Record each snapshot's new chunk size when its backup runs (closes #311)

snapshot list worked out NEW CHUNK SIZE from the snapshot's file rows. A
file's row is shared by every snapshot that lists it and rewritten when
the file changes, so a snapshot whose change was a modified file showed
0 B, and older snapshots' figures moved after later backups.

The scanner now totals the size of the chunks it stores that were not
stored before (the chunks chunk_count counts), the backup writes that
total to a new snapshots column, new_chunk_size, and snapshot list reads
it.

Judgement call: the figure is fixed when the backup runs, so removing an
earlier snapshot no longer raises a later snapshot's figure.

Model: opus-5-5

README.md

@@ -286,13 +286,15 @@ needed.
   remove orphaned blobs from remote storage. By default keeps only the latest
   snapshot per name; use `--keep-newer-than` for a rolling window.
 * `--keep-newer-than <duration>`: With `--prune`, keep snapshots newer than
-  this duration instead of only the latest (e.g. `4w`, `30d`, `6mo`, `1y`)
+  this duration instead of only the latest (e.g. `4w`, `30d`, `6mo`, `1y`).
+  Without `--prune`, or with a value that is not a valid duration, the
+  command fails before the backup starts.
 
 **`snapshot list`**: Show every snapshot known to this host — the union
 of the local index and the backup destination store — with timestamps
 and three sizes per snapshot (compressed remote size; total
-uncompressed chunk size; size of chunks newly referenced by that
-snapshot).
+uncompressed chunk size; size of the chunks that snapshot stored that
+were not stored before, recorded when its backup ran).
 
 Listing the destination store does **not** require the age secret key,
 so it works in vaultik's intended configuration, where the backed-up
@@ -305,8 +307,8 @@ only the hash, so hostname and snapshot name exist solely in the local
 index and in the encrypted per-snapshot database. Snapshots found only
 on the destination store are therefore listed as
 `<remote only:<abbreviated remote key>>` and show `<remote only>` in
-the uncompressed and "new chunk" columns, which can only be computed
-from the local index. Their timestamp and compressed size are real,
+the uncompressed and "new chunk" columns, which come only from the
+local index. Their timestamp and compressed size are real,
 read from the manifest.
 
 Snapshots in the local index with no counterpart on the destination
@@ -384,12 +386,10 @@ manifest on the destination store to compute the still-referenced blob
 set and delete any blob not in that set. Step (3) reads all remote
 manifests — network cost scales with the number of snapshots. `snapshot
 create --prune` runs the same cleanup automatically; this is the
-manual entry point for the same work. If a blob cannot be deleted, the
-command (and `snapshot create --prune`) exits non-zero.
+manual entry point for the same work.
 * `--force`: Skip confirmation prompt
 * `--json`: Output stats as JSON. Also skips the confirmation prompt, as
-  `--force` does. A blob that cannot be deleted is counted in
-  `blobs_failed`, and the document is printed before the non-zero exit.
+  `--force` does.
 
 **`info`**: Display system configuration, storage settings, encryption
 recipients, and local database statistics.
@@ -403,14 +403,15 @@ orphaned blob figures are reported as unknown; `--json` gives them as
 `null`, lists the remote key of each unreadable manifest in
 `unreadable_manifests` and counts the manifests under skipped names in
 `skipped_manifest_count`. An unreadable manifest also leaves its
-snapshot's blob count and blob size unknown, `null` in `--json`.
+snapshot's blob count and blob size unknown, `null` in `--json`. A file
+under `blobs/` whose name is not a blob hash is not counted as a blob,
+since `prune` never deletes it.
 * `--json`: Output as JSON
 
 **`remote nuke`**: Delete every snapshot's metadata and every blob from the
 backup destination store, leaving the bucket prefix empty. Destructive and
 irreversible. This is the single supported way to wipe the entire
-destination store. If anything cannot be deleted, the command exits
-non-zero; running it again deletes what is left.
+destination store.
 * `--force`: Required to confirm destruction.
 
 **`database delete`**: Delete the local SQLite state database file
@@ -432,7 +433,10 @@ object store. Credentials are read from `s3.access_key_id` and
 `s3.secret_access_key` in the config file.
 
