const [snaps, setSnaps] = useState<ZFSSnapshot[] | null>(null)
-  const [open, setOpen] = useState(false)
-  async function toggle() {
-    setOpen(!open)
-    if (!open && !snaps) { try { setSnaps(await api.zfsSnapshots(d.name)) } catch (e) { toast(e instanceof Error ? e.message : 'failed', 'err'); setSnaps([]) } }
-  }
-  async function snapshot() {
-    const def = 'hamlab-' + new Date().toISOString().slice(0, 16).replace(/[-:T]/g, '').replace(/(\d{8})(\d{4})/, '$1-$2')
-    const name = await askText(`Snapshot name for ${d.name}@`, def)
-    if (!name) return
-    try { await api.zfsSnapshot(d.name, name.trim()); toast(`${d.name}@${name.trim()} created`); setSnaps(null); onChanged() }
-    catch (e) { toast(e instanceof Error ? e.message : 'failed', 'err') }
-  }
-  const depth = d.name.split('/').length - 1
-  return (
-    <>
-      <div className="ds-row" style={{ paddingLeft: 12 + depth * 16 }}>
-        <span className="ds-name" onClick={toggle}><span className="chev">{open ? '▾' : '▸'}</span>{d.name.split('/').pop()}{d.type === 'volume' && <span className="badge">zvol</span>}</span>
-        <span className="num">{fmtBytes(d.used)}</span>
-        <span className="num muted">{fmtBytes(d.refer)}</span>
-        <span className="num muted">{d.used_by_snapshots ? fmtBytes(d.used_by_snapshots) : '—'}</span>
-        <span className="num muted">{d.snapshots}</span>
-        <span className="num muted">{d.compressratio}</span>
-        <span className="ds-mount muted">{d.mount}</span>
-      </div>
-      {open && (
-        <div className="ds-snaps">
-          <div className="svc-actions"><Btn className="btn" onClick={snapshot}>Snapshot now</Btn><span className="muted">avail {fmtBytes(d.avail)}</span></div>
-          {snaps === null ? <div className="muted"><Spinner /> listing…</div> : snaps.length === 0 ? <div className="muted">No snapshots.</div> : (
-            <div className="snap-list">{snaps.slice().reverse().map((s) => <div key={s.name} className="snap"><span className="mono">{s.name.split('@')[1]}</span><span className="num muted">{new Date(s.created).toLocaleString()} · {fmtBytes(s.used)}</span></div>)}</div>
-          )}
-        </div>
-      )}
-    </>
-  )
-}
-
 // ---- page ----
 export default function Disks() {
   const [devs, setDevs] = useState<StorageDevice[] | null>(null)
-  const [zfs, setZfs] = useState<ZFSInfo | null>(null)
   const [hasSmart, setHasSmart] = useState(true)
   const [err, setErr] = useState('')
   const [task, setTask] = useState<string | null>(null)
@@ -194,7 +117,7 @@ export default function Disks() {
   const load = useCallback(async () => {
     try {
       const r = await api.storage()
-      setDevs(r.devices); setZfs(r.zfs); setHasSmart(r.smartctl); setErr('')
+      setDevs(r.devices); setHasSmart(r.smartctl); setErr('')
     } catch (e) { setErr(e instanceof Error ? e.message : 'failed') }
   }, [])
   useEffect(() => { load() }, [load])
@@ -237,18 +160,6 @@ export default function Disks() {
         {devs.map((d) => <DeviceCard key={d.name} d={d} live={liveFor(d)} forceOpen={allSmart ? true : null} />)}
       </div>
 
-      <div className="dash-bar"><h2 className="section">ZFS</h2></div>
-      {zfs && !zfs.available && <div className="notice">{zfs.message || 'No ZFS pools on this host.'}</div>}
-      {zfs?.available && zfs.pools.length === 0 && <div className="notice">ZFS is present but no pools are imported.</div>}
-      {zfs?.available && zfs.pools.length > 0 && (
-        <>
-          <div className="cards">{zfs.pools.map((p) => <PoolCard key={p.name} p={p} onChanged={load} />)}</div>
-          <section className="card datasets">
-            <div className="ds-row head"><span>Dataset</span><span className="num">Used</span><span className="num">Refer</span><span className="num">In snaps</span><span className="num">Snaps</span><span className="num">Ratio</span><span>Mount</span></div>
-            {zfs.datasets.map((d) => <DatasetRow key={d.name} d={d} onChanged={load} />)}
-          </section>
-        </>
-      )}
     </div>
   )
 }

web/src/Jobs.tsx

@@ -175,11 +175,11 @@ function TimerDetail({ t, onChanged, onBack }: { t: CronTimer; onChanged: () =>
 }
 
 // ---- page ----
-export default function Cron() {
+export default function Jobs() {
   const [ov, setOv] = useState<CronOverview | null>(null)
   const [err, setErr] = useState('')
   const [q, setQ] = useState('')
-  const [hashSel, setHashSel] = useHashSel('cron') // "job:<id>" or "timer:<unit>", in the URL
+  const [hashSel, setHashSel] = useHashSel('jobs') // "job:<id>" or "timer:<unit>", in the URL
   const sel = /^(job|timer):./.test(hashSel) ? { kind: hashSel.split(':')[0] as 'job' | 'timer', id: hashSel.slice(hashSel.indexOf(':') + 1) } : null
   const setSel = (v: { kind: 'job' | 'timer'; id: string } | null) => setHashSel(v ? `${v.kind}:${v.id}` : '')
   const [editing, setEditing] = useState<string | null>(null)
@@ -206,7 +206,7 @@ export default function Cron() {
   else pane = <div className="svc-empty muted">Select a job or timer.</div>
 
   return (
-    <div className={'cron' + (sel || editing ? ' has-sel' : '')}>
+    <div className={'cron jobs' + (sel || editing ? ' has-sel' : '')}>
       <div className="cron-list">
         <div className="svc-tools">
           <div className="tools-row"><input placeholder="filter jobs and timers" value={q} onChange={(e) => setQ(e.target.value)} /><Btn className="btn" title="reload" onClick={load}>↻</Btn></div>
@@ -218,7 +218,7 @@ export default function Cron() {
         {ov && !ov.logging && <div className="notice" style={{ margin: 8 }}>cron isn’t logging to the journal on this host, so “last run” is unavailable for cron jobs.</div>}
         <div className="cron-rows">
           {!ov && !err && <Loading label="Reading crontabs…" />}
-          {ov && <h3>Cron jobs · {jobs.length}</h3>}
+          {ov && <h3>Scheduled jobs · {jobs.length}</h3>}
           {jobs.map((j) => (
             <div key={j.id} className={'cron-row' + (sel?.kind === 'job' && sel.id === j.id ? ' active' : '') + (j.enabled ? '' : ' off')} onClick={() => { setEditing(null); setSel({ kind: 'job', id: j.id }) }}>
               <span className={'sdot ' + (j.enabled ? 'ok' : '')} />

