Go on with a backup when the destination marker cannot be checked (closes #389)

A source host whose credentials allow only PUT, which the documents
say is enough to back up, failed every backup after its first: the
marker check looks the marker up with an S3 HEAD, which those
credentials are refused, and any error other than not found was
fatal.

Such an error now means the check could not be made: it is logged at
info level, so --cron stays silent, and the command goes on. Not found
still stops it. The documents now say so, and that such a host does
not notice an emptied destination, so vaultik database delete must be
run on it after the destination is emptied. The fault-injecting test
store gains a Stat hook for the test.

Model: opus-5-5

ARCHITECTURE.md

@@ -312,7 +312,7 @@ Repository interfaces:
 ```
 CreateSnapshot(opts)
     │
-    ├─► markDestination()   // Check the marker (see Storage Layout in S3), then write it
+    ├─► markDestination()   // Refuse a destination without the marker, then write it
     │
     ├─► PruneDatabase()   // Critical: avoid dedup errors
     │
@@ -389,10 +389,9 @@ there (`checkDestinationMarker` in `internal/vaultik/destination_marker.go`):
 `remote nuke` fail, and `snapshot list` and `snapshot remove` behave as for a
 destination that cannot be listed. This keeps those commands from taking an
 unplugged volume's empty mount point for a destination whose snapshots are
-all gone. When the look-up fails for any reason other than not found, for
+all gone. A destination that refuses the look-up, as S3 does to credentials
-example when S3 refuses it to credentials that allow only PUT, the check is
+that allow only PUT, is not checked, so such a host does not notice an
-skipped, so a host with such credentials does not notice an emptied
+emptied destination; see
-destination; see
 [docs/REPOSTRUCTURE.md](docs/REPOSTRUCTURE.md#marker-file-vaultik-destinationtxt).
 The `file://` backend never creates its destination directory, so a write to a
 missing one fails.

README.md

@@ -332,9 +332,9 @@ value where a list belongs or a word where a number belongs), is refused.
   command fails before the backup starts.
 * Fails before it writes anything when a `file://` destination directory
   does not exist, or when the local index holds snapshots and the
-  destination answers that it has no `vaultik-destination.txt`. When that
+  destination answers that it has no `vaultik-destination.txt`. A
-  look-up fails for any reason other than not found, for example when S3
+  destination that refuses that look-up, as S3 does to credentials that
-  refuses it to credentials that allow only PUT, the check is skipped (see
+  allow only PUT, is not checked (see
   [remote storage layout](#remote-storage-layout))
 
 **`snapshot list`**: Show every snapshot known to this host — the union
@@ -370,9 +370,9 @@ gives: revert the configuration, or run `vaultik database delete`.
 If the destination store cannot be listed (unmounted volume,
 permission denied, network down), the command warns, falls back to the
 local index alone, and still exits zero. It does the same when the
-destination answers that it has no `vaultik-destination.txt` while the
+destination has no `vaultik-destination.txt` while the local index
-local index holds snapshots stored there, as when a volume mounted at
+holds snapshots stored there, as when a volume mounted at the
-the destination is unplugged and leaves its empty mount point behind.
+destination is unplugged and leaves its empty mount point behind.
 * `--json`: Output in JSON format. Each entry carries `locally_tracked`
   (whether the snapshot is in the local index), `remote_key` (the full
   64-character storage key), and `remote_present` (whether it was seen
@@ -415,8 +415,8 @@ with `--local-only`, the snapshot must be in the local index. Local row
 cleanup (files, chunks, blobs the snapshot was the last referrer for)
 runs automatically. If removing the snapshot's metadata from the
 destination store fails (for example because the store is unreachable,
-or the local index holds snapshots and the destination answers that it
+or the local index holds snapshots and the destination has no
-has no `vaultik-destination.txt`), the local-DB removal still completes and a
+`vaultik-destination.txt`), the local-DB removal still completes and a
 warning is emitted; run `vaultik snapshot remove <snapshot-id>` again
 once the store is reachable to remove the snapshot's metadata from it
 (`vaultik prune` does not). For a snapshot that is only on the
@@ -459,9 +459,9 @@ be deleted. Step (3) reads all remote manifests — network cost scales with
 the number of snapshots.
 `snapshot create --prune` runs the same cleanup automatically; this is the
 manual entry point for the same work. If the destination store cannot
-be listed, or the local index holds snapshots and the destination answers
+be listed, or the local index holds snapshots and the destination has
-that it has no `vaultik-destination.txt` (an unplugged volume's empty mount
+no `vaultik-destination.txt` (an unplugged volume's empty mount point),
-point), prune fails and deletes nothing. `snapshot purge` does the same. If a
+prune fails and deletes nothing. `snapshot purge` does the same. If a
 blob cannot be deleted, the command (and `snapshot create --prune`)
 exits non-zero.
 * `--force`: Skip confirmation prompt
@@ -496,8 +496,8 @@ and irreversible. This is the single supported way to wipe the entire
 destination store. A snapshot is removed from the local index only once
 its metadata is deleted from the destination store. If the destination
 store cannot be listed, or the local index holds snapshots and the
-destination answers that it has no `vaultik-destination.txt` (an unplugged
+destination has no `vaultik-destination.txt` (an unplugged volume's
-volume's empty mount point), the command fails before it removes anything. If a
+empty mount point), the command fails before it removes anything. If a