 **Local filesystem** (`file:///path/to/backup`): Stores blobs and metadata on
-a local or mounted filesystem. Useful for testing or backing up to a NAS.
+a local or mounted filesystem. Useful for testing or backing up to a NAS. The
+path must be absolute; a relative one is refused when the config loads.
+Percent-escapes in the path are decoded, so `my%20stick` and `my stick` name
+the same directory.
 
 **Rclone** (`rclone://remote/path`): Uses rclone's 70+ supported cloud
 providers. Requires rclone to be configured separately (`rclone config`).

TODO.md

@@ -22,16 +22,13 @@ the tag exists and is exercised; what is left is merging `next` to
 
 # Completed Steps
 
-- 2026-10-13: Made `prune` and `remote nuke` exit non-zero when a delete
-  fails ([issue #290](https://git.eeqj.de/sneak/vaultik/issues/290)).
-  `prune`, and the prune step of `snapshot create --prune`, counted a
-  blob it could not delete and still exited 0; it now prints its summary
-  or `--json` document and then fails. `remote nuke` warned about a
-  snapshot's metadata it could not delete, said to run `vaultik prune`,
-  which never removes metadata, and then reported the store empty. It
-  now fails without that report and says to run `vaultik remote nuke
-  --force` again, and a successful nuke no longer advises `prune` for
-  blobs it deletes itself.
+- 2026-10-13: Stopped `remote info` counting a file under `blobs/` that
+  is not a blob as an orphaned blob
+  ([issue #295](https://git.eeqj.de/sneak/vaultik/issues/295)). A stray
+  file such as `.DS_Store` was reported as an orphaned blob and the
+  report advised running `prune`, which skips such a file and deleted
+  nothing. `remote info` now takes its blob list from the same listing
+  `prune` uses, in the table and in `--json`.
 
 - 2026-10-13: Made `snapshot remove` fail for a snapshot that does not
   exist ([issue #293](https://git.eeqj.de/sneak/vaultik/issues/293)).

docs/DATAMODEL.md

@@ -119,6 +119,7 @@ Tracks backup snapshots.
 - `completed_at` (INTEGER) - Completion timestamp (NULL if in progress)
 - `file_count` (INTEGER) - Number of files in snapshot
 - `chunk_count` (INTEGER) - Number of chunks this snapshot stored that were not stored before
+- `new_chunk_size` (INTEGER) - Total size of those chunks before compression; `snapshot list` shows it as NEW CHUNK SIZE
 - `blob_count` (INTEGER) - Number of blobs this snapshot created
 - `total_size` (INTEGER) - Total size of all files
 - `blob_size` (INTEGER) - Total compressed size of all referenced blobs

internal/blob/packer.go

@@ -245,6 +245,17 @@ func (p *Packer) Flush(ctx context.Context) error {
 	return nil
 }
 
+// DiscardCurrentBlob closes and removes the temp file of the blob being
+// packed, if any, and drops that blob. A caller that stops before Flush
+// must call it, or the temp file is left behind. Thread-safe.
+func (p *Packer) DiscardCurrentBlob() {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	p.cleanupTempFile()
+	p.currentBlob = nil
+}
+
 // FinalizeBlob finalizes the current blob being assembled.
 // This compresses the accumulated chunks, encrypts the result, and computes
 // the content-addressed hash. The finalized blob is either passed to the

