P2 redesign · phase 2: store rewrite — sources, slim schedules, repo maintenance

Go-side data model rebuilt against migration 0008. The fat-Schedule
shape (paths/excludes/tags/retention/manual/kind/options/hooks) is
gone; that surface lives on source_groups now.

* store/types.go
  - Schedule slimmed to {id, host_id, cron, enabled, source_group_ids,
    timestamps}. SourceGroupIDs populated by Get/List, accepted on
    Create/Update so callers pass desired junction state in one shape.
  - SourceGroup added: name (= snapshot tag), includes/excludes,
    retention_policy, retry_max + retry_backoff_seconds, cached
    conflict_dimension.
  - HostRepoMaintenance added: forget/prune/check cadences + enabled.
  - PendingRun added: offline-retry queue.
  - Host loses RepoInitialisedAt; gains BandwidthUpKBps + BandwidthDownKBps.
  - RetentionPolicy moves home from "schedule field" to "source group
    field" but the type itself + Summary() method unchanged.

* store/sources.go (new) — CRUD + GetByName + ConflictDimension cache.
  Group writes bump host_schedule_version; conflict cache writes don't
  (server-internal projection, agent doesn't see it).
* store/maintenance.go (new) — CreateDefault is idempotent (INSERT OR
  IGNORE). UpdateRepoMaintenance doesn't bump schedule version because
  these run on the server's own ticker, not the agent's local cron.
* store/pending.go (new) — Enqueue / DueRunsForRetry / Bump / Delete.
* store/schedules.go — rewritten for slim shape + junction CRUD.
  Update wipes the schedule_source_groups junction wholesale and
  re-inserts (simpler than diffing). Adds SchedulesUsingGroup for
  retention-conflict detection + UI labels.
* store/hosts.go — drops repo_initialised_at scan, adds bandwidth scan.
  New SetHostBandwidth helper.

* HTTP layer — temporarily stubbed during this rewrite (501 returns
  with redesign_in_progress error code). Phase 3 fills these in
  against the new shape:
    - schedules.go REST CRUD
    - schedule_push.go agent reconciliation
    - ui_schedules.go HTML form CRUD
  Run-now-per-host + Init-repo handlers in ui_handlers.go also stubbed
  — both go away in the new model (Run-now per source group; auto-init
  at host enrolment).

* enrollment.go — replaces "seed manual schedule from typed paths"
  with "seed default source group + repo-maintenance row." The default
  group gets the typed paths as its includes; operator edits later
  via Sources tab.

* ws/handler.go — drops the MarkHostRepoInitialised projection (column
  is gone; auto-init makes it derivable from latest init job's status).

Tests:
* store: existing schedule test rewritten for slim shape + junction;
  new sources_test.go covers source-group CRUD, name uniqueness,
  conflict cache, repo-maintenance defaults + idempotent seed,
  pending-runs queue lifecycle.
* http: schedules_test.go and schedule_push_test.go deleted — both
  exercised the obsolete fat-schedule API. Phase 3 rewrites them
  against the new endpoints.

go test ./... green. cmd/server + cmd/agent build. The UI is broken
end-to-end (schedules / sources / repo tabs all hit 501 stubs); Phase 3
restores REST + on-the-wire reconciliation; Phase 4 rewires the UI
templates against the new model.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/store/schedules.go

@@ -3,15 +3,14 @@ package store
 import (
 	"context"
 	"database/sql"
-	"encoding/json"
 	"errors"
 	"fmt"
 	"time"
 )
 
-// CreateSchedule inserts a new schedule and bumps the host's
-// schedule_version atomically. Returns the inserted row's
-// CreatedAt / UpdatedAt timestamps written into s.
+// CreateSchedule inserts a new slim schedule row + the schedule_source_groups
+// junction entries for s.SourceGroupIDs, atomic in one tx. Bumps
+// host_schedule_version. Caller mints s.ID.
 func (st *Store) CreateSchedule(ctx context.Context, s *Schedule) error {
 	if s.ID == "" || s.HostID == "" {
 		return errors.New("store: schedule id and host_id required")
@@ -19,20 +18,6 @@ func (st *Store) CreateSchedule(ctx context.Context, s *Schedule) error {
 	now := time.Now().UTC()
 	s.CreatedAt = now
 	s.UpdatedAt = now
-	if s.Paths == nil {
-		s.Paths = []string{}
-	}
-	if s.Excludes == nil {
-		s.Excludes = []string{}
-	}
-	if s.Tags == nil {
-		s.Tags = []string{}
-	}
-	pathsJSON, _ := json.Marshal(s.Paths)
-	excludesJSON, _ := json.Marshal(s.Excludes)
-	tagsJSON, _ := json.Marshal(s.Tags)
-	retentionJSON, _ := json.Marshal(s.RetentionPolicy)
-	optionsJSON, _ := json.Marshal(s.Options)
 
