Keep command output to the README's stdout and stderr rules (closes #224)

The startup banner moves from stdout to stderr, so a `completion`
script, a `config get` value and the hidden `__complete` command print
only their own output. `--quiet`, `--cron` and `--json` still suppress
it.

A failing `remote info`, `prune` or `snapshot remove` under `--json`
now reports its error on stderr. Their reporters returned early under
`--json`, so the failure reached neither stream.

`snapshot verify --quiet` writes no report. A failure is still
returned and printed on stderr, with the same exit status.

Judgement call: the banner's stream, posted on the issue for the owner.

Model: opus-5-5

internal/vaultik/snapshot.go

@@ -732,7 +732,7 @@ func (v *Vaultik) VerifySnapshotWithOptions(
 	result.BlobCount = manifest.BlobCount
 	result.TotalSize = manifest.TotalCompressedSize
 
-	if !opts.JSON {
+	if !opts.JSON && !v.UI.Quiet() {
 		v.stdoutf("Snapshot information:\n")
 		v.stdoutf("  Blob count:   %d\n", manifest.BlobCount)
 		v.stdoutf("  Total size:   %s\n", ubytes(manifest.TotalCompressedSize))
@@ -787,7 +787,7 @@ func (v *Vaultik) printVerifyHeader(snapshotID string, opts *VerifyOptions) {
 		snapshotTime = t
 	}
 
-	if !opts.JSON {
+	if !opts.JSON && !v.UI.Quiet() {
 		v.stdoutf("Verifying snapshot %s\n", snapshotID)
 
 		if !snapshotTime.IsZero() {
@@ -827,7 +827,7 @@ func (v *Vaultik) verifyManifestBlobs(
 		stat, err := v.Storage.Stat(v.ctx, blobPath)
 		switch {
 		case err != nil:
-			if !opts.JSON {
+			if !opts.JSON && !v.UI.Quiet() {
 				v.stdoutf("  Missing: %s (%s)\n",
 					blob.Hash, ubytes(blob.CompressedSize))
 			}
@@ -835,7 +835,7 @@ func (v *Vaultik) verifyManifestBlobs(
 			missing++
 			missingSize += blob.CompressedSize
 		case stat.Size != blob.CompressedSize:
-			if !opts.JSON {
+			if !opts.JSON && !v.UI.Quiet() {
 				v.stdoutf("  Wrong size: %s (store has %s, manifest lists %s)\n",
 					blob.Hash, ubytes(stat.Size), ubytes(blob.CompressedSize))
 			}
@@ -867,6 +867,22 @@ func (v *Vaultik) formatVerifyResult(
 		return v.outputVerifyJSON(result)
 	}
 
+	// Under --quiet a failure is still returned, and the cli layer
+	// prints it on stderr.
+	if !v.UI.Quiet() {
+		v.printVerifySummary(result, failure)
+	}
+
+	if failure != "" {
+		return fmt.Errorf("%w: %s", errSnapshotVerifyFailed, failure)
+	}
+
+	return nil
+}
+
+// printVerifySummary prints the counts and the status line that end the
+// human-readable shallow verify report. failure is empty when it passed.
+func (v *Vaultik) printVerifySummary(result *VerifyResult, failure string) {
 	v.stdoutf("\nVerification complete:\n")
 	v.stdoutf("  Present with listed size: %d blobs\n", result.Verified)
 
@@ -888,14 +904,12 @@ func (v *Vaultik) formatVerifyResult(
 	if failure != "" {
 		v.stdoutf("FAILED - %s\n", failure)
 
-		return fmt.Errorf("%w: %s", errSnapshotVerifyFailed, failure)
+		return
 	}
 
 	// Report only what was actually checked: presence and size, not contents.
 	v.stdoutf("OK - all %d blobs listed in the manifest are present with the "+
 		"listed size; contents not checked (use --deep)\n", result.Verified)
-
-	return nil
 }
 
 // shallowVerifyFailure returns a human-readable description of everything

internal/vaultik/verify.go

@@ -103,7 +103,7 @@ func (v *Vaultik) RunDeepVerify(snapshotID string, opts *VerifyOptions) error {
 
 	log.Info("Starting snapshot verification", "snapshot_id", snapshotID, "mode", "deep")
 
