Correct doc and help sentences that are false about the code (closes #233)

A blob is written whole to a temporary file and uploaded once finished,
not streamed to storage. The README, ARCHITECTURE.md and
config.example.yml now say a backup needs free temporary space for each
blob (twice that for an rclone destination that cannot stream uploads)
and for the metadata export's copies of the local index, in $TMPDIR, or
partly in /var/tmp when TMPDIR is unset. Also corrected: the snapshot ID
format, what restore reads and how incomplete snapshots are removed in
docs/DATAMODEL.md, what source_path holds, the index_path default, the
config search order in the snapshot create help, what snapshot remove
cleans up in the prune help, how the release installs Go, and the
script/release and script/fmt-check comments.

Model: opus-5-5

ARCHITECTURE.md

@@ -54,10 +54,12 @@ The database tracks five primary entities and their relationships:
 
 #### File (`database.File`)
 Represents a file, directory, or symlink in the backup system. Stores metadata needed for restoration:
-- Path, source_path (for restore path stripping), mtime
+- Path, mtime
 - Size, mode, ownership (uid, gid)
 - Symlink target (if applicable)
 
+It also stores `source_path`, the source directory the scan found it under, made absolute and with symlinks resolved. Restore does not read it.
+
 #### Chunk (`database.Chunk`)
 A content-addressed unit of data. Files are split into variable-size chunks using the FastCDC algorithm:
 - `ChunkHash`: SHA256 hash of chunk content (primary key)
@@ -82,9 +84,11 @@ The final storage unit uploaded to S3. Contains many compressed and encrypted ch
 Blob creation process:
 1. Chunks are accumulated (up to MaxBlobSize, typically 10GB)
 2. As each chunk is added, its uncompressed bytes are fed to a running SHA-256
-3. Concurrently, the same bytes are compressed with zstd, then encrypted with age (recipients configured in config), and streamed to storage
+3. Concurrently, the same bytes are compressed with zstd, then encrypted with age (recipients configured in config), and written to a temporary file
 4. On finalize, the blob's name is the double SHA-256 of the uncompressed contents — `hex(SHA256(SHA256(...)))` — not a hash of the compressed, encrypted bytes
-5. Uploaded to `blobs/{hash[0:2]}/{hash[2:4]}/{hash}`
+5. The finished file is uploaded to `blobs/{hash[0:2]}/{hash[2:4]}/{hash}` and then deleted
+
+A backup needs free temporary space, because each blob is written whole to a temporary file before it is uploaded (up to about `blob_size_limit`; an rclone destination that cannot stream uploads needs about twice that) and the metadata export writes copies of the local index. Temporary files go to `$TMPDIR` (default `/tmp`); with `TMPDIR` unset, SQLite writes one of those copies to `/var/tmp`.
 
 #### BlobChunk (`database.BlobChunk`)
 Maps chunks to their position within blobs:

README.md

@@ -546,7 +546,7 @@ complete annotated example also lives in
 | `s3.*` | | Legacy S3 configuration (endpoint, bucket, credentials) |
 | `exclude` | | Global exclude patterns (applied to all snapshots) |
 | `chunk_size` | `10MB` | Average chunk size for content-defined chunking |
-| `blob_size_limit` | `10GB` | Maximum blob size before splitting. Must be at least four times `chunk_size` (the largest chunk the chunker can emit), otherwise a single-chunk blob could exceed the limit |
+| `blob_size_limit` | `10GB` | Maximum blob size before splitting. Must be at least four times `chunk_size` (the largest chunk the chunker can emit), otherwise a single-chunk blob could exceed the limit. A backup needs free temporary space, because each blob is written whole to a temporary file before it is uploaded (up to about `blob_size_limit`; an rclone destination that cannot stream uploads needs about twice that) and the metadata export writes copies of the local index. Temporary files go to `$TMPDIR` (default `/tmp`); with `TMPDIR` unset, SQLite writes one of those copies to `/var/tmp` |
 | `compression_level` | `3` | zstd compression level (1-19) |
 | `hostname` | system hostname | Hostname used in snapshot IDs |
 | `index_path` | platform data dir | Local SQLite index path |
@@ -805,7 +805,8 @@ them. We provide:
   in the `Dockerfile` together.
 * `script/release` — cross-compile and publish the release artifacts
   with the pinned `goreleaser`. Refuses a `goreleaser` on `PATH` whose
-  version is not the pinned one, on the same reasoning as `script/lint`.
+  version is not the pinned one, because a different version would build
+  a different release from the same tag.
 * `script/release-snapshot` — the same build with no publishing and no
   tagging, into `./dist`
 * `script/test` — run the test suite by building the `test` phase of
@@ -915,14 +916,14 @@ It is passed to `goreleaser` as `GITEA_TOKEN`. The runner's automatic
 token is deliberately not used: it is not guaranteed to carry release
 write access.
 
-The Go toolchain that compiles the released binaries comes from an
-`actions/setup-go` step pinned by commit sha, reading its version from
-`go.mod` (currently `1.26.1`, the same version the `Dockerfile` builder
-stage pins by digest). `goreleaser` shells out to `go` for every
+The Go toolchain that compiles the released binaries is installed by
+`script/install-go`, which downloads the version named by `go.mod`
+(currently `1.26.1`, the same version the `Dockerfile` builder stage
+pins by digest) and refuses the archive unless its sha256 matches the
+value committed in the script. `goreleaser` shells out to `go` for every
 cross-compile, so without that step the release would either fail
 outright or ship binaries built by whatever unpinned toolchain the
-runner happened to carry — the one unpinned thing in an otherwise
-hash-pinned release path.
+runner happened to carry.
 
 To rehearse the whole build without publishing or tagging anything:
 

TODO.md

@@ -22,6 +22,53 @@ the tag exists and is exercised; what is left is merging `next` to
 
 # Completed Steps
 
+- 2026-10-07: Corrected documentation, help text and comments that were
+  false about the code
+  ([issue #233](https://git.eeqj.de/sneak/vaultik/issues/233)). A blob
+  is not streamed to storage. The README, `ARCHITECTURE.md` and
+  `config.example.yml` now say a backup needs free temporary space,
+  because each blob is written whole to a temporary file before it is
+  uploaded (up to about `blob_size_limit`; an rclone destination that
+  cannot stream uploads needs about twice that) and the metadata export
+  writes copies of the local index. Temporary files go to `$TMPDIR`
+  (default `/tmp`); with `TMPDIR` unset, SQLite writes one of those
+  copies to `/var/tmp`. Also corrected: the snapshot ID format, what restore
+  reads and how incomplete snapshots are removed in `docs/DATAMODEL.md`,
+  what `source_path` holds, the `index_path` and config file defaults,
+  what `snapshot remove` cleans up, how the release gets its Go
+  toolchain, and the `script/release` and `script/fmt-check` comments.
+
+- 2026-10-07: Cut the time the `internal/vaultik` and `internal/database`
+  tests take ([issue #235](https://git.eeqj.de/sneak/vaultik/issues/235)).
+  Most of the `internal/vaultik` time went to 24 tests that ran one at a
+  time only because they call `log.Initialize`; they now call it before
+  `t.Parallel()`, as the package's other tests do. `TestLargeDatasets`
+  committed each of its 1,500 inserts on its own and now makes them in
+  one transaction. `TestDedupOnlySnapshotRestores` gives its second
+  backup its own snapshot name instead of sleeping past the one-second
+  timestamp in the snapshot ID.
+
+- 2026-10-07: Made two messages say only what is true
+  ([issue #240](https://git.eeqj.de/sneak/vaultik/issues/240)). A config
+  file that others can read was warned about as containing S3
+  credentials even when it set none, as a `file://` config does. The
+  warning now says the file may contain S3 credentials only when
+  `s3.access_key_id` or `s3.secret_access_key` is set, since either may
+  come from a `${...}` reference rather than the file, and otherwise
+  says the file is readable by others. `snapshot purge` against a
+  destination store it could not list gave an error with
+  `listing remote snapshots:` in it twice; the prefix now appears once.
+
+- 2026-10-07: Made `s3.part_size` set the multipart upload part size
+  ([issue #232](https://git.eeqj.de/sneak/vaultik/issues/232)). It was
+  loaded and defaulted but never passed to the S3 client, whose uploader
+  used a fixed 10MiB part. It now reaches the uploader for `storage_url`
+  and for the `s3.*` fields, and a part size S3 refuses, below 5MiB or
+  above 5GiB, `0` included, fails at config load. A blob too large for
+  S3's limit of 10,000 parts at the configured size is uploaded in larger
+  parts. The docs gave the default as `5MB`, which the config file reads
+  as 5,000,000 bytes, below the minimum; they now say `5MiB`.
+
 - 2026-10-07: Made per-name retention work when the hostname contains `_`
   ([issue #230](https://git.eeqj.de/sneak/vaultik/issues/230)). A
   snapshot ID is `hostname_name_timestamp`, and the name was read as