internal/cli/entry_snapshot_create_prune_test.go

@@ -0,0 +1,108 @@
+package cli //nolint:testpackage // shares runEntry and the hermetic config helpers
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Flags of `snapshot create` used to build argument vectors below.
+const (
+	flagPrune         = "--prune"
+	flagKeepNewerThan = "--keep-newer-than"
+)
+
+// TestEntrySnapshotCreateRejectsKeepNewerThanBeforeBackup checks that a
+// --keep-newer-than the post-backup prune could not use stops `snapshot
+// create` before the backup: the command fails and the destination
+// store stays empty. It used to be read only by the prune, after the
+// snapshot was uploaded, and without --prune it was ignored.
+//
+//nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
+func TestEntrySnapshotCreateRejectsKeepNewerThanBeforeBackup(t *testing.T) {
+	for _, testCase := range []struct {
+		name string
+		args []string
+	}{
+		{
+			name: "decimal in a day count",
+			args: []string{flagPrune, flagKeepNewerThan, "1.5d"},
+		},
+		{
+			name: "unknown unit",
+			args: []string{flagPrune, flagKeepNewerThan, "4x"},
+		},
+		{
+			name: "without --prune",
+			args: []string{flagKeepNewerThan, "4w"},
+		},
+	} {
+		t.Run(testCase.name, func(t *testing.T) {
+			configPath, storeDir := writeBackupConfig(t)
+
+			code, _, _ := runEntry(t, append(
+				[]string{flagConfig, configPath, cmdSnapshot, cmdCreate},
+				testCase.args...)...)
+
+			assert.Equal(t, 1, code)
+
+			stored, err := os.ReadDir(storeDir)
+			require.NoError(t, err)
+			assert.Empty(t, stored, "nothing may be uploaded")
+		})
+	}
+}
+
+// TestEntrySnapshotCreateReportsPostBackupPruneFailure makes the
+// post-backup prune fail after a good backup, by planting a manifest
+// that cannot be decoded, and checks that the failure is reported as the
+// prune's and not as a failed snapshot creation.
+//
+//nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
+func TestEntrySnapshotCreateReportsPostBackupPruneFailure(t *testing.T) {
+	configPath, storeDir := writeBackupConfig(t)
+
+	// A remote key is 64 lowercase hex characters. The prune reads every
+	// manifest on the store and fails on one it cannot decode.
+	plantedDir := filepath.Join(storeDir, "metadata", strings.Repeat("a", 64))
+	require.NoError(t, os.MkdirAll(plantedDir, 0o750))
+	require.NoError(t, os.WriteFile(
+		filepath.Join(plantedDir, "manifest.json.zst"),
+		[]byte("not a valid manifest"), 0o600))
+
+	code, _, stderr := runEntry(t,
+		flagConfig, configPath, cmdSnapshot, cmdCreate, flagPrune)
+
+	assert.Equal(t, 1, code)
+	assert.Contains(t, stderr, "Backup completed, but post-backup prune failed")
+	assert.NotContains(t, stderr, "Snapshot creation failed")
+
+	snapshots, err := os.ReadDir(filepath.Join(storeDir, "metadata"))
+	require.NoError(t, err)
+	assert.Len(t, snapshots, 2,
+		"the new snapshot is on the store beside the planted one")
+}
+
+// writeBackupConfig builds a hermetic config with one small file in its
+// source directory and an empty destination store directory. Returns the
+// config path and the store directory.
+func writeBackupConfig(t *testing.T) (string, string) {
+	t.Helper()
+
+	configPath := writeHermeticPruneConfig(t, false)
+
+	// writeHermeticPruneConfig puts the source and store directories
+	// beside the config file.
+	dir := filepath.Dir(configPath)
+	sourceDir := filepath.Join(dir, "source")
+
+	require.NoError(t, os.Mkdir(sourceDir, 0o750))
+	require.NoError(t, os.WriteFile(
+		filepath.Join(sourceDir, "file.txt"), []byte("hello"), 0o600))
+
+	return configPath, filepath.Join(dir, "store")
+}

internal/cli/snapshot.go

@@ -71,6 +71,11 @@ otherwise from the platform config directory (~/.config/vaultik/config.yml
 on Linux), then /etc/vaultik/config.yml.`,
 		Args: cobra.ArbitraryArgs,
 		RunE: func(cmd *cobra.Command, args []string) error {
+			err := opts.Validate()
+			if err != nil {
+				return err
+			}
+
 			// Pass snapshot names from args
 			opts.Snapshots = args
 			// --skip-errors is a global flag on the root command.
@@ -97,6 +102,13 @@ on Linux), then /etc/vaultik/config.yml.`,
 			}, func(v *vaultik.Vaultik) error {
 				return v.CreateSnapshot(opts)
 			}, func(err error) {
+				if errors.Is(err, vaultik.ErrPostBackupPruneFailed) {
+					log.Error("Post-backup prune failed", "error", err)
+					ReportErrorf("Backup completed, but %v", err)
+
+					return
+				}
+
 				log.Error("Snapshot creation failed", "error", err)
 				ReportErrorf("Snapshot creation failed: %v", err)
 			})

