Stop snapshot purge when a snapshot cannot leave the local index (closes #337 )

snapshot purge, and the purge step of snapshot create --prune, logged a failed local index delete, then deleted that snapshot's metadata from the destination store anyway and exited 0, leaving a local record whose metadata was gone. It now stops at that snapshot with an error, before touching its metadata, so the command exits non-zero; snapshots already purged stay purged. This matches how the same loop already handles a failed metadata delete. Model: opus-5-5
2026-10-13 19:35:57 +00:00
40 changed files with 215 additions and 1006 deletions
@@ -311,8 +311,6 @@ Repository interfaces:

 ```
 CreateSnapshot(opts)
-    │
-    ├─► markDestination()   // Refuse a destination without the marker, then write it
    │
    ├─► PruneDatabase()   // Critical: avoid dedup errors
    │
@@ -369,8 +367,6 @@ CreateSnapshot(opts)

 ```
 bucket/
-├── vaultik-destination.txt          # Marker written by every backup
-│
 ├── blobs/
 │   └── {hash[0:2]}/
 │       └── {hash[2:4]}/
@@ -382,15 +378,6 @@ bucket/
        └── manifest.json.zst        # Blob list (for pruning/verification)
 ```

-While the local index holds snapshots, a destination without
-`vaultik-destination.txt` is treated as not present
-(`checkDestinationMarker` in `internal/vaultik/destination_marker.go`):
-`snapshot create` refuses to write to it, and listing it fails as for a
-destination that cannot be listed. An unplugged volume's empty mount point
-is therefore never taken for a destination whose snapshots are all gone.
-The `file://` backend never creates its destination directory, so a write
-to a missing one fails.
-
 The `{remote-key}` directory name is a one-way double SHA-256 hash of the human
 snapshot ID, so the human ID (hostname, snapshot name, timestamp) is never
 written to the store as a directory name. See
@@ -24,10 +24,6 @@ grep 'public key' vaultik_backup_private_key.txt
 vaultik config set age_recipients.0 age1YOUR_PUBLIC_KEY_HERE
 vaultik config set storage_url "file:///Volumes/usbstick/mybackup"

-# create the destination directory; vaultik never creates it, so a backup
-# to a volume that is not plugged in fails instead of filling the disk
-mkdir /Volumes/usbstick/mybackup
-
 # macOS only: grant your terminal app Full Disk Access first
 # (System Settings → Privacy & Security → Full Disk Access), otherwise
 # the backup will abort with a permission error on protected directories
@@ -293,10 +289,6 @@ needed.
  this duration instead of only the latest (e.g. `4w`, `30d`, `6mo`, `1y`).
  Without `--prune`, or with a value that is not a valid duration, the
  command fails before the backup starts.
-* Fails before it writes anything when a `file://` destination directory
-  does not exist, or when the local index holds snapshots and the
-  destination has no `vaultik-destination.txt` (see
-  [remote storage layout](#remote-storage-layout))

 **`snapshot list`**: Show every snapshot known to this host — the union
 of the local index and the backup destination store — with timestamps
@@ -326,10 +318,7 @@ invocation that reconciles them.

 If the destination store cannot be listed (unmounted volume,
 permission denied, network down), the command warns, falls back to the
-local index alone, and still exits zero. It does the same when the
-local index holds snapshots and the destination has no
-`vaultik-destination.txt`, as when a volume mounted at the destination
-is unplugged and leaves its empty mount point behind.
+local index alone, and still exits zero.
 * `--json`: Output in JSON format. Each entry carries `locally_tracked`
  (whether the snapshot is in the local index), `remote_key` (the full
  64-character storage key), and `remote_present` (whether it was seen
@@ -350,7 +339,9 @@ is unplugged and leaves its empty mount point behind.

 **`snapshot purge`**: Remove old snapshots based on criteria. Retention is
 per-snapshot-name (`--keep-latest` keeps the latest of each name, not the
-latest globally).
+latest globally). If a snapshot cannot be removed from the local index, the
+command stops there, leaves that snapshot's metadata on the destination store
+and exits non-zero; `snapshot create --prune` fails the same way.
 * `--keep-latest`: Keep only the most recent snapshot of each name
 * `--older-than <duration>`: Remove snapshots older than duration (e.g. `30d`,
  `4w`, `6mo`, `1y`; `m` is minutes, `mo` is months)
@@ -367,13 +358,11 @@ prune` invocation to run as a follow-up. An ID that names no snapshot in
 the local index or on the destination store is an error; with
 `--local-only`, the snapshot must be in the local index. Local row
 cleanup (files, chunks, blobs the snapshot was the last referrer for)
-runs automatically. If the destination store is unreachable, or the
-local index holds snapshots and the destination has no
-`vaultik-destination.txt`, the local-DB removal still completes and a
-warning is emitted; run `vaultik snapshot remove <snapshot-id>` again
-once the store is reachable to remove the snapshot's metadata from it
-(`vaultik prune` does not). To wipe everything on the destination in one
-go, use `vaultik remote nuke --force`.
+runs automatically. If the destination store is unreachable, the local-DB
+removal still completes and a warning is emitted; run `vaultik snapshot
+remove <snapshot-id>` again once the store is reachable to remove the
+snapshot's metadata from it (`vaultik prune` does not). To wipe everything
+on the destination in one go, use `vaultik remote nuke --force`.
 * `--local-only`: Skip remote cleanup; only touch the local index
 * `--dry-run`: Show what would be deleted without deleting
 * `--force`: Skip confirmation prompt
@@ -402,12 +391,8 @@ manifest on the destination store to compute the still-referenced blob
 set and delete any blob not in that set. Step (3) reads all remote
 manifests — network cost scales with the number of snapshots. `snapshot
 create --prune` runs the same cleanup automatically; this is the
-manual entry point for the same work. If the destination store cannot
-be listed, or the local index holds snapshots and the destination has
-no `vaultik-destination.txt` (an unplugged volume's empty mount point),
-prune fails and deletes nothing. `snapshot purge` does the same. If a
-blob cannot be deleted, the command (and `snapshot create --prune`)
-exits non-zero.
+manual entry point for the same work. If a blob cannot be deleted, the
+command (and `snapshot create --prune`) exits non-zero.
 * `--force`: Skip confirmation prompt
 * `--json`: Output stats as JSON. Also skips the confirmation prompt, as
  `--force` does. A blob that cannot be deleted is counted in
@@ -430,12 +415,11 @@ under `blobs/` whose name is not a blob hash is not counted as a blob,
 since `prune` never deletes it.
 * `--json`: Output as JSON

-**`remote nuke`**: Delete every snapshot's metadata, every blob and
-`vaultik-destination.txt` from the backup destination store, leaving the
-bucket prefix empty. Destructive and irreversible. This is the single
-supported way to wipe the entire destination store. If anything cannot
-be deleted, the command exits non-zero; running it again deletes what is
-left.
+**`remote nuke`**: Delete every snapshot's metadata and every blob from the
+backup destination store, leaving the bucket prefix empty. Destructive and
+irreversible. This is the single supported way to wipe the entire
+destination store. If anything cannot be deleted, the command exits
+non-zero; running it again deletes what is left.
 * `--force`: Required to confirm destruction.

 **`database delete`**: Delete the local SQLite state database file
@@ -460,12 +444,7 @@ object store. Credentials are read from `s3.access_key_id` and
 a local or mounted filesystem. Useful for testing or backing up to a NAS. The
 path must be absolute; a relative one is refused when the config loads.
 Percent-escapes in the path are decoded, so `my%20stick` and `my stick` name
-the same directory. The directory must exist before the first backup: vaultik
-never creates it. A directory on a removable volume is gone while the volume is
-not mounted, so a backup then fails instead of writing to the disk under the
-mount point. The mount point itself stays behind when the volume is unplugged:
-there only `vaultik-destination.txt` stops such a backup, and only while the
-local index holds snapshots.
+the same directory.

 **Rclone** (`rclone://remote/path`): Uses rclone's 70+ supported cloud
 providers. Requires rclone to be configured separately (`rclone config`).
@@ -496,7 +475,6 @@ For an implementation-level view of the internals — the data model, the

