Make a mistyped subcommand under a group command an error (closes #319)

snapshot, config, remote, database and completion had no Run, and
cobra checks a command's arguments only when it has one, so `vaultik
snapshot craete` printed the group's help and exited 0. Each group now
prints its help only when given no argument; any other word fails as
an unknown command with exit 1, as at the top level.

cobra adds the completion command only when Execute runs, so the root
command now adds it itself to give it a Run. Its scripts then go to
os.Stdout as it was at that moment; a later SetOut does not redirect
them.

Judgement call: the error has no "Did you mean" suggestion, which the
top level gives.

Model: opus-5-5

README.md

@@ -286,7 +286,9 @@ needed.
   remove orphaned blobs from remote storage. By default keeps only the latest
   snapshot per name; use `--keep-newer-than` for a rolling window.
 * `--keep-newer-than <duration>`: With `--prune`, keep snapshots newer than
-  this duration instead of only the latest (e.g. `4w`, `30d`, `6mo`, `1y`)
+  this duration instead of only the latest (e.g. `4w`, `30d`, `6mo`, `1y`).
+  Without `--prune`, or with a value that is not a valid duration, the
+  command fails before the backup starts.
 
 **`snapshot list`**: Show every snapshot known to this host — the union
 of the local index and the backup destination store — with timestamps
@@ -349,9 +351,11 @@ the backup destination store. Blobs are NOT touched — deleting blobs
 requires reading every remaining remote manifest (the destination store
 may hold snapshots this host doesn't know about), which is what
 `vaultik prune` does. On success the command prints the exact `vaultik
-prune` invocation to run as a follow-up. Local row cleanup (files,
-chunks, blobs the snapshot was the last referrer for) runs
-automatically. If the destination store is unreachable, the local-DB
+prune` invocation to run as a follow-up. An ID that names no snapshot in
+the local index or on the destination store is an error; with
+`--local-only`, the snapshot must be in the local index. Local row
+cleanup (files, chunks, blobs the snapshot was the last referrer for)
+runs automatically. If the destination store is unreachable, the local-DB
 removal still completes and a warning is emitted; run `vaultik snapshot
 remove <snapshot-id>` again once the store is reachable to remove the
 snapshot's metadata from it (`vaultik prune` does not). To wipe everything
@@ -399,7 +403,9 @@ orphaned blob figures are reported as unknown; `--json` gives them as
 `null`, lists the remote key of each unreadable manifest in
 `unreadable_manifests` and counts the manifests under skipped names in
 `skipped_manifest_count`. An unreadable manifest also leaves its
-snapshot's blob count and blob size unknown, `null` in `--json`.
+snapshot's blob count and blob size unknown, `null` in `--json`. A file
+under `blobs/` whose name is not a blob hash is not counted as a blob,
+since `prune` never deletes it.
 * `--json`: Output as JSON
 
 **`remote nuke`**: Delete every snapshot's metadata and every blob from the
@@ -412,7 +418,8 @@ destination store.
 entirely. Remote storage is unaffected; the next backup will do a full
 scan and re-deduplicate against existing remote blobs, and the local
 index will re-bind to the currently configured storage destination.
-Use this after changing `storage_url` to a different destination.
+Use this after changing `storage_url`, or `s3.endpoint`, `s3.bucket` or
+`s3.prefix`, to a different destination.
 * `--force`: Skip confirmation prompt
 
 ---

TODO.md

@@ -22,6 +22,51 @@ the tag exists and is exercised; what is left is merging `next` to
 
 # Completed Steps
 
+- 2026-10-13: Stopped `remote info` counting a file under `blobs/` that
+  is not a blob as an orphaned blob
+  ([issue #295](https://git.eeqj.de/sneak/vaultik/issues/295)). A stray
+  file such as `.DS_Store` was reported as an orphaned blob and the
+  report advised running `prune`, which skips such a file and deleted
+  nothing. `remote info` now takes its blob list from the same listing
+  `prune` uses, in the table and in `--json`.
+
+- 2026-10-13: Made `snapshot remove` fail for a snapshot that does not
+  exist ([issue #293](https://git.eeqj.de/sneak/vaultik/issues/293)).
+  The command never checked the ID: it reported the snapshot removed
+  from the local database and from the destination store and exited 0,
+  under `--json`, `--dry-run` and `--local-only` too. An ID that names
+  no snapshot in the local index or on the destination store is now an
+  error; with `--local-only`, the snapshot must be in the local index.
+  The command now reports a removal from either side only when one
+  happened, and `remote_removed` is true only when metadata was deleted.
+
+- 2026-10-12: Bound the local index to the destination an `s3.*` config
+  names ([issue #298](https://git.eeqj.de/sneak/vaultik/issues/298)).
+  Only `storage_url` was checked, so after `s3.bucket` or `s3.prefix`
+  changed, the next backup treated every chunk as already stored,
+  uploaded nothing, and completed a snapshot that could not be restored.
+  Without `storage_url`, the local index is now bound to `s3.endpoint`,
+  `s3.bucket` and `s3.prefix`, and a change is refused as a changed
+  `storage_url` is.
+
+- 2026-10-12: Rejected a retention duration longer than about 292 years
+  ([issue #289](https://git.eeqj.de/sneak/vaultik/issues/289)). The
+  number given to `--older-than` or `--keep-newer-than` was multiplied
+  by the length of its unit with no limit, so from `293y`, `15251w`,
+  `3559mo` or `106752d`, or a sum of parts such as `200y200y`, the
+  result wrapped to a negative duration. The cutoff then lay in the
+  future, every snapshot of the name was deleted, the one just made
+  included, and the command exited 0. Such a duration is now rejected
+  as invalid and nothing is deleted.
+
+- 2026-10-08: Made a backup cancelled under `--skip-errors` stop at once
+  ([issue #286](https://git.eeqj.de/sneak/vaultik/issues/286)). After
+  Ctrl-C or SIGTERM, phase 2 treated the cancellation error from each
+  remaining file like an unreadable file: it opened the file, printed an
+  error line for it, counted it as failed and went on to the next one.
+  The run now stops at the first file after the cancellation, and no
+  file is counted as failed because of it.
+
 - 2026-10-08: Made `remote nuke` delete the `.partial` files that
   uploads cut off part-way leave on the destination store
   ([issue #281](https://git.eeqj.de/sneak/vaultik/issues/281)). The
@@ -29,6 +74,15 @@ the tag exists and is exercised; what is left is merging `next` to
   place and still reported the store empty. It now removes them under
   `metadata/` and `blobs/` as its last step.
 
+- 2026-10-08: Made a local index error while recording a directory or
+  symlink stop a backup under `--skip-errors`
+  ([issue #284](https://git.eeqj.de/sneak/vaultik/issues/284)). Phase 2
+  only records such an entry in the local index, since it has no data
+  to open or read, but an error doing so was skipped like an unreadable
+  file. The snapshot then completed without the entry, and a restore
+  did not recreate it. The error now stops the backup, as it does
+  without the flag.
+
 - 2026-10-08: Counted a file that a backup could not store as failed
   ([issue #280](https://git.eeqj.de/sneak/vaultik/issues/280)). A file
   that phase 1 counted and phase 2 could not open, because it was

internal/blob/packer.go

@@ -245,6 +245,17 @@ func (p *Packer) Flush(ctx context.Context) error {
 	return nil
 }
 
