Read the snapshot name using the stored hostname (closes #230)

A snapshot ID is hostname_name_timestamp, and purge took the name to be
everything between the first and the last underscore. With a hostname
such as my_host the name home came out as host_home, so
`snapshot purge --keep-latest --snapshot home` found nothing to delete
and `snapshot create --prune` purged nothing without a message. The name
is now read by removing the hostname stored with the snapshot, in the
short form the ID uses, so both may contain underscores. This was chosen
over rejecting underscores in `hostname` when the config loads, which
would also stop restores on such a host.

The purge consistency test stored a hostname that did not match its
snapshot IDs; it now matches, as it always does in production.

Model: opus-5-5

README.md

@@ -390,7 +390,13 @@ recipients, and local database statistics.
 
 **`remote info`**: Show storage backend type and location plus detailed
 remote storage inventory: per-snapshot metadata sizes, blob counts, and
-orphaned blob detection.
+orphaned blob detection. A name under `metadata/` that is not a remote
+key is skipped with a warning and is not printed. If a listed
+`manifest.json.zst` cannot be read, or sits under a skipped name, the
+orphaned blob figures are reported as unknown; `--json` gives them as
+`null`, lists the remote key of each unreadable manifest in
+`unreadable_manifests` and counts the manifests under skipped names in
+`skipped_manifest_count`.
 * `--json`: Output as JSON
 
 **`remote nuke`**: Delete every snapshot's metadata and every blob from the

TODO.md

@@ -26,11 +26,28 @@ the tag exists and is exercised; what is left is merging `next` to
   ([issue #230](https://git.eeqj.de/sneak/vaultik/issues/230)). A
   snapshot ID is `hostname_name_timestamp`, and the name was read as
   everything between the first and the last `_`, so with
-  `hostname: my_host` the name `home` came out as `host_home` and
+  `hostname: my_host` the name `home` came out as `host_home`.
-  `snapshot create --prune` and `snapshot purge --snapshot home` purged
+  `snapshot purge --keep-latest --snapshot home` then printed "No
-  nothing, without a message. The name is now read using the hostname
+  snapshots to delete", and `snapshot create --prune` purged nothing
-  the `snapshots` table stores with each snapshot, cut at its first `.`
+  without a message. The name is now read using the hostname the
-  as it is in the ID.
+  `snapshots` table stores with each snapshot, cut at its first `.` as it
+  is in the ID.
+
+- 2026-10-07: Made `remote info` stop reporting a snapshot's blobs as
+  orphaned when its manifest cannot be read, and stop printing raw
+  names from under `metadata/`
+  ([issue #228](https://git.eeqj.de/sneak/vaultik/issues/228)). A
+  manifest it failed to read was skipped, so that snapshot's blobs were
+  counted as orphaned and the report advised running `vaultik prune`.
+  The orphan figures are now unknown in that case, with no prune
+  advice, and `--json` gives them as `null` with the unreadable remote
+  keys in `unreadable_manifests`. A name under `metadata/` that is not
+  64 lowercase hex characters is now skipped with a warning instead of
+  being printed, control characters included. A manifest under a
+  skipped name is then not read either, so it also leaves the orphan
+  figures unknown, and `--json` counts such manifests in
+  `skipped_manifest_count`. A directory with no manifest in it, as left
+  by an interrupted backup, leaves the figures known.
 
 - 2026-10-07: Made `config set` keep a string that looks like a number
   ([issue #229](https://git.eeqj.de/sneak/vaultik/issues/229)). It wrote

internal/vaultik/info.go

@@ -183,6 +183,11 @@ type SnapshotMetadataInfo struct {
 	TotalSize    int64  `json:"total_size"`
 	BlobCount    int    `json:"blob_count"`
 	BlobsSize    int64  `json:"blobs_size"`
+
+	// Set when the listing holds this snapshot's manifest.json.zst. A
+	// backup interrupted before its manifest upload leaves a directory
+	// without one, which prune does not treat as a snapshot.
+	hasManifest bool
 }
 
 // RemoteInfoResult contains all remote storage information
@@ -206,9 +211,20 @@ type RemoteInfoResult struct {
 	ReferencedBlobCount int   `json:"referenced_blob_count"`
 	ReferencedBlobSize  int64 `json:"referenced_blob_size"`
 
