Make config set create a list for an index under a missing key (closes #308)

`config set age_recipients.0 age1...` on a file without `age_recipients`
wrote a map keyed `0`, after which no command could load the config. A
missing key is now created as a list when the next path element is a
number.

`config set` checks its result with the config loader before writing and
refuses a failure the change brings in: a config that loaded must still
load, and one still being filled in (failing validation until complete)
must still decode into the config type. The new `config.Parse`, split out
of `config.Load`, decodes config data, filling in `${...}` references,
without validating.

Rule suppressed: gosec G304 where `config.Load` and the new tests read a
file.

Model: opus-5-5

ARCHITECTURE.md

@@ -311,8 +311,6 @@ Repository interfaces:
 
 ```
 CreateSnapshot(opts)
-    │
-    ├─► markDestination()   // Refuse a destination without the marker, then write it
     │
     ├─► PruneDatabase()   // Critical: avoid dedup errors
     │
@@ -369,8 +367,6 @@ CreateSnapshot(opts)
 
 ```
 bucket/
-├── vaultik-destination.txt          # Marker written by every backup
-│
 ├── blobs/
 │   └── {hash[0:2]}/
 │       └── {hash[2:4]}/
@@ -382,15 +378,6 @@ bucket/
         └── manifest.json.zst        # Blob list (for pruning/verification)
 ```
 
-While the local index holds snapshots, a destination without
-`vaultik-destination.txt` is treated as not present
-(`checkDestinationMarker` in `internal/vaultik/destination_marker.go`):
-`snapshot create` refuses to write to it, and listing it fails as for a
-destination that cannot be listed. An unplugged volume's empty mount point
-is therefore never taken for a destination whose snapshots are all gone.
-The `file://` backend never creates its destination directory, so a write
-to a missing one fails.
-
 The `{remote-key}` directory name is a one-way double SHA-256 hash of the human
 snapshot ID, so the human ID (hostname, snapshot name, timestamp) is never
 written to the store as a directory name. See

README.md

@@ -24,10 +24,6 @@ grep 'public key' vaultik_backup_private_key.txt
 vaultik config set age_recipients.0 age1YOUR_PUBLIC_KEY_HERE
 vaultik config set storage_url "file:///Volumes/usbstick/mybackup"
 
-# create the destination directory; vaultik never creates it, so a backup
-# to a volume that is not plugged in fails instead of filling the disk
-mkdir /Volumes/usbstick/mybackup
-
 # macOS only: grant your terminal app Full Disk Access first
 # (System Settings → Privacy & Security → Full Disk Access), otherwise
 # the backup will abort with a permission error on protected directories
@@ -275,8 +271,16 @@ existing file. Created with mode `0600` since it will contain credentials.
 **`config set`**: Set a scalar config value by dotted YAML path
 (e.g. `vaultik config set compression_level 9`,
 `vaultik config set storage_url "file:///mnt/backups"`). Comments and
-formatting in the file are preserved; intermediate maps are created as
-needed.
+formatting in the file are preserved. Missing keys along the path are
+created: as a list when the next path element is a number (so
+`vaultik config set age_recipients.0 age1...` works on a file without
+`age_recipients`), otherwise as a map. If the config loads, a change
+after which it would not, such as `vaultik config set compression_level 99`,
+is refused and the file is left unchanged. A config that does not load
+yet, such as the one `config init` writes before `storage_url` is set,
+can be filled in one setting at a time: only a change that gives a
+setting the wrong type, such as a single value where a list belongs or a
+word where a number belongs, is refused.
 
 **`snapshot create`**: Perform incremental backup of configured snapshots.
 * Optional snapshot names argument to create specific snapshots (default: all)
@@ -293,10 +297,6 @@ needed.
   this duration instead of only the latest (e.g. `4w`, `30d`, `6mo`, `1y`).
   Without `--prune`, or with a value that is not a valid duration, the
   command fails before the backup starts.
-* Fails before it writes anything when a `file://` destination directory
-  does not exist, or when the local index holds snapshots and the
-  destination has no `vaultik-destination.txt` (see
-  [remote storage layout](#remote-storage-layout))
 
 **`snapshot list`**: Show every snapshot known to this host — the union
 of the local index and the backup destination store — with timestamps
@@ -325,10 +325,7 @@ invocation that reconciles them.
 
 If the destination store cannot be listed (unmounted volume,
 permission denied, network down), the command warns, falls back to the
-local index alone, and still exits zero. It does the same when the
-local index holds snapshots and the destination has no
-`vaultik-destination.txt`, as when a volume mounted at the destination
-is unplugged and leaves its empty mount point behind.
+local index alone, and still exits zero.
 * `--json`: Output in JSON format. Each entry carries `locally_tracked`
   (whether the snapshot is in the local index), `remote_key` (the full
   64-character storage key), and `remote_present` (whether it was seen
@@ -366,13 +363,11 @@ prune` invocation to run as a follow-up. An ID that names no snapshot in
 the local index or on the destination store is an error; with
 `--local-only`, the snapshot must be in the local index. Local row
 cleanup (files, chunks, blobs the snapshot was the last referrer for)
-runs automatically. If the destination store is unreachable, or the
-local index holds snapshots and the destination has no
-`vaultik-destination.txt`, the local-DB removal still completes and a
-warning is emitted; run `vaultik snapshot remove <snapshot-id>` again
-once the store is reachable to remove the snapshot's metadata from it
-(`vaultik prune` does not). To wipe everything on the destination in one
-go, use `vaultik remote nuke --force`.
+runs automatically. If the destination store is unreachable, the local-DB
+removal still completes and a warning is emitted; run `vaultik snapshot
+remove <snapshot-id>` again once the store is reachable to remove the
+snapshot's metadata from it (`vaultik prune` does not). To wipe everything
+on the destination in one go, use `vaultik remote nuke --force`.
 * `--local-only`: Skip remote cleanup; only touch the local index
 * `--dry-run`: Show what would be deleted without deleting
 * `--force`: Skip confirmation prompt
@@ -399,10 +394,7 @@ manifest on the destination store to compute the still-referenced blob
 set and delete any blob not in that set. Step (3) reads all remote
 manifests — network cost scales with the number of snapshots. `snapshot
 create --prune` runs the same cleanup automatically; this is the
-manual entry point for the same work. If the destination store cannot
-be listed, or the local index holds snapshots and the destination has
-no `vaultik-destination.txt` (an unplugged volume's empty mount point),
-prune fails and deletes nothing. `snapshot purge` does the same.
+manual entry point for the same work.
 * `--force`: Skip confirmation prompt
 * `--json`: Output stats as JSON. Also skips the confirmation prompt, as
   `--force` does.
@@ -424,10 +416,10 @@ under `blobs/` whose name is not a blob hash is not counted as a blob,
 since `prune` never deletes it.
 * `--json`: Output as JSON
 
-**`remote nuke`**: Delete every snapshot's metadata, every blob and
-`vaultik-destination.txt` from the backup destination store, leaving the
-bucket prefix empty. Destructive and irreversible. This is the single
-supported way to wipe the entire destination store.
+**`remote nuke`**: Delete every snapshot's metadata and every blob from the
+backup destination store, leaving the bucket prefix empty. Destructive and
+irreversible. This is the single supported way to wipe the entire
+destination store.
 * `--force`: Required to confirm destruction.
 
 **`database delete`**: Delete the local SQLite state database file
@@ -452,12 +444,7 @@ object store. Credentials are read from `s3.access_key_id` and
 a local or mounted filesystem. Useful for testing or backing up to a NAS. The
 path must be absolute; a relative one is refused when the config loads.
 Percent-escapes in the path are decoded, so `my%20stick` and `my stick` name
-the same directory. The directory must exist before the first backup: vaultik
-never creates it. A directory on a removable volume is gone while the volume is
-not mounted, so a backup then fails instead of writing to the disk under the
-mount point. The mount point itself stays behind when the volume is unplugged:
-there only `vaultik-destination.txt` stops such a backup, and only while the
-local index holds snapshots.
+the same directory.
 
 **Rclone** (`rclone://remote/path`): Uses rclone's 70+ supported cloud
 providers. Requires rclone to be configured separately (`rclone config`).
@@ -488,7 +475,6 @@ For an implementation-level view of the internals — the data model, the
 