+// DiscardCurrentBlob closes and removes the temp file of the blob being
+// packed, if any, and drops that blob. A caller that stops before Flush
+// must call it, or the temp file is left behind. Thread-safe.
+func (p *Packer) DiscardCurrentBlob() {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	p.cleanupTempFile()
+	p.currentBlob = nil
+}
+
 // FinalizeBlob finalizes the current blob being assembled.
 // This compresses the accumulated chunks, encrypts the result, and computes
 // the content-addressed hash. The finalized blob is either passed to the

internal/cli/config.go

@@ -251,6 +251,12 @@ func NewConfigCommand() *cobra.Command {
 		Use:   "config",
 		Short: "Manage the configuration file",
 		Long:  "Commands for creating, editing, and querying the vaultik config file.",
+		// cobra checks Args only on a command that has a Run: without
+		// one, a mistyped subcommand printed help and exited 0.
+		Args: cobra.NoArgs,
+		Run: func(cmd *cobra.Command, _ []string) {
+			_ = cmd.Help()
+		},
 	}
 
 	cmd.AddCommand(newConfigInitCommand())

internal/cli/database.go

@@ -15,6 +15,12 @@ func NewDatabaseCommand() *cobra.Command {
 		Use:   "database",
 		Short: "Manage the local state database",
 		Long:  `Commands for managing the local SQLite state database.`,
+		// cobra checks Args only on a command that has a Run: without
+		// one, a mistyped subcommand printed help and exited 0.
+		Args: cobra.NoArgs,
+		Run: func(cmd *cobra.Command, _ []string) {
+			_ = cmd.Help()
+		},
 	}
 
 	cmd.AddCommand(

internal/cli/entry_snapshot_create_prune_test.go

@@ -0,0 +1,108 @@
+package cli //nolint:testpackage // shares runEntry and the hermetic config helpers
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Flags of `snapshot create` used to build argument vectors below.
+const (
+	flagPrune         = "--prune"
+	flagKeepNewerThan = "--keep-newer-than"
+)
+
+// TestEntrySnapshotCreateRejectsKeepNewerThanBeforeBackup checks that a
+// --keep-newer-than the post-backup prune could not use stops `snapshot
+// create` before the backup: the command fails and the destination
+// store stays empty. It used to be read only by the prune, after the
+// snapshot was uploaded, and without --prune it was ignored.
+//
+//nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
+func TestEntrySnapshotCreateRejectsKeepNewerThanBeforeBackup(t *testing.T) {
+	for _, testCase := range []struct {
+		name string
+		args []string
+	}{
+		{
+			name: "decimal in a day count",
+			args: []string{flagPrune, flagKeepNewerThan, "1.5d"},
+		},
+		{
+			name: "unknown unit",
+			args: []string{flagPrune, flagKeepNewerThan, "4x"},
+		},
+		{
+			name: "without --prune",
+			args: []string{flagKeepNewerThan, "4w"},
+		},
+	} {
+		t.Run(testCase.name, func(t *testing.T) {
+			configPath, storeDir := writeBackupConfig(t)
+
+			code, _, _ := runEntry(t, append(
+				[]string{flagConfig, configPath, cmdSnapshot, cmdCreate},
+				testCase.args...)...)
+
+			assert.Equal(t, 1, code)
+
+			stored, err := os.ReadDir(storeDir)
+			require.NoError(t, err)
+			assert.Empty(t, stored, "nothing may be uploaded")
+		})
+	}
+}
+
+// TestEntrySnapshotCreateReportsPostBackupPruneFailure makes the
+// post-backup prune fail after a good backup, by planting a manifest
+// that cannot be decoded, and checks that the failure is reported as the
+// prune's and not as a failed snapshot creation.
+//
+//nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
+func TestEntrySnapshotCreateReportsPostBackupPruneFailure(t *testing.T) {
+	configPath, storeDir := writeBackupConfig(t)
+
+	// A remote key is 64 lowercase hex characters. The prune reads every
+	// manifest on the store and fails on one it cannot decode.
+	plantedDir := filepath.Join(storeDir, "metadata", strings.Repeat("a", 64))
+	require.NoError(t, os.MkdirAll(plantedDir, 0o750))
+	require.NoError(t, os.WriteFile(
+		filepath.Join(plantedDir, "manifest.json.zst"),
+		[]byte("not a valid manifest"), 0o600))
+
+	code, _, stderr := runEntry(t,
+		flagConfig, configPath, cmdSnapshot, cmdCreate, flagPrune)
+
+	assert.Equal(t, 1, code)
+	assert.Contains(t, stderr, "Backup completed, but post-backup prune failed")
+	assert.NotContains(t, stderr, "Snapshot creation failed")
+
+	snapshots, err := os.ReadDir(filepath.Join(storeDir, "metadata"))
+	require.NoError(t, err)
+	assert.Len(t, snapshots, 2,
+		"the new snapshot is on the store beside the planted one")
+}
+
+// writeBackupConfig builds a hermetic config with one small file in its
+// source directory and an empty destination store directory. Returns the
+// config path and the store directory.
+func writeBackupConfig(t *testing.T) (string, string) {
+	t.Helper()
+
+	configPath := writeHermeticPruneConfig(t, false)
+
+	// writeHermeticPruneConfig puts the source and store directories
+	// beside the config file.
+	dir := filepath.Dir(configPath)
+	sourceDir := filepath.Join(dir, "source")
+
+	require.NoError(t, os.Mkdir(sourceDir, 0o750))
+	require.NoError(t, os.WriteFile(
+		filepath.Join(sourceDir, "file.txt"), []byte("hello"), 0o600))
+
+	return configPath, filepath.Join(dir, "store")
+}

internal/cli/entry_unknown_subcommand_test.go

@@ -0,0 +1,43 @@
+package cli //nolint:testpackage // shares runEntry and the command-word constants
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// TestEntryGroupRejectsUnknownSubcommand runs each group command with a
+// mistyped subcommand, as a crontab line might carry one. It must fail
+// with exit 1 and name the word, as `vaultik bogus` does at the top
+// level, instead of printing the group's help and exiting 0 having done
+// nothing. The group name alone still prints its help.
+//
+//nolint:paralleltest // replaces os.Args, os.Stdout and os.Stderr
+func TestEntryGroupRejectsUnknownSubcommand(t *testing.T) {
+	for _, testCase := range []struct {
+		group    string
+		mistyped string
+	}{
+		{group: cmdSnapshot, mistyped: "craete"},
+		{group: "config", mistyped: "inti"},
+		{group: cmdRemote, mistyped: "ifno"},
+		{group: "database", mistyped: "delte"},
+		{group: "completion", mistyped: "nosuchshell"},
+	} {
+		t.Run(testCase.group, func(t *testing.T) {
+			code, stdout, stderr := runEntry(t,
+				testCase.group, testCase.mistyped)
+
+			assert.Equal(t, 1, code)
+			assert.Empty(t, stdout)
+			assert.Contains(t, stderr,
+				`unknown command "`+testCase.mistyped+`"`)
+
+			code, stdout, _ = runEntry(t, testCase.group)
+
+			assert.Equal(t, 0, code)
+			assert.Contains(t, stdout,
+				programName+" "+testCase.group+" [command]")
+		})
+	}
+}

internal/cli/remote.go

@@ -18,6 +18,12 @@ func NewRemoteCommand() *cobra.Command {
 		Use:   "remote",
 		Short: "Remote storage management commands",
 		Long:  "Commands for inspecting and managing remote storage",
+		// cobra checks Args only on a command that has a Run: without
+		// one, a mistyped subcommand printed help and exited 0.
+		Args: cobra.NoArgs,
+		Run: func(cmd *cobra.Command, _ []string) {
+			_ = cmd.Help()
+		},
 	}
 
 	// Add subcommands

internal/cli/root.go

@@ -74,6 +74,21 @@ on the source system.`,
 		NewDatabaseCommand(),
 	)
 
+	// cobra adds the completion command only when Execute runs, and with
+	// no Run, so it skipped its own cobra.NoArgs and a mistyped shell name
+	// printed help and exited 0. Adding it here lets it have a Run. Its
+	// scripts go to os.Stdout as it is now: a later SetOut does not
+	// redirect them.
+	cmd.InitDefaultCompletionCmd()
+
+	for _, sub := range cmd.Commands() {
+		if sub.Name() == "completion" {
+			sub.Run = func(completion *cobra.Command, _ []string) {
+				_ = completion.Help()
+			}
+		}
+	}
+
 	return cmd
 }
 

internal/cli/snapshot.go

@@ -41,6 +41,12 @@ func NewSnapshotCommand() *cobra.Command {
 		Use:   "snapshot",
 		Short: "Snapshot management commands",
 		Long:  "Commands for creating, listing, and managing snapshots",
+		// cobra checks Args only on a command that has a Run: without
+		// one, a mistyped subcommand printed help and exited 0.
+		Args: cobra.NoArgs,
+		Run: func(cmd *cobra.Command, _ []string) {
+			_ = cmd.Help()
+		},
 	}
 