config.example.yml

@@ -287,15 +287,18 @@ storage_url: "rclone://myremote/path/to/backups"
 #  #use_ssl: true
 #
 #  # Part size for multipart uploads
-#  # Minimum 5MB, affects memory usage during upload
-#  # Supports: 5MB, 10M, 100MiB, etc.
-#  # Default: 5MB
-#  #part_size: 5MB
+#  # Minimum 5MiB, maximum 5GiB; affects memory usage during upload
+#  # A blob too large for 10,000 parts of this size gets larger parts
+#  # Supports: 10MB, 16MiB, 100MiB, etc. (5MB is below the minimum)
+#  # Default: 5MiB
+#  #part_size: 5MiB
 
 # Path to local SQLite index database
 # This database tracks file state for incremental backups
-# Default: /var/lib/vaultik/index.sqlite
-#index_path: /var/lib/vaultik/index.sqlite
+# Default: the platform data directory, e.g.
+#   macOS: ~/Library/Application Support/vaultik/index.sqlite
+#   Linux: ~/.local/share/vaultik/index.sqlite
+#index_path: /path/to/index.sqlite
 
 # Average chunk size for content-defined chunking
 # Smaller chunks = better deduplication but more metadata
@@ -310,6 +313,12 @@ storage_url: "rclone://myremote/path/to/backups"
 # Chunking uses no secret (the FastCDC parameters are fixed and public). At a
 # large limit a blob holds hundreds of chunks, so individual chunk lengths are
 # not visible in its size; lowering the limit toward chunk_size exposes them.
+# A backup needs free temporary space, because each blob is written whole to
+# a temporary file before it is uploaded (up to about blob_size_limit; an
+# rclone destination that cannot stream uploads needs about twice that) and
+# the metadata export writes copies of the local index. Temporary files go to
+# $TMPDIR (default /tmp); with TMPDIR unset, SQLite writes one of those copies
+# to /var/tmp.
 # Supports: 1GB, 10G, 500MB, 1GiB, etc.
 # Default: 10GB
 #blob_size_limit: 10GB

docs/DATAMODEL.md

@@ -111,7 +111,7 @@ Maps chunks to the blobs that contain them.
 Tracks backup snapshots.
 
 **Columns:**
-- `id` (TEXT PRIMARY KEY) - Snapshot ID (format: hostname-YYYYMMDD-HHMMSSZ)
+- `id` (TEXT PRIMARY KEY) - Snapshot ID (format: `hostname_name_timestamp`, e.g. `server1_home_2025-06-01T12:00:00Z`: the hostname up to its first `.`, the snapshot name, and an RFC 3339 UTC timestamp)
 - `hostname` (TEXT) - Hostname where backup was created
 - `vaultik_version` (TEXT) - Version of Vaultik used
 - `vaultik_git_revision` (TEXT) - Git revision of Vaultik used
@@ -218,8 +218,8 @@ The `{remote-key}` directory name is a one-way hash of the human snapshot ID, so
 ### 4. Restore Process
 
 The restore process doesn't use the local database. Instead:
-1. Downloads snapshot metadata from S3
-2. Downloads required blobs based on manifest
+1. Downloads and decrypts the snapshot's metadata database (`db.zst.age`) from S3
+2. Downloads the blobs holding the chunks of the files being restored, found through that database's `blob_chunks` table; the manifest is not read
 3. Reconstructs files from decrypted and decompressed chunks
 
 ### 5. Pruning
@@ -232,9 +232,8 @@ The restore process doesn't use the local database. Instead:
 
 Before each backup:
 1. Query incomplete snapshots (where `completed_at IS NULL`)
-2. Check if metadata exists in S3
-3. If no metadata, delete snapshot and all associations
-4. Clean up orphaned files, chunks, and blobs
+2. Delete each one and all its associations, without checking S3 for its metadata
+3. Clean up orphaned files, chunks, and blobs
 
 ## Repository Pattern
 

internal/cli/config.go

@@ -205,7 +205,7 @@ storage_url: ""
 #   access_key_id: YOUR_ACCESS_KEY
 #   secret_access_key: YOUR_SECRET_KEY
 #   # region: us-east-1        # Default: us-east-1
-#   # part_size: 5MB           # Multipart upload part size. Default: 5MB
+#   # part_size: 5MiB          # Upload part size, 5MiB to 5GiB. Default: 5MiB
 #   # For the s3:// form, disable TLS with ?ssl=false in the URL, not use_ssl.
 
 # ─── OPTIONAL ────────────────────────────────────────────────────────────────

internal/cli/prune.go

@@ -22,9 +22,11 @@ scans every snapshot manifest in the destination store, builds the
 set of still-referenced blob hashes, and deletes any blob not in that
 set.
 
-Snapshot create --prune and snapshot remove run the same cleanup
-automatically; this command is the manual entry point for the same
-work (e.g. after a crashed backup or to reclaim storage).`,
+Snapshot create --prune runs the same cleanup automatically; this
+command is the manual entry point for the same work (e.g. after a
+crashed backup or to reclaim storage). Snapshot remove leaves blobs in
+place; run this command afterwards to delete the ones no longer
+referenced.`,
 		Args: cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, _ []string) error {
 			// Use unified config resolution

internal/cli/snapshot.go

@@ -66,8 +66,9 @@ func newSnapshotCreateCommand() *cobra.Command {
 If snapshot names are provided, only those snapshots are created.
 If no names are provided, all configured snapshots are created.
 