-	// Orphaned blobs
+	// Orphaned blobs. Both stay nil (null in the JSON) when a manifest
-	OrphanedBlobCount int   `json:"orphaned_blob_count"`
+	// was listed but not read, since that snapshot's blobs would be
-	OrphanedBlobSize  int64 `json:"orphaned_blob_size"`
+	// counted as orphaned.
+	OrphanedBlobCount *int   `json:"orphaned_blob_count"`
+	OrphanedBlobSize  *int64 `json:"orphaned_blob_size"`
+
+	// Remote key of each snapshot whose manifest could not be read
+	UnreadableManifests []string `json:"unreadable_manifests,omitempty"`
+
+	// Number of manifests not read because the name above them under
+	// metadata/ is not a remote key. The names themselves are not
+	// reported: they come from the destination store and may hold
+	// control characters.
+	SkippedManifestCount int `json:"skipped_manifest_count,omitempty"`
 }
 
 // RemoteInfo displays information about remote storage
@@ -234,16 +250,28 @@ func (v *Vaultik) RemoteInfo(jsonOutput bool) error {
 		v.stdoutf("Scanning snapshot metadata...\n")
 	}
 
-	snapshotMetadata, snapshotIDs, err := v.collectSnapshotMetadata()
+	snapshotMetadata, snapshotIDs, skippedManifestCount, err := v.collectSnapshotMetadata()
 	if err != nil {
 		return err
 	}
 
+	result.SkippedManifestCount = skippedManifestCount
+
 	if showText {
-		v.stdoutf("Downloading %d manifest(s)...\n", len(snapshotIDs))
+		manifestCount := 0
+
+		for _, info := range snapshotMetadata {
+			if info.hasManifest {
+				manifestCount++
+			}
 		}
 
-	referencedBlobs := v.collectReferencedBlobsFromManifests(snapshotIDs, snapshotMetadata)
+		v.stdoutf("Downloading %d manifest(s)...\n", manifestCount)
+	}
+
+	referencedBlobs, unreadableManifests := v.collectReferencedBlobsFromManifests(
+		snapshotIDs, snapshotMetadata)
+	result.UnreadableManifests = unreadableManifests
 
 	v.populateRemoteInfoResult(result, snapshotMetadata, snapshotIDs, referencedBlobs)
 
@@ -256,7 +284,7 @@ func (v *Vaultik) RemoteInfo(jsonOutput bool) error {
 		"snapshots", result.TotalMetadataCount,
 		"total_blobs", result.TotalBlobCount,
 		"referenced_blobs", result.ReferencedBlobCount,
-		"orphaned_blobs", result.OrphanedBlobCount)
+		"unreadable_manifests", len(result.UnreadableManifests))
 
 	if jsonOutput {
 		enc := json.NewEncoder(v.Stdout)
@@ -273,16 +301,18 @@ func (v *Vaultik) RemoteInfo(jsonOutput bool) error {
 }
 
 // collectSnapshotMetadata scans remote metadata and returns
-// per-snapshot info and sorted IDs.
+// per-snapshot info, sorted IDs and the number of manifests it skipped
+// because the name above them is not a remote key.
 func (v *Vaultik) collectSnapshotMetadata() (
-	map[string]*SnapshotMetadataInfo, []string, error,
+	map[string]*SnapshotMetadataInfo, []string, int, error,
 ) {
 	snapshotMetadata := make(map[string]*SnapshotMetadataInfo)
+	skippedManifestCount := 0
 
 	metadataCh := v.Storage.ListStream(v.ctx, "metadata/")
 	for obj := range metadataCh {
 		if obj.Err != nil {
-			return nil, nil, fmt.Errorf("listing metadata: %w", obj.Err)
+			return nil, nil, 0, fmt.Errorf("listing metadata: %w", obj.Err)
 		}
 
 		parts := strings.Split(obj.Key, "/")
@@ -291,6 +321,22 @@ func (v *Vaultik) collectSnapshotMetadata() (
 		}
 