 	// Add subcommands
@@ -71,6 +77,11 @@ otherwise from the platform config directory (~/.config/vaultik/config.yml
 on Linux), then /etc/vaultik/config.yml.`,
 		Args: cobra.ArbitraryArgs,
 		RunE: func(cmd *cobra.Command, args []string) error {
+			err := opts.Validate()
+			if err != nil {
+				return err
+			}
+
 			// Pass snapshot names from args
 			opts.Snapshots = args
 			// --skip-errors is a global flag on the root command.
@@ -97,6 +108,13 @@ on Linux), then /etc/vaultik/config.yml.`,
 			}, func(v *vaultik.Vaultik) error {
 				return v.CreateSnapshot(opts)
 			}, func(err error) {
+				if errors.Is(err, vaultik.ErrPostBackupPruneFailed) {
+					log.Error("Post-backup prune failed", "error", err)
+					ReportErrorf("Backup completed, but %v", err)
+
+					return
+				}
+
 				log.Error("Snapshot creation failed", "error", err)
 				ReportErrorf("Snapshot creation failed: %v", err)
 			})
@@ -255,8 +273,12 @@ manifest (the destination store may hold snapshots this host doesn't
 know about), which is what 'vaultik prune' does. On success the command
 prints the exact 'vaultik prune' invocation to run as a follow-up.
 
+An ID that names no snapshot in the local index or on the destination
+store is an error.
+
 Use --local-only to skip the remote half (e.g. when you want to forget a
-snapshot locally without touching the destination store).
+snapshot locally without touching the destination store); the snapshot
+must then be in the local index.
 
 If the remote is unreachable, the local-database removal still completes
 and a warning is emitted; run 'vaultik snapshot remove <snapshot-id>' again

internal/snapshot/scanner.go

@@ -1295,6 +1295,11 @@ func (s *Scanner) batchAddFilesToSnapshot(
 func (s *Scanner) processPhase(
 	ctx context.Context, filesToProcess []*FileToProcess, result *ScanResult,
 ) error {
+	// On an error or cancellation the blob being packed is never
+	// finalized, so its temp file must be removed here. After a
+	// successful flush there is no such blob and this does nothing.
+	defer s.packer.DiscardCurrentBlob()
+
 	// Calculate total bytes to process
 	var totalBytes int64
 	for _, f := range filesToProcess {
@@ -1312,6 +1317,13 @@ func (s *Scanner) processPhase(
 
 	// Process each file
 	for _, fileToProcess := range filesToProcess {
+		// Check context cancellation
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		default:
+		}
+
 		// Update progress
 		if s.progress != nil {
 			s.progress.GetStats().CurrentFile.Store(fileToProcess.Path)
@@ -1348,13 +1360,32 @@ func (s *Scanner) processPhase(
 	return s.finalizeProcessPhase(ctx, result)
 }
 
-// processFileWithErrorHandling wraps processFileStreaming with error recovery for
-// deleted files and skip-errors mode. Returns (skipped, error).
+// processFileWithErrorHandling records a directory or symlink, or wraps
+// processFileStreaming for a regular file with error recovery for deleted
+// files and skip-errors mode. Returns (skipped, error).
 func (s *Scanner) processFileWithErrorHandling(
 	ctx context.Context, fileToProcess *FileToProcess, result *ScanResult,
 ) (bool, error) {
+	// A directory or symlink has no data to open or read; it is only
+	// recorded in the local index. An error recording it stops the run
+	// even under --skip-errors, or the snapshot would complete without it.
+	mode := os.FileMode(fileToProcess.File.Mode)
+	if mode&os.ModeSymlink != 0 || mode.IsDir() {
+		err := s.recordNonRegularFile(ctx, fileToProcess)
+		if err != nil {
+			return false, fmt.Errorf("processing file %s: %w", fileToProcess.Path, err)
+		}
+
+		return false, nil
+	}
+
 	err := s.processFileStreaming(ctx, fileToProcess, result)
 	if err != nil {
+		// A cancelled run stops here even under --skip-errors, rather than
+		// counting this file as failed and going on to the next one.
+		if ctx.Err() != nil {
+			return false, fmt.Errorf("processing file %s: %w", fileToProcess.Path, err)
+		}
 		// A packer/database/encryption/upload failure means the chunk's data
 		// may not have been stored. Skipping the file would let the snapshot
 		// record a file whose chunk is in no blob and cannot be restored, so
@@ -1392,12 +1423,7 @@ func (s *Scanner) processFileWithErrorHandling(
 
 // countFailedFile counts a file that phase 2 could not store as failed
 // and takes its size back out of BytesScanned, where phase 1 put it.
-// Phase 1 counts no directories, so a directory is not counted here.
 func countFailedFile(fileToProcess *FileToProcess, result *ScanResult) {
-	if fileToProcess.FileInfo.IsDir() {
-		return
-	}
-
 	result.FilesFailed++
 	result.BytesScanned -= fileToProcess.FileInfo.Size()
 }
@@ -1770,16 +1796,11 @@ func (e *packerError) Error() string { return e.err.Error() }
 
 func (e *packerError) Unwrap() error { return e.err }
 
-// processFileStreaming processes a file by streaming chunks directly to the packer
+// processFileStreaming processes a regular file by streaming chunks directly
+// to the packer
 func (s *Scanner) processFileStreaming(
 	ctx context.Context, fileToProcess *FileToProcess, result *ScanResult,
 ) error {
-	// Symlinks and directories have no data to chunk — just record them in the DB.
-	mode := os.FileMode(fileToProcess.File.Mode)
-	if mode&os.ModeSymlink != 0 || mode.IsDir() {
-		return s.recordNonRegularFile(ctx, fileToProcess)
-	}
-
 	file, err := s.fs.Open(fileToProcess.Path)
 	if err != nil {
 		return fmt.Errorf("opening file: %w", wrapPermissionError(fileToProcess.Path, err))

internal/snapshot/skip_errors_test.go

@@ -82,6 +82,32 @@ func (f *readFailFs) Open(name string) (afero.File, error) {
 	return file, nil
 }
 
+// cancelOnOpenFs cancels the run when the scanner opens the target file to
+// back it up, as Ctrl-C partway through processing would, and records each
+// file opened after that.
+type cancelOnOpenFs struct {
+	afero.Fs
+
+	target            string
+	cancel            context.CancelFunc
+	cancelled         bool
+	openedAfterCancel []string
+}
+
+//nolint:ireturn // afero.Fs.Open is defined to return the interface.
+func (f *cancelOnOpenFs) Open(name string) (afero.File, error) {
+	if f.cancelled {
+		f.openedAfterCancel = append(f.openedAfterCancel, name)
+	}
+
+	if name == f.target {
+		f.cancel()
+		f.cancelled = true
+	}
+
+	return f.Fs.Open(name)
+}
+
 // linkRemovedAfterLstatFs is the real filesystem, except that the symlink at
 // target is removed right after the walk lstats it, as happens when a link is
 // deleted during a backup. The scanner's readlink of it then fails.
@@ -128,15 +154,16 @@ func writeSkipErrorTestFile(t *testing.T, fs afero.Fs, path, content string) {
 	}
 }
 
-// runSkipErrorScan scans source on fs with the given skip-errors setting,
-// printing user-facing messages to uiw (nil discards them), and returns the
-// repositories (for inspection) and the scan error.
+// runSkipErrorScan scans source on fs under ctx with the given skip-errors
+// setting, printing user-facing messages to uiw (nil discards them), and
+// returns the repositories (for inspection) and the scan error.
 func runSkipErrorScan(
-	t *testing.T, fs afero.Fs, source string, skipErrors bool, uiw *ui.Writer,
+	ctx context.Context, t *testing.T, fs afero.Fs, source string,
+	skipErrors bool, uiw *ui.Writer,
 ) (*database.Repositories, error) {
 	t.Helper()
 