 ```
 <bucket>/<prefix>/
-├── vaultik-destination.txt     # Marker written by every backup
 ├── blobs/
 │   └── <aa>/<bb>/<full_blob_hash>
 └── metadata/
@@ -505,15 +483,6 @@ For an implementation-level view of the internals — the data model, the
        └── manifest.json.zst   # Unencrypted blob list (for pruning)
 ```

-* `vaultik-destination.txt` holds one fixed line of text, with no host
-  name, path or time. While the local index holds snapshots, a
-  destination without it is treated as not present: `snapshot create`
-  refuses to write to it, `prune` and `snapshot purge` fail, and
-  `snapshot list` and `snapshot remove` warn, as for a destination that
-  cannot be listed. This keeps an unplugged volume's empty mount point
-  from being taken for a destination whose snapshots are all gone. Mount
-  the volume if it is removable; if the destination was emptied on
-  purpose, run `vaultik database delete` and back up again.
 * Blobs are two-level directory sharded using the first 4 hex chars of the blob hash
 * `db.zst.age` is a binary SQLite database (zstd compressed, age encrypted)
  containing all file metadata, chunk mappings, and relationships for the snapshot
@@ -4,7 +4,7 @@ This document describes the structure and organization of data stored in the S3

 ## Overview

-Vaultik stores all backup data in an S3-compatible object store. The repository consists of two main components, plus a marker file:
+Vaultik stores all backup data in an S3-compatible object store. The repository consists of two main components:
 1. **Blobs** - The actual backup data (content-addressed, encrypted)
 2. **Metadata** - Snapshot information and manifests (partially encrypted)

@@ -12,7 +12,6 @@ Vaultik stores all backup data in an S3-compatible object store. The repository

 ```
 <bucket>/<prefix>/
-├── vaultik-destination.txt
 ├── blobs/
 │   └── <hash[0:2]>/
 │       └── <hash[2:4]>/
@@ -25,10 +24,6 @@ Vaultik stores all backup data in an S3-compatible object store. The repository

 The metadata subdirectory is named with the **remote key**, a one-way hash of the snapshot ID, not with the human-readable snapshot ID itself. See [Remote Key Derivation](#remote-key-derivation).

-## Marker File (`vaultik-destination.txt`)
-
-Every backup writes this file at the root before it uploads anything. It holds one fixed line of plain text and names no host, path or time. While the local index holds snapshots, a destination without it is treated as not present: `snapshot create` refuses to write to it, and `prune`, `snapshot purge`, `snapshot remove` and `snapshot list` behave as for a destination that cannot be listed. An unplugged volume leaves an empty directory at its mount point, and without the marker that directory would read as a destination whose snapshots are all gone. `remote nuke` deletes the marker last.
-
 ## Blobs Directory (`blobs/`)

 ### Structure
@@ -101,8 +101,7 @@ func TestEntryPruneJSONStdoutIsExactlyOneDocument(t *testing.T) {
 // writeHermeticPruneConfig builds a config over a temp directory with an
 // empty destination directory and, if seedStale is set, creates the
 // index database up front with one snapshot record that has no
-// counterpart on the destination store, and gives the destination the
-// marker a backup writes. Returns the config path.
+// counterpart on the destination store. Returns the config path.
 func writeHermeticPruneConfig(t *testing.T, seedStale bool) string {
 	t.Helper()

@@ -132,11 +131,6 @@ func writeHermeticPruneConfig(t *testing.T, seedStale bool) string {

 	if seedStale {
 		seedStaleSnapshotRecord(t, indexPath)
-
-		// While the local index holds a snapshot, prune fails on a
-		// destination without the marker a backup writes.
-		require.NoError(t, os.WriteFile(
-			filepath.Join(storeDir, "vaultik-destination.txt"), nil, 0o600))
 	}

 	return configPath
@@ -0,0 +1,90 @@
+package cli //nolint:testpackage // shares runEntry and the hermetic config helpers
+
+import (
+	"context"
+	"database/sql"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/vaultik/internal/database"
+	"sneak.berlin/go/vaultik/internal/snapshot"
+	"sneak.berlin/go/vaultik/internal/types"
+)
+
+// The `snapshot purge` command word and flags used below.
+const (
+	cmdPurge       = "purge"
+	flagKeepLatest = "--keep-latest"
+	flagForce      = "--force"
+)
+
+// TestEntrySnapshotPurgeKeepsMetadataWhenLocalIndexDeleteFails makes
+// removing a snapshot from the local index fail and checks that
+// `snapshot purge` exits non-zero and leaves that snapshot's metadata on
+// the destination store. It used to log the error, delete the metadata
+// anyway and exit 0.
+//
+//nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
+func TestEntrySnapshotPurgeKeepsMetadataWhenLocalIndexDeleteFails(t *testing.T) {
+	ctx := context.Background()
+	configPath := writeHermeticPruneConfig(t, false)
+
+	// writeHermeticPruneConfig puts the index and the store directory
+	// beside the config file.
+	dir := filepath.Dir(configPath)
+
+	// Two snapshots of the same name: --keep-latest purges the older.
+	olderStart := time.Date(2026, 5, 1, 9, 0, 0, 0, time.UTC)
+	newerStart := olderStart.Add(time.Hour)
+	olderID := "test-host_test_" + olderStart.Format(time.RFC3339)
+	newerID := "test-host_test_" + newerStart.Format(time.RFC3339)
+
+	db, err := database.New(ctx, filepath.Join(dir, "index.sqlite"))
+	require.NoError(t, err)
+
+	repos := database.NewRepositories(db)
+
+	manifestPaths := make(map[string]string)
+
+	for id, startedAt := range map[string]time.Time{
+		olderID: olderStart,
+		newerID: newerStart,
+	} {
+		completedAt := startedAt.Add(time.Minute)
+		snap := &database.Snapshot{
+			ID:             types.SnapshotID(id),
+			Hostname:       "test-host",
+			VaultikVersion: "test",
+			StartedAt:      startedAt,
+			CompletedAt:    &completedAt,
+		}
+
+		err = repos.WithTx(ctx, func(ctx context.Context, tx *sql.Tx) error {
+			return repos.Snapshots.Create(ctx, tx, snap)
+		})
+		require.NoError(t, err)
+
+		manifestPaths[id] = filepath.Join(dir, "store", "metadata",
+			snapshot.RemoteSnapshotKey(id), "manifest.json.zst")
+		require.NoError(t, os.MkdirAll(filepath.Dir(manifestPaths[id]), 0o750))
+		require.NoError(t, os.WriteFile(manifestPaths[id], []byte("stub"), 0o600))
+	}
+
+	_, err = db.Conn().ExecContext(ctx, `
+		CREATE TRIGGER refuse_snapshot_delete BEFORE DELETE ON snapshots
+		BEGIN SELECT RAISE(ABORT, 'simulated index error'); END`)
+	require.NoError(t, err)
+	require.NoError(t, db.Close())
+
+	code, _, stderr := runEntry(t,
+		flagConfig, configPath, cmdSnapshot, cmdPurge, flagKeepLatest, flagForce)
+
+	assert.Equal(t, 1, code)
+	assert.Contains(t, stderr, "simulated index error")
+	assert.FileExists(t, manifestPaths[olderID],
+		"a snapshot still in the local index keeps its metadata")
+}
@@ -21,13 +21,9 @@ type FileStorer struct {
 // NewFileStorer creates a new filesystem storage backend.
 //
 // Construction is intentionally cheap and does not touch the filesystem.
-// The backend never creates basePath: the user does, so that when
-// basePath is a directory on an unplugged volume, a write fails instead
-// of landing on the disk under the mount point. This does not hold when
-// basePath is the mount point itself, which stays behind when its volume
-// is unplugged.
-// Put and PutWithProgress fail on a missing basePath and create the
-// directories below it as needed.
+// The basePath is recorded; the directory is created lazily on first
+// write. Write operations (Put/PutWithProgress) call MkdirAll for the
+// per-blob parent directory, which also covers basePath on first use.
 // Get and Stat report a key under a missing basePath as ErrNotFound.
 // List and ListStream fail on a missing basePath, because listing it as
 // an empty store would make `prune` drop every local snapshot record.
@@ -124,10 +120,9 @@ func (f *FileStorer) Delete(_ context.Context, key string) error {
 	return nil
 }

-// List returns all keys with the given prefix, reading through symlinked
-// directories. It fails when the destination directory is missing, or
-// when the prefix or a directory above it is a symlink whose target is
-// missing; a prefix that is truly missing is an empty listing.
+// List returns all keys with the given prefix. It fails when the
+// destination directory is missing; a missing prefix under it is an
+// empty listing.
 func (f *FileStorer) List(ctx context.Context, prefix string) ([]string, error) {
 	var keys []string

@@ -138,7 +133,8 @@ func (f *FileStorer) List(ctx context.Context, prefix string) ([]string, error)

 	basePath := f.fullPath(prefix)

-	exists, err := f.prefixExists(prefix)
+	// Check if the prefix exists
+	exists, err := afero.Exists(f.fs, basePath)
 	if err != nil {
 		return nil, fmt.Errorf("checking path: %w", err)
 	}
@@ -147,7 +143,7 @@ func (f *FileStorer) List(ctx context.Context, prefix string) ([]string, error)
 		return keys, nil // Empty list for non-existent prefix
 	}

