Exit non-zero when snapshot create --skip-errors skips anything it cannot read (closes #310 )

A backup under --skip-errors printed its skip errors and failed count, then "Finished successfully.", and exited 0, so a cron wrapper could not tell it from a complete backup. A directory the walk could not list was not counted at all. Each entry the walk skips is now counted as examined and failed. When --skip-errors skipped anything it could not read or list, the run keeps its snapshots, runs the post-backup prune as before, and then returns an error the command reports as "Backup completed, but N file(s) could not be read". A file removed during the run is still counted as failed in the summary but leaves the exit status at 0, with or without the flag. Model: opus-5-5
2026-10-14 03:21:31 +00:00
46 changed files with 290 additions and 743 deletions
@@ -311,8 +311,6 @@ Repository interfaces:

 ```
 CreateSnapshot(opts)
-    │
-    ├─► markDestination()   // Refuse a destination without the marker, then write it
    │
    ├─► PruneDatabase()   // Critical: avoid dedup errors
    │
@@ -369,8 +367,6 @@ CreateSnapshot(opts)

 ```
 bucket/
-├── vaultik-destination.txt          # Marker written by every backup
-│
 ├── blobs/
 │   └── {hash[0:2]}/
 │       └── {hash[2:4]}/
@@ -382,15 +378,6 @@ bucket/
        └── manifest.json.zst        # Blob list (for pruning/verification)
 ```

-A destination without `vaultik-destination.txt` is treated as not present
-while the local index holds snapshots stored there (`checkDestinationMarker`
-in `internal/vaultik/destination_marker.go`): `snapshot create` refuses to
-write to it, `prune` and `snapshot purge` fail, and `snapshot list` and
-`snapshot remove` behave as for a destination that cannot be listed. This
-keeps those commands from taking an unplugged volume's empty mount point for
-a destination whose snapshots are all gone. The `file://` backend never
-creates its destination directory, so a write to a missing one fails.
-
 The `{remote-key}` directory name is a one-way double SHA-256 hash of the human
 snapshot ID, so the human ID (hostname, snapshot name, timestamp) is never
 written to the store as a directory name. See
@@ -24,10 +24,6 @@ grep 'public key' vaultik_backup_private_key.txt
 vaultik config set age_recipients.0 age1YOUR_PUBLIC_KEY_HERE
 vaultik config set storage_url "file:///Volumes/usbstick/mybackup"

-# create the destination directory; vaultik never creates it, so a backup
-# to a volume that is not plugged in fails instead of filling the disk
-mkdir /Volumes/usbstick/mybackup
-
 # macOS only: grant your terminal app Full Disk Access first
 # (System Settings → Privacy & Security → Full Disk Access), otherwise
 # the backup will abort with a permission error on protected directories
@@ -182,7 +178,7 @@ vaultik version
 * `--verbose`, `-v`: Enable verbose output (on stderr — see below)
 * `--debug`: Enable debug output (on stderr — see below)
 * `--quiet`, `-q`: Suppress non-error output (also suppresses startup banner)
-* `--skip-errors`: Skip files that cannot be read when creating a snapshot, or that cannot be restored when restoring, instead of aborting. Packing and storage errors while creating a snapshot (which would leave a chunk recorded but not stored) still abort the run.
+* `--skip-errors`: Skip files that cannot be read when creating a snapshot, or that cannot be restored when restoring, instead of aborting. Packing and storage errors while creating a snapshot (which would leave a chunk recorded but not stored) still abort the run. A run that skipped anything still finishes but exits non-zero: `snapshot create` keeps the snapshot and counts each file or directory it skipped as failed. A file removed during the backup is also counted as failed but does not change the exit status.

 ### locking

@@ -302,10 +298,6 @@ value where a list belongs or a word where a number belongs), is refused.
  this duration instead of only the latest (e.g. `4w`, `30d`, `6mo`, `1y`).
  Without `--prune`, or with a value that is not a valid duration, the
  command fails before the backup starts.
-* Fails before it writes anything when a `file://` destination directory
-  does not exist, or when the local index holds snapshots and the
-  destination has no `vaultik-destination.txt` (see
-  [remote storage layout](#remote-storage-layout))

 **`snapshot list`**: Show every snapshot known to this host — the union
 of the local index and the backup destination store — with timestamps
@@ -339,10 +331,7 @@ gives: revert the configuration, or run `vaultik database delete`.

 If the destination store cannot be listed (unmounted volume,
 permission denied, network down), the command warns, falls back to the
-local index alone, and still exits zero. It does the same when the
-destination has no `vaultik-destination.txt` while the local index
-holds snapshots stored there, as when a volume mounted at the
-destination is unplugged and leaves its empty mount point behind.
+local index alone, and still exits zero.
 * `--json`: Output in JSON format. Each entry carries `locally_tracked`
  (whether the snapshot is in the local index), `remote_key` (the full
  64-character storage key), and `remote_present` (whether it was seen
@@ -384,14 +373,13 @@ snapshot in the local index or on the destination store is an error;
 with `--local-only`, the snapshot must be in the local index. Local row
 cleanup (files, chunks, blobs the snapshot was the last referrer for)
 runs automatically. If removing the snapshot's metadata from the
-destination store fails (for example because the store is unreachable,
-or the local index holds snapshots and the destination has no
-`vaultik-destination.txt`), the local-DB removal still completes and a
-warning is emitted; run `vaultik snapshot remove <snapshot-id>` again
-once the store is reachable to remove the snapshot's metadata from it
-(`vaultik prune` does not). For a snapshot that is only on the
-destination store, that failure is an error. To wipe everything on the
-destination in one go, use `vaultik remote nuke --force`.
+destination store fails (for example because the store is unreachable),
+the local-DB removal still completes and a warning is emitted; run
+`vaultik snapshot remove <snapshot-id>` again once the store is reachable
+to remove the snapshot's metadata from it (`vaultik prune` does not). For
+a snapshot that is only on the destination store, that failure is an
+error. To wipe everything on the destination in one go, use `vaultik
+remote nuke --force`.
 * `--local-only`: Skip remote cleanup; only touch the local index
 * `--dry-run`: Show what would be deleted without deleting
 * `--force`: Skip confirmation prompt
@@ -422,12 +410,8 @@ manifest on the destination store to compute the still-referenced blob
 set and delete any blob not in that set. Step (3) reads all remote
 manifests — network cost scales with the number of snapshots. `snapshot
 create --prune` runs the same cleanup automatically; this is the
-manual entry point for the same work. If the destination store cannot
-be listed, or the local index holds snapshots and the destination has
-no `vaultik-destination.txt` (an unplugged volume's empty mount point),
-prune fails and deletes nothing. `snapshot purge` does the same. If a
-blob cannot be deleted, the command (and `snapshot create --prune`)
-exits non-zero.
+manual entry point for the same work. If a blob cannot be deleted, the
+command (and `snapshot create --prune`) exits non-zero.
 * `--force`: Skip confirmation prompt
 * `--json`: Output stats as JSON. Also skips the confirmation prompt, as
  `--force` does. A blob that cannot be deleted is counted in
@@ -451,12 +435,11 @@ since `prune` never deletes it.
 * `--json`: Output as JSON

 **`remote nuke`**: Delete every object under `metadata/` and `blobs/` on
-the backup destination store, whatever its name, and then
-`vaultik-destination.txt`, leaving the bucket prefix empty. Destructive
-and irreversible. This is the single supported way to wipe the entire
-destination store. If a listing afterwards still finds anything under
-`metadata/` or `blobs/`, the command names each object left and exits
-non-zero; running it again deletes what is left.
+the backup destination store, whatever its name, leaving the bucket prefix
+empty. Destructive and irreversible. This is the single supported way to
+wipe the entire destination store. If a listing afterwards still finds
+anything there, the command names each object left and exits non-zero;
+running it again deletes what is left.
 * `--force`: Required to confirm destruction.

 **`database delete`**: Delete the local SQLite state database file
@@ -481,12 +464,7 @@ object store. Credentials are read from `s3.access_key_id` and
 a local or mounted filesystem. Useful for testing or backing up to a NAS. The
 path must be absolute; a relative one is refused when the config loads.
 Percent-escapes in the path are decoded, so `my%20stick` and `my stick` name
-the same directory. The directory must exist before the first backup: vaultik
-never creates it. A directory on a removable volume is gone while the volume is
-not mounted, so a backup then fails instead of writing to the disk under the
-mount point. The mount point itself stays behind when the volume is unplugged:
-there only `vaultik-destination.txt` stops such a backup, and only while the
-local index holds snapshots.
+the same directory.

 **Rclone** (`rclone://remote/path`): Uses rclone's 70+ supported cloud
 providers. Requires rclone to be configured separately (`rclone config`).
@@ -517,7 +495,6 @@ For an implementation-level view of the internals — the data model, the