-	db, err := database.NewTestDB()
+	db, err := database.New(ctx, ":memory:")
 	if err != nil {
 		t.Fatalf("create test db: %v", err)
 	}
@@ -161,7 +188,6 @@ func runSkipErrorScan(
 		SkipErrors:       skipErrors,
 	})
 
-	ctx := context.Background()
 	snapshotID := "test-snapshot-skip-errors"
 	createTestSnapshotRecord(ctx, t, repos, snapshotID)
 
@@ -185,7 +211,7 @@ func TestScannerPackingFailureAbortsUnderSkipErrors(t *testing.T) {
 	writeSkipErrorTestFile(t, fs, "/source/file1.txt", "first file content")
 	writeSkipErrorTestFile(t, fs, "/source/file2.txt", "second file content")
 
-	repos, err := runSkipErrorScan(t, fs, "/source", true, nil)
+	repos, err := runSkipErrorScan(context.Background(), t, fs, "/source", true, nil)
 	if err == nil {
 		t.Fatal("expected scan to abort on the packer error, got nil")
 	}
@@ -212,7 +238,7 @@ func TestScannerReadErrorAbortsWithoutSkipErrors(t *testing.T) {
 	fs := &readFailFs{Fs: afero.NewMemMapFs(), target: target}
 	writeSkipErrorTestFile(t, fs, target, "content that cannot be read")
 
-	_, err := runSkipErrorScan(t, fs, "/source", false, nil)
+	_, err := runSkipErrorScan(context.Background(), t, fs, "/source", false, nil)
 	if err == nil {
 		t.Fatal("expected scan to fail on the read error, got nil")
 	}
@@ -228,7 +254,7 @@ func TestScannerReadErrorSkippedWithSkipErrors(t *testing.T) {
 	fs := &readFailFs{Fs: afero.NewMemMapFs(), target: target}
 	writeSkipErrorTestFile(t, fs, target, "content that cannot be read")
 
-	repos, err := runSkipErrorScan(t, fs, "/source", true, nil)
+	repos, err := runSkipErrorScan(context.Background(), t, fs, "/source", true, nil)
 	if err != nil {
 		t.Fatalf("expected scan to complete with --skip-errors, got %v", err)
 	}
@@ -267,7 +293,7 @@ func TestScannerUnreadableSymlinkAbortsWithoutSkipErrors(t *testing.T) {
 	sourceDir, linkPath := writeSymlinkSource(t)
 	fs := &linkRemovedAfterLstatFs{t: t, target: linkPath}
 
-	_, err := runSkipErrorScan(t, fs, sourceDir, false, nil)
+	_, err := runSkipErrorScan(context.Background(), t, fs, sourceDir, false, nil)
 	if !errors.Is(err, os.ErrNotExist) {
 		t.Fatalf("expected scan to fail on the removed symlink, got %v", err)
 	}
@@ -283,7 +309,7 @@ func TestScannerUnreadableSymlinkSkippedWithSkipErrors(t *testing.T) {
 	fs := &linkRemovedAfterLstatFs{t: t, target: linkPath}
 	uiw := ui.NewWithColor(io.Discard, false)
 
-	repos, err := runSkipErrorScan(t, fs, sourceDir, true, uiw)
+	repos, err := runSkipErrorScan(context.Background(), t, fs, sourceDir, true, uiw)
 	if err != nil {
 		t.Fatalf("expected scan to complete with --skip-errors, got %v", err)
 	}
@@ -302,3 +328,113 @@ func TestScannerUnreadableSymlinkSkippedWithSkipErrors(t *testing.T) {
 		t.Fatalf("expected %s not to be recorded", linkPath)
 	}
 }
+
+// TestScannerCancelStopsSkipErrorsRun checks that a --skip-errors backup
+// cancelled partway through processing returns the cancellation error,
+// opens no further file, and reports no file as failed.
+func TestScannerCancelStopsSkipErrorsRun(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name          string
+		targetContent string
+	}{
+		// The cancellation lands while the target is being read.
+		{name: "while reading a file", targetContent: "first file content"},
+		// An empty target has no chunks, so the cancellation goes unnoticed
+		// until the run moves on to the next file.
+		{name: "between files", targetContent: ""},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			const target = "/source/a.txt"
+
+			ctx, cancel := context.WithCancel(context.Background())
+			defer cancel()
+
+			fs := &cancelOnOpenFs{
+				Fs: afero.NewMemMapFs(), target: target, cancel: cancel,
+			}
+			writeSkipErrorTestFile(t, fs, target, tt.targetContent)
+			writeSkipErrorTestFile(t, fs, "/source/b.txt", "second file content")
+			writeSkipErrorTestFile(t, fs, "/source/c.txt", "third file content")
+
+			uiw := ui.NewWithColor(io.Discard, false)
+
+			_, err := runSkipErrorScan(ctx, t, fs, "/source", true, uiw)
+			if !errors.Is(err, context.Canceled) {
+				t.Fatalf("expected the cancellation error, got %v", err)
+			}
+
+			if len(fs.openedAfterCancel) != 0 {
+				t.Fatalf("expected no file opened after the cancellation, got %v",
+					fs.openedAfterCancel)
+			}
+
+			if uiw.ErrorCount() != 0 {
+				t.Fatalf("expected no file reported as failed, got %d error lines",
+					uiw.ErrorCount())
+			}
+		})
+	}
+}
+
+// TestScannerRemovesBlobTempFileWhenRunStops checks that a run stopped
+// part-way, by a file it cannot read or by a cancellation, removes the
+// temp file of the blob it was packing.
+func TestScannerRemovesBlobTempFileWhenRunStops(t *testing.T) {
+	t.Parallel()
+
+	// a.txt is backed up first and starts a blob; the run stops at b.txt.
+	const target = "/source/b.txt"
+
+	tests := []struct {
+		name  string
+		newFs func(cancel context.CancelFunc) afero.Fs
+	}{
+		{
+			name: "file cannot be read",
+			newFs: func(context.CancelFunc) afero.Fs {
+				return &readFailFs{Fs: afero.NewMemMapFs(), target: target}
+			},
+		},
+		{
+			name: "cancelled",
+			newFs: func(cancel context.CancelFunc) afero.Fs {
+				return &cancelOnOpenFs{
+					Fs: afero.NewMemMapFs(), target: target, cancel: cancel,
+				}
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			ctx, cancel := context.WithCancel(context.Background())
+			defer cancel()
+
+			fs := tt.newFs(cancel)
+			writeSkipErrorTestFile(t, fs, "/source/a.txt", "first file content")
+			writeSkipErrorTestFile(t, fs, target, "second file content")
+
+			_, err := runSkipErrorScan(ctx, t, fs, "/source", false, nil)
+			if err == nil {
+				t.Fatal("expected the scan to stop with an error, got nil")
+			}
+
+			left, err := afero.Glob(fs, filepath.Join(os.TempDir(), "vaultik-blob-*"))
+			if err != nil {
+				t.Fatalf("listing blob temp files: %v", err)
+			}
+
+			if len(left) != 0 {
+				t.Fatalf("expected no blob temp file left, got %v", left)
+			}
+		})
+	}
+}

internal/vaultik/helpers.go

@@ -3,6 +3,7 @@ package vaultik
 import (
 	"errors"
 	"fmt"
+	"math"
 	"regexp"
 	"strconv"
 	"strings"
@@ -47,6 +48,10 @@ const (
 	year  = 365 * day
 )
 