web/src/Shell.tsx

@@ -8,14 +8,15 @@ import Gallery from './Gallery'
 import Docker from './Docker'
 import Alerts from './Alerts'
 import Services from './Services'
-import Cron from './Cron'
+import Jobs from './Jobs'
 import Updates from './Updates'
 import Disks from './Disks'
+import ZFS from './ZFS'
 import Files from './Files'
 import Top from './Top'
 import Machines from './Machines'
 import Settings from './Settings'
-import Space from './Space'
+import Usage from './Usage'
 import Users from './Users'
 import MachineSwitcher from './MachineSwitcher'
 import { MachineStatus, setMachine } from './api'
@@ -54,10 +55,11 @@ const GROUPS: Group[] = [
   { id: 'terminal', label: 'Terminal', icon: '>_' },
   { id: 'services', label: 'Services', icon: '◈' },
   { id: 'docker', label: 'Docker', icon: DockerIcon },
-  { id: 'cron', label: 'Cron', icon: ClockIcon },
+  { id: 'jobs', label: 'Jobs', icon: ClockIcon },
   { id: 'updates', label: 'Updates', icon: '⇪' },
   { id: 'disks', label: 'Disks', icon: '▤' },
-  { id: 'space', label: 'Space', icon: '▧' },
+  { id: 'zfs', label: 'ZFS', icon: '⛁' },
+  { id: 'usage', label: 'Usage', icon: '▧' },
   { id: 'files', label: 'Files', icon: FolderIcon },
   { id: 'alerts', label: 'Alerts', icon: BellIcon },
   { id: 'machines', label: 'Machines', icon: '⌂' },
@@ -66,16 +68,21 @@ const GROUPS: Group[] = [
   { id: 'settings', label: 'Settings', icon: '⚙' },
 ]
 
-type View = 'terminal' | 'widgets' | 'docker' | 'alerts' | 'services' | 'cron' | 'updates' | 'disks' | 'space' | 'files' | 'procs' | 'machines' | 'users' | 'settings'
-const VIEWS: View[] = ['terminal', 'widgets', 'docker', 'alerts', 'services', 'cron', 'updates', 'disks', 'space', 'files', 'procs', 'machines', 'users', 'settings']
+type View = 'terminal' | 'widgets' | 'docker' | 'alerts' | 'services' | 'jobs' | 'updates' | 'disks' | 'zfs' | 'usage' | 'files' | 'procs' | 'machines' | 'users' | 'settings'
+const VIEWS: View[] = ['terminal', 'widgets', 'docker', 'alerts', 'services', 'jobs', 'updates', 'disks', 'zfs', 'usage', 'files', 'procs', 'machines', 'users', 'settings']
 const HUB_ONLY: View[] = ['machines', 'users', 'settings', 'alerts']
 
 // URL hash is the source of truth for where you are: #/<machine|hub>/<view>. Back and
 // forward work, reload restores the tab, and links can point at a page on a machine.
+// Pages that were renamed, so a link or a bookmark made before it still lands where it meant.
+const RENAMED_VIEWS: Record<string, View> = { space: 'usage', cron: 'jobs', top: 'procs', dashboard: 'procs' }
+
 function parseHash(): { machine: string | null; view: View } | null {
   const m = location.hash.match(/^#\/([a-z0-9-]+)\/([a-z]+)(?:\/.*)?$/) // anything after the page is that page's own selection
-  if (!m || !VIEWS.includes(m[2] as View)) return null
-  return { machine: m[1] === 'hub' ? null : m[1], view: m[2] as View }
+  if (!m) return null
+  const view = VIEWS.includes(m[2] as View) ? (m[2] as View) : RENAMED_VIEWS[m[2]]
+  if (!view) return null
+  return { machine: m[1] === 'hub' ? null : m[1], view }
 }
 
 function fmtUptime(s: number): string {
@@ -262,16 +269,17 @@ export default function Shell({ me: hubMe, onLoggedOut }: { me: Me; onLoggedOut:
         <main className="main" key={machine ?? 'hub'}>
           {view === 'settings' && <Settings me={hubMe} />}
           {view === 'users' && <Users me={hubMe} />}
-          {view === 'space' && <Space key={machine ?? ''} />}
+          {view === 'usage' && <Usage key={machine ?? ''} />}
           {view === 'machines' && <Machines hub={hubMe} onChanged={loadMachines} onOpen={(n) => { switchMachine(n); setView('procs') }} />}
           {view === 'widgets' && <Gallery />}
           {view === 'docker' && <Docker />}
           {view === 'alerts' && <Alerts machines={machines.map((m) => m.name)} titleOf={(n) => titleOf(n === hubMe.host ? null : n, machines, hubMe.host)} />}
           {view === 'procs' && <Top />}
           {view === 'services' && <Services />}
-          {view === 'cron' && <Cron />}
+          {view === 'jobs' && <Jobs />}
           {view === 'updates' && <Updates />}
           {view === 'disks' && <Disks />}
+          {view === 'zfs' && <ZFS />}
           {view === 'files' && <Files onOpenInTerminal={runInTerminal} />}
           {termView && <TermTabs terms={ordered} active={active} creating={creating}
             onSelect={setActive} onNew={create} onRename={rename} onClose={close} onMove={moveTab}
@@ -298,7 +306,7 @@ export default function Shell({ me: hubMe, onLoggedOut }: { me: Me; onLoggedOut:
         <span>{machine ? `${title} · ` : ''}{me.version.startsWith('v') ? me.version : 'v' + me.version}</span>
         <span>up {fmtUptime(me.uptime)}</span>
         <span className="spacer" />
-        <span className="muted">{view === 'widgets' ? 'Widgets' : view === 'docker' ? 'Docker' : view === 'alerts' ? 'Alerts' : view === 'services' ? 'Services' : view === 'cron' ? 'Cron' : view === 'updates' ? 'Updates' : view === 'disks' ? 'Disks' : view === 'space' ? 'Space' : view === 'files' ? 'Files' : view === 'procs' ? 'Processes' : view === 'machines' ? 'Machines' : view === 'users' ? 'Users' : view === 'settings' ? 'Settings' : activeTerm ? activeTerm.name : ''}</span>
+        <span className="muted">{view === 'widgets' ? 'Widgets' : view === 'docker' ? 'Docker' : view === 'alerts' ? 'Alerts' : view === 'services' ? 'Services' : view === 'jobs' ? 'Jobs' : view === 'updates' ? 'Updates' : view === 'disks' ? 'Disks' : view === 'zfs' ? 'ZFS' : view === 'usage' ? 'Usage' : view === 'files' ? 'Files' : view === 'procs' ? 'Processes' : view === 'machines' ? 'Machines' : view === 'users' ? 'Users' : view === 'settings' ? 'Settings' : activeTerm ? activeTerm.name : ''}</span>
       </footer>
     </div>
   )