-Config is located at /etc/vaultik/config.yml by default, but can be overridden by
-specifying a path using --config or by setting VAULTIK_CONFIG to a path.`,
+The config is read from the path given by --config or VAULTIK_CONFIG;
+otherwise from the platform config directory (~/.config/vaultik/config.yml
+on Linux), then /etc/vaultik/config.yml.`,
 		Args: cobra.ArbitraryArgs,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			// Pass snapshot names from args

internal/config/config.go

@@ -33,11 +33,14 @@ const secretKeyPrefix = "AGE-SECRET-KEY-"
 const (
 	defaultBlobSizeLimit    = Size(10 * 1024 * 1024 * 1024) // 10GB
 	defaultChunkSize        = Size(10 * 1024 * 1024)        // 10MB
-	defaultS3PartSize       = Size(5 * 1024 * 1024)         // 5MB
+	defaultS3PartSize       = Size(5 * 1024 * 1024)         // 5MiB
 	defaultCompressionLevel = 3
 	minChunkSize            = 1024 * 1024 // 1MB
 	minCompressionLevel     = 1
 	maxCompressionLevel     = 19
+	// S3 accepts a multipart upload part from 5MiB to 5GiB.
+	minS3PartSize = 5 * 1024 * 1024
+	maxS3PartSize = 5 * 1024 * 1024 * 1024
 )
 
 // Sentinel validation errors.
@@ -55,6 +58,7 @@ var (
 		"blob_size_limit must be at least the largest chunk the chunker can " +
 			"emit (chunk_size times the FastCDC size spread)")
 	errBadCompression   = errors.New("compression_level must be between 1 and 19")
+	errBadS3PartSize    = errors.New("s3.part_size must be between 5MiB and 5GiB")
 	errBadStorageScheme = errors.New(
 		"storage_url must start with s3://, file://, or rclone://")
 	errStorageNotConfigured = errors.New(
@@ -244,6 +248,7 @@ func Load(path string) (*Config, error) {
 		ChunkSize:        defaultChunkSize,
 		IndexPath:        filepath.Join(xdg.DataHome, appName, "index.sqlite"),
 		CompressionLevel: defaultCompressionLevel,
+		S3:               S3Config{PartSize: defaultS3PartSize},
 	}
 
 	// Convert smartconfig data to YAML then unmarshal
@@ -294,17 +299,13 @@ func Load(path string) (*Config, error) {
 		cfg.S3.Region = "us-east-1"
 	}
 
-	if cfg.S3.PartSize == 0 {
-		cfg.S3.PartSize = defaultS3PartSize
-	}
-
 	// Check config file permissions (warn if world or group readable)
 	//nolint:gosec // G703: config path is operator-supplied by design
 	info, statErr := os.Stat(path)
 	if statErr == nil {
 		mode := info.Mode().Perm()
 		if mode&0044 != 0 { // group or world readable
-			log.Warn("Config file has insecure permissions (contains S3 credentials)",
+			log.Warn(cfg.readableByOthersWarning(),
 				"path", path,
 				"mode", fmt.Sprintf("%04o", mode),
 				"recommendation", "chmod 600 "+path)
@@ -332,6 +333,7 @@ func Load(path string) (*Config, error) {
 //     (chunk_size times chunker.ChunkSizeSpread), so a single-chunk blob never
 //     exceeds the configured limit
 //   - Compression level must be between 1 and 19
+//   - S3 part size must be between 5MiB and 5GiB, the part sizes S3 accepts
 //
 // Returns an error describing the first validation failure encountered.
 func (c *Config) Validate() error {
@@ -376,6 +378,11 @@ func (c *Config) Validate() error {
 		return errBadCompression
 	}
 
+	if c.S3.PartSize.Int64() < minS3PartSize ||
+		c.S3.PartSize.Int64() > maxS3PartSize {
+		return errBadS3PartSize
+	}
+
 	return nil
 }
 
@@ -411,6 +418,18 @@ func (c *Config) setAgeSecretKey() {
 	}
 }
 
+// readableByOthersWarning is the warning Load logs when others can read
+// the config file. It says "may contain" because the S3 credentials are
+// seen only after smartconfig has replaced any ${...} reference in the
+// file with its value, so a set credential need not be in the file.
+func (c *Config) readableByOthersWarning() string {
+	if c.S3.AccessKeyID != "" || c.S3.SecretAccessKey != "" {
+		return "Config file is readable by others and may contain S3 credentials"
+	}
+
+	return "Config file is readable by others"
+}
+
 // validateStorage validates storage configuration.
 // If StorageURL is set, it takes precedence. S3 URLs require credentials.
 // File URLs don't require any S3 configuration.

internal/config/config_test.go

@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"sneak.berlin/go/vaultik/internal/chunker"
+	"sneak.berlin/go/vaultik/internal/log"
 )
 
 const (
@@ -166,6 +167,7 @@ func TestValidateBlobSizeLimit(t *testing.T) {
 			ChunkSize:        chunkSize,
 			BlobSizeLimit:    blobLimit,
 			CompressionLevel: 3,
+			S3:               S3Config{PartSize: defaultS3PartSize},
 		}
 	}
 
@@ -221,6 +223,120 @@ func TestValidateBlobSizeLimit(t *testing.T) {
 	}
 }
 
+// TestValidateS3PartSize checks that s3.part_size is held to the part sizes
+// S3 accepts, 5MiB to 5GiB, by changing only the part size of the test
+// config. "5MB" in the config file is 5,000,000 bytes, below the minimum.
+func TestValidateS3PartSize(t *testing.T) {
+	t.Parallel()
+
+	base, err := Load(os.Getenv("VAULTIK_CONFIG"))
+	if err != nil {
+		t.Fatalf("Failed to load config: %v", err)
+	}
+
+	tests := []struct {
+		name     string
+		partSize Size
+		wantErr  bool
+	}{
+		{
+			name:     "5MB is rejected",
+			partSize: 5_000_000,
+			wantErr:  true,
+		},
+		{
+			name:     "one byte below 5MiB is rejected",
+			partSize: minS3PartSize - 1,
+			wantErr:  true,
+		},
+		{
+			name:     "5MiB is accepted",
+			partSize: minS3PartSize,
+			wantErr:  false,
+		},
+		{
+			name:     "5GiB is accepted",
+			partSize: maxS3PartSize,
+			wantErr:  false,
+		},
+		{
+			name:     "one byte above 5GiB is rejected",
+			partSize: maxS3PartSize + 1,
+			wantErr:  true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			cfg := *base
+			cfg.S3.PartSize = tt.partSize
+
+			err := cfg.Validate()
+			if tt.wantErr {
+				if !errors.Is(err, errBadS3PartSize) {
+					t.Fatalf("Validate() error = %v, want errBadS3PartSize", err)
+				}
+
+				return
+			}
+
+			if err != nil {
+				t.Fatalf("Validate() unexpected error: %v", err)
+			}
+		})
+	}
+}
+
+// TestLoadS3PartSize checks that a config file without s3.part_size loads
+// with the 5MiB default, and that an explicit 0 fails at load like any other
+// part size S3 refuses.
+func TestLoadS3PartSize(t *testing.T) {
+	t.Parallel()
+
+	const withoutPartSize = "snapshots:\n" +
+		"  test:\n" +
+		"    paths: [/tmp/vaultik-test-source]\n" +
+		"storage_url: file:///tmp/vaultik-test-storage\n"
+
+	writeConfig := func(t *testing.T, text string) string {
+		t.Helper()
+
+		path := filepath.Join(t.TempDir(), "config.yml")
+
+		err := os.WriteFile(path, []byte(text), 0o600)
+		if err != nil {
+			t.Fatalf("write config: %v", err)
+		}
+
+		return path
+	}
+
+	t.Run("absent loads as 5MiB", func(t *testing.T) {
+		t.Parallel()
+
+		cfg, err := Load(writeConfig(t, withoutPartSize))
+		if err != nil {
+			t.Fatalf("Load() unexpected error: %v", err)
+		}
+
+		if cfg.S3.PartSize != defaultS3PartSize {
+			t.Errorf("s3.part_size = %d, want %d",
+				cfg.S3.PartSize, defaultS3PartSize)
+		}
+	})
+
+	t.Run("0 is rejected", func(t *testing.T) {
+		t.Parallel()
+
+		_, err := Load(writeConfig(t, withoutPartSize+"s3:\n  part_size: 0\n"))
+		if !errors.Is(err, errBadS3PartSize) {
+			t.Fatalf("Load() error = %v, want errBadS3PartSize", err)
+		}
+	})
+}
+
 // TestValidateAgeRecipients checks that recipients are parsed at config load
 // (a bad entry fails immediately, not mid-backup) and that no invalid entry —
 // least of all a pasted secret key — is echoed in the error. An empty list
@@ -236,6 +352,7 @@ func TestValidateAgeRecipients(t *testing.T) {
 			ChunkSize:        Size(10 * 1024 * 1024),
 			BlobSizeLimit:    Size(10 * 1024 * 1024 * 1024),
 			CompressionLevel: 3,
+			S3:               S3Config{PartSize: defaultS3PartSize},
 		}
 	}
 
