feat(snapshot-manager): migrate snapshot management to Rust

rust/rust-source.nix

@@ -0,0 +1,10 @@
+{ lib }:
+lib.fileset.toSource {
+  root = ../.;
+  fileset = lib.fileset.unions [
+    ../Cargo.toml
+    ../Cargo.lock
+    ../clippy.toml
+    ./.
+  ];
+}

rust/snapshot_manager/Cargo.toml

@@ -0,0 +1,23 @@
+[package]
+name = "snapshot-manager"
+version = "0.1.0"
+edition = "2024"
+description = "Create and rotate ZFS snapshots with Signal failure alerts"
+license = "MIT"
+
+[dependencies]
+anyhow.workspace = true
+chrono.workspace = true
+clap = { workspace = true, features = ["derive", "env"] }
+env_logger.workspace = true
+log.workspace = true
+serde = { workspace = true, features = ["derive"] }
+signal.workspace = true
+toml = "0.9"
+zfs.workspace = true
+
+[dev-dependencies]
+tempfile = "3"
+
+[lints]
+workspace = true

rust/snapshot_manager/package.nix

@@ -0,0 +1,25 @@
+{ lib, rustPlatform }:
+rustPlatform.buildRustPackage {
+  pname = "snapshot-manager";
+  version = "0.1.0";
+  src = import ../rust-source.nix { inherit lib; };
+
+  cargoLock.lockFile = ../../Cargo.lock;
+  cargoBuildFlags = [
+    "-p"
+    "snapshot-manager"
+  ];
+  cargoTestFlags = [
+    "-p"
+    "snapshot-manager"
+    "-p"
+    "signal"
+    "-p"
+    "zfs"
+  ];
+
+  meta = {
+    description = "ZFS snapshot manager with Signal failure alerts";
+    mainProgram = "snapshot-manager";
+  };
+}