web/src/Top.tsx

@@ -250,6 +250,20 @@ export default function Top() {
 
   // the process table, and the CPU model, come from the same place the Processes page reads
   const [pt, setPt] = useState<ProcTable | null>(null)
+  const [pickedIf, setPickedIf] = useState<string | null>(null) // which NIC the net box draws
+  // Which pool each drive belongs to, asked once: a drive in a ZFS pool has no filesystem of
+  // its own, and "nothing is on it" would be a lie about eight drives holding a NAS.
+  const [pools, setPools] = useState<Record<string, string>>({})
+  useEffect(() => {
+    let live = true
+    api.storage().then((r) => {
+      if (!live) return
+      const m: Record<string, string> = {}
+      for (const d of r.devices) for (const part of d.parts) if (part.fstype === 'zfs_member' && part.label) m[d.name] = part.label
+      setPools(m)
+    }).catch(() => { /* the rows simply say less */ })
+    return () => { live = false }
+  }, [])
   const [err, setErr] = useState('')
   useEffect(() => {
     let stop = false
@@ -319,8 +333,12 @@ export default function Top() {
   const free = (mem as { free?: number }).free ?? Math.max(0, mem.total - mem.used - cached)
   const swap = s?.swap ?? pt?.swap
   const net = (s?.net ?? pt?.net ?? []).filter((n) => n.up && n.iface !== 'lo')
-  const iface = net[0]
-  const fs = s?.fs ?? []
+  // the one that has actually carried traffic, not whichever the kernel listed first — wg0
+  // and a dormant wlan should not push the real NIC out of the way. Tapping a name switches.
+  const busiest = net.length ? net.reduce((a, b) => (b.rx_total + b.tx_total > a.rx_total + a.tx_total ? b : a)) : undefined
+  const iface = net.find((n) => n.iface === pickedIf) ?? busiest
+  // the disks box is this machine's own storage: a CIFS or NFS share is somebody else's disk
+  const fs = (s?.fs ?? []).filter((f) => !f.remote)
   const pct = (a: number, b: number) => (b > 0 ? (a / b) * 100 : 0)
   // the top of a graph's scale: the peak of what it is drawing — the window, not everything kept
   const peak = (id: string) => Math.max(1, ...(curves.get(id) ?? []).slice(-cap))
@@ -378,18 +396,26 @@ export default function Top() {
 
       <Box n={3} name="disks" className="top-disks" right="io">
         <div className="t-disks">
-          {swap && swap.total > 0 && <Disk name="swap" size={swap.total} used={swap.used} />}
-          {fs.map((f) => {
-            // which drive is behind a mount isn't in the sample, so only the root filesystem
-            // gets an IO line, against the machine's largest drive — which is the one it is on
-            const d = f.mount === '/' ? [...(s?.disks ?? [])].sort((a, b) => b.size - a.size)[0] : undefined
-            return <Disk key={f.mount} name={f.mount === '/' ? 'root' : f.mount.split('/').filter(Boolean).pop() ?? f.mount} size={f.size} used={f.used} io={d ? d.util_pct : undefined} />
+          {(s?.disks ?? []).map((d) => {
+            // what is on this drive: the filesystems the sampler could attribute to it. A ZFS
+            // pool or an md array spans several drives, so nothing is attributed and the row
+            // shows what is true of the hardware — how busy it is, and how hot.
+            const on = fs.filter((f) => f.disk === d.name)
+            const used = on.reduce((a, f) => a + f.used, 0)
+            return <Disk key={d.name} name={d.name} note={d.model} size={d.size} used={on.length ? used : undefined} io={d.util_pct} temp={d.temp} mounts={on.map((f) => f.mount)} pool={pools[d.name]} />
           })}
-          {fs.length === 0 && <div className="t-dim">no filesystems reported</div>}
+          {(s?.disks ?? []).length === 0 && <div className="t-dim">no drives reported</div>}
         </div>
       </Box>
 
-      <Box n={4} name="net" className="top-net" right={iface ? <span className="t-if">{iface.iface}</span> : undefined}>
+      <Box n={4} name="net" className="top-net" right={net.length ? (
+        <span className="t-ifs">
+          {net.map((n) => (
+            <button key={n.iface} className={'t-if' + (iface && n.iface === iface.iface ? ' on' : '')}
+              title={`${n.iface} — ${bytes(n.rx_total)} in, ${bytes(n.tx_total)} out`} onClick={() => setPickedIf(n.iface)}>{n.iface}</button>
+          ))}
+        </span>
+      ) : undefined}>
         {iface ? (
           <div className="t-net">
             <div className="t-net-graphs">
@@ -470,14 +496,29 @@ const Rows = memo(function Rows({ procs, sel, onSel, curves, empty }: { procs: P
   )
 })
 