-	err = f.walk(basePath, func(path string, info os.FileInfo, err error) error {
+	err = afero.Walk(f.fs, basePath, func(path string, info os.FileInfo, err error) error {
 		if err != nil {
 			return err
 		}
@@ -180,9 +176,7 @@ func (f *FileStorer) List(ctx context.Context, prefix string) ([]string, error)
 }

 // ListStream returns a channel of ObjectInfo for large result sets. Like
-// List, it reads through symlinked directories and sends an error when
-// the destination directory is missing, or when the prefix or a directory
-// above it is a symlink whose target is missing.
+// List, it sends an error when the destination directory is missing.
 func (f *FileStorer) ListStream(ctx context.Context, prefix string) <-chan ObjectInfo {
 	ch := make(chan ObjectInfo)

@@ -198,7 +192,8 @@ func (f *FileStorer) ListStream(ctx context.Context, prefix string) <-chan Objec

 		basePath := f.fullPath(prefix)

-		exists, err := f.prefixExists(prefix)
+		// Check if the prefix exists
+		exists, err := afero.Exists(f.fs, basePath)
 		if err != nil {
 			ch <- ObjectInfo{Err: fmt.Errorf("checking path: %w", err)}

@@ -209,7 +204,7 @@ func (f *FileStorer) ListStream(ctx context.Context, prefix string) <-chan Objec
 			return // Empty channel for non-existent prefix
 		}

-		_ = f.walk(basePath, func(path string, info os.FileInfo, err error) error {
+		_ = afero.Walk(f.fs, basePath, func(path string, info os.FileInfo, err error) error {
 			// Check context cancellation
 			select {
 			case <-ctx.Done():
@@ -248,12 +243,11 @@ func (f *FileStorer) ListStream(ctx context.Context, prefix string) <-chan Objec
 }

 // DeletePartialUploads removes every file under prefix whose name ends in
-// tempSuffix. Like List, it reads through symlinked directories and fails
-// on one whose target is missing. A missing prefix has none to remove.
+// tempSuffix. A missing prefix has none to remove.
 func (f *FileStorer) DeletePartialUploads(ctx context.Context, prefix string) error {
 	basePath := f.fullPath(prefix)

-	exists, err := f.prefixExists(prefix)
+	exists, err := afero.Exists(f.fs, basePath)
 	if err != nil {
 		return fmt.Errorf("checking path: %w", err)
 	}
@@ -262,7 +256,7 @@ func (f *FileStorer) DeletePartialUploads(ctx context.Context, prefix string) er
 		return nil
 	}

-	err = f.walk(basePath, func(path string, info os.FileInfo, err error) error {
+	err = afero.Walk(f.fs, basePath, func(path string, info os.FileInfo, err error) error {
 		if err != nil {
 			return err
 		}
@@ -303,19 +297,7 @@ func (f *FileStorer) writeAtomic(
 	path := f.fullPath(key)
 	dir := filepath.Dir(path)

-	// Checked on every write, so a destination that disappears part-way
-	// through a backup fails it rather than being recreated by MkdirAll.
-	_, err := f.fs.Stat(f.basePath)
-	if os.IsNotExist(err) {
-		return fmt.Errorf("destination directory does not exist; "+
-			"create it, or mount the volume it is on: %w", err)
-	}
-
-	if err != nil {
-		return fmt.Errorf("checking destination directory: %w", err)
-	}
-
-	err = f.fs.MkdirAll(dir, storageDirPerm)
+	err := f.fs.MkdirAll(dir, storageDirPerm)
 	if err != nil {
 		return fmt.Errorf("creating directories: %w", err)
 	}
@@ -370,54 +352,6 @@ func (f *FileStorer) writeAtomic(
 	return nil
 }

-// walk is afero.Walk, except that it reads through a symlinked directory
-// the way Get and Stat do, where afero.Walk reports the link as one file.
-// afero.Walk uses Lstat, which does not follow a link, whenever the
-// filesystem has one; the struct below carries only the afero.Fs methods,
-// so the walk uses Stat instead. A link back up the tree is followed until
-// the operating system refuses the path for too many levels of links, and
-// the walk then fails.
-func (f *FileStorer) walk(root string, fn filepath.WalkFunc) error {
-	return afero.Walk(struct{ afero.Fs }{f.fs}, root, fn)
-}
-
-// prefixExists reports whether prefix exists under the destination
-// directory. It checks each directory on the way down to prefix in turn,
-// and the first one Stat cannot find decides: if it is not there at all,
-// prefix is missing; if it is a symlink whose target is missing, such as
-// a link to a volume that is not mounted, prefixExists fails, since
-// listing it as empty would let prune delete every blob.
-func (f *FileStorer) prefixExists(prefix string) (bool, error) {
-	lstater, canLstat := f.fs.(afero.Lstater)
-	path := f.basePath
-
-	for name := range strings.SplitSeq(prefix, "/") {
-		path = filepath.Join(path, name)
-
-		_, err := f.fs.Stat(path)
-		if err == nil {
-			continue
-		}
-
-		if !os.IsNotExist(err) {
-			return false, err
-		}
-
-		// Lstat does not follow a symlink at path, so it finds the link
-		// that Stat could not follow.
-		if canLstat {
-			_, _, lstatErr := lstater.LstatIfPossible(path)
-			if lstatErr == nil {
-				return false, err
-			}
-		}
-
-		return false, nil
-	}
-
-	return true, nil
-}
-
 // fullPath returns the full filesystem path for a key.
 func (f *FileStorer) fullPath(key string) string {
 	return filepath.Join(f.basePath, key)
@@ -4,10 +4,7 @@ import (
 	"context"
 	"errors"
 	"io/fs"
-	"os"
 	"path/filepath"
-	"reflect"
-	"strings"
 	"testing"

