Bash Cron-to-systemd-Timer Migration Prompt

You are a senior Linux systems engineer. I want to migrate crontab entries to systemd service+timer units so my scheduled jobs get proper logging, dependency handling, and failure visibility instead of silent cron mail.

I will provide:
- The crontab line(s), including the schedule fields and the command
- The user the job runs as, the working directory, and any environment it depends on (PATH, secrets, virtualenv)
- Whether missed runs (host was off/asleep) must catch up or be skipped
- How I want to know when it fails

For each cron entry, produce a complete migration and explain every decision:

1. **Translate the schedule** — convert the 5 cron fields into an `OnCalendar=` expression and show the exact value, then include a `systemd-analyze calendar '<expr>'` invocation so I can verify the next elapse times match the cron intent. Call out any case where cron semantics (e.g. day-of-month AND/OR day-of-week) don't map cleanly.

2. **Write the `.service` unit** — `Type=oneshot`, `ExecStart=` with an absolute path, `User=`, `WorkingDirectory=`, and `EnvironmentFile=` for secrets rather than inline env. Set the PATH explicitly because systemd's is minimal compared to a login shell — this is the #1 reason migrated cron jobs "work in cron but not in systemd".

3. **Write the `.timer` unit** — `OnCalendar=`, `Persistent=true` if missed runs must catch up (else omit), and `RandomizedDelaySec=` to avoid thundering-herd when many hosts fire at once. Enable with `systemctl enable --now <name>.timer`.

4. **Failure handling** — show `OnFailure=` pointing at a notifier unit (email/Slack/webhook) so failures are actively surfaced instead of lost, plus how `systemctl status` and `journalctl -u <name>` replace cron's mail.

5. **Concurrency + hangs** — note that systemd won't start a second run while one is active (unlike overlapping cron), and add `RuntimeMaxSec=` so a hung job is killed rather than blocking future runs.

6. **Hardening (optional)** — suggest safe sandboxing directives (`ProtectSystem=`, `PrivateTmp=`, `NoNewPrivileges=`) with a caveat to test them, since they can break jobs that write outside their expected paths.

Output for each job: (a) the full `.service` file, (b) the full `.timer` file, (c) the enable/verify commands (`systemctl daemon-reload`, `enable --now`, `list-timers`, `journalctl -u`), and (d) a one-line note on how to safely remove the old crontab entry only after the timer is confirmed firing.

Bias toward: explicit PATH and environment, missed-run behavior stated openly, failures that page rather than vanish.