-function Disk({ name, size, used, io }: { name: string; size: number; used: number; io?: number }) {
-  const upct = size > 0 ? (used / size) * 100 : 0
+// One physical drive. `used` is the bytes of the filesystems on it, left out when none can
+// be attributed to it — a pool member's share of a pool is not a number worth inventing.
+function Disk({ name, note, size, used, io, temp, mounts, pool }: { name: string; note?: string; size: number; used?: number; io?: number; temp?: number; mounts?: string[]; pool?: string }) {
+  const upct = used !== undefined && size > 0 ? (used / size) * 100 : 0
   return (
     <div className="t-disk">
-      <div className="t-row"><b>{name}</b><span className="spacer" />{bytes(size)}</div>
+      <div className="t-row">
+        <b>{name}</b>
+        {note && <span className="t-dim t-model" title={note}>{note}</span>}
+        <span className="spacer" />
+        {temp !== undefined && temp > 0 && <span className="t-temp">{Math.round(temp)}°C</span>}
+        {bytes(size)}
+      </div>
       {io !== undefined && <div className="t-row t-sub"><span>IO%</span><Meter pct={io} grad="io" /></div>}
-      <div className="t-row t-sub"><span>Used:</span><span className="t-pct">{Math.round(upct)}%</span><Meter pct={upct} grad="used" /><span className="t-amt">{bytes(used, 1)}</span></div>
-      <div className="t-row t-sub"><span>Free:</span><span className="t-pct">{Math.round(100 - upct)}%</span><Meter pct={100 - upct} grad="free" /><span className="t-amt">{bytes(Math.max(0, size - used), 1)}</span></div>
+      {used !== undefined ? (
+        <>
+          <div className="t-row t-sub"><span>Used:</span><span className="t-pct">{Math.round(upct)}%</span><Meter pct={upct} grad="used" /><span className="t-amt">{bytes(used, 1)}</span></div>
+          <div className="t-row t-sub"><span>Free:</span><span className="t-pct">{Math.round(100 - upct)}%</span><Meter pct={100 - upct} grad="free" /><span className="t-amt">{bytes(Math.max(0, size - used), 1)}</span></div>
+          {mounts && mounts.length > 0 && <div className="t-row t-sub t-dim t-mounts" title={mounts.join('  ')}>{mounts.join(' ')}</div>}
+        </>
+      ) : (
+        <div className="t-row t-sub t-dim">{pool ? `member of ZFS pool ${pool}` : 'nothing mounted from it'}</div>
+      )}
     </div>
   )
 }

web/src/Usage.tsx

@@ -1,4 +1,5 @@
-// Space: what is using a disk, WizTree-style. Pick a disk, scan it (a parallel walk of every
+// Usage: what is using a disk, WizTree-style. (The tab was called Space until 2026-09-24;
+// the Go package and the /api/space endpoints behind it still carry the old name.) Pick a disk, scan it (a parallel walk of every
 // filesystem the disk backs, as root when the host allows), then read the result two ways:
 // a tree of folders largest-first, and a treemap of whatever folder is selected, where every
 // file is a tile sized by what it takes on disk and coloured by what kind of thing it is.
@@ -45,10 +46,10 @@ const ago = (iso?: string) => {
 const fmtDur = (a: string, b?: string) => { const ms = (b ? new Date(b).getTime() : Date.now()) - new Date(a).getTime(); return ms < 1000 ? `${ms} ms` : ms < 60000 ? `${(ms / 1000).toFixed(1)} s` : `${Math.floor(ms / 60000)} min ${Math.round((ms % 60000) / 1000)} s` }
 const parentOf = (p: string) => (p === '/' ? '/' : p.slice(0, p.lastIndexOf('/')) || '/')
 
-export default function Space() {
+export default function Usage() {
   const [targets, setTargets] = useState<SpaceTarget[] | null>(null)
   const [err, setErr] = useState('')
-  const [sel, setSel] = useHashSel('space')
+  const [sel, setSel] = useHashSel('usage')
   const [tab, setTab] = useState<'tree' | 'files'>('tree')
   const rate = useRefreshMs()
 

