The datasets table is a snapshot explorer, and snapshots can be deleted

Renamed Datasets to Snapshots and turned the columns around to match: how many each
dataset has and what they cost come first, the dataset's own size after. Opening one lists
its snapshots with when it was taken, when it expires — read from the TTL in its own name,
so no server call is needed — its size, and a Delete button. Deleting takes the same-named
snapshot on descendant datasets too, which is how a recursive schedule made it, and says so
before it does anything.

Dropped "What would it delete?" from the schedule cards, and the endpoint behind it. Run
now says plainly that expired snapshots go at the same time, which is the whole of what the
preview was telling anyone.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

PLAN.md

@@ -276,6 +276,44 @@ something long in one, switch away and back, refresh — it's all still there.
   a dashboard could silently reset the sampling rate for the whole machine, overriding the
   fleet refresh rate set in Settings. The sampler now has one source: `refreshMs` in the UI
   prefs, which the hub fans out, remembered per machine as `sampler_ms`.
+- **ZFS tab, with scheduled snapshots** — **shipped 2026-09-24** (`internal/storage/snapshots.go`,
+  `internal/api/zfs.go`, `ZFS.tsx`). Pools, datasets and snapshots moved out of Disks —
+  Disks is the hardware, ZFS is the filesystem on top of it — and the tab gained what it was
+  split out for: **snapshot schedules**. Hourly, daily, weekly or monthly, per dataset,
+  optionally recursive, with a **retention period** and a floor that keeps the newest few
+  whatever their age. A missed window (the machine was off) runs once on return rather than
+  being skipped.
+  **The naming is zfSnap's, deliberately.** `grid` has run zfSnap v1.11.1 from root cron at
+  02:30 with a 6-week TTL since before this repo existed, and it works. So rather than
+  invent a second convention for two tools to disagree over, this writes and reads exactly
+  what zfSnap does — `tank@2026-09-24_02.30.01--6w`, **retention encoded in the name**. Three
+  consequences: Ham Lab shows and expires the snapshots zfSnap already took; the two can run
+  side by side without fighting, since both only remove what has passed the expiry written
+  into its own name; and changing a schedule never re-dates old snapshots, because each
+  carries the rule it was taken under. The page **detects the existing cron job**
+  (zfSnap, zfs-auto-snapshot, sanoid, or a bare `zfs snapshot`) and says so, warning if a Ham
+  Lab schedule is running as well.
+  **Nothing is destroyed unseen.** Every schedule answers *what would it delete?* with the
+  list, sizes and dates, before Run now touches anything; only names that parse as a stamp
+  and a TTL are candidates, so a snapshot taken by hand is invisible to it; and a snapshot
+  deleted by hand needs its full name typed back.
+  **A schedule is a real cron job** (2026-09-24, Mitchell's call after the first cut ran it
+  from a ticker inside the daemon). Ham Lab writes `/etc/cron.d/hamlab-zfs`, owns it, and
+  rewrites it whole on every change; each line calls `hamlab zfs-snapshot <id>` as the
+  account Ham Lab runs as, reaching zfs through sudo as the daemon does. Snapshots are
+  backup-shaped and must not stop because a console is down, upgrading, or uninstalled — and
+  a cron line is greppable by anyone looking at the machine the normal way. **A cron
+  expression is the single description of when a schedule fires**: the four common shapes
+  render to one, `custom` states one outright, and the next run is read back with the same
+  evaluator the Jobs tab uses on everyone else's lines, so the page, the file and the
+  prediction cannot disagree. A run's outcome is written to `zfs-runs/<id>.json` beside the
+  config, never to `state.json`, because the cron job is a separate process and the daemon
+  would clobber it. An existing external job can be **adopted** — its schedule, retention
+  and dataset read out of the cron line into a new Ham Lab schedule.
+  **zfSnap is retired on `grid`** as of that day: Ham Lab now takes the nightly `tank`
+  snapshot, the package is purged and the old cron line is gone, with the 515 snapshots it
+  had taken left untouched and fully readable here — which is what adopting its naming
+  bought. See `hamlet/docs/hosts.md`.
 - **Skins** — 13 since 2026-09-19 (`themes.ts`: a palette is one `mk(…)` line): Dark,
   Light, Cyberpunk, Retro, **HUD** (hairlines of cyan on near-black, corner ticks, thin
   type), Nord, Gruvbox, Catppuccin + Latte, Dracula, Tokyo Night, Solarized Dark + Light;
@@ -511,32 +549,6 @@ something long in one, switch away and back, refresh — it's all still there.
   - *Not app work, but the trigger:* nothing here blocks starting the migration except the
     inventory. Do that first.
 
-- **Rename the Space tab** — asked for 2026-09-23, not started. "Space" is vague; the tab
-  is WizTree for a disk or pool. Candidates: **Usage**, **Disk Usage**, **Storage**. Note
-  `Disks` already exists and `Storage` would muddle with it, so Usage is probably the one.
-  The rename touches the rail label, the `View` id, the hash route (`#/<machine>/space`,
-  which people may have bookmarked — decide whether to keep `space` as the id and change
-  only the label), the footer's page name and `Space.tsx`'s own strings.
-
-- **ZFS gets its own tab, under Disks** — asked for 2026-09-23, not started. Today ZFS is a
-  section inside `Disks.tsx`: pools with health, capacity, fragmentation, scrub controls, a
-  dataset tree and per-dataset snapshot lists with "Snapshot now". Moving it out makes room
-  for what is actually wanted: **scheduled snapshots with a retention policy**, configured
-  from the console rather than by hand. What exists to build on — `grid` runs `zfSnap`
-  nightly at 02:30 from root cron with 6-week expiry (`zfsnap-cron-6w-daily.sh`, predates
-  this repo), and Ham Lab's Cron tab can already read, write and run root crontabs, so the
-  job can be managed rather than reinvented. Decide: does Ham Lab drive `zfSnap`/`zfs-auto-
-  snapshot` if present, or write and own its own timer? Per-dataset policies or one for the
-  pool? And it must show what a retention rule *will* delete before it runs.
-
-- **Rename Cron to something generic** — asked for 2026-09-23, not started. Mitchell's
-  reasoning: the Services tab is systemd but "Services" is the right generic name for it,
-  so the scheduling tab should be named for the job it does, not the tool. **Scheduled** or
-  **Jobs**. The tab already covers more than cron — `/etc/crontab`, `/etc/cron.d`, user
-  crontabs, `run-parts` directories *and* systemd timers — so the generic name is the
-  honest one. Same rename surface as the Space tab: rail label, `View` id, hash route,
-  footer name.
-
 - **A Virtualization tab** — asked for 2026-09-23, not started, and **large**. Run and
   manage **LXC containers and virtual machines** from the console, the way Proxmox does —
   which is the comparison Ham Lab has invited since its first line. Nothing exists yet.
@@ -553,6 +565,40 @@ something long in one, switch away and back, refresh — it's all still there.
   item names the heavier pieces (multi-select and bulk actions, folder download, resumable
   uploads, a gallery, search) — worth doing the two together, since they are the same tab.
 
+- **A KVM tab** — asked for 2026-09-24, not started. **Dead simple is the brief**: paste one
+  HTTP link, the tab shows whatever UI that KVM serves, and the keyboard goes to it. **This
+  is KVM the keyboard-video-mouse switch, not KVM the hypervisor** — the Virtualization item
+  above means the other one.
+  - **The device**: a **Sipeed NanoKVM** attached to `grid` at **`10.0.0.217`** (MAC
+    `48:da:35:6f:d0:31`), web UI on port 80. The only one so far, so store a list, not one URL.
+  - **Framing works.** Probed 2026-09-24: it sends **no `X-Frame-Options` and no
+    `frame-ancestors`**, so it does not refuse to be embedded. No fallback needed.
+  - **Proxy it through the daemon — that is what makes the simple version possible.** The
+    KVM is **HTTP only**, and Ham Lab is served over TLS, so a bare `http://…` iframe is
+    blocked as mixed content and the "just paste a link" idea dies there. Serving it from Ham
+    Lab's own origin (`/api/kvm/<id>/…`, on the `proxyNode` machinery, which already carries
+    WebSockets — exactly what the video and input streams are) fixes three things at once:
+    no mixed content, the KVM sits behind **Ham Lab's** login rather than a second one
+    (`/api/vm/info` answers 401, so it has its own, which the hub can hold once), and the
+    iframe becomes **same-origin**, which matters for the keyboard below.
+  - **The keyboard needs less than it sounds.** A parent page *cannot* capture keys and
+    forward them into a **cross-origin** iframe — the browser forbids synthetic events across
+    origins — but it does not need to: an iframe with focus receives keystrokes directly, and
+    the NanoKVM's own page already handles them. So "capture and give it to the iframe" is
+    really: click-to-focus, keep focus there, and stop the console's own shortcuts from
+    eating keys while it is focused. What is genuinely worth adding is **fullscreen** plus
+    `navigator.keyboard.lock()`, which is what stops the *browser* swallowing Escape, Tab and
+    Ctrl-W so they reach the guest — note it is Chromium-only, so Firefox and iOS Safari get
+    the plain version. Proxying makes the iframe same-origin anyway, so real forwarding stays
+    available if some KVM ever needs it.
+  - **Where the list lives is the one real design decision.** A KVM earns its keep when the
+    machine is *down* — no OS, a bad kernel, a BIOS screen — which is when that host's Ham Lab
+    cannot answer. So it is **hub-side** and must work for machines running no Ham Lab at all.
+    A `kvm_url` in each node's own `config.json` would fail in exactly the case it is for.
+  - **Do not give it an NPM host** without deciding to: `*.bigham.dev` is a wildcard to the
+    public IP, so that would put BIOS-level control of `grid` on the internet behind only the
+    KVM's own login. Behind Ham Lab's proxy it inherits Ham Lab's auth instead.
+
 ## Open questions
 
 - Idle-session reaping policy (never / after N days) — leaning never; it's a

cmd/hamlab/main.go

@@ -4,6 +4,7 @@ package main
 import (
 	"bufio"
 	"context"
+	"encoding/json"
 	"errors"
 	"flag"
 	"fmt"
@@ -32,6 +33,7 @@ import (
 	"hamlab/internal/metrics"
 	"hamlab/internal/nodes"
 	"hamlab/internal/services"
+	"hamlab/internal/priv"
 	"hamlab/internal/setup"
 	"hamlab/internal/space"
 	"hamlab/internal/storage"
@@ -59,6 +61,7 @@ func main() {
   serve                run the console in the foreground (what the service runs)
   passwd [user]        set a user's password (makes the account if it is new; reads stdin when piped)
   users                list the accounts
+  zfs-snapshot <id>    run one ZFS snapshot schedule (what its cron line calls)
   user-rm <user>       remove an account and sign it out everywhere
   check                verify the config and state load, then exit
   version
@@ -129,6 +132,10 @@ func main() {
 		if err := passwd(cfg, flag.Arg(1)); err != nil {
 			log.Fatal(err)
 		}
+	case "zfs-snapshot":
+		if err := zfsSnapshot(cfg, flag.Arg(1)); err != nil {
+			log.Fatal(err)
+		}
 	case "users":
 		migrateUsers(cfg)
 		if len(cfg.Users) == 0 {
@@ -178,6 +185,58 @@ func main() {
 
 // migrateUsers gives a pre-users config its first account, named after this OS user, so
 // the CLI sees the same accounts the daemon will.
+// zfsSnapshot runs one snapshot schedule: take it, then expire what has aged out. This is
+// what the cron line Ham Lab writes actually calls, so a schedule keeps running whether or
+// not the console is up — and keeps running if Ham Lab is never opened again.
+//
+// It deliberately does not write state.json. The daemon owns that file and would clobber
+// anything written from out here; the outcome goes beside it instead, in zfs-runs/.
+func zfsSnapshot(cfg *config.Config, id string) error {
+	if strings.TrimSpace(id) == "" {
+		return errors.New("usage: hamlab zfs-snapshot <schedule-id>")
+	}
+	st, err := store.Open(filepath.Join(cfg.DataDir(), "state.json"))
+	if err != nil {
+		return err
+	}
+	var raw json.RawMessage
+	st.View(func(s *store.State) { raw = s.ZFS })
+	var z struct {
+		Policies []storage.Policy `json:"policies"`
+	}
+	if len(raw) > 0 {
+		if err := json.Unmarshal(raw, &z); err != nil {
+			return fmt.Errorf("reading the schedules: %w", err)
+		}
+	}
+	var p *storage.Policy
+	for i := range z.Policies {
+		if z.Policies[i].ID == id {
+			p = &z.Policies[i]
+		}
+	}
+	if p == nil {
+		return fmt.Errorf("no snapshot schedule %q — it may have been removed; this cron line is stale", id)
+	}
+	res, runErr := storage.New(priv.Available()).Run(context.Background(), p)
+	rec := storage.RunRecord{At: time.Now(), Taken: res.Taken, Pruned: res.Pruned}
+	if runErr != nil {
+		rec.Error = runErr.Error()
+	}
+	if err := storage.WriteRun(cfg.DataDir(), id, rec); err != nil {
+		fmt.Fprintln(os.Stderr, "recording the run:", err)
+	}
+	if runErr != nil {
+		return runErr
+	}
+	fmt.Printf("%s: took %s", p.Name, res.Taken)
+	if len(res.Pruned) > 0 {
+		fmt.Printf(", expired %d", len(res.Pruned))
+	}
+	fmt.Println()
+	return nil
+}
+
 func migrateUsers(cfg *config.Config) {
 	name := os.Getenv("USER")
 	if u, err := user.Current(); err == nil && u.Username != "" {

internal/api/server.go

@@ -251,6 +251,11 @@ func New(cfg *config.Config, sessions *auth.Sessions, mgr *term.Manager, col *me
 	m.HandleFunc("GET /api/storage/zfs/snapshots", s.auth(s.zfsSnapshots))
 	m.HandleFunc("POST /api/storage/zfs/scrub/{pool}/{action}", s.auth(s.zfsScrub))
 	m.HandleFunc("POST /api/storage/zfs/snapshot", s.auth(s.zfsSnapshot))
+	m.HandleFunc("GET /api/zfs", s.auth(s.zfsOverview))
+	m.HandleFunc("PUT /api/zfs/schedules", s.auth(s.zfsPolicyPut))
+	m.HandleFunc("DELETE /api/zfs/schedules/{id}", s.auth(s.zfsPolicyDelete))
+	m.HandleFunc("POST /api/zfs/schedules/{id}/run", s.auth(s.zfsRunNow))
+	m.HandleFunc("POST /api/zfs/snapshots/delete", s.auth(s.zfsSnapshotDelete))
 	m.HandleFunc("GET /api/space", s.auth(s.spaceOverview))
 	m.HandleFunc("GET /api/space/{disk}", s.auth(s.spaceStatus))
 	m.HandleFunc("POST /api/space/{disk}/scan", s.auth(s.spaceScan))