@@ -343,3 +460,125 @@ func TestAgeSecretKeySourceName(t *testing.T) {
 		})
 	}
 }
+
+// loadReadableConfig writes configYAML to a file that others can read,
+// loads it, and returns what the logger wrote to stderr meanwhile. The
+// logger writes to the os.Stderr it finds when it is initialized, so
+// os.Stderr is pointed at a file first. Not parallel-safe: os.Stderr and
+// the logger are process-global.
+func loadReadableConfig(t *testing.T, configYAML string) string {
+	t.Helper()
+
+	dir := t.TempDir()
+	configPath := filepath.Join(dir, "config.yml")
+	stderrPath := filepath.Join(dir, "stderr")
+
+	err := os.WriteFile(configPath, []byte(configYAML), 0o600)
+	if err != nil {
+		t.Fatalf("writing config: %v", err)
+	}
+
+	//nolint:gosec // G302: the test needs a config file others can read
+	err = os.Chmod(configPath, 0o644)
+	if err != nil {
+		t.Fatalf("chmod config: %v", err)
+	}
+
+	stderrFile, err := os.Create(stderrPath) //nolint:gosec // G304: test temp path
+	if err != nil {
+		t.Fatalf("creating stderr file: %v", err)
+	}
+
+	previous := os.Stderr
+	os.Stderr = stderrFile
+
+	log.Initialize(log.Config{})
+
+	_, loadErr := Load(configPath)
+
+	os.Stderr = previous
+
+	log.Initialize(log.Config{})
+
+	_ = stderrFile.Close()
+
+	if loadErr != nil {
+		t.Fatalf("Load() error = %v", loadErr)
+	}
+
+	captured, err := os.ReadFile(stderrPath) //nolint:gosec // G304: test temp path
+	if err != nil {
+		t.Fatalf("reading stderr file: %v", err)
+	}
+
+	return string(captured)
+}
+
+// TestLoadWarnsReadableConfigWithoutS3Credentials checks that a config
+// file others can read, holding no S3 credentials, is warned about
+// without a claim that it holds them.
+//
+//nolint:paralleltest // loadReadableConfig replaces os.Stderr
+func TestLoadWarnsReadableConfigWithoutS3Credentials(t *testing.T) {
+	stderr := loadReadableConfig(t, `
+storage_url: file:///var/backups/vaultik
+snapshots:
+  home:
+    paths:
+      - /home
+`)
+
+	if !strings.Contains(stderr, "Config file is readable by others") {
+		t.Errorf("expected a warning that the file is readable by others, got %q",
+			stderr)
+	}
+
+	if strings.Contains(stderr, "S3 credentials") {
+		t.Errorf("warning names S3 credentials the file does not set: %q", stderr)
+	}
+}
+
+// TestLoadWarnsReadableConfigWithS3Credentials checks that a config file
+// others can read and that sets S3 credentials, as values or as ${ENV:...}
+// references, is warned about as one that may contain them.
+//
+//nolint:paralleltest // loadReadableConfig replaces os.Stderr
+func TestLoadWarnsReadableConfigWithS3Credentials(t *testing.T) {
+	t.Setenv("VAULTIK_TEST_ACCESS_KEY_ID", "test-access-key")
+	t.Setenv("VAULTIK_TEST_SECRET_ACCESS_KEY", "test-secret-key")
+
+	configs := map[string]string{
+		"values": `
+storage_url: s3://bucket/prefix?endpoint=s3.example.com
+s3:
+  access_key_id: test-access-key
+  secret_access_key: test-secret-key
+snapshots:
+  home:
+    paths:
+      - /home
+`,
+		"references": `
+storage_url: s3://bucket/prefix?endpoint=s3.example.com
+s3:
+  access_key_id: ${ENV:VAULTIK_TEST_ACCESS_KEY_ID}
+  secret_access_key: ${ENV:VAULTIK_TEST_SECRET_ACCESS_KEY}
+snapshots:
+  home:
+    paths:
+      - /home
+`,
+	}
+
+	for name, configYAML := range configs {
+		t.Run(name, func(t *testing.T) {
+			stderr := loadReadableConfig(t, configYAML)
+
+			if !strings.Contains(stderr,
+				"Config file is readable by others and may contain S3 credentials") {
+				t.Errorf("expected a warning naming the S3 credentials, got %q",
+					stderr)
+			}
+		})
+	}
+}

internal/database/models.go

@@ -14,8 +14,7 @@ type File struct {
 	ID   types.FileID   // UUID primary key
 	Path types.FilePath // Absolute path of the file
 
-	// SourcePath is the source directory this file came from (used for
-	// restore path stripping).
+	// SourcePath is the source directory this file came from.
 	SourcePath types.SourcePath
 	MTime      time.Time
 	Size       int64

internal/database/repository_edge_cases_test.go

@@ -3,6 +3,7 @@ package database
 
 import (
 	"context"
+	"database/sql"
 	"fmt"
 	"strings"
 	"testing"
@@ -367,7 +368,7 @@ func verifyBlobNullUploadTS(
 }
 
 // createLargeDatasetFiles creates fileCount files and adds every other
-// one to the snapshot.
+// one to the snapshot, in one transaction as a backup writes them.
 func createLargeDatasetFiles(
 	t *testing.T,
 	repos *Repositories,
@@ -376,31 +377,38 @@ func createLargeDatasetFiles(
 ) {
 	t.Helper()
 
-	ctx := context.Background()
 	start := time.Now()
 
-	for i := range fileCount {
-		file := &File{
-			Path:  types.FilePath(fmt.Sprintf("/large/file%05d.txt", i)),
-			MTime: time.Now(),
-			Size:  int64(i * 1024),
-			Mode:  0644,
-			UID:   uint32(1000 + (i % 10)),
-			GID:   uint32(1000 + (i % 10)),
-		}
+	err := repos.WithTx(context.Background(),
+		func(ctx context.Context, tx *sql.Tx) error {
+			for i := range fileCount {
+				file := &File{
+					Path:  types.FilePath(fmt.Sprintf("/large/file%05d.txt", i)),
+					MTime: time.Now(),
+					Size:  int64(i * 1024),
+					Mode:  0644,
+					UID:   uint32(1000 + (i % 10)),
+					GID:   uint32(1000 + (i % 10)),
+				}
 
-		err := repos.Files.Create(ctx, nil, file)
-		if err != nil {
-			t.Fatalf("failed to create file %d: %v", i, err)
-		}
+				err := repos.Files.Create(ctx, tx, file)
+				if err != nil {
+					return fmt.Errorf("creating file %d: %w", i, err)
+				}
 
-		// Add half to snapshot
-		if i%2 == 0 {
-			err = repos.Snapshots.AddFileByID(ctx, nil, snapshotID, file.ID)
-			if err != nil {
-				t.Fatal(err)
+				// Add half to snapshot
+				if i%2 == 0 {
+					err = repos.Snapshots.AddFileByID(ctx, tx, snapshotID, file.ID)
+					if err != nil {
+						return err
+					}
+				}
 			}
-		}
+
+			return nil
+		})
+	if err != nil {
+		t.Fatal(err)
 	}
 
 	t.Logf("Created %d files in %v", fileCount, time.Since(start))

internal/database/schema/001.sql

@@ -5,7 +5,7 @@
 CREATE TABLE IF NOT EXISTS files (
     id TEXT PRIMARY KEY,  -- UUID
     path TEXT NOT NULL UNIQUE,
-    source_path TEXT NOT NULL DEFAULT '',  -- The source directory this file came from (for restore path stripping)
+    source_path TEXT NOT NULL DEFAULT '',  -- The source directory this file came from
     mtime INTEGER NOT NULL,  -- whole seconds since the Unix epoch
     mtime_nsec INTEGER NOT NULL,  -- nanoseconds within that second, 0 to 999999999
     size INTEGER NOT NULL,

internal/s3/client.go

@@ -27,10 +27,12 @@ type Client struct {
 	bucket   string
 	prefix   string
 	endpoint string
+	partSize int64
 }
 