 	"sneak.berlin/go/vaultik/internal/storage"
@@ -63,272 +60,3 @@ func TestFileStorerListMissingDestination(t *testing.T) {
 		t.Errorf("ListStream error = %v, want a not-exist error", streamErr)
 	}
 }
-
-// The two directories at the top of a destination, either of which the
-// tests below replace with a symlink.
-const (
-	metadataDir = "metadata"
-	blobsDir    = "blobs"
-)
-
-// moveBehindSymlink moves base/dir to a directory elsewhere and puts a
-// symlink to it in its place.
-func moveBehindSymlink(t *testing.T, base, dir string) {
-	t.Helper()
-
-	linkPath := filepath.Join(base, dir)
-	movedPath := filepath.Join(t.TempDir(), dir)
-
-	err := os.Rename(linkPath, movedPath)
-	if err != nil {
-		t.Fatalf("moving %s away: %v", dir, err)
-	}
-
-	err = os.Symlink(movedPath, linkPath)
-	if err != nil {
-		t.Fatalf("linking %s: %v", dir, err)
-	}
-}
-
-// TestFileStorerListsThroughSymlinkedDirectory checks that List and
-// ListStream read through a symlinked metadata/ or blobs/ directory, as Get
-// and Stat do, instead of listing the link as one key. Listing the whole
-// destination meets the link part-way through the walk; listing its prefix
-// starts the walk at the link. A prefix missing behind the link lists as
-// empty.
-func TestFileStorerListsThroughSymlinkedDirectory(t *testing.T) {
-	t.Parallel()
-
-	for _, dir := range []string{metadataDir, blobsDir} {
-		t.Run(dir, func(t *testing.T) {
-			t.Parallel()
-
-			base := t.TempDir()
-			key := dir + "/aa/bb/object"
-
-			s, err := storage.NewFileStorer(base)
-			if err != nil {
-				t.Fatalf("NewFileStorer: %v", err)
-			}
-
-			err = s.Put(context.Background(), key, strings.NewReader("data"))
-			if err != nil {
-				t.Fatalf("Put: %v", err)
-			}
-
-			moveBehindSymlink(t, base, dir)
-
-			want := []string{key}
-
-			for _, prefix := range []string{"", dir + "/"} {
-				got := listSorted(t, s, prefix)
-				if !reflect.DeepEqual(got, want) {
-					t.Errorf("List(%q) = %v, want %v", prefix, got, want)
-				}
-
-				got = listStreamKeys(t, s, prefix)
-				if !reflect.DeepEqual(got, want) {
-					t.Errorf("ListStream(%q) = %v, want %v", prefix, got, want)
-				}
-			}
-
-			absent := dir + "/absent/"
-
-			if got := listSorted(t, s, absent); len(got) != 0 {
-				t.Errorf("List(%q) = %v, want empty", absent, got)
-			}
-
-			if got := listStreamKeys(t, s, absent); len(got) != 0 {
-				t.Errorf("ListStream(%q) = %v, want empty", absent, got)
-			}
-		})
-	}
-}
-
-// TestFileStorerListFailsOnSymlinkWithMissingTarget checks that List and
-// ListStream fail on a symlinked metadata/ or blobs/ directory whose target
-// is missing, such as a link to a volume that is not mounted, as they do on
-// a missing destination directory, instead of listing it as empty. That
-// holds for a prefix below the link too.
-func TestFileStorerListFailsOnSymlinkWithMissingTarget(t *testing.T) {
-	t.Parallel()
-
-	ctx := context.Background()
-
-	for _, dir := range []string{metadataDir, blobsDir} {
-		t.Run(dir, func(t *testing.T) {
-			t.Parallel()
-
-			base := t.TempDir()
-
-			s, err := storage.NewFileStorer(base)
-			if err != nil {
-				t.Fatalf("NewFileStorer: %v", err)
-			}
-
-			unmounted := filepath.Join(t.TempDir(), "unmounted")
-
-			err = os.Symlink(unmounted, filepath.Join(base, dir))
-			if err != nil {
-				t.Fatalf("Symlink: %v", err)
-			}
-
-			for _, prefix := range []string{"", dir + "/", dir + "/aa/"} {
-				keys, err := s.List(ctx, prefix)
-				if !errors.Is(err, fs.ErrNotExist) {
-					t.Errorf("List(%q) = %v, %v; want a not-exist error",
-						prefix, keys, err)
-				}
-
-				var streamErr error
-
-				for object := range s.ListStream(ctx, prefix) {
-					if object.Err != nil {
-						streamErr = object.Err
-					}
-				}
-
-				if !errors.Is(streamErr, fs.ErrNotExist) {
-					t.Errorf("ListStream(%q) error = %v, want a not-exist error",
-						prefix, streamErr)
-				}
-			}
-		})
-	}
-}
-
-// TestFileStorerListFailsOnSymlinkLoop checks that a symlink pointing back
-// at the destination makes List and ListStream fail instead of walking it
-// forever.
-func TestFileStorerListFailsOnSymlinkLoop(t *testing.T) {
-	t.Parallel()
-
-	ctx := context.Background()
-	base := t.TempDir()
-
-	s, err := storage.NewFileStorer(base)
-	if err != nil {
-		t.Fatalf("NewFileStorer: %v", err)
-	}
-
-	err = s.Put(ctx, testBlobKey, strings.NewReader("data"))
-	if err != nil {
-		t.Fatalf("Put: %v", err)
-	}
-
-	err = os.Symlink(base, filepath.Join(base, "blobs", "loop"))
-	if err != nil {
-		t.Fatalf("Symlink: %v", err)
-	}
-
-	keys, err := s.List(ctx, "blobs/")
-	if err == nil {
-		t.Errorf("List = %d keys and no error, want an error", len(keys))
-	}
-
-	var streamErr error
-
-	for object := range s.ListStream(ctx, "blobs/") {
-		if object.Err != nil {
-			streamErr = object.Err
-		}
-	}
-
-	if streamErr == nil {
-		t.Error("ListStream sent no error, want one")
-	}
-}
-
-// TestFileStorerDeletePartialUploadsThroughSymlinkedDirectory checks that
-// DeletePartialUploads, which remote nuke uses, removes a leftover temp
-// file behind a symlinked metadata/ or blobs/ directory and keeps the
-// object at the real key.
-func TestFileStorerDeletePartialUploadsThroughSymlinkedDirectory(t *testing.T) {
-	t.Parallel()
-
-	ctx := context.Background()
-
-	for _, dir := range []string{metadataDir, blobsDir} {
-		t.Run(dir, func(t *testing.T) {
-			t.Parallel()
-
-			base := t.TempDir()
-			key := dir + "/aa/bb/object"
-
-			s, err := storage.NewFileStorer(base)
-			if err != nil {
-				t.Fatalf("NewFileStorer: %v", err)
-			}
-
-			err = s.Put(ctx, key, strings.NewReader("data"))
-			if err != nil {
-				t.Fatalf("Put: %v", err)
-			}
-
-			leftover := filepath.Join(base, key+"-123456.partial")
-
-			err = os.WriteFile(leftover, []byte("half"), 0o600)
-			if err != nil {
-				t.Fatalf("writing leftover temp file: %v", err)
-			}
-
-			moveBehindSymlink(t, base, dir)
-
-			err = s.DeletePartialUploads(ctx, dir+"/")
-			if err != nil {
-				t.Fatalf("DeletePartialUploads: %v", err)
-			}
-
-			// leftover runs through the link.
-			_, err = os.Stat(leftover)
-			if !os.IsNotExist(err) {
-				t.Errorf("leftover temp file was not removed: %v", err)
-			}
-
-			_, err = s.Stat(ctx, key)
-			if err != nil {
-				t.Errorf("Stat of the real key: %v", err)
-			}
-		})
-	}
-}
-
-// TestFileStorerPutMissingDestination checks that a write fails when the
-// destination directory has gone, even after earlier writes to it
-// succeeded, and that it does not create the directory again.
-func TestFileStorerPutMissingDestination(t *testing.T) {
-	t.Parallel()
-
-	ctx := context.Background()
-	base := filepath.Join(t.TempDir(), "usbstick")
-
-	err := os.Mkdir(base, 0o750)
-	if err != nil {
-		t.Fatalf("Mkdir: %v", err)
-	}
-
-	s, err := storage.NewFileStorer(base)
-	if err != nil {
-		t.Fatalf("NewFileStorer: %v", err)
-	}
-
-	err = s.Put(ctx, "blobs/aa/bb/first", strings.NewReader("first"))
-	if err != nil {
-		t.Fatalf("first Put: %v", err)
-	}
-
-	err = os.Rename(base, base+"-unplugged")
-	if err != nil {
-		t.Fatalf("Rename: %v", err)
-	}
-
-	err = s.Put(ctx, "blobs/aa/bb/second", strings.NewReader("second"))
-	if !errors.Is(err, fs.ErrNotExist) {
-		t.Errorf("Put = %v, want a not-exist error", err)
-	}
-
-	_, err = os.Stat(base)
-	if !errors.Is(err, fs.ErrNotExist) {
-		t.Errorf("Put created the destination directory again (Stat = %v)", err)
-	}
-}
@@ -41,8 +41,7 @@ type Info struct {
 // directory for filesystem).
 type Storer interface {
 	// Put stores data at the specified key.
-	// The filesystem backend fails when its destination directory does
-	// not exist, and creates the directories below it as needed.
+	// Parent directories are created automatically for filesystem backends.
 	Put(ctx context.Context, key string, data io.Reader) error

 	// PutWithProgress stores data with progress reporting.
@@ -137,7 +137,7 @@ func TestBackupAfterRemovingNewestSnapshotRestoresChangedFile(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 	changedPath := filepath.Join(dataDir, "appended.bin")
@@ -184,7 +184,7 @@ func TestBackupAfterInterruptedRunRestoresChangedFile(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 	changedPath := filepath.Join(dataDir, "appended.bin")
@@ -34,7 +34,7 @@ func TestDeepVerifyAcceptsHealthyAndRejectsCorruptBlob(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