internal/api/zfs.go

@@ -0,0 +1,262 @@
+package api
+
+// The ZFS tab: pools, datasets, snapshots, and a schedule for taking and expiring them.
+//
+// grid already runs zfSnap from root cron and has done for longer than this repo has
+// existed, so this does not replace it. It reads the same snapshot names, expires by the
+// same rule, and surfaces the cron job that drives it — so what is on screen is the truth
+// about the machine, whether Ham Lab or zfSnap is doing the work. A Ham Lab schedule is for
+// a machine that has no such tool, and the page says plainly when both are running.
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"io"
+	"log"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"hamlab/internal/storage"
+	"hamlab/internal/store"
+)
+
+type zfsState struct {
+	Policies []storage.Policy `json:"policies"`
+}
+
+func (s *Server) zfsLoad() zfsState {
+	var raw json.RawMessage
+	s.store.View(func(st *store.State) { raw = st.ZFS })
+	var z zfsState
+	if len(raw) > 0 {
+		_ = json.Unmarshal(raw, &z)
+	}
+	if z.Policies == nil {
+		z.Policies = []storage.Policy{}
+	}
+	return z
+}
+
+func (s *Server) zfsSave(z zfsState) error {
+	b, err := json.Marshal(z)
+	if err != nil {
+		return err
+	}
+	return s.store.Update(func(st *store.State) { st.ZFS = b })
+}
+
+// externalSnapshotJob finds a cron job that is already taking snapshots on this machine, so
+// the page can say so rather than let two schedules quietly double up.
+func (s *Server) externalSnapshotJob(ctx context.Context) map[string]any {
+	if s.cron == nil {
+		return nil
+	}
+	ov := s.cron.Overview(ctx)
+	for _, j := range ov.Jobs {
+		if !j.Enabled {
+			continue
+		}
+		c := strings.ToLower(j.Command)
+		if !strings.Contains(c, "zfsnap") && !strings.Contains(c, "zfs-auto-snapshot") && !strings.Contains(c, "sanoid") &&
+			!(strings.Contains(c, "zfs ") && strings.Contains(c, "snapshot")) {
+			continue
+		}
+		return map[string]any{
+			"tool": toolName(c), "schedule": j.Schedule, "command": j.Command,
+			"user": j.User, "source": j.Source, "id": j.ID, "next": j.Next, "last": j.Last,
+		}
+	}
+	return nil
+}
+
+func toolName(cmd string) string {
+	switch {
+	case strings.Contains(cmd, "zfsnap"):
+		return "zfSnap"
+	case strings.Contains(cmd, "zfs-auto-snapshot"):
+		return "zfs-auto-snapshot"
+	case strings.Contains(cmd, "sanoid"):
+		return "sanoid"
+	}
+	return "a cron job"
+}
+
+// randomID is a short opaque id for a schedule.
+func randomID() (string, error) {
+	b := make([]byte, 6)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(b), nil
+}
+
+// ---- the cron file ----
+//
+// A schedule is a cron line, written to /etc/cron.d/hamlab-zfs, which Ham Lab owns and
+// rewrites whole whenever the schedules change. Nothing in the daemon runs them: snapshots
+// are backup-shaped and should not stop because a web console is down, being upgraded, or
+// uninstalled. The line calls `hamlab zfs-snapshot <id>` as the account Ham Lab runs as,
+// which reaches zfs through sudo exactly as the daemon does.
+
+// syncCron puts the current schedules on the machine.
+func (s *Server) syncCron(ctx context.Context, z zfsState) error {
+	exe, err := os.Executable()
+	if err != nil {
+		return err
+	}
+	exe, _ = filepath.EvalSymlinks(exe)
+	return s.storage.WriteCronFile(ctx, z.Policies, s.user, exe, s.cfg.Path())
+}
+
+// ---- endpoints ----
+
+func (s *Server) zfsOverview(w http.ResponseWriter, r *http.Request) {
+	z := s.zfsLoad()
+	now := time.Now()
+	dir := s.cfg.DataDir()
+	out := make([]map[string]any, 0, len(z.Policies))
+	for i := range z.Policies {
+		p := z.Policies[i]
+		expr, _ := p.CronExpr()
+		m := map[string]any{"policy": p, "cron": expr, "last": storage.ReadRun(dir, p.ID)}
+		if p.Enabled {
+			if n := p.NextRun(now); !n.IsZero() {
+				m["next"] = n
+			}
+		}
+		out = append(out, m)
+	}
+	jsonOK(w, 200, map[string]any{
+		"zfs": s.storage.ZFS(r.Context()), "policies": out, "external": s.externalSnapshotJob(r.Context()),
+	})
+}
+
+func (s *Server) zfsPolicyPut(w http.ResponseWriter, r *http.Request) {
+	var p storage.Policy
+	if err := json.NewDecoder(io.LimitReader(r.Body, 16<<10)).Decode(&p); err != nil {
+		jsonErr(w, 400, "bad request")
+		return
+	}
+	if err := p.Validate(); err != nil {
+		jsonErr(w, 400, err.Error())
+		return
+	}
+	z := s.zfsLoad()
+	found := false
+	for i := range z.Policies {
+		if z.Policies[i].ID == p.ID && p.ID != "" {
+			z.Policies[i] = p
+			found = true
+		}
+	}
+	if !found {
+		if p.ID == "" {
+			id, err := randomID()
+			if err != nil {
+				jsonErr(w, 500, err.Error())
+				return
+			}
+			p.ID = id
+		}
+		z.Policies = append(z.Policies, p)
+	}
+	if err := s.zfsSave(z); err != nil {
+		jsonErr(w, 500, err.Error())
+		return
+	}
+	if err := s.syncCron(r.Context(), z); err != nil {
+		jsonErr(w, 500, "saved, but writing "+storage.CronFile+" failed: "+err.Error())
+		return
+	}
+	expr, _ := p.CronExpr()
+	log.Printf("zfs schedule %q saved by %s (%s, %q, keep %s)", p.Name, clientIP(r), p.Dataset, expr, p.KeepFor)
+	jsonOK(w, 200, p)
+}
+
+func (s *Server) zfsPolicyDelete(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	z := s.zfsLoad()
+	kept := z.Policies[:0]
+	found := false
+	for _, p := range z.Policies {
+		if p.ID == id {
+			found = true
+			continue
+		}
+		kept = append(kept, p)
+	}
+	if !found {
+		jsonErr(w, 404, "no such schedule")
+		return
+	}
+	z.Policies = kept
+	if err := s.zfsSave(z); err != nil {
+		jsonErr(w, 500, err.Error())
+		return
+	}
+	if err := s.syncCron(r.Context(), z); err != nil {
+		jsonErr(w, 500, "removed, but writing "+storage.CronFile+" failed: "+err.Error())
+		return
+	}
+	storage.ForgetRun(s.cfg.DataDir(), id)
+	log.Printf("zfs schedule %s removed by %s (its snapshots are left alone)", id, clientIP(r))
+	w.WriteHeader(204)
+}
+
+func (s *Server) zfsPolicy(id string) (storage.Policy, bool) {
+	for _, p := range s.zfsLoad().Policies {
+		if p.ID == id {
+			return p, true
+		}
+	}
+	return storage.Policy{}, false
+}
+
+func (s *Server) zfsRunNow(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	p, ok := s.zfsPolicy(id)
+	if !ok {
+		jsonErr(w, 404, "no such schedule")
+		return
+	}
+	res, err := s.storage.Run(r.Context(), &p)
+	rec := storage.RunRecord{At: time.Now(), Taken: res.Taken, Pruned: res.Pruned}
+	if err != nil {
+		rec.Error = err.Error()
+	}
+	_ = storage.WriteRun(s.cfg.DataDir(), id, rec)
+	if err != nil {
+		jsonErr(w, 500, err.Error())
+		return
+	}
+	log.Printf("zfs schedule %q run by %s: took %s, expired %d", p.Name, clientIP(r), res.Taken, len(res.Pruned))
+	jsonOK(w, 200, res)
+}
+
+// zfsSnapshotDelete removes one snapshot, named in full and typed back by the caller.
+func (s *Server) zfsSnapshotDelete(w http.ResponseWriter, r *http.Request) {
+	var body struct {
+		Name      string `json:"name"`
+		Confirm   string `json:"confirm"`
+		Recursive bool   `json:"recursive"`
+	}
+	if err := json.NewDecoder(io.LimitReader(r.Body, 4096)).Decode(&body); err != nil {
+		jsonErr(w, 400, "bad request")
+		return
+	}
+	if body.Confirm != body.Name {
+		jsonErr(w, 400, "type the snapshot's full name to confirm")
+		return
+	}
+	if err := s.storage.DestroySnapshot(r.Context(), body.Name, body.Recursive); err != nil {
+		jsonErr(w, 500, err.Error())
+		return
+	}
+	log.Printf("zfs snapshot %s destroyed by %s%s", body.Name, clientIP(r), map[bool]string{true: " (recursive)", false: ""}[body.Recursive])
+	w.WriteHeader(204)
+}

internal/cron/cron.go

@@ -1,3 +1,6 @@
+// Package cron reads and writes what the UI calls the **Jobs** tab (named "Cron" until
+// 2026-09-24; the package and its /api/cron endpoints kept the old name).
+//
 // Package cron reads every scheduled job on the host into one list: /etc/crontab,
 // /etc/cron.d/*, per-user crontabs, the run-parts directories they drive, and systemd
 // timers. It computes next runs from the cron expressions, pulls last runs from the

internal/cron/schedule.go

@@ -132,6 +132,17 @@ func (s *schedule) dayMatches(t time.Time) bool {
 	}
 }
 
+// NextRun is the first time strictly after `from` that a cron expression fires. Exported so
+// anything that writes a cron line — the ZFS snapshot schedules — can say when it runs next
+// using the same evaluator that reads everyone else's.
+func NextRun(expr string, from time.Time) (time.Time, bool) { return nextRun(expr, from) }
+
+// ValidSchedule reports whether a cron expression parses.
+func ValidSchedule(expr string) error {
+	_, err := parseSchedule(expr)
+	return err
+}
+
 // nextRun finds the first time strictly after `from` that the schedule fires.
 func nextRun(expr string, from time.Time) (time.Time, bool) {
 	s, err := parseSchedule(expr)

internal/metrics/metrics.go

@@ -90,6 +90,15 @@ type FS struct {
 	Type  string `json:"type"`
 	Size  uint64 `json:"size"`
 	Used  uint64 `json:"used"`
+	// Remote is set when the filesystem lives on another machine — a CIFS or NFS share,
+	// sshfs, and so on. Its bytes are somebody else's disk, so a panel about this machine's
+	// hardware leaves it out, while the sensor stays for anyone who does want it.
+	Remote bool `json:"remote,omitempty"`
+	// Disk is the physical drive these bytes are on ("nvme0", "sda"), named as the sampler
+	// names it; empty when that cannot be
+	// said honestly: a ZFS pool or an md array spreads a filesystem over several drives, and
+	// a remote mount is on none of them.
+	Disk string `json:"disk,omitempty"`
 }
 
 type UPS struct {
@@ -766,6 +775,15 @@ func foldNVMe(devs []Disk) []Disk {
 
 // Kernel/virtual filesystems that aren't storage. Anything else that's mounted is
 // shown, so new real filesystems (bcachefs, exotic FUSE) work without a code change.
+// remoteFS is every filesystem type whose storage is not in this machine.
+var remoteFS = map[string]bool{
+	"cifs": true, "smb3": true, "smbfs": true, "nfs": true, "nfs4": true, "afs": true,
+	"ceph": true, "glusterfs": true, "9p": true, "afpfs": true, "davfs": true,
+	"fuse.sshfs": true, "sshfs": true, "fuse.rclone": true, "fuse.s3fs": true,
+	"fuse.davfs2": true, "fuse.curlftpfs": true, "fuse.gcsfuse": true, "beegfs": true,
+	"lustre": true, "orangefs": true, "pvfs2": true, "coda": true, "ncpfs": true,
+}
+
 var pseudoFS = map[string]bool{
 	"proc": true, "sysfs": true, "devtmpfs": true, "devpts": true, "tmpfs": true, "ramfs": true,
 	"cgroup": true, "cgroup2": true, "pstore": true, "bpf": true, "securityfs": true, "debugfs": true,
@@ -812,7 +830,7 @@ func filesystems() []FS {
 				return
 			}
 			bs := uint64(st.Bsize)
-			done <- FS{Mount: mount, Type: fs[2], Size: st.Blocks * bs, Used: (st.Blocks - st.Bfree) * bs}
+			done <- FS{Mount: mount, Type: fs[2], Size: st.Blocks * bs, Used: (st.Blocks - st.Bfree) * bs, Remote: remoteFS[fs[2]], Disk: diskOf(fs[0])}
 		}()
 		select {
 		case r := <-done:
@@ -820,12 +838,52 @@ func filesystems() []FS {
 				out = append(out, r)
 			}
 		case <-time.After(3 * time.Second):
-			out = append(out, FS{Mount: mount, Type: fs[2]}) // unreachable: size 0 signals it
+			out = append(out, FS{Mount: mount, Type: fs[2], Remote: remoteFS[fs[2]]}) // unreachable: size 0 signals it
 		}
 	}
 	return out
 }
 