internal/config/config.go

@@ -61,6 +61,9 @@ var (
 	errBadS3PartSize    = errors.New("s3.part_size must be between 5MiB and 5GiB")
 	errBadStorageScheme = errors.New(
 		"storage_url must start with s3://, file://, or rclone://")
+	errFileURLNotAbsolute = errors.New(
+		"a file:// storage_url needs an absolute path, " +
+			"as in file:///path/to/backup")
 	errStorageNotConfigured = errors.New(
 		"storage not configured; set storage_url or provide s3.endpoint + " +
 			"s3.bucket + credentials")
@@ -461,11 +464,18 @@ func (c *Config) validateStorage() error {
 
 // validateStorageURL validates URL-based storage configuration. File and
 // rclone URLs need no credentials; S3 URLs require the legacy s3.*
-// credential fields.
+// credential fields. A file URL must name an absolute path: a relative one
+// would resolve against the working directory, so the destination would
+// move with it.
 func (c *Config) validateStorageURL() error {
 	switch {
 	case strings.HasPrefix(c.StorageURL, "file://"):
-		// File storage doesn't need S3 credentials
+		// storage.ParseStorageURL applies the same rule, but config
+		// cannot import storage, which imports config.
+		if !strings.HasPrefix(c.StorageURL, "file:///") {
+			return errFileURLNotAbsolute
+		}
+
 		return nil
 	case strings.HasPrefix(c.StorageURL, "rclone://"):
 		// Rclone storage uses rclone's own config

internal/config/config_test.go

@@ -337,6 +337,35 @@ func TestLoadS3PartSize(t *testing.T) {
 	})
 }
 
+// TestLoadRejectsRelativeFileURL checks that a file:// storage_url with a
+// relative path fails at load. Accepted, it would resolve against the
+// working directory, so a backup run from another directory would write
+// to a different destination and still succeed.
+func TestLoadRejectsRelativeFileURL(t *testing.T) {
+	t.Parallel()
+
+	const relativeConfig = "snapshots:\n" +
+		"  test:\n" +
+		"    paths: [/tmp/vaultik-test-source]\n" +
+		"storage_url: file://dest\n"
+
+	path := filepath.Join(t.TempDir(), "config.yml")
+
+	err := os.WriteFile(path, []byte(relativeConfig), 0o600)
+	if err != nil {
+		t.Fatalf("write config: %v", err)
+	}
+
+	_, err = Load(path)
+	if !errors.Is(err, errFileURLNotAbsolute) {
+		t.Fatalf("Load() error = %v, want errFileURLNotAbsolute", err)
+	}
+
+	if !strings.Contains(err.Error(), "absolute path") {
+		t.Errorf("error %q does not say to use an absolute path", err.Error())
+	}
+}
+
 // TestValidateAgeRecipients checks that recipients are parsed at config load
 // (a bad entry fails immediately, not mid-backup) and that no invalid entry —
 // least of all a pasted secret key — is echoed in the error. An empty list

internal/database/schema/001.sql

@@ -86,6 +86,7 @@ CREATE TABLE IF NOT EXISTS snapshots (
     completed_at INTEGER,
     file_count INTEGER NOT NULL DEFAULT 0,
     chunk_count INTEGER NOT NULL DEFAULT 0,
+    new_chunk_size INTEGER NOT NULL DEFAULT 0,
     blob_count INTEGER NOT NULL DEFAULT 0,
     total_size INTEGER NOT NULL DEFAULT 0,
     blob_size INTEGER NOT NULL DEFAULT 0,

internal/database/snapshots.go

@@ -129,6 +129,7 @@ func (r *SnapshotRepository) UpdateExtendedStats(
 	compressionLevel int,
 	uploadBytes int64,
 	uploadDurationMs int64,
+	newChunkSize int64,
 ) error {
 	compressionRatio, err := r.extendedCompressionRatio(
 		ctx, tx, snapshotID, blobUncompressedSize,
@@ -143,18 +144,19 @@ func (r *SnapshotRepository) UpdateExtendedStats(
 		    compression_ratio = ?,
 		    compression_level = ?,
 		    upload_bytes = ?,
-		    upload_duration_ms = ?
+		    upload_duration_ms = ?,
+		    new_chunk_size = ?
 		WHERE id = ?
 	`
 
