Make remote nuke delete every object under metadata/ and blobs/ (closes #291)

remote nuke deleted only the snapshot metadata and blobs the snapshot
and blob listings recognise, so a snapshot's database whose manifest
was never uploaded, and any name under blobs/ that is not a blob hash,
survived while nuke reported the store empty.

After removing every snapshot, nuke now deletes every object listed
under metadata/ and blobs/, whatever its name, in place of the blob
prune step. A delete that fails is logged and the others still run. A
listing afterwards decides the result: nuke reports the store empty
only when it finds nothing, and otherwise names each object left and
fails.

Judgement call: nuke no longer prints the blob prune summary.

Model: opus-5-5

internal/vaultik/prune.go

@@ -22,6 +22,11 @@ var errNukeRequiresForce = errors.New(
 // errBlobDeleteFailed reports unreferenced blobs prune could not delete.
 var errBlobDeleteFailed = errors.New("blob(s) could not be deleted")
 
+// errObjectsLeft reports objects remote nuke still finds on the backup
+// destination store after deleting.
+var errObjectsLeft = errors.New(
+	"object(s) still on the backup destination store")
+
 // nukeCommandHint is the command suggested when a remote nuke could not
 // delete everything: running it again deletes what is left, which
 // `vaultik prune` does not do for snapshot metadata.
@@ -35,10 +40,11 @@ const metadataDirName = "metadata"
 // (blobs/<aa>/<bb>/<hash>).
 const blobKeyParts = 4
 
-// NukeRemote deletes every snapshot's metadata and every blob from remote
-// storage, along with any object an upload cut off part-way left under a
-// temporary `.partial` name. After this returns successfully the bucket
-// prefix is empty and the next backup starts from scratch.
+// NukeRemote deletes every object under metadata/ and blobs/ in remote
+// storage, whatever its name, along with any object an upload cut off
+// part-way left under a temporary `.partial` name. It returns
+// successfully only when a listing afterwards finds nothing left there,
+// and the next backup then starts from scratch.
 //
 // Refuses to run unless force is true. The caller is responsible for
 // confirming with the user.
@@ -68,7 +74,8 @@ func (v *Vaultik) NukeRemote(force bool) error {
 }
 
 // emptyDestinationStore does the deleting for NukeRemote and stops at
-// the first step that fails.
+// the first step that fails. It also fails when objects are still
+// listed at the end, naming each one.
 func (v *Vaultik) emptyDestinationStore() error {
 	v.UI.Beginf("Removing all snapshot metadata from backup destination store.")
 
@@ -77,25 +84,62 @@ func (v *Vaultik) emptyDestinationStore() error {
 		return fmt.Errorf("removing all snapshots: %w", err)
 	}
 
-	v.UI.Beginf("Removing any blobs still present in backup destination store.")
+	v.UI.Beginf("Removing everything still present in backup destination store.")
 
-	err = v.PruneBlobs(&PruneOptions{Force: true})
-	if err != nil {
-		return fmt.Errorf("pruning blobs: %w", err)
+	var left []string
+
+	for _, prefix := range []string{"metadata/", "blobs/"} {
+		keys, err := v.deleteEverythingUnder(prefix)
+		if err != nil {
+			return err
+		}
+
+		left = append(left, keys...)
 	}
 
-	// The file and rclone listings skip `.partial` objects, so the two
-	// steps above never delete them.
-	for _, prefix := range []string{"metadata/", "blobs/"} {
-		err = v.Storage.DeletePartialUploads(v.ctx, prefix)
-		if err != nil {
-			return fmt.Errorf("deleting partial uploads: %w", err)
-		}
+	for _, key := range left {
+		v.UI.Warningf("Still on the backup destination store: %s", key)
+	}
+
+	if len(left) > 0 {
+		return fmt.Errorf("%d %w", len(left), errObjectsLeft)
 	}
 
 	return nil
 }
 
+// deleteEverythingUnder deletes every object under prefix, whatever its
+// name, and returns the keys a listing afterwards still finds. A delete
+// that fails is logged and the others still run; that object then
+// shows up in the listing afterwards.
+func (v *Vaultik) deleteEverythingUnder(prefix string) ([]string, error) {
+	keys, err := v.Storage.List(v.ctx, prefix)
+	if err != nil {
+		return nil, fmt.Errorf("listing %s: %w", prefix, err)
+	}
+
+	for _, key := range keys {
+		err = v.Storage.Delete(v.ctx, key)
+		if err != nil {
+			log.Error("Failed to delete object", "key", key, "error", err)
+		}
+	}
+
+	// The file and rclone listings skip `.partial` objects, so the
+	// deletes above never reach them.
+	err = v.Storage.DeletePartialUploads(v.ctx, prefix)
+	if err != nil {
+		return nil, fmt.Errorf("deleting partial uploads: %w", err)
+	}
+
+	left, err := v.Storage.List(v.ctx, prefix)
+	if err != nil {
+		return nil, fmt.Errorf("listing %s: %w", prefix, err)
+	}
+
+	return left, nil
+}
+
 // PruneBlobsResult contains the result of a blob prune operation
 //
 //nolint:tagliatelle // snake_case is the established JSON output format