Refuse a backup destination an unplugged volume left empty (closes #239)

Every backup writes vaultik-destination.txt at the destination root.
While the local index holds snapshots, a destination without it is
not present: snapshot create refuses before writing, prune and
snapshot purge fail, and snapshot list and snapshot remove act as for
a destination that cannot be listed. snapshot create checks before it
drops incomplete snapshots, snapshot remove before it looks on the
destination. remote nuke deletes the marker last. The file:// backend
never creates its destination directory; that protects a directory on
a removable volume, not a mount point.

Tests back up into directories that exist; fixtures for a written
destination carry the marker.

Judgement call: the marker is rewritten on every backup.
Deviation: for the complexity limit, two blocks moved, unchanged, into
snapshotNamesToCreate and confirmRemoveSnapshot.

Model: opus-5-5

internal/cli/entry_prune_json_test.go

@@ -101,7 +101,8 @@ func TestEntryPruneJSONStdoutIsExactlyOneDocument(t *testing.T) {
 // writeHermeticPruneConfig builds a config over a temp directory with an
 // empty destination directory and, if seedStale is set, creates the
 // index database up front with one snapshot record that has no
-// counterpart on the destination store. Returns the config path.
+// counterpart on the destination store, and gives the destination the
+// marker a backup writes. Returns the config path.
 func writeHermeticPruneConfig(t *testing.T, seedStale bool) string {
 	t.Helper()
 
@@ -131,6 +132,11 @@ func writeHermeticPruneConfig(t *testing.T, seedStale bool) string {
 
 	if seedStale {
 		seedStaleSnapshotRecord(t, indexPath)
+
+		// While the local index holds a snapshot, prune fails on a
+		// destination without the marker a backup writes.
+		require.NoError(t, os.WriteFile(
+			filepath.Join(storeDir, "vaultik-destination.txt"), nil, 0o600))
 	}
 
 	return configPath

internal/cli/entry_snapshot_purge_test.go

@@ -41,6 +41,11 @@ func TestEntrySnapshotPurgeKeepsMetadataWhenLocalIndexDeleteFails(t *testing.T)
 	// too, so the purge selects it rather than dropping it as stale.
 	seedStaleSnapshotRecord(t, indexPath)
 
+	// While the local index holds a snapshot, purge fails on a
+	// destination without the marker a backup writes.
+	require.NoError(t, os.WriteFile(
+		filepath.Join(dir, "store", "vaultik-destination.txt"), nil, 0o600))
+
 	manifestDir := filepath.Join(dir, "store", "metadata",
 		snapshot.RemoteSnapshotKey(stalePruneSnapshotID))
 	require.NoError(t, os.MkdirAll(manifestDir, 0o750))
@@ -59,10 +64,12 @@ func TestEntrySnapshotPurgeKeepsMetadataWhenLocalIndexDeleteFails(t *testing.T)
 	require.NoError(t, err)
 	require.NoError(t, db.Close())
 
-	code, _, _ := runEntry(t, flagConfig, configPath,
+	code, _, stderr := runEntry(t, flagConfig, configPath,
 		cmdSnapshot, cmdPurge, flagOlderThan, "30d", flagForce)
 
 	assert.Equal(t, 1, code)
+	assert.Contains(t, stderr, "simulated index error",
+		"the purge must fail at the local-index delete")
 	assert.FileExists(t, manifestPath,
 		"the snapshot is still in the local index, so its metadata must stay")
 }