 	chunkSize := int64(64 * 1024)
@@ -1,74 +0,0 @@
-package vaultik
-
-import (
-	"errors"
-	"fmt"
-	"strings"
-
-	"sneak.berlin/go/vaultik/internal/storage"
-)
-
-// destinationMarkerKey is the object every backup writes at the root of
-// the backup destination store. While the local index holds a snapshot,
-// a destination without it is treated as not present: an unplugged
-// volume leaves an empty directory at its mount point, which would
-// otherwise read as a store whose snapshots are all gone.
-const destinationMarkerKey = "vaultik-destination.txt"
-
-// destinationMarkerText is the whole content of the marker. It names no
-// host, path or time.
-const destinationMarkerText = "This is a vaultik backup destination store.\n"
-
-// errDestinationNotPresent is returned when the local index holds a
-// snapshot and the backup destination store has no marker.
-var errDestinationNotPresent = errors.New("backup destination store is not present")
-
-// checkDestinationMarker returns errDestinationNotPresent when the local
-// index holds a snapshot and the backup destination store has no marker.
-// With no snapshot in the local index, as on a first backup or on
-// another machine, there is nothing to check.
-func (v *Vaultik) checkDestinationMarker() error {
-	ids, err := v.localSnapshotIDs()
-	if err != nil {
-		return fmt.Errorf("listing local snapshots: %w", err)
-	}
-
-	if len(ids) == 0 {
-		return nil
-	}
-
-	_, err = v.Storage.Stat(v.ctx, destinationMarkerKey)
-	if errors.Is(err, storage.ErrNotFound) {
-		return fmt.Errorf("%w: %s has no %s, but the local index holds "+
-			"snapshots stored there; mount the volume if it is removable, "+
-			"or if the destination was emptied on purpose, run "+
-			"'vaultik database delete' and back up again",
-			errDestinationNotPresent, v.Storage.Info().Location,
-			destinationMarkerKey)
-	}
-
-	if err != nil {
-		return fmt.Errorf("checking for %s: %w", destinationMarkerKey, err)
-	}
-
-	return nil
-}
-
-// markDestination checks the backup destination store with
-// checkDestinationMarker and then writes the marker, so a first backup
-// marks its destination and a later one writes the same text again.
-func (v *Vaultik) markDestination() error {
-	err := v.checkDestinationMarker()
-	if err != nil {
-		return err
-	}
-
-	err = v.Storage.Put(v.ctx, destinationMarkerKey,
-		strings.NewReader(destinationMarkerText))
-	if err != nil {
-		return fmt.Errorf("writing %s to the backup destination store: %w",
-			destinationMarkerKey, err)
-	}
-
-	return nil
-}
@@ -1,184 +0,0 @@
-package vaultik_test
-
-import (
-	"bytes"
-	"context"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/vaultik/internal/database"
-	"sneak.berlin/go/vaultik/internal/log"
-	"sneak.berlin/go/vaultik/internal/vaultik"
-)
-
-// These tests cover https://git.eeqj.de/sneak/vaultik/issues/239: a
-// file:// destination at a volume's mount point leaves an empty directory
-// behind when the volume is unplugged. While the local index holds
-// snapshots, a destination without vaultik-destination.txt is not present,
-// so no command may write to it or conclude from it that the local
-// snapshots are gone.
-
-// markerFile is the name of the file a backup writes at the root of the
-// destination.
-const markerFile = "vaultik-destination.txt"
-
-// backUpThenUnplugMountPoint backs up to a file:// destination, then
-// moves the destination directory away and leaves an empty directory in
-// its place, as unplugging a volume mounted there would. It returns the
-// path of that empty directory.
-func backUpThenUnplugMountPoint(
-	ctx context.Context, t *testing.T,
-) (*vaultik.Vaultik, *database.Repositories, *bytes.Buffer, string) {
-	t.Helper()
-
-	storeDir := filepath.Join(t.TempDir(), "mnt")
-	v, repos, out := backUpToFileDestination(ctx, t, storeDir)
-
-	require.NoError(t, os.Rename(storeDir, storeDir+"-unplugged"))
-	require.NoError(t, os.Mkdir(storeDir, 0o750))
-
-	return v, repos, out, storeDir
-}
-
-// assertUntouched checks that the local index still holds its one
-// snapshot and that nothing was written to the empty mount point.
-func assertUntouched(
-	ctx context.Context, t *testing.T,
-	repos *database.Repositories, storeDir string,
-) {
-	t.Helper()
-
-	snapshots, err := repos.Snapshots.ListRecent(ctx, listRecentTestLimit)
-	require.NoError(t, err)
-	assert.Len(t, snapshots, 1, "no local snapshot record may be deleted")
-
-	entries, err := os.ReadDir(storeDir)
-	require.NoError(t, err)
-	assert.Empty(t, entries, "nothing may be written to the empty mount point")
-}
-
-// TestFirstBackupWritesMarker checks that a backup writes the marker
-// file at the root of the destination.
-func TestFirstBackupWritesMarker(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	storeDir := t.TempDir()
-	backUpToFileDestination(context.Background(), t, storeDir)
-
-	assert.FileExists(t, filepath.Join(storeDir, markerFile))
-}
-
-// TestBackupRefusesDestinationWithoutMarker checks that snapshot create
-// --prune writes nothing and drops no local snapshot record when the
-// destination has no marker.
-func TestBackupRefusesDestinationWithoutMarker(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	v, repos, _, storeDir := backUpThenUnplugMountPoint(ctx, t)
-
-	err := v.CreateSnapshot(&vaultik.SnapshotCreateOptions{
-		Cron:  true,
-		Prune: true,
-	})
-	require.ErrorContains(t, err, markerFile)
-
-	assertUntouched(ctx, t, repos, storeDir)
-}
-
-// TestPruneRefusesDestinationWithoutMarker checks that prune fails and
-// deletes no local snapshot record when the destination has no marker.
-func TestPruneRefusesDestinationWithoutMarker(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	v, repos, _, storeDir := backUpThenUnplugMountPoint(ctx, t)
-
-	err := v.Prune(&vaultik.PruneOptions{Force: true})
-	require.ErrorContains(t, err, markerFile)
-
-	assertUntouched(ctx, t, repos, storeDir)
-}
-
-// TestPurgeRefusesDestinationWithoutMarker checks that snapshot purge
-// fails and deletes no local snapshot record when the destination has no
-// marker.
-func TestPurgeRefusesDestinationWithoutMarker(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	v, repos, _, storeDir := backUpThenUnplugMountPoint(ctx, t)
-
-	err := v.PurgeSnapshotsWithOptions(&vaultik.SnapshotPurgeOptions{
-		KeepLatest: true,
-		Force:      true,
-	})
-	require.ErrorContains(t, err, markerFile)
-
-	assertUntouched(ctx, t, repos, storeDir)
-}
-
-// TestRemoveSnapshotWarnsWhenDestinationHasNoMarker checks that snapshot
-// remove warns that the metadata could not be removed from a destination
-// without a marker, instead of reporting that it was.
-func TestRemoveSnapshotWarnsWhenDestinationHasNoMarker(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	v, repos, out, _ := backUpThenUnplugMountPoint(ctx, t)
-
-	result, err := v.RemoveSnapshot(localSnapshotID(ctx, t, repos, "first"),
-		&vaultik.RemoveOptions{Force: true})
-	require.NoError(t, err)
-
-	assert.False(t, result.RemoteRemoved)
-	assert.Contains(t, out.String(),
-		"Could not remove snapshot metadata from remote")
-	assert.Contains(t, out.String(), markerFile)
-	assert.NotContains(t, out.String(),
-		"Removed snapshot metadata from remote storage")
-}
-
-// TestListSnapshotsWarnsWhenDestinationHasNoMarker checks that snapshot
-// list warns and shows the local index alone when the destination has no
-// marker, without reporting the local snapshot as missing from it.
-func TestListSnapshotsWarnsWhenDestinationHasNoMarker(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	v, repos, out, _ := backUpThenUnplugMountPoint(ctx, t)
-	id := localSnapshotID(ctx, t, repos, "first")
-
-	require.NoError(t, v.ListSnapshots(false))
-
-	assert.Contains(t, out.String(), "Could not list backup destination store")
-	assert.Contains(t, out.String(), markerFile)
-	assert.Contains(t, out.String(), id)
-	assert.NotContains(t, out.String(), "not found in backup destination store")
-}
-
-// TestBackupAfterNukeRemoteSucceeds checks that remote nuke leaves the
-// destination ready for a new first backup, which writes the marker
-// again.
-func TestBackupAfterNukeRemoteSucceeds(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	storeDir := t.TempDir()
-	v, _, _ := backUpToFileDestination(context.Background(), t, storeDir)
-
-	require.NoError(t, v.NukeRemote(true))
-	assert.NoFileExists(t, filepath.Join(storeDir, markerFile))
-
-	require.NoError(t, backUp(v, "second"))
-	assert.FileExists(t, filepath.Join(storeDir, markerFile))
-}
@@ -192,7 +192,7 @@ func assertRestoreRejectsDamagedBlob(
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

@@ -238,7 +238,7 @@ func TestDeepVerifyCatchesLyingBackend(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

 	ctx := context.Background()
@@ -290,7 +290,7 @@ func TestInterruptedBlobUploadRecordsNoUploadedBlob(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

 	ctx := context.Background()
@@ -298,6 +298,10 @@ func TestInterruptedBlobUploadRecordsNoUploadedBlob(t *testing.T) {

 	writeFaultSourceTree(t, fs, dataDir)

+	// No upload succeeds, so nothing creates the destination directory.
+	// It must exist for the listing below to show that no blob survived.
+	require.NoError(t, os.Mkdir(storeDir, 0o750))
+
 	inner, err := storage.NewFileStorer(storeDir)
 	require.NoError(t, err)

@@ -361,7 +365,7 @@ func TestBackupRetryAfterInterruptedUploadIsRestorable(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

@@ -425,7 +429,7 @@ func TestBackupSurvivesMetadataExportInterruption(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

 	ctx := context.Background()
@@ -507,7 +511,7 @@ func TestBackupCompletesOnlyAfterMetadataExport(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

@@ -682,7 +686,7 @@ func TestRestoreReportsDiskFull(t *testing.T) {
 	osFS := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

@@ -771,7 +771,7 @@ func TestEndToEndFileStorage(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

@@ -964,7 +964,7 @@ func TestDedupOnlySnapshotRestores(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

@@ -24,11 +24,13 @@ import (
 // that is not plugged in, cannot be listed. It is not an empty store, so
 // no command may conclude from it that the local snapshots are gone.