 	if tx != nil {
 		_, err = tx.ExecContext(ctx, query,
 			blobUncompressedSize, compressionRatio, compressionLevel,
-			uploadBytes, uploadDurationMs, snapshotID)
+			uploadBytes, uploadDurationMs, newChunkSize, snapshotID)
 	} else {
 		_, err = r.db.ExecWithLog(ctx, query,
 			blobUncompressedSize, compressionRatio, compressionLevel,
-			uploadBytes, uploadDurationMs, snapshotID)
+			uploadBytes, uploadDurationMs, newChunkSize, snapshotID)
 	}
 
 	if err != nil {
@@ -594,45 +596,24 @@ func (r *SnapshotRepository) GetSnapshotUncompressedChunkSize(
 	return totalSize, nil
 }
 
-// GetSnapshotNewChunkSize returns the sum of plaintext sizes of chunks that are
-// referenced by this snapshot but not by any earlier completed snapshot known to
-// the local database. The result is the marginal uncompressed data this snapshot
-// added to the dedup pool — i.e., the delta from prior snapshots.
+// GetSnapshotNewChunkSize returns the total plaintext size of the chunks the
+// snapshot's backup stored that were not stored before, as the backup
+// recorded it. It is not derived from the snapshot's files: a file's row is
+// shared by every snapshot that lists it and is rewritten when the file
+// changes, so it shows only the file's latest chunks.
 func (r *SnapshotRepository) GetSnapshotNewChunkSize(
 	ctx context.Context, snapshotID string,
 ) (int64, error) {
-	query := `
-		WITH this_snap_chunks AS (
-			SELECT DISTINCT fc.chunk_hash
-			FROM snapshot_files sf
-			JOIN file_chunks fc ON sf.file_id = fc.file_id
-			WHERE sf.snapshot_id = ?
-		),
-		prior_chunks AS (
-			SELECT DISTINCT fc.chunk_hash
-			FROM snapshots s
-			JOIN snapshot_files sf ON sf.snapshot_id = s.id
-			JOIN file_chunks fc ON fc.file_id = sf.file_id
-			WHERE s.completed_at IS NOT NULL
-			  AND s.id != ?
-			  AND s.started_at < (SELECT started_at FROM snapshots WHERE id = ?)
-		)
-		SELECT COALESCE(SUM(c.size), 0)
-		FROM chunks c
-		JOIN this_snap_chunks t ON c.chunk_hash = t.chunk_hash
-		WHERE c.chunk_hash NOT IN (SELECT chunk_hash FROM prior_chunks)
-	`
+	query := `SELECT new_chunk_size FROM snapshots WHERE id = ?`
 
-	var totalSize int64
+	var newChunkSize int64
 
-	err := r.db.conn.QueryRowContext(
-		ctx, query, snapshotID, snapshotID, snapshotID,
-	).Scan(&totalSize)
+	err := r.db.conn.QueryRowContext(ctx, query, snapshotID).Scan(&newChunkSize)
 	if err != nil {
 		return 0, fmt.Errorf("querying new chunk size: %w", err)
 	}
 