 ```
 <bucket>/<prefix>/
-├── vaultik-destination.txt     # Marker written by every backup
 ├── blobs/
 │   └── <aa>/<bb>/<full_blob_hash>
 └── metadata/
@@ -497,15 +483,6 @@ For an implementation-level view of the internals — the data model, the
         └── manifest.json.zst   # Unencrypted blob list (for pruning)
 ```
 
-* `vaultik-destination.txt` holds one fixed line of text, with no host
-  name, path or time. While the local index holds snapshots, a
-  destination without it is treated as not present: `snapshot create`
-  refuses to write to it, `prune` and `snapshot purge` fail, and
-  `snapshot list` and `snapshot remove` warn, as for a destination that
-  cannot be listed. This keeps an unplugged volume's empty mount point
-  from being taken for a destination whose snapshots are all gone. Mount
-  the volume if it is removable; if the destination was emptied on
-  purpose, run `vaultik database delete` and back up again.
 * Blobs are two-level directory sharded using the first 4 hex chars of the blob hash
 * `db.zst.age` is a binary SQLite database (zstd compressed, age encrypted)
   containing all file metadata, chunk mappings, and relationships for the snapshot

docs/REPOSTRUCTURE.md

@@ -4,7 +4,7 @@ This document describes the structure and organization of data stored in the S3
 
 ## Overview
 
-Vaultik stores all backup data in an S3-compatible object store. The repository consists of two main components, plus a marker file:
+Vaultik stores all backup data in an S3-compatible object store. The repository consists of two main components:
 1. **Blobs** - The actual backup data (content-addressed, encrypted)
 2. **Metadata** - Snapshot information and manifests (partially encrypted)
 
@@ -12,7 +12,6 @@ Vaultik stores all backup data in an S3-compatible object store. The repository
 
 ```
 <bucket>/<prefix>/
-├── vaultik-destination.txt
 ├── blobs/
 │   └── <hash[0:2]>/
 │       └── <hash[2:4]>/
@@ -25,10 +24,6 @@ Vaultik stores all backup data in an S3-compatible object store. The repository
 
 The metadata subdirectory is named with the **remote key**, a one-way hash of the snapshot ID, not with the human-readable snapshot ID itself. See [Remote Key Derivation](#remote-key-derivation).
 
-## Marker File (`vaultik-destination.txt`)
-
-Every backup writes this file at the root before it uploads anything. It holds one fixed line of plain text and names no host, path or time. While the local index holds snapshots, a destination without it is treated as not present: `snapshot create` refuses to write to it, and `prune`, `snapshot purge`, `snapshot remove` and `snapshot list` behave as for a destination that cannot be listed. An unplugged volume leaves an empty directory at its mount point, and without the marker that directory would read as a destination whose snapshots are all gone. `remote nuke` deletes the marker last.
-
 ## Blobs Directory (`blobs/`)
 
 ### Structure

internal/cli/config.go

@@ -44,6 +44,9 @@ var (
 	errNeedNumericIndex = errors.New("key is a list; use a numeric index")
 	errIndexOutOfRange  = errors.New("index out of range")
 	errNotMapOrList     = errors.New("key is not a map or list")
+	errWouldNotLoad     = errors.New(
+		"vaultik would not load the config after this change, " +
+			"so the file was not changed")
 )
 
 const defaultConfigTemplate = `# vaultik configuration
@@ -391,8 +394,15 @@ func newConfigSetCommand() *cobra.Command {
 		Use:   "set <key> <value>",
 		Short: "Set a config value by dotted path (e.g. compression_level 5)",
 		Long: `Sets a scalar config value addressed by dotted YAML path and writes
-the file back, preserving comments and formatting. Intermediate maps
-are created as needed.
+the file back, preserving comments and formatting. Missing keys along
+the path are created: as a list when the next path element is a
+number, otherwise as a map.
+
+If the config loads, a change after which it would not, such as
+compression_level 99, is refused and the file is left unchanged. A
+config that does not load yet, such as the one config init writes
+before storage_url is set, can be filled in one setting at a time:
+only a change that gives a setting the wrong type is refused.
 
 Examples:
   vaultik config set storage_url "file:///mnt/backups"
@@ -422,6 +432,11 @@ func writeConfigSet(out *ui.Writer, path, key, value string) error {
 		return err
 	}
 
+	oldData, err := marshalConfigYAML(root)
+	if err != nil {
+		return fmt.Errorf("marshaling config: %w", err)
+	}
+
 	err = yamlPathSet(root, strings.Split(key, "."), value)
 	if err != nil {
 		return err
@@ -432,6 +447,11 @@ func writeConfigSet(out *ui.Writer, path, key, value string) error {
 		return fmt.Errorf("marshaling config: %w", err)
 	}
 
+	err = checkConfigChange(oldData, data)
+	if err != nil {
+		return fmt.Errorf("%w: %w", errWouldNotLoad, err)
+	}
+
 	err = os.WriteFile(path, data, configFileMode)
 	if err != nil {
 		return fmt.Errorf("writing config file: %w", err)
@@ -453,6 +473,28 @@ func writeConfigSet(out *ui.Writer, path, key, value string) error {
 	return nil
 }
 
+// checkConfigChange returns the reason vaultik would not load newData, the
+// config after a change, if the change brings that failure in. If oldData,
+// the config before it, decodes into the config type, the new one must
+// too; if the old one also passes validation, the new one must pass it. A
+// config still being filled in fails validation until it is complete, so
+// only decoding is checked for it.
+func checkConfigChange(oldData, newData []byte) error {
+	oldCfg, oldErr := config.Parse(oldData)
+	if oldErr == nil {
+		newCfg, err := config.Parse(newData)
+		if err != nil {
+			return err
+		}
+
+		if oldCfg.Validate() == nil {
+			return newCfg.Validate()
+		}
+	}
+
+	return nil
+}
+
 // marshalConfigYAML renders a config document tree with 2-space indentation,
 // matching defaultConfigTemplate. yaml.Marshal defaults to 4 spaces, which
 // would reindent the whole file on the first `config set` despite the promise
@@ -559,8 +601,8 @@ func yamlPathGet(root *yaml.Node, keys []string) (*yaml.Node, error) {
 	return node, nil
 }
 
-// yamlPathSet navigates a dotted key path, creating intermediate maps as
-// needed, and sets the final key to the given scalar value. Numeric path
+// yamlPathSet navigates a dotted key path, creating missing keys as needed,
+// and sets the final key to the given scalar value. Numeric path
 // components index into sequences; an index equal to the sequence length
 // appends a new element (e.g. "age_recipients.1" on a 1-element list).
 func yamlPathSet(root *yaml.Node, keys []string, value string) error {
@@ -573,12 +615,12 @@ func yamlPathSet(root *yaml.Node, keys []string, value string) error {
 		node = node.Content[0]
 	}
 
-	for i, key := range keys {
+	for i := range keys {
 		last := i == len(keys)-1
 
 		switch node.Kind {
 		case yaml.MappingNode:
-			node = yamlSetInMapping(node, key, value, last)
+			node = yamlSetInMapping(node, keys, i, value, last)
 		case yaml.SequenceNode:
 			next, err := yamlSetInSequence(node, keys, i, value, last)
 			if err != nil {
@@ -647,14 +689,16 @@ func yamlField(typ reflect.Type, key string) (reflect.StructField, bool) {
 	return reflect.StructField{}, false
 }
 