-// newFileDestinationVaultik returns a Vaultik that backs up the
-// snapshot named "first" to a file:// destination at storeDir.
-func newFileDestinationVaultik(
+// backUpToFileDestination backs up the snapshot named "first" to a
+// file:// destination at storeDir, which need not exist yet. Everything
+// the returned Vaultik prints after the backup goes to the returned
+// buffer.
+func backUpToFileDestination(
 	ctx context.Context, t *testing.T, storeDir string,
-) (*vaultik.Vaultik, *database.Repositories) {
+) (*vaultik.Vaultik, *database.Repositories, *bytes.Buffer) {
 	t.Helper()

 	osFs := afero.NewOsFs()
@@ -47,22 +49,8 @@ func newFileDestinationVaultik(

 	repos := database.NewRepositories(db)
 	cfg := changedFileConfig(dataDir, dbPath)
+	v := newBackupVaultik(ctx, cfg, store, repos, db, osFs)

-	return newBackupVaultik(ctx, cfg, store, repos, db, osFs), repos
-}
-
-// backUpToFileDestination creates the directory storeDir, as a user must
-// before the first backup, and backs up the snapshot named "first" to a
-// file:// destination there. Everything the returned Vaultik prints
-// after the backup goes to the returned buffer.
-func backUpToFileDestination(
-	ctx context.Context, t *testing.T, storeDir string,
-) (*vaultik.Vaultik, *database.Repositories, *bytes.Buffer) {
-	t.Helper()
-
-	require.NoError(t, os.MkdirAll(storeDir, 0o750))
-
-	v, repos := newFileDestinationVaultik(ctx, t, storeDir)
 	require.NoError(t, backUp(v, "first"))

 	out := &bytes.Buffer{}
@@ -87,28 +75,21 @@ func backUpThenUnplug(
 	return v, repos, out
 }

-// TestBackupFailsWhenDestinationDirectoryMissing checks that a backup to
-// a file:// destination whose directory does not exist fails before it
-// records a snapshot, and does not create the directory.
-func TestBackupFailsWhenDestinationDirectoryMissing(t *testing.T) {
+// TestFirstBackupCreatesDestinationDirectory checks that a first backup
+// to a destination directory that does not exist yet creates it, and
+// that the destination can be listed afterwards.
+func TestFirstBackupCreatesDestinationDirectory(t *testing.T) {
 	log.Initialize(log.Config{})
 	t.Parallel()

 	ctx := context.Background()
-	volume := filepath.Join(t.TempDir(), "volume")
-	v, repos := newFileDestinationVaultik(ctx, t, filepath.Join(volume, "backup"))
+	storeDir := filepath.Join(t.TempDir(), "volume", "backup")
+	v, _, out := backUpToFileDestination(ctx, t, storeDir)

-	err := backUp(v, "first")
-	require.ErrorIs(t, err, fs.ErrNotExist)
-	require.ErrorContains(t, err, "create it, or mount the volume it is on")
+	require.NoError(t, v.ListSnapshots(false))

-	_, err = os.Stat(volume)
-	require.ErrorIs(t, err, fs.ErrNotExist,
-		"the backup must not create the destination directory")
-
-	snapshots, err := repos.Snapshots.ListRecent(ctx, listRecentTestLimit)
-	require.NoError(t, err)
-	assert.Empty(t, snapshots)
+	assert.NotContains(t, out.String(), "Could not list backup destination store")
+	assert.NotContains(t, out.String(), "not found in backup destination store")
 }

 // TestListSnapshotsWarnsWhenDestinationMissing checks that snapshot list
@@ -39,7 +39,7 @@ func TestNewChunkSizeOfChangedFileStaysFixed(t *testing.T) {

 	appendRandomBytes(t, fs, files, changedPath, appendedFileSize)

-	store, err := storage.NewFileStorer(t.TempDir())
+	store, err := storage.NewFileStorer(filepath.Join(tempDir, "remote"))
 	require.NoError(t, err)

 	db, err := database.New(ctx, dbPath)
@@ -37,9 +37,8 @@ const blobKeyParts = 4

 // NukeRemote deletes every snapshot's metadata and every blob from remote
 // storage, along with any object an upload cut off part-way left under a
-// temporary `.partial` name, and the destination marker. After this
-// returns successfully the bucket prefix is empty and the next backup
-// starts from scratch.
+// temporary `.partial` name. After this returns successfully the bucket
+// prefix is empty and the next backup starts from scratch.
 //
 // Refuses to run unless force is true. The caller is responsible for
 // confirming with the user.
@@ -94,13 +93,6 @@ func (v *Vaultik) emptyDestinationStore() error {
 		}
 	}

-	// Last, once the local snapshot records are gone: the next backup
-	// then has none and writes the marker again.
-	err = v.Storage.Delete(v.ctx, destinationMarkerKey)
-	if err != nil {
-		return fmt.Errorf("deleting %s: %w", destinationMarkerKey, err)
-	}
-
 	return nil
 }

@@ -34,9 +34,6 @@ func setupConsistencyTest(
 	repos := database.NewRepositories(db)
 	mockStorage := NewMockStorer()

-	// A backup wrote to this destination, so it carries the marker.
-	require.NoError(t, mockStorage.Put(ctx, markerFile, strings.NewReader("")))
-
 	for _, id := range snapshotIDs {
 		parts := strings.Split(id, "_")
 		startedAt, err := time.Parse(time.RFC3339, parts[len(parts)-1])
@@ -44,9 +44,6 @@ func setupPurgeTest(
 	repos := database.NewRepositories(db)
 	mockStorage := NewMockStorer()

-	// A backup wrote to this destination, so it carries the marker.
-	require.NoError(t, mockStorage.Put(ctx, markerFile, strings.NewReader("")))
-
 	// Insert each snapshot into the DB and create remote metadata stubs.
 	// Use timestamps parsed from snapshot IDs for realistic ordering.
 	for _, id := range snapshotIDs {
@@ -303,10 +303,6 @@ func TestRemoveSnapshot_DefaultRemovesMetadataNotBlobs(t *testing.T) {
 	addBlob(t, store, blobUnique)
 	addBlob(t, store, blobShared)

-	// A backup wrote to this destination, so it carries the marker.
-	require.NoError(t, store.Put(context.Background(), markerFile,
-		bytes.NewReader(nil)))
-
 	tv := vaultik.NewForTesting(store)
 	tv.Repositories = newLocalIndex(t, "snapshot-001", "snapshot-002")

@@ -396,12 +392,7 @@ func TestRemoveSnapshot_NoMetadataOnDestination(t *testing.T) {
 	log.Initialize(log.Config{})
 	t.Parallel()

-	// A backup wrote to this destination, so it carries the marker.
-	store := newTestStorer()
-	require.NoError(t, store.Put(context.Background(), markerFile,
-		bytes.NewReader(nil)))
-
-	tv := vaultik.NewForTesting(store)
+	tv := vaultik.NewForTesting(newTestStorer())
 	tv.Repositories = newLocalIndex(t, "snapshot-001")

 	result, err := tv.RemoveSnapshot("snapshot-001",
@@ -42,7 +42,7 @@ func TestRestoreOnAnotherMachine(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

@@ -65,7 +65,7 @@ func TestRestoreCleansTempDirOnInterrupt(t *testing.T) {
 	root := t.TempDir()

 	dataDir := filepath.Join(root, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(root, "remote")
 	restoreDir := filepath.Join(root, "restored")
 	dbPath := filepath.Join(root, "index.sqlite")

@@ -197,7 +197,7 @@ func TestRestoreLocalityAndReadAt(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

@@ -107,7 +107,7 @@ func backupOneFile(
 	require.NoError(t, afero.WriteFile(fs, srcPath, content, mode))
 	require.NoError(t, fs.Chmod(srcPath, mode))

-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

 	storer, err := storage.NewFileStorer(storeDir)
@@ -345,7 +345,7 @@ func backupSingleChunkFiles(
 		require.NoError(t, afero.WriteFile(fs, path, files[path], 0o644))
 	}

-	storer, err := storage.NewFileStorer(t.TempDir())
+	storer, err := storage.NewFileStorer(filepath.Join(tempDir, "remote"))
 	require.NoError(t, err)

 	db, err := database.New(ctx, dbPath)
@@ -29,7 +29,7 @@ func TestRestoreAndDeepVerifyRejectSwappedDatabase(t *testing.T) {

 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")

 	chunkSize := int64(64 * 1024)

@@ -100,7 +100,7 @@ func TestDeepVerifyRejectsSwappedDatabaseWithEmptyManifest(t *testing.T) {

 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")

 	chunkSize := int64(64 * 1024)

@@ -186,7 +186,7 @@ func TestRestoreSweeperEvictsBlobs(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

@@ -33,7 +33,7 @@ func TestRestoreRejectsTruncatedMetadataDB(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