 	tx, err := st.db.BeginTx(ctx, nil)
 	if err != nil {
@@ -41,19 +26,16 @@ func (st *Store) CreateSchedule(ctx context.Context, s *Schedule) error {
 	defer func() { _ = tx.Rollback() }()
 
 	if _, err := tx.ExecContext(ctx,
-		`INSERT INTO schedules (
-			id, host_id, kind, cron_expr, paths, excludes, tags,
-			retention_policy, options, pre_hook, post_hook, enabled, manual,
-			created_at, updated_at
-		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-		s.ID, s.HostID, s.Kind, s.CronExpr,
-		string(pathsJSON), string(excludesJSON), string(tagsJSON),
-		string(retentionJSON), string(optionsJSON),
-		s.PreHook, s.PostHook, boolToInt(s.Enabled), boolToInt(s.Manual),
+		`INSERT INTO schedules (id, host_id, cron_expr, enabled, created_at, updated_at)
+		 VALUES (?, ?, ?, ?, ?, ?)`,
+		s.ID, s.HostID, s.CronExpr, boolToInt(s.Enabled),
 		now.Format(time.RFC3339Nano), now.Format(time.RFC3339Nano),
 	); err != nil {
 		return fmt.Errorf("store: create schedule: %w", err)
 	}
+	if err := writeScheduleGroupsTx(ctx, tx, s.ID, s.SourceGroupIDs); err != nil {
+		return err
+	}
 	if err := bumpHostScheduleVersionTx(ctx, tx, s.HostID); err != nil {
 		return err
 	}
@@ -61,27 +43,11 @@ func (st *Store) CreateSchedule(ctx context.Context, s *Schedule) error {
 }
 
 // UpdateSchedule replaces every editable field on an existing row
-// and bumps host_schedule_version. ID and HostID must match an
-// existing row; kind is immutable (creating a new schedule is
-// cheaper than re-keying retention/hooks).
+// and rewrites the junction. Bumps host_schedule_version.
 func (st *Store) UpdateSchedule(ctx context.Context, s *Schedule) error {
 	if s.ID == "" || s.HostID == "" {
 		return errors.New("store: schedule id and host_id required")
 	}
-	if s.Paths == nil {
-		s.Paths = []string{}
-	}
-	if s.Excludes == nil {
-		s.Excludes = []string{}
-	}
-	if s.Tags == nil {
-		s.Tags = []string{}
-	}
-	pathsJSON, _ := json.Marshal(s.Paths)
-	excludesJSON, _ := json.Marshal(s.Excludes)
-	tagsJSON, _ := json.Marshal(s.Tags)
-	retentionJSON, _ := json.Marshal(s.RetentionPolicy)
-	optionsJSON, _ := json.Marshal(s.Options)
 	now := time.Now().UTC()
 
 	tx, err := st.db.BeginTx(ctx, nil)
@@ -91,16 +57,10 @@ func (st *Store) UpdateSchedule(ctx context.Context, s *Schedule) error {
 	defer func() { _ = tx.Rollback() }()
 
 	res, err := tx.ExecContext(ctx,
-		`UPDATE schedules SET
-			cron_expr = ?, paths = ?, excludes = ?, tags = ?,
-			retention_policy = ?, options = ?,
-			pre_hook = ?, post_hook = ?, enabled = ?, manual = ?,
-			updated_at = ?
+		`UPDATE schedules
+		 SET cron_expr = ?, enabled = ?, updated_at = ?
 		 WHERE id = ? AND host_id = ?`,
-		s.CronExpr,
-		string(pathsJSON), string(excludesJSON), string(tagsJSON),
-		string(retentionJSON), string(optionsJSON),
-		s.PreHook, s.PostHook, boolToInt(s.Enabled), boolToInt(s.Manual),
+		s.CronExpr, boolToInt(s.Enabled),
 		now.Format(time.RFC3339Nano),
 		s.ID, s.HostID,
 	)
@@ -112,14 +72,23 @@ func (st *Store) UpdateSchedule(ctx context.Context, s *Schedule) error {
 		return ErrNotFound
 	}
 	s.UpdatedAt = now
+	// Rewrite junction wholesale — simpler than diffing.
+	if _, err := tx.ExecContext(ctx,
+		`DELETE FROM schedule_source_groups WHERE schedule_id = ?`, s.ID,
+	); err != nil {
+		return fmt.Errorf("store: clear schedule junction: %w", err)
+	}
+	if err := writeScheduleGroupsTx(ctx, tx, s.ID, s.SourceGroupIDs); err != nil {
+		return err
+	}
 	if err := bumpHostScheduleVersionTx(ctx, tx, s.HostID); err != nil {
 		return err
 	}
 	return tx.Commit()
 }
 