-// yamlSetInMapping resolves (creating if needed) the value node for key
-// within a mapping node, setting it to value when it is the final path
-// element, and returns the node to descend into.
-func yamlSetInMapping(node *yaml.Node, key, value string, last bool) *yaml.Node {
+// yamlSetInMapping resolves (creating if needed) the value node for the
+// path element keys[i] within a mapping node, setting it to value when it
+// is the final path element, and returns the node to descend into.
+func yamlSetInMapping(
+	node *yaml.Node, keys []string, i int, value string, last bool,
+) *yaml.Node {
 	var valueNode *yaml.Node
 
 	for j := 0; j+1 < len(node.Content); j += 2 {
-		if node.Content[j].Value == key {
+		if node.Content[j].Value == keys[i] {
 			valueNode = node.Content[j+1]
 
 			break
@@ -662,13 +706,8 @@ func yamlSetInMapping(node *yaml.Node, key, value string, last bool) *yaml.Node
 	}
 
 	if valueNode == nil {
-		keyNode := &yaml.Node{Kind: yaml.ScalarNode, Value: key}
-
-		valueNode = &yaml.Node{Kind: yaml.MappingNode}
-		if last {
-			valueNode = &yaml.Node{Kind: yaml.ScalarNode, Value: value}
-		}
-
+		keyNode := &yaml.Node{Kind: yaml.ScalarNode, Value: keys[i]}
+		valueNode = newPathNode(keys, i, value)
 		node.Content = append(node.Content, keyNode, valueNode)
 	} else if last {
 		setScalar(valueNode, value)
@@ -696,12 +735,7 @@ func yamlSetInSequence(
 	}
 
 	if idx == len(node.Content) {
-		newNode := &yaml.Node{Kind: yaml.MappingNode}
-		if last {
-			newNode = &yaml.Node{Kind: yaml.ScalarNode, Value: value}
-		}
-
-		node.Content = append(node.Content, newNode)
+		node.Content = append(node.Content, newPathNode(keys, i, value))
 	} else if last {
 		setScalar(node.Content[idx], value)
 	}
@@ -709,6 +743,22 @@ func yamlSetInSequence(
 	return node.Content[idx], nil
 }
 
+// newPathNode returns the node to create for the missing path element
+// keys[i]: the value when it is the final path element, otherwise an empty
+// list when the next path element is a number and an empty map when not.
+func newPathNode(keys []string, i int, value string) *yaml.Node {
+	if i == len(keys)-1 {
+		return &yaml.Node{Kind: yaml.ScalarNode, Value: value}
+	}
+
+	_, err := strconv.Atoi(keys[i+1])
+	if err == nil {
+		return &yaml.Node{Kind: yaml.SequenceNode}
+	}
+
+	return &yaml.Node{Kind: yaml.MappingNode}
+}
+
 // setScalar overwrites a node in place with a plain scalar value.
 func setScalar(n *yaml.Node, value string) {
 	n.Kind = yaml.ScalarNode

internal/cli/config_test.go

@@ -58,14 +58,17 @@ func TestDefaultConfigTemplateParses(t *testing.T) {
 	}
 }
 
+// testRecipient is a valid age public key.
+const testRecipient = "age1278m9q7dp3chsh2dcy82qk27v047zywyvtxwnj4cvt0z65jw6a7q5dqhfj"
+
 // TestConfigSetRecipientOnFreshConfig follows the README quickstart: on the
 // file `config init` writes, `config set age_recipients.0` and
 // `config set storage_url` give a config that loads with that recipient.
+// Neither is refused, although the config does not load until both are set;
+// once it loads, a recipient that is not a valid key is.
 func TestConfigSetRecipientOnFreshConfig(t *testing.T) {
 	t.Parallel()
 
-	const recipient = "age1278m9q7dp3chsh2dcy82qk27v047zywyvtxwnj4cvt0z65jw6a7q5dqhfj"
-
 	path := filepath.Join(t.TempDir(), "config.yml")
 
 	err := os.WriteFile(path, []byte(defaultConfigTemplate), configFileMode)
@@ -75,7 +78,7 @@ func TestConfigSetRecipientOnFreshConfig(t *testing.T) {
 
 	out := ui.NewWithColor(&bytes.Buffer{}, false)
 
-	err = writeConfigSet(out, path, "age_recipients.0", recipient)
+	err = writeConfigSet(out, path, "age_recipients.0", testRecipient)
 	if err != nil {
 		t.Fatalf("config set age_recipients.0: %v", err)
 	}
@@ -90,8 +93,186 @@ func TestConfigSetRecipientOnFreshConfig(t *testing.T) {
 		t.Fatalf("config.Load: %v", err)
 	}
 
-	if len(cfg.AgeRecipients) != 1 || cfg.AgeRecipients[0] != recipient {
-		t.Errorf("age_recipients = %v, want [%s]", cfg.AgeRecipients, recipient)
+	if len(cfg.AgeRecipients) != 1 || cfg.AgeRecipients[0] != testRecipient {
+		t.Errorf("age_recipients = %v, want [%s]", cfg.AgeRecipients, testRecipient)
+	}
+
+	err = writeConfigSet(out, path, "age_recipients.0", "notakey")
+	if err == nil || !strings.Contains(err.Error(), "not a valid recipient") {
+		t.Errorf("config set age_recipients.0 notakey gives error %v, "+
+			"want one saying it is not a valid recipient", err)
+	}
+
+	_, err = config.Load(path)
+	if err != nil {
+		t.Errorf("config.Load after the refused change: %v", err)
+	}
+}
+
+// configWithoutRecipients loads, but has no age_recipients key and no
+// snapshot named work.
+const configWithoutRecipients = `storage_url: file:///mnt/backups
+snapshots:
+  home:
+    paths:
+      - "~"
+`
+
+// TestConfigSetIndexUnderMissingKey checks that a list index under a key
+// the file does not have creates a list, and that the result loads.
+func TestConfigSetIndexUnderMissingKey(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		key   string
+		value string
+		field func(cfg *config.Config) []string
+	}{
+		{"age_recipients.0", testRecipient,
+			func(cfg *config.Config) []string { return cfg.AgeRecipients }},
+		{"snapshots.work.paths.0", "/srv/work",
+			func(cfg *config.Config) []string { return cfg.Snapshots["work"].Paths }},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.key, func(t *testing.T) {
+			t.Parallel()
+
+			path := filepath.Join(t.TempDir(), "config.yml")
+
+			err := os.WriteFile(path, []byte(configWithoutRecipients), configFileMode)
+			if err != nil {
+				t.Fatalf("write config: %v", err)
+			}
+
+			err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
+				path, tt.key, tt.value)
+			if err != nil {
+				t.Fatalf("config set %s: %v", tt.key, err)
+			}
+
+			cfg, err := config.Load(path)
+			if err != nil {
+				t.Fatalf("config.Load: %v", err)
+			}
+
+			got := tt.field(cfg)
+			if len(got) != 1 || got[0] != tt.value {
+				t.Errorf("%s gives %v, want [%s]", tt.key, got, tt.value)
+			}
+		})
+	}
+}
+
+// TestConfigSetKeepsFileThatWouldNotLoad checks that config set refuses a
+// change after which the config would not load, with an error giving the
+// reason, and leaves the file as it was. On the file `config init` writes,
+// which does not load until storage_url is set, only a value of the wrong
+// type is refused.
+func TestConfigSetKeepsFileThatWouldNotLoad(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		config string
+		key    string
+		value  string
+		reason string
+	}{
+		// Index 1 of the empty list the missing key gives.
+		{configWithoutRecipients, "age_recipients.1", testRecipient,
+			"index out of range"},
+		// A list set to a single value.
+		{configWithoutRecipients, "snapshots.home.paths", "/srv",
+			"into []string"},
+		{configWithoutRecipients, "chunk_size", "fast",
+			"invalid size format"},
+		// Values of the right type that fail validation.
+		{configWithoutRecipients, "compression_level", "99",
+			"compression_level must be between 1 and 19"},
+		{configWithoutRecipients, "chunk_size", "1KB",
+			"chunk_size must be at least 1MB"},
+		// The type check on a config that does not load yet.
+		{defaultConfigTemplate, "snapshots.apps.paths", "/srv",
+			"into []string"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.key+" "+tt.value, func(t *testing.T) {
+			t.Parallel()
+
+			path := filepath.Join(t.TempDir(), "config.yml")
+
+			err := os.WriteFile(path, []byte(tt.config), configFileMode)
+			if err != nil {
+				t.Fatalf("write config: %v", err)
+			}
+
+			err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
+				path, tt.key, tt.value)
+			if err == nil || !strings.Contains(err.Error(), tt.reason) {
+				t.Errorf("config set %s %s gives error %v, want one saying %q",
+					tt.key, tt.value, err, tt.reason)
+			}
+
+			data, err := os.ReadFile(path) //nolint:gosec // G304: test-controlled path
+			if err != nil {
+				t.Fatalf("read config: %v", err)
+			}
+
+			if string(data) != tt.config {
+				t.Errorf("config set %s changed the file to:\n%s",
+					tt.key, data)
+			}
+		})
+	}
+}
+
+// TestConfigSetRefusesOnlyItsOwnFailure checks that setting another key
+// works on a config with a ${...} reference on compression_level, which
+// loads because loading fills the reference in, and on one whose
+// compression_level already fails to load.
+func TestConfigSetRefusesOnlyItsOwnFailure(t *testing.T) {
+	t.Parallel()
+
+	levelPath := filepath.Join(t.TempDir(), "level")
+
+	err := os.WriteFile(levelPath, []byte("9"), configFileMode)
+	if err != nil {
+		t.Fatalf("write level: %v", err)
+	}
+
+	configs := map[string]string{
+		"reference": configWithoutRecipients +
+			"compression_level: ${FILE:" + levelPath + "}\n",
+		"failing": configWithoutRecipients + "compression_level: fast\n",
+	}
+
+	for name, configYAML := range configs {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			path := filepath.Join(t.TempDir(), "config.yml")
+
+			err := os.WriteFile(path, []byte(configYAML), configFileMode)
+			if err != nil {
+				t.Fatalf("write config: %v", err)
+			}
+
+			err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
+				path, "hostname", "myhost")
+			if err != nil {
+				t.Fatalf("config set hostname: %v", err)
+			}
+
+			data, err := os.ReadFile(path) //nolint:gosec // G304: test-controlled path
+			if err != nil {
+				t.Fatalf("read config: %v", err)
+			}
+
+			if !strings.Contains(string(data), "hostname: myhost") {
+				t.Errorf("config set hostname wrote:\n%s", data)
+			}
+		})
 	}
 }
 