@@ -28,7 +28,7 @@ func TestVerifyPassesWhenBackupReusesStoredBlob(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	secondDBPath := filepath.Join(tempDir, "second.sqlite")

 	chunkSize := int64(64 * 1024)
@@ -25,7 +25,7 @@ func TestBackupOfSameSecondRewriteRestoresNewContent(t *testing.T) {
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	dataDir := filepath.Join(tempDir, "src")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")
 	rewrittenPath := filepath.Join(dataDir, "small.txt")
@@ -36,7 +36,7 @@ func TestShallowVerifyDetectsWrongBlobSize(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

 	chunkSize := int64(32 * 1024)
@@ -110,7 +110,7 @@ func TestShallowVerifyDetectsMissingDatabase(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

 	chunkSize := int64(32 * 1024)
@@ -193,7 +193,7 @@ func TestShallowVerifyReportsStatErrorsApartFromMissing(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

 	chunkSize := int64(32 * 1024)
@@ -282,7 +282,7 @@ func TestShallowVerifyQuietFailsOnStatErrorAlone(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

 	chunkSize := int64(32 * 1024)
@@ -94,13 +94,6 @@ func (v *Vaultik) CreateSnapshot(opts *SnapshotCreateOptions) error {
 		return err
 	}

-	// Before PruneDatabase: it drops incomplete snapshots, which could
-	// leave the local index without one and so skip the marker check.
-	err = v.markDestination()
-	if err != nil {
-		return err
-	}
-
 	// Clean up incomplete snapshots FIRST, before any scanning.
 	// This is critical for data safety; PruneDatabase below does it.
 	hostname := v.Config.Hostname
@@ -123,9 +116,21 @@ func (v *Vaultik) CreateSnapshot(opts *SnapshotCreateOptions) error {
 		return fmt.Errorf("prune database: %w", err)
 	}

-	snapshotNames, err := v.snapshotNamesToCreate(opts.Snapshots)
-	if err != nil {
-		return err
+	// Determine which snapshots to process
+	snapshotNames := opts.Snapshots
+	if len(snapshotNames) == 0 {
+		snapshotNames = v.Config.SnapshotNames()
+	} else {
+		// Validate requested snapshot names exist
+		for _, name := range snapshotNames {
+			if _, ok := v.Config.Snapshots[name]; !ok {
+				return fmt.Errorf("%w: %q", errSnapshotNotInConfig, name)
+			}
+		}
+	}
+
+	if len(snapshotNames) == 0 {
+		return errNoSnapshotsInConfig
 	}

 	// Process each named snapshot
@@ -165,28 +170,6 @@ func (v *Vaultik) CreateSnapshot(opts *SnapshotCreateOptions) error {
 	return nil
 }

-// snapshotNamesToCreate returns the requested snapshot names, each checked
-// against the config, or every configured name when none was requested.
-func (v *Vaultik) snapshotNamesToCreate(requested []string) ([]string, error) {
-	snapshotNames := requested
-	if len(snapshotNames) == 0 {
-		snapshotNames = v.Config.SnapshotNames()
-	} else {
-		// Validate requested snapshot names exist
-		for _, name := range snapshotNames {
-			if _, ok := v.Config.Snapshots[name]; !ok {
-				return nil, fmt.Errorf("%w: %q", errSnapshotNotInConfig, name)
-			}
-		}
-	}
-
-	if len(snapshotNames) == 0 {
-		return nil, errNoSnapshotsInConfig
-	}
-
-	return snapshotNames, nil
-}
-
 // runPostBackupPrune drops older snapshots of the given names and removes
 // orphan blobs from remote storage. If keepNewerThan is set (e.g. "4w"),
 // snapshots newer than that duration are kept. Otherwise only the latest
@@ -644,7 +627,8 @@ func selectSnapshotsToPurge(
 }

 // confirmAndExecutePurge shows deletion candidates, confirms with the
-// user, and deletes snapshots.
+// user, and deletes snapshots. It stops with an error at the first
+// snapshot it cannot delete.
 func (v *Vaultik) confirmAndExecutePurge(
 	toDelete []SnapshotInfo, force, quiet bool,
 ) error {
@@ -686,10 +670,11 @@ func (v *Vaultik) confirmAndExecutePurge(
 		snapshotID := snap.ID.String()
 		log.Info("Deleting snapshot", "id", snapshotID)

+		// Stop before the remote delete: a snapshot still in the local
+		// index must keep its metadata on the destination store.
 		err := v.deleteSnapshotFromLocalDB(snapshotID)
 		if err != nil {
-			log.Error("Failed to delete from local database",
-				"snapshot_id", snapshotID, "error", err)
+			return fmt.Errorf("deleting snapshot %s from local index: %w", snapshotID, err)
 		}

 		_, err = v.deleteRemoteSnapshotByKey(snapshot.RemoteSnapshotKey(snapshotID))
@@ -1259,18 +1244,10 @@ func (v *Vaultik) RemoveSnapshot(
 		return v.removeSnapshotDryRun(result, snapshotID, opts)
 	}

-	if !v.confirmRemoveSnapshot(snapshotID, opts) {
+	if !opts.Force && !opts.JSON && !v.confirmRemoveSnapshot(snapshotID, opts) {
 		return result, nil
 	}

-	// Checked before the local record is deleted: it may be the last
-	// snapshot in the local index, and the check applies only while the
-	// local index holds one.
-	var markerErr error
-	if !opts.LocalOnly {
-		markerErr = v.checkDestinationMarker()
-	}
-
 	if inLocalIndex {
 		log.Info("Removing snapshot from local database", "snapshot_id", snapshotID)

@@ -1281,7 +1258,7 @@ func (v *Vaultik) RemoveSnapshot(
 	}

 	if !opts.LocalOnly {
-		result.RemoteRemoved = v.removeSnapshotRemote(snapshotID, markerErr, opts)
+		result.RemoteRemoved = v.removeSnapshotRemote(snapshotID, opts)
 	}

 	if v.SnapshotManager != nil {
@@ -1373,13 +1350,9 @@ func (v *Vaultik) removeSnapshotDryRun(
 }

 // confirmRemoveSnapshot prompts for confirmation before removing a
-// snapshot, unless --force or --json is set. Returns false (treating
-// EOF/read errors as "no") unless the user answers "y".
+// snapshot. Returns false (treating EOF/read errors as "no") unless the
+// user answers "y".
 func (v *Vaultik) confirmRemoveSnapshot(snapshotID string, opts *RemoveOptions) bool {
-	if opts.Force || opts.JSON {
-		return true
-	}
-
 	if opts.LocalOnly {
 		v.stdoutf("Remove snapshot '%s' from local database "+
 			"(remote untouched)? [y/N] ", snapshotID)
@@ -1411,24 +1384,15 @@ func (v *Vaultik) confirmRemoveSnapshot(snapshotID string, opts *RemoveOptions)
 // removal has already happened, so the user is told the remote half
 // didn't finish and to run `vaultik snapshot remove` for the snapshot
 // again once the destination store is reachable (`vaultik prune` never
-// removes snapshot metadata). markerErr is the result of
-// checkDestinationMarker; when it is set, nothing is deleted and it is
-// the failure reported. Returns true when the remote removal succeeded
-// and deleted something.
-func (v *Vaultik) removeSnapshotRemote(
-	snapshotID string, markerErr error, opts *RemoveOptions,
-) bool {
+// removes snapshot metadata). Returns true when the remote removal
+// succeeded and deleted something.
+func (v *Vaultik) removeSnapshotRemote(snapshotID string, opts *RemoveOptions) bool {
 	log.Info("Removing snapshot metadata from remote storage",
 		"snapshot_id", snapshotID)

-	var deleted int
-
-	err := markerErr
-	if err == nil {
-		deleted, err = v.deleteRemoteSnapshotByKey(
-			snapshot.RemoteSnapshotKey(snapshotID))
-	}
+	remoteKey := snapshot.RemoteSnapshotKey(snapshotID)

+	deleted, err := v.deleteRemoteSnapshotByKey(remoteKey)
 	if err != nil {
 		log.Warn("Could not remove snapshot metadata from remote storage; "+
 			"run '"+snapshotRemoveCommandHint+"' with the snapshot's ID "+
@@ -1532,8 +1496,8 @@ func (v *Vaultik) localSnapshotIDs() ([]string, error) {
 // listAllRemoteSnapshotKeys collects the hashed remote keys
 // (subdirectories under metadata/) currently present in the
 // destination store. Returns (nil, err) when the store cannot be
-// listed, or is not present by checkDestinationMarker; callers must
-// treat that as "no remote info available," not fatal.
+// listed; callers must treat that as "no remote info available," not
+// fatal.
 func (v *Vaultik) listAllRemoteSnapshotKeys() ([]string, error) {
 	log.Info("Listing all remote snapshots")