+// diskOf names the physical drive a mount's source device sits on — "/dev/nvme0n1p2" is on
+// "nvme0n1". It follows one layer of device-mapper or md (LUKS on a partition, say) but
+// gives up when a thing spans several drives, because then no single drive is the answer.
+func diskOf(source string) string {
+	if !strings.HasPrefix(source, "/dev/") {
+		return "" // a ZFS pool, a network share, a tmpfs: not a block device at all
+	}
+	d := parentDisk(strings.TrimPrefix(source, "/dev/"), 0)
+	// the sampler reports one drive per NVMe controller, so name it the same way
+	if m := nsRe.FindStringSubmatch(d); m != nil {
+		return m[1]
+	}
+	return d
+}
+
+func parentDisk(name string, depth int) string {
+	if name == "" || depth > 4 || strings.Contains(name, "/") {
+		return ""
+	}
+	base := "/sys/class/block/" + name
+	if _, err := os.Stat(base); err != nil {
+		return ""
+	}
+	// a partition: its parent directory in sysfs is the whole drive
+	if _, err := os.Stat(base + "/partition"); err == nil {
+		if target, err := os.Readlink(base); err == nil {
+			return filepath.Base(filepath.Dir(target))
+		}
+		return ""
+	}
+	// device-mapper or md: one drive underneath is an answer, several is not
+	if ents, err := os.ReadDir(base + "/slaves"); err == nil && len(ents) > 0 {
+		if len(ents) > 1 {
+			return ""
+		}
+		return parentDisk(ents[0].Name(), depth+1)
+	}
+	return name // a whole drive, used without partitioning
+}
+
 // ---- UPS ----
 
 func runOut(args ...string) (string, bool) {

internal/metrics/sensors.go

@@ -117,9 +117,18 @@ func flatten(s Sample, want func(id string) bool) []sensors.Sensor {
 
 	for _, x := range s.FS {
 		p := "fs." + sensors.Seg(x.Mount)
-		f.add(p+".size", x.Mount+" size", "bytes", "B", float64(x.Size), s.fsT, none, "mount", x.Mount, "fstype", x.Type)
+		// remote says the bytes are on another machine (a CIFS or NFS share), so a view of
-		f.add(p+".used", x.Mount+" used", "bytes", "B", float64(x.Used), s.fsT, upTo(float64(x.Size)), "mount", x.Mount, "fstype", x.Type)
+		// this machine's hardware can leave it out without losing the sensor
-		f.add(p+".used_pct", x.Mount+" used", "usage", "%", ratio(x.Used, x.Size), s.fsT, pct, "mount", x.Mount, "fstype", x.Type)
+		lbl := []string{"mount", x.Mount, "fstype", x.Type}
+		if x.Remote {
+			lbl = append(lbl, "remote", "1")
+		}
+		if x.Disk != "" {
+			lbl = append(lbl, "disk", x.Disk)
+		}
+		f.add(p+".size", x.Mount+" size", "bytes", "B", float64(x.Size), s.fsT, none, lbl...)
+		f.add(p+".used", x.Mount+" used", "bytes", "B", float64(x.Used), s.fsT, upTo(float64(x.Size)), lbl...)
+		f.add(p+".used_pct", x.Mount+" used", "usage", "%", ratio(x.Used, x.Size), s.fsT, pct, lbl...)
 	}
 
 	if u := s.UPS; u != nil {

internal/space/walk.go

@@ -1,4 +1,6 @@
-// Package space measures what is using a disk: a parallel walk of the filesystems a disk
+// Package space measures what is using a disk — it is what the UI calls the **Usage** tab
+// (renamed from "Space" on 2026-09-24; the package and its /api/space endpoints kept the
+// old name rather than churn a working API): a parallel walk of the filesystems a disk
 // backs, kept as a tree of directories and the files worth seeing, the way WizTree does it.
 //
 // The walk never crosses a filesystem boundary by itself — /proc, /sys, another disk's

internal/storage/snapshots.go

@@ -0,0 +1,476 @@
+package storage
+
+// Scheduled snapshots with a retention period: take a snapshot of a dataset on a schedule,
+// and drop the ones that have aged out.
+//
+// **The naming is zfSnap's, deliberately.** grid has run zfSnap v1.11.1 from root cron since
+// before this repo existed and it works well, so rather than invent a second convention and
+// have two tools disagree about what a snapshot is, this writes and reads exactly what
+// zfSnap does: `<dataset>@2026-09-24_02.30.01--6w`, with the retention encoded in the name.
+// That has three consequences worth knowing. Ham Lab can show and manage the snapshots
+// zfSnap already took. The two can run side by side without fighting, because both only
+// ever destroy snapshots that have passed the expiry written into their own name. And
+// changing a policy's retention does not retroactively re-date old snapshots — each one
+// carries the rule it was taken under, which is the behaviour you want from a backup.
+//
+// Two rules make this safe to run unattended. Only a snapshot whose name parses as a stamp
+// and a TTL is ever a candidate — anything taken by hand or named anything else is invisible
+// to it. And every policy can be asked what it would delete, before it deletes anything.
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"hamlab/internal/cron"
+	"hamlab/internal/priv"
+)
+
+// stampLayout is zfSnap's timestamp: 2026-09-24_02.30.01.
+const stampLayout = "2006-01-02_15.04.05"
+
+// ttlSep separates the stamp from the retention in a snapshot name, as zfSnap writes it.
+const ttlSep = "--"
+
+// Policy is a standing instruction: snapshot this dataset on this schedule, keep the
+// snapshots this long.
+type Policy struct {
+	ID      string `json:"id"`
+	Name    string `json:"name"`
+	Dataset string `json:"dataset"`
+	// Recursive takes one atomic snapshot of the dataset and everything under it (zfs -r).
+	Recursive bool `json:"recursive"`
+	// Every is hourly | daily | weekly | monthly | custom. At is "HH:MM" (the minute alone
+	// is used for hourly). Weekday is 0=Sunday, Day is 1–28. With "custom", Cron is a plain
+	// cron expression and the rest is ignored — the escape hatch for anything the four
+	// common shapes cannot say.
+	Every   string `json:"every"`
+	At      string `json:"at"`
+	Weekday int    `json:"weekday"`
+	Day     int    `json:"day"`
+	Cron    string `json:"cron,omitempty"`
+	// KeepFor is how long a snapshot lives: "6w", "30d", "12h". It is written into the
+	// snapshot's own name, zfSnap-style, so each one carries the rule it was taken under.
+	// KeepMin is a floor — that many newest snapshots survive however old they are, so a
+	// dataset is never left with none.
+	KeepFor string `json:"keep_for"`
+	KeepMin int    `json:"keep_min"`
+	Prefix  string `json:"prefix"`
+	Enabled bool   `json:"enabled"`
+
+}
+
+func (p *Policy) prefix() string { return strings.TrimSpace(p.Prefix) }
+
+// Validate reports what is wrong with a policy, or nil.
+func (p *Policy) Validate() error {
+	if !datasetRe.MatchString(p.Dataset) {
+		return errors.New("dataset: a pool or pool/dataset name")
+	}
+	if pre := p.prefix(); pre != "" && (!snapRe.MatchString(pre) || strings.Contains(pre, ttlSep)) {
+		return errors.New("prefix: letters, digits, . _ : and - only, and no --")
+	}
+	switch p.Every {
+	case "hourly", "daily", "weekly", "monthly":
+	case "custom":
+		if strings.TrimSpace(p.Cron) == "" {
+			return errors.New("a custom schedule needs a cron expression")
+		}
+	default:
+		return errors.New("every: hourly, daily, weekly, monthly or custom")
+	}
+	if _, err := p.CronExpr(); err != nil {
+		return err
+	}
+	if _, _, err := p.clock(); err != nil {
+		return err
+	}
+	if p.Every == "weekly" && (p.Weekday < 0 || p.Weekday > 6) {
+		return errors.New("weekday: 0 (Sunday) to 6")
+	}
+	if p.Every == "monthly" && (p.Day < 1 || p.Day > 28) {
+		return errors.New("day: 1 to 28, so every month has one")
+	}
+	if p.KeepFor != "" {
+		if _, err := ParseAge(p.KeepFor); err != nil {
+			return err
+		}
+	}
+	if p.KeepMin < 0 {
+		return errors.New("keep at least: 0 or more")
+	}
+	if p.KeepFor == "" {
+		return errors.New("a retention period is required — it is written into each snapshot's name, and is what lets it be cleaned up later")
+	}
+	return nil
+}
+
+func (p *Policy) clock() (hour, min int, err error) {
+	at := strings.TrimSpace(p.At)
+	if at == "" {
+		return 0, 0, nil
+	}
+	h, m, ok := strings.Cut(at, ":")
+	if !ok {
+		return 0, 0, errors.New("at: HH:MM")
+	}
+	hour, err = strconv.Atoi(h)
+	if err == nil {
+		min, err = strconv.Atoi(m)
+	}
+	if err != nil || hour < 0 || hour > 23 || min < 0 || min > 59 {
+		return 0, 0, errors.New("at: HH:MM, 00:00 to 23:59")
+	}
+	return hour, min, nil
+}
+
+// ParseAge reads "6w", "30d", "12h", "90m" as a duration. Weeks and days are what a
+// retention period is actually written in, and time.ParseDuration knows neither.
+func ParseAge(s string) (time.Duration, error) {
+	s = strings.TrimSpace(strings.ToLower(s))
+	if s == "" {
+		return 0, errors.New("empty period")
+	}
+	unit := s[len(s)-1]
+	n, err := strconv.Atoi(s[:len(s)-1])
+	if err != nil || n <= 0 {
+		return 0, fmt.Errorf("%q: a number and a unit, like 6w, 30d or 12h", s)
+	}
+	switch unit {
+	case 'm':
+		return time.Duration(n) * time.Minute, nil
+	case 'h':
+		return time.Duration(n) * time.Hour, nil
+	case 'd':
+		return time.Duration(n) * 24 * time.Hour, nil
+	case 'w':
+		return time.Duration(n) * 7 * 24 * time.Hour, nil
+	}
+	return 0, fmt.Errorf("%q: the unit is m, h, d or w", s)
+}
+
+// CronExpr renders the schedule as a cron expression — which is what actually runs it. The
+// four common shapes are sugar over this; a custom policy states it outright. One expression
+// is the only description of when a schedule fires, so the page, the cron file and the next
+// run can never disagree.
+func (p *Policy) CronExpr() (string, error) {
+	if p.Every == "custom" {
+		expr := strings.Join(strings.Fields(p.Cron), " ")
+		if err := cron.ValidSchedule(expr); err != nil {
+			return "", fmt.Errorf("cron expression: %w", err)
+		}
+		if strings.HasPrefix(expr, "@reboot") {
+			return "", errors.New("@reboot is not a schedule for snapshots")
+		}
+		return expr, nil
+	}
+	hour, min, err := p.clock()
+	if err != nil {
+		return "", err
+	}
+	switch p.Every {
+	case "hourly":
+		return fmt.Sprintf("%d * * * *", min), nil
+	case "daily":
+		return fmt.Sprintf("%d %d * * *", min, hour), nil
+	case "weekly":
+		return fmt.Sprintf("%d %d * * %d", min, hour, p.Weekday), nil
+	case "monthly":
+		return fmt.Sprintf("%d %d %d * *", min, hour, p.Day), nil
+	}
+	return "", errors.New("unknown schedule")
+}
+
+// NextRun is when cron will next fire this schedule, read with the same evaluator the Jobs
+// tab uses on everyone else's lines.
+func (p *Policy) NextRun(now time.Time) time.Time {
+	expr, err := p.CronExpr()
+	if err != nil {
+		return time.Time{}
+	}
+	t, ok := cron.NextRun(expr, now)
+	if !ok {
+		return time.Time{}
+	}
+	return t
+}
+
+// SnapTime reads a snapshot's name in zfSnap's convention and returns when it was taken,
+// when it expires, and whether the name parsed at all. A name without a TTL never expires.
+// An optional prefix in front of the stamp is allowed, so a policy can label its own.
+func SnapTime(name string) (taken time.Time, expires time.Time, ok bool) {
+	_, snap, cut := strings.Cut(name, "@")
+	if !cut {
+		return
+	}
+	body, ttl, hasTTL := strings.Cut(snap, ttlSep)
+	// an optional "<prefix>-" before the stamp
+	stamp := body
+	if len(body) > len(stampLayout) {
+		stamp = body[len(body)-len(stampLayout):]
+	}
+	t, err := time.ParseInLocation(stampLayout, stamp, time.Local)
+	if err != nil {
+		return time.Time{}, time.Time{}, false
+	}
+	taken, ok = t, true
+	if hasTTL {
+		if d, err := ParseAge(ttl); err == nil {
+			expires = t.Add(d)
+		}
+	}
+	return
+}
+
+// Doomed is which of this dataset's snapshots have passed the expiry written into their own
+// names, oldest first — exactly what zfSnap -d would remove. This is what the UI shows
+// before anything is deleted, and what Run then acts on. KeepMin holds back that many of the
+// newest whatever their names say, so a dataset is never left with none.
+func (m *Manager) Doomed(ctx context.Context, p *Policy) ([]Snapshot, error) {
+	if err := p.Validate(); err != nil {
+		return nil, err
+	}
+	all, err := m.Snapshots(ctx, p.Dataset)
+	if err != nil {
+		return nil, err
+	}
+	var dated []Snapshot
+	expiry := map[string]time.Time{}
+	for _, s := range all {
+		taken, exp, ok := SnapTime(s.Name)
+		if !ok || exp.IsZero() {
+			continue // hand-made, or kept forever: not ours to remove
+		}
+		_ = taken
+		dated = append(dated, s)
+		expiry[s.Name] = exp
+	}
+	sort.Slice(dated, func(i, j int) bool { return dated[i].Created > dated[j].Created }) // newest first
+	now := time.Now()
+	var doomed []Snapshot
+	for i, s := range dated {
+		if i < p.KeepMin {
+			continue // the floor: these survive however old they are
+		}
+		if expiry[s.Name].Before(now) {
+			doomed = append(doomed, s)
+		}
+	}
+	sort.Slice(doomed, func(i, j int) bool { return doomed[i].Created < doomed[j].Created }) // oldest first
+	return doomed, nil
+}
+
+// DestroySnapshot removes one snapshot. recursive also removes the same-named snapshot on
+// every dataset beneath it, which is what a recursive policy created.
+func (m *Manager) DestroySnapshot(ctx context.Context, full string, recursive bool) error {
+	dataset, snap, ok := strings.Cut(full, "@")
+	if !ok || !datasetRe.MatchString(dataset) || !snapRe.MatchString(snap) {
+		return errors.New("bad snapshot name")
+	}
+	args := []string{"zfs", "destroy"}
+	if recursive {
+		args = append(args, "-r")
+	}
+	out, code, err := m.run(ctx, append(args, full)...)
+	if err != nil {
+		return err
+	}
+	if code != 0 {
+		return errors.New(strings.TrimSpace(string(out)))
+	}
+	return nil
+}
+
+// SnapshotRecursive takes dataset@name, optionally of everything beneath it too.
+func (m *Manager) SnapshotRecursive(ctx context.Context, dataset, name string, recursive bool) error {
+	if !datasetRe.MatchString(dataset) || !snapRe.MatchString(name) {
+		return errors.New("bad snapshot name")
+	}
+	args := []string{"zfs", "snapshot"}
+	if recursive {
+		args = append(args, "-r")
+	}
+	out, code, err := m.run(ctx, append(args, dataset+"@"+name)...)
+	if err != nil {
+		return err
+	}
+	if code != 0 {
+		return errors.New(strings.TrimSpace(string(out)))
+	}
+	return nil
+}
+
+// RunResult is what one pass of a policy did.
+type RunResult struct {
+	Taken   string   `json:"taken"`
+	Pruned  []string `json:"pruned"`
+	Skipped int      `json:"skipped"` // snapshots that are not this policy's, left alone
+}
+
+// Run takes the snapshot and prunes what has aged out. It is the same code the scheduler
+// calls, so "Run now" and the timer cannot drift apart.
+func (m *Manager) Run(ctx context.Context, p *Policy) (RunResult, error) {
+	var res RunResult
+	if err := p.Validate(); err != nil {
+		return res, err
+	}
+	name := time.Now().Format(stampLayout)
+	if pre := strings.TrimSpace(p.Prefix); pre != "" {
+		name = pre + "-" + name
+	}
+	if p.KeepFor != "" {
+		name += ttlSep + strings.TrimSpace(strings.ToLower(p.KeepFor)) // zfSnap's convention: the retention lives in the name
+	}
+	if err := m.SnapshotRecursive(ctx, p.Dataset, name, p.Recursive); err != nil {
+		return res, err
+	}
+	res.Taken = p.Dataset + "@" + name
+	doomed, err := m.Doomed(ctx, p)
+	if err != nil {
+		return res, err // the snapshot was taken; the prune is what failed
+	}
+	for _, s := range doomed {
+		if err := m.DestroySnapshot(ctx, s.Name, p.Recursive); err != nil {
+			return res, fmt.Errorf("destroying %s: %w", s.Name, err)
+		}
+		res.Pruned = append(res.Pruned, s.Name)
+	}
+	return res, nil
+}
+
+// ---- what happened when it ran ----
+//
+// The policies are a definition the daemon owns; what a run did is written by whatever ran
+// it, which is a cron job in its own process. Keeping the two apart means the CLI never has
+// to write state.json behind the daemon's back — the last writer would win and one of them
+// would lose its work.
+
+// RunRecord is the outcome of one run of one schedule.
+type RunRecord struct {
+	At     time.Time `json:"at"`
+	Taken  string    `json:"taken,omitempty"`
+	Pruned []string  `json:"pruned,omitempty"`
+	Error  string    `json:"error,omitempty"`
+}
+
+func runPath(dir, id string) string { return filepath.Join(dir, "zfs-runs", id+".json") }
+
+// WriteRun records what a run did, beside the config.
+func WriteRun(dir, id string, r RunRecord) error {
+	if err := os.MkdirAll(filepath.Join(dir, "zfs-runs"), 0o700); err != nil {
+		return err
+	}
+	b, err := json.Marshal(r)
+	if err != nil {
+		return err
+	}
+	p := runPath(dir, id)
+	tmp := p + ".tmp"
+	if err := os.WriteFile(tmp, b, 0o600); err != nil {
+		return err
+	}
+	return os.Rename(tmp, p)
+}
+
+// ReadRun is the last thing a schedule did, or the zero value if it has never run.
+func ReadRun(dir, id string) RunRecord {
+	var r RunRecord
+	b, err := os.ReadFile(runPath(dir, id))
+	if err == nil {
+		_ = json.Unmarshal(b, &r)
+	}
+	return r
+}
+
+// ForgetRun drops a schedule's record, for when the schedule itself goes.
+func ForgetRun(dir, id string) { _ = os.Remove(runPath(dir, id)) }
+
+// ---- the cron file ----
+
+// CronFile is where Ham Lab writes the snapshot schedules. One file it owns entirely and
+// rewrites whole, so there is never a half-updated set of lines, and so a schedule removed
+// in the UI is removed from the machine.
+const CronFile = "/etc/cron.d/hamlab-zfs"
+
+// CronFileText renders every schedule as cron lines. user is who they run as — the account
+// Ham Lab itself runs as, which reaches zfs through sudo exactly as the daemon does, so the
+// files it writes stay owned by that account rather than by root.
+func CronFileText(policies []Policy, user, exe, config string) (string, error) {
+	var b strings.Builder
+	b.WriteString("# Ham Lab snapshot schedules — written by the ZFS tab, rewritten whole on every change.\n")
+	b.WriteString("# Edit them there, not here: anything added by hand is lost the next time a schedule changes.\n")
+	b.WriteString("SHELL=/bin/sh\n")
+	b.WriteString("PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\n\n")
+	for i := range policies {
+		p := &policies[i]
+		if !p.Enabled {
+			b.WriteString("# " + p.Name + " — paused\n")
+			continue
+		}
+		expr, err := p.CronExpr()
+		if err != nil {
+			return "", fmt.Errorf("%s: %w", p.Name, err)
+		}
+		name := strings.ReplaceAll(p.Name, "\n", " ")
+		fmt.Fprintf(&b, "# %s — %s, keep %s\n", name, p.Dataset, p.KeepFor)
+		fmt.Fprintf(&b, "%s %s %s -config %s zfs-snapshot %s\n\n", expr, user, exe, config, p.ID)
+	}
+	return b.String(), nil
+}
+
+// WriteCronFile puts the schedules on the machine, or removes the file when there are none.
+func (m *Manager) WriteCronFile(ctx context.Context, policies []Policy, user, exe, config string) error {
+	live := false
+	for i := range policies {
+		if policies[i].Enabled {
+			live = true
+		}
+	}
+	if !live {
+		out, code, err := m.run(ctx, "rm", "-f", CronFile)
+		if err != nil {
+			return err
+		}
+		if code != 0 {
+			return errors.New(strings.TrimSpace(string(out)))
+		}
+		return nil
+	}
+	text, err := CronFileText(policies, user, exe, config)
+	if err != nil {
+		return err
+	}
+	return m.writeRoot(ctx, CronFile, text)
+}
+
+// writeRoot puts text at a root-owned path, through the same privilege escalation every
+// other write here uses.
+func (m *Manager) writeRoot(ctx context.Context, path, text string) error {
+	args := []string{"tee", path}
+	if m.sudo {
+		args = priv.Wrap(args...)
+	}
+	ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, args[0], args[1:]...)
+	cmd.Stdin = strings.NewReader(text)
+	var errb bytes.Buffer
+	cmd.Stdout, cmd.Stderr = nil, &errb
+	if err := cmd.Run(); err != nil {
+		msg := strings.TrimSpace(errb.String())
+		if msg == "" {
+			msg = err.Error()
+		}
+		return errors.New(msg)
+	}
+	return nil
+}