internal/cli/entry_prune_json_test.go

@@ -101,8 +101,7 @@ func TestEntryPruneJSONStdoutIsExactlyOneDocument(t *testing.T) {
 // writeHermeticPruneConfig builds a config over a temp directory with an
 // empty destination directory and, if seedStale is set, creates the
 // index database up front with one snapshot record that has no
-// counterpart on the destination store, and gives the destination the
-// marker a backup writes. Returns the config path.
+// counterpart on the destination store. Returns the config path.
 func writeHermeticPruneConfig(t *testing.T, seedStale bool) string {
 	t.Helper()
 
@@ -132,11 +131,6 @@ func writeHermeticPruneConfig(t *testing.T, seedStale bool) string {
 
 	if seedStale {
 		seedStaleSnapshotRecord(t, indexPath)
-
-		// While the local index holds a snapshot, prune fails on a
-		// destination without the marker a backup writes.
-		require.NoError(t, os.WriteFile(
-			filepath.Join(storeDir, "vaultik-destination.txt"), nil, 0o600))
 	}
 
 	return configPath

internal/config/config.go

@@ -4,6 +4,7 @@
 package config
 
 import (
+	"bytes"
 	"errors"
 	"fmt"
 	"os"
@@ -233,14 +234,48 @@ func New(path Path) (*Config, error) {
 	return cfg, nil
 }
 
-// Load reads and parses the configuration file from the specified path.
-// It applies default values for optional fields, performs environment variable
-// substitution using smartconfig, and validates the configuration.
-// The configuration file should be in YAML format. Returns an error if the file
-// cannot be read, parsed, or if validation fails.
+// Load reads the configuration file at path, parses it with Parse, warns
+// when others can read the file, and validates the configuration.
+// Returns an error if the file cannot be read, parsed, or if validation
+// fails.
 func Load(path string) (*Config, error) {
+	data, err := os.ReadFile(path) //nolint:gosec // G304: config path is operator-supplied
+	if err != nil {
+		return nil, fmt.Errorf("failed to load config file: %w", err)
+	}
+
+	cfg, err := Parse(data)
+	if err != nil {
+		return nil, err
+	}
+
+	// Check config file permissions (warn if world or group readable)
+	//nolint:gosec // G703: config path is operator-supplied by design
+	info, statErr := os.Stat(path)
+	if statErr == nil {
+		mode := info.Mode().Perm()
+		if mode&0044 != 0 { // group or world readable
+			log.Warn(cfg.readableByOthersWarning(),
+				"path", path,
+				"mode", fmt.Sprintf("%04o", mode),
+				"recommendation", "chmod 600 "+path)
+		}
+	}
+
+	err = cfg.Validate()
+	if err != nil {
+		return nil, fmt.Errorf("invalid config: %w", err)
+	}
+
+	return cfg, nil
+}
+
+// Parse reads YAML config data as Load does, without validating it. It
+// applies default values for optional fields, fills in ${...} references
+// using smartconfig, and expands ~ in paths.
+func Parse(data []byte) (*Config, error) {
 	// Load config using smartconfig for interpolation
-	sc, err := smartconfig.NewFromConfigPath(path)
+	sc, err := smartconfig.NewFromReader(bytes.NewReader(data))
 	if err != nil {
 		return nil, fmt.Errorf("failed to load config file: %w", err)
 	}
@@ -302,24 +337,6 @@ func Load(path string) (*Config, error) {
 		cfg.S3.Region = "us-east-1"
 	}
 
-	// Check config file permissions (warn if world or group readable)
-	//nolint:gosec // G703: config path is operator-supplied by design
-	info, statErr := os.Stat(path)
-	if statErr == nil {
-		mode := info.Mode().Perm()
-		if mode&0044 != 0 { // group or world readable
-			log.Warn(cfg.readableByOthersWarning(),
-				"path", path,
-				"mode", fmt.Sprintf("%04o", mode),
-				"recommendation", "chmod 600 "+path)
-		}
-	}
-
-	err = cfg.Validate()
-	if err != nil {
-		return nil, fmt.Errorf("invalid config: %w", err)
-	}
-
 	return cfg, nil
 }
 

internal/storage/file.go

@@ -21,13 +21,9 @@ type FileStorer struct {
 // NewFileStorer creates a new filesystem storage backend.
 //
 // Construction is intentionally cheap and does not touch the filesystem.
-// The backend never creates basePath: the user does, so that when
-// basePath is a directory on an unplugged volume, a write fails instead
-// of landing on the disk under the mount point. This does not hold when
-// basePath is the mount point itself, which stays behind when its volume
-// is unplugged.
-// Put and PutWithProgress fail on a missing basePath and create the
-// directories below it as needed.
+// The basePath is recorded; the directory is created lazily on first
+// write. Write operations (Put/PutWithProgress) call MkdirAll for the
+// per-blob parent directory, which also covers basePath on first use.
 // Get and Stat report a key under a missing basePath as ErrNotFound.
 // List and ListStream fail on a missing basePath, because listing it as
 // an empty store would make `prune` drop every local snapshot record.
@@ -301,19 +297,7 @@ func (f *FileStorer) writeAtomic(
 	path := f.fullPath(key)
 	dir := filepath.Dir(path)
 
-	// Checked on every write, so a destination that disappears part-way
-	// through a backup fails it rather than being recreated by MkdirAll.
-	_, err := f.fs.Stat(f.basePath)
-	if os.IsNotExist(err) {
-		return fmt.Errorf("destination directory does not exist; "+
-			"create it, or mount the volume it is on: %w", err)
-	}
-
-	if err != nil {
-		return fmt.Errorf("checking destination directory: %w", err)
-	}
-
-	err = f.fs.MkdirAll(dir, storageDirPerm)
+	err := f.fs.MkdirAll(dir, storageDirPerm)
 	if err != nil {
 		return fmt.Errorf("creating directories: %w", err)
 	}

internal/storage/file_backend_test.go

@@ -4,9 +4,7 @@ import (
 	"context"
 	"errors"
 	"io/fs"
-	"os"
 	"path/filepath"
-	"strings"
 	"testing"
 