+// maxDuration is the largest value a time.Duration can hold, about 292
+// years.
+const maxDuration = time.Duration(math.MaxInt64)
+
 // A snapshot ID split on "_" has at least a hostname and a trailing
 // timestamp.
 const minSnapshotIDParts = 2
@@ -145,10 +150,10 @@ func parseSnapshotName(snapshotID, hostname string) string {
 // parseDuration parses a duration string with support for human-friendly units:
 // d/day/days, w/week/weeks, mo/month/months, y/year/years, plus standard Go
 // duration units. Following Go, m is minutes and mo is months. A bare number,
-// an unknown unit, and a negative value are all rejected. Outside the Go
-// units the input must be whole numbers each followed directly by a unit
-// (2w3d), so 1.0y and 30 days are errors; decimals work only in Go units
-// (1.5h).
+// an unknown unit, a negative value, and a total longer than maxDuration are
+// all rejected. Outside the Go units the input must be whole numbers each
+// followed directly by a unit (2w3d), so 1.0y and 30 days are errors;
+// decimals work only in Go units (1.5h).
 func parseDuration(s string) (time.Duration, error) {
 	if strings.HasPrefix(strings.TrimSpace(s), "-") {
 		return 0, errNegativeDuration
@@ -181,19 +186,30 @@ func parseDuration(s string) (time.Duration, error) {
 			return 0, fmt.Errorf("invalid number %q: %w", match[1], err)
 		}
 
+		var unitLength time.Duration
+
 		unit := strings.ToLower(match[2])
 		switch unit {
 		case "d", "day", "days":
-			total += time.Duration(n) * day
+			unitLength = day
 		case "w", "week", "weeks":
-			total += time.Duration(n) * week
+			unitLength = week
 		case "mo", "month", "months":
-			total += time.Duration(n) * month
+			unitLength = month
 		case "y", "year", "years":
-			total += time.Duration(n) * year
+			unitLength = year
 		default:
 			return 0, fmt.Errorf("%w %q", errUnknownTimeUnit, unit)
 		}
+
+		// Past maxDuration the sum wraps to a negative value, which would
+		// put the purge cutoff in the future.
+		if time.Duration(n) > (maxDuration-total)/unitLength {
+			return 0, fmt.Errorf("%w: %q is longer than about 292 years",
+				errInvalidDuration, s)
+		}
+
+		total += time.Duration(n) * unitLength
 	}
 
 	return total, nil

internal/vaultik/helpers_test.go

@@ -111,6 +111,17 @@ func TestParseDuration(t *testing.T) {
 		{"30 days", 0, true},
 		{"30 days ago", 0, true},
 		{"x7d", 0, true},
+		// The largest time.Duration is about 292 years. A larger value
+		// must be rejected, not wrapped to a negative one, which would
+		// put the cutoff in the future and select every snapshot.
+		{"292y", 292 * 365 * 24 * time.Hour, false},
+		{"293y", 0, true},
+		{"3559mo", 0, true},
+		{"15251w", 0, true},
+		{"106752d", 0, true},
+		{"2562048h", 0, true},
+		{"200y200y", 0, true},
+		{"292y6mo", 0, true},
 	}
 
 	for _, tt := range tests {

internal/vaultik/info.go

@@ -167,10 +167,6 @@ const (
 	// metadataKeyParts is the minimum "/"-separated segment count of a
 	// metadata object key (metadata/<snapshot-id>/<filename>).
 	metadataKeyParts = 3
-
-	// blobKeyParts is the minimum "/"-separated segment count of a blob
-	// object key (blobs/<aa>/<bb>/<hash>).
-	blobKeyParts = 4
 )
 
 // SnapshotMetadataInfo contains information about a single snapshot's metadata
@@ -454,23 +450,16 @@ func (v *Vaultik) scanRemoteBlobStorage(
 		v.stdoutf("Scanning blobs...\n")
 	}
 
-	blobCh := v.Storage.ListStream(v.ctx, "blobs/")
-	allBlobs := make(map[string]int64)
+	// Use prune's listing, so a file under blobs/ that prune would never
+	// delete is not counted as a blob, and so not as an orphaned one.
+	allBlobs, err := v.listAllRemoteBlobs()
+	if err != nil {
+		return err
+	}
 
-	for obj := range blobCh {
-		if obj.Err != nil {
-			return fmt.Errorf("listing blobs: %w", obj.Err)
-		}
-
-		parts := strings.Split(obj.Key, "/")
-		if len(parts) < blobKeyParts {
-			continue
-		}
-
-		hash := parts[3]
-		allBlobs[hash] = obj.Size
+	for _, size := range allBlobs {
 		result.TotalBlobCount++
-		result.TotalBlobSize += obj.Size
+		result.TotalBlobSize += size
 	}
 
 	// A blob named only by a manifest that could not be read, or by one

internal/vaultik/prune.go

@@ -23,6 +23,10 @@ var errNukeRequiresForce = errors.New(
 // metadata.
 const metadataDirName = "metadata"
 
+// blobKeyParts is the "/"-separated segment count of a blob object key
+// (blobs/<aa>/<bb>/<hash>).
+const blobKeyParts = 4
+
 // NukeRemote deletes every snapshot's metadata and every blob from remote
 // storage, along with any object an upload cut off part-way left under a
 // temporary `.partial` name. After this returns successfully the bucket

internal/vaultik/purge_per_name_test.go

@@ -267,6 +267,29 @@ func TestPurgeOlderThan_WithNameFilter(t *testing.T) {
 	assert.Contains(t, remaining, snapHomeT0)
 }
 
+func TestPurgeOlderThan_TooLargeDeletesNothing(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	snapshotIDs := []string{snapHomeT0, snapHomeT1}
+
+	v := setupPurgeTest(t, snapHostname, snapshotIDs)
+
+	err := v.PurgeSnapshotsWithOptions(&vaultik.SnapshotPurgeOptions{
+		OlderThan: "1000y",
+		Force:     true,
+	})
+	require.Error(t, err)
+
+	err = v.PurgeSnapshotsWithOptions(&vaultik.SnapshotPurgeOptions{
+		OlderThan: "292y",
+		Force:     true,
+	})
+	require.NoError(t, err)
+
+	assert.ElementsMatch(t, snapshotIDs, listRemainingSnapshots(t, v))
+}
+
 func TestPurgeKeepLatest_ThreeNames(t *testing.T) {
 	log.Initialize(log.Config{})
 	t.Parallel()

internal/vaultik/remote_info_test.go

@@ -185,6 +185,39 @@ func TestRemoteInfo_SkipsNonConformingMetadataName(t *testing.T) {
 	assert.NotContains(t, doc, "unreadable_manifests")
 }
 
+// TestRemoteInfo_DoesNotCountNonBlobFileUnderBlobs checks that a file
+// under blobs/ whose name is not a blob hash is not counted as a blob.
+// prune never deletes such a file, so counting it as an orphaned blob
+// would advise a prune that removes nothing.
+func TestRemoteInfo_DoesNotCountNonBlobFileUnderBlobs(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	env := newListEnv(t)
+	env.addRemote(t, listRemoteID, time.Date(2026, 3, 2, 0, 0, 0, 0, time.UTC))
+	addBlob(t, env.store.testStorer, testBlobHashA)
+	require.NoError(t, env.store.Put(context.Background(),
+		"blobs/"+testBlobHashA[:2]+"/"+testBlobHashA[2:4]+"/.DS_Store",
+		bytes.NewReader([]byte("junk"))))
+
+	require.NoError(t, env.v.RemoteInfo(false))
+
+	text := env.stdout.String()
+	assert.Contains(t, text, "Total blobs on remote:      1 (")
+	assert.Contains(t, text, "Orphaned (unreferenced):    0 (")
+	assert.NotContains(t, text, "vaultik prune")
+
+	env.stdout.Reset()
+	require.NoError(t, env.v.RemoteInfo(true))
+
+	var doc map[string]any
+
+	require.NoError(t, json.Unmarshal(env.stdout.Bytes(), &doc))
+	assert.InDelta(t, 1, doc["total_blob_count"], 0)
+	assert.InDelta(t, 0, doc["orphaned_blob_count"], 0)
+	assert.InDelta(t, 0, doc["orphaned_blob_size"], 0)
+}
+
 // TestRemoteInfo_DirectoryWithoutManifestLeavesOrphansKnown checks that
 // a directory under metadata/ holding no manifest.json.zst, such as one
 // left by a backup interrupted before its manifest upload, leaves the

internal/vaultik/remove_snapshot_test.go

@@ -3,17 +3,21 @@ package vaultik_test
 import (
 	"bytes"
 	"context"
+	"database/sql"
 	"io"
 	"strings"
 	"sync"
 	"testing"
+	"time"
 