 ```
 <bucket>/<prefix>/
-├── vaultik-destination.txt     # Marker written by every backup
 ├── blobs/
 │   └── <aa>/<bb>/<full_blob_hash>
 └── metadata/
@@ -526,15 +503,6 @@ For an implementation-level view of the internals — the data model, the
        └── manifest.json.zst   # Unencrypted blob list (for pruning)
 ```

-* `vaultik-destination.txt` holds one fixed line of text, with no host
-  name, path or time. A destination without it is treated as not
-  present while the local index holds snapshots stored there:
-  `snapshot create` refuses to write to it, `prune` and `snapshot purge`
-  fail, and `snapshot list` and `snapshot remove` behave as for a
-  destination that cannot be listed. This keeps an unplugged volume's empty mount point
-  from being taken for a destination whose snapshots are all gone. Mount
-  the volume if it is removable; if the destination was emptied on
-  purpose, run `vaultik database delete` and back up again.
 * Blobs are two-level directory sharded using the first 4 hex chars of the blob hash
 * `db.zst.age` is a binary SQLite database (zstd compressed, age encrypted)
  containing all file metadata, chunk mappings, and relationships for the snapshot
@@ -4,7 +4,7 @@ This document describes the structure and organization of data stored in the S3

 ## Overview

-Vaultik stores all backup data in an S3-compatible object store. The repository consists of two main components, plus a marker file:
+Vaultik stores all backup data in an S3-compatible object store. The repository consists of two main components:
 1. **Blobs** - The actual backup data (content-addressed, encrypted)
 2. **Metadata** - Snapshot information and manifests (partially encrypted)

@@ -12,7 +12,6 @@ Vaultik stores all backup data in an S3-compatible object store. The repository

 ```
 <bucket>/<prefix>/
-├── vaultik-destination.txt
 ├── blobs/
 │   └── <hash[0:2]>/
 │       └── <hash[2:4]>/
@@ -25,10 +24,6 @@ Vaultik stores all backup data in an S3-compatible object store. The repository

 The metadata subdirectory is named with the **remote key**, a one-way hash of the snapshot ID, not with the human-readable snapshot ID itself. See [Remote Key Derivation](#remote-key-derivation).

-## Marker File (`vaultik-destination.txt`)
-
-Every backup writes this file at the root before it uploads anything. It holds one fixed line of plain text and names no host, path or time. A destination without it is treated as not present while the local index holds snapshots stored there: `snapshot create` refuses to write to it, and `prune`, `snapshot purge`, `snapshot remove` and `snapshot list` behave as for a destination that cannot be listed. An unplugged volume leaves an empty directory at its mount point, and without the marker that directory would read as a destination whose snapshots are all gone. `remote nuke` deletes the marker last.
-
 ## Blobs Directory (`blobs/`)

 ### Structure
@@ -101,8 +101,7 @@ func TestEntryPruneJSONStdoutIsExactlyOneDocument(t *testing.T) {
 // writeHermeticPruneConfig builds a config over a temp directory with an
 // empty destination directory and, if seedStale is set, creates the
 // index database up front with one snapshot record that has no
-// counterpart on the destination store, and gives the destination the
-// marker a backup writes. Returns the config path.
+// counterpart on the destination store. Returns the config path.
 func writeHermeticPruneConfig(t *testing.T, seedStale bool) string {
 	t.Helper()

@@ -132,11 +131,6 @@ func writeHermeticPruneConfig(t *testing.T, seedStale bool) string {

 	if seedStale {
 		seedStaleSnapshotRecord(t, indexPath)
-
-		// While the local index holds a snapshot, prune fails on a
-		// destination without the marker a backup writes.
-		require.NoError(t, os.WriteFile(
-			filepath.Join(storeDir, "vaultik-destination.txt"), nil, 0o600))
 	}

 	return configPath
@@ -0,0 +1,30 @@
+package cli //nolint:testpackage // shares runEntry and the hermetic config helpers
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// TestEntrySnapshotCreateSkipErrorsExitsNonZeroWhenItSkips backs up,
+// under --skip-errors, a source directory that does not exist, which the
+// walk skips. The command exits non-zero and reports the backup as
+// completed, not as a failed snapshot creation. See
+// https://git.eeqj.de/sneak/vaultik/issues/310.
+//
+//nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
+func TestEntrySnapshotCreateSkipErrorsExitsNonZeroWhenItSkips(t *testing.T) {
+	// writeBackupConfig would create the source directory.
+	configPath := writeHermeticPruneConfig(t, false)
+
+	code, stdout, stderr := runEntry(t,
+		flagConfig, configPath, "--skip-errors", cmdSnapshot, cmdCreate)
+
+	assert.Equal(t, 1, code)
+	assert.Contains(t, stdout,
+		"Files: 1 examined, 0 backed up, 0 unchanged, 1 failed.")
+	assert.NotContains(t, stdout, "Finished successfully.")
+	assert.Contains(t, stderr,
+		"Backup completed, but 1 file(s) could not be read")
+	assert.NotContains(t, stderr, "Snapshot creation failed")
+}
@@ -41,11 +41,6 @@ func TestEntrySnapshotPurgeKeepsMetadataWhenLocalIndexDeleteFails(t *testing.T)
 	// too, so the purge selects it rather than dropping it as stale.
 	seedStaleSnapshotRecord(t, indexPath)

-	// While the local index holds a snapshot, purge fails on a
-	// destination without the marker a backup writes.
-	require.NoError(t, os.WriteFile(
-		filepath.Join(dir, "store", "vaultik-destination.txt"), nil, 0o600))
-
 	manifestDir := filepath.Join(dir, "store", "metadata",
 		snapshot.RemoteSnapshotKey(stalePruneSnapshotID))
 	require.NoError(t, os.MkdirAll(manifestDir, 0o750))
@@ -64,12 +59,10 @@ func TestEntrySnapshotPurgeKeepsMetadataWhenLocalIndexDeleteFails(t *testing.T)
 	require.NoError(t, err)
 	require.NoError(t, db.Close())

-	code, _, stderr := runEntry(t, flagConfig, configPath,
+	code, _, _ := runEntry(t, flagConfig, configPath,
 		cmdSnapshot, cmdPurge, flagOlderThan, "30d", flagForce)

 	assert.Equal(t, 1, code)
-	assert.Contains(t, stderr, "simulated index error",
-		"the purge must fail at the local-index delete")
 	assert.FileExists(t, manifestPath,
 		"the snapshot is still in the local index, so its metadata must stay")
 }
@@ -115,6 +115,13 @@ on Linux), then /etc/vaultik/config.yml.`,
 					return
 				}

+				if errors.Is(err, vaultik.ErrFilesUnreadable) {
+					log.Error("Backup completed with unreadable files", "error", err)
+					ReportErrorf("Backup completed, but %v", err)
+
+					return
+				}
+
 				log.Error("Snapshot creation failed", "error", err)
 				ReportErrorf("Snapshot creation failed: %v", err)
 			})
@@ -141,10 +141,11 @@ type ScannerConfig struct {
 // ScanResult contains the results of a scan operation. Files and bytes
 // are counted per file: BytesScanned is the size of the new and changed
 // files, BytesSkipped that of the unchanged ones. FilesFailed counts the
-// new and changed files that phase 2 could not store; FilesScanned
-// includes them and BytesScanned does not. ChunksCreated counts the
-// chunks that were not already stored, and NewChunkSize is their total
-// size.
+// new and changed files that phase 2 could not store and, under
+// --skip-errors, each entry the walk could not read, such as a directory
+// it could not list; FilesScanned includes them and BytesScanned does
+// not. ChunksCreated counts the chunks that were not already stored, and
+// NewChunkSize is their total size.
 type ScanResult struct {
 	FilesScanned   int
 	FilesSkipped   int
@@ -161,6 +162,11 @@ type ScanResult struct {
 	UploadDuration time.Duration
 	StartTime      time.Time
 	EndTime        time.Time
+
+	// FilesUnreadable is the part of FilesFailed that --skip-errors
+	// skipped because it could not be read or listed; the rest are files
+	// removed after the walk listed them.
+	FilesUnreadable int
 }

 // NewScanner creates a new scanner instance
@@ -883,7 +889,7 @@ func (s *Scanner) scanPhase(

 	walkFn := func(filePath string, info os.FileInfo, err error) error {
 		if err != nil {
-			return s.handleWalkError(filePath, err)
+			return s.handleWalkError(filePath, err, result)
 		}

 		// Check context cancellation
@@ -959,7 +965,7 @@ func (s *Scanner) recordSpecialEntry(
 	if info.Mode()&os.ModeSymlink != 0 {
 		file, err := s.buildSymlinkEntry(filePath, info)
 		if err != nil {
-			return true, s.handleWalkError(filePath, err)
+			return true, s.handleWalkError(filePath, err, result)
 		}

 		existingFiles[filePath] = struct{}{}
@@ -983,14 +989,21 @@ func (s *Scanner) recordSpecialEntry(
 }

 // handleWalkError deals with a filesystem error surfaced by the walk:
-// skipped (with a UI notice) under --skip-errors, fatal otherwise.
-func (s *Scanner) handleWalkError(filePath string, err error) error {
+// under --skip-errors the entry is skipped with a UI notice and counted
+// as examined, failed and unreadable, otherwise the error is fatal.
+func (s *Scanner) handleWalkError(
+	filePath string, err error, result *ScanResult,
+) error {
 	if s.skipErrors {
 		log.Error("Failed to access file (skipping due to --skip-errors)",
 			"path", filePath, "error", err)
 		s.ui.Errorf("Failed to access %s: %v. Skipping (--skip-errors).",
 			s.ui.Path(filePath), err)