 	"sneak.berlin/go/vaultik/internal/storage"
@@ -62,43 +60,3 @@ func TestFileStorerListMissingDestination(t *testing.T) {
 		t.Errorf("ListStream error = %v, want a not-exist error", streamErr)
 	}
 }
-
-// TestFileStorerPutMissingDestination checks that a write fails when the
-// destination directory has gone, even after earlier writes to it
-// succeeded, and that it does not create the directory again.
-func TestFileStorerPutMissingDestination(t *testing.T) {
-	t.Parallel()
-
-	ctx := context.Background()
-	base := filepath.Join(t.TempDir(), "usbstick")
-
-	err := os.Mkdir(base, 0o750)
-	if err != nil {
-		t.Fatalf("Mkdir: %v", err)
-	}
-
-	s, err := storage.NewFileStorer(base)
-	if err != nil {
-		t.Fatalf("NewFileStorer: %v", err)
-	}
-
-	err = s.Put(ctx, "blobs/aa/bb/first", strings.NewReader("first"))
-	if err != nil {
-		t.Fatalf("first Put: %v", err)
-	}
-
-	err = os.Rename(base, base+"-unplugged")
-	if err != nil {
-		t.Fatalf("Rename: %v", err)
-	}
-
-	err = s.Put(ctx, "blobs/aa/bb/second", strings.NewReader("second"))
-	if !errors.Is(err, fs.ErrNotExist) {
-		t.Errorf("Put = %v, want a not-exist error", err)
-	}
-
-	_, err = os.Stat(base)
-	if !errors.Is(err, fs.ErrNotExist) {
-		t.Errorf("Put created the destination directory again (Stat = %v)", err)
-	}
-}

internal/storage/storer.go

@@ -41,8 +41,7 @@ type Info struct {
 // directory for filesystem).
 type Storer interface {
 	// Put stores data at the specified key.
-	// The filesystem backend fails when its destination directory does
-	// not exist, and creates the directories below it as needed.
+	// Parent directories are created automatically for filesystem backends.
 	Put(ctx context.Context, key string, data io.Reader) error
 
 	// PutWithProgress stores data with progress reporting.

internal/vaultik/changed_file_restore_test.go

@@ -137,7 +137,7 @@ func TestBackupAfterRemovingNewestSnapshotRestoresChangedFile(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 	changedPath := filepath.Join(dataDir, "appended.bin")
@@ -184,7 +184,7 @@ func TestBackupAfterInterruptedRunRestoresChangedFile(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 	changedPath := filepath.Join(dataDir, "appended.bin")

internal/vaultik/deep_verify_test.go

@@ -30,7 +30,7 @@ func TestDeepVerifyAcceptsHealthyAndRejectsCorruptBlob(t *testing.T) {
 	tempDir := t.TempDir()
 
 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 
 	chunkSize := int64(64 * 1024)

internal/vaultik/destination_marker.go

@@ -1,74 +0,0 @@
-package vaultik
-
-import (
-	"errors"
-	"fmt"
-	"strings"
-
-	"sneak.berlin/go/vaultik/internal/storage"
-)
-
-// destinationMarkerKey is the object every backup writes at the root of
-// the backup destination store. While the local index holds a snapshot,
-// a destination without it is treated as not present: an unplugged
-// volume leaves an empty directory at its mount point, which would
-// otherwise read as a store whose snapshots are all gone.
-const destinationMarkerKey = "vaultik-destination.txt"
-
-// destinationMarkerText is the whole content of the marker. It names no
-// host, path or time.
-const destinationMarkerText = "This is a vaultik backup destination store.\n"
-
-// errDestinationNotPresent is returned when the local index holds a
-// snapshot and the backup destination store has no marker.
-var errDestinationNotPresent = errors.New("backup destination store is not present")
-
-// checkDestinationMarker returns errDestinationNotPresent when the local
-// index holds a snapshot and the backup destination store has no marker.
-// With no snapshot in the local index, as on a first backup or on
-// another machine, there is nothing to check.
-func (v *Vaultik) checkDestinationMarker() error {
-	ids, err := v.localSnapshotIDs()
-	if err != nil {
-		return fmt.Errorf("listing local snapshots: %w", err)
-	}
-
-	if len(ids) == 0 {
-		return nil
-	}
-
-	_, err = v.Storage.Stat(v.ctx, destinationMarkerKey)
-	if errors.Is(err, storage.ErrNotFound) {
-		return fmt.Errorf("%w: %s has no %s, but the local index holds "+
-			"snapshots stored there; mount the volume if it is removable, "+
-			"or if the destination was emptied on purpose, run "+
-			"'vaultik database delete' and back up again",
-			errDestinationNotPresent, v.Storage.Info().Location,
-			destinationMarkerKey)
-	}
-
-	if err != nil {
-		return fmt.Errorf("checking for %s: %w", destinationMarkerKey, err)
-	}
-
-	return nil
-}
-
-// markDestination checks the backup destination store with
-// checkDestinationMarker and then writes the marker, so a first backup
-// marks its destination and a later one writes the same text again.
-func (v *Vaultik) markDestination() error {
-	err := v.checkDestinationMarker()
-	if err != nil {
-		return err
-	}
-
-	err = v.Storage.Put(v.ctx, destinationMarkerKey,
-		strings.NewReader(destinationMarkerText))
-	if err != nil {
-		return fmt.Errorf("writing %s to the backup destination store: %w",
-			destinationMarkerKey, err)
-	}
-
-	return nil
-}

internal/vaultik/destination_marker_test.go

@@ -1,184 +0,0 @@
-package vaultik_test
-
-import (
-	"bytes"
-	"context"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/vaultik/internal/database"
-	"sneak.berlin/go/vaultik/internal/log"
-	"sneak.berlin/go/vaultik/internal/vaultik"
-)
-
-// These tests cover https://git.eeqj.de/sneak/vaultik/issues/239: a
-// file:// destination at a volume's mount point leaves an empty directory
-// behind when the volume is unplugged. While the local index holds
-// snapshots, a destination without vaultik-destination.txt is not present,
-// so no command may write to it or conclude from it that the local
-// snapshots are gone.
-
-// markerFile is the name of the file a backup writes at the root of the
-// destination.
-const markerFile = "vaultik-destination.txt"
-
-// backUpThenUnplugMountPoint backs up to a file:// destination, then
-// moves the destination directory away and leaves an empty directory in
-// its place, as unplugging a volume mounted there would. It returns the
-// path of that empty directory.
-func backUpThenUnplugMountPoint(
-	ctx context.Context, t *testing.T,
-) (*vaultik.Vaultik, *database.Repositories, *bytes.Buffer, string) {
-	t.Helper()
-
-	storeDir := filepath.Join(t.TempDir(), "mnt")
-	v, repos, out := backUpToFileDestination(ctx, t, storeDir)
-
-	require.NoError(t, os.Rename(storeDir, storeDir+"-unplugged"))
-	require.NoError(t, os.Mkdir(storeDir, 0o750))
-
-	return v, repos, out, storeDir
-}
-
-// assertUntouched checks that the local index still holds its one
-// snapshot and that nothing was written to the empty mount point.
-func assertUntouched(
-	ctx context.Context, t *testing.T,
-	repos *database.Repositories, storeDir string,
-) {
-	t.Helper()
-
-	snapshots, err := repos.Snapshots.ListRecent(ctx, listRecentTestLimit)
-	require.NoError(t, err)
-	assert.Len(t, snapshots, 1, "no local snapshot record may be deleted")
-
-	entries, err := os.ReadDir(storeDir)
-	require.NoError(t, err)
-	assert.Empty(t, entries, "nothing may be written to the empty mount point")
-}
-
-// TestFirstBackupWritesMarker checks that a backup writes the marker
-// file at the root of the destination.
-func TestFirstBackupWritesMarker(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	storeDir := t.TempDir()
-	backUpToFileDestination(context.Background(), t, storeDir)
-
-	assert.FileExists(t, filepath.Join(storeDir, markerFile))
-}
-
-// TestBackupRefusesDestinationWithoutMarker checks that snapshot create
-// --prune writes nothing and drops no local snapshot record when the
-// destination has no marker.
-func TestBackupRefusesDestinationWithoutMarker(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	v, repos, _, storeDir := backUpThenUnplugMountPoint(ctx, t)
-
-	err := v.CreateSnapshot(&vaultik.SnapshotCreateOptions{
-		Cron:  true,
-		Prune: true,
-	})
-	require.ErrorContains(t, err, markerFile)
-
-	assertUntouched(ctx, t, repos, storeDir)
-}
-
-// TestPruneRefusesDestinationWithoutMarker checks that prune fails and
-// deletes no local snapshot record when the destination has no marker.
-func TestPruneRefusesDestinationWithoutMarker(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	v, repos, _, storeDir := backUpThenUnplugMountPoint(ctx, t)
-
-	err := v.Prune(&vaultik.PruneOptions{Force: true})
-	require.ErrorContains(t, err, markerFile)
-
-	assertUntouched(ctx, t, repos, storeDir)
-}
-
-// TestPurgeRefusesDestinationWithoutMarker checks that snapshot purge
-// fails and deletes no local snapshot record when the destination has no
-// marker.
-func TestPurgeRefusesDestinationWithoutMarker(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	v, repos, _, storeDir := backUpThenUnplugMountPoint(ctx, t)
-
-	err := v.PurgeSnapshotsWithOptions(&vaultik.SnapshotPurgeOptions{
-		KeepLatest: true,
-		Force:      true,
-	})
-	require.ErrorContains(t, err, markerFile)
-
-	assertUntouched(ctx, t, repos, storeDir)
-}
-
-// TestRemoveSnapshotWarnsWhenDestinationHasNoMarker checks that snapshot
-// remove warns that the metadata could not be removed from a destination
-// without a marker, instead of reporting that it was.
-func TestRemoveSnapshotWarnsWhenDestinationHasNoMarker(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	v, repos, out, _ := backUpThenUnplugMountPoint(ctx, t)
-
-	result, err := v.RemoveSnapshot(localSnapshotID(ctx, t, repos, "first"),
-		&vaultik.RemoveOptions{Force: true})
-	require.NoError(t, err)
-
-	assert.False(t, result.RemoteRemoved)
-	assert.Contains(t, out.String(),
-		"Could not remove snapshot metadata from remote")
-	assert.Contains(t, out.String(), markerFile)
-	assert.NotContains(t, out.String(),
-		"Removed snapshot metadata from remote storage")
-}
-
-// TestListSnapshotsWarnsWhenDestinationHasNoMarker checks that snapshot
-// list warns and shows the local index alone when the destination has no
-// marker, without reporting the local snapshot as missing from it.
-func TestListSnapshotsWarnsWhenDestinationHasNoMarker(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	v, repos, out, _ := backUpThenUnplugMountPoint(ctx, t)
-	id := localSnapshotID(ctx, t, repos, "first")
-
-	require.NoError(t, v.ListSnapshots(false))
-
-	assert.Contains(t, out.String(), "Could not list backup destination store")
-	assert.Contains(t, out.String(), markerFile)
-	assert.Contains(t, out.String(), id)
-	assert.NotContains(t, out.String(), "not found in backup destination store")
-}
-
-// TestBackupAfterNukeRemoteSucceeds checks that remote nuke leaves the
-// destination ready for a new first backup, which writes the marker
-// again.
-func TestBackupAfterNukeRemoteSucceeds(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	storeDir := t.TempDir()
-	v, _, _ := backUpToFileDestination(context.Background(), t, storeDir)
-
-	require.NoError(t, v.NukeRemote(true))
-	assert.NoFileExists(t, filepath.Join(storeDir, markerFile))
-
-	require.NoError(t, backUp(v, "second"))
-	assert.FileExists(t, filepath.Join(storeDir, markerFile))
-}