-	return totalSize, nil
+	return newChunkSize, nil
 }
 
 // GetIncompleteSnapshots returns all snapshots that haven't been completed

internal/snapshot/exclude_test.go

@@ -531,3 +531,50 @@ func TestExcludePatterns_UnanchoredPatternFile(t *testing.T) {
 	require.Equal(t, 1, result.FilesScanned,
 		"Unanchored pattern for file should match anywhere")
 }
+
+func TestExcludePatterns_DoubleStarDirectoryAtEveryDepth(t *testing.T) {
+	t.Parallel()
+
+	// As in gitignore, a leading **/ also matches directly under the source dir
+	fs := setupAnchoredTestFS(t)
+
+	scanner, repos, cleanup := createTestScanner(t, fs, []string{"**/projectname"})
+	defer cleanup()
+
+	ctx := context.Background()
+	createSnapshotRecord(ctx, t, repos, "test-snapshot")
+
+	result, err := scanner.Scan(ctx, "/backup", "test-snapshot")
+	require.NoError(t, err)
+
+	// **/projectname should exclude BOTH:
+	// - /backup/projectname/file.txt
+	// - /backup/otherproject/projectname/file.txt
+	// Total files: 4, excluded: 2
+	require.Equal(t, 2, result.FilesScanned,
+		"**/ directory pattern should match at the top level and nested")
+}
+
+func TestExcludePatterns_DoubleStarFileAtEveryDepth(t *testing.T) {
+	t.Parallel()
+
+	// As in gitignore, a leading **/ also matches directly under the source dir
+	fs := setupAnchoredTestFS(t)
+
+	scanner, repos, cleanup := createTestScanner(t, fs, []string{"**/*.txt"})
+	defer cleanup()
+
+	ctx := context.Background()
+	createSnapshotRecord(ctx, t, repos, "test-snapshot")
+
+	result, err := scanner.Scan(ctx, "/backup", "test-snapshot")
+	require.NoError(t, err)
+
+	// **/*.txt should exclude ALL .txt files:
+	// - /backup/file.txt
+	// - /backup/projectname/file.txt
+	// - /backup/otherproject/projectname/file.txt
+	// Total files: 4, excluded: 3
+	require.Equal(t, 1, result.FilesScanned,
+		"**/ file pattern should match at the top level and nested")
+}

internal/snapshot/scanner.go

@@ -135,7 +135,9 @@ type ScannerConfig struct {
 // are counted per file: BytesScanned is the size of the new and changed
 // files, BytesSkipped that of the unchanged ones. FilesFailed counts the
 // new and changed files that phase 2 could not store; FilesScanned
-// includes them and BytesScanned does not.
+// includes them and BytesScanned does not. ChunksCreated counts the
+// chunks that were not already stored, and NewChunkSize is their total
+// size.
 type ScanResult struct {
 	FilesScanned   int
 	FilesSkipped   int
@@ -145,6 +147,7 @@ type ScanResult struct {
 	BytesSkipped   int64
 	BytesDeleted   int64
 	ChunksCreated  int
+	NewChunkSize   int64
 	BlobsCreated   int
 	BlobsUploaded  int
 	BytesUploaded  int64
@@ -1295,6 +1298,11 @@ func (s *Scanner) batchAddFilesToSnapshot(
 func (s *Scanner) processPhase(
 	ctx context.Context, filesToProcess []*FileToProcess, result *ScanResult,
 ) error {
+	// On an error or cancellation the blob being packed is never
+	// finalized, so its temp file must be removed here. After a
+	// successful flush there is no such blob and this does nothing.
+	defer s.packer.DiscardCurrentBlob()
+
 	// Calculate total bytes to process
 	var totalBytes int64
 	for _, f := range filesToProcess {
@@ -1861,11 +1869,12 @@ func (s *Scanner) processFileStreaming(
 	return nil
 }
 
-// updateChunkStats counts a chunk that was not already stored. The scan
-// result's file counts, BytesScanned and BytesSkipped are not touched
-// here: the scan phase counts each file once.
+// updateChunkStats counts a chunk that was not already stored, and its
+// size. The scan result's file counts, BytesScanned and BytesSkipped are
+// not touched here: the scan phase counts each file once.
 func (s *Scanner) updateChunkStats(chunkSize int64, result *ScanResult) {
 	result.ChunksCreated++
+	result.NewChunkSize += chunkSize
 
 	if s.progress != nil {
 		s.progress.GetStats().ChunksCreated.Add(1)
@@ -2013,6 +2022,14 @@ func compileExcludePatterns(patterns []string) []compiledPattern {
 		// Remove trailing slash if present (directory indicator)
 		pattern = strings.TrimSuffix(pattern, "/")
 
+		// A leading "**/" demands a "/" before the name and so misses an
+		// entry directly under the source path. An unanchored pattern
+		// already matches at every depth, so drop the prefix: as in
+		// gitignore, "**/x" then also matches a top-level "x".
+		if !anchored {
+			pattern = strings.TrimPrefix(pattern, "**/")
+		}
+
 		// Compile the glob pattern
 		// For patterns without path separators, we need to match them as components
 		// e.g., ".git" should match ".git" anywhere in the path