 listing afterwards still finds anything under `metadata/` or `blobs/`,
 the command names each object left and exits non-zero; running it again
 deletes what is left.
@@ -588,13 +588,13 @@ For an implementation-level view of the internals — the data model, the
   taken for a destination whose snapshots are all gone. Mount
   the volume if it is removable; if the destination was emptied on
   purpose, run `vaultik database delete` and back up again.
-  When the look-up fails for any reason other than not found, the check
+  When the store refuses the look-up, the check is skipped and the
-  is skipped and the command goes on. S3 refuses it on every run to
+  command goes on. S3 refuses it on every run to credentials that
-  credentials that allow only PUT, so a host with such credentials does
+  allow only PUT, so a host with such credentials does not notice a
-  not notice a destination emptied since its last backup, and its next
+  destination emptied since its last backup, and its next backup would
-  backup would leave out the data its local index records as already
+  leave out the data its local index records as already stored. After
-  stored. After the destination is emptied, run
+  the destination is emptied, run `vaultik database delete` on such a
-  `vaultik database delete` on such a host before it backs up again.
+  host before it backs up again.
 * Blobs are two-level directory sharded using the first 4 hex chars of the blob hash
 * `db.zst.age` is a binary SQLite database (zstd compressed, age encrypted)
   containing all file metadata, chunk mappings, and relationships for the snapshot

docs/REPOSTRUCTURE.md

@@ -29,7 +29,7 @@ The metadata subdirectory is named with the **remote key**, a one-way hash of th
 
 Every backup writes this file at the root before it uploads anything. It holds one fixed line of plain text and names no host, path or time. While the local index holds snapshots stored there, a destination that answers a look-up of the marker with not found is treated as not present: `snapshot create` refuses to write to it, and `prune`, `snapshot purge`, `snapshot remove`, `snapshot list` and `remote nuke` behave as for a destination that cannot be listed. An unplugged volume leaves an empty directory at its mount point, and without the marker that directory would read as a destination whose snapshots are all gone. `remote nuke` deletes the marker last.
 
-When the look-up of the marker fails for any reason other than not found, the check is skipped and the command goes on. S3 refuses it on every run to credentials that allow only PUT, so a host with such credentials does not notice a destination emptied since its last backup, and its next backup would leave out the data its local index records as already stored. After the destination is emptied, run `vaultik database delete` on such a host before it backs up again.
+When the store refuses the look-up of the marker, the check is skipped and the command goes on. S3 refuses it on every run to credentials that allow only PUT, so a host with such credentials does not notice a destination emptied since its last backup, and its next backup would leave out the data its local index records as already stored. After the destination is emptied, run `vaultik database delete` on such a host before it backs up again.
 
 ## Blobs Directory (`blobs/`)
 

internal/cli/entry_prune_json_test.go

@@ -134,7 +134,7 @@ func writeHermeticPruneConfig(t *testing.T, seedStale bool) string {
 		seedStaleSnapshotRecord(t, indexPath)
 
 		// While the local index holds a snapshot, prune fails on a
-		// destination that answers that it has no marker.
+		// destination without the marker a backup writes.
 		require.NoError(t, os.WriteFile(
 			filepath.Join(storeDir, "vaultik-destination.txt"), nil, 0o600))
 	}

internal/cli/entry_snapshot_purge_test.go

@@ -42,7 +42,7 @@ func TestEntrySnapshotPurgeKeepsMetadataWhenLocalIndexDeleteFails(t *testing.T)
 	seedStaleSnapshotRecord(t, indexPath)
 
 	// While the local index holds a snapshot, purge fails on a
-	// destination that answers that it has no marker.
+	// destination without the marker a backup writes.
 	require.NoError(t, os.WriteFile(
 		filepath.Join(dir, "store", "vaultik-destination.txt"), nil, 0o600))
 

internal/vaultik/destination_marker.go

@@ -28,10 +28,10 @@ var errDestinationNotPresent = errors.New("backup destination store is not prese
 
 // checkDestinationMarker returns errDestinationNotPresent when the local
 // index holds a snapshot stored on the backup destination store and the
-// store answers that it has no marker. With no snapshot in the local
+// store has no marker. With no snapshot in the local index, as on a
-// index, as on a first backup or on another machine, there is nothing to
+// first backup or on another machine, there is nothing to check; nor
-// check; nor when the local index is bound to a different destination
+// when the local index is bound to a different destination than the
-// than the configured one, since its snapshots are stored there.
+// configured one, since its snapshots are stored there.
 //
 // A look-up of the marker that fails for any other reason than not
 // found is logged and otherwise ignored, because the check could not be

internal/vaultik/destination_marker_test.go

@@ -20,9 +20,9 @@ import (
 // These tests cover https://git.eeqj.de/sneak/vaultik/issues/239: a
 // file:// destination at a volume's mount point leaves an empty directory
 // behind when the volume is unplugged. While the local index holds
-// snapshots, a destination that answers that it has no
+// snapshots, a destination without vaultik-destination.txt is not present,
-// vaultik-destination.txt is not present, so no command may write to it
+// so no command may write to it or conclude from it that the local
-// or conclude from it that the local snapshots are gone.
+// snapshots are gone.
 
 // markerFile is the name of the file a backup writes at the root of the
 // destination.