 		snapshotID := parts[1]
+		filename := parts[2]
+		isManifest := filename == "manifest.json.zst"
+
+		// The name comes from the destination store, which is not
+		// trusted, and is printed in the report. Accept it only in the
+		// form of a remote key.
+		if !isBlobHash(snapshotID) {
+			log.Warn("Skipping non-conforming key under metadata/",
+				"key", obj.Key)
+
+			if isManifest {
+				skippedManifestCount++
+			}
+
+			continue
+		}
 
 		if _, exists := snapshotMetadata[snapshotID]; !exists {
 			snapshotMetadata[snapshotID] = &SnapshotMetadataInfo{SnapshotID: snapshotID}
@@ -298,7 +344,10 @@ func (v *Vaultik) collectSnapshotMetadata() (
 
 		info := snapshotMetadata[snapshotID]
 
-		filename := parts[2]
+		if isManifest {
+			info.hasManifest = true
+		}
+
 		if strings.HasPrefix(filename, "manifest") {
 			info.ManifestSize = obj.Size
 		} else if strings.HasPrefix(filename, "db") {
@@ -315,17 +364,25 @@ func (v *Vaultik) collectSnapshotMetadata() (
 
 	sort.Strings(snapshotIDs)
 
-	return snapshotMetadata, snapshotIDs, nil
+	return snapshotMetadata, snapshotIDs, skippedManifestCount, nil
 }
 
-// collectReferencedBlobsFromManifests downloads manifests and returns
+// collectReferencedBlobsFromManifests downloads the listed manifests
-// referenced blob hashes with sizes.
+// and returns referenced blob hashes with sizes, and the remote keys
+// of the manifests it could not read.
 func (v *Vaultik) collectReferencedBlobsFromManifests(
 	snapshotIDs []string, snapshotMetadata map[string]*SnapshotMetadataInfo,
-) map[string]int64 {
+) (map[string]int64, []string) {
 	referencedBlobs := make(map[string]int64)
 
+	var unreadable []string
+
 	for _, snapshotID := range snapshotIDs {
+		info := snapshotMetadata[snapshotID]
+		if !info.hasManifest {
+			continue
+		}
+
 		// snapshotIDs here are remote keys, taken straight from the
 		// metadata/ listing. downloadManifestByKey is the single reader
 		// for remote manifests; see its doc comment.
@@ -333,10 +390,11 @@ func (v *Vaultik) collectReferencedBlobsFromManifests(
 		if err != nil {
 			log.Warn("Failed to read manifest", "snapshot", snapshotID, "error", err)
 
+			unreadable = append(unreadable, snapshotID)
+
 			continue
 		}
 
-		info := snapshotMetadata[snapshotID]
 		info.BlobCount = manifest.BlobCount
 
 		var blobsSize int64
@@ -349,7 +407,7 @@ func (v *Vaultik) collectReferencedBlobsFromManifests(
 		info.BlobsSize = blobsSize
 	}
 
-	return referencedBlobs
+	return referencedBlobs, unreadable
 }
 
 // populateRemoteInfoResult fills in the result's snapshot and
@@ -378,8 +436,9 @@ func (v *Vaultik) populateRemoteInfoResult(
 }
 
 // scanRemoteBlobStorage lists all blobs on remote and computes orphan
-// stats. showText is true only when the human report is being printed
+// stats when every listed manifest was read. showText is true only
-// (not --json, not --quiet), gating the progress line.
+// when the human report is being printed (not --json, not --quiet),
+// gating the progress line.
 func (v *Vaultik) scanRemoteBlobStorage(
 	result *RemoteInfoResult, referencedBlobs map[string]int64, showText bool,
 ) error {
@@ -406,13 +465,28 @@ func (v *Vaultik) scanRemoteBlobStorage(
 		result.TotalBlobSize += obj.Size
 	}
 
+	// A blob named only by a manifest that could not be read, or by one
+	// under a skipped name, would be counted as orphaned, so the orphan
+	// figures stay unknown.
+	if len(result.UnreadableManifests) > 0 || result.SkippedManifestCount > 0 {
+		return nil
+	}
+
+	var (
+		orphanedCount int
+		orphanedSize  int64
+	)
+
 	for hash, size := range allBlobs {
 		if _, referenced := referencedBlobs[hash]; !referenced {
-			result.OrphanedBlobCount++
+			orphanedCount++
-			result.OrphanedBlobSize += size
+			orphanedSize += size
 		}
 	}
 