rust/snapshot_manager/src/main.rs

@@ -0,0 +1,383 @@
+use std::{
+    collections::HashMap,
+    fs,
+    path::{Path, PathBuf},
+    process::ExitCode,
+};
+
+use anyhow::{Context, Result};
+use chrono::{DateTime, Datelike, NaiveDate, NaiveTime, Timelike, Utc};
+use clap::Parser;
+use log::{error, info};
+use serde::Deserialize;
+use signal::Signal;
+
+#[derive(Parser)]
+#[command(version, about)]
+struct Args {
+    /// TOML file containing default and per-dataset snapshot retention counts.
+    config_file: PathBuf,
+
+    /// Send Signal failure alerts (requires both phone numbers).
+    #[arg(long, env = "SIGNAL_ALERTS", default_value_t = false, action = clap::ArgAction::Set)]
+    signal_alerts: bool,
+
+    /// Signal account sending failure alerts.
+    #[arg(
+        long,
+        env = "SIGNAL_ALERT_FROM_PHONE",
+        hide_env_values = true,
+        required_if_eq("signal_alerts", "true"),
+        value_parser = clap::builder::NonEmptyStringValueParser::new()
+    )]
+    signal_alert_from_phone: Option<String>,
+
+    /// Signal recipient for failure alerts.
+    #[arg(
+        long,
+        env = "SIGNAL_ALERT_TO_PHONE",
+        hide_env_values = true,
+        required_if_eq("signal_alerts", "true"),
+        value_parser = clap::builder::NonEmptyStringValueParser::new()
+    )]
+    signal_alert_to_phone: Option<String>,
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+struct Retention {
+    #[serde(rename = "15_min")]
+    quarter_hourly: usize,
+    hourly: usize,
+    daily: usize,
+    monthly: usize,
+}
+
+impl Default for Retention {
+    fn default() -> Self {
+        Self {
+            quarter_hourly: 4,
+            hourly: 12,
+            daily: 0,
+            monthly: 0,
+        }
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(transparent)]
+struct Config(HashMap<String, Retention>);
+
+impl Config {
+    fn load(path: &Path) -> Result<Self> {
+        let contents = fs::read_to_string(path)
+            .with_context(|| format!("Failed to read configuration {}", path.display()))?;
+        toml::from_str(&contents)
+            .with_context(|| format!("Invalid configuration {}", path.display()))
+    }
+
+    fn retention_for(&self, dataset: &str) -> Retention {
+        self.0
+            .get(dataset)
+            .or_else(|| self.0.get("default"))
+            .copied()
+            .unwrap_or_default()
+    }
+}
+
+fn main() -> ExitCode {
+    let args = Args::parse();
+    env_logger::Builder::from_env(env_logger::Env::default().default_filter_or("info")).init();
+    info!("Starting snapshot_manager");
+    let signal = if args.signal_alerts {
+        args.signal_alert_from_phone
+            .map(|from_phone| Signal { from_phone })
+    } else {
+        None
+    };
+    let alerts = signal.as_ref().zip(args.signal_alert_to_phone.as_deref());
+    match run(&args.config_file, alerts) {
+        Ok(()) => {
+            info!("snapshot_manager completed");
+            ExitCode::SUCCESS
+        }
+        Err(error) => {
+            error!("{error:#}");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+fn run(config_file: &Path, alerts: Option<(&Signal, &str)>) -> Result<()> {
+    let result = (|| {
+        // Validate all retention settings before making any changes to ZFS.
+        let config = Config::load(config_file)?;
+        let snapshot_time = timestamp(Utc::now());
+        for dataset_name in zfs::list_datasets()? {
+            if let Err(error) = zfs::create_snapshot(&dataset_name, &snapshot_time) {
+                let message = format!("{dataset_name} failed to create snapshot {snapshot_time}");
+                error!("{message}: {error:#}");
+                send_alert(alerts, &message)?;
+                continue;
+            }
+            remove_old_snapshots(&config, alerts, &dataset_name)
+                .context("Failed to remove old snapshots")?;
+        }
+        Ok(())