 // Config contains S3 client configuration.
-// All fields are required except Prefix, which defaults to an empty string.
+// All fields are required except Prefix, which defaults to an empty string,
+// and PartSize, where zero means the SDK default of 5 MiB.
 // A non-empty Prefix is joined to every key with one "/", whether or not
 // it ends with one.
 // The Endpoint field should include the protocol (http:// or https://).
@@ -41,6 +43,9 @@ type Config struct {
 	AccessKeyID     string
 	SecretAccessKey string
 	Region          string
+	// PartSize is the size in bytes of each part of a multipart upload.
+	// An upload too large for S3's limit of 10,000 parts gets larger parts.
+	PartSize int64
 }
 
 // nopLogger is a logger that discards all output.
@@ -90,6 +95,7 @@ func NewClient(ctx context.Context, cfg Config) (*Client, error) {
 		bucket:   cfg.Bucket,
 		prefix:   prefix,
 		endpoint: cfg.Endpoint,
+		partSize: cfg.PartSize,
 	}, nil
 }
 
@@ -123,12 +129,9 @@ func (c *Client) PutObjectWithProgress(
 ) error {
 	fullKey := c.prefix + key
 
-	// uploadPartSize is 10MB for better progress granularity.
-	const uploadPartSize = 10 * 1024 * 1024
-
 	// Create an uploader with the S3 client
 	uploader := manager.NewUploader(c.s3Client, func(u *manager.Uploader) {
-		u.PartSize = uploadPartSize
+		u.PartSize = uploadPartSize(c.partSize, size)
 	})
 
 	// Create a progress reader that tracks upload progress
@@ -149,6 +152,21 @@ func (c *Client) PutObjectWithProgress(
 	return err
 }
 
+// uploadPartSize returns the part size for an upload of size bytes: the
+// configured part size (the SDK default when zero), raised where needed so
+// the upload fits in S3's limit of 10,000 parts. The uploader cannot raise
+// it itself, because it cannot seek the progress reader to learn its size.
+func uploadPartSize(configured, size int64) int64 {
+	if configured == 0 {
+		configured = manager.DefaultUploadPartSize
+	}
+
+	maxParts := int64(manager.MaxUploadParts)
+	smallestThatFits := (size + maxParts - 1) / maxParts // rounded up
+
+	return max(configured, smallestThatFits)
+}
+
 // GetObject downloads an object from S3 with the specified key.
 // The key is automatically prefixed with the configured prefix.
 // Returns a ReadCloser containing the object data. The caller must

internal/s3/client_internal_test.go

@@ -0,0 +1,55 @@
+package s3
+
+import "testing"
+
+// TestUploadPartSize checks that an upload too large for 10,000 parts of the
+// configured size gets parts just large enough to fit in 10,000.
+func TestUploadPartSize(t *testing.T) {
+	t.Parallel()
+
+	const mib = 1024 * 1024
+
+	tests := []struct {
+		name       string
+		configured int64
+		size       int64
+		want       int64
+	}{
+		{
+			name:       "an upload that fits keeps the configured size",
+			configured: 5 * mib,
+			size:       10 * 1024 * mib,
+			want:       5 * mib,
+		},
+		{
+			name:       "exactly 10,000 parts keeps the configured size",
+			configured: 6 * mib,
+			size:       10_000 * 6 * mib,
+			want:       6 * mib,
+		},
+		{
+			name:       "one byte more than 10,000 parts adds a byte to each",
+			configured: 6 * mib,
+			size:       10_000*6*mib + 1,
+			want:       6*mib + 1,
+		},
+		{
+			name:       "zero means the SDK default of 5MiB",
+			configured: 0,
+			size:       1,
+			want:       5 * mib,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			got := uploadPartSize(tt.configured, tt.size)
+			if got != tt.want {
+				t.Errorf("uploadPartSize(%d, %d) = %d, want %d",
+					tt.configured, tt.size, got, tt.want)
+			}
+		})
+	}
+}

internal/s3/module.go

@@ -28,6 +28,7 @@ func provideClient(lc fx.Lifecycle, cfg *config.Config) (*Client, error) {
 		AccessKeyID:     cfg.S3.AccessKeyID,
 		SecretAccessKey: cfg.S3.SecretAccessKey,
 		Region:          cfg.S3.Region,
+		PartSize:        cfg.S3.PartSize.Int64(),
 	})
 	if err != nil {
 		return nil, err

internal/snapshot/scanner.go

@@ -58,8 +58,8 @@ type Scanner struct {
 	compressionLevel int
 	ageRecipient     string
 	snapshotID       string // Current snapshot being processed
-	// currentSourcePath is the source directory being scanned (used for
-	// restore path stripping).
+	// currentSourcePath is the source directory being scanned, stored with
+	// each file record.
 	currentSourcePath string
 	exclude           []string          // Glob patterns for files/directories to exclude
 	compiledExclude   []compiledPattern // Compiled glob patterns
@@ -211,7 +211,6 @@ func (s *Scanner) Scan(
 	ctx context.Context, path string, snapshotID string,
 ) (*ScanResult, error) {
 	s.snapshotID = snapshotID
-	// Store source path for file records (used during restore)
 	s.currentSourcePath = path
 	result := &ScanResult{
 		StartTime: time.Now().UTC(),
@@ -1198,9 +1197,8 @@ func (s *Scanner) checkFileInMemory(
 	}
 
 	file := &database.File{
-		ID:   fileID,
-		Path: types.FilePath(path),
-		// Store source directory for restore path stripping
+		ID:         fileID,
+		Path:       types.FilePath(path),
 		SourcePath: types.SourcePath(s.currentSourcePath),
 		MTime:      info.ModTime(),
 		Size:       info.Size(),

internal/storage/module.go

@@ -99,6 +99,7 @@ func storerFromParsedS3URL(parsed *URL, cfg *config.Config) (Storer, error) {
 		AccessKeyID:     cfg.S3.AccessKeyID,
 		SecretAccessKey: cfg.S3.SecretAccessKey,
 		Region:          region,
+		PartSize:        cfg.S3.PartSize.Int64(),
 	})
 	if err != nil {
 		return nil, fmt.Errorf("creating S3 client: %w", err)
@@ -134,6 +135,7 @@ func storerFromLegacyS3Config(cfg *config.Config) (Storer, error) {
 		AccessKeyID:     cfg.S3.AccessKeyID,
 		SecretAccessKey: cfg.S3.SecretAccessKey,
 		Region:          region,
+		PartSize:        cfg.S3.PartSize.Int64(),
 	})
 	if err != nil {
 		return nil, fmt.Errorf("creating S3 client: %w", err)

internal/storage/s3_test.go

@@ -1,11 +1,14 @@
 package storage_test
 
 import (
+	"bytes"
 	"context"
 	"errors"
+	"net/http"
 	"net/http/httptest"
 	"slices"
 	"strings"
+	"sync/atomic"
 	"testing"
 
 	"github.com/johannesboyne/gofakes3"
@@ -19,6 +22,13 @@ import (
 // s3TestBucket is the bucket created for each in-process S3 server.
 const s3TestBucket = "test-bucket"
 