internal/snapshot/skip_errors_test.go

@@ -381,3 +381,60 @@ func TestScannerCancelStopsSkipErrorsRun(t *testing.T) {
 		})
 	}
 }
+
+// TestScannerRemovesBlobTempFileWhenRunStops checks that a run stopped
+// part-way, by a file it cannot read or by a cancellation, removes the
+// temp file of the blob it was packing.
+func TestScannerRemovesBlobTempFileWhenRunStops(t *testing.T) {
+	t.Parallel()
+
+	// a.txt is backed up first and starts a blob; the run stops at b.txt.
+	const target = "/source/b.txt"
+
+	tests := []struct {
+		name  string
+		newFs func(cancel context.CancelFunc) afero.Fs
+	}{
+		{
+			name: "file cannot be read",
+			newFs: func(context.CancelFunc) afero.Fs {
+				return &readFailFs{Fs: afero.NewMemMapFs(), target: target}
+			},
+		},
+		{
+			name: "cancelled",
+			newFs: func(cancel context.CancelFunc) afero.Fs {
+				return &cancelOnOpenFs{
+					Fs: afero.NewMemMapFs(), target: target, cancel: cancel,
+				}
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			ctx, cancel := context.WithCancel(context.Background())
+			defer cancel()
+
+			fs := tt.newFs(cancel)
+			writeSkipErrorTestFile(t, fs, "/source/a.txt", "first file content")
+			writeSkipErrorTestFile(t, fs, target, "second file content")
+
+			_, err := runSkipErrorScan(ctx, t, fs, "/source", false, nil)
+			if err == nil {
+				t.Fatal("expected the scan to stop with an error, got nil")
+			}
+
+			left, err := afero.Glob(fs, filepath.Join(os.TempDir(), "vaultik-blob-*"))
+			if err != nil {
+				t.Fatalf("listing blob temp files: %v", err)
+			}
+
+			if len(left) != 0 {
+				t.Fatalf("expected no blob temp file left, got %v", left)
+			}
+		})
+	}
+}

internal/snapshot/snapshot.go

@@ -199,6 +199,7 @@ func (sm *SnapshotManager) UpdateSnapshotStatsExtended(
 			stats.CompressionLevel,
 			stats.BytesUploaded,
 			stats.UploadDurationMs,
+			stats.NewChunkSize,
 		)
 	})
 }
@@ -906,6 +907,7 @@ type ExtendedBackupStats struct {
 	BlobUncompressedSize int64 // Total uncompressed size of all referenced blobs
 	CompressionLevel     int   // Compression level used for this snapshot
 	UploadDurationMs     int64 // Total milliseconds spent uploading to S3
+	NewChunkSize         int64 // Total size of the chunks counted in ChunksCreated
 }
 
 // deleteOtherSnapshots deletes all snapshots except the current one

internal/storage/faultstore/faultstore.go

@@ -1,16 +1,15 @@
 // Package faultstore provides a storage.Storer wrapper that injects
 // faults on demand, so tests can reproduce the failure modes a real
 // backend exhibits: an upload that fails partway, a backend that reports
-// success while storing nothing, reads that return corrupt or truncated
-// bytes, and a delete the backend refuses. It is the seam called for by
-// the fault-injection tests (sneak/vaultik issue 72) and is meant to be
-// reused by future tests rather than re-implemented per case.
+// success while storing nothing, and reads that return corrupt or
+// truncated bytes. It is the seam called for by the fault-injection
+// tests (sneak/vaultik issue 72) and is meant to be reused by future
+// tests rather than re-implemented per case.
 //
-// The wrapper delegates every method to the inner Storer. Three hooks
-// change that: OnPut decides the fate of each write, OnGet decides how
-// each read's bytes are returned, and OnDelete decides whether each
-// delete fails. All are keyed by the object key, so a test can fault
-// only blobs, only metadata, or a single object.
+// The wrapper delegates every method to the inner Storer. Two hooks
+// change that: OnPut decides the fate of each write, and OnGet decides
+// how each read's bytes are returned. Both are keyed by the object key,
+// so a test can fault only blobs, only metadata, or a single object.
 package faultstore
 
 import (
@@ -26,10 +25,6 @@ import (
 // ErrInjectedUpload is returned by a Put the OnPut hook chose to fail.
 var ErrInjectedUpload = errors.New("faultstore: injected upload failure")
 