+    })();
+    if let Err(error) = &result {
+        error!("snapshot_manager failed: {error:#}");
+        if let Err(alert_error) = send_alert(alerts, "snapshot_manager failed") {
+            error!("Failed to send failure alert: {alert_error:#}");
+        }
+    }
+    result
+}
+
+fn timestamp(now: DateTime<Utc>) -> String {
+    let minute = now.minute().saturating_sub(now.minute() % 15);
+    format!("auto_{}{minute:02}", now.format("%Y%m%d%H"))
+}
+
+fn remove_old_snapshots(
+    config: &Config,
+    alerts: Option<(&Signal, &str)>,
+    dataset_name: &str,
+) -> Result<()> {
+    let retention = config.retention_for(dataset_name);
+    info!("Using {retention:?} for {dataset_name}");
+    let snapshots = zfs::list_snapshots(dataset_name)?;
+    for snapshot in snapshots_to_delete(&snapshots, retention) {
+        info!("Deleting {dataset_name}@{snapshot}");
+        if let Some(error) = zfs::delete_snapshot(dataset_name, snapshot)? {
+            let message = format!("{dataset_name}@{snapshot} failed to delete: {error}");
+            error!("{message}");
+            send_alert(alerts, &message)?;
+        }
+    }
+    Ok(())
+}
+
+fn snapshots_to_delete(snapshots: &[String], retention: Retention) -> Vec<&str> {
+    let mut tiers: [Vec<&str>; 4] = Default::default();
+    for snapshot in snapshots {
+        if let Some(index) = bucket(snapshot)
+            && let Some(tier) = tiers.get_mut(index)
+        {
+            tier.push(snapshot);
+        }
+    }
+
+    let counts = [
+        retention.quarter_hourly,
+        retention.hourly,
+        retention.daily,
+        retention.monthly,
+    ];
+    let mut deletions = Vec::new();
+    for (mut tier, count) in tiers.into_iter().zip(counts) {
+        tier.sort_unstable();
+        let delete_count = tier.len().saturating_sub(count);
+        deletions.extend(tier.into_iter().take(delete_count));
+    }
+    deletions
+}
+
+fn bucket(name: &str) -> Option<usize> {
+    let digits = name.strip_prefix("auto_")?;
+    if digits.len() != 12 || !digits.bytes().all(|byte| byte.is_ascii_digit()) {
+        return None;
+    }
+    let date = NaiveDate::from_ymd_opt(
+        digits.get(..4)?.parse().ok()?,
+        digits.get(4..6)?.parse().ok()?,
+        digits.get(6..8)?.parse().ok()?,
+    )?;
+    let time = NaiveTime::from_hms_opt(
+        digits.get(8..10)?.parse().ok()?,
+        digits.get(10..)?.parse().ok()?,
+        0,
+    )?;
+
+    // The tiers are disjoint: midnight belongs to daily, except on the first
+    // of the month, when it belongs to monthly.
+    match (time.minute(), time.hour(), date.day()) {
+        (15 | 30 | 45, _, _) => Some(0),
+        (0, 1..=23, _) => Some(1),
+        (0, 0, 2..=31) => Some(2),
+        (0, 0, 1) => Some(3),
+        _ => None,
+    }
+}
+
+fn send_alert(alerts: Option<(&Signal, &str)>, body: &str) -> Result<()> {
+    if let Some((signal, to_phone)) = alerts {
+        signal.send(to_phone, body)?;
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use chrono::TimeZone;
+
+    use super::*;
+
+    #[test]
+    fn dataset_overrides_default_and_other_datasets_fall_back() {
+        let config: Config = toml::from_str(
+            r#"
+            [default]
+            15_min = 8
+            hourly = 24
+            daily = 0
+            monthly = 0
+
+            ["pool/home"]
+            15_min = 2
+            hourly = 3
+            daily = 4
+            monthly = 5
+            "#,
+        )
+        .unwrap();
+        assert_eq!(
+            config.retention_for("pool/home"),
+            Retention {
+                quarter_hourly: 2,
+                hourly: 3,
+                daily: 4,
+                monthly: 5,
+            }
+        );
+        assert_eq!(config.retention_for("pool/other").hourly, 24);
+        assert_eq!(config.retention_for("pool/home/child").quarter_hourly, 8);
+    }
+
+    #[test]