+		result.FilesScanned++
+		result.FilesFailed++
+		result.FilesUnreadable++
+
 		return nil // Continue scanning
 	}

@@ -1422,6 +1435,7 @@ func (s *Scanner) processFileWithErrorHandling(
 				s.ui.Path(fileToProcess.Path), err)

 			countFailedFile(fileToProcess, result)
+			result.FilesUnreadable++

 			return true, nil
 		}
@@ -21,13 +21,9 @@ type FileStorer struct {
 // NewFileStorer creates a new filesystem storage backend.
 //
 // Construction is intentionally cheap and does not touch the filesystem.
-// The backend never creates basePath: the user does, so that when
-// basePath is a directory on an unplugged volume, a write fails instead
-// of landing on the disk under the mount point. This does not hold when
-// basePath is the mount point itself, which stays behind when its volume
-// is unplugged.
-// Put and PutWithProgress fail on a missing basePath and create the
-// directories below it as needed.
+// The basePath is recorded; the directory is created lazily on first
+// write. Write operations (Put/PutWithProgress) call MkdirAll for the
+// per-blob parent directory, which also covers basePath on first use.
 // Get and Stat report a key under a missing basePath as ErrNotFound.
 // List and ListStream fail on a missing basePath, because listing it as
 // an empty store would make `prune` drop every local snapshot record.
@@ -303,19 +299,7 @@ func (f *FileStorer) writeAtomic(
 	path := f.fullPath(key)
 	dir := filepath.Dir(path)

-	// Checked on every write, so a destination that disappears part-way
-	// through a backup fails it rather than being recreated by MkdirAll.
-	_, err := f.fs.Stat(f.basePath)
-	if os.IsNotExist(err) {
-		return fmt.Errorf("destination directory does not exist; "+
-			"create it, or mount the volume it is on: %w", err)
-	}
-
-	if err != nil {
-		return fmt.Errorf("checking destination directory: %w", err)
-	}
-
-	err = f.fs.MkdirAll(dir, storageDirPerm)
+	err := f.fs.MkdirAll(dir, storageDirPerm)
 	if err != nil {
 		return fmt.Errorf("creating directories: %w", err)
 	}
@@ -292,43 +292,3 @@ func TestFileStorerDeletePartialUploadsThroughSymlinkedDirectory(t *testing.T) {
 		})
 	}
 }
-
-// TestFileStorerPutMissingDestination checks that a write fails when the
-// destination directory has gone, even after earlier writes to it
-// succeeded, and that it does not create the directory again.
-func TestFileStorerPutMissingDestination(t *testing.T) {
-	t.Parallel()
-
-	ctx := context.Background()
-	base := filepath.Join(t.TempDir(), "usbstick")
-
-	err := os.Mkdir(base, 0o750)
-	if err != nil {
-		t.Fatalf("Mkdir: %v", err)
-	}
-
-	s, err := storage.NewFileStorer(base)
-	if err != nil {
-		t.Fatalf("NewFileStorer: %v", err)
-	}
-
-	err = s.Put(ctx, "blobs/aa/bb/first", strings.NewReader("first"))
-	if err != nil {
-		t.Fatalf("first Put: %v", err)
-	}
-
-	err = os.Rename(base, base+"-unplugged")
-	if err != nil {
-		t.Fatalf("Rename: %v", err)
-	}
-
-	err = s.Put(ctx, "blobs/aa/bb/second", strings.NewReader("second"))
-	if !errors.Is(err, fs.ErrNotExist) {
-		t.Errorf("Put = %v, want a not-exist error", err)
-	}
-
-	_, err = os.Stat(base)
-	if !errors.Is(err, fs.ErrNotExist) {
-		t.Errorf("Put created the destination directory again (Stat = %v)", err)
-	}
-}
@@ -41,8 +41,7 @@ type Info struct {
 // directory for filesystem).
 type Storer interface {
 	// Put stores data at the specified key.
-	// The filesystem backend fails when its destination directory does
-	// not exist, and creates the directories below it as needed.
+	// Parent directories are created automatically for filesystem backends.
 	Put(ctx context.Context, key string, data io.Reader) error

 	// PutWithProgress stores data with progress reporting.
@@ -137,7 +137,7 @@ func TestBackupAfterRemovingNewestSnapshotRestoresChangedFile(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 	changedPath := filepath.Join(dataDir, "appended.bin")
@@ -184,7 +184,7 @@ func TestBackupAfterInterruptedRunRestoresChangedFile(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 	changedPath := filepath.Join(dataDir, "appended.bin")
@@ -35,7 +35,7 @@ func TestDeepVerifyAcceptsHealthyAndRejectsCorruptBlob(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

 	chunkSize := int64(64 * 1024)
@@ -94,7 +94,7 @@ func TestDeepVerifyJSONCountsBlobs(t *testing.T) {

 	fs := afero.NewOsFs()
 	ctx := context.Background()
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(t.TempDir(), "remote")

 	cfg, storer, snapshotID, keys := backUpSeveralBlobs(ctx, t, storeDir)

@@ -151,7 +151,7 @@ func TestDeepVerifyJSONCountsWrongSizeBlob(t *testing.T) {

 	fs := afero.NewOsFs()
 	ctx := context.Background()
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(t.TempDir(), "remote")

 	cfg, storer, snapshotID, keys := backUpSeveralBlobs(ctx, t, storeDir)

@@ -183,7 +183,7 @@ func TestDeepVerifyStopsOnBlobThatCannotBeChecked(t *testing.T) {
 	t.Parallel()

 	ctx := context.Background()
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(t.TempDir(), "remote")