+// Credentials for the tests that build a storer from a config.Config. The
+// in-process S3 server accepts any.
+const (
+	s3TestAccessKeyID     = "key"
+	s3TestSecretAccessKey = "secret"
+)
+
 // newS3Storer builds an s3:// backend backed by a fresh in-process
 // S3 server. It reuses the same in-memory S3 harness (gofakes3 + s3mem
 // over httptest) that internal/s3 and the not-found regression test use,
@@ -128,8 +138,8 @@ func TestS3URLPrefixKeyLayout(t *testing.T) {
 			storer, err := storage.NewStorer(&config.Config{
 				StorageURL: storageURL + "?endpoint=" + srv.URL,
 				S3: config.S3Config{
-					AccessKeyID:     "key",
-					SecretAccessKey: "secret",
+					AccessKeyID:     s3TestAccessKeyID,
+					SecretAccessKey: s3TestSecretAccessKey,
 				},
 			})
 			if err != nil {
@@ -171,6 +181,90 @@ func TestS3URLPrefixKeyLayout(t *testing.T) {
 	}
 }
 
+// TestS3UploadUsesConfiguredPartSize checks that s3.part_size reaches the
+// multipart uploader, through storage_url and through the s3.* fields. An
+// object three parts long must arrive as three parts; at the SDK's default
+// of 5 MiB it would arrive as four.
+func TestS3UploadUsesConfiguredPartSize(t *testing.T) {
+	t.Parallel()
+
+	const (
+		partSize  = 6 * 1024 * 1024
+		wantParts = 3
+	)
+
+	backend := s3mem.New()
+
+	err := backend.CreateBucket(s3TestBucket)
+	if err != nil {
+		t.Fatalf("create bucket: %v", err)
+	}
+
+	// Every part of a multipart upload is one request with a partNumber.
+	var parts atomic.Int32
+
+	fake := gofakes3.New(backend).Server()
+	srv := httptest.NewServer(http.HandlerFunc(
+		func(w http.ResponseWriter, r *http.Request) {
+			if r.URL.Query().Has("partNumber") {
+				parts.Add(1)
+			}
+
+			fake.ServeHTTP(w, r)
+		}))
+	t.Cleanup(srv.Close)
+
+	cases := []struct {
+		name string
+		cfg  *config.Config
+	}{
+		{
+			name: "storage_url",
+			cfg: &config.Config{
+				StorageURL: "s3://" + s3TestBucket + "?endpoint=" + srv.URL,
+				S3: config.S3Config{
+					AccessKeyID:     s3TestAccessKeyID,
+					SecretAccessKey: s3TestSecretAccessKey,
+					PartSize:        partSize,
+				},
+			},
+		},
+		{
+			name: "s3.endpoint",
+			cfg: &config.Config{
+				S3: config.S3Config{
+					Endpoint:        srv.URL,
+					Bucket:          s3TestBucket,
+					AccessKeyID:     s3TestAccessKeyID,
+					SecretAccessKey: s3TestSecretAccessKey,
+					PartSize:        partSize,
+				},
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		parts.Store(0)
+
+		storer, err := storage.NewStorer(tc.cfg)
+		if err != nil {
+			t.Fatalf("%s: NewStorer: %v", tc.name, err)
+		}
+
+		data := bytes.NewReader(make([]byte, wantParts*partSize))
+
+		err = storer.PutWithProgress(
+			context.Background(), "blob", data, data.Size(), nil)
+		if err != nil {
+			t.Fatalf("%s: PutWithProgress: %v", tc.name, err)
+		}
+
+		if got := parts.Load(); got != wantParts {
+			t.Errorf("%s: uploaded in %d parts, want %d", tc.name, got, wantParts)
+		}
+	}
+}
+
 // listStreamKeys returns the keys ListStream yields under a prefix, and
 // fails the test on a listing error.
 func listStreamKeys(t *testing.T, s storage.Storer, prefix string) []string {

internal/types/types.go

@@ -155,8 +155,8 @@ type BlobHash string
 // FilePath represents an absolute path to a file or directory.
 type FilePath string
 
-// SourcePath represents the root directory from which files are backed up.
-// Used during restore to strip the source prefix from paths.
+// SourcePath is the source directory a scan found a file under, made
+// absolute and with symlinks resolved.
 type SourcePath string
 
 // Hostname identifies a host machine.

internal/vaultik/changed_file_restore_test.go

@@ -130,10 +130,9 @@ func assertThirdSnapshotRestores(
 // up, and that snapshot is removed. The first snapshot keeps the file row,
 // which now lists the appended content's chunks, while removal drops the
 // blob that held them.
-//
-//nolint:paralleltest // installs the global logger via log.Initialize
 func TestBackupAfterRemovingNewestSnapshotRestoresChangedFile(t *testing.T) {
 	log.Initialize(log.Config{})
+	t.Parallel()
 
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
@@ -178,10 +177,9 @@ func TestBackupAfterRemovingNewestSnapshotRestoresChangedFile(t *testing.T) {
 // The next run's prune drops that incomplete snapshot and its blob, while
 // the first snapshot keeps the file row, which now lists the appended
 // content's chunks.
-//
-//nolint:paralleltest // installs the global logger via log.Initialize
 func TestBackupAfterInterruptedRunRestoresChangedFile(t *testing.T) {
 	log.Initialize(log.Config{})
+	t.Parallel()
 
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()

internal/vaultik/fault_injection_test.go

@@ -38,11 +38,9 @@ import (
 // (https://git.eeqj.de/sneak/vaultik/issues/130) and is not re-tested
 // here; these tests target the layers above the backend.
 //
-// The tests run serially, not with t.Parallel: each calls
-// log.Initialize, which replaces the package-global logger, and a
-// backup or restore running concurrently reads that same logger. Under
-// -race the two collide. Running one at a time is the same choice
-// prune_count_test.go already makes for the same reason.
+// log.Initialize replaces the package-global logger that a running
+// backup or restore reads, so each test calls it before t.Parallel,
+// while no parallel test is running yet.
 
 const (
 	faultChunkSize   = int64(64 * 1024)
@@ -165,17 +163,19 @@ func newReaderVaultik(
 // Scenario 3: a stored blob's bytes are flipped before restore reads
 // them. Restore must fail loudly, and no file must be left on the
 // restore target holding corrupt content.
-//
-//nolint:paralleltest // installs the global logger via log.Initialize
 func TestRestoreRejectsCorruptBlob(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
 	assertRestoreRejectsDamagedBlob(t, faultstore.GetCorrupt, "corrupt")
 }
 
 // Scenario 4: a stored blob is truncated before restore reads it. Same
 // contract as the corrupt case.
-//
-//nolint:paralleltest // installs the global logger via log.Initialize
 func TestRestoreRejectsTruncatedBlob(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
 	assertRestoreRejectsDamagedBlob(t, faultstore.GetTruncate, "truncated")
 }
 
@@ -188,7 +188,6 @@ func assertRestoreRejectsDamagedBlob(
 	t *testing.T, fault faultstore.GetFault, name string,
 ) {
 	t.Helper()
-	log.Initialize(log.Config{})
 
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
@@ -232,10 +231,9 @@ func assertRestoreRejectsDamagedBlob(
 
 // Scenario 6: the backend accepts blob uploads and reports success but
 // stores nothing. verify --deep must catch it.
-//
-//nolint:paralleltest // installs the global logger via log.Initialize
 func TestDeepVerifyCatchesLyingBackend(t *testing.T) {
 	log.Initialize(log.Config{})
+	t.Parallel()
 