internal/vaultik/fault_injection_test.go

@@ -192,7 +192,7 @@ func assertRestoreRejectsDamagedBlob(
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 
@@ -238,7 +238,7 @@ func TestDeepVerifyCatchesLyingBackend(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 
 	ctx := context.Background()
@@ -290,7 +290,7 @@ func TestInterruptedBlobUploadRecordsNoUploadedBlob(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 
 	ctx := context.Background()
@@ -298,6 +298,10 @@ func TestInterruptedBlobUploadRecordsNoUploadedBlob(t *testing.T) {
 
 	writeFaultSourceTree(t, fs, dataDir)
 
+	// No upload succeeds, so nothing creates the destination directory.
+	// It must exist for the listing below to show that no blob survived.
+	require.NoError(t, os.Mkdir(storeDir, 0o750))
+
 	inner, err := storage.NewFileStorer(storeDir)
 	require.NoError(t, err)
 
@@ -361,7 +365,7 @@ func TestBackupRetryAfterInterruptedUploadIsRestorable(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 
@@ -425,7 +429,7 @@ func TestBackupSurvivesMetadataExportInterruption(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 
 	ctx := context.Background()
@@ -507,7 +511,7 @@ func TestBackupCompletesOnlyAfterMetadataExport(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 
@@ -682,7 +686,7 @@ func TestRestoreReportsDiskFull(t *testing.T) {
 	osFS := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 

internal/vaultik/integration_test.go

@@ -771,7 +771,7 @@ func TestEndToEndFileStorage(t *testing.T) {
 	tempDir := t.TempDir()
 
 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 
@@ -964,7 +964,7 @@ func TestDedupOnlySnapshotRestores(t *testing.T) {
 	tempDir := t.TempDir()
 
 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 

internal/vaultik/missing_destination_test.go

@@ -24,11 +24,13 @@ import (
 // that is not plugged in, cannot be listed. It is not an empty store, so
 // no command may conclude from it that the local snapshots are gone.
 
-// newFileDestinationVaultik returns a Vaultik that backs up the
-// snapshot named "first" to a file:// destination at storeDir.
-func newFileDestinationVaultik(
+// backUpToFileDestination backs up the snapshot named "first" to a
+// file:// destination at storeDir, which need not exist yet. Everything
+// the returned Vaultik prints after the backup goes to the returned
+// buffer.
+func backUpToFileDestination(
 	ctx context.Context, t *testing.T, storeDir string,
-) (*vaultik.Vaultik, *database.Repositories) {
+) (*vaultik.Vaultik, *database.Repositories, *bytes.Buffer) {
 	t.Helper()
 
 	osFs := afero.NewOsFs()
@@ -47,22 +49,8 @@ func newFileDestinationVaultik(
 
 	repos := database.NewRepositories(db)
 	cfg := changedFileConfig(dataDir, dbPath)
+	v := newBackupVaultik(ctx, cfg, store, repos, db, osFs)
 
-	return newBackupVaultik(ctx, cfg, store, repos, db, osFs), repos
-}
-
-// backUpToFileDestination creates the directory storeDir, as a user must
-// before the first backup, and backs up the snapshot named "first" to a
-// file:// destination there. Everything the returned Vaultik prints
-// after the backup goes to the returned buffer.
-func backUpToFileDestination(
-	ctx context.Context, t *testing.T, storeDir string,
-) (*vaultik.Vaultik, *database.Repositories, *bytes.Buffer) {
-	t.Helper()
-
-	require.NoError(t, os.MkdirAll(storeDir, 0o750))
-
-	v, repos := newFileDestinationVaultik(ctx, t, storeDir)
 	require.NoError(t, backUp(v, "first"))
 
 	out := &bytes.Buffer{}
@@ -87,28 +75,21 @@ func backUpThenUnplug(
 	return v, repos, out
 }
 
-// TestBackupFailsWhenDestinationDirectoryMissing checks that a backup to
-// a file:// destination whose directory does not exist fails before it
-// records a snapshot, and does not create the directory.
-func TestBackupFailsWhenDestinationDirectoryMissing(t *testing.T) {
+// TestFirstBackupCreatesDestinationDirectory checks that a first backup
+// to a destination directory that does not exist yet creates it, and
+// that the destination can be listed afterwards.
+func TestFirstBackupCreatesDestinationDirectory(t *testing.T) {
 	log.Initialize(log.Config{})
 	t.Parallel()
 
 	ctx := context.Background()
-	volume := filepath.Join(t.TempDir(), "volume")
-	v, repos := newFileDestinationVaultik(ctx, t, filepath.Join(volume, "backup"))
+	storeDir := filepath.Join(t.TempDir(), "volume", "backup")
+	v, _, out := backUpToFileDestination(ctx, t, storeDir)
 
-	err := backUp(v, "first")
-	require.ErrorIs(t, err, fs.ErrNotExist)
-	require.ErrorContains(t, err, "create it, or mount the volume it is on")
+	require.NoError(t, v.ListSnapshots(false))
 