internal/storage/snapshots_test.go

@@ -0,0 +1,135 @@
+package storage
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"hamlab/internal/cron"
+)
+
+func TestSnapTimeReadsZfSnapNames(t *testing.T) {
+	// the real thing off grid
+	taken, exp, ok := SnapTime("tank@2026-09-24_02.30.01--6w")
+	if !ok {
+		t.Fatal("zfSnap's own name must parse")
+	}
+	if taken.Format("2006-01-02 15:04:05") != "2026-09-24 02:30:01" {
+		t.Fatalf("taken = %v", taken)
+	}
+	if got := exp.Sub(taken); got != 6*7*24*time.Hour {
+		t.Fatalf("ttl = %v, want 6w", got)
+	}
+	// a labelled one from a policy with a prefix
+	if _, e, ok := SnapTime("tank/apps@nightly-2026-09-24_02.30.01--30d"); !ok || e.IsZero() {
+		t.Fatal("a prefixed name must parse and expire")
+	}
+	// no TTL: never expires
+	if _, e, ok := SnapTime("tank@2026-09-24_02.30.01"); !ok || !e.IsZero() {
+		t.Fatal("a name without a TTL must parse and never expire")
+	}
+	// things that are not ours
+	for _, n := range []string{"tank@before-upgrade", "tank@manual", "tank", "tank@2026-13-45_99.99.99--6w"} {
+		if _, _, ok := SnapTime(n); ok {
+			t.Errorf("%q must not parse as a scheduled snapshot", n)
+		}
+	}
+}
+
+func TestCronExprAndNextRun(t *testing.T) {
+	now := time.Date(2026, 9, 24, 9, 15, 0, 0, time.Local)
+	for _, c := range []struct {
+		p    Policy
+		want string
+	}{
+		{Policy{Every: "daily", At: "02:30"}, "30 2 * * *"},
+		{Policy{Every: "hourly", At: "00:30"}, "30 * * * *"},
+		{Policy{Every: "weekly", At: "04:00", Weekday: 0}, "0 4 * * 0"},
+		{Policy{Every: "monthly", At: "05:15", Day: 12}, "15 5 12 * *"},
+		{Policy{Every: "custom", Cron: "*/15  9-17 * * 1-5"}, "*/15 9-17 * * 1-5"},
+	} {
+		got, err := c.p.CronExpr()
+		if err != nil || got != c.want {
+			t.Errorf("CronExpr(%+v) = %q, %v; want %q", c.p.Every, got, err, c.want)
+		}
+	}
+	// the next run is read with the same evaluator the Jobs tab uses
+	daily := Policy{Every: "daily", At: "02:30"}
+	if n := daily.NextRun(now); n.Hour() != 2 || n.Minute() != 30 || n.Day() != 25 {
+		t.Fatalf("NextRun = %v, want 25th 02:30", n)
+	}
+	// a custom expression that does not parse is refused, not silently ignored
+	if _, err := (&Policy{Every: "custom", Cron: "not a schedule"}).CronExpr(); err == nil {
+		t.Fatal("a bad cron expression must be refused")
+	}
+	if _, err := (&Policy{Every: "custom", Cron: "@reboot"}).CronExpr(); err == nil {
+		t.Fatal("@reboot is not a snapshot schedule")
+	}
+}
+
+func TestCronFileText(t *testing.T) {
+	ps := []Policy{
+		{ID: "abc", Name: "tank nightly", Dataset: "tank", Every: "daily", At: "02:30", KeepFor: "6w", Enabled: true},
+		{ID: "def", Name: "paused one", Dataset: "tank/apps", Every: "hourly", At: "00:05", KeepFor: "2d"},
+	}
+	text, err := CronFileText(ps, "core", "/usr/local/bin/hamlab", "/home/core/apps/hamlab/config.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(text, "30 2 * * * core /usr/local/bin/hamlab -config /home/core/apps/hamlab/config.json zfs-snapshot abc") {
+		t.Fatalf("the enabled schedule is missing or malformed:\n%s", text)
+	}
+	if strings.Contains(text, "zfs-snapshot def") {
+		t.Fatalf("a paused schedule must not be scheduled:\n%s", text)
+	}
+	// every line cron will read must parse as a schedule
+	for _, line := range strings.Split(text, "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" || strings.HasPrefix(line, "#") || strings.Contains(line, "=") {
+			continue
+		}
+		f := strings.Fields(line)
+		if err := cron.ValidSchedule(strings.Join(f[:5], " ")); err != nil {
+			t.Errorf("line %q: %v", line, err)
+		}
+	}
+}
+
+func TestValidateRefusesNonsense(t *testing.T) {
+	ok := Policy{Dataset: "tank/apps", Every: "daily", At: "02:30", KeepFor: "6w"}
+	if err := ok.Validate(); err != nil {
+		t.Fatalf("a sane policy: %v", err)
+	}
+	bad := []Policy{
+		{Dataset: "", Every: "daily", At: "02:30", KeepFor: "6w"},
+		{Dataset: "tank", Every: "yearly", At: "02:30", KeepFor: "6w"},
+		{Dataset: "tank", Every: "custom", KeepFor: "6w"},
+		{Dataset: "tank", Every: "custom", Cron: "not a schedule", KeepFor: "6w"},
+		{Dataset: "tank", Every: "daily", At: "25:00", KeepFor: "6w"},
+		{Dataset: "tank", Every: "daily", At: "02:30"},                          // no retention
+		{Dataset: "tank", Every: "daily", At: "02:30", KeepFor: "6 weeks"},      // unparseable
+		{Dataset: "tank", Every: "monthly", At: "02:30", Day: 31, KeepFor: "6w"}, // not every month has one
+		{Dataset: "tank", Every: "daily", At: "02:30", KeepFor: "6w", Prefix: "a--b"},
+	}
+	for i, p := range bad {
+		if err := p.Validate(); err == nil {
+			t.Errorf("bad policy %d was accepted: %+v", i, p)
+		}
+	}
+}
+
+func TestParseAge(t *testing.T) {
+	for s, want := range map[string]time.Duration{
+		"6w": 6 * 7 * 24 * time.Hour, "30d": 30 * 24 * time.Hour,
+		"12h": 12 * time.Hour, "90m": 90 * time.Minute,
+	} {
+		if got, err := ParseAge(s); err != nil || got != want {
+			t.Errorf("ParseAge(%q) = %v, %v; want %v", s, got, err, want)
+		}
+	}
+	for _, s := range []string{"", "6", "w", "-1d", "0w", "6y", "six weeks"} {
+		if _, err := ParseAge(s); err == nil {
+			t.Errorf("ParseAge(%q) should fail", s)
+		}
+	}
+}

internal/store/store.go

@@ -51,7 +51,8 @@ type State struct {
 	// UI is the pre-users machine-wide look; on first boot with users it moves to the first
 	// account. Kept so an old state file still reads.
 	UI         json.RawMessage `json:"ui,omitempty"`
-	Alerts     json.RawMessage `json:"alerts,omitempty"`      // rules, channels and recent events (internal/api/alerts.go)
+	Alerts     json.RawMessage `json:"alerts,omitempty"`
+	ZFS        json.RawMessage `json:"zfs,omitempty"`  // snapshot schedules (internal/api/zfs.go)      // rules, channels and recent events (internal/api/alerts.go)
 	SamplerMs  int             `json:"sampler_ms,omitempty"`  // how often this machine samples; the hub keeps every machine on the console's refresh rate
 	HistorySec int             `json:"history_sec,omitempty"` // how far back the graphs reach; the hub keeps every machine on the same one
 }

web/src/Disks.tsx

@@ -1,8 +1,8 @@
 import { useCallback, useEffect, useMemo, useState } from 'react'
-import { api, SmartInfo, StorageDevice, ZFSInfo, ZFSSnapshot } from './api'
+import { api, SmartInfo, StorageDevice } from './api'
 import { fmtBytes, fmtRate } from './fmt'
 import TaskOutput from './TaskOutput'
-import { Btn, Loading, Spinner, askText, toast } from './ui'
+import { askText, Btn, Loading, Meter, Spinner, toast } from './ui'
 import { useRefreshMs } from './prefs'
 import { Sensor, useSensorStream } from './sensors'
 
@@ -11,10 +11,6 @@ const KIND: Record<string, string> = { nvme: 'NVMe', ssd: 'SSD', hdd: 'HDD', usb
 const hours = (h: number) => (h >= 24 * 365 ? `${(h / 8760).toFixed(1)} y` : h >= 48 ? `${Math.round(h / 24)} d` : `${h} h`)
 const ago = (ms: number) => { const s = (Date.now() - ms) / 1000; return s < 3600 ? `${Math.round(s / 60)}m ago` : s < 86400 ? `${Math.round(s / 3600)}h ago` : `${Math.round(s / 86400)}d ago` }
 
-function Meter({ frac, cls }: { frac: number; cls?: string }) {
-  const c = cls ?? (frac >= 0.95 ? 'bad' : frac >= 0.85 ? 'warn' : '')
-  return <div className="meter"><div className={'fill ' + c} style={{ width: `${Math.min(100, Math.max(0, frac * 100))}%` }} /></div>
-}
 
 // ---- SMART panel ----
 function SmartPanel({ dev, rotational }: { dev: string; rotational: boolean }) {
@@ -109,82 +105,9 @@ function DeviceCard({ d, live, forceOpen }: { d: StorageDevice; live?: { read_bp
   )
 }
 