 	cfg, storer, snapshotID, keys := backUpSeveralBlobs(ctx, t, storeDir)
 	failing := statFailingStorer{Storer: storer, failKeys: []string{keys[0]}}
@@ -1,90 +0,0 @@
-package vaultik
-
-import (
-	"errors"
-	"fmt"
-	"strings"
-
-	"sneak.berlin/go/vaultik/internal/storage"
-)
-
-// destinationMarkerKey is the object every backup writes at the root of
-// the backup destination store. While the local index holds a snapshot
-// stored there, a destination without it is treated as not present: an
-// unplugged volume leaves an empty directory at its mount point, which
-// would otherwise read as a store whose snapshots are all gone.
-const destinationMarkerKey = "vaultik-destination.txt"
-
-// destinationMarkerText is the whole content of the marker. It names no
-// host, path or time.
-const destinationMarkerText = "This is a vaultik backup destination store.\n"
-
-// errDestinationNotPresent is returned when the local index holds a
-// snapshot stored on the backup destination store and the store has no
-// marker.
-var errDestinationNotPresent = errors.New("backup destination store is not present")
-
-// checkDestinationMarker returns errDestinationNotPresent when the local
-// index holds a snapshot stored on the backup destination store and the
-// store has no marker. With no snapshot in the local index, as on a
-// first backup or on another machine, there is nothing to check; nor
-// when the local index is bound to a different destination than the
-// configured one, since its snapshots are stored there.
-func (v *Vaultik) checkDestinationMarker() error {
-	ids, err := v.localSnapshotIDs()
-	if err != nil {
-		return fmt.Errorf("listing local snapshots: %w", err)
-	}
-
-	if len(ids) == 0 {
-		return nil
-	}
-
-	// Config is nil only in tests, which then record no binding (see
-	// EnsureStorageBinding).
-	if v.Config != nil {
-		stored, configured, err := v.storageBinding()
-		if err != nil {
-			return err
-		}
-
-		if stored != "" && stored != configured {
-			return nil
-		}
-	}
-
-	_, err = v.Storage.Stat(v.ctx, destinationMarkerKey)
-	if errors.Is(err, storage.ErrNotFound) {
-		return fmt.Errorf("%w: %s has no %s, but the local index holds "+
-			"snapshots stored there; mount the volume if it is removable, "+
-			"or if the destination was emptied on purpose, run "+
-			"'vaultik database delete' and back up again",
-			errDestinationNotPresent, v.Storage.Info().Location,
-			destinationMarkerKey)
-	}
-
-	if err != nil {
-		return fmt.Errorf("checking for %s: %w", destinationMarkerKey, err)
-	}
-
-	return nil
-}
-
-// markDestination checks the backup destination store with
-// checkDestinationMarker and then writes the marker, so a first backup
-// marks its destination and a later one writes the same text again.
-func (v *Vaultik) markDestination() error {
-	err := v.checkDestinationMarker()
-	if err != nil {
-		return err
-	}
-
-	err = v.Storage.Put(v.ctx, destinationMarkerKey,
-		strings.NewReader(destinationMarkerText))
-	if err != nil {
-		return fmt.Errorf("writing %s to the backup destination store: %w",
-			destinationMarkerKey, err)
-	}
-
-	return nil
-}
@@ -1,278 +0,0 @@
-package vaultik_test
-
-import (
-	"bytes"
-	"context"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/vaultik/internal/database"
-	"sneak.berlin/go/vaultik/internal/log"
-	"sneak.berlin/go/vaultik/internal/storage"
-	"sneak.berlin/go/vaultik/internal/vaultik"
-)
-
-// These tests cover https://git.eeqj.de/sneak/vaultik/issues/239: a
-// file:// destination at a volume's mount point leaves an empty directory
-// behind when the volume is unplugged. While the local index holds
-// snapshots, a destination without vaultik-destination.txt is not present,
-// so no command may write to it or conclude from it that the local
-// snapshots are gone.
-
-// markerFile is the name of the file a backup writes at the root of the
-// destination.
-const markerFile = "vaultik-destination.txt"
-
-// backUpThenUnplugMountPoint backs up to a file:// destination, then
-// moves the destination directory away and leaves an empty directory in
-// its place, as unplugging a volume mounted there would. It returns the
-// path of that empty directory.
-func backUpThenUnplugMountPoint(
-	ctx context.Context, t *testing.T,
-) (*vaultik.Vaultik, *database.Repositories, *bytes.Buffer, string) {
-	t.Helper()
-
-	storeDir := filepath.Join(t.TempDir(), "mnt")
-	v, repos, out := backUpToFileDestination(ctx, t, storeDir)
-
-	require.NoError(t, os.Rename(storeDir, storeDir+"-unplugged"))
-	require.NoError(t, os.Mkdir(storeDir, 0o750))
-
-	return v, repos, out, storeDir
-}
-
-// assertUntouched checks that the local index still holds its one
-// snapshot and that nothing was written to the empty mount point.
-func assertUntouched(
-	ctx context.Context, t *testing.T,
-	repos *database.Repositories, storeDir string,
-) {
-	t.Helper()
-
-	snapshots, err := repos.Snapshots.ListRecent(ctx, listRecentTestLimit)
-	require.NoError(t, err)
-	assert.Len(t, snapshots, 1, "no local snapshot record may be deleted")
-
-	entries, err := os.ReadDir(storeDir)
-	require.NoError(t, err)
-	assert.Empty(t, entries, "nothing may be written to the empty mount point")
-}
-
-// TestFirstBackupWritesMarker checks that a backup writes the marker
-// file at the root of the destination.
-func TestFirstBackupWritesMarker(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	storeDir := t.TempDir()
-	backUpToFileDestination(context.Background(), t, storeDir)
-
-	assert.FileExists(t, filepath.Join(storeDir, markerFile))
-}
-
-// TestBackupRefusesDestinationWithoutMarker checks that snapshot create
-// --prune writes nothing and drops no local snapshot record when the
-// destination has no marker.
-func TestBackupRefusesDestinationWithoutMarker(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	v, repos, _, storeDir := backUpThenUnplugMountPoint(ctx, t)
-
-	err := v.CreateSnapshot(&vaultik.SnapshotCreateOptions{
-		Cron:  true,
-		Prune: true,
-	})
-	require.ErrorContains(t, err, markerFile)
-
-	assertUntouched(ctx, t, repos, storeDir)
-}
-
-// TestBackupChecksMarkerBeforeDroppingIncompleteSnapshots checks that
-// snapshot create writes nothing when the local index holds only an
-// incomplete snapshot and the destination has no marker. The backup drops
-// incomplete snapshots before it scans; checked after that, the local
-// index would hold none and nothing would be checked.
-func TestBackupChecksMarkerBeforeDroppingIncompleteSnapshots(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	storeDir := t.TempDir()
-	v, repos := newFileDestinationVaultik(ctx, t, storeDir)
-
-	require.NoError(t, repos.Snapshots.Create(ctx, nil, &database.Snapshot{
-		ID:        "host_first_2026-01-02T03:04:05Z",
-		Hostname:  "host",
-		StartedAt: time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC),
-	}))
-
-	err := backUp(v, "first")
-	require.ErrorContains(t, err, markerFile)
-
-	assertUntouched(ctx, t, repos, storeDir)
-}
-
-// TestPruneRefusesDestinationWithoutMarker checks that prune fails and
-// deletes no local snapshot record when the destination has no marker.
-func TestPruneRefusesDestinationWithoutMarker(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	v, repos, _, storeDir := backUpThenUnplugMountPoint(ctx, t)
-
-	err := v.Prune(&vaultik.PruneOptions{Force: true})
-	require.ErrorContains(t, err, markerFile)
-
-	assertUntouched(ctx, t, repos, storeDir)
-}
-
-// TestPurgeRefusesDestinationWithoutMarker checks that snapshot purge
-// fails and deletes no local snapshot record when the destination has no
-// marker.
-func TestPurgeRefusesDestinationWithoutMarker(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	v, repos, _, storeDir := backUpThenUnplugMountPoint(ctx, t)
-
-	err := v.PurgeSnapshotsWithOptions(&vaultik.SnapshotPurgeOptions{
-		KeepLatest: true,
-		Force:      true,
-	})
-	require.ErrorContains(t, err, markerFile)
-
-	assertUntouched(ctx, t, repos, storeDir)
-}
-
-// TestRemoveSnapshotWarnsWhenDestinationHasNoMarker checks that snapshot
-// remove warns that the metadata could not be removed from a destination
-// without a marker, instead of reporting that it was.
-func TestRemoveSnapshotWarnsWhenDestinationHasNoMarker(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	v, repos, out, _ := backUpThenUnplugMountPoint(ctx, t)
-
-	result, err := v.RemoveSnapshot(localSnapshotID(ctx, t, repos, "first"),
-		&vaultik.RemoveOptions{Force: true})
-	require.NoError(t, err)
-
-	assert.False(t, result.RemoteRemoved)
-	assert.Contains(t, out.String(),
-		"Could not remove snapshot metadata from remote")
-	assert.Contains(t, out.String(), markerFile)
-	assert.NotContains(t, out.String(),
-		"Removed snapshot metadata from remote storage")
-}
-
-// TestRemoveSnapshotOnlyOnDestinationFailsWithoutMarker checks that
-// snapshot remove, for a snapshot that is only on the destination, fails
-// saying the destination is not present when it has no marker, instead
-// of saying the snapshot does not exist.
-func TestRemoveSnapshotOnlyOnDestinationFailsWithoutMarker(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	storeDir := filepath.Join(t.TempDir(), "mnt")
-	v, repos, _ := backUpToFileDestination(ctx, t, storeDir)
-	require.NoError(t, backUp(v, "second"))
-
-	id := localSnapshotID(ctx, t, repos, "first")
-	_, err := v.RemoveSnapshot(id,
-		&vaultik.RemoveOptions{Force: true, LocalOnly: true})
-	require.NoError(t, err)
-
-	// Unplug the volume: an empty directory stays at its mount point.
-	require.NoError(t, os.Rename(storeDir, storeDir+"-unplugged"))
-	require.NoError(t, os.Mkdir(storeDir, 0o750))
-
-	_, err = v.RemoveSnapshot(id, &vaultik.RemoveOptions{Force: true})
-	require.ErrorContains(t, err, markerFile)
-	require.ErrorContains(t, err, "mount the volume")
-
-	assertUntouched(ctx, t, repos, storeDir)
-}
-
-// TestListSnapshotsWarnsWhenDestinationHasNoMarker checks that snapshot
-// list warns and shows the local index alone when the destination has no
-// marker, without reporting the local snapshot as missing from it.
-func TestListSnapshotsWarnsWhenDestinationHasNoMarker(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	v, repos, out, _ := backUpThenUnplugMountPoint(ctx, t)
-	id := localSnapshotID(ctx, t, repos, "first")
-
-	require.NoError(t, v.ListSnapshots(false))
-
-	assert.Contains(t, out.String(), "Could not list backup destination store")
-	assert.Contains(t, out.String(), markerFile)
-	assert.Contains(t, out.String(), id)
-	assert.NotContains(t, out.String(), "not found in backup destination store")
-}
-
-// TestListSnapshotsAfterStorageURLChangeToEmptyDirectory checks that
-// snapshot list, after storage_url is changed to an empty directory,
-// warns only that the local index is bound to a different destination:
-// the local snapshots are stored at the old one, so the new one's lack
-// of a marker says nothing. With --json the local row is not on the new
-// destination, so remote_present is false, not unknown.
-func TestListSnapshotsAfterStorageURLChangeToEmptyDirectory(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	v, repos, out := backUpToFileDestination(ctx, t, t.TempDir())
-	id := localSnapshotID(ctx, t, repos, "first")
-
-	newDir := t.TempDir()
-	store, err := storage.NewFileStorer(newDir)
-	require.NoError(t, err)
-
-	v.Storage = store
-	v.Config.StorageURL = "file://" + newDir
-
-	require.NoError(t, v.ListSnapshots(false))
-
-	assert.Contains(t, out.String(), id)
-	assert.Contains(t, out.String(),
-		"local index is bound to a different backup destination")
-	assert.NotContains(t, out.String(), "Could not list backup destination store")
-	assert.NotContains(t, out.String(), markerFile)
-
-	out.Reset()
-	require.NoError(t, v.ListSnapshots(true))
-
-	rows := decodeListJSON(t, out.String())
-	require.Len(t, rows, 1)
-	require.NotNil(t, rows[0].RemotePresent)
-	assert.False(t, *rows[0].RemotePresent)
-}
-
-// TestBackupAfterNukeRemoteSucceeds checks that remote nuke leaves the
-// destination ready for a new first backup, which writes the marker
-// again.
-func TestBackupAfterNukeRemoteSucceeds(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	storeDir := t.TempDir()
-	v, _, _ := backUpToFileDestination(context.Background(), t, storeDir)
-
-	require.NoError(t, v.NukeRemote(true))
-	assert.NoFileExists(t, filepath.Join(storeDir, markerFile))
-
-	require.NoError(t, backUp(v, "second"))
-	assert.FileExists(t, filepath.Join(storeDir, markerFile))
-}
@@ -192,7 +192,7 @@ func assertRestoreRejectsDamagedBlob(
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