 	"github.com/klauspost/compress/zstd"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/vaultik/internal/database"
 	"sneak.berlin/go/vaultik/internal/log"
 	"sneak.berlin/go/vaultik/internal/snapshot"
 	"sneak.berlin/go/vaultik/internal/storage"
+	"sneak.berlin/go/vaultik/internal/types"
 	"sneak.berlin/go/vaultik/internal/vaultik"
 )
 
@@ -214,6 +218,37 @@ func addBlob(t *testing.T, store *testStorer, hash string) {
 	require.NoError(t, err)
 }
 
+// newLocalIndex returns an in-memory local index holding a completed
+// snapshot row for each of ids.
+func newLocalIndex(t *testing.T, ids ...string) *database.Repositories {
+	t.Helper()
+
+	ctx := context.Background()
+
+	db, err := database.New(ctx, ":memory:")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = db.Close() })
+
+	repos := database.NewRepositories(db)
+
+	for _, id := range ids {
+		completedAt := time.Now().UTC()
+		snap := &database.Snapshot{
+			ID:          types.SnapshotID(id),
+			Hostname:    snapHostname,
+			StartedAt:   completedAt,
+			CompletedAt: &completedAt,
+		}
+
+		err = repos.WithTx(ctx, func(ctx context.Context, tx *sql.Tx) error {
+			return repos.Snapshots.Create(ctx, tx, snap)
+		})
+		require.NoError(t, err)
+	}
+
+	return repos
+}
+
 // ============================================================================
 // Unit Tests for RemoveSnapshot
 // ============================================================================
@@ -233,6 +268,7 @@ func TestRemoveSnapshot_LocalOnly_PreservesRemote(t *testing.T) {
 	addBlob(t, store, blobA)
 
 	tv := vaultik.NewForTesting(store)
+	tv.Repositories = newLocalIndex(t, "snapshot-001")
 
 	opts := &vaultik.RemoveOptions{Force: true, LocalOnly: true}
 	result, err := tv.RemoveSnapshot("snapshot-001", opts)
@@ -268,6 +304,7 @@ func TestRemoveSnapshot_DefaultRemovesMetadataNotBlobs(t *testing.T) {
 	addBlob(t, store, blobShared)
 
 	tv := vaultik.NewForTesting(store)
+	tv.Repositories = newLocalIndex(t, "snapshot-001", "snapshot-002")
 
 	opts := &vaultik.RemoveOptions{Force: true}
 	result, err := tv.RemoveSnapshot("snapshot-001", opts)
@@ -316,6 +353,84 @@ func TestRemoveSnapshot_DryRun(t *testing.T) {
 	assert.Contains(t, tv.Stdout.String(), "[Dry run - no changes made]")
 }
 
+// TestRemoveSnapshot_UnknownIDIsError checks that an ID naming no
+// snapshot in the local index or on the destination store is an error
+// under every option, and that nothing is reported as removed.
+func TestRemoveSnapshot_UnknownIDIsError(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	for name, opts := range map[string]vaultik.RemoveOptions{
+		"force":      {Force: true},
+		"json":       {JSON: true},
+		"dry-run":    {Force: true, DryRun: true},
+		"local-only": {Force: true, LocalOnly: true},
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			store := newTestStorer()
+			addManifest(t, store, "snapshot-001", nil)
+
+			tv := vaultik.NewForTesting(store)
+			tv.Repositories = newLocalIndex(t, "snapshot-001")
+
+			result, err := tv.RemoveSnapshot("snapshot-999", &opts)
+
+			require.ErrorContains(t, err, "snapshot not found")
+			assert.False(t, result.RemoteRemoved)
+			assert.Empty(t, tv.Stdout.String())
+			assert.True(t, store.hasKey(remoteKeyPath("snapshot-001")))
+		})
+	}
+}
+
+// TestRemoveSnapshot_NoMetadataOnDestination checks that removing a
+// snapshot whose metadata is not on the destination store does not
+// report metadata removed from it.
+func TestRemoveSnapshot_NoMetadataOnDestination(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	tv := vaultik.NewForTesting(newTestStorer())
+	tv.Repositories = newLocalIndex(t, "snapshot-001")
+
+	result, err := tv.RemoveSnapshot("snapshot-001",
+		&vaultik.RemoveOptions{Force: true})
+
+	require.NoError(t, err)
+	assert.False(t, result.RemoteRemoved)
+
+	out := tv.Stdout.String()
+	assert.Contains(t, out, "Removed snapshot 'snapshot-001' from local database")
+	assert.NotContains(t, out, "Removed snapshot metadata from remote storage")
+}
+
+// TestRemoveSnapshot_NotInLocalIndex checks that removing a snapshot
+// only the destination store holds removes its metadata there without
+// reporting a removal from the local database.
+func TestRemoveSnapshot_NotInLocalIndex(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	store := newTestStorer()
+	addManifest(t, store, "snapshot-001", nil)
+
+	tv := vaultik.NewForTesting(store)
+	tv.Repositories = newLocalIndex(t)
+
+	result, err := tv.RemoveSnapshot("snapshot-001",
+		&vaultik.RemoveOptions{Force: true})
+
+	require.NoError(t, err)
+	assert.True(t, result.RemoteRemoved)
+	assert.False(t, store.hasKey(remoteKeyPath("snapshot-001")))
+
+	out := tv.Stdout.String()
+	assert.NotContains(t, out, "from local database")
+	assert.Contains(t, out, "Removed snapshot metadata from remote storage")
+}
+
 func TestRemoveAllSnapshots_RequiresForce(t *testing.T) {
 	log.Initialize(log.Config{})
 	t.Parallel()

internal/vaultik/snapshot.go

@@ -23,12 +23,19 @@ var (
 	errNoSnapshotsInConfig  = errors.New("no snapshots configured")
 	errSnapshotVerifyFailed = errors.New("verification failed")
 	errRemoveAllNeedsForce  = errors.New("--all requires --force")
+	errSnapshotNotFound     = errors.New("snapshot not found")
 	errInvalidTableName     = errors.New("invalid table name")
 	errNoAgeRecipients      = errors.New(
 		"creating a snapshot needs at least one public key in " +
 			"age_recipients (generate a keypair with: age-keygen)")
+	errKeepNewerThanNeedsPrune = errors.New("--keep-newer-than requires --prune")
 )
 
+// ErrPostBackupPruneFailed wraps a failure of the post-backup prune,
+// which runs only after every snapshot was created and uploaded, so the
+// caller can report it apart from a failed backup.
+var ErrPostBackupPruneFailed = errors.New("post-backup prune failed")
+
 // listRecentLimit caps how many snapshot rows are fetched from the
 // local index for listing and purge operations.
 const listRecentLimit = 10000
@@ -44,6 +51,26 @@ type SnapshotCreateOptions struct {
 	Snapshots     []string // Optional list of snapshot names to process (empty = all)
 }
 
+// Validate fails when KeepNewerThan is set without Prune or is not a
+// valid duration. Only the post-backup prune reads KeepNewerThan, after
+// the backup, so the caller checks it before starting one.
+func (opts *SnapshotCreateOptions) Validate() error {
+	if opts.KeepNewerThan == "" {
+		return nil
+	}
+
+	if !opts.Prune {
+		return errKeepNewerThanNeedsPrune
+	}
+
+	_, err := parseDuration(opts.KeepNewerThan)
+	if err != nil {
+		return fmt.Errorf("--keep-newer-than: %w", err)
+	}
+
+	return nil
+}
+
 // CreateSnapshot executes the snapshot creation operation
 func (v *Vaultik) CreateSnapshot(opts *SnapshotCreateOptions) error {
 	// config.Load accepts an empty list, since listing, verifying and
@@ -122,7 +149,7 @@ func (v *Vaultik) CreateSnapshot(opts *SnapshotCreateOptions) error {
 	if opts.Prune {
 		err = v.runPostBackupPrune(snapshotNames, opts.KeepNewerThan)
 		if err != nil {
-			return fmt.Errorf("post-backup prune: %w", err)
+			return fmt.Errorf("%w: %w", ErrPostBackupPruneFailed, err)
 		}
 	}
 