-// ---- ZFS ----
-function PoolCard({ p, onChanged }: { p: ZFSInfo['pools'][number]; onChanged: () => void }) {
-  const scrubbing = /scrub in progress/i.test(p.scan ?? '')
-  const paused = /scrub paused/i.test(p.scan ?? '')
-  const [cfg, setCfg] = useState(false)
-  const act = (a: 'start' | 'pause' | 'stop') => async () => {
-    try { await api.zfsScrub(p.name, a); toast(`scrub ${a}: ok`); onChanged() } catch (e) { toast(e instanceof Error ? e.message : 'failed', 'err') }
-  }
-  return (
-    <section className="card">
-      <div className="sub-head">
-        <span className={'dot ' + (p.health === 'ONLINE' ? 'ok' : p.health === 'DEGRADED' ? 'warn' : 'bad')} />
-        <span className="dname">{p.name}</span>
-        <span className="badge">{p.health}</span>
-        <span className="spacer" />
-        <span className="num">{fmtBytes(p.alloc)} / {fmtBytes(p.size)} · {p.cap}%</span>
-      </div>
-      <Meter frac={p.cap / 100} cls={p.cap >= 90 ? 'bad' : p.cap >= 80 ? 'warn' : ''} />
-      <div className="props" style={{ marginTop: 8 }}>
-        <div><span className="k">Free</span><span>{fmtBytes(p.free)} · fragmentation {p.frag}% · dedup {p.dedup}</span></div>
-        {p.scan && <div><span className="k">Scan</span><span style={{ whiteSpace: 'normal' }}>{p.scan}</span></div>}
-        {p.errors && <div><span className="k">Errors</span><span className={p.errors.startsWith('No known') ? '' : 'warn-text'}>{p.errors}</span></div>}
-      </div>
-      <div className="svc-actions">
-        {!scrubbing && <Btn className="btn" confirm={`Start a scrub of ${p.name}? It reads the whole pool and can take many hours.`} onClick={act('start')}>{paused ? 'Resume scrub' : 'Scrub'}</Btn>}
-        {scrubbing && <Btn className="btn" onClick={act('pause')}>Pause scrub</Btn>}
-        {(scrubbing || paused) && <Btn className="btn" confirm="Stop the scrub?" onClick={act('stop')}>Stop scrub</Btn>}
-        <button className="btn" onClick={() => setCfg(!cfg)}>{cfg ? 'Hide vdevs' : 'Vdevs'}</button>
-      </div>
-      {cfg && <pre className="unit-file">{p.config}</pre>}
-    </section>
-  )
-}
-
-function DatasetRow({ d, onChanged }: { d: ZFSInfo['datasets'][number]; onChanged: () => void }) {
-  const [snaps, setSnaps] = useState<ZFSSnapshot[] | null>(null)
-  const [open, setOpen] = useState(false)
-  async function toggle() {
-    setOpen(!open)
-    if (!open && !snaps) { try { setSnaps(await api.zfsSnapshots(d.name)) } catch (e) { toast(e instanceof Error ? e.message : 'failed', 'err'); setSnaps([]) } }
-  }
-  async function snapshot() {
-    const def = 'hamlab-' + new Date().toISOString().slice(0, 16).replace(/[-:T]/g, '').replace(/(\d{8})(\d{4})/, '$1-$2')
-    const name = await askText(`Snapshot name for ${d.name}@`, def)
-    if (!name) return
-    try { await api.zfsSnapshot(d.name, name.trim()); toast(`${d.name}@${name.trim()} created`); setSnaps(null); onChanged() }
-    catch (e) { toast(e instanceof Error ? e.message : 'failed', 'err') }
-  }
-  const depth = d.name.split('/').length - 1
-  return (
-    <>
-      <div className="ds-row" style={{ paddingLeft: 12 + depth * 16 }}>
-        <span className="ds-name" onClick={toggle}><span className="chev">{open ? '▾' : '▸'}</span>{d.name.split('/').pop()}{d.type === 'volume' && <span className="badge">zvol</span>}</span>
-        <span className="num">{fmtBytes(d.used)}</span>
-        <span className="num muted">{fmtBytes(d.refer)}</span>
-        <span className="num muted">{d.used_by_snapshots ? fmtBytes(d.used_by_snapshots) : '—'}</span>
-        <span className="num muted">{d.snapshots}</span>
-        <span className="num muted">{d.compressratio}</span>
-        <span className="ds-mount muted">{d.mount}</span>
-      </div>
-      {open && (
-        <div className="ds-snaps">
-          <div className="svc-actions"><Btn className="btn" onClick={snapshot}>Snapshot now</Btn><span className="muted">avail {fmtBytes(d.avail)}</span></div>
-          {snaps === null ? <div className="muted"><Spinner /> listing…</div> : snaps.length === 0 ? <div className="muted">No snapshots.</div> : (
-            <div className="snap-list">{snaps.slice().reverse().map((s) => <div key={s.name} className="snap"><span className="mono">{s.name.split('@')[1]}</span><span className="num muted">{new Date(s.created).toLocaleString()} · {fmtBytes(s.used)}</span></div>)}</div>
-          )}
-        </div>
-      )}
-    </>
-  )
-}
-
 // ---- page ----
 export default function Disks() {
   const [devs, setDevs] = useState<StorageDevice[] | null>(null)
-  const [zfs, setZfs] = useState<ZFSInfo | null>(null)
   const [hasSmart, setHasSmart] = useState(true)
   const [err, setErr] = useState('')
   const [task, setTask] = useState<string | null>(null)
@@ -194,7 +117,7 @@ export default function Disks() {
   const load = useCallback(async () => {
     try {
       const r = await api.storage()
-      setDevs(r.devices); setZfs(r.zfs); setHasSmart(r.smartctl); setErr('')
+      setDevs(r.devices); setHasSmart(r.smartctl); setErr('')
     } catch (e) { setErr(e instanceof Error ? e.message : 'failed') }
   }, [])
   useEffect(() => { load() }, [load])
@@ -237,18 +160,6 @@ export default function Disks() {
         {devs.map((d) => <DeviceCard key={d.name} d={d} live={liveFor(d)} forceOpen={allSmart ? true : null} />)}
       </div>
 
-      <div className="dash-bar"><h2 className="section">ZFS</h2></div>
-      {zfs && !zfs.available && <div className="notice">{zfs.message || 'No ZFS pools on this host.'}</div>}
-      {zfs?.available && zfs.pools.length === 0 && <div className="notice">ZFS is present but no pools are imported.</div>}
-      {zfs?.available && zfs.pools.length > 0 && (
-        <>
-          <div className="cards">{zfs.pools.map((p) => <PoolCard key={p.name} p={p} onChanged={load} />)}</div>
-          <section className="card datasets">
-            <div className="ds-row head"><span>Dataset</span><span className="num">Used</span><span className="num">Refer</span><span className="num">In snaps</span><span className="num">Snaps</span><span className="num">Ratio</span><span>Mount</span></div>
-            {zfs.datasets.map((d) => <DatasetRow key={d.name} d={d} onChanged={load} />)}
-          </section>
-        </>
-      )}
     </div>
   )
 }

web/src/Jobs.tsx

@@ -175,11 +175,11 @@ function TimerDetail({ t, onChanged, onBack }: { t: CronTimer; onChanged: () =>
 }
 
 // ---- page ----
-export default function Cron() {
+export default function Jobs() {
   const [ov, setOv] = useState<CronOverview | null>(null)
   const [err, setErr] = useState('')
   const [q, setQ] = useState('')
-  const [hashSel, setHashSel] = useHashSel('cron') // "job:<id>" or "timer:<unit>", in the URL
+  const [hashSel, setHashSel] = useHashSel('jobs') // "job:<id>" or "timer:<unit>", in the URL
   const sel = /^(job|timer):./.test(hashSel) ? { kind: hashSel.split(':')[0] as 'job' | 'timer', id: hashSel.slice(hashSel.indexOf(':') + 1) } : null
   const setSel = (v: { kind: 'job' | 'timer'; id: string } | null) => setHashSel(v ? `${v.kind}:${v.id}` : '')
   const [editing, setEditing] = useState<string | null>(null)
@@ -206,7 +206,7 @@ export default function Cron() {
   else pane = <div className="svc-empty muted">Select a job or timer.</div>
 
   return (
-    <div className={'cron' + (sel || editing ? ' has-sel' : '')}>
+    <div className={'cron jobs' + (sel || editing ? ' has-sel' : '')}>
       <div className="cron-list">
         <div className="svc-tools">
           <div className="tools-row"><input placeholder="filter jobs and timers" value={q} onChange={(e) => setQ(e.target.value)} /><Btn className="btn" title="reload" onClick={load}>↻</Btn></div>
@@ -218,7 +218,7 @@ export default function Cron() {
         {ov && !ov.logging && <div className="notice" style={{ margin: 8 }}>cron isn’t logging to the journal on this host, so “last run” is unavailable for cron jobs.</div>}
         <div className="cron-rows">
           {!ov && !err && <Loading label="Reading crontabs…" />}
-          {ov && <h3>Cron jobs · {jobs.length}</h3>}
+          {ov && <h3>Scheduled jobs · {jobs.length}</h3>}
           {jobs.map((j) => (
             <div key={j.id} className={'cron-row' + (sel?.kind === 'job' && sel.id === j.id ? ' active' : '') + (j.enabled ? '' : ' off')} onClick={() => { setEditing(null); setSel({ kind: 'job', id: j.id }) }}>
               <span className={'sdot ' + (j.enabled ? 'ok' : '')} />

web/src/Shell.tsx

@@ -8,14 +8,15 @@ import Gallery from './Gallery'
 import Docker from './Docker'
 import Alerts from './Alerts'
 import Services from './Services'
-import Cron from './Cron'
+import Jobs from './Jobs'
 import Updates from './Updates'
 import Disks from './Disks'
+import ZFS from './ZFS'
 import Files from './Files'
 import Top from './Top'
 import Machines from './Machines'
 import Settings from './Settings'
-import Space from './Space'
+import Usage from './Usage'
 import Users from './Users'
 import MachineSwitcher from './MachineSwitcher'
 import { MachineStatus, setMachine } from './api'
@@ -54,10 +55,11 @@ const GROUPS: Group[] = [
   { id: 'terminal', label: 'Terminal', icon: '>_' },
   { id: 'services', label: 'Services', icon: '◈' },
   { id: 'docker', label: 'Docker', icon: DockerIcon },
-  { id: 'cron', label: 'Cron', icon: ClockIcon },
+  { id: 'jobs', label: 'Jobs', icon: ClockIcon },
   { id: 'updates', label: 'Updates', icon: '⇪' },
   { id: 'disks', label: 'Disks', icon: '▤' },
-  { id: 'space', label: 'Space', icon: '▧' },
+  { id: 'zfs', label: 'ZFS', icon: '⛁' },
+  { id: 'usage', label: 'Usage', icon: '▧' },
   { id: 'files', label: 'Files', icon: FolderIcon },
   { id: 'alerts', label: 'Alerts', icon: BellIcon },
   { id: 'machines', label: 'Machines', icon: '⌂' },
@@ -66,16 +68,21 @@ const GROUPS: Group[] = [
   { id: 'settings', label: 'Settings', icon: '⚙' },
 ]
 
-type View = 'terminal' | 'widgets' | 'docker' | 'alerts' | 'services' | 'cron' | 'updates' | 'disks' | 'space' | 'files' | 'procs' | 'machines' | 'users' | 'settings'
+type View = 'terminal' | 'widgets' | 'docker' | 'alerts' | 'services' | 'jobs' | 'updates' | 'disks' | 'zfs' | 'usage' | 'files' | 'procs' | 'machines' | 'users' | 'settings'
-const VIEWS: View[] = ['terminal', 'widgets', 'docker', 'alerts', 'services', 'cron', 'updates', 'disks', 'space', 'files', 'procs', 'machines', 'users', 'settings']
+const VIEWS: View[] = ['terminal', 'widgets', 'docker', 'alerts', 'services', 'jobs', 'updates', 'disks', 'zfs', 'usage', 'files', 'procs', 'machines', 'users', 'settings']
 const HUB_ONLY: View[] = ['machines', 'users', 'settings', 'alerts']
 
 // URL hash is the source of truth for where you are: #/<machine|hub>/<view>. Back and
 // forward work, reload restores the tab, and links can point at a page on a machine.
+// Pages that were renamed, so a link or a bookmark made before it still lands where it meant.
+const RENAMED_VIEWS: Record<string, View> = { space: 'usage', cron: 'jobs', top: 'procs', dashboard: 'procs' }
+
 function parseHash(): { machine: string | null; view: View } | null {
   const m = location.hash.match(/^#\/([a-z0-9-]+)\/([a-z]+)(?:\/.*)?$/) // anything after the page is that page's own selection
-  if (!m || !VIEWS.includes(m[2] as View)) return null
+  if (!m) return null
-  return { machine: m[1] === 'hub' ? null : m[1], view: m[2] as View }
+  const view = VIEWS.includes(m[2] as View) ? (m[2] as View) : RENAMED_VIEWS[m[2]]
+  if (!view) return null
+  return { machine: m[1] === 'hub' ? null : m[1], view }
 }
 
 function fmtUptime(s: number): string {
@@ -262,16 +269,17 @@ export default function Shell({ me: hubMe, onLoggedOut }: { me: Me; onLoggedOut:
         <main className="main" key={machine ?? 'hub'}>
           {view === 'settings' && <Settings me={hubMe} />}
           {view === 'users' && <Users me={hubMe} />}
-          {view === 'space' && <Space key={machine ?? ''} />}
+          {view === 'usage' && <Usage key={machine ?? ''} />}
           {view === 'machines' && <Machines hub={hubMe} onChanged={loadMachines} onOpen={(n) => { switchMachine(n); setView('procs') }} />}
           {view === 'widgets' && <Gallery />}
           {view === 'docker' && <Docker />}
           {view === 'alerts' && <Alerts machines={machines.map((m) => m.name)} titleOf={(n) => titleOf(n === hubMe.host ? null : n, machines, hubMe.host)} />}
           {view === 'procs' && <Top />}
           {view === 'services' && <Services />}
-          {view === 'cron' && <Cron />}
+          {view === 'jobs' && <Jobs />}
           {view === 'updates' && <Updates />}
           {view === 'disks' && <Disks />}
+          {view === 'zfs' && <ZFS />}
           {view === 'files' && <Files onOpenInTerminal={runInTerminal} />}
           {termView && <TermTabs terms={ordered} active={active} creating={creating}
             onSelect={setActive} onNew={create} onRename={rename} onClose={close} onMove={moveTab}
@@ -298,7 +306,7 @@ export default function Shell({ me: hubMe, onLoggedOut }: { me: Me; onLoggedOut:
         <span>{machine ? `${title} · ` : ''}{me.version.startsWith('v') ? me.version : 'v' + me.version}</span>
         <span>up {fmtUptime(me.uptime)}</span>
         <span className="spacer" />
-        <span className="muted">{view === 'widgets' ? 'Widgets' : view === 'docker' ? 'Docker' : view === 'alerts' ? 'Alerts' : view === 'services' ? 'Services' : view === 'cron' ? 'Cron' : view === 'updates' ? 'Updates' : view === 'disks' ? 'Disks' : view === 'space' ? 'Space' : view === 'files' ? 'Files' : view === 'procs' ? 'Processes' : view === 'machines' ? 'Machines' : view === 'users' ? 'Users' : view === 'settings' ? 'Settings' : activeTerm ? activeTerm.name : ''}</span>
+        <span className="muted">{view === 'widgets' ? 'Widgets' : view === 'docker' ? 'Docker' : view === 'alerts' ? 'Alerts' : view === 'services' ? 'Services' : view === 'jobs' ? 'Jobs' : view === 'updates' ? 'Updates' : view === 'disks' ? 'Disks' : view === 'zfs' ? 'ZFS' : view === 'usage' ? 'Usage' : view === 'files' ? 'Files' : view === 'procs' ? 'Processes' : view === 'machines' ? 'Machines' : view === 'users' ? 'Users' : view === 'settings' ? 'Settings' : activeTerm ? activeTerm.name : ''}</span>
       </footer>
     </div>
   )