-	_, err = os.Stat(volume)
-	require.ErrorIs(t, err, fs.ErrNotExist,
-		"the backup must not create the destination directory")
-
-	snapshots, err := repos.Snapshots.ListRecent(ctx, listRecentTestLimit)
-	require.NoError(t, err)
-	assert.Empty(t, snapshots)
+	assert.NotContains(t, out.String(), "Could not list backup destination store")
+	assert.NotContains(t, out.String(), "not found in backup destination store")
 }
 
 // TestListSnapshotsWarnsWhenDestinationMissing checks that snapshot list

internal/vaultik/prune.go

@@ -29,9 +29,8 @@ const blobKeyParts = 4
 
 // NukeRemote deletes every snapshot's metadata and every blob from remote
 // storage, along with any object an upload cut off part-way left under a
-// temporary `.partial` name, and the destination marker. After this
-// returns successfully the bucket prefix is empty and the next backup
-// starts from scratch.
+// temporary `.partial` name. After this returns successfully the bucket
+// prefix is empty and the next backup starts from scratch.
 //
 // Refuses to run unless force is true. The caller is responsible for
 // confirming with the user.
@@ -63,13 +62,6 @@ func (v *Vaultik) NukeRemote(force bool) error {
 		}
 	}
 
-	// Last, once the local snapshot records are gone: the next backup
-	// then has none and writes the marker again.
-	err = v.Storage.Delete(v.ctx, destinationMarkerKey)
-	if err != nil {
-		return fmt.Errorf("deleting %s: %w", destinationMarkerKey, err)
-	}
-
 	v.UI.Completef("Backup destination store is now empty.")
 
 	return nil

internal/vaultik/purge_local_remote_consistency_test.go

@@ -34,9 +34,6 @@ func setupConsistencyTest(
 	repos := database.NewRepositories(db)
 	mockStorage := NewMockStorer()
 
-	// A backup wrote to this destination, so it carries the marker.
-	require.NoError(t, mockStorage.Put(ctx, markerFile, strings.NewReader("")))
-
 	for _, id := range snapshotIDs {
 		parts := strings.Split(id, "_")
 		startedAt, err := time.Parse(time.RFC3339, parts[len(parts)-1])

internal/vaultik/purge_per_name_test.go

@@ -44,9 +44,6 @@ func setupPurgeTest(
 	repos := database.NewRepositories(db)
 	mockStorage := NewMockStorer()
 
-	// A backup wrote to this destination, so it carries the marker.
-	require.NoError(t, mockStorage.Put(ctx, markerFile, strings.NewReader("")))
-
 	// Insert each snapshot into the DB and create remote metadata stubs.
 	// Use timestamps parsed from snapshot IDs for realistic ordering.
 	for _, id := range snapshotIDs {

internal/vaultik/remove_snapshot_test.go

@@ -303,10 +303,6 @@ func TestRemoveSnapshot_DefaultRemovesMetadataNotBlobs(t *testing.T) {
 	addBlob(t, store, blobUnique)
 	addBlob(t, store, blobShared)
 
-	// A backup wrote to this destination, so it carries the marker.
-	require.NoError(t, store.Put(context.Background(), markerFile,
-		bytes.NewReader(nil)))
-
 	tv := vaultik.NewForTesting(store)
 	tv.Repositories = newLocalIndex(t, "snapshot-001", "snapshot-002")
 
@@ -396,12 +392,7 @@ func TestRemoveSnapshot_NoMetadataOnDestination(t *testing.T) {
 	log.Initialize(log.Config{})
 	t.Parallel()
 
-	// A backup wrote to this destination, so it carries the marker.
-	store := newTestStorer()
-	require.NoError(t, store.Put(context.Background(), markerFile,
-		bytes.NewReader(nil)))
-
-	tv := vaultik.NewForTesting(store)
+	tv := vaultik.NewForTesting(newTestStorer())
 	tv.Repositories = newLocalIndex(t, "snapshot-001")
 
 	result, err := tv.RemoveSnapshot("snapshot-001",

internal/vaultik/restore_another_machine_test.go

@@ -42,7 +42,7 @@ func TestRestoreOnAnotherMachine(t *testing.T) {
 	tempDir := t.TempDir()
 
 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 

internal/vaultik/restore_interrupt_test.go

@@ -65,7 +65,7 @@ func TestRestoreCleansTempDirOnInterrupt(t *testing.T) {
 	root := t.TempDir()
 
 	dataDir := filepath.Join(root, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(root, "remote")
 	restoreDir := filepath.Join(root, "restored")
 	dbPath := filepath.Join(root, "index.sqlite")
 

internal/vaultik/restore_locality_test.go

@@ -197,7 +197,7 @@ func TestRestoreLocalityAndReadAt(t *testing.T) {
 	tempDir := t.TempDir()
 
 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 

internal/vaultik/restore_perms_test.go

@@ -107,7 +107,7 @@ func backupOneFile(
 	require.NoError(t, afero.WriteFile(fs, srcPath, content, mode))
 	require.NoError(t, fs.Chmod(srcPath, mode))
 
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 
 	storer, err := storage.NewFileStorer(storeDir)

internal/vaultik/restore_skip_errors_test.go

@@ -219,7 +219,7 @@ func backupSingleChunkFiles(
 		require.NoError(t, afero.WriteFile(fs, path, files[path], 0o644))
 	}
 
-	storer, err := storage.NewFileStorer(t.TempDir())
+	storer, err := storage.NewFileStorer(filepath.Join(tempDir, "remote"))
 	require.NoError(t, err)
 
 	db, err := database.New(ctx, dbPath)

internal/vaultik/restore_snapshot_identity_test.go

@@ -29,7 +29,7 @@ func TestRestoreAndDeepVerifyRejectSwappedDatabase(t *testing.T) {
 
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 
 	chunkSize := int64(64 * 1024)
 
@@ -100,7 +100,7 @@ func TestDeepVerifyRejectsSwappedDatabaseWithEmptyManifest(t *testing.T) {
 
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 
 	chunkSize := int64(64 * 1024)
 

internal/vaultik/restore_sweeper_integration_test.go

@@ -186,7 +186,7 @@ func TestRestoreSweeperEvictsBlobs(t *testing.T) {
 	tempDir := t.TempDir()
 
 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 

internal/vaultik/restore_truncated_db_test.go

@@ -33,7 +33,7 @@ func TestRestoreRejectsTruncatedMetadataDB(t *testing.T) {
 	tempDir := t.TempDir()
 
 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 

internal/vaultik/same_second_rewrite_test.go

@@ -25,7 +25,7 @@ func TestBackupOfSameSecondRewriteRestoresNewContent(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 	rewrittenPath := filepath.Join(dataDir, "small.txt")

internal/vaultik/shallow_verify_test.go

@@ -31,7 +31,7 @@ func TestShallowVerifyDetectsWrongBlobSize(t *testing.T) {
 	tempDir := t.TempDir()
 
 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 
 	chunkSize := int64(32 * 1024)
@@ -105,7 +105,7 @@ func TestShallowVerifyDetectsMissingDatabase(t *testing.T) {
 	tempDir := t.TempDir()
 
 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 
 	chunkSize := int64(32 * 1024)

internal/vaultik/snapshot.go

@@ -92,13 +92,6 @@ func (v *Vaultik) CreateSnapshot(opts *SnapshotCreateOptions) error {
 		return err
 	}
 
-	// Before PruneDatabase: it drops incomplete snapshots, which could
-	// leave the local index without one and so skip the marker check.
-	err = v.markDestination()
-	if err != nil {
-		return err
-	}
-
 	// Clean up incomplete snapshots FIRST, before any scanning.
 	// This is critical for data safety; PruneDatabase below does it.
 	hostname := v.Config.Hostname
@@ -121,9 +114,21 @@ func (v *Vaultik) CreateSnapshot(opts *SnapshotCreateOptions) error {
 		return fmt.Errorf("prune database: %w", err)
 	}
 
-	snapshotNames, err := v.snapshotNamesToCreate(opts.Snapshots)
-	if err != nil {
-		return err
+	// Determine which snapshots to process
+	snapshotNames := opts.Snapshots
+	if len(snapshotNames) == 0 {
+		snapshotNames = v.Config.SnapshotNames()
+	} else {
+		// Validate requested snapshot names exist
+		for _, name := range snapshotNames {
+			if _, ok := v.Config.Snapshots[name]; !ok {
+				return fmt.Errorf("%w: %q", errSnapshotNotInConfig, name)
+			}
+		}
+	}
+
+	if len(snapshotNames) == 0 {
+		return errNoSnapshotsInConfig
 	}
 