+    fn absent_default_uses_original_builtin_counts() {
+        let config: Config = toml::from_str("").unwrap();
+        assert_eq!(config.retention_for("pool/home"), Retention::default());
+    }
+
+    #[test]
+    fn rejects_incomplete_negative_and_unknown_retention_settings() {
+        for settings in [
+            "15_min = 1\nhourly = 2\ndaily = 3",
+            "15_min = -1\nhourly = 2\ndaily = 3\nmonthly = 4",
+            "15_min = 1\nhourly = 2\ndaily = 3\nmonthly = 4\nweekly = 5",
+            "15_min = 1.5\nhourly = 2\ndaily = 3\nmonthly = 4",
+        ] {
+            assert!(toml::from_str::<Config>(&format!("[default]\n{settings}")).is_err());
+        }
+    }
+
+    #[test]
+    fn timestamps_round_down_at_quarter_hour_boundaries() {
+        for (minute, expected) in [
+            (0, "00"),
+            (14, "00"),
+            (15, "15"),
+            (29, "15"),
+            (30, "30"),
+            (44, "30"),
+            (45, "45"),
+            (59, "45"),
+        ] {
+            let now = Utc.with_ymd_and_hms(2026, 1, 1, 0, minute, 59).unwrap();
+            assert_eq!(timestamp(now), format!("auto_2026010100{expected}"));
+        }
+    }
+
+    #[test]
+    fn tiers_are_disjoint_at_day_and_month_boundaries() {
+        for (name, expected) in [
+            ("auto_202602010015", 0),
+            ("auto_202602010030", 0),
+            ("auto_202602010045", 0),
+            ("auto_202602010100", 1),
+            ("auto_202602012300", 1),
+            ("auto_202602020000", 2),
+            ("auto_202402290000", 2),
+            ("auto_202602010000", 3),
+            ("auto_202601010000", 3),
+        ] {
+            assert_eq!(bucket(name), Some(expected), "{name}");
+        }
+    }
+
+    #[test]
+    fn only_exact_valid_manager_names_are_eligible() {
+        for name in [
+            "manual",
+            "manual_auto_202602010015",
+            "auto_202602010015_backup",
+            "auto_20260201001",
+            "auto_202602300000",
+            "auto_202602012400",
+            "auto_202602010060",
+            "auto_202602010005",
+            "auto_２０２６02010015",
+        ] {
+            assert_eq!(bucket(name), None, "{name}");
+        }
+    }
+
+    #[test]
+    fn keeps_newest_in_each_tier_regardless_of_input_order() {
+        let snapshots = [
+            "auto_202601010000",
+            "auto_202602020000",
+            "auto_202602020115",
+            "auto_202602020215",
+            "auto_202602020200",
+            "auto_202602020100",
+            "auto_202602030000",
+            "auto_202602010000",
+            "manual",
+        ]
+        .map(String::from);
+        let retention = Retention {
+            quarter_hourly: 1,
+            hourly: 1,
+            daily: 1,
+            monthly: 1,
+        };
+        assert_eq!(
+            snapshots_to_delete(&snapshots, retention),
+            [
+                "auto_202602020115",
+                "auto_202602020100",
+                "auto_202602020000",
+                "auto_202601010000",
+            ]
+        );
+    }
+
+    #[test]
+    fn zero_counts_delete_all_managed_snapshots_and_large_counts_keep_them() {
+        let snapshots = [
+            "auto_202601010015",
+            "auto_202601010100",
+            "auto_202601020000",
+            "auto_202601010000",
+            "manual",
+        ]
+        .map(String::from);
+        let none = Retention {
+            quarter_hourly: 0,
+            hourly: 0,
+            daily: 0,
+            monthly: 0,
+        };
+        assert_eq!(snapshots_to_delete(&snapshots, none).len(), 4);
+        let all = Retention {
+            quarter_hourly: 100,
+            hourly: 100,
+            daily: 100,
+            monthly: 100,
+        };
+        assert!(snapshots_to_delete(&snapshots, all).is_empty());
+        assert!(snapshots_to_delete(&[], none).is_empty());
+    }
+}