web/src/Top.tsx

@@ -250,6 +250,20 @@ export default function Top() {
 
   // the process table, and the CPU model, come from the same place the Processes page reads
   const [pt, setPt] = useState<ProcTable | null>(null)
+  const [pickedIf, setPickedIf] = useState<string | null>(null) // which NIC the net box draws
+  // Which pool each drive belongs to, asked once: a drive in a ZFS pool has no filesystem of
+  // its own, and "nothing is on it" would be a lie about eight drives holding a NAS.
+  const [pools, setPools] = useState<Record<string, string>>({})
+  useEffect(() => {
+    let live = true
+    api.storage().then((r) => {
+      if (!live) return
+      const m: Record<string, string> = {}
+      for (const d of r.devices) for (const part of d.parts) if (part.fstype === 'zfs_member' && part.label) m[d.name] = part.label
+      setPools(m)
+    }).catch(() => { /* the rows simply say less */ })
+    return () => { live = false }
+  }, [])
   const [err, setErr] = useState('')
   useEffect(() => {
     let stop = false
@@ -319,8 +333,12 @@ export default function Top() {
   const free = (mem as { free?: number }).free ?? Math.max(0, mem.total - mem.used - cached)
   const swap = s?.swap ?? pt?.swap
   const net = (s?.net ?? pt?.net ?? []).filter((n) => n.up && n.iface !== 'lo')
-  const iface = net[0]
+  // the one that has actually carried traffic, not whichever the kernel listed first — wg0
-  const fs = s?.fs ?? []
+  // and a dormant wlan should not push the real NIC out of the way. Tapping a name switches.
+  const busiest = net.length ? net.reduce((a, b) => (b.rx_total + b.tx_total > a.rx_total + a.tx_total ? b : a)) : undefined
+  const iface = net.find((n) => n.iface === pickedIf) ?? busiest
+  // the disks box is this machine's own storage: a CIFS or NFS share is somebody else's disk
+  const fs = (s?.fs ?? []).filter((f) => !f.remote)
   const pct = (a: number, b: number) => (b > 0 ? (a / b) * 100 : 0)
   // the top of a graph's scale: the peak of what it is drawing — the window, not everything kept
   const peak = (id: string) => Math.max(1, ...(curves.get(id) ?? []).slice(-cap))
@@ -378,18 +396,26 @@ export default function Top() {
 
       <Box n={3} name="disks" className="top-disks" right="io">
         <div className="t-disks">
-          {swap && swap.total > 0 && <Disk name="swap" size={swap.total} used={swap.used} />}
+          {(s?.disks ?? []).map((d) => {
-          {fs.map((f) => {
+            // what is on this drive: the filesystems the sampler could attribute to it. A ZFS
-            // which drive is behind a mount isn't in the sample, so only the root filesystem
+            // pool or an md array spans several drives, so nothing is attributed and the row
-            // gets an IO line, against the machine's largest drive — which is the one it is on
+            // shows what is true of the hardware — how busy it is, and how hot.
-            const d = f.mount === '/' ? [...(s?.disks ?? [])].sort((a, b) => b.size - a.size)[0] : undefined
+            const on = fs.filter((f) => f.disk === d.name)
-            return <Disk key={f.mount} name={f.mount === '/' ? 'root' : f.mount.split('/').filter(Boolean).pop() ?? f.mount} size={f.size} used={f.used} io={d ? d.util_pct : undefined} />
+            const used = on.reduce((a, f) => a + f.used, 0)
+            return <Disk key={d.name} name={d.name} note={d.model} size={d.size} used={on.length ? used : undefined} io={d.util_pct} temp={d.temp} mounts={on.map((f) => f.mount)} pool={pools[d.name]} />
           })}
-          {fs.length === 0 && <div className="t-dim">no filesystems reported</div>}
+          {(s?.disks ?? []).length === 0 && <div className="t-dim">no drives reported</div>}
         </div>
       </Box>
 
-      <Box n={4} name="net" className="top-net" right={iface ? <span className="t-if">{iface.iface}</span> : undefined}>
+      <Box n={4} name="net" className="top-net" right={net.length ? (
+        <span className="t-ifs">
+          {net.map((n) => (
+            <button key={n.iface} className={'t-if' + (iface && n.iface === iface.iface ? ' on' : '')}
+              title={`${n.iface} — ${bytes(n.rx_total)} in, ${bytes(n.tx_total)} out`} onClick={() => setPickedIf(n.iface)}>{n.iface}</button>
+          ))}
+        </span>
+      ) : undefined}>
         {iface ? (
           <div className="t-net">
             <div className="t-net-graphs">
@@ -470,14 +496,29 @@ const Rows = memo(function Rows({ procs, sel, onSel, curves, empty }: { procs: P
   )
 })
 
-function Disk({ name, size, used, io }: { name: string; size: number; used: number; io?: number }) {
+// One physical drive. `used` is the bytes of the filesystems on it, left out when none can
-  const upct = size > 0 ? (used / size) * 100 : 0
+// be attributed to it — a pool member's share of a pool is not a number worth inventing.
+function Disk({ name, note, size, used, io, temp, mounts, pool }: { name: string; note?: string; size: number; used?: number; io?: number; temp?: number; mounts?: string[]; pool?: string }) {
+  const upct = used !== undefined && size > 0 ? (used / size) * 100 : 0
   return (
     <div className="t-disk">
-      <div className="t-row"><b>{name}</b><span className="spacer" />{bytes(size)}</div>
+      <div className="t-row">
+        <b>{name}</b>
+        {note && <span className="t-dim t-model" title={note}>{note}</span>}
+        <span className="spacer" />
+        {temp !== undefined && temp > 0 && <span className="t-temp">{Math.round(temp)}°C</span>}
+        {bytes(size)}
+      </div>
       {io !== undefined && <div className="t-row t-sub"><span>IO%</span><Meter pct={io} grad="io" /></div>}
-      <div className="t-row t-sub"><span>Used:</span><span className="t-pct">{Math.round(upct)}%</span><Meter pct={upct} grad="used" /><span className="t-amt">{bytes(used, 1)}</span></div>
+      {used !== undefined ? (
-      <div className="t-row t-sub"><span>Free:</span><span className="t-pct">{Math.round(100 - upct)}%</span><Meter pct={100 - upct} grad="free" /><span className="t-amt">{bytes(Math.max(0, size - used), 1)}</span></div>
+        <>
+          <div className="t-row t-sub"><span>Used:</span><span className="t-pct">{Math.round(upct)}%</span><Meter pct={upct} grad="used" /><span className="t-amt">{bytes(used, 1)}</span></div>
+          <div className="t-row t-sub"><span>Free:</span><span className="t-pct">{Math.round(100 - upct)}%</span><Meter pct={100 - upct} grad="free" /><span className="t-amt">{bytes(Math.max(0, size - used), 1)}</span></div>
+          {mounts && mounts.length > 0 && <div className="t-row t-sub t-dim t-mounts" title={mounts.join('  ')}>{mounts.join(' ')}</div>}
+        </>
+      ) : (
+        <div className="t-row t-sub t-dim">{pool ? `member of ZFS pool ${pool}` : 'nothing mounted from it'}</div>
+      )}
     </div>
   )
 }

web/src/Usage.tsx

@@ -1,4 +1,5 @@
-// Space: what is using a disk, WizTree-style. Pick a disk, scan it (a parallel walk of every
+// Usage: what is using a disk, WizTree-style. (The tab was called Space until 2026-09-24;
+// the Go package and the /api/space endpoints behind it still carry the old name.) Pick a disk, scan it (a parallel walk of every
 // filesystem the disk backs, as root when the host allows), then read the result two ways:
 // a tree of folders largest-first, and a treemap of whatever folder is selected, where every
 // file is a tile sized by what it takes on disk and coloured by what kind of thing it is.
@@ -45,10 +46,10 @@ const ago = (iso?: string) => {
 const fmtDur = (a: string, b?: string) => { const ms = (b ? new Date(b).getTime() : Date.now()) - new Date(a).getTime(); return ms < 1000 ? `${ms} ms` : ms < 60000 ? `${(ms / 1000).toFixed(1)} s` : `${Math.floor(ms / 60000)} min ${Math.round((ms % 60000) / 1000)} s` }
 const parentOf = (p: string) => (p === '/' ? '/' : p.slice(0, p.lastIndexOf('/')) || '/')
 
-export default function Space() {
+export default function Usage() {
   const [targets, setTargets] = useState<SpaceTarget[] | null>(null)
   const [err, setErr] = useState('')
-  const [sel, setSel] = useHashSel('space')
+  const [sel, setSel] = useHashSel('usage')
   const [tab, setTab] = useState<'tree' | 'files'>('tree')
   const rate = useRefreshMs()
 