+	result.OrphanedBlobCount = &orphanedCount
+	result.OrphanedBlobSize = &orphanedSize
+
 	return nil
 }
 
@@ -465,11 +539,21 @@ func (v *Vaultik) printRemoteInfoTable(result *RemoteInfoResult) {
 	v.stdoutf("Referenced by snapshots:    %s (%s)\n",
 		humanize.Comma(int64(result.ReferencedBlobCount)),
 		ubytes(result.ReferencedBlobSize))
-	v.stdoutf("Orphaned (unreferenced):    %s (%s)\n",
-		humanize.Comma(int64(result.OrphanedBlobCount)),
-		ubytes(result.OrphanedBlobSize))
 
-	if result.OrphanedBlobCount > 0 {
+	if result.OrphanedBlobCount == nil {
+		v.stdoutf("Orphaned (unreferenced):    unknown "+
+			"(%d manifest(s) could not be read, "+
+			"%d manifest(s) under a non-conforming name skipped)\n",
+			len(result.UnreadableManifests), result.SkippedManifestCount)
+
+		return
+	}
+
+	v.stdoutf("Orphaned (unreferenced):    %s (%s)\n",
+		humanize.Comma(int64(*result.OrphanedBlobCount)),
+		ubytes(*result.OrphanedBlobSize))
+
+	if *result.OrphanedBlobCount > 0 {
 		v.stdoutf("\nRun 'vaultik prune' to remove orphaned blobs.\n")
 	}
 }