rust/snapshot_manager/tests/cli.rs

@@ -0,0 +1,202 @@
+#![cfg(test)]
+
+use std::{fs, os::unix::fs::symlink, path::Path, process::Command};
+
+use tempfile::tempdir;
+
+fn command() -> Command {
+    let mut command = Command::new(env!("CARGO_BIN_EXE_snapshot-manager"));
+    command
+        .env_remove("SIGNAL_ALERTS")
+        .env_remove("SIGNAL_ALERT_FROM_PHONE")
+        .env_remove("SIGNAL_ALERT_TO_PHONE")
+        .env_remove("SNAPSHOT_TEST_SCRIPT")
+        .env_remove("RUST_LOG");
+    command
+}
+
+#[test]
+fn help_works_without_phone_numbers() {
+    let output = command().arg("--help").output().unwrap();
+    assert!(output.status.success());
+    assert!(
+        String::from_utf8(output.stdout)
+            .unwrap()
+            .contains("<CONFIG_FILE>")
+    );
+}
+
+#[test]
+fn help_documents_environment_variables_without_exposing_phone_numbers() {
+    let output = command()
+        .env("SIGNAL_ALERT_FROM_PHONE", "+15555550101")
+        .env("SIGNAL_ALERT_TO_PHONE", "+15555550102")
+        .arg("--help")
+        .output()
+        .unwrap();
+    assert!(output.status.success());
+    let stdout = String::from_utf8(output.stdout).unwrap();
+    for name in [
+        "SIGNAL_ALERTS",
+        "SIGNAL_ALERT_FROM_PHONE",
+        "SIGNAL_ALERT_TO_PHONE",
+    ] {
+        assert!(stdout.contains(name), "{stdout}");
+    }
+    assert!(!stdout.contains("+15555550101"), "{stdout}");
+    assert!(!stdout.contains("+15555550102"), "{stdout}");
+}
+
+#[test]
+fn config_argument_is_required() {
+    let output = command().output().unwrap();
+    assert_eq!(output.status.code(), Some(2));
+}
+
+#[test]
+fn enabled_alerts_require_phone_numbers_before_running() {
+    for use_env in [false, true] {
+        for (from, to, expected) in [
+            (None, None, "--signal-alert-from-phone"),
+            (Some(""), None, "--signal-alert-from-phone"),
+            (Some("+15555550101"), None, "--signal-alert-to-phone"),
+            (Some("+15555550101"), Some(""), "--signal-alert-to-phone"),
+            (None, Some("+15555550102"), "--signal-alert-from-phone"),
+        ] {
+            let mut command = command();
+            if use_env {
+                command.env("SIGNAL_ALERTS", "true");
+            } else {
+                command.args(["--signal-alerts", "true"]);
+            }
+            if let Some(from) = from {
+                command.env("SIGNAL_ALERT_FROM_PHONE", from);
+            }
+            if let Some(to) = to {
+                command.env("SIGNAL_ALERT_TO_PHONE", to);
+            }
+            let output = command.arg("unused.toml").output().unwrap();
+            let stderr = String::from_utf8(output.stderr).unwrap();
+            assert_eq!(output.status.code(), Some(2), "{stderr}");
+            assert!(stderr.contains(expected), "{stderr}");
+            assert!(!stderr.contains("Starting snapshot_manager"), "{stderr}");
+        }
+    }
+}
+
+#[test]
+fn enabled_alerts_accept_environment_variables_and_cli_overrides() {
+    let dir = tempdir().unwrap();
+    let config = dir.path().join("config.toml");
+    let scenario = dir.path().join("scenario");
+    fs::write(&config, "").unwrap();
+    // An empty dataset list completes successfully without sending an alert.
+    fs::write(&scenario, "").unwrap();
+    symlink(
+        Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/zfs"),
+        dir.path().join("zfs"),
+    )
+    .unwrap();
+
+    for use_cli in [false, true] {
+        let mut command = command();
+        if use_cli {
+            command
+                .env("SIGNAL_ALERTS", "invalid")
+                .env("SIGNAL_ALERT_FROM_PHONE", "")
+                .env("SIGNAL_ALERT_TO_PHONE", "")
+                .args([
+                    "--signal-alerts",
+                    "true",
+                    "--signal-alert-from-phone",
+                    "+15555550101",
+                    "--signal-alert-to-phone",
+                    "+15555550102",
+                ]);
+        } else {
+            command
+                .env("SIGNAL_ALERTS", "true")
+                .env("SIGNAL_ALERT_FROM_PHONE", "+15555550101")
+                .env("SIGNAL_ALERT_TO_PHONE", "+15555550102");
+        }
+        let output = command
+            .current_dir(dir.path())
+            .env("PATH", dir.path())
+            .env("SNAPSHOT_TEST_SCRIPT", &scenario)
+            .arg(&config)
+            .output()
+            .unwrap();
+        let stderr = String::from_utf8(output.stderr).unwrap();
+        assert!(output.status.success(), "{stderr}");
+        assert!(stderr.contains("snapshot_manager completed"), "{stderr}");
+    }
+}
+
+#[test]
+fn disabled_alerts_allow_snapshot_failures_without_phone_numbers() {
+    let dir = tempdir().unwrap();
+    let config = dir.path().join("config.toml");
+    fs::write(&config, "").unwrap();
+    symlink(
+        Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/zfs"),
+        dir.path().join("zfs"),
+    )
+    .unwrap();
+
+    for (env_value, args) in [
+        (None, vec![]),
+        (Some("false"), vec![]),
+        (None, vec!["--signal-alerts", "false"]),
+        (Some("true"), vec!["--signal-alerts", "false"]),
+    ] {
+        let mut command = command();
+        if let Some(value) = env_value {
+            command.env("SIGNAL_ALERTS", value);
+        }
+        let output = command
+            .env("PATH", dir.path())
+            .args(args)
+            .arg(&config)
+            .output()
+            .unwrap();
+        let stderr = String::from_utf8(output.stderr).unwrap();
+        assert!(output.status.success(), "{stderr}");
+        assert!(
+            stderr.contains("pool/home failed to create snapshot"),
+            "{stderr}"
+        );
+        assert!(stderr.contains("snapshot_manager completed"), "{stderr}");
+        assert!(!stderr.contains("Signal"), "{stderr}");
+    }
+}
+
+#[test]
+fn disabled_alerts_preserve_fatal_errors_without_phone_numbers() {
+    let dir = tempdir().unwrap();
+    for args in [vec![], vec!["--signal-alerts", "false"]] {
+        let output = command()
+            .args(args)
+            .arg(dir.path().join("missing.toml"))
+            .output()
+            .unwrap();
+        let stderr = String::from_utf8(output.stderr).unwrap();
+        assert_eq!(output.status.code(), Some(1), "{stderr}");
+        assert!(stderr.contains("Failed to read configuration"), "{stderr}");
+        assert!(!stderr.contains("SIGNAL_ALERT_"), "{stderr}");
+        assert!(!stderr.contains("Failed to send failure alert"), "{stderr}");
+    }
+}
+
+#[test]
+fn signal_alerts_requires_a_boolean_value() {
+    for use_env in [false, true] {
+        let mut command = command();
+        if use_env {
+            command.env("SIGNAL_ALERTS", "invalid");
+        } else {
+            command.args(["--signal-alerts", "invalid"]);
+        }
+        let output = command.arg("unused.toml").output().unwrap();
+        assert_eq!(output.status.code(), Some(2));
+    }
+}