web/src/ZFS.tsx

@@ -0,0 +1,359 @@
+// ZFS: pools, datasets, snapshots, and a schedule for taking and expiring them.
+//
+// Split out of the Disks tab on 2026-09-24. Disks is the hardware; this is the filesystem
+// on top of it, which has enough of its own to say.
+//
+// On the schedule: `grid` has run zfSnap from root cron since before Ham Lab existed, and it
+// works. So this reads and writes the same snapshot names — `2026-09-24_02.30.01--6w`, with
+// the retention in the name — rather than inventing a second convention for the two tools to
+// disagree over. An existing cron job is detected and shown, so the page tells the truth
+// about the machine whether Ham Lab or something else is doing the work.
+import { FormEvent, useCallback, useEffect, useState } from 'react'
+import { api, ZFSExternal, ZFSInfo, ZFSOverview, ZFSPolicy, ZFSRun, ZFSSnapshot } from './api'
+import { fmtBytes } from './fmt'
+import { useRefreshMs } from './prefs'
+import { askText, askYes, Btn, Loading, Meter, Spinner, toast, useEscape } from './ui'
+
+const ago = (t?: string | number) => {
+  if (!t) return 'never'
+  const s = Math.max(0, (Date.now() - new Date(t).getTime()) / 1000)
+  return s < 60 ? 'just now' : s < 3600 ? `${Math.floor(s / 60)} min ago` : s < 86400 ? `${Math.floor(s / 3600)} h ago` : `${Math.floor(s / 86400)} d ago`
+}
+const soon = (t?: string) => {
+  if (!t) return '—'
+  const s = (new Date(t).getTime() - Date.now()) / 1000
+  return s < 60 ? 'any moment' : s < 3600 ? `in ${Math.round(s / 60)} min` : s < 86400 ? `in ${Math.round(s / 3600)} h` : `in ${Math.round(s / 86400)} d`
+}
+const WEEKDAYS = ['Sunday', 'Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday']
+const describe = (p: ZFSPolicy) => {
+  const when = p.every === 'custom' ? `on ${p.cron}`
+    : p.every === 'hourly' ? `every hour at :${(p.at.split(':')[1] ?? '00').padStart(2, '0')}`
+    : p.every === 'daily' ? `every day at ${p.at}`
+      : p.every === 'weekly' ? `every ${WEEKDAYS[p.weekday] ?? 'Sunday'} at ${p.at}`
+        : `on day ${p.day} of the month at ${p.at}`
+  return `${when} · keep ${p.keep_for}${p.recursive ? ' · recursive' : ''}`
+}
+
+// ---- pools and datasets (moved from the Disks tab) ----
+function PoolCard({ p, onChanged }: { p: ZFSInfo['pools'][number]; onChanged: () => void }) {
+  const scrubbing = /scrub in progress/i.test(p.scan ?? '')
+  const paused = /scrub paused/i.test(p.scan ?? '')
+  const [cfg, setCfg] = useState(false)
+  const act = (a: 'start' | 'pause' | 'stop') => async () => {
+    try { await api.zfsScrub(p.name, a); toast(`scrub ${a}: ok`); onChanged() } catch (e) { toast(e instanceof Error ? e.message : 'failed', 'err') }
+  }
+  return (
+    <section className="card">
+      <div className="sub-head">
+        <span className={'dot ' + (p.health === 'ONLINE' ? 'ok' : p.health === 'DEGRADED' ? 'warn' : 'bad')} />
+        <span className="dname">{p.name}</span>
+        <span className="badge">{p.health}</span>
+        <span className="spacer" />
+        <span className="num">{fmtBytes(p.alloc)} / {fmtBytes(p.size)} · {p.cap}%</span>
+      </div>
+      <Meter frac={p.cap / 100} cls={p.cap >= 90 ? 'bad' : p.cap >= 80 ? 'warn' : ''} />
+      <div className="props" style={{ marginTop: 8 }}>
+        <div><span className="k">Free</span><span>{fmtBytes(p.free)} · fragmentation {p.frag}% · dedup {p.dedup}</span></div>
+        {p.scan && <div><span className="k">Scan</span><span style={{ whiteSpace: 'normal' }}>{p.scan}</span></div>}
+        {p.errors && <div><span className="k">Errors</span><span className={p.errors.startsWith('No known') ? '' : 'warn-text'}>{p.errors}</span></div>}
+      </div>
+      <div className="svc-actions">
+        {!scrubbing && <Btn className="btn" confirm={`Start a scrub of ${p.name}? It reads the whole pool and can take many hours.`} onClick={act('start')}>{paused ? 'Resume scrub' : 'Scrub'}</Btn>}
+        {scrubbing && <Btn className="btn" onClick={act('pause')}>Pause scrub</Btn>}
+        {(scrubbing || paused) && <Btn className="btn" confirm="Stop the scrub?" onClick={act('stop')}>Stop scrub</Btn>}
+        <button className="btn" onClick={() => setCfg(!cfg)}>{cfg ? 'Hide vdevs' : 'Vdevs'}</button>
+      </div>
+      {cfg && <pre className="unit-file">{p.config}</pre>}
+    </section>
+  )
+}
+
+// A snapshot's name carries when it was taken and how long it lives — 2026-09-24_02.30.01--6w
+// — so the explorer can say when each one goes without asking the server anything.
+function snapMeta(full: string): { taken?: Date; expires?: Date } {
+  const snap = full.split('@')[1] ?? ''
+  const [body, ttl] = snap.split('--')
+  const m = /(\d{4})-(\d{2})-(\d{2})_(\d{2})\.(\d{2})\.(\d{2})$/.exec(body)
+  if (!m) return {}
+  const taken = new Date(+m[1], +m[2] - 1, +m[3], +m[4], +m[5], +m[6])
+  const a = /^(\d+)([mhdw])$/.exec(ttl ?? '')
+  if (!a) return { taken }
+  const ms = { m: 60e3, h: 3600e3, d: 86400e3, w: 7 * 86400e3 }[a[2]]!
+  return { taken, expires: new Date(taken.getTime() + +a[1] * ms) }
+}
+
+// One dataset in the snapshot explorer: how many it has and what they cost, opening into
+// the snapshots themselves, each of which can be taken now or deleted.
+function DatasetRow({ d, onChanged }: { d: ZFSInfo['datasets'][number]; onChanged: () => void }) {
+  const [snaps, setSnaps] = useState<ZFSSnapshot[] | null>(null)
+  const [open, setOpen] = useState(false)
+  const reload = useCallback(async () => {
+    try { setSnaps(await api.zfsSnapshots(d.name)) } catch (e) { toast(e instanceof Error ? e.message : 'failed', 'err'); setSnaps([]) }
+  }, [d.name])
+  async function toggle() {
+    setOpen(!open)
+    if (!open && !snaps) await reload()
+  }
+  async function snapshot() {
+    const def = new Date().toISOString().slice(0, 19).replace('T', '_').replace(/:/g, '.')
+    const name = await askText(`Snapshot name for ${d.name}@`, def)
+    if (!name) return
+    try { await api.zfsSnapshot(d.name, name.trim()); toast(`${d.name}@${name.trim()} created`); await reload(); onChanged() }
+    catch (e) { toast(e instanceof Error ? e.message : 'failed', 'err') }
+  }
+  async function destroy(s: ZFSSnapshot) {
+    const short = s.name.split('@')[1]
+    if (!await askYes(`Delete ${s.name}? It is removed from this dataset and from every dataset beneath it that has a snapshot of the same name. This cannot be undone.`, 'Delete')) return
+    try { await api.deleteZfsSnapshot(s.name, true); toast(`${short} deleted`); await reload(); onChanged() }
+    catch (e) { toast(e instanceof Error ? e.message : 'failed', 'err') }
+  }
+  const depth = d.name.split('/').length - 1
+  return (
+    <>
+      <div className="ds-row" style={{ paddingLeft: 12 + depth * 16 }}>
+        <span className="ds-name" onClick={toggle}><span className="chev">{open ? '▾' : '▸'}</span>{d.name.split('/').pop()}{d.type === 'volume' && <span className="badge">zvol</span>}</span>
+        <span className="num">{d.snapshots}</span>
+        <span className="num muted">{d.used_by_snapshots ? fmtBytes(d.used_by_snapshots) : '—'}</span>
+        <span className="num muted">{fmtBytes(d.used)}</span>
+        <span className="num muted">{fmtBytes(d.refer)}</span>
+        <span className="ds-mount muted">{d.mount}</span>
+      </div>
+      {open && (
+        <div className="ds-snaps">
+          <div className="svc-actions"><Btn className="btn" onClick={snapshot}>Snapshot now</Btn><span className="muted small">{d.snapshots} snapshot{d.snapshots === 1 ? '' : 's'} · {fmtBytes(d.avail)} free on this dataset</span></div>
+          {snaps === null ? <div className="muted"><Spinner /> listing…</div> : snaps.length === 0 ? <div className="muted">No snapshots.</div> : (
+            <div className="snap-list">{snaps.slice().reverse().map((s) => {
+              const { taken, expires } = snapMeta(s.name)
+              const gone = expires && expires.getTime() < Date.now()
+              return (
+                <div key={s.name} className="snap">
+                  <span className="mono snap-name" title={s.name}>{s.name.split('@')[1]}</span>
+                  <span className="muted snap-when">{taken ? taken.toLocaleString() : new Date(s.created).toLocaleString()}</span>
+                  <span className={'muted snap-exp' + (gone ? ' warn' : '')}>{expires ? (gone ? 'expired' : `expires ${expires.toLocaleDateString()}`) : 'kept'}</span>
+                  <span className="num muted">{fmtBytes(s.used)}</span>
+                  <Btn className="btn danger snap-del" onClick={() => destroy(s)}>Delete</Btn>
+                </div>
+              )
+            })}</div>
+          )}
+        </div>
+      )}
+    </>
+  )
+}
+
+// ---- schedules ----
+
+function ExternalNotice({ x, mine, onAdopt }: { x: ExternalJob; mine: number; onAdopt: () => void }) {
+  return (
+    <div className={'notice' + (mine > 0 ? ' attn' : '')} style={{ marginBottom: 8 }}>
+      <b>{x.tool}</b> is already taking snapshots on this machine, from cron as <b>{x.user}</b>:
+      <div className="mono small" style={{ margin: '4px 0', wordBreak: 'break-all' }}>{x.schedule} &nbsp; {x.command}</div>
+      <span className="muted">in {x.source}{x.last ? ` · last ran ${ago(x.last)}` : ''}</span>
+      {mine > 0
+        ? <div className="warn" style={{ marginTop: 6 }}>A Ham Lab schedule is running as well. Both use the same names and both only remove snapshots that have passed the expiry written into them, so they will not fight — but they will take twice as many. Keep one.</div>
+        : <div className="svc-actions" style={{ marginTop: 6 }}>
+            <Btn className="btn" onClick={onAdopt}>Adopt as a schedule</Btn>
+            <span className="muted small">Copies it into a Ham Lab schedule you can edit here. Turn the old cron job off on the Jobs tab once you are happy with it.</span>
+          </div>}
+    </div>
+  )
+}
+type ExternalJob = ZFSExternal
+
+function ScheduleCard({ p, cron, next, last, onChanged, onEdit }: { p: ZFSPolicy; cron: string; next?: string; last: ZFSRun; onChanged: () => void; onEdit: () => void }) {
+  const [busy, setBusy] = useState('')
+  const run = async () => {
+    if (!await askYes(`Take a snapshot of ${p.dataset} now? Snapshots past their retention are removed at the same time, as they would be on the schedule.`, 'Run now')) return
+    setBusy('run')
+    try { const r = await api.runZfsSchedule(p.id); toast(`${r.taken}${r.pruned.length ? ` · ${r.pruned.length} expired removed` : ''}`); onChanged() }
+    catch (e) { toast(e instanceof Error ? e.message : 'failed', 'err') } finally { setBusy('') }
+  }
+  const remove = async () => {
+    if (!await askYes(`Remove the schedule "${p.name}"? The snapshots it already took are left exactly as they are.`, 'Remove')) return
+    try { await api.deleteZfsSchedule(p.id); toast('schedule removed'); onChanged() } catch (e) { toast(e instanceof Error ? e.message : 'failed', 'err') }
+  }
+  const toggle = async () => {
+    try { await api.saveZfsSchedule({ ...p, enabled: !p.enabled }); onChanged() } catch (e) { toast(e instanceof Error ? e.message : 'failed', 'err') }
+  }
+  return (
+    <section className="card">
+      <div className="sub-head">
+        <span className={'dot ' + (last.error ? 'bad' : p.enabled ? 'ok' : '')} />
+        <span className="dname">{p.name || p.dataset}</span>
+        {!p.enabled && <span className="badge">paused</span>}
+        <span className="spacer" />
+        <span className="muted small">{p.enabled ? soon(next) : 'not scheduled'}</span>
+      </div>
+      <div className="props" style={{ marginTop: 6 }}>
+        <div><span className="k">Dataset</span><span className="mono">{p.dataset}</span></div>
+        <div><span className="k">When</span><span>{describe(p)}</span></div>
+        <div><span className="k">Cron</span><span className="mono small" title={`in ${'/etc/cron.d/hamlab-zfs'}`}>{cron}</span></div>
+        <div><span className="k">Last run</span><span>{ago(last.at)}{last.pruned?.length ? ` · ${last.pruned.length} expired removed` : ''}</span></div>
+        {last.taken && <div><span className="k">Last snapshot</span><span className="mono small">{last.taken.split('@')[1]}</span></div>}
+        {p.keep_min > 0 && <div><span className="k">Floor</span><span>always keep the newest {p.keep_min}</span></div>}
+      </div>
+      {last.error && <div className="error" style={{ marginTop: 8 }}>{last.error}</div>}
+      <div className="svc-actions">
+        <Btn className="btn on" busy={busy === 'run'} onClick={run}>Run now</Btn>
+        <button className="btn" onClick={onEdit}>Edit</button>
+        <Btn className="btn" onClick={toggle}>{p.enabled ? 'Pause' : 'Resume'}</Btn>
+        <Btn className="btn danger" onClick={remove}>Remove</Btn>
+      </div>
+    </section>
+  )
+}
+
+const BLANK: Partial<ZFSPolicy> = { name: '', dataset: '', recursive: true, every: 'daily', at: '02:30', weekday: 0, day: 1, keep_for: '6w', keep_min: 1, enabled: true }
+
+function ScheduleDialog({ p, datasets, onClose, onSaved }: { p: Partial<ZFSPolicy>; datasets: string[]; onClose: () => void; onSaved: () => void }) {
+  const [f, setF] = useState<Partial<ZFSPolicy>>({ ...BLANK, ...p })
+  const [err, setErr] = useState('')
+  useEscape(onClose)
+  const set = (k: keyof ZFSPolicy, v: unknown) => setF((x) => ({ ...x, [k]: v }))
+  const save = async (e: FormEvent) => {
+    e.preventDefault(); setErr('')
+    try { await api.saveZfsSchedule({ ...f, name: (f.name || '').trim() || f.dataset }); onSaved() }
+    catch (e) { setErr(e instanceof Error ? e.message : 'failed') }
+  }
+  return (
+    <div className="modal-back" onClick={onClose}>
+      <form className="modal" onClick={(e) => e.stopPropagation()} onSubmit={save}>
+        <h3>{f.id ? 'Edit schedule' : 'New snapshot schedule'}</h3>
+        <label className="muted">Dataset
+          <select value={f.dataset} onChange={(e) => set('dataset', e.target.value)} required>
+            <option value="">choose…</option>
+            {datasets.map((d) => <option key={d} value={d}>{d}</option>)}
+          </select>
+        </label>
+        <label className="muted">Name — what this schedule is for
+          <input value={f.name} onChange={(e) => set('name', e.target.value)} placeholder={f.dataset || 'nightly'} maxLength={64} />
+        </label>
+        <label className="muted">How often
+          <span className="chips">
+            {(['hourly', 'daily', 'weekly', 'monthly', 'custom'] as const).map((k) => (
+              <button type="button" key={k} className={'chip' + (f.every === k ? ' on' : '')} onClick={() => set('every', k)}>{k}</button>
+            ))}
+          </span>
+        </label>
+        {f.every === 'custom' ? (
+          <label className="muted">Cron expression — minute hour day month weekday
+            <input className="mono" value={f.cron ?? ''} onChange={(e) => set('cron', e.target.value)} placeholder="0 */6 * * *" spellCheck={false} required />
+          </label>
+        ) : (
+          <label className="muted">At
+            <input type="time" value={f.at} onChange={(e) => set('at', e.target.value)} />
+          </label>
+        )}
+        {f.every === 'weekly' && (
+          <label className="muted">On
+            <select value={f.weekday} onChange={(e) => set('weekday', Number(e.target.value))}>
+              {WEEKDAYS.map((d, i) => <option key={d} value={i}>{d}</option>)}
+            </select>
+          </label>
+        )}
+        {f.every === 'monthly' && (
+          <label className="muted">Day of the month — 1 to 28, so every month has one
+            <input type="number" min={1} max={28} value={f.day} onChange={(e) => set('day', Number(e.target.value))} />
+          </label>
+        )}
+        <label className="muted">Snapshot name prefix — optional; the timestamp and retention follow it
+          <input value={f.prefix ?? ''} onChange={(e) => set('prefix', e.target.value)} placeholder="none" spellCheck={false} />
+        </label>
+        <label className="muted">Keep for — written into each snapshot's name, as zfSnap does it: 6w, 30d, 12h
+          <input value={f.keep_for} onChange={(e) => set('keep_for', e.target.value)} placeholder="6w" spellCheck={false} required />
+        </label>
+        <label className="muted">Always keep the newest — a floor, whatever their age
+          <input type="number" min={0} max={99} value={f.keep_min} onChange={(e) => set('keep_min', Number(e.target.value))} />
+        </label>
+        <label className="muted" style={{ flexDirection: 'row', alignItems: 'center', gap: 8 }}>
+          <input type="checkbox" checked={!!f.recursive} onChange={(e) => set('recursive', e.target.checked)} style={{ width: 'auto' }} />
+          Recursive — one atomic snapshot of this dataset and everything under it
+        </label>
+        <label className="muted" style={{ flexDirection: 'row', alignItems: 'center', gap: 8 }}>
+          <input type="checkbox" checked={!!f.enabled} onChange={(e) => set('enabled', e.target.checked)} style={{ width: 'auto' }} />
+          Enabled
+        </label>
+        {err && <div className="error">{err}</div>}
+        <div className="svc-actions">
+          <button type="submit" className="btn on" disabled={!f.dataset || !f.keep_for}>Save</button>
+          <span className="spacer" />
+          <button type="button" className="btn" onClick={onClose}>Cancel</button>
+        </div>
+      </form>
+    </div>
+  )
+}
+
+// adopt reads an existing cron job into the fields of a new schedule, so replacing it is a
+// matter of checking the numbers rather than retyping them. zfSnap's own flags are read
+// where they can be: -a <age> is the retention, -r is recursive.
+function adopt(x: ExternalJob, fallbackDataset: string): Partial<ZFSPolicy> {
+  const cmd = x.command
+  const keep = /-a\s+(\d+[mhdwMy])/.exec(cmd)?.[1] ?? /--\s*(\d+[mhdw])\b/.exec(cmd)?.[1] ?? '6w'
+  const f = x.schedule.trim().split(/\s+/)
+  const min = Number(f[0]), hour = Number(f[1])
+  const simple = f.length === 5 && Number.isInteger(min) && Number.isInteger(hour) && f[2] === '*' && f[3] === '*' && f[4] === '*'
+  const ds = /\b(tank[\w/-]*)\b/.exec(cmd)?.[1] ?? fallbackDataset
+  return {
+    ...BLANK, name: `${x.tool} (adopted)`, dataset: ds,
+    recursive: /\s-\w*r/.test(cmd) || true,
+    every: simple ? 'daily' : 'custom',
+    at: simple ? `${String(hour).padStart(2, '0')}:${String(min).padStart(2, '0')}` : '02:30',
+    cron: simple ? '' : x.schedule.trim(),
+    keep_for: keep, keep_min: 1, enabled: true,
+  }
+}
+
+// ---- page ----
+
+export default function ZFS() {
+  const [ov, setOv] = useState<ZFSOverview | null>(null)
+  const [err, setErr] = useState('')
+  const [editing, setEditing] = useState<Partial<ZFSPolicy> | null>(null)
+  const rate = useRefreshMs()
+
+  const load = useCallback(async () => {
+    try { setOv(await api.zfsOverview()); setErr('') } catch (e) { setErr(e instanceof Error ? e.message : 'failed') }
+  }, [])
+  useEffect(() => { load() }, [load])
+  useEffect(() => { const t = setInterval(load, Math.max(5000, rate * 10)); return () => clearInterval(t) }, [load, rate])
+
+  if (err && !ov) return <div className="dash"><div className="error">{err}</div></div>
+  if (!ov) return <div className="dash"><Loading label="Reading ZFS…" /></div>
+  const zfs: ZFSInfo = ov.zfs
+  const datasets = zfs.datasets.filter((d) => d.type !== 'volume').map((d) => d.name)
+  const mine = ov.policies.filter((x) => x.policy.enabled).length
+
+  if (!zfs.available) return <div className="dash"><div className="notice">{zfs.message || 'No ZFS on this host.'}</div></div>
+
+  return (
+    <div className="dash">
+      <div className="dash-bar"><h2 className="section">Pools</h2></div>
+      {zfs.pools.length === 0 && <div className="notice">ZFS is present but no pools are imported.</div>}
+      <div className="cards">{zfs.pools.map((p) => <PoolCard key={p.name} p={p} onChanged={load} />)}</div>
+
+      <div className="dash-bar" style={{ marginTop: 12 }}><h2 className="section">Snapshot schedules</h2><span className="spacer" />
+        <Btn className="btn on" onClick={() => setEditing({ ...BLANK, dataset: zfs.pools[0]?.name ?? '' })}>+ New schedule</Btn>
+      </div>
+      {ov.external && <ExternalNotice x={ov.external} mine={mine} onAdopt={() => setEditing(adopt(ov.external!, zfs.pools[0]?.name ?? ''))} />}
+      {ov.policies.length === 0 && !ov.external && <div className="notice">Nothing is taking snapshots on a schedule. Snapshots are written the way zfSnap writes them, with the retention in the name, so anything already here is understood.</div>}
+      <div className="cards">{ov.policies.map(({ policy, cron, next, last }) => (
+        <ScheduleCard key={policy.id} p={policy} cron={cron} next={next} last={last ?? {}} onChanged={load} onEdit={() => setEditing(policy)} />
+      ))}</div>
+
+      <div className="dash-bar" style={{ marginTop: 12 }}><h2 className="section">Snapshots</h2><span className="spacer" />
+        <span className="muted small">{zfs.datasets.reduce((a, d) => a + d.snapshots, 0)} across {zfs.datasets.length} datasets · open one to browse, take or delete</span>
+      </div>
+      <section className="card ds-table">
+        <div className="ds-row head">
+          <span>Dataset</span><span className="num">Snapshots</span><span className="num">They use</span>
+          <span className="num">Dataset uses</span><span className="num">Referenced</span><span>Mount</span>
+        </div>
+        {zfs.datasets.map((d) => <DatasetRow key={d.name} d={d} onChanged={load} />)}
+      </section>
+
+      {editing && <ScheduleDialog p={editing} datasets={datasets.length ? datasets : zfs.pools.map((p) => p.name)} onClose={() => setEditing(null)} onSaved={() => { setEditing(null); load() }} />}
+    </div>
+  )
+}