@@ -238,7 +238,7 @@ func TestDeepVerifyCatchesLyingBackend(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

 	ctx := context.Background()
@@ -290,7 +290,7 @@ func TestInterruptedBlobUploadRecordsNoUploadedBlob(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

 	ctx := context.Background()
@@ -298,6 +298,10 @@ func TestInterruptedBlobUploadRecordsNoUploadedBlob(t *testing.T) {

 	writeFaultSourceTree(t, fs, dataDir)

+	// No upload succeeds, so nothing creates the destination directory.
+	// It must exist for the listing below to show that no blob survived.
+	require.NoError(t, os.Mkdir(storeDir, 0o750))
+
 	inner, err := storage.NewFileStorer(storeDir)
 	require.NoError(t, err)

@@ -361,7 +365,7 @@ func TestBackupRetryAfterInterruptedUploadIsRestorable(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

@@ -425,7 +429,7 @@ func TestBackupSurvivesMetadataExportInterruption(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

 	ctx := context.Background()
@@ -441,10 +445,6 @@ func TestBackupSurvivesMetadataExportInterruption(t *testing.T) {

 	repos := database.NewRepositories(db)

-	// snapshot create writes the marker; this backup runs its steps one
-	// by one, so the marker is written here.
-	require.NoError(t, inner.Put(ctx, markerFile, strings.NewReader("")))
-
 	// Back up and complete with a working backend.
 	sm := newFaultSnapshotManager(fs, inner, cfg, repos)
 	scanner := newFaultScanner(fs, inner, cfg, repos)
@@ -493,14 +493,8 @@ func TestBackupSurvivesMetadataExportInterruption(t *testing.T) {
 		"shallow verify must report the missing manifest")

 	// snapshot list must not crash on the partial snapshot.
-	var listOut strings.Builder
-
-	reader.UI = ui.NewWithColor(&listOut, false)
 	require.NoError(t, reader.ListSnapshots(false),
 		"snapshot list must tolerate a partially-exported snapshot")
-	assert.NotContains(t, listOut.String(),
-		"Could not list backup destination store",
-		"snapshot list must read the partial snapshot from the destination")
 }

 // Scenario 2, repair: the process dies during the metadata export of a
@@ -517,7 +511,7 @@ func TestBackupCompletesOnlyAfterMetadataExport(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

@@ -693,7 +687,7 @@ func TestRestoreReportsDiskFull(t *testing.T) {
 	osFS := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

@@ -771,7 +771,7 @@ func TestEndToEndFileStorage(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

@@ -964,7 +964,7 @@ func TestDedupOnlySnapshotRestores(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

@@ -24,11 +24,13 @@ import (
 // that is not plugged in, cannot be listed. It is not an empty store, so
 // no command may conclude from it that the local snapshots are gone.

-// newFileDestinationVaultik returns a Vaultik that backs up the
-// snapshot named "first" to a file:// destination at storeDir.
-func newFileDestinationVaultik(
+// backUpToFileDestination backs up the snapshot named "first" to a
+// file:// destination at storeDir, which need not exist yet. Everything
+// the returned Vaultik prints after the backup goes to the returned
+// buffer.
+func backUpToFileDestination(
 	ctx context.Context, t *testing.T, storeDir string,
-) (*vaultik.Vaultik, *database.Repositories) {
+) (*vaultik.Vaultik, *database.Repositories, *bytes.Buffer) {
 	t.Helper()

 	osFs := afero.NewOsFs()
@@ -47,22 +49,8 @@ func newFileDestinationVaultik(

 	repos := database.NewRepositories(db)
 	cfg := changedFileConfig(dataDir, dbPath)
+	v := newBackupVaultik(ctx, cfg, store, repos, db, osFs)

-	return newBackupVaultik(ctx, cfg, store, repos, db, osFs), repos
-}
-
-// backUpToFileDestination creates the directory storeDir, as a user must
-// before the first backup, and backs up the snapshot named "first" to a
-// file:// destination there. Everything the returned Vaultik prints
-// after the backup goes to the returned buffer.
-func backUpToFileDestination(
-	ctx context.Context, t *testing.T, storeDir string,
-) (*vaultik.Vaultik, *database.Repositories, *bytes.Buffer) {
-	t.Helper()
-
-	require.NoError(t, os.MkdirAll(storeDir, 0o750))
-
-	v, repos := newFileDestinationVaultik(ctx, t, storeDir)
 	require.NoError(t, backUp(v, "first"))

 	out := &bytes.Buffer{}
@@ -87,28 +75,21 @@ func backUpThenUnplug(
 	return v, repos, out
 }

-// TestBackupFailsWhenDestinationDirectoryMissing checks that a backup to
-// a file:// destination whose directory does not exist fails before it
-// records a snapshot, and does not create the directory.
-func TestBackupFailsWhenDestinationDirectoryMissing(t *testing.T) {
+// TestFirstBackupCreatesDestinationDirectory checks that a first backup
+// to a destination directory that does not exist yet creates it, and
+// that the destination can be listed afterwards.
+func TestFirstBackupCreatesDestinationDirectory(t *testing.T) {
 	log.Initialize(log.Config{})
 	t.Parallel()

 	ctx := context.Background()
-	volume := filepath.Join(t.TempDir(), "volume")
-	v, repos := newFileDestinationVaultik(ctx, t, filepath.Join(volume, "backup"))
+	storeDir := filepath.Join(t.TempDir(), "volume", "backup")
+	v, _, out := backUpToFileDestination(ctx, t, storeDir)

-	err := backUp(v, "first")
-	require.ErrorIs(t, err, fs.ErrNotExist)
-	require.ErrorContains(t, err, "create it, or mount the volume it is on")
+	require.NoError(t, v.ListSnapshots(false))

-	_, err = os.Stat(volume)
-	require.ErrorIs(t, err, fs.ErrNotExist,
-		"the backup must not create the destination directory")
-
-	snapshots, err := repos.Snapshots.ListRecent(ctx, listRecentTestLimit)
-	require.NoError(t, err)
-	assert.Empty(t, snapshots)
+	assert.NotContains(t, out.String(), "Could not list backup destination store")
+	assert.NotContains(t, out.String(), "not found in backup destination store")
 }

 // TestListSnapshotsWarnsWhenDestinationMissing checks that snapshot list
@@ -39,7 +39,7 @@ func TestNewChunkSizeOfChangedFileStaysFixed(t *testing.T) {

 	appendRandomBytes(t, fs, files, changedPath, appendedFileSize)

-	store, err := storage.NewFileStorer(t.TempDir())
+	store, err := storage.NewFileStorer(filepath.Join(tempDir, "remote"))
 	require.NoError(t, err)

 	db, err := database.New(ctx, dbPath)
@@ -42,10 +42,9 @@ const blobKeyParts = 4

 // NukeRemote deletes every object under metadata/ and blobs/ in remote
 // storage, whatever its name, along with any object an upload cut off
-// part-way left under a temporary `.partial` name, and last the
-// destination marker. It returns successfully only when a listing
-// afterwards finds nothing left under metadata/ and blobs/, and the next
-// backup then starts from scratch.
+// part-way left under a temporary `.partial` name. It returns
+// successfully only when a listing afterwards finds nothing left there,
+// and the next backup then starts from scratch.
 //
 // Refuses to run unless force is true. The caller is responsible for
 // confirming with the user.
@@ -106,13 +105,6 @@ func (v *Vaultik) emptyDestinationStore() error {
 		return fmt.Errorf("%d %w", len(left), errObjectsLeft)
 	}

-	// Last, once the local snapshot records are gone: the next backup
-	// then has none and writes the marker again.
-	err = v.Storage.Delete(v.ctx, destinationMarkerKey)
-	if err != nil {
-		return fmt.Errorf("deleting %s: %w", destinationMarkerKey, err)
-	}
-
 	return nil
 }

@@ -35,9 +35,6 @@ func setupConsistencyTest(
 	repos := database.NewRepositories(db)
 	mockStorage := NewMockStorer()

-	// A backup wrote to this destination, so it carries the marker.
-	require.NoError(t, mockStorage.Put(ctx, markerFile, strings.NewReader("")))
-
 	for _, id := range snapshotIDs {
 		parts := strings.Split(id, "_")
 		startedAt, err := time.Parse(time.RFC3339, parts[len(parts)-1])
@@ -45,9 +45,6 @@ func setupPurgeTest(
 	repos := database.NewRepositories(db)
 	mockStorage := NewMockStorer()