web/src/ZFS.tsx

@@ -0,0 +1,303 @@
+// ZFS: pools, datasets, snapshots, and a schedule for taking and expiring them.
+//
+// Split out of the Disks tab on 2026-09-24. Disks is the hardware; this is the filesystem
+// on top of it, which has enough of its own to say.
+//
+// On the schedule: `grid` has run zfSnap from root cron since before Ham Lab existed, and it
+// works. So this reads and writes the same snapshot names — `2026-09-24_02.30.01--6w`, with
+// the retention in the name — rather than inventing a second convention for the two tools to
+// disagree over. An existing cron job is detected and shown, so the page tells the truth
+// about the machine whether Ham Lab or something else is doing the work.
+import { FormEvent, useCallback, useEffect, useState } from 'react'
+import { api, ZFSExternal, ZFSInfo, ZFSOverview, ZFSPolicy, ZFSSnapshot } from './api'
+import { fmtBytes } from './fmt'
+import { useRefreshMs } from './prefs'
+import { askText, askYes, Btn, Loading, Meter, Spinner, toast, useEscape } from './ui'
+
+const ago = (t?: string | number) => {
+  if (!t) return 'never'
+  const s = Math.max(0, (Date.now() - new Date(t).getTime()) / 1000)
+  return s < 60 ? 'just now' : s < 3600 ? `${Math.floor(s / 60)} min ago` : s < 86400 ? `${Math.floor(s / 3600)} h ago` : `${Math.floor(s / 86400)} d ago`
+}
+const soon = (t?: string) => {
+  if (!t) return '—'
+  const s = (new Date(t).getTime() - Date.now()) / 1000
+  return s < 60 ? 'any moment' : s < 3600 ? `in ${Math.round(s / 60)} min` : s < 86400 ? `in ${Math.round(s / 3600)} h` : `in ${Math.round(s / 86400)} d`
+}
+const WEEKDAYS = ['Sunday', 'Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday']
+const describe = (p: ZFSPolicy) => {
+  const when = p.every === 'hourly' ? `every hour at :${(p.at.split(':')[1] ?? '00').padStart(2, '0')}`
+    : p.every === 'daily' ? `every day at ${p.at}`
+      : p.every === 'weekly' ? `every ${WEEKDAYS[p.weekday] ?? 'Sunday'} at ${p.at}`
+        : `on day ${p.day} of the month at ${p.at}`
+  return `${when} · keep ${p.keep_for}${p.recursive ? ' · recursive' : ''}`
+}
+
+// ---- pools and datasets (moved from the Disks tab) ----
+function PoolCard({ p, onChanged }: { p: ZFSInfo['pools'][number]; onChanged: () => void }) {
+  const scrubbing = /scrub in progress/i.test(p.scan ?? '')
+  const paused = /scrub paused/i.test(p.scan ?? '')
+  const [cfg, setCfg] = useState(false)
+  const act = (a: 'start' | 'pause' | 'stop') => async () => {
+    try { await api.zfsScrub(p.name, a); toast(`scrub ${a}: ok`); onChanged() } catch (e) { toast(e instanceof Error ? e.message : 'failed', 'err') }
+  }
+  return (
+    <section className="card">
+      <div className="sub-head">
+        <span className={'dot ' + (p.health === 'ONLINE' ? 'ok' : p.health === 'DEGRADED' ? 'warn' : 'bad')} />
+        <span className="dname">{p.name}</span>
+        <span className="badge">{p.health}</span>
+        <span className="spacer" />
+        <span className="num">{fmtBytes(p.alloc)} / {fmtBytes(p.size)} · {p.cap}%</span>
+      </div>
+      <Meter frac={p.cap / 100} cls={p.cap >= 90 ? 'bad' : p.cap >= 80 ? 'warn' : ''} />
+      <div className="props" style={{ marginTop: 8 }}>
+        <div><span className="k">Free</span><span>{fmtBytes(p.free)} · fragmentation {p.frag}% · dedup {p.dedup}</span></div>
+        {p.scan && <div><span className="k">Scan</span><span style={{ whiteSpace: 'normal' }}>{p.scan}</span></div>}
+        {p.errors && <div><span className="k">Errors</span><span className={p.errors.startsWith('No known') ? '' : 'warn-text'}>{p.errors}</span></div>}
+      </div>
+      <div className="svc-actions">
+        {!scrubbing && <Btn className="btn" confirm={`Start a scrub of ${p.name}? It reads the whole pool and can take many hours.`} onClick={act('start')}>{paused ? 'Resume scrub' : 'Scrub'}</Btn>}
+        {scrubbing && <Btn className="btn" onClick={act('pause')}>Pause scrub</Btn>}
+        {(scrubbing || paused) && <Btn className="btn" confirm="Stop the scrub?" onClick={act('stop')}>Stop scrub</Btn>}
+        <button className="btn" onClick={() => setCfg(!cfg)}>{cfg ? 'Hide vdevs' : 'Vdevs'}</button>
+      </div>
+      {cfg && <pre className="unit-file">{p.config}</pre>}
+    </section>
+  )
+}
+
+function DatasetRow({ d, onChanged }: { d: ZFSInfo['datasets'][number]; onChanged: () => void }) {
+  const [snaps, setSnaps] = useState<ZFSSnapshot[] | null>(null)
+  const [open, setOpen] = useState(false)
+  async function toggle() {
+    setOpen(!open)
+    if (!open && !snaps) { try { setSnaps(await api.zfsSnapshots(d.name)) } catch (e) { toast(e instanceof Error ? e.message : 'failed', 'err'); setSnaps([]) } }
+  }
+  async function snapshot() {
+    const def = 'hamlab-' + new Date().toISOString().slice(0, 16).replace(/[-:T]/g, '').replace(/(\d{8})(\d{4})/, '$1-$2')
+    const name = await askText(`Snapshot name for ${d.name}@`, def)
+    if (!name) return
+    try { await api.zfsSnapshot(d.name, name.trim()); toast(`${d.name}@${name.trim()} created`); setSnaps(null); onChanged() }
+    catch (e) { toast(e instanceof Error ? e.message : 'failed', 'err') }
+  }
+  const depth = d.name.split('/').length - 1
+  return (
+    <>
+      <div className="ds-row" style={{ paddingLeft: 12 + depth * 16 }}>
+        <span className="ds-name" onClick={toggle}><span className="chev">{open ? '▾' : '▸'}</span>{d.name.split('/').pop()}{d.type === 'volume' && <span className="badge">zvol</span>}</span>
+        <span className="num">{fmtBytes(d.used)}</span>
+        <span className="num muted">{fmtBytes(d.refer)}</span>
+        <span className="num muted">{d.used_by_snapshots ? fmtBytes(d.used_by_snapshots) : '—'}</span>
+        <span className="num muted">{d.snapshots}</span>
+        <span className="num muted">{d.compressratio}</span>
+        <span className="ds-mount muted">{d.mount}</span>
+      </div>
+      {open && (
+        <div className="ds-snaps">
+          <div className="svc-actions"><Btn className="btn" onClick={snapshot}>Snapshot now</Btn><span className="muted">avail {fmtBytes(d.avail)}</span></div>
+          {snaps === null ? <div className="muted"><Spinner /> listing…</div> : snaps.length === 0 ? <div className="muted">No snapshots.</div> : (
+            <div className="snap-list">{snaps.slice().reverse().map((s) => <div key={s.name} className="snap"><span className="mono">{s.name.split('@')[1]}</span><span className="num muted">{new Date(s.created).toLocaleString()} · {fmtBytes(s.used)}</span></div>)}</div>
+          )}
+        </div>
+      )}
+    </>
+  )
+}
+
+// ---- schedules ----
+
+function ExternalNotice({ x, mine }: { x: ExternalJob; mine: number }) {
+  return (
+    <div className={'notice' + (mine > 0 ? ' attn' : '')} style={{ marginBottom: 8 }}>
+      <b>{x.tool}</b> is already taking snapshots on this machine, from cron as <b>{x.user}</b>:
+      <div className="mono small" style={{ margin: '4px 0', wordBreak: 'break-all' }}>{x.schedule} &nbsp; {x.command}</div>
+      <span className="muted">in {x.source}{x.last ? ` · last ran ${ago(x.last)}` : ''}</span>
+      {mine > 0
+        ? <div className="warn" style={{ marginTop: 6 }}>A Ham Lab schedule is running as well. Both use the same names and both only remove snapshots that have passed the expiry written into them, so they will not fight — but they will take twice as many. Keep one.</div>
+        : <div className="muted small" style={{ marginTop: 6 }}>Ham Lab reads the snapshots it makes and shows when each expires. Add a schedule here only if you mean to replace it; edit this one on the Jobs tab.</div>}
+    </div>
+  )
+}
+type ExternalJob = ZFSExternal
+
+function ScheduleCard({ p, next, onChanged, onEdit }: { p: ZFSPolicy; next?: string; onChanged: () => void; onEdit: () => void }) {
+  const [expired, setExpired] = useState<ZFSSnapshot[] | null>(null)
+  const [busy, setBusy] = useState('')
+  const preview = async () => {
+    setBusy('preview')
+    try { setExpired((await api.zfsExpired(p.id)).expired) } catch (e) { toast(e instanceof Error ? e.message : 'failed', 'err') } finally { setBusy('') }
+  }
+  const run = async () => {
+    const n = expired?.length
+    const warn = n ? ` It will also destroy ${n} expired snapshot${n === 1 ? '' : 's'}.` : ''
+    if (!await askYes(`Take a snapshot of ${p.dataset} now?${warn}`, 'Run now')) return
+    setBusy('run')
+    try { const r = await api.runZfsSchedule(p.id); toast(`${r.taken}${r.pruned.length ? ` · ${r.pruned.length} expired removed` : ''}`); setExpired(null); onChanged() }
+    catch (e) { toast(e instanceof Error ? e.message : 'failed', 'err') } finally { setBusy('') }
+  }
+  const remove = async () => {
+    if (!await askYes(`Remove the schedule "${p.name}"? The snapshots it already took are left exactly as they are.`, 'Remove')) return
+    try { await api.deleteZfsSchedule(p.id); toast('schedule removed'); onChanged() } catch (e) { toast(e instanceof Error ? e.message : 'failed', 'err') }
+  }
+  const toggle = async () => {
+    try { await api.saveZfsSchedule({ ...p, enabled: !p.enabled }); onChanged() } catch (e) { toast(e instanceof Error ? e.message : 'failed', 'err') }
+  }
+  return (
+    <section className="card">