 	// Process each named snapshot
@@ -163,28 +168,6 @@ func (v *Vaultik) CreateSnapshot(opts *SnapshotCreateOptions) error {
 	return nil
 }
 
-// snapshotNamesToCreate returns the requested snapshot names, each checked
-// against the config, or every configured name when none was requested.
-func (v *Vaultik) snapshotNamesToCreate(requested []string) ([]string, error) {
-	snapshotNames := requested
-	if len(snapshotNames) == 0 {
-		snapshotNames = v.Config.SnapshotNames()
-	} else {
-		// Validate requested snapshot names exist
-		for _, name := range snapshotNames {
-			if _, ok := v.Config.Snapshots[name]; !ok {
-				return nil, fmt.Errorf("%w: %q", errSnapshotNotInConfig, name)
-			}
-		}
-	}
-
-	if len(snapshotNames) == 0 {
-		return nil, errNoSnapshotsInConfig
-	}
-
-	return snapshotNames, nil
-}
-
 // runPostBackupPrune drops older snapshots of the given names and removes
 // orphan blobs from remote storage. If keepNewerThan is set (e.g. "4w"),
 // snapshots newer than that duration are kept. Otherwise only the latest
@@ -1209,18 +1192,10 @@ func (v *Vaultik) RemoveSnapshot(
 		return v.removeSnapshotDryRun(result, snapshotID, opts)
 	}
 
-	if !v.confirmRemoveSnapshot(snapshotID, opts) {
+	if !opts.Force && !opts.JSON && !v.confirmRemoveSnapshot(snapshotID, opts) {
 		return result, nil
 	}
 
-	// Checked before the local record is deleted: it may be the last
-	// snapshot in the local index, and the check applies only while the
-	// local index holds one.
-	var markerErr error
-	if !opts.LocalOnly {
-		markerErr = v.checkDestinationMarker()
-	}
-
 	if inLocalIndex {
 		log.Info("Removing snapshot from local database", "snapshot_id", snapshotID)
 
@@ -1231,7 +1206,7 @@ func (v *Vaultik) RemoveSnapshot(
 	}
 
 	if !opts.LocalOnly {
-		result.RemoteRemoved = v.removeSnapshotRemote(snapshotID, markerErr, opts)
+		result.RemoteRemoved = v.removeSnapshotRemote(snapshotID, opts)
 	}
 
 	if v.SnapshotManager != nil {
@@ -1323,13 +1298,9 @@ func (v *Vaultik) removeSnapshotDryRun(
 }
 
 // confirmRemoveSnapshot prompts for confirmation before removing a
-// snapshot, unless --force or --json is set. Returns false (treating
-// EOF/read errors as "no") unless the user answers "y".
+// snapshot. Returns false (treating EOF/read errors as "no") unless the
+// user answers "y".
 func (v *Vaultik) confirmRemoveSnapshot(snapshotID string, opts *RemoveOptions) bool {
-	if opts.Force || opts.JSON {
-		return true
-	}
-
 	if opts.LocalOnly {
 		v.stdoutf("Remove snapshot '%s' from local database "+
 			"(remote untouched)? [y/N] ", snapshotID)
@@ -1361,24 +1332,15 @@ func (v *Vaultik) confirmRemoveSnapshot(snapshotID string, opts *RemoveOptions)
 // removal has already happened, so the user is told the remote half
 // didn't finish and to run `vaultik snapshot remove` for the snapshot
 // again once the destination store is reachable (`vaultik prune` never
-// removes snapshot metadata). markerErr is the result of
-// checkDestinationMarker; when it is set, nothing is deleted and it is
-// the failure reported. Returns true when the remote removal succeeded
-// and deleted something.
-func (v *Vaultik) removeSnapshotRemote(
-	snapshotID string, markerErr error, opts *RemoveOptions,
-) bool {
+// removes snapshot metadata). Returns true when the remote removal
+// succeeded and deleted something.
+func (v *Vaultik) removeSnapshotRemote(snapshotID string, opts *RemoveOptions) bool {
 	log.Info("Removing snapshot metadata from remote storage",
 		"snapshot_id", snapshotID)
 
-	var deleted int
-
-	err := markerErr
-	if err == nil {
-		deleted, err = v.deleteRemoteSnapshotByKey(
-			snapshot.RemoteSnapshotKey(snapshotID))
-	}
+	remoteKey := snapshot.RemoteSnapshotKey(snapshotID)
 
+	deleted, err := v.deleteRemoteSnapshotByKey(remoteKey)
 	if err != nil {
 		log.Warn("Could not remove snapshot metadata from remote storage; "+
 			"run '"+snapshotRemoveCommandHint+"' with the snapshot's ID "+
@@ -1482,8 +1444,8 @@ func (v *Vaultik) localSnapshotIDs() ([]string, error) {
 // listAllRemoteSnapshotKeys collects the hashed remote keys
 // (subdirectories under metadata/) currently present in the
 // destination store. Returns (nil, err) when the store cannot be
-// listed, or is not present by checkDestinationMarker; callers must
-// treat that as "no remote info available," not fatal.
+// listed; callers must treat that as "no remote info available," not
+// fatal.
 func (v *Vaultik) listAllRemoteSnapshotKeys() ([]string, error) {
 	log.Info("Listing all remote snapshots")
 
@@ -1532,11 +1494,6 @@ func (v *Vaultik) listAllRemoteSnapshotKeys() ([]string, error) {
 		}
 	}
 
-	err := v.checkDestinationMarker()
-	if err != nil {
-		return nil, err
-	}
-
 	return keys, nil
 }
 

internal/vaultik/snapshot_failed_file_test.go

@@ -87,7 +87,7 @@ func TestSnapshotSummaryCountsFileNotStoredAsFailed(t *testing.T) {
 				"src": {Paths: []string{srcDir}},
 			}
 
-			store, err := storage.NewFileStorer(t.TempDir())
+			store, err := storage.NewFileStorer(filepath.Join(tempDir, "remote"))
 			require.NoError(t, err)
 
 			db, err := database.New(ctx, cfg.IndexPath)

internal/vaultik/snapshot_list_test.go

@@ -122,9 +122,6 @@ func newListEnv(t *testing.T) *listEnv {
 	store := newObservingStorer()
 	stdout := &bytes.Buffer{}
 
-	// A backup wrote to this destination, so it carries the marker.
-	require.NoError(t, store.Put(ctx, markerFile, strings.NewReader("")))
-
 	v := &vaultik.Vaultik{
 		Config: &config.Config{
 			AgeSecretKey: "",

internal/vaultik/snapshot_skip_errors_test.go

@@ -45,7 +45,7 @@ func TestSkipErrorsBackupStopsOnIndexErrorRecordingDirectory(t *testing.T) {
 		"tree": {Paths: []string{srcDir}},
 	}
 
-	store, err := storage.NewFileStorer(t.TempDir())
+	store, err := storage.NewFileStorer(filepath.Join(tempDir, "remote"))
 	require.NoError(t, err)
 
 	db, err := database.New(ctx, cfg.IndexPath)

internal/vaultik/snapshot_summary_test.go

@@ -84,7 +84,7 @@ func newSummaryEnv(t *testing.T) *summaryEnv {
 		"split":  {Paths: []string{dirOne, dirTwo}},
 	}
 
-	inner, err := storage.NewFileStorer(t.TempDir())
+	inner, err := storage.NewFileStorer(filepath.Join(tempDir, "remote"))
 	require.NoError(t, err)
 
 	store := faultstore.New(inner)

internal/vaultik/two_path_snapshot_test.go

@@ -28,7 +28,7 @@ func TestBackupWithoutCronOfTwoPathSnapshotRestoresBothPaths(t *testing.T) {
 	tempDir := t.TempDir()
 	firstDir := filepath.Join(tempDir, "first")
 	secondDir := filepath.Join(tempDir, "second")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 

internal/vaultik/verify_quiet_test.go

@@ -28,7 +28,7 @@ func TestVerify_QuietSuppressesReport(t *testing.T) {
 	tempDir := t.TempDir()
 
 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 
 	chunkSize := int64(32 * 1024)