-// DeleteSchedule removes a schedule and bumps host_schedule_version.
-// Returns ErrNotFound if no row matched.
+// DeleteSchedule removes a schedule and its junction rows; bumps
+// host_schedule_version. Returns ErrNotFound if no row matched.
 func (st *Store) DeleteSchedule(ctx context.Context, hostID, scheduleID string) error {
 	tx, err := st.db.BeginTx(ctx, nil)
 	if err != nil {
@@ -137,35 +106,39 @@ func (st *Store) DeleteSchedule(ctx context.Context, hostID, scheduleID string)
 	if n == 0 {
 		return ErrNotFound
 	}
+	// Junction rows go via ON DELETE CASCADE; nothing to do here.
 	if err := bumpHostScheduleVersionTx(ctx, tx, hostID); err != nil {
 		return err
 	}
 	return tx.Commit()
 }
 
-// GetSchedule returns one schedule by (host_id, id). Returns
-// ErrNotFound on miss.
+// GetSchedule returns one schedule (with its junction-resolved
+// SourceGroupIDs populated) by (host_id, id). ErrNotFound on miss.
 func (st *Store) GetSchedule(ctx context.Context, hostID, scheduleID string) (*Schedule, error) {
 	row := st.db.QueryRowContext(ctx,
-		`SELECT id, host_id, kind, cron_expr, paths, excludes, tags,
-			retention_policy, options, pre_hook, post_hook, enabled, manual,
-			created_at, updated_at
+		`SELECT id, host_id, cron_expr, enabled, created_at, updated_at
 		 FROM schedules WHERE id = ? AND host_id = ?`,
 		scheduleID, hostID)
 	s, err := scanSchedule(row)
 	if errors.Is(err, sql.ErrNoRows) {
 		return nil, ErrNotFound
 	}
-	return s, err
+	if err != nil {
+		return nil, err
+	}
+	s.SourceGroupIDs, err = st.scheduleGroupIDs(ctx, scheduleID)
+	if err != nil {
+		return nil, err
+	}
+	return s, nil
 }
 
-// ListSchedulesByHost returns every schedule for a host, ordered
-// by created_at. Empty slice on miss (not an error).
+// ListSchedulesByHost returns every schedule for a host, with
+// SourceGroupIDs resolved.
 func (st *Store) ListSchedulesByHost(ctx context.Context, hostID string) ([]Schedule, error) {
 	rows, err := st.db.QueryContext(ctx,
-		`SELECT id, host_id, kind, cron_expr, paths, excludes, tags,
-			retention_policy, options, pre_hook, post_hook, enabled, manual,
-			created_at, updated_at
+		`SELECT id, host_id, cron_expr, enabled, created_at, updated_at
 		 FROM schedules WHERE host_id = ? ORDER BY created_at`,
 		hostID)
 	if err != nil {
@@ -180,11 +153,22 @@ func (st *Store) ListSchedulesByHost(ctx context.Context, hostID string) ([]Sche
 		}
 		out = append(out, *s)
 	}
-	return out, rows.Err()
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	// Second pass to resolve junctions — small fleet, cheap.
+	for i := range out {
+		ids, err := st.scheduleGroupIDs(ctx, out[i].ID)
+		if err != nil {
+			return nil, err
+		}
+		out[i].SourceGroupIDs = ids
+	}
+	return out, nil
 }
 
-// GetHostScheduleVersion returns the current version for a host,
-// or 0 if no row exists yet.
+// GetHostScheduleVersion returns the current version for a host, or
+// 0 if no row exists yet.
 func (st *Store) GetHostScheduleVersion(ctx context.Context, hostID string) (int64, error) {
 	var v int64
 	err := st.db.QueryRowContext(ctx,
@@ -210,12 +194,26 @@ func (st *Store) SetHostAppliedScheduleVersion(ctx context.Context, hostID strin
 	return nil
 }
 