@@ -1582,11 +1546,6 @@ func (v *Vaultik) listAllRemoteSnapshotKeys() ([]string, error) {
 		}
 	}

-	err := v.checkDestinationMarker()
-	if err != nil {
-		return nil, err
-	}
-
 	return keys, nil
 }

@@ -87,7 +87,7 @@ func TestSnapshotSummaryCountsFileNotStoredAsFailed(t *testing.T) {
 				"src": {Paths: []string{srcDir}},
 			}

-			store, err := storage.NewFileStorer(t.TempDir())
+			store, err := storage.NewFileStorer(filepath.Join(tempDir, "remote"))
 			require.NoError(t, err)

 			db, err := database.New(ctx, cfg.IndexPath)
@@ -122,9 +122,6 @@ func newListEnv(t *testing.T) *listEnv {
 	store := newObservingStorer()
 	stdout := &bytes.Buffer{}

-	// A backup wrote to this destination, so it carries the marker.
-	require.NoError(t, store.Put(ctx, markerFile, strings.NewReader("")))
-
 	v := &vaultik.Vaultik{
 		Config: &config.Config{
 			AgeSecretKey: "",
@@ -45,7 +45,7 @@ func TestSkipErrorsBackupStopsOnIndexErrorRecordingDirectory(t *testing.T) {
 		"tree": {Paths: []string{srcDir}},
 	}

-	store, err := storage.NewFileStorer(t.TempDir())
+	store, err := storage.NewFileStorer(filepath.Join(tempDir, "remote"))
 	require.NoError(t, err)

 	db, err := database.New(ctx, cfg.IndexPath)
@@ -84,7 +84,7 @@ func newSummaryEnv(t *testing.T) *summaryEnv {
 		"split":  {Paths: []string{dirOne, dirTwo}},
 	}

-	inner, err := storage.NewFileStorer(t.TempDir())
+	inner, err := storage.NewFileStorer(filepath.Join(tempDir, "remote"))
 	require.NoError(t, err)

 	store := faultstore.New(inner)
@@ -1,147 +0,0 @@
-package vaultik_test
-
-import (
-	"context"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/vaultik/internal/log"
-	"sneak.berlin/go/vaultik/internal/vaultik"
-)
-
-// TestPruneDeletesNothingThroughSymlinkedDirectory checks that prune keeps
-// every blob and the local snapshot record when the metadata/ or blobs/
-// directory of a file:// destination is a symlink to a directory elsewhere
-// (https://git.eeqj.de/sneak/vaultik/issues/296). A backup writes through
-// such a link, so prune has to list through it too.
-func TestPruneDeletesNothingThroughSymlinkedDirectory(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	for _, dir := range []string{"metadata", "blobs"} {
-		t.Run(dir, func(t *testing.T) {
-			t.Parallel()
-
-			ctx := context.Background()
-			storeDir := filepath.Join(t.TempDir(), "store")
-			v, repos, _ := backUpToFileDestination(ctx, t, storeDir)
-			blobFiles := blobFilesIn(t, storeDir)
-			moveBehindSymlink(t, storeDir, dir)
-
-			require.NoError(t, v.Prune(&vaultik.PruneOptions{Force: true}))
-
-			// When blobs/ is the link, these paths run through it.
-			for _, blobFile := range blobFiles {
-				assert.FileExists(t, blobFile, "prune must delete no blob")
-			}
-
-			snapshots, err := repos.Snapshots.ListRecent(ctx, listRecentTestLimit)
-			require.NoError(t, err)
-			assert.Len(t, snapshots, 1, "prune must delete no local snapshot record")
-		})
-	}
-}
-
-// TestPruneFailsOnSymlinkedDirectoryWithMissingTarget checks that prune
-// fails, deleting no blob and keeping the local snapshot record, when the
-// metadata/ or blobs/ directory of a file:// destination is a symlink
-// whose target is missing, as a link to a volume that is not mounted is.
-func TestPruneFailsOnSymlinkedDirectoryWithMissingTarget(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	for _, dir := range []string{"metadata", "blobs"} {
-		t.Run(dir, func(t *testing.T) {
-			t.Parallel()
-
-			ctx := context.Background()
-			storeDir := filepath.Join(t.TempDir(), "store")
-			v, repos, _ := backUpToFileDestination(ctx, t, storeDir)
-			blobFiles := blobFilesIn(t, storeDir)
-			targetPath := moveBehindSymlink(t, storeDir, dir)
-
-			// Unmount the volume the link points to, and mount it again
-			// once prune has run.
-			unmountedPath := targetPath + "-unmounted"
-			require.NoError(t, os.Rename(targetPath, unmountedPath))
-
-			err := v.Prune(&vaultik.PruneOptions{Force: true})
-			require.ErrorIs(t, err, fs.ErrNotExist)
-
-			require.NoError(t, os.Rename(unmountedPath, targetPath))
-
-			// When blobs/ is the link, these paths run through it.
-			for _, blobFile := range blobFiles {
-				assert.FileExists(t, blobFile, "prune must delete no blob")
-			}
-
-			snapshots, err := repos.Snapshots.ListRecent(ctx, listRecentTestLimit)
-			require.NoError(t, err)
-			assert.Len(t, snapshots, 1, "prune must delete no local snapshot record")
-		})
-	}
-}
-
-// TestRemoveSnapshotWarnsOnSymlinkedMetadataWithMissingTarget checks that
-// snapshot remove warns that the metadata could not be removed from the
-// destination when metadata/ is a symlink whose target is missing, as it
-// does when the destination directory is missing, instead of finding no
-// metadata to remove.
-func TestRemoveSnapshotWarnsOnSymlinkedMetadataWithMissingTarget(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	storeDir := filepath.Join(t.TempDir(), "store")
-	v, repos, out := backUpToFileDestination(ctx, t, storeDir)
-	targetPath := moveBehindSymlink(t, storeDir, "metadata")
-	require.NoError(t, os.Rename(targetPath, targetPath+"-unmounted"))
-
-	result, err := v.RemoveSnapshot(localSnapshotID(ctx, t, repos, "first"),
-		&vaultik.RemoveOptions{Force: true})
-	require.NoError(t, err)
-
-	assert.False(t, result.RemoteRemoved)
-	assert.Contains(t, out.String(),
-		"Could not remove snapshot metadata from remote")
-	assert.NotContains(t, out.String(),
-		"Removed snapshot metadata from remote storage")
-}
-
-// blobFilesIn returns the paths of the blob files under storeDir/blobs, and
-// fails the test when there are none.
-func blobFilesIn(t *testing.T, storeDir string) []string {
-	t.Helper()
-
-	var blobFiles []string
-
-	err := filepath.WalkDir(filepath.Join(storeDir, "blobs"),
-		func(path string, entry fs.DirEntry, err error) error {
-			if err == nil && !entry.IsDir() {
-				blobFiles = append(blobFiles, path)
-			}
-
-			return err
-		})
-	require.NoError(t, err)
-	require.NotEmpty(t, blobFiles)
-
-	return blobFiles
-}
-
-// moveBehindSymlink moves storeDir/dir to a directory elsewhere, puts a
-// symlink to it in its place, and returns where it went.
-func moveBehindSymlink(t *testing.T, storeDir, dir string) string {
-	t.Helper()
-
-	linkPath := filepath.Join(storeDir, dir)
-	targetPath := filepath.Join(t.TempDir(), dir)
-	require.NoError(t, os.Rename(linkPath, targetPath))
-	require.NoError(t, os.Symlink(targetPath, linkPath))
-
-	return targetPath
-}
@@ -28,7 +28,7 @@ func TestBackupWithoutCronOfTwoPathSnapshotRestoresBothPaths(t *testing.T) {
 	tempDir := t.TempDir()
 	firstDir := filepath.Join(tempDir, "first")
 	secondDir := filepath.Join(tempDir, "second")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	restoreDir := filepath.Join(tempDir, "restored")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

@@ -36,7 +36,7 @@ func TestUncompressedSizeOfChangedFileStaysFixed(t *testing.T) {

 	appendRandomBytes(t, fs, files, changedPath, appendedFileSize)

-	store, err := storage.NewFileStorer(t.TempDir())
+	store, err := storage.NewFileStorer(filepath.Join(tempDir, "remote"))
 	require.NoError(t, err)

 	db, err := database.New(ctx, dbPath)
@@ -28,7 +28,7 @@ func TestVerify_QuietSuppressesReport(t *testing.T) {
 	tempDir := t.TempDir()

 	dataDir := filepath.Join(tempDir, "source")
-	storeDir := t.TempDir()
+	storeDir := filepath.Join(tempDir, "remote")
 	dbPath := filepath.Join(tempDir, "index.sqlite")

 	chunkSize := int64(32 * 1024)