internal/vaultik/remote_info_test.go

@@ -0,0 +1,159 @@
+package vaultik_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/vaultik/internal/log"
+	"sneak.berlin/go/vaultik/internal/snapshot"
+)
+
+// testBlobHashB is a blob that the manifest written by addRemote does
+// not reference.
+const testBlobHashB = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" +
+	"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+
+// TestRemoteInfo_UnreadableManifestLeavesOrphansUnknown checks that a
+// manifest remote info cannot read makes the orphan figures unknown. A
+// blob referenced only by that snapshot would otherwise be counted as
+// orphaned, and the report would advise running prune.
+func TestRemoteInfo_UnreadableManifestLeavesOrphansUnknown(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	env := newListEnv(t)
+
+	// The readable manifest references blob A only.
+	env.addRemote(t, listRemoteID, time.Date(2026, 3, 2, 0, 0, 0, 0, time.UTC))
+	addBlob(t, env.store.testStorer, testBlobHashA)
+	addBlob(t, env.store.testStorer, testBlobHashB)
+
+	// With every manifest readable, blob B is orphaned.
+	require.NoError(t, env.v.RemoteInfo(true))
+
+	var doc map[string]any
+
+	require.NoError(t, json.Unmarshal(env.stdout.Bytes(), &doc))
+	assert.InDelta(t, 1, doc["orphaned_blob_count"], 0)
+
+	// A second snapshot whose manifest cannot be decoded. Blob B may be
+	// one of its blobs.
+	unreadableKey := snapshot.RemoteSnapshotKey(listLocalID)
+	require.NoError(t, env.store.Put(context.Background(),
+		"metadata/"+unreadableKey+"/manifest.json.zst",
+		bytes.NewReader([]byte("not a valid manifest"))))
+
+	env.stdout.Reset()
+	require.NoError(t, env.v.RemoteInfo(false))
+
+	text := env.stdout.String()
+	assert.Contains(t, text, "Orphaned (unreferenced):    unknown "+
+		"(1 manifest(s) could not be read, "+
+		"0 manifest(s) under a non-conforming name skipped)")
+	assert.NotContains(t, text, "vaultik prune")
+
+	env.stdout.Reset()
+	require.NoError(t, env.v.RemoteInfo(true))
+
+	doc = nil
+	require.NoError(t, json.Unmarshal(env.stdout.Bytes(), &doc))
+	assert.Contains(t, doc, "orphaned_blob_count")
+	assert.Nil(t, doc["orphaned_blob_count"])
+	assert.Contains(t, doc, "orphaned_blob_size")
+	assert.Nil(t, doc["orphaned_blob_size"])
+	assert.Equal(t, []any{unreadableKey}, doc["unreadable_manifests"])
+}
+
+// TestRemoteInfo_SkipsNonConformingMetadataName checks that a directory
+// under metadata/ whose name is not a remote key is left out of the
+// report, and that the orphan figures are unknown when it holds a
+// manifest. The name comes from the destination store; printed raw, its
+// control characters would reach the terminal. Its manifest is not
+// read, so a blob only it references would otherwise be counted as
+// orphaned.
+func TestRemoteInfo_SkipsNonConformingMetadataName(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	env := newListEnv(t)
+	env.addRemote(t, listRemoteID, time.Date(2026, 3, 2, 0, 0, 0, 0, time.UTC))
+	addBlob(t, env.store.testStorer, testBlobHashA)
+	addBlob(t, env.store.testStorer, testBlobHashB)
+	require.NoError(t, env.store.Put(context.Background(),
+		"metadata/\x1b[31mred/manifest.json.zst",
+		bytes.NewReader([]byte("not a valid manifest"))))
+
+	require.NoError(t, env.v.RemoteInfo(false))
+
+	text := env.stdout.String()
+	assert.NotContains(t, text, "\x1b")
+	assert.NotContains(t, text, "31mred")
+	assert.Contains(t, text, "Total (1 snapshots)")
+	assert.Contains(t, text, "Orphaned (unreferenced):    unknown "+
+		"(0 manifest(s) could not be read, "+
+		"1 manifest(s) under a non-conforming name skipped)")
+	assert.NotContains(t, text, "vaultik prune")
+
+	env.stdout.Reset()
+	require.NoError(t, env.v.RemoteInfo(true))
+
+	out := env.stdout.String()
+	assert.NotContains(t, out, "31mred")
+
+	var doc map[string]any
+
+	require.NoError(t, json.Unmarshal([]byte(out), &doc))
+	assert.Contains(t, doc, "orphaned_blob_count")
+	assert.Nil(t, doc["orphaned_blob_count"])
+	assert.Contains(t, doc, "orphaned_blob_size")
+	assert.Nil(t, doc["orphaned_blob_size"])
+	assert.InDelta(t, 1, doc["skipped_manifest_count"], 0)
+	assert.NotContains(t, doc, "unreadable_manifests")
+}
+
+// TestRemoteInfo_DirectoryWithoutManifestLeavesOrphansKnown checks that
+// a directory under metadata/ holding no manifest.json.zst, such as one
+// left by a backup interrupted before its manifest upload, leaves the
+// orphan figures known. prune does not treat such a directory as a
+// snapshot and deletes the blobs the report lists as orphaned.
+func TestRemoteInfo_DirectoryWithoutManifestLeavesOrphansKnown(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	env := newListEnv(t)
+	env.addRemote(t, listRemoteID, time.Date(2026, 3, 2, 0, 0, 0, 0, time.UTC))
+	addBlob(t, env.store.testStorer, testBlobHashA)
+	addBlob(t, env.store.testStorer, testBlobHashB)
+
+	// One directory under a remote key and one under a non-conforming
+	// name, each holding only a database.
+	names := []string{snapshot.RemoteSnapshotKey(listLocalID), "\x1b[31mred"}
+	for _, name := range names {
+		require.NoError(t, env.store.Put(context.Background(),
+			"metadata/"+name+"/db.zst.age",
+			bytes.NewReader([]byte("not a valid database"))))
+	}
+
+	require.NoError(t, env.v.RemoteInfo(false))
+
+	text := env.stdout.String()
+	assert.NotContains(t, text, "\x1b")
+	assert.Contains(t, text, "Downloading 1 manifest(s)...")
+	assert.Contains(t, text, "Orphaned (unreferenced):    1 (")
+	assert.Contains(t, text, "Run 'vaultik prune' to remove orphaned blobs.")
+
+	env.stdout.Reset()
+	require.NoError(t, env.v.RemoteInfo(true))
+
+	var doc map[string]any
+
+	require.NoError(t, json.Unmarshal(env.stdout.Bytes(), &doc))
+	assert.InDelta(t, 1, doc["orphaned_blob_count"], 0)
+	assert.NotContains(t, doc, "unreadable_manifests")
+	assert.NotContains(t, doc, "skipped_manifest_count")
+}