-	// A backup wrote to this destination, so it carries the marker.
-	require.NoError(t, mockStorage.Put(ctx, markerFile, strings.NewReader("")))
-
 	// Insert each snapshot into the DB and create remote metadata stubs.
 	// Use timestamps parsed from snapshot IDs for realistic ordering.
 	for _, id := range snapshotIDs {
@@ -96,10 +96,6 @@ func TestRemoveSnapshot_QuietSuppressesReport(t *testing.T) {
 		store := newTestStorer()
 		addManifest(t, store, "snapshot-001", nil)

-		// A backup wrote to this destination, so it carries the marker.
-		require.NoError(t, store.Put(context.Background(), markerFile,
-			bytes.NewReader(nil)))
-
 		tv := vaultik.NewForTesting(store)
 		tv.Repositories = newLocalIndex(t, "snapshot-001")
 		tv.UI.SetQuiet(true)
@@ -304,10 +304,6 @@ func TestRemoveSnapshot_DefaultRemovesMetadataNotBlobs(t *testing.T) {
 	addBlob(t, store, blobUnique)
 	addBlob(t, store, blobShared)

-	// A backup wrote to this destination, so it carries the marker.
-	require.NoError(t, store.Put(context.Background(), markerFile,
-		bytes.NewReader(nil)))
-
 	tv := vaultik.NewForTesting(store)
 	tv.Repositories = newLocalIndex(t, "snapshot-001", "snapshot-002")

@@ -377,10 +373,6 @@ func TestRemoveSnapshot_UnknownIDIsError(t *testing.T) {
 			store := newTestStorer()
 			addManifest(t, store, "snapshot-001", nil)

-			// A backup wrote to this destination, so it carries the marker.
-			require.NoError(t, store.Put(context.Background(), markerFile,
-				bytes.NewReader(nil)))
-
 			tv := vaultik.NewForTesting(store)
 			tv.Repositories = newLocalIndex(t, "snapshot-001")

@@ -401,12 +393,7 @@ func TestRemoveSnapshot_NoMetadataOnDestination(t *testing.T) {
 	log.Initialize(log.Config{})
 	t.Parallel()

-	// A backup wrote to this destination, so it carries the marker.
-	store := newTestStorer()
-	require.NoError(t, store.Put(context.Background(), markerFile,
-		bytes.NewReader(nil)))
-
-	tv := vaultik.NewForTesting(store)
+	tv := vaultik.NewForTesting(newTestStorer())
 	tv.Repositories = newLocalIndex(t, "snapshot-001")

 	result, err := tv.RemoveSnapshot("snapshot-001",
@@ -42,7 +42,7 @@ func TestRestoreOnAnotherMachine(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

@@ -65,7 +65,7 @@ func TestRestoreCleansTempDirOnInterrupt(t *testing.T) {
 	root := t.TempDir()

 	dataDir := filepath.Join(root, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(root, "remote")
 	restoreDir := filepath.Join(root, "restored")
 	dbPath := filepath.Join(root, "index.sqlite")

@@ -201,7 +201,7 @@ func TestRestoreLocalityAndReadAt(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

@@ -107,7 +107,7 @@ func backupOneFile(
 	require.NoError(t, afero.WriteFile(fs, srcPath, content, mode))
 	require.NoError(t, fs.Chmod(srcPath, mode))

-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

 	storer, err := storage.NewFileStorer(storeDir)
@@ -348,7 +348,7 @@ func backupSingleChunkFiles(
 		require.NoError(t, afero.WriteFile(fs, path, files[path], 0o644))
 	}

-	storer, err := storage.NewFileStorer(t.TempDir())
+	storer, err := storage.NewFileStorer(filepath.Join(tempDir, "remote"))
 	require.NoError(t, err)

 	db, err := database.New(ctx, dbPath)
@@ -29,7 +29,7 @@ func TestRestoreAndDeepVerifyRejectSwappedDatabase(t *testing.T) {

 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")

 	chunkSize := int64(64 * 1024)

@@ -100,7 +100,7 @@ func TestDeepVerifyRejectsSwappedDatabaseWithEmptyManifest(t *testing.T) {

 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")

 	chunkSize := int64(64 * 1024)

@@ -186,7 +186,7 @@ func TestRestoreSweeperEvictsBlobs(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

@@ -34,7 +34,7 @@ func TestRestoreFreesBlobsNoPendingFileNeeds(t *testing.T) {
 	dataDir := filepath.Join(tempDir, "source")
 	originalsDir := filepath.Join(dataDir, "originals")
 	copiesDir := filepath.Join(dataDir, "copies")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

 	originals := writeFilesWithCopies(t, fs, originalsDir, copiesDir, fileBytes)
@@ -33,7 +33,7 @@ func TestRestoreRejectsTruncatedMetadataDB(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

@@ -32,7 +32,7 @@ func TestRestoreNamesUnmatchedPathAndRestoresTheMatchingOne(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

@@ -89,7 +89,7 @@ func TestRestoreNamesEveryPathWhenNothingMatches(t *testing.T) {
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
 	linkDir := filepath.Join(tempDir, "srclink")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

@@ -152,7 +152,7 @@ func TestRestoreNamesUnmatchedPathWhenADamagedBlobStopsIt(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

@@ -28,7 +28,7 @@ func TestVerifyPassesWhenBackupReusesStoredBlob(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	secondDBPath := filepath.Join(tempDir, "second.sqlite")

 	chunkSize := int64(64 * 1024)
@@ -25,7 +25,7 @@ func TestBackupOfSameSecondRewriteRestoresNewContent(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 	rewrittenPath := filepath.Join(dataDir, "small.txt")
@@ -36,7 +36,7 @@ func TestShallowVerifyDetectsWrongBlobSize(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

 	chunkSize := int64(32 * 1024)
@@ -116,7 +116,7 @@ func TestShallowVerifyDetectsMissingDatabase(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

 	chunkSize := int64(32 * 1024)
@@ -199,7 +199,7 @@ func TestShallowVerifyReportsStatErrorsApartFromMissing(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

 	chunkSize := int64(32 * 1024)
@@ -288,7 +288,7 @@ func TestShallowVerifyQuietFailsOnStatErrorAlone(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

 	chunkSize := int64(32 * 1024)
@@ -39,6 +39,11 @@ var (
 // caller can report it apart from a failed backup.
 var ErrPostBackupPruneFailed = errors.New("post-backup prune failed")

+// ErrFilesUnreadable is returned when --skip-errors skipped files or
+// directories it could not read or list. The snapshot is complete and
+// kept, so the caller can report it apart from a failed backup.
+var ErrFilesUnreadable = errors.New("file(s) could not be read")
+
 // listRecentLimit caps how many snapshot rows are fetched from the
 // local index for listing and purge operations.
 const listRecentLimit = 10000
@@ -95,13 +100,6 @@ func (v *Vaultik) CreateSnapshot(opts *SnapshotCreateOptions) error {
 		return err
 	}

-	// Before PruneDatabase: it drops incomplete snapshots, which could
-	// leave the local index without one and so skip the marker check.
-	err = v.markDestination()
-	if err != nil {
-		return err
-	}
-
 	// Clean up incomplete snapshots FIRST, before any scanning.
 	// This is critical for data safety; PruneDatabase below does it.
 	hostname := v.Config.Hostname
@@ -124,18 +122,34 @@ func (v *Vaultik) CreateSnapshot(opts *SnapshotCreateOptions) error {
 		return fmt.Errorf("prune database: %w", err)
 	}

-	snapshotNames, err := v.snapshotNamesToCreate(opts.Snapshots)
-	if err != nil {
-		return err
+	// Determine which snapshots to process
+	snapshotNames := opts.Snapshots
+	if len(snapshotNames) == 0 {
+		snapshotNames = v.Config.SnapshotNames()
+	} else {
+		// Validate requested snapshot names exist
+		for _, name := range snapshotNames {
+			if _, ok := v.Config.Snapshots[name]; !ok {
+				return fmt.Errorf("%w: %q", errSnapshotNotInConfig, name)
+			}
+		}
+	}
+
+	if len(snapshotNames) == 0 {
+		return errNoSnapshotsInConfig
 	}

 	// Process each named snapshot
+	filesUnreadable := 0
+
 	for snapIdx, snapName := range snapshotNames {
-		err = v.createNamedSnapshot(
+		unreadable, err := v.createNamedSnapshot(
 			opts, hostname, snapName, snapIdx+1, len(snapshotNames))
 		if err != nil {
 			return err
 		}
+
+		filesUnreadable += unreadable
 	}

 	// Print overall summary if multiple snapshots
@@ -151,6 +165,19 @@ func (v *Vaultik) CreateSnapshot(opts *SnapshotCreateOptions) error {
 		}
 	}

+	return v.finishCreateSnapshot(filesUnreadable)
+}
+
+// finishCreateSnapshot ends a run whose snapshots are all complete and
+// kept. Like finishRestore, it returns an error when --skip-errors
+// skipped anything it could not read or list; otherwise it prints the
+// closing line. A file removed during the run is counted as failed in
+// the summary but is not an error, with or without --skip-errors.
+func (v *Vaultik) finishCreateSnapshot(filesUnreadable int) error {
+	if filesUnreadable > 0 {
+		return fmt.Errorf("%d %w", filesUnreadable, ErrFilesUnreadable)
+	}
+
 	// Terminus must obey the --cron invariant: silent on total
 	// success only. UI.Complete is dropped in cron/quiet mode (that's
 	// the success path), but if any warnings fired during the run we
@@ -166,28 +193,6 @@ func (v *Vaultik) CreateSnapshot(opts *SnapshotCreateOptions) error {
 	return nil
 }