@@ -643,7 +670,7 @@ func (v *Vaultik) confirmAndExecutePurge(
 				"snapshot_id", snapshotID, "error", err)
 		}
 
-		err = v.deleteRemoteSnapshotByKey(snapshot.RemoteSnapshotKey(snapshotID))
+		_, err = v.deleteRemoteSnapshotByKey(snapshot.RemoteSnapshotKey(snapshotID))
 		if err != nil {
 			return fmt.Errorf("deleting snapshot %s from remote: %w", snapshotID, err)
 		}
@@ -1153,6 +1180,11 @@ func (v *Vaultik) RemoveSnapshot(
 		return result, err
 	}
 
+	inLocalIndex, err := v.findSnapshotToRemove(snapshotID, opts)
+	if err != nil {
+		return result, err
+	}
+
 	if opts.DryRun {
 		return v.removeSnapshotDryRun(result, snapshotID, opts)
 	}
@@ -1161,11 +1193,13 @@ func (v *Vaultik) RemoveSnapshot(
 		return result, nil
 	}
 
-	log.Info("Removing snapshot from local database", "snapshot_id", snapshotID)
+	if inLocalIndex {
+		log.Info("Removing snapshot from local database", "snapshot_id", snapshotID)
 
-	err = v.deleteSnapshotFromLocalDB(snapshotID)
-	if err != nil {
-		return result, fmt.Errorf("removing from local database: %w", err)
+		err = v.deleteSnapshotFromLocalDB(snapshotID)
+		if err != nil {
+			return result, fmt.Errorf("removing from local database: %w", err)
+		}
 	}
 
 	if !opts.LocalOnly {
@@ -1184,9 +1218,11 @@ func (v *Vaultik) RemoveSnapshot(
 		return result, v.outputRemoveJSON(result)
 	}
 
-	v.stdoutf("Removed snapshot '%s' from local database\n", snapshotID)
+	if inLocalIndex {
+		v.stdoutf("Removed snapshot '%s' from local database\n", snapshotID)
+	}
 
-	if !opts.LocalOnly && result.RemoteRemoved {
+	if result.RemoteRemoved {
 		v.printlnStdout("Removed snapshot metadata from remote storage")
 		v.stdoutf("\nNote: The removed snapshot's blobs remain on the remote. "+
 			"Run '%s' to delete any blobs no longer referenced by any "+
@@ -1196,6 +1232,45 @@ func (v *Vaultik) RemoveSnapshot(
 	return result, nil
 }
 
+// findSnapshotToRemove reports whether the local index has a row for
+// snapshotID, and returns errSnapshotNotFound when there is nothing to
+// remove: no row and, unless LocalOnly is set, no metadata on the
+// destination store either. The destination store is consulted only
+// when the local index has no row, so a snapshot in the local index can
+// still be removed from it while the destination store is unreachable.
+func (v *Vaultik) findSnapshotToRemove(
+	snapshotID string, opts *RemoveOptions,
+) (bool, error) {
+	if v.Repositories != nil {
+		snap, err := v.Repositories.Snapshots.GetByID(v.ctx, snapshotID)
+		if err != nil {
+			return false, fmt.Errorf("looking up snapshot in local index: %w", err)
+		}
+
+		if snap != nil {
+			return true, nil
+		}
+	}
+
+	if opts.LocalOnly {
+		return false, fmt.Errorf("%w in the local index: %s",
+			errSnapshotNotFound, snapshotID)
+	}
+
+	objects, err := v.remoteSnapshotObjects(snapshot.RemoteSnapshotKey(snapshotID))
+	if err != nil {
+		return false, fmt.Errorf("looking up snapshot on destination store: %w", err)
+	}
+
+	if len(objects) == 0 {
+		return false, fmt.Errorf(
+			"%w in the local index or on the destination store: %s",
+			errSnapshotNotFound, snapshotID)
+	}
+
+	return false, nil
+}
+
 // removeSnapshotDryRun reports what RemoveSnapshot would do without
 // making changes.
 func (v *Vaultik) removeSnapshotDryRun(
@@ -1255,14 +1330,14 @@ func (v *Vaultik) confirmRemoveSnapshot(snapshotID string, opts *RemoveOptions)
 // didn't finish and to run `vaultik snapshot remove` for the snapshot
 // again once the destination store is reachable (`vaultik prune` never
 // removes snapshot metadata). Returns true when the remote removal
-// succeeded.
+// succeeded and deleted something.
 func (v *Vaultik) removeSnapshotRemote(snapshotID string, opts *RemoveOptions) bool {
 	log.Info("Removing snapshot metadata from remote storage",
 		"snapshot_id", snapshotID)
 
 	remoteKey := snapshot.RemoteSnapshotKey(snapshotID)
 
-	err := v.deleteRemoteSnapshotByKey(remoteKey)
+	deleted, err := v.deleteRemoteSnapshotByKey(remoteKey)
 	if err != nil {
 		log.Warn("Could not remove snapshot metadata from remote storage; "+
 			"run '"+snapshotRemoveCommandHint+"' with the snapshot's ID "+
@@ -1280,7 +1355,7 @@ func (v *Vaultik) removeSnapshotRemote(snapshotID string, opts *RemoveOptions) b
 		return false
 	}
 
-	return true
+	return deleted > 0
 }
 
 // RemoveAllSnapshots removes every snapshot known to the local
@@ -1572,7 +1647,7 @@ func (v *Vaultik) removeAllLocalSnapshots(
 		}
 
 		if !opts.LocalOnly {
-			err = v.deleteRemoteSnapshotByKey(
+			_, err = v.deleteRemoteSnapshotByKey(
 				snapshot.RemoteSnapshotKey(snapshotID))
 			if err != nil {
 				log.Warn("Failed to remove snapshot metadata from remote",
@@ -1598,7 +1673,7 @@ func (v *Vaultik) removeAllOrphanRemotes(
 	for _, key := range orphanRemoteKeys {
 		log.Info("Removing orphan remote snapshot", "remote_key", key)
 
-		err := v.deleteRemoteSnapshotByKey(key)
+		_, err := v.deleteRemoteSnapshotByKey(key)
 		if err != nil {
 			log.Warn("Failed to remove orphan from remote",
 				"remote_key", key, "error", err)
@@ -1645,34 +1720,44 @@ func (v *Vaultik) deleteSnapshotFromLocalDB(snapshotID string) error {
 }
 
 // deleteRemoteSnapshotByKey removes everything under
-// metadata/<remoteKey>/ on the destination store. The argument is a
-// remote key (double-SHA256 derivation), not a human snapshot ID;
-// callers that have a human ID must hash via snapshot.RemoteSnapshotKey
-// first.
-func (v *Vaultik) deleteRemoteSnapshotByKey(remoteKey string) error {
-	prefix := fmt.Sprintf("metadata/%s/", remoteKey)
-	objectCh := v.Storage.ListStream(v.ctx, prefix)
-
-	var objectsToDelete []string
-
-	for object := range objectCh {
-		if object.Err != nil {
-			return fmt.Errorf("listing objects: %w", object.Err)
-		}
-
-		objectsToDelete = append(objectsToDelete, object.Key)
+// metadata/<remoteKey>/ on the destination store and returns how many
+// objects it deleted. The argument is a remote key (double-SHA256
+// derivation), not a human snapshot ID; callers that have a human ID
+// must hash via snapshot.RemoteSnapshotKey first.
+func (v *Vaultik) deleteRemoteSnapshotByKey(remoteKey string) (int, error) {
+	objectsToDelete, err := v.remoteSnapshotObjects(remoteKey)
+	if err != nil {
+		return 0, err
 	}
 
