True @joshcooper but in this case, the provider should have grabbed the command from the on-disk entity. So there is a valid is-value, even without a should-value. At least that's my understanding.

What's most confusing is that from the command line (quite likely the agent also), it works as expected w/o a command in the manifest. I literally did this

$ RUBYLIB=lib puppet apply -e 'cron { "My daily failure": ensure => present, special => absent }' 
Notice: /Stage[main]//Cron[My daily failure]/special: undefined 'special' from 'daily'
Notice: Finished catalog run in 0.18 seconds