-// snapshotNamesToCreate returns the requested snapshot names, each checked
-// against the config, or every configured name when none was requested.
-func (v *Vaultik) snapshotNamesToCreate(requested []string) ([]string, error) {
-	snapshotNames := requested
-	if len(snapshotNames) == 0 {
-		snapshotNames = v.Config.SnapshotNames()
-	} else {
-		// Validate requested snapshot names exist
-		for _, name := range snapshotNames {
-			if _, ok := v.Config.Snapshots[name]; !ok {
-				return nil, fmt.Errorf("%w: %q", errSnapshotNotInConfig, name)
-			}
-		}
-	}
-
-	if len(snapshotNames) == 0 {
-		return nil, errNoSnapshotsInConfig
-	}
-
-	return snapshotNames, nil
-}
-
 // runPostBackupPrune drops older snapshots of the given names and removes
 // orphan blobs from remote storage. If keepNewerThan is set (e.g. "4w"),
 // snapshots newer than that duration are kept. Otherwise only the latest
@@ -240,16 +245,22 @@ type snapshotStats struct {
 	totalBlobsUploaded int
 	uploadDuration     time.Duration

+	// The part of totalFilesFailed that --skip-errors skipped because it
+	// could not be read or listed.
+	totalFilesUnreadable int
+
 	// The sizes of all blobs the snapshot references, set by
 	// finalizeSnapshotMetadata once snapshot_blobs is populated.
 	blobSize             int64
 	blobUncompressedSize int64
 }

-// createNamedSnapshot creates a single named snapshot
+// createNamedSnapshot creates a single named snapshot and returns the
+// number of entries --skip-errors skipped because it could not read or
+// list them.
 func (v *Vaultik) createNamedSnapshot(
 	opts *SnapshotCreateOptions, hostname, snapName string, idx, total int,
-) error {
+) (int, error) {
 	snapshotStartTime := time.Now()

 	if total > 1 {
@@ -258,12 +269,12 @@ func (v *Vaultik) createNamedSnapshot(

 	resolvedDirs, err := v.resolveSnapshotPaths(snapName)
 	if err != nil {
-		return err
+		return 0, err
 	}

 	previousSnapshotID, err := v.previousSnapshotID(snapName)
 	if err != nil {
-		return err
+		return 0, err
 	}

 	scanner := v.ScannerFactory(snapshot.ScannerParams{
@@ -278,7 +289,7 @@ func (v *Vaultik) createNamedSnapshot(
 	snapshotID, err := v.SnapshotManager.CreateSnapshotWithName(
 		v.ctx, hostname, snapName, v.Globals.Version, v.Globals.Commit)
 	if err != nil {
-		return fmt.Errorf("creating snapshot: %w", err)
+		return 0, fmt.Errorf("creating snapshot: %w", err)
 	}

 	log.Info("Beginning snapshot", "snapshot_id", snapshotID, "name", snapName)
@@ -286,12 +297,12 @@ func (v *Vaultik) createNamedSnapshot(

 	stats, err := v.scanAllDirectories(scanner, resolvedDirs, snapshotID)
 	if err != nil {
-		return err
+		return 0, err
 	}

 	err = v.finalizeSnapshotMetadata(snapshotID, stats)
 	if err != nil {
-		return err
+		return 0, err
 	}

 	log.Info("Snapshot complete",
@@ -304,7 +315,7 @@ func (v *Vaultik) createNamedSnapshot(

 	v.printSnapshotSummary(snapshotID, snapshotStartTime, stats)

-	return nil
+	return stats.totalFilesUnreadable, nil
 }

 // previousSnapshotID returns the ID of the most recent completed snapshot
@@ -390,6 +401,7 @@ func (v *Vaultik) scanAllDirectories(
 		stats.totalBlobs += result.BlobsCreated
 		stats.totalFilesSkipped += result.FilesSkipped
 		stats.totalFilesFailed += result.FilesFailed
+		stats.totalFilesUnreadable += result.FilesUnreadable
 		stats.totalBytesSkipped += result.BytesSkipped
 		stats.totalFilesDeleted += result.FilesDeleted
 		stats.totalBytesDeleted += result.BytesDeleted
@@ -1298,18 +1310,10 @@ func (v *Vaultik) RemoveSnapshot(
 		return v.removeSnapshotDryRun(result, snapshotID, opts)
 	}

-	if !v.confirmRemoveSnapshot(snapshotID, opts) {
+	if !opts.Force && !opts.JSON && !v.confirmRemoveSnapshot(snapshotID, opts) {
 		return result, nil
 	}

-	// Checked before the local record is deleted: it may be the last
-	// snapshot in the local index, and the check applies only while the
-	// local index holds one.
-	var markerErr error
-	if !opts.LocalOnly {
-		markerErr = v.checkDestinationMarker()
-	}
-
 	if inLocalIndex {
 		log.Info("Removing snapshot from local database", "snapshot_id", snapshotID)

@@ -1320,7 +1324,7 @@ func (v *Vaultik) RemoveSnapshot(
 	}

 	result.RemoteRemoved, err = v.removeSnapshotRemote(
-		snapshotID, inLocalIndex, markerErr, opts)
+		snapshotID, inLocalIndex, opts)
 	if err != nil {
 		return result, err
 	}
@@ -1357,9 +1361,7 @@ func (v *Vaultik) RemoveSnapshot(
 // remove: no row and, unless LocalOnly is set, no metadata on the
 // destination store either. The destination store is consulted only
 // when the local index has no row, so a snapshot in the local index can
-// still be removed from it while the destination store is unreachable,
-// and only after checkDestinationMarker passes, so an unplugged volume's
-// empty mount point is not taken for a store without the snapshot.
+// still be removed from it while the destination store is unreachable.
 func (v *Vaultik) findSnapshotToRemove(
 	snapshotID string, opts *RemoveOptions,
 ) (bool, error) {
@@ -1379,11 +1381,6 @@ func (v *Vaultik) findSnapshotToRemove(
 			errSnapshotNotFound, snapshotID)
 	}

-	err := v.checkDestinationMarker()
-	if err != nil {
-		return false, err
-	}
-
 	objects, err := v.remoteSnapshotObjects(snapshot.RemoteSnapshotKey(snapshotID))
 	if err != nil {
 		return false, fmt.Errorf("looking up snapshot on destination store: %w", err)
@@ -1422,15 +1419,11 @@ func (v *Vaultik) removeSnapshotDryRun(
 }

 // confirmRemoveSnapshot prompts for confirmation before removing a
-// snapshot, unless --force or --json is set. Returns false (treating
-// EOF/read errors as "no") unless the user answers "y". The prompt and
-// its answer bypass the UI: they are an interactive exchange the
-// operator must see, so --quiet does not silence them.
+// snapshot. Returns false (treating EOF/read errors as "no") unless the
+// user answers "y". The prompt and its answer bypass the UI: they are an
+// interactive exchange the operator must see, so --quiet does not
+// silence them.
 func (v *Vaultik) confirmRemoveSnapshot(snapshotID string, opts *RemoveOptions) bool {
-	if opts.Force || opts.JSON {
-		return true
-	}
-
 	if opts.LocalOnly {
 		v.stdoutf("Remove snapshot '%s' from local database "+
 			"(remote untouched)? [y/N] ", snapshotID)
@@ -1460,17 +1453,15 @@ func (v *Vaultik) confirmRemoveSnapshot(snapshotID string, opts *RemoveOptions)
 // removeSnapshotRemote strips the snapshot's metadata from the
 // destination store. It returns true only when the delete finished
 // without an error and removed at least one object; under LocalOnly it
-// does nothing. markerErr is the result of checkDestinationMarker; when
-// it is set, nothing is deleted and it is the failure. When the snapshot
-// is only on the destination store, a failure is returned as an error,
-// because that removal is all the command does. When the snapshot was in
-// the local index, its removal there has already happened, so a failure
-// is only a warning telling the user to run `vaultik snapshot remove`
-// for the snapshot again once the destination store is reachable
-// (`vaultik prune` never removes snapshot metadata).
+// does nothing. When the snapshot is only on the destination store, a
+// failure is returned as an error, because that removal is all the
+// command does. When the snapshot was in the local index, its removal
+// there has already happened, so a failure is only a warning telling the
+// user to run `vaultik snapshot remove` for the snapshot again once the
+// destination store is reachable (`vaultik prune` never removes snapshot
+// metadata).
 func (v *Vaultik) removeSnapshotRemote(
-	snapshotID string, inLocalIndex bool, markerErr error,
-	opts *RemoveOptions,
+	snapshotID string, inLocalIndex bool, opts *RemoveOptions,
 ) (bool, error) {
 	if opts.LocalOnly {
 		return false, nil
@@ -1479,14 +1470,9 @@ func (v *Vaultik) removeSnapshotRemote(
 	log.Info("Removing snapshot metadata from remote storage",
 		"snapshot_id", snapshotID)