-	for _, key := range objectsToDelete {
-		err := v.Storage.Delete(v.ctx, key)
+	for i, key := range objectsToDelete {
+		err = v.Storage.Delete(v.ctx, key)
 		if err != nil {
-			return fmt.Errorf("removing %s: %w", key, err)
+			return i, fmt.Errorf("removing %s: %w", key, err)
 		}
 
 		log.Debug("Deleted remote object", "key", key)
 	}
 
-	return nil
+	return len(objectsToDelete), nil
+}
+
+// remoteSnapshotObjects lists the keys of every object under
+// metadata/<remoteKey>/ on the destination store.
+func (v *Vaultik) remoteSnapshotObjects(remoteKey string) ([]string, error) {
+	prefix := fmt.Sprintf("metadata/%s/", remoteKey)
+
+	var keys []string
+
+	for object := range v.Storage.ListStream(v.ctx, prefix) {
+		if object.Err != nil {
+			return nil, fmt.Errorf("listing objects: %w", object.Err)
+		}
+
+		keys = append(keys, object.Key)
+	}
+
+	return keys, nil
 }
 
 // outputRemoveJSON outputs the removal result as JSON

internal/vaultik/snapshot_skip_errors_test.go

@@ -0,0 +1,75 @@
+package vaultik_test
+
+import (
+	"context"
+	"fmt"
+	"path/filepath"
+	"testing"
+
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/vaultik/internal/config"
+	"sneak.berlin/go/vaultik/internal/database"
+	"sneak.berlin/go/vaultik/internal/log"
+	"sneak.berlin/go/vaultik/internal/storage"
+	"sneak.berlin/go/vaultik/internal/vaultik"
+)
+
+// --skip-errors skips only a file that cannot be opened or read. A local
+// index error while a directory is recorded stops the backup, and the
+// snapshot is not recorded as complete. See
+// https://git.eeqj.de/sneak/vaultik/issues/284.
+func TestSkipErrorsBackupStopsOnIndexErrorRecordingDirectory(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	ctx := context.Background()
+
+	// The scan walks the source path with symlinks resolved, so dirPath
+	// must be spelled the same way to match the row the scan inserts.
+	tempDir, err := filepath.EvalSymlinks(t.TempDir())
+	require.NoError(t, err)
+
+	srcDir := filepath.Join(tempDir, "src")
+	dirPath := filepath.Join(srcDir, "dir")
+
+	fs := afero.NewOsFs()
+	require.NoError(t, fs.MkdirAll(dirPath, 0o755))
+	require.NoError(t, afero.WriteFile(fs,
+		filepath.Join(dirPath, "file.txt"), []byte("file content"), 0o644))
+
+	cfg := faultTestConfig()
+	cfg.IndexPath = filepath.Join(tempDir, "index.sqlite")
+	cfg.Snapshots = map[string]config.SnapshotConfig{
+		"tree": {Paths: []string{srcDir}},
+	}
+
+	store, err := storage.NewFileStorer(filepath.Join(tempDir, "remote"))
+	require.NoError(t, err)
+
+	db, err := database.New(ctx, cfg.IndexPath)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = db.Close() })
+
+	// The local index refuses the directory's files row.
+	_, err = db.Conn().ExecContext(ctx, fmt.Sprintf(`
+		CREATE TRIGGER refuse_directory BEFORE INSERT ON files
+		WHEN NEW.path = '%s'
+		BEGIN SELECT RAISE(ABORT, 'simulated index error'); END`, dirPath))
+	require.NoError(t, err)
+
+	repos := database.NewRepositories(db)
+	v := newBackupVaultik(ctx, cfg, store, repos, db, fs)
+
+	err = v.CreateSnapshot(&vaultik.SnapshotCreateOptions{
+		SkipErrors: true,
+		Snapshots:  []string{"tree"},
+	})
+	require.ErrorContains(t, err, "simulated index error")
+
+	snapshots, err := repos.Snapshots.ListRecent(ctx, listRecentTestLimit)
+	require.NoError(t, err)
+	require.Len(t, snapshots, 1)
+	assert.Nil(t, snapshots[0].CompletedAt)
+}

internal/vaultik/storage_bind.go

@@ -9,7 +9,7 @@ import (
 )
 
 // errStorageBindingMismatch is returned when the local index database is
-// bound to a different destination than the configured storage_url.
+// bound to a different destination than the configured one.
 var errStorageBindingMismatch = errors.New(
 	"local index is bound to a different backup destination")
 
@@ -24,8 +24,9 @@ var errStorageBindingMismatch = errors.New(
 //
 // Behaviour:
 //   - On first use (empty stored value), record the configured
-//     storage_url and log the binding.
-//   - When the stored value matches the configured storage_url, do
+//     destination (storage_url, or the s3.* endpoint, bucket and
+//     prefix) and log the binding.
+//   - When the stored value matches the configured destination, do
 //     nothing and return nil.
 //   - When the two differ, refuse with an error that tells the user
 //     how to recover (revert the config, or run `vaultik database
@@ -46,12 +47,10 @@ func (v *Vaultik) EnsureStorageBinding() error {
 
 	configured := v.Config.StorageURL
 	if configured == "" {
-		// Some legacy configs still use the split s3.* keys instead of
-		// storage_url. Falling back to a synthetic URL for those would
-		// hide the fact that the binding is loose. Instead, treat
-		// unset as "nothing to bind against" — the check is
-		// necessarily best-effort for those configs.
-		return nil
+		// The s3.* form: bind on its endpoint, bucket and prefix,
+		// written the way storage_url would name the same destination.
+		s3 := v.Config.S3
+		configured = "s3://" + s3.Bucket + "/" + s3.Prefix + "?endpoint=" + s3.Endpoint
 	}
 
 	stored, err := v.Repositories.LocalMeta.Get(v.ctx, database.LocalMetaKeyStorageURL)
@@ -96,7 +95,8 @@ func buildBindingMismatchMessage(stored, configured string) string {
 		"future snapshots referencing blobs that don't exist at the new destination.\n" +
 		"\n" +
 		"To proceed, either:\n" +
-		"  - revert storage_url in your config to the bound destination, or\n" +
+		"  - revert storage_url (or the s3.* endpoint, bucket and prefix) in your\n" +
+		"    config to the bound destination, or\n" +
 		"  - run 'vaultik database delete' to discard the local index and rebuild it\n" +
 		"    from a fresh full backup against the new destination"
 }

internal/vaultik/storage_bind_test.go

@@ -76,3 +76,51 @@ func TestEnsureStorageBinding_MismatchRefuses(t *testing.T) {
 	assert.Contains(t, err.Error(), "file:///mnt/backups/new")
 	assert.Contains(t, err.Error(), "vaultik database delete")
 }
+
+// A config with no storage_url names its destination with s3.endpoint,
+// s3.bucket and s3.prefix; a change to any of them must be refused just
+// as a changed storage_url is.
+func TestEnsureStorageBinding_S3FieldsChangeRefuses(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	bound := config.S3Config{
+		Endpoint: "https://s3.example.com",
+		Bucket:   "bucket-a",
+		Prefix:   "backups",
+	}
+
+	tests := []struct {
+		name    string
+		changed config.S3Config
+	}{
+		{"bucket", config.S3Config{
+			Endpoint: bound.Endpoint, Bucket: "bucket-b", Prefix: bound.Prefix,
+		}},
+		{"prefix", config.S3Config{
+			Endpoint: bound.Endpoint, Bucket: bound.Bucket, Prefix: "other",
+		}},
+		{"endpoint", config.S3Config{
+			Endpoint: "https://s3.other.com", Bucket: bound.Bucket, Prefix: bound.Prefix,
+		}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			tv, _ := buildBindTestVaultik(t, "")
+
+			tv.Config.S3 = bound
+			require.NoError(t, tv.EnsureStorageBinding(), "first use binds")
+			require.NoError(t, tv.EnsureStorageBinding(), "same destination passes")
+
+			tv.Config.S3 = tt.changed
+			err := tv.EnsureStorageBinding()
+			require.Error(t, err)
+			assert.Contains(t, err.Error(),
+				"local index is bound to a different backup destination")
+			assert.Contains(t, err.Error(), "vaultik database delete")
+		})
+	}
+}