web/src/api.ts

@@ -70,7 +70,7 @@ export interface Temp { chip: string; label: string; c: number; max?: number; cr
 export interface Fan { chip: string; label: string; rpm: number }
 export interface NetIf { iface: string; up: boolean; rx_bps: number; tx_bps: number; rx_total: number; tx_total: number }
 export interface Disk { name: string; model?: string; size: number; read_bps: number; write_bps: number; util_pct: number; temp?: number }
-export interface FS { mount: string; type: string; size: number; used: number }
+export interface FS { mount: string; type: string; size: number; used: number; remote?: boolean; disk?: string }
 export interface UPS { driver: string; model: string; state: string; source: string; on_battery: boolean; in_v: number; out_v: number; battery_pct: number; runtime_min: number; load_w: number; load_pct: number; last_event?: string }
 export interface Proc { pid: number; ppid: number; name: string; cmd?: string; user: string; cpu: number; cpu_time: number; rss: number; threads: number; state: string; nice: number; started: number }
 export interface MemInfo { total: number; used: number; avail: number; free?: number; cached?: number; buffers?: number }
@@ -133,6 +133,11 @@ export interface SpaceNode { name: string; dir: boolean; size: number; apparent:
 export interface SpaceTree extends SpaceNode { path: string; children?: SpaceTree[]; more_n?: number; more_size?: number; total: number }
 export interface SpaceFile { path: string; size: number; apparent: number; mtime: number }
 
+export interface ZFSPolicy { id: string; name: string; dataset: string; recursive: boolean; every: 'hourly' | 'daily' | 'weekly' | 'monthly' | 'custom'; at: string; weekday: number; day: number; cron?: string; keep_for: string; keep_min: number; prefix?: string; enabled: boolean }
+export interface ZFSRun { at?: string; taken?: string; pruned?: string[]; error?: string }
+export interface ZFSExternal { tool: string; schedule: string; command: string; user: string; source: string; id: string; next?: number; last?: number }
+export interface ZFSOverview { zfs: ZFSInfo; policies: { policy: ZFSPolicy; cron: string; next?: string; last: ZFSRun }[]; external?: ZFSExternal | null }
+
 export interface FileEntry { name: string; type: 'dir' | 'file' | 'link' | 'other'; size: number; mode: string; perm: string; mtime: number; user: string; group: string; target?: string; broken?: boolean }
 export interface FileInfo extends FileEntry { path: string; text: boolean }
 
@@ -179,6 +184,11 @@ export const api = {
   storage: () => req<{ devices: StorageDevice[]; zfs: ZFSInfo; smartctl: boolean }>('GET', '/api/storage'),
   smart: (dev: string, force = false) => req<SmartInfo>('GET', `/api/storage/smart/${dev}${force ? '?force=1' : ''}`),
   smartTest: (dev: string, kind: 'short' | 'long') => req<void>('POST', `/api/storage/smart/${dev}/test/${kind}`),
+  zfsOverview: () => req<ZFSOverview>('GET', '/api/zfs'),
+  saveZfsSchedule: (p: Partial<ZFSPolicy>) => req<ZFSPolicy>('PUT', '/api/zfs/schedules', p),
+  deleteZfsSchedule: (id: string) => req<void>('DELETE', `/api/zfs/schedules/${encodeURIComponent(id)}`),
+  runZfsSchedule: (id: string) => req<{ taken: string; pruned: string[] }>('POST', `/api/zfs/schedules/${encodeURIComponent(id)}/run`),
+  deleteZfsSnapshot: (name: string, recursive: boolean) => req<void>('POST', '/api/zfs/snapshots/delete', { name, confirm: name, recursive }),
   zfsSnapshots: (dataset: string) => req<ZFSSnapshot[]>('GET', `/api/storage/zfs/snapshots?dataset=${encodeURIComponent(dataset)}`),
   zfsScrub: (pool: string, action: 'start' | 'pause' | 'stop') => req<void>('POST', `/api/storage/zfs/scrub/${encodeURIComponent(pool)}/${action}`),
   zfsSnapshot: (dataset: string, name: string) => req<void>('POST', '/api/storage/zfs/snapshot', { dataset, name }),

web/src/railorder.ts

@@ -5,8 +5,25 @@ import { useEffect, useState } from 'react'
 
 const KEY = 'hamlab.rail'
 
+// Pages that were renamed, so an order saved before it still puts the page where it was put:
+// Top became Processes, Space became Usage, Cron became Jobs. A page that was removed
+// outright (Dashboard) is not here — orderBy drops ids that match no page.
+const RENAMED: Record<string, string> = { top: 'procs', space: 'usage', cron: 'jobs' }
+
 export function getRailOrder(): string[] {
-  try { const v = JSON.parse(localStorage.getItem(KEY) ?? '[]'); return Array.isArray(v) ? v.filter((x) => typeof x === 'string') : [] } catch { return [] }
+  let raw: unknown
+  try { raw = JSON.parse(localStorage.getItem(KEY) ?? '[]') } catch { return [] }
+  if (!Array.isArray(raw)) return []
+  const seen = new Set<string>()
+  const out: string[] = []
+  for (const x of raw) {
+    if (typeof x !== 'string') continue
+    const id = RENAMED[x] ?? x
+    if (seen.has(id)) continue // a merged page keeps the earlier of the two slots
+    seen.add(id)
+    out.push(id)
+  }
+  return out
 }
 
 export function setRailOrder(ids: string[], save = true) {

web/src/sampleAdapter.ts

@@ -51,7 +51,7 @@ export function sampleOf(v: Values, cat: Catalog): Sample {
     fans: hw('fan.').map(({ id, s }) => ({ chip: s.labels!.chip, label: s.labels!.label, rpm: num(v, id) })),
     net: [...groups(v, cat, 'net.', 'iface')].map(([iface, p]) => ({ iface, up: v[p + '.up'] === true, rx_bps: num(v, p + '.rx'), tx_bps: num(v, p + '.tx'), rx_total: num(v, p + '.rx_total'), tx_total: num(v, p + '.tx_total') })),
     disks: [...groups(v, cat, 'disk.', 'device')].map(([name, p]) => ({ name, model: cat.get(p + '.size')?.labels?.model || undefined, size: num(v, p + '.size'), read_bps: num(v, p + '.read'), write_bps: num(v, p + '.write'), util_pct: num(v, p + '.util'), temp: num(v, p + '.temp') || undefined })),
-    fs: [...groups(v, cat, 'fs.', 'mount')].map(([mount, p]) => ({ mount, type: cat.get(p + '.size')?.labels?.fstype ?? '', size: num(v, p + '.size'), used: num(v, p + '.used') })),
+    fs: [...groups(v, cat, 'fs.', 'mount')].map(([mount, p]) => ({ mount, type: cat.get(p + '.size')?.labels?.fstype ?? '', size: num(v, p + '.size'), used: num(v, p + '.used'), remote: cat.get(p + '.size')?.labels?.remote === '1', disk: cat.get(p + '.size')?.labels?.disk })),
     ups: v['ups.battery'] === undefined ? null : {
       driver: cat.get('ups.last_event')?.labels?.driver ?? '', model: cat.get('ups.battery')?.labels?.model ?? '', state: str(v, 'ups.state'), source: str(v, 'ups.source'),
       on_battery: v['ups.on_battery'] === true, in_v: num(v, 'ups.in_v'), out_v: num(v, 'ups.out_v'), battery_pct: num(v, 'ups.battery'), runtime_min: num(v, 'ups.runtime'),

web/src/styles.css

@@ -285,14 +285,21 @@ h2.section { margin: 0; font-size: 13px; font-weight: 600; color: var(--muted);
    the fallback above stays a fallback. */
 .disk-cards { grid-template-columns: repeat(auto-fill, minmax(min(420px, 100%), 1fr)); }
 .datasets { padding: 0; overflow-x: auto; }
-.ds-row { display: grid; grid-template-columns: minmax(160px, 1fr) 80px 80px 80px 50px 50px minmax(120px, 1fr); gap: 8px; align-items: center; padding: 6px 12px; border-bottom: 1px solid var(--border); font-size: 13px; min-width: 700px; } /* the columns and gaps add up to 692: at 640 the row ended before its own cells did */
+.ds-row { display: grid; grid-template-columns: minmax(160px, 1fr) 80px 90px 90px 90px minmax(120px, 1fr); gap: 8px; align-items: center; padding: 6px 12px; border-bottom: 1px solid var(--border); font-size: 13px; min-width: 700px; }
 .ds-row.head { color: var(--muted); font-size: 11px; text-transform: uppercase; letter-spacing: .5px; }
 .ds-row .num { text-align: right; }
 .ds-name { cursor: pointer; display: flex; align-items: center; gap: 6px; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
 .ds-mount { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; font-family: ui-monospace, monospace; font-size: 12px; }
 .ds-snaps { padding: 8px 12px 10px 40px; border-bottom: 1px solid var(--border); background: var(--bg); display: flex; flex-direction: column; gap: 6px; }
 .snap-list { display: flex; flex-direction: column; gap: 2px; max-height: 40vh; overflow-y: auto; }
-.snap { display: flex; justify-content: space-between; gap: 12px; font-size: 12px; }
+.snap { display: grid; grid-template-columns: minmax(150px, 1fr) 150px 120px 70px auto; gap: 10px; align-items: center; font-size: 12px; padding: 2px 0; border-bottom: 1px solid var(--border); }
+.snap .snap-name { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.snap .snap-when, .snap .snap-exp { white-space: nowrap; }
+.snap .snap-exp.warn { color: var(--s2); }
+.snap .num { text-align: right; }
+.snap .snap-del { padding: 0 6px; font-size: 11px; opacity: .55; }
+.snap:hover .snap-del { opacity: 1; }
+@media (max-width: 800px) { .snap { grid-template-columns: minmax(120px, 1fr) auto auto; } .snap .snap-when, .snap .snap-exp { display: none; } }
 
 /* files */
 .files { position: absolute; inset: 0; display: flex; flex-direction: column; background: var(--bg); }
@@ -720,3 +727,16 @@ pre.diff .add { color: var(--ok); background: color-mix(in srgb, var(--ok) 12%,
   .space-row.file { grid-template-columns: minmax(120px, 1fr) 72px 80px; }
   .space-split { padding: 8px; } .space-tree { flex: 1 1 45%; } .space-map { flex: 1 1 55%; }
 }
+
+/* the Processes tab's drive rows and NIC switcher */
+.t-disk .t-model { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; max-width: 14ch; margin-left: 6px; }
+.t-disk .t-temp { margin-right: 8px; color: var(--t-blue, var(--accent2)); }
+.t-disk .t-mounts { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.t-ifs { display: inline-flex; gap: 4px; flex-wrap: wrap; justify-content: flex-end; }
+.t-ifs .t-if { padding: 0 4px; border-radius: 3px; color: var(--muted); }
+.t-ifs .t-if:hover { color: var(--fg); background: var(--bg3); }
+.t-ifs .t-if.on { color: var(--fg); box-shadow: inset 0 -2px 0 var(--accent); }
+
+/* ZFS: the schedule dialog's controls match the rest of the modal forms */
+.modal select, .modal input[type=time], .modal input[type=number] { padding: 9px 10px; background: var(--bg); border: 1px solid var(--border); border-radius: 6px; color: var(--fg); font-size: 16px; }
+.modal .chips { margin-top: 2px; }

web/src/ui.tsx

@@ -14,6 +14,12 @@ export function CloseBtn({ onClick, title = 'Close' }: { onClick: () => void; ti
   )
 }
 
+// A filled bar. Red past 95%, amber past 85%, unless the caller says otherwise.
+export function Meter({ frac, cls }: { frac: number; cls?: string }) {
+  const c = cls ?? (frac >= 0.95 ? 'bad' : frac >= 0.85 ? 'warn' : '')
+  return <div className="meter"><div className={'fill ' + c} style={{ width: `${Math.min(100, Math.max(0, frac * 100))}%` }} /></div>
+}
+
 export function Loading({ label = 'Loading…' }: { label?: string }) {
   return <div className="center muted loading"><Spinner size={22} /><div>{label}</div></div>
 }