-	var deleted int
-
-	err := markerErr
-	if err == nil {
-		deleted, err = v.deleteRemoteSnapshotByKey(
-			snapshot.RemoteSnapshotKey(snapshotID))
-	}
+	remoteKey := snapshot.RemoteSnapshotKey(snapshotID)

+	deleted, err := v.deleteRemoteSnapshotByKey(remoteKey)
 	if err != nil && !inLocalIndex {
 		return false, fmt.Errorf(
 			"removing snapshot metadata from destination store: %w", err)
@@ -1595,8 +1581,8 @@ func (v *Vaultik) localSnapshotIDs() ([]string, error) {
 // listAllRemoteSnapshotKeys collects the hashed remote keys
 // (subdirectories under metadata/) currently present in the
 // destination store. Returns (nil, err) when the store cannot be
-// listed, or is not present by checkDestinationMarker; callers must
-// treat that as "no remote info available," not fatal.
+// listed; callers must treat that as "no remote info available," not
+// fatal.
 func (v *Vaultik) listAllRemoteSnapshotKeys() ([]string, error) {
 	log.Info("Listing all remote snapshots")

@@ -1645,11 +1631,6 @@ func (v *Vaultik) listAllRemoteSnapshotKeys() ([]string, error) {
 		}
 	}

-	err := v.checkDestinationMarker()
-	if err != nil {
-		return nil, err
-	}
-
 	return keys, nil
 }

@@ -53,7 +53,7 @@ func newDeletedCountEnv(t *testing.T, files map[string][]byte) *deletedCountEnv
 	cfg.IndexPath = filepath.Join(tempDir, "index.sqlite")
 	cfg.Snapshots = map[string]config.SnapshotConfig{}

-	store, err := storage.NewFileStorer(t.TempDir())
+	store, err := storage.NewFileStorer(filepath.Join(tempDir, "remote"))
 	require.NoError(t, err)

 	db, err := database.New(ctx, cfg.IndexPath)
@@ -178,11 +178,13 @@ func TestBackupDoesNotCountFileInUnopenableDirectoryAsDeleted(t *testing.T) {
 	}

 	env.out.Reset()
-	require.NoError(t, env.v.CreateSnapshot(&vaultik.SnapshotCreateOptions{
+	err := env.v.CreateSnapshot(&vaultik.SnapshotCreateOptions{
 		SkipErrors: true,
 		Snapshots:  []string{"work"},
-	}))
-	assert.Contains(t, env.out.String(), filesLine(1, 0, 1))
+	})
+	require.ErrorIs(t, err, vaultik.ErrFilesUnreadable)
+	assert.Contains(t, env.out.String(),
+		"Files: 2 examined, 0 backed up, 1 unchanged, 1 failed.")
 }

 // A backup counts only files that the previous snapshot of its own name
@@ -49,13 +49,19 @@ func TestSnapshotSummaryCountsFileNotStoredAsFailed(t *testing.T) {
 		name       string
 		openErr    error
 		skipErrors bool
+		wantErr    error // nil for none
 	}{
 		// What a normal user gets opening a file with mode 000.
 		{name: "unopenable under skip-errors",
-			openErr: os.ErrPermission, skipErrors: true},
+			openErr: os.ErrPermission, skipErrors: true,
+			wantErr: vaultik.ErrFilesUnreadable},
 		// What opening a file removed after phase 1 gives.
 		{name: "removed between the phases",
 			openErr: os.ErrNotExist, skipErrors: false},
+		// A removal is not an error, so --skip-errors does not make the
+		// run fail. See https://git.eeqj.de/sneak/vaultik/issues/310.
+		{name: "removed between the phases under skip-errors",
+			openErr: os.ErrNotExist, skipErrors: true},
 	}

 	for _, tt := range tests {
@@ -87,7 +93,7 @@ func TestSnapshotSummaryCountsFileNotStoredAsFailed(t *testing.T) {
 				"src": {Paths: []string{srcDir}},
 			}

-			store, err := storage.NewFileStorer(t.TempDir())
+			store, err := storage.NewFileStorer(filepath.Join(tempDir, "remote"))
 			require.NoError(t, err)

 			db, err := database.New(ctx, cfg.IndexPath)
@@ -99,10 +105,11 @@ func TestSnapshotSummaryCountsFileNotStoredAsFailed(t *testing.T) {
 			v := newBackupVaultik(ctx, cfg, store, repos, db, fs)
 			v.UI = ui.NewWithColor(out, false)

-			require.NoError(t, v.CreateSnapshot(&vaultik.SnapshotCreateOptions{
+			err = v.CreateSnapshot(&vaultik.SnapshotCreateOptions{
 				SkipErrors: tt.skipErrors,
 				Snapshots:  []string{"src"},
-			}))
+			})
+			require.ErrorIs(t, err, tt.wantErr)

 			summary := out.String()
 			assert.Contains(t, summary,
@@ -122,9 +122,6 @@ func newListEnv(t *testing.T) *listEnv {
 	store := newObservingStorer()
 	stdout := &bytes.Buffer{}

-	// A backup wrote to this destination, so it carries the marker.
-	require.NoError(t, store.Put(ctx, markerFile, strings.NewReader("")))
-
 	v := &vaultik.Vaultik{
 		Config: &config.Config{
 			AgeSecretKey: "",
@@ -3,6 +3,7 @@ package vaultik_test
 import (
 	"context"
 	"fmt"
+	"os"
 	"path/filepath"
 	"testing"

@@ -45,7 +46,7 @@ func TestSkipErrorsBackupStopsOnIndexErrorRecordingDirectory(t *testing.T) {
 		"tree": {Paths: []string{srcDir}},
 	}

-	store, err := storage.NewFileStorer(t.TempDir())
+	store, err := storage.NewFileStorer(filepath.Join(tempDir, "remote"))
 	require.NoError(t, err)

 	db, err := database.New(ctx, cfg.IndexPath)
@@ -73,3 +74,55 @@ func TestSkipErrorsBackupStopsOnIndexErrorRecordingDirectory(t *testing.T) {
 	require.Len(t, snapshots, 1)
 	assert.Nil(t, snapshots[0].CompletedAt)
 }
+
+// A backup under --skip-errors that skips a file it cannot open, or a
+// directory it cannot list, keeps the snapshot, counts what it skipped
+// as failed and returns an error instead of finishing successfully. See
+// https://git.eeqj.de/sneak/vaultik/issues/310.
+func TestSkipErrorsBackupKeepsSnapshotAndFailsWhenItSkips(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		skipped string // relative to the source directory
+	}{
+		{name: "file it cannot open", skipped: "skipdir/file.txt"},
+		{name: "directory it cannot list", skipped: "skipdir"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			env := newDeletedCountEnv(t, map[string][]byte{
+				"stored.txt":       []byte("stored"),
+				"skipdir/file.txt": []byte("in skipdir"),
+			})
+			env.setSnapshot("work", "")
+
+			// A mode does not lock out root, who runs the tests, so
+			// opening the skipped path is made to fail instead.
+			env.v.Fs = &openFailFs{
+				path: filepath.Join(env.src, tt.skipped),
+				err:  os.ErrPermission,
+			}
+
+			err := env.v.CreateSnapshot(&vaultik.SnapshotCreateOptions{
+				SkipErrors: true,
+				Snapshots:  []string{"work"},
+			})
+			require.ErrorIs(t, err, vaultik.ErrFilesUnreadable)
+
+			assert.Contains(t, env.out.String(),
+				"Files: 2 examined, 1 backed up, 0 unchanged, 1 failed.")
+			assert.NotContains(t, env.out.String(), "Finished successfully.")
+
+			snapshots, err := env.v.Repositories.Snapshots.ListRecent(
+				context.Background(), listRecentTestLimit)
+			require.NoError(t, err)
+			require.Len(t, snapshots, 1)
+			assert.NotNil(t, snapshots[0].CompletedAt, "the snapshot is kept")
+		})
+	}
+}
@@ -84,7 +84,7 @@ func newSummaryEnv(t *testing.T) *summaryEnv {
 		"split":  {Paths: []string{dirOne, dirTwo}},
 	}

-	inner, err := storage.NewFileStorer(t.TempDir())
+	inner, err := storage.NewFileStorer(filepath.Join(tempDir, "remote"))
 	require.NoError(t, err)

 	store := faultstore.New(inner)
@@ -28,7 +28,7 @@ func TestBackupWithoutCronOfTwoPathSnapshotRestoresBothPaths(t *testing.T) {
 	tempDir := t.TempDir()
 	firstDir := filepath.Join(tempDir, "first")
 	secondDir := filepath.Join(tempDir, "second")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

@@ -36,7 +36,7 @@ func TestUncompressedSizeOfChangedFileStaysFixed(t *testing.T) {

 	appendRandomBytes(t, fs, files, changedPath, appendedFileSize)

-	store, err := storage.NewFileStorer(t.TempDir())
+	store, err := storage.NewFileStorer(filepath.Join(tempDir, "remote"))
 	require.NoError(t, err)

 	db, err := database.New(ctx, dbPath)
@@ -28,7 +28,7 @@ func TestVerify_QuietSuppressesReport(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

 	chunkSize := int64(32 * 1024)