+      <div className="sub-head">
+        <span className={'dot ' + (p.last_error ? 'bad' : p.enabled ? 'ok' : '')} />
+        <span className="dname">{p.name || p.dataset}</span>
+        {!p.enabled && <span className="badge">paused</span>}
+        <span className="spacer" />
+        <span className="muted small">{p.enabled ? soon(next) : 'not scheduled'}</span>
+      </div>
+      <div className="props" style={{ marginTop: 6 }}>
+        <div><span className="k">Dataset</span><span className="mono">{p.dataset}</span></div>
+        <div><span className="k">When</span><span>{describe(p)}</span></div>
+        <div><span className="k">Last run</span><span>{ago(p.last_run)}{p.pruned ? ` · ${p.pruned} expired removed` : ''}</span></div>
+        {p.last_taken && <div><span className="k">Last snapshot</span><span className="mono small">{p.last_taken.split('@')[1]}</span></div>}
+        {p.keep_min > 0 && <div><span className="k">Floor</span><span>always keep the newest {p.keep_min}</span></div>}
+      </div>
+      {p.last_error && <div className="error" style={{ marginTop: 8 }}>{p.last_error}</div>}
+      {expired && (
+        <div className="notice" style={{ marginTop: 8 }}>
+          {expired.length === 0 ? 'Nothing has expired — a run now would only take a snapshot.' : (
+            <>
+              <b>{expired.length}</b> snapshot{expired.length === 1 ? '' : 's'} would be destroyed by a run now:
+              <div className="snap-list" style={{ marginTop: 6, maxHeight: 180, overflow: 'auto' }}>
+                {expired.map((s) => <div key={s.name} className="snap"><span className="mono">{s.name.split('@')[1]}</span><span className="num muted">{new Date(s.created).toLocaleDateString()} · {fmtBytes(s.used)}</span></div>)}
+              </div>
+            </>
+          )}
+        </div>
+      )}
+      <div className="svc-actions">
+        <Btn className="btn" busy={busy === 'preview'} onClick={preview}>What would it delete?</Btn>
+        <Btn className="btn on" busy={busy === 'run'} onClick={run}>Run now</Btn>
+        <button className="btn" onClick={onEdit}>Edit</button>
+        <Btn className="btn" onClick={toggle}>{p.enabled ? 'Pause' : 'Resume'}</Btn>
+        <Btn className="btn danger" onClick={remove}>Remove</Btn>
+      </div>
+    </section>
+  )
+}
+
+const BLANK: Partial<ZFSPolicy> = { name: '', dataset: '', recursive: true, every: 'daily', at: '02:30', weekday: 0, day: 1, keep_for: '6w', keep_min: 1, enabled: true }
+
+function ScheduleDialog({ p, datasets, onClose, onSaved }: { p: Partial<ZFSPolicy>; datasets: string[]; onClose: () => void; onSaved: () => void }) {
+  const [f, setF] = useState<Partial<ZFSPolicy>>({ ...BLANK, ...p })
+  const [err, setErr] = useState('')
+  useEscape(onClose)
+  const set = (k: keyof ZFSPolicy, v: unknown) => setF((x) => ({ ...x, [k]: v }))
+  const save = async (e: FormEvent) => {
+    e.preventDefault(); setErr('')
+    try { await api.saveZfsSchedule({ ...f, name: (f.name || '').trim() || f.dataset }); onSaved() }
+    catch (e) { setErr(e instanceof Error ? e.message : 'failed') }
+  }
+  return (
+    <div className="modal-back" onClick={onClose}>
+      <form className="modal" onClick={(e) => e.stopPropagation()} onSubmit={save}>
+        <h3>{f.id ? 'Edit schedule' : 'New snapshot schedule'}</h3>
+        <label className="muted">Dataset
+          <select value={f.dataset} onChange={(e) => set('dataset', e.target.value)} required>
+            <option value="">choose…</option>
+            {datasets.map((d) => <option key={d} value={d}>{d}</option>)}
+          </select>
+        </label>
+        <label className="muted">Name — what this schedule is for
+          <input value={f.name} onChange={(e) => set('name', e.target.value)} placeholder={f.dataset || 'nightly'} maxLength={64} />
+        </label>
+        <label className="muted">How often
+          <span className="chips">
+            {(['hourly', 'daily', 'weekly', 'monthly'] as const).map((k) => (
+              <button type="button" key={k} className={'chip' + (f.every === k ? ' on' : '')} onClick={() => set('every', k)}>{k}</button>
+            ))}
+          </span>
+        </label>
+        <label className="muted">At
+          <input type="time" value={f.at} onChange={(e) => set('at', e.target.value)} />
+        </label>
+        {f.every === 'weekly' && (
+          <label className="muted">On
+            <select value={f.weekday} onChange={(e) => set('weekday', Number(e.target.value))}>
+              {WEEKDAYS.map((d, i) => <option key={d} value={i}>{d}</option>)}
+            </select>
+          </label>
+        )}
+        {f.every === 'monthly' && (
+          <label className="muted">Day of the month — 1 to 28, so every month has one
+            <input type="number" min={1} max={28} value={f.day} onChange={(e) => set('day', Number(e.target.value))} />
+          </label>
+        )}
+        <label className="muted">Keep for — written into each snapshot's name, as zfSnap does it: 6w, 30d, 12h
+          <input value={f.keep_for} onChange={(e) => set('keep_for', e.target.value)} placeholder="6w" spellCheck={false} required />
+        </label>
+        <label className="muted">Always keep the newest — a floor, whatever their age
+          <input type="number" min={0} max={99} value={f.keep_min} onChange={(e) => set('keep_min', Number(e.target.value))} />
+        </label>
+        <label className="muted" style={{ flexDirection: 'row', alignItems: 'center', gap: 8 }}>
+          <input type="checkbox" checked={!!f.recursive} onChange={(e) => set('recursive', e.target.checked)} style={{ width: 'auto' }} />
+          Recursive — one atomic snapshot of this dataset and everything under it
+        </label>
+        <label className="muted" style={{ flexDirection: 'row', alignItems: 'center', gap: 8 }}>
+          <input type="checkbox" checked={!!f.enabled} onChange={(e) => set('enabled', e.target.checked)} style={{ width: 'auto' }} />
+          Enabled
+        </label>
+        {err && <div className="error">{err}</div>}
+        <div className="svc-actions">
+          <button type="submit" className="btn on" disabled={!f.dataset || !f.keep_for}>Save</button>
+          <span className="spacer" />
+          <button type="button" className="btn" onClick={onClose}>Cancel</button>
+        </div>
+      </form>
+    </div>
+  )
+}
+
+// ---- page ----
+
+export default function ZFS() {
+  const [ov, setOv] = useState<ZFSOverview | null>(null)
+  const [err, setErr] = useState('')
+  const [editing, setEditing] = useState<Partial<ZFSPolicy> | null>(null)
+  const rate = useRefreshMs()
+
+  const load = useCallback(async () => {
+    try { setOv(await api.zfsOverview()); setErr('') } catch (e) { setErr(e instanceof Error ? e.message : 'failed') }
+  }, [])
+  useEffect(() => { load() }, [load])
+  useEffect(() => { const t = setInterval(load, Math.max(5000, rate * 10)); return () => clearInterval(t) }, [load, rate])
+
+  if (err && !ov) return <div className="dash"><div className="error">{err}</div></div>
+  if (!ov) return <div className="dash"><Loading label="Reading ZFS…" /></div>
+  const zfs: ZFSInfo = ov.zfs
+  const datasets = zfs.datasets.filter((d) => d.type !== 'volume').map((d) => d.name)
+  const mine = ov.policies.filter((x) => x.policy.enabled).length
+
+  if (!zfs.available) return <div className="dash"><div className="notice">{zfs.message || 'No ZFS on this host.'}</div></div>
+
+  return (
+    <div className="dash">
+      <div className="dash-bar"><h2 className="section">Pools</h2></div>
+      {zfs.pools.length === 0 && <div className="notice">ZFS is present but no pools are imported.</div>}
+      <div className="cards">{zfs.pools.map((p) => <PoolCard key={p.name} p={p} onChanged={load} />)}</div>
+
+      <div className="dash-bar" style={{ marginTop: 12 }}><h2 className="section">Snapshot schedules</h2><span className="spacer" />
+        <Btn className="btn on" onClick={() => setEditing({ ...BLANK, dataset: zfs.pools[0]?.name ?? '' })}>+ New schedule</Btn>
+      </div>
+      {ov.external && <ExternalNotice x={ov.external} mine={mine} />}
+      {ov.policies.length === 0 && !ov.external && <div className="notice">Nothing is taking snapshots on a schedule. Snapshots are written the way zfSnap writes them, with the retention in the name, so anything already here is understood.</div>}
+      <div className="cards">{ov.policies.map(({ policy, next }) => (
+        <ScheduleCard key={policy.id} p={policy} next={next} onChanged={load} onEdit={() => setEditing(policy)} />
+      ))}</div>
+
+      <div className="dash-bar" style={{ marginTop: 12 }}><h2 className="section">Datasets</h2><span className="spacer" /><span className="muted small">used · referenced · in snapshots · count · compression · mount</span></div>
+      <section className="card ds-table">
+        {zfs.datasets.map((d) => <DatasetRow key={d.name} d={d} onChanged={load} />)}
+      </section>
+
+      {editing && <ScheduleDialog p={editing} datasets={datasets.length ? datasets : zfs.pools.map((p) => p.name)} onClose={() => setEditing(null)} onSaved={() => { setEditing(null); load() }} />}
+    </div>
+  )
+}