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
@@ -285,10 +283,9 @@ func TestDeepVerifyCatchesLyingBackend(t *testing.T) {
 // Scenario 1a: a blob upload fails partway through. The interrupted run
 // must not record the blob as uploaded, must not reference it from the
 // snapshot, and must leave no blob object at the destination.
-//
-//nolint:paralleltest // installs the global logger via log.Initialize
 func TestInterruptedBlobUploadRecordsNoUploadedBlob(t *testing.T) {
 	log.Initialize(log.Config{})
+	t.Parallel()
 
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
@@ -361,10 +358,9 @@ func TestInterruptedBlobUploadRecordsNoUploadedBlob(t *testing.T) {
 // chunks in a blob that was actually uploaded, so the retry re-chunks and
 // re-uploads the affected data instead of silently referencing data that
 // never reached storage.
-//
-//nolint:paralleltest // installs the global logger via log.Initialize
 func TestBackupRetryAfterInterruptedUploadIsRestorable(t *testing.T) {
 	log.Initialize(log.Config{})
+	t.Parallel()
 
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
@@ -426,10 +422,9 @@ func TestBackupRetryAfterInterruptedUploadIsRestorable(t *testing.T) {
 // covered by TestBackupCompletesOnlyAfterMetadataExport
 // (https://git.eeqj.de/sneak/vaultik/issues/177); this test exercises the
 // lower-level export path in isolation.
-//
-//nolint:paralleltest // installs the global logger via log.Initialize
 func TestBackupSurvivesMetadataExportInterruption(t *testing.T) {
 	log.Initialize(log.Config{})
+	t.Parallel()
 
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
@@ -509,10 +504,9 @@ func TestBackupSurvivesMetadataExportInterruption(t *testing.T) {
 // destination. Rerunning the backup must then prune the incomplete
 // snapshot, produce a snapshot whose destination metadata and local index
 // agree, and restore. See https://git.eeqj.de/sneak/vaultik/issues/177.
-//
-//nolint:paralleltest // installs the global logger via log.Initialize
 func TestBackupCompletesOnlyAfterMetadataExport(t *testing.T) {
 	log.Initialize(log.Config{})
+	t.Parallel()
 
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
@@ -685,10 +679,9 @@ func faultScannerFactory(
 // Scenario 5: the restore target runs out of space mid-file. Restore
 // must fail with an out-of-space error, and must not leave a truncated
 // file at the target path presenting as a complete restore.
-//
-//nolint:paralleltest // installs the global logger via log.Initialize
 func TestRestoreReportsDiskFull(t *testing.T) {
 	log.Initialize(log.Config{})
+	t.Parallel()
 
 	osFS := afero.NewOsFs()
 	tempDir := t.TempDir()

internal/vaultik/integration_test.go

@@ -928,17 +928,17 @@ func setupDedupBackupEnv(
 	}
 }
 
-// runDedupSnapshot creates a "dedup" snapshot, scans dataDir into it,
-// completes it, and exports its metadata, returning the snapshot ID and
-// scan result.
+// runDedupSnapshot creates a snapshot with the given name, scans dataDir
+// into it, completes it, and exports its metadata, returning the snapshot
+// ID and scan result.
 func runDedupSnapshot(
 	ctx context.Context, t *testing.T,
 	sm *snapshot.SnapshotManager, scanner *snapshot.Scanner,
-	hostname, dataDir, dbPath string,
+	hostname, name, dataDir, dbPath string,
 ) (string, *snapshot.ScanResult) {
 	t.Helper()
 
-	id, err := sm.CreateSnapshotWithName(ctx, hostname, "dedup", "v", "g")
+	id, err := sm.CreateSnapshotWithName(ctx, hostname, name, "v", "g")
 	require.NoError(t, err)
 
 	result, err := scanner.Scan(ctx, dataDir, id)
@@ -980,16 +980,15 @@ func TestDedupOnlySnapshotRestores(t *testing.T) {
 
 	// First snapshot — uploads all blobs.
 	_, r1 := runDedupSnapshot(ctx, t, sm, makeScanner(),
-		cfg.Hostname, dataDir, dbPath)
+		cfg.Hostname, "first", dataDir, dbPath)
 	require.Positive(t, r1.BlobsCreated,
 		"first snapshot should upload at least one blob")
 
-	// Second snapshot — same data, every chunk dedups. Sleep past the
-	// second-precision timestamp so the snapshot IDs differ.
-	time.Sleep(1100 * time.Millisecond)
-
+	// Second snapshot — same data, every chunk dedups. Its own name gives
+	// it a different snapshot ID without waiting for the one-second
+	// timestamp in the ID to tick over.
 	id2, r2 := runDedupSnapshot(ctx, t, sm, makeScanner(),
-		cfg.Hostname, dataDir, dbPath)
+		cfg.Hostname, "second", dataDir, dbPath)
 	require.Equal(t, 0, r2.BlobsCreated,
 		"second snapshot should upload zero new blobs (fully dedup'd)")
 

internal/vaultik/missing_destination_test.go

@@ -6,6 +6,7 @@ import (
 	"io/fs"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/spf13/afero"
@@ -77,10 +78,9 @@ func backUpThenUnplug(
 // TestFirstBackupCreatesDestinationDirectory checks that a first backup
 // to a destination directory that does not exist yet creates it, and
 // that the destination can be listed afterwards.
-//
-//nolint:paralleltest // installs the global logger via log.Initialize
 func TestFirstBackupCreatesDestinationDirectory(t *testing.T) {
 	log.Initialize(log.Config{})
+	t.Parallel()
 
 	ctx := context.Background()
 	storeDir := filepath.Join(t.TempDir(), "volume", "backup")
@@ -95,10 +95,9 @@ func TestFirstBackupCreatesDestinationDirectory(t *testing.T) {
 // TestListSnapshotsWarnsWhenDestinationMissing checks that snapshot list
 // warns and shows the local index alone, without reporting the local
 // snapshot as missing from the destination.
-//
-//nolint:paralleltest // installs the global logger via log.Initialize
 func TestListSnapshotsWarnsWhenDestinationMissing(t *testing.T) {
 	log.Initialize(log.Config{})
+	t.Parallel()
 
 	ctx := context.Background()
 	v, repos, out := backUpThenUnplug(ctx, t)
@@ -115,10 +114,9 @@ func TestListSnapshotsWarnsWhenDestinationMissing(t *testing.T) {
 // TestRemoveSnapshotWarnsWhenDestinationMissing checks that snapshot
 // remove warns that the metadata could not be removed from the
 // destination, instead of reporting that it was.
-//
-//nolint:paralleltest // installs the global logger via log.Initialize
 func TestRemoveSnapshotWarnsWhenDestinationMissing(t *testing.T) {
 	log.Initialize(log.Config{})
+	t.Parallel()
 
 	ctx := context.Background()
 	v, repos, out := backUpThenUnplug(ctx, t)
@@ -137,10 +135,9 @@ func TestRemoveSnapshotWarnsWhenDestinationMissing(t *testing.T) {
 // TestPruneKeepsLocalRecordsWhenDestinationMissing checks that prune
 // fails on a destination it cannot list and deletes no local snapshot
 // record.
-//
-//nolint:paralleltest // installs the global logger via log.Initialize
 func TestPruneKeepsLocalRecordsWhenDestinationMissing(t *testing.T) {
 	log.Initialize(log.Config{})
+	t.Parallel()
 
 	ctx := context.Background()
 	v, repos, _ := backUpThenUnplug(ctx, t)
@@ -153,3 +150,22 @@ func TestPruneKeepsLocalRecordsWhenDestinationMissing(t *testing.T) {
 	require.NoError(t, err)
 	assert.Len(t, snapshots, 1, "prune must delete no local snapshot record")
 }
+
+// TestPurgeSaysListingFailedOnceWhenDestinationMissing checks that
+// snapshot purge fails on a destination it cannot list, with an error
+// that says "listing remote snapshots" once.
+func TestPurgeSaysListingFailedOnceWhenDestinationMissing(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	ctx := context.Background()
+	v, _, _ := backUpThenUnplug(ctx, t)
+
+	err := v.PurgeSnapshotsWithOptions(&vaultik.SnapshotPurgeOptions{
+		KeepLatest: true,
+		Force:      true,
+	})
+	require.ErrorIs(t, err, fs.ErrNotExist)
+	assert.Equal(t, 1, strings.Count(err.Error(), "listing remote snapshots"),
+		err.Error())
+}