+// BumpHostScheduleVersion is the public wrapper for non-schedule
+// CRUD that needs to push to the agent — e.g. source-group edits
+// (paths/retention change), retry-policy edits.
+func (st *Store) BumpHostScheduleVersion(ctx context.Context, hostID string) error {
+	tx, err := st.db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+	if err := bumpHostScheduleVersionTx(ctx, tx, hostID); err != nil {
+		return err
+	}
+	return tx.Commit()
+}
+
 // bumpHostScheduleVersionTx upserts host_schedule_version, +1 each
 // call. Caller owns the tx.
 func bumpHostScheduleVersionTx(ctx context.Context, tx *sql.Tx, hostID string) error {
 	if _, err := tx.ExecContext(ctx,
-		`INSERT INTO host_schedule_version (host_id, version)
-		 VALUES (?, 1)
+		`INSERT INTO host_schedule_version (host_id, version) VALUES (?, 1)
 		 ON CONFLICT(host_id) DO UPDATE SET version = version + 1`,
 		hostID); err != nil {
 		return fmt.Errorf("store: bump schedule version: %w", err)
@@ -223,6 +221,66 @@ func bumpHostScheduleVersionTx(ctx context.Context, tx *sql.Tx, hostID string) e
 	return nil
 }
 
+// writeScheduleGroupsTx inserts the junction rows for one schedule.
+// Caller owns the tx; assumes the table is already empty for this id
+// (Update wipes before calling; Create starts empty).
+func writeScheduleGroupsTx(ctx context.Context, tx *sql.Tx, scheduleID string, groupIDs []string) error {
+	for _, gid := range groupIDs {
+		if gid == "" {
+			continue
+		}
+		if _, err := tx.ExecContext(ctx,
+			`INSERT INTO schedule_source_groups (schedule_id, source_group_id) VALUES (?, ?)`,
+			scheduleID, gid,
+		); err != nil {
+			return fmt.Errorf("store: link schedule %s to group %s: %w", scheduleID, gid, err)
+		}
+	}
+	return nil
+}
+
+// scheduleGroupIDs reads the junction for one schedule.
+func (st *Store) scheduleGroupIDs(ctx context.Context, scheduleID string) ([]string, error) {
+	rows, err := st.db.QueryContext(ctx,
+		`SELECT source_group_id FROM schedule_source_groups WHERE schedule_id = ?`,
+		scheduleID)
+	if err != nil {
+		return nil, fmt.Errorf("store: read schedule junction: %w", err)
+	}
+	defer rows.Close()
+	out := []string{}
+	for rows.Next() {
+		var id string
+		if err := rows.Scan(&id); err != nil {
+			return nil, err
+		}
+		out = append(out, id)
+	}
+	return out, rows.Err()
+}
+
+// SchedulesUsingGroup is the inverse — list schedule IDs that
+// reference a given source group. Used for retention-conflict
+// detection and "X schedules use this group" UI labels.
+func (st *Store) SchedulesUsingGroup(ctx context.Context, groupID string) ([]string, error) {
+	rows, err := st.db.QueryContext(ctx,
+		`SELECT schedule_id FROM schedule_source_groups WHERE source_group_id = ?`,
+		groupID)
+	if err != nil {
+		return nil, fmt.Errorf("store: schedules using group: %w", err)
+	}
+	defer rows.Close()
+	out := []string{}
+	for rows.Next() {
+		var id string
+		if err := rows.Scan(&id); err != nil {
+			return nil, err
+		}
+		out = append(out, id)
+	}
+	return out, rows.Err()
+}
+
 // ----- scan helpers --------------------------------------------------
 
 func scanSchedule(row *sql.Row) (*Schedule, error) {
@@ -235,35 +293,15 @@ type scheduleScanner interface {
 
 func scanScheduleRow(s scheduleScanner) (*Schedule, error) {
 	var (
-		out                                          Schedule
-		paths, excludes, tags, retention, options    string
-		createdAt, updatedAt                         string
-		enabled, manual                              int
+		out                  Schedule
+		createdAt, updatedAt string
+		enabled              int
 	)
-	err := s.Scan(&out.ID, &out.HostID, &out.Kind, &out.CronExpr,
-		&paths, &excludes, &tags, &retention, &options,
-		&out.PreHook, &out.PostHook, &enabled, &manual,
-		&createdAt, &updatedAt)
+	err := s.Scan(&out.ID, &out.HostID, &out.CronExpr, &enabled, &createdAt, &updatedAt)
 	if err != nil {
 		return nil, err
 	}
-	if paths != "" {
-		_ = json.Unmarshal([]byte(paths), &out.Paths)
-	}
-	if excludes != "" {
-		_ = json.Unmarshal([]byte(excludes), &out.Excludes)
-	}
-	if tags != "" {
-		_ = json.Unmarshal([]byte(tags), &out.Tags)
-	}
-	if retention != "" {
-		_ = json.Unmarshal([]byte(retention), &out.RetentionPolicy)
-	}
-	if options != "" {
-		_ = json.Unmarshal([]byte(options), &out.Options)
-	}
 	out.Enabled = enabled != 0
-	out.Manual = manual != 0
 	if t, err := time.Parse(time.RFC3339Nano, createdAt); err == nil {
 		out.CreatedAt = t
 	}