web/src/api.ts

@@ -70,7 +70,7 @@ export interface Temp { chip: string; label: string; c: number; max?: number; cr
 export interface Fan { chip: string; label: string; rpm: number }
 export interface NetIf { iface: string; up: boolean; rx_bps: number; tx_bps: number; rx_total: number; tx_total: number }
 export interface Disk { name: string; model?: string; size: number; read_bps: number; write_bps: number; util_pct: number; temp?: number }
-export interface FS { mount: string; type: string; size: number; used: number }
+export interface FS { mount: string; type: string; size: number; used: number; remote?: boolean; disk?: string }
 export interface UPS { driver: string; model: string; state: string; source: string; on_battery: boolean; in_v: number; out_v: number; battery_pct: number; runtime_min: number; load_w: number; load_pct: number; last_event?: string }
 export interface Proc { pid: number; ppid: number; name: string; cmd?: string; user: string; cpu: number; cpu_time: number; rss: number; threads: number; state: string; nice: number; started: number }
 export interface MemInfo { total: number; used: number; avail: number; free?: number; cached?: number; buffers?: number }
@@ -133,6 +133,10 @@ export interface SpaceNode { name: string; dir: boolean; size: number; apparent:
 export interface SpaceTree extends SpaceNode { path: string; children?: SpaceTree[]; more_n?: number; more_size?: number; total: number }
 export interface SpaceFile { path: string; size: number; apparent: number; mtime: number }
 
+export interface ZFSPolicy { id: string; name: string; dataset: string; recursive: boolean; every: 'hourly' | 'daily' | 'weekly' | 'monthly'; at: string; weekday: number; day: number; keep_for: string; keep_min: number; prefix?: string; enabled: boolean; last_run?: string; last_error?: string; last_taken?: string; pruned?: number }
+export interface ZFSExternal { tool: string; schedule: string; command: string; user: string; source: string; id: string; next?: number; last?: number }
+export interface ZFSOverview { zfs: ZFSInfo; policies: { policy: ZFSPolicy; next?: string }[]; external?: ZFSExternal | null }
+
 export interface FileEntry { name: string; type: 'dir' | 'file' | 'link' | 'other'; size: number; mode: string; perm: string; mtime: number; user: string; group: string; target?: string; broken?: boolean }
 export interface FileInfo extends FileEntry { path: string; text: boolean }
 