internal/vaultik/prune_count_test.go

@@ -14,10 +14,9 @@ import (
 // the discarded-error bug: getTableCount for a table its query cannot
 // resolve must not silently become 0. A count that could not be read is
 // reported as unknown, which a reader can tell apart from an empty table.
-//
-//nolint:paralleltest // installs the global logger via log.Initialize
 func TestTableCountForReportSurfacesReadFailure(t *testing.T) {
 	log.Initialize(log.Config{})
+	t.Parallel()
 
 	ctx := context.Background()
 

internal/vaultik/restore_interrupt_test.go

@@ -164,10 +164,9 @@ func scratchEntries(t *testing.T, dir string) []string {
 // restore while a blob download is in progress. The download fails only
 // because of the cancel, so Restore must return context.Canceled without
 // reporting the file that needs the blob as failed.
-//
-//nolint:paralleltest // installs the global logger via log.Initialize
 func TestRestoreSkipErrorsCancelDuringBlobDownload(t *testing.T) {
 	log.Initialize(log.Config{})
+	t.Parallel()
 
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()

internal/vaultik/restore_skip_errors_test.go

@@ -45,9 +45,10 @@ type missingBlobBackup struct {
 // after one blob of a two-blob snapshot was deleted. Every file stored in
 // that blob must be reported as failed and left absent, every other file
 // must be restored intact, and Restore must still return an error.
-//
-//nolint:paralleltest // installs the global logger via log.Initialize
 func TestRestoreSkipErrorsSkipsFilesOfMissingBlob(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
 	ctx := context.Background()
 	backup := backupThenDeleteOneBlob(ctx, t)
 
@@ -85,9 +86,10 @@ func TestRestoreSkipErrorsSkipsFilesOfMissingBlob(t *testing.T) {
 
 // TestRestoreMissingBlobAbortsWithoutSkipErrors checks that a deleted blob
 // still ends the restore with an error when SkipErrors is not set.
-//
-//nolint:paralleltest // installs the global logger via log.Initialize
 func TestRestoreMissingBlobAbortsWithoutSkipErrors(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
 	ctx := context.Background()
 	backup := backupThenDeleteOneBlob(ctx, t)
 
@@ -107,7 +109,6 @@ func backupThenDeleteOneBlob(
 	ctx context.Context, t *testing.T,
 ) *missingBlobBackup {
 	t.Helper()
-	log.Initialize(log.Config{})
 
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()

internal/vaultik/same_second_rewrite_test.go

@@ -18,10 +18,9 @@ import (
 // A file rewritten with its size unchanged and a new mtime in the same
 // second as the mtime the index holds must still be backed up. See
 // https://git.eeqj.de/sneak/vaultik/issues/226.
-//
-//nolint:paralleltest // installs the global logger via log.Initialize
 func TestBackupOfSameSecondRewriteRestoresNewContent(t *testing.T) {
 	log.Initialize(log.Config{})
+	t.Parallel()
 
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()

internal/vaultik/snapshot.go

@@ -1052,7 +1052,7 @@ func (v *Vaultik) syncWithRemote() error {
 	// every local snapshot record (issue #160).
 	remoteKeys, err := v.listAllRemoteSnapshotKeys()
 	if err != nil {
-		return fmt.Errorf("listing remote snapshots: %w", err)
+		return err
 	}
 
 	remoteKeySet := make(map[string]bool, len(remoteKeys))

internal/vaultik/snapshot_summary_test.go

@@ -54,8 +54,6 @@ type summaryEnv struct {
 func newSummaryEnv(t *testing.T) *summaryEnv {
 	t.Helper()
 
-	log.Initialize(log.Config{})
-
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	srcDir := filepath.Join(tempDir, "src")
@@ -193,9 +191,10 @@ func (e *summaryEnv) dataLine(total, backedUp int64) string {
 // A first backup stores copy.bin's chunks while backing up a.bin, so
 // copy.bin's chunks are deduplicated within the run. Each file and byte
 // is still counted once.
-//
-//nolint:paralleltest // installs the global logger via log.Initialize
 func TestSnapshotSummaryFirstRun(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
 	env := newSummaryEnv(t)
 
 	summary := env.backUp(t, "first", false)
@@ -219,9 +218,10 @@ func TestSnapshotSummaryFirstRun(t *testing.T) {
 // An incremental backup where a.bin's mtime changed but its content did
 // not: a.bin is backed up again and every one of its chunks is already
 // stored.
-//
-//nolint:paralleltest // installs the global logger via log.Initialize
 func TestSnapshotSummaryIncrementalRunWithDeduplicatedChunks(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
 	env := newSummaryEnv(t)
 
 	env.backUp(t, "first", false)
@@ -251,9 +251,10 @@ func TestSnapshotSummaryIncrementalRunWithDeduplicatedChunks(t *testing.T) {
 // Under --cron the progress reporter is off; the upload figures must
 // still reach the summary and the snapshots row. The snapshot has two
 // paths, each backed up by its own scan.
-//
-//nolint:paralleltest // installs the global logger via log.Initialize
 func TestSnapshotSummaryCronRunRecordsUploads(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
 	env := newSummaryEnv(t)
 
 	summary := env.backUp(t, "split", true)

internal/vaultik/two_path_snapshot_test.go

@@ -18,10 +18,9 @@ import (
 // A backup without --cron runs the progress reporter while one scanner
 // scans each path of the snapshot in turn. See
 // https://git.eeqj.de/sneak/vaultik/issues/253.
-//
-//nolint:paralleltest // installs the global logger via log.Initialize
 func TestBackupWithoutCronOfTwoPathSnapshotRestoresBothPaths(t *testing.T) {
 	log.Initialize(log.Config{})
+	t.Parallel()
 
 	const snapshotName = "data"
 

script/fmt-check

@@ -1,6 +1,9 @@
 #!/bin/sh
-# script/fmt-check: check formatting (read-only). Same scope as
-# script/fmt, but fails instead of writing.
+# script/fmt-check: check formatting (read-only). Fails instead of
+# writing. It checks every Go file outside .tool, which is more than
+# script/fmt formats: `go fmt ./...` skips `testdata` directories and
+# files and directories whose names start with `.` or `_`. Fix a file
+# only this reports with `gofmt -w`.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"

script/release

@@ -21,10 +21,9 @@ goreleaser_version() {
         head -n 1
 }
 
-# Resolve the goreleaser to run, on the same rule script/lint uses for
-# golangci-lint: a binary on PATH is accepted only when it is exactly
-# the pinned version, because a differently versioned tool would
-# produce a differently built release from the same tag. Anything else
+# Resolve the goreleaser to run. A binary on PATH is accepted only when
+# it is exactly the pinned version, because a differently versioned tool
+# would produce a differently built release from the same tag. Anything else
 # comes from .tool/bin, and a missing one is a loud failure naming the
 # script that installs it rather than a silent fallback.
 resolve_goreleaser() {

test/config.yaml

@@ -19,7 +19,7 @@ s3:
   secret_access_key: test-secret-key
   region: us-east-1
   use_ssl: true
-  part_size: 5242880  # 5MB
+  part_size: 5242880  # 5MiB
 index_path: /tmp/vaultik-test.sqlite
 chunk_size: 10MB
 blob_size_limit: 10GB