rust/snapshot_manager/tests/fixtures/zfs

@@ -0,0 +1,12 @@
+#!/bin/sh
+if [ -n "${SNAPSHOT_TEST_SCRIPT:-}" ]; then
+  printf '%s\n' "$*" >> calls
+  . "$SNAPSHOT_TEST_SCRIPT"
+  exit
+fi
+
+case "$*" in
+  'list -Hp -t filesystem -o name') printf '%s\n' pool/home ;;
+  'snapshot pool/home@'*) printf '%s\n' 'permission denied' >&2; exit 1 ;;
+  *) exit 99 ;;
+esac

rust/snapshot_manager/tests/manager.rs

@@ -0,0 +1,290 @@
+#![cfg(test)]
+
+use std::{
+    fs,
+    os::unix::fs::symlink,
+    path::{Path, PathBuf},
+    process::{Command, Output},
+};
+
+use tempfile::{TempDir, tempdir};
+
+struct Fixture {
+    dir: TempDir,
+    config: PathBuf,
+}
+
+impl Fixture {
+    fn new(script: &str) -> Self {
+        let dir = tempdir().unwrap();
+        // Only the child process sees this PATH. The real zfs cannot be found.
+        symlink(
+            Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/zfs"),
+            dir.path().join("zfs"),
+        )
+        .unwrap();
+        // The executable is a checked-in fixture; scenario files are read by
+        // its shell, so parallel tests never execute a file being written.
+        fs::write(dir.path().join("scenario"), script).unwrap();
+        let config = dir.path().join("config.toml");
+        fs::write(
+            &config,
+            "[default]\n15_min = 1\nhourly = 0\ndaily = 0\nmonthly = 0\n",
+        )
+        .unwrap();
+        Self { dir, config }
+    }
+
+    fn calls(&self) -> Vec<String> {
+        fs::read_to_string(self.dir.path().join("calls"))
+            .unwrap_or_default()
+            .lines()
+            .map(String::from)
+            .collect()
+    }
+
+    fn normalized_calls(&self) -> Vec<String> {
+        self.calls()
+            .into_iter()
+            .map(|call| {
+                if call.starts_with("snapshot ") {
+                    let (dataset, name) = call.split_once('@').unwrap();
+                    assert!(name.starts_with("auto_"), "{call}");
+                    format!("{dataset}@<timestamp>")
+                } else {
+                    call
+                }
+            })
+            .collect()
+    }
+
+    fn run(&self) -> Output {
+        Command::new(env!("CARGO_BIN_EXE_snapshot-manager"))
+            .current_dir(self.dir.path())
+            .env("PATH", self.dir.path())
+            .env("SNAPSHOT_TEST_SCRIPT", self.dir.path().join("scenario"))
+            .env_remove("SIGNAL_ALERTS")
+            .env_remove("SIGNAL_ALERT_FROM_PHONE")
+            .env_remove("SIGNAL_ALERT_TO_PHONE")
+            .env_remove("RUST_LOG")
+            .arg(&self.config)
+            .output()
+            .unwrap()
+    }
+}
+
+fn stderr(output: &Output) -> &str {
+    std::str::from_utf8(&output.stderr).unwrap()
+}
+
+#[test]
+fn creates_then_prunes_only_this_datasets_managed_snapshots() {
+    let fixture = Fixture::new(
+        r#"
+case "$*" in
+  'list -Hp -t filesystem -o name')
+    printf '%s\n' pool pool/home
+    printf '%s\n' 'warning on stderr' >&2 ;;
+  'snapshot pool/home@auto_'*) ;;
+  'list -Hp -t snapshot -o name -d 1 pool/home')
+    printf '%s\n' pool/home@auto_200002020145 pool/home@auto_200002020115 pool/home@manual pool/home@manual_auto_200001010015 pool/home/child@auto_200001010015 pool/other@auto_200001010015 ;;
+  'destroy pool/home@auto_200002020115') ;;
+  *) exit 99 ;;
+esac
+"#,
+    );
+    let output = fixture.run();