@@ -179,6 +183,12 @@ export const api = {
   storage: () => req<{ devices: StorageDevice[]; zfs: ZFSInfo; smartctl: boolean }>('GET', '/api/storage'),
   smart: (dev: string, force = false) => req<SmartInfo>('GET', `/api/storage/smart/${dev}${force ? '?force=1' : ''}`),
   smartTest: (dev: string, kind: 'short' | 'long') => req<void>('POST', `/api/storage/smart/${dev}/test/${kind}`),
+  zfsOverview: () => req<ZFSOverview>('GET', '/api/zfs'),
+  saveZfsSchedule: (p: Partial<ZFSPolicy>) => req<ZFSPolicy>('PUT', '/api/zfs/schedules', p),
+  deleteZfsSchedule: (id: string) => req<void>('DELETE', `/api/zfs/schedules/${encodeURIComponent(id)}`),
+  zfsExpired: (id: string) => req<{ expired: ZFSSnapshot[] }>('GET', `/api/zfs/schedules/${encodeURIComponent(id)}/expired`),
+  runZfsSchedule: (id: string) => req<{ taken: string; pruned: string[] }>('POST', `/api/zfs/schedules/${encodeURIComponent(id)}/run`),
+  deleteZfsSnapshot: (name: string, recursive: boolean) => req<void>('POST', '/api/zfs/snapshots/delete', { name, confirm: name, recursive }),
   zfsSnapshots: (dataset: string) => req<ZFSSnapshot[]>('GET', `/api/storage/zfs/snapshots?dataset=${encodeURIComponent(dataset)}`),
   zfsScrub: (pool: string, action: 'start' | 'pause' | 'stop') => req<void>('POST', `/api/storage/zfs/scrub/${encodeURIComponent(pool)}/${action}`),
   zfsSnapshot: (dataset: string, name: string) => req<void>('POST', '/api/storage/zfs/snapshot', { dataset, name }),

web/src/railorder.ts

@@ -5,8 +5,25 @@ import { useEffect, useState } from 'react'
 
 const KEY = 'hamlab.rail'
 
+// Pages that were renamed, so an order saved before it still puts the page where it was put:
+// Top became Processes, Space became Usage, Cron became Jobs. A page that was removed
+// outright (Dashboard) is not here — orderBy drops ids that match no page.
+const RENAMED: Record<string, string> = { top: 'procs', space: 'usage', cron: 'jobs' }
+
 export function getRailOrder(): string[] {
-  try { const v = JSON.parse(localStorage.getItem(KEY) ?? '[]'); return Array.isArray(v) ? v.filter((x) => typeof x === 'string') : [] } catch { return [] }
+  let raw: unknown
+  try { raw = JSON.parse(localStorage.getItem(KEY) ?? '[]') } catch { return [] }
+  if (!Array.isArray(raw)) return []
+  const seen = new Set<string>()
+  const out: string[] = []
+  for (const x of raw) {
+    if (typeof x !== 'string') continue
+    const id = RENAMED[x] ?? x
+    if (seen.has(id)) continue // a merged page keeps the earlier of the two slots
+    seen.add(id)
+    out.push(id)
+  }
+  return out
 }
 
 export function setRailOrder(ids: string[], save = true) {

web/src/sampleAdapter.ts

@@ -51,7 +51,7 @@ export function sampleOf(v: Values, cat: Catalog): Sample {
     fans: hw('fan.').map(({ id, s }) => ({ chip: s.labels!.chip, label: s.labels!.label, rpm: num(v, id) })),
     net: [...groups(v, cat, 'net.', 'iface')].map(([iface, p]) => ({ iface, up: v[p + '.up'] === true, rx_bps: num(v, p + '.rx'), tx_bps: num(v, p + '.tx'), rx_total: num(v, p + '.rx_total'), tx_total: num(v, p + '.tx_total') })),
     disks: [...groups(v, cat, 'disk.', 'device')].map(([name, p]) => ({ name, model: cat.get(p + '.size')?.labels?.model || undefined, size: num(v, p + '.size'), read_bps: num(v, p + '.read'), write_bps: num(v, p + '.write'), util_pct: num(v, p + '.util'), temp: num(v, p + '.temp') || undefined })),
-    fs: [...groups(v, cat, 'fs.', 'mount')].map(([mount, p]) => ({ mount, type: cat.get(p + '.size')?.labels?.fstype ?? '', size: num(v, p + '.size'), used: num(v, p + '.used') })),
+    fs: [...groups(v, cat, 'fs.', 'mount')].map(([mount, p]) => ({ mount, type: cat.get(p + '.size')?.labels?.fstype ?? '', size: num(v, p + '.size'), used: num(v, p + '.used'), remote: cat.get(p + '.size')?.labels?.remote === '1', disk: cat.get(p + '.size')?.labels?.disk })),
     ups: v['ups.battery'] === undefined ? null : {
       driver: cat.get('ups.last_event')?.labels?.driver ?? '', model: cat.get('ups.battery')?.labels?.model ?? '', state: str(v, 'ups.state'), source: str(v, 'ups.source'),
       on_battery: v['ups.on_battery'] === true, in_v: num(v, 'ups.in_v'), out_v: num(v, 'ups.out_v'), battery_pct: num(v, 'ups.battery'), runtime_min: num(v, 'ups.runtime'),

web/src/styles.css

@@ -720,3 +720,16 @@ pre.diff .add { color: var(--ok); background: color-mix(in srgb, var(--ok) 12%,
   .space-row.file { grid-template-columns: minmax(120px, 1fr) 72px 80px; }
   .space-split { padding: 8px; } .space-tree { flex: 1 1 45%; } .space-map { flex: 1 1 55%; }
 }
+
+/* the Processes tab's drive rows and NIC switcher */
+.t-disk .t-model { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; max-width: 14ch; margin-left: 6px; }
+.t-disk .t-temp { margin-right: 8px; color: var(--t-blue, var(--accent2)); }
+.t-disk .t-mounts { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.t-ifs { display: inline-flex; gap: 4px; flex-wrap: wrap; justify-content: flex-end; }
+.t-ifs .t-if { padding: 0 4px; border-radius: 3px; color: var(--muted); }
+.t-ifs .t-if:hover { color: var(--fg); background: var(--bg3); }
+.t-ifs .t-if.on { color: var(--fg); box-shadow: inset 0 -2px 0 var(--accent); }
+
+/* ZFS: the schedule dialog's controls match the rest of the modal forms */
+.modal select, .modal input[type=time], .modal input[type=number] { padding: 9px 10px; background: var(--bg); border: 1px solid var(--border); border-radius: 6px; color: var(--fg); font-size: 16px; }
+.modal .chips { margin-top: 2px; }

web/src/ui.tsx

@@ -14,6 +14,12 @@ export function CloseBtn({ onClick, title = 'Close' }: { onClick: () => void; ti
   )
 }
 
+// A filled bar. Red past 95%, amber past 85%, unless the caller says otherwise.
+export function Meter({ frac, cls }: { frac: number; cls?: string }) {
+  const c = cls ?? (frac >= 0.95 ? 'bad' : frac >= 0.85 ? 'warn' : '')
+  return <div className="meter"><div className={'fill ' + c} style={{ width: `${Math.min(100, Math.max(0, frac * 100))}%` }} /></div>
+}
+
 export function Loading({ label = 'Loading…' }: { label?: string }) {
   return <div className="center muted loading"><Spinner size={22} /><div>{label}</div></div>
 }