-	if !opts.JSON {
+	if !opts.JSON && !v.UI.Quiet() {
 		v.stdoutf("Deep verification of snapshot: %s\n\n", snapshotID)
 	}
 
@@ -143,10 +143,13 @@ func (v *Vaultik) RunDeepVerify(snapshotID string, opts *VerifyOptions) error {
 
 	log.Info("✓ Verification completed successfully",
 		"snapshot_id", snapshotID, "mode", "deep", "blobs_verified", len(dbBlobs))
-	v.stdoutf("\n✓ Verification completed successfully\n")
-	v.stdoutf("  Snapshot:       %s\n", snapshotID)
-	v.stdoutf("  Blobs verified: %d\n", len(dbBlobs))
-	v.stdoutf("  Total size:     %s\n", ubytes(totalSize))
+
+	if !v.UI.Quiet() {
+		v.stdoutf("\n✓ Verification completed successfully\n")
+		v.stdoutf("  Snapshot:       %s\n", snapshotID)
+		v.stdoutf("  Blobs verified: %d\n", len(dbBlobs))
+		v.stdoutf("  Total size:     %s\n", ubytes(totalSize))
+	}
 
 	return nil
 }
@@ -170,7 +173,7 @@ func (v *Vaultik) loadVerificationData(
 	// remote manifests; see its doc comment.
 	log.Info("Downloading manifest", "remote_key", remoteKey)
 
-	if !opts.JSON {
+	if !opts.JSON && !v.UI.Quiet() {
 		v.stdoutf("Downloading manifest...\n")
 	}
 
@@ -185,7 +188,7 @@ func (v *Vaultik) loadVerificationData(
 		"manifest_blob_count", manifest.BlobCount,
 		"manifest_total_size", ubytes(manifest.TotalCompressedSize))
 
-	if !opts.JSON {
+	if !opts.JSON && !v.UI.Quiet() {
 		v.stdoutf("Manifest loaded: %d blobs (%s)\n",
 			manifest.BlobCount, ubytes(manifest.TotalCompressedSize))
 		v.stdoutf("Downloading and decrypting database...\n")
@@ -215,7 +218,7 @@ func (v *Vaultik) loadVerificationData(
 		"db_blob_count", len(dbBlobs),
 		"db_total_size", ubytes(dbTotalSize))
 
-	if !opts.JSON {
+	if !opts.JSON && !v.UI.Quiet() {
 		v.stdoutf("Database loaded: %d blobs (%s)\n",
 			len(dbBlobs), ubytes(dbTotalSize))
 	}
@@ -273,7 +276,7 @@ func (v *Vaultik) runVerificationSteps(
 	totalSize int64,
 	identities []age.Identity,
 ) error {
-	if !opts.JSON {
+	if !opts.JSON && !v.UI.Quiet() {
 		v.stdoutf("Verifying manifest against database...\n")
 	}
 
@@ -282,7 +285,7 @@ func (v *Vaultik) runVerificationSteps(
 		return v.deepVerifyFailure(result, opts, err.Error(), err)
 	}
 
-	if !opts.JSON {
+	if !opts.JSON && !v.UI.Quiet() {
 		v.stdoutf("Manifest verified.\n")
 		v.stdoutf("Checking blob existence in remote storage...\n")
 	}
@@ -292,7 +295,7 @@ func (v *Vaultik) runVerificationSteps(
 		return v.deepVerifyFailure(result, opts, err.Error(), err)
 	}
 
-	if !opts.JSON {
+	if !opts.JSON && !v.UI.Quiet() {
 		v.stdoutf("All blobs exist.\n")
 		v.stdoutf("Downloading and verifying blob contents (%d blobs, %s)...\n",
 			len(dbBlobs), ubytes(totalSize))
@@ -748,7 +751,7 @@ func (v *Vaultik) performDeepVerificationFromDB(
 			"eta", eta.Round(time.Second),
 		)
 