+    assert!(output.status.success(), "{}", stderr(&output));
+    assert_eq!(
+        fixture.normalized_calls(),
+        [
+            "list -Hp -t filesystem -o name",
+            "snapshot pool/home@<timestamp>",
+            "list -Hp -t snapshot -o name -d 1 pool/home",
+            "destroy pool/home@auto_200002020115",
+        ]
+    );
+}
+
+#[test]
+fn failed_or_duplicate_creation_skips_pruning_but_continues() {
+    for error in ["snapshot already exists", "permission denied"] {
+        let fixture = Fixture::new(&format!(
+            r#"
+case "$*" in
+  'list -Hp -t filesystem -o name') printf '%s\n' pool/home pool/other ;;
+  'snapshot pool/home@auto_'*) printf '%s\n' '{error}' >&2; exit 1 ;;
+  'snapshot pool/other@auto_'*) ;;
+  'list -Hp -t snapshot -o name -d 1 pool/other') ;;
+  *) exit 99 ;;
+esac
+"#
+        ));
+        let output = fixture.run();
+        assert!(output.status.success(), "{}", stderr(&output));
+        assert!(stderr(&output).contains("pool/home failed to create snapshot auto_"));
+        assert!(stderr(&output).contains(error));
+        assert_eq!(
+            fixture.normalized_calls(),
+            [
+                "list -Hp -t filesystem -o name",
+                "snapshot pool/home@<timestamp>",
+                "snapshot pool/other@<timestamp>",
+                "list -Hp -t snapshot -o name -d 1 pool/other",
+            ]
+        );
+        let calls = fixture.calls();
+        assert_eq!(
+            calls[1].split_once('@').unwrap().1,
+            calls[2].split_once('@').unwrap().1
+        );
+    }
+}
+
+#[test]
+fn dependent_clone_failure_is_reported_and_remaining_deletions_continue() {
+    let fixture = Fixture::new(
+        r#"
+case "$*" in
+  'list -Hp -t filesystem -o name') printf '%s\n' pool/home ;;
+  'snapshot pool/home@auto_'*) ;;
+  'list -Hp -t snapshot -o name -d 1 pool/home')
+    printf '%s\n' pool/home@auto_200002020115 pool/home@auto_200002020130 pool/home@auto_200002020145 ;;
+  'destroy pool/home@auto_200002020115')
+    printf '%s\n' "cannot destroy 'pool/home@auto_200002020115': snapshot has dependent clones" >&2; exit 1 ;;
+  'destroy pool/home@auto_200002020130') ;;
+  *) exit 99 ;;
+esac
+"#,
+    );
+    let output = fixture.run();
+    assert!(output.status.success(), "{}", stderr(&output));
+    assert!(
+        stderr(&output).contains(
+            "pool/home@auto_200002020115 failed to delete: snapshot has dependent clones"
+        )
+    );
+    assert_eq!(
+        fixture.calls().last().unwrap(),
+        "destroy pool/home@auto_200002020130"
+    );
+}
+
+#[test]
+fn unexpected_destroy_failure_aborts_and_reports_the_error() {
+    let fixture = Fixture::new(
+        r#"
+case "$1" in
+  list)
+    if [ "$4" = filesystem ]; then
+      printf '%s\n' pool/home
+    else
+      printf '%s\n' pool/home@auto_200002020115 pool/home@auto_200002020130 pool/home@auto_200002020145
+    fi ;;
+  snapshot) ;;
+  destroy) printf '%s\n' 'permission denied' >&2; exit 1 ;;
+esac
+"#,
+    );
+    let output = fixture.run();
+    assert_eq!(output.status.code(), Some(1), "{}", stderr(&output));
+    assert!(stderr(&output).contains("permission denied"));
+    assert!(stderr(&output).contains("snapshot_manager failed"));
+    assert_eq!(
+        fixture.calls().last().unwrap(),
+        "destroy pool/home@auto_200002020115"
+    );
+}
+
+#[test]
+fn failed_list_never_uses_partial_output() {
+    for stream in ["", " >&2"] {
+        let fixture = Fixture::new(&format!(
+            "printf '%s\\n' pool/home\nprintf '%s\\n' 'cannot list datasets'{stream}\nexit 1"
+        ));
+        let output = fixture.run();
+        assert_eq!(output.status.code(), Some(1), "{}", stderr(&output));
+        assert!(stderr(&output).contains("cannot list datasets"));
+        assert!(stderr(&output).contains("snapshot_manager failed"));
+        assert_eq!(fixture.calls(), ["list -Hp -t filesystem -o name"]);
+    }
+}
+
+#[test]
+fn failed_snapshot_listing_aborts_without_destroying_anything() {
+    let fixture = Fixture::new(
+        r#"
+case "$*" in
+  'list -Hp -t filesystem -o name') printf '%s\n' pool/home ;;
+  'snapshot pool/home@auto_'*) ;;
+  *) printf '%s\n' pool/home@auto_200002020115; exit 1 ;;
+esac
+"#,
+    );
+    let output = fixture.run();
+    assert_eq!(output.status.code(), Some(1), "{}", stderr(&output));
+    assert!(stderr(&output).contains("snapshot_manager failed"));
+    assert_eq!(fixture.calls().len(), 3);
+}
+
+#[test]
+fn invalid_config_stops_before_any_zfs_commands() {
+    let fixture = Fixture::new("exit 99");
+    fs::write(
+        &fixture.config,
+        "[default]\n15_min = -1\nhourly = 1\ndaily = 0\nmonthly = 0",
+    )
+    .unwrap();
+    let output = fixture.run();
+    assert_eq!(output.status.code(), Some(1), "{}", stderr(&output));
+    assert!(stderr(&output).contains("Invalid configuration"));
+    assert!(fixture.calls().is_empty());
+}
+
+#[test]
+fn missing_zfs_executable_fails_and_reports_the_error() {
+    let fixture = Fixture::new("exit 99");
+    fs::remove_file(fixture.dir.path().join("zfs")).unwrap();
+    let output = fixture.run();
+    assert_eq!(output.status.code(), Some(1), "{}", stderr(&output));
+    assert!(stderr(&output).contains("Failed to execute zfs"));
+    assert!(stderr(&output).contains("snapshot_manager failed"));
+    assert!(fixture.calls().is_empty());
+}
+
+#[test]
+fn dataset_names_are_passed_as_one_argument_without_a_shell() {
+    let fixture = Fixture::new(
+        r#"
+case "$1" in
+  list)
+    [ "$*" = 'list -Hp -t filesystem -o name' ] || exit 98
+    printf '%s\n' 'pool/two words;touch injected' ;;
+  snapshot)
+    [ "$#" -eq 2 ] || exit 97
+    case "$2" in
+      'pool/two words;touch injected@auto_'*) printf '%s\n' 'argument preserved' >&2; exit 1 ;;
+      *) exit 96 ;;
+    esac ;;
+  *) exit 99 ;;
+esac
+"#,
+    );
+    let output = fixture.run();
+    assert!(output.status.success(), "{}", stderr(&output));
+    assert!(stderr(&output).contains("argument preserved"));
+    assert_eq!(
+        fixture.normalized_calls(),
+        [
+            "list -Hp -t filesystem -o name",
+            "snapshot pool/two words;touch injected@<timestamp>"
+        ]
+    );
+    assert!(fs::read_dir(fixture.dir.path()).unwrap().all(|entry| {
+        !entry
+            .unwrap()
+            .file_name()
+            .to_string_lossy()
+            .starts_with("injected")
+    }));
+}

rust/van_weather/package.nix

@@ -2,15 +2,7 @@
 rustPlatform.buildRustPackage {
   pname = "van-weather";
   version = "0.1.0";
-  src = lib.fileset.toSource {
-    root = ../..;
-    fileset = lib.fileset.unions [
-      ../../Cargo.toml
-      ../../Cargo.lock
-      ../../clippy.toml
-      ../.
-    ];
-  };
+  src = import ../rust-source.nix { inherit lib; };
 
   cargoLock.lockFile = ../../Cargo.lock;
   cargoBuildFlags = [