-		if !opts.JSON {
+		if !opts.JSON && !v.UI.Quiet() {
 			v.stdoutf("  Verified %d/%d blobs (%d remaining) - %s/%s - elapsed %s, eta %s\n",
 				i+1, len(blobs), remaining,
 				ubytes(bytesProcessed),

internal/vaultik/verify_quiet_test.go

@@ -0,0 +1,102 @@
+package vaultik_test
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/vaultik/internal/log"
+	"sneak.berlin/go/vaultik/internal/snapshot"
+	"sneak.berlin/go/vaultik/internal/ui"
+	"sneak.berlin/go/vaultik/internal/vaultik"
+)
+
+// TestVerify_QuietSuppressesReport is the --quiet contract for
+// `snapshot verify`: neither shallow nor deep verify writes its report,
+// a failed verify still returns its error (which the cli layer prints
+// on stderr), and the --json document still emits.
+func TestVerify_QuietSuppressesReport(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	fs := afero.NewOsFs()
+	tempDir := t.TempDir()
+
+	dataDir := filepath.Join(tempDir, "source")
+	storeDir := filepath.Join(tempDir, "remote")
+	dbPath := filepath.Join(tempDir, "index.sqlite")
+
+	chunkSize := int64(32 * 1024)
+	maxBlobSize := int64(128 * 1024)
+
+	require.NoError(t, fs.MkdirAll(dataDir, 0o755))
+	require.NoError(t, afero.WriteFile(fs,
+		filepath.Join(dataDir, "data.bin"),
+		bytesPattern("quiet-", int(maxBlobSize*2)), 0o644))
+
+	ctx := context.Background()
+
+	cfg, storer, snapshotID := runFileStorageBackup(
+		ctx, t, fs, dataDir, storeDir, dbPath, chunkSize, maxBlobSize)
+
+	// The UI writes to the same buffer as Stdout, as both write to the
+	// process's stdout in production.
+	var stdout bytes.Buffer
+
+	newQuietVerifier := func() *vaultik.Vaultik {
+		v := &vaultik.Vaultik{
+			Config:  cfg,
+			Storage: storer,
+			Fs:      fs,
+			Stdout:  &stdout,
+			Stderr:  io.Discard,
+			UI:      ui.NewWithColor(&stdout, false),
+		}
+		v.SetContext(ctx)
+		v.UI.SetQuiet(true)
+
+		return v
+	}
+
+	require.NoError(t, newQuietVerifier().VerifySnapshotWithOptions(
+		snapshotID, &vaultik.VerifyOptions{}))
+	require.Empty(t, stdout.String(),
+		"shallow verify must write no report under --quiet")
+
+	require.NoError(t, newQuietVerifier().VerifySnapshotWithOptions(
+		snapshotID, &vaultik.VerifyOptions{Deep: true}))
+	require.Empty(t, stdout.String(),
+		"deep verify must write no report under --quiet")
+
+	require.NoError(t, newQuietVerifier().VerifySnapshotWithOptions(
+		snapshotID, &vaultik.VerifyOptions{JSON: true}))
+	require.Equal(t, "ok", decodeVerifyResult(t, stdout.Bytes()).Status,
+		"the --json document must still emit under --quiet")
+
+	// A snapshot without its encrypted database fails shallow verify. A
+	// failed report also lists each missing blob and each blob of the
+	// wrong size, so remove one blob and grow another.
+	require.NoError(t, os.Remove(filepath.Join(storeDir, "metadata",
+		snapshot.RemoteSnapshotKey(snapshotID), "db.zst.age")))
+
+	blobFiles, err := filepath.Glob(
+		filepath.Join(storeDir, "blobs", "*", "*", "*"))
+	require.NoError(t, err)
+	require.GreaterOrEqual(t, len(blobFiles), 2,
+		"the snapshot must span two blobs, one to remove and one to grow")
+	require.NoError(t, os.Remove(blobFiles[0]))
+	growOneBlob(t, fs, filepath.Join(storeDir, "blobs"))
+
+	stdout.Reset()
+
+	require.Error(t, newQuietVerifier().VerifySnapshotWithOptions(
+		snapshotID, &vaultik.VerifyOptions{}),
+		"--quiet must not change the outcome of a failed verify")
+	require.Empty(t, stdout.String(),
+		"a failed verify must write no report under --quiet")
+}