-// ErrInjectedDelete is returned by a Delete the OnDelete hook chose to
-// fail.
-var ErrInjectedDelete = errors.New("faultstore: injected delete failure")
-
 // PutAction is the disposition OnPut assigns to a write.
 type PutAction int
 
@@ -71,11 +66,6 @@ type Storer struct {
 	// OnGet, when set, is consulted for every Get with the object key
 	// and damages the returned bytes accordingly.
 	OnGet func(key string) GetFault
-
-	// OnDelete, when set, is consulted before every Delete with the
-	// object key. Returning true fails the delete and leaves the object
-	// in place.
-	OnDelete func(key string) bool
 }
 
 // New wraps inner. inner must be non-nil.
@@ -164,12 +154,8 @@ func (f *Storer) Stat(ctx context.Context, key string) (*storage.ObjectInfo, err
 	return f.inner.Stat(ctx, key)
 }
 
-// Delete removes the object unless OnDelete fails the delete.
+// Delete delegates unchanged.
 func (f *Storer) Delete(ctx context.Context, key string) error {
-	if f.OnDelete != nil && f.OnDelete(key) {
-		return fmt.Errorf("%w for %q", ErrInjectedDelete, key)
-	}
-
 	return f.inner.Delete(ctx, key)
 }
 

internal/storage/url.go

@@ -17,8 +17,10 @@ const (
 
 // Sentinel errors for storage URL parsing.
 var (
-	ErrEmptyStorageURL   = errors.New("storage URL is empty")
-	ErrEmptyFilePath     = errors.New("file URL path is empty")
+	ErrEmptyStorageURL  = errors.New("storage URL is empty")
+	ErrEmptyFilePath    = errors.New("file URL path is empty")
+	ErrRelativeFilePath = errors.New(
+		"file URL needs an absolute path, as in file:///path/to/backup")
 	ErrMissingBucket     = errors.New("s3 URL missing bucket name")
 	ErrMissingRemote     = errors.New("rclone URL missing remote name")
 	ErrUnsupportedScheme = errors.New(
@@ -51,17 +53,8 @@ func ParseStorageURL(rawURL string) (*URL, error) {
 		return nil, ErrEmptyStorageURL
 	}
 
-	// Handle file:// URLs
 	if after, ok := strings.CutPrefix(rawURL, "file://"); ok {
-		path := after
-		if path == "" {
-			return nil, ErrEmptyFilePath
-		}
-
-		return &URL{
-			Scheme: schemeFile,
-			Prefix: path,
-		}, nil
+		return parseFileURL(after)
 	}
 
 	if strings.HasPrefix(rawURL, "s3://") {
@@ -75,6 +68,27 @@ func ParseStorageURL(rawURL string) (*URL, error) {
 	return nil, ErrUnsupportedScheme
 }
 
+// parseFileURL parses the path that follows file://. The path must be
+// absolute: a relative one would resolve against the working directory,
+// so the destination would move with it. Percent-escapes are decoded, so
+// my%20stick names the directory "my stick"; a literal space is kept.
+func parseFileURL(rawPath string) (*URL, error) {
+	if rawPath == "" {
+		return nil, ErrEmptyFilePath
+	}
+
+	if !strings.HasPrefix(rawPath, "/") {
+		return nil, ErrRelativeFilePath
+	}
+
+	path, err := url.PathUnescape(rawPath)
+	if err != nil {
+		return nil, fmt.Errorf("invalid file URL path: %w", err)
+	}
+
+	return &URL{Scheme: schemeFile, Prefix: path}, nil
+}
+
 // parseS3URL parses an s3://bucket/prefix URL. It rejects credentials in
 // the userinfo and any query parameter other than endpoint, region and
 // ssl, so a credential-bearing URL is never stored or echoed.

internal/storage/url_parse_test.go

@@ -14,7 +14,10 @@ import (
 func TestParseStorageURLValid(t *testing.T) {
 	t.Parallel()
 
-	const bucket = "mybucket"
+	const (
+		bucket     = "mybucket"
+		fileScheme = "file"
+	)
 
 	cases := []struct {
 		name string
@@ -24,7 +27,17 @@ func TestParseStorageURLValid(t *testing.T) {
 		{
 			name: "file absolute path",
 			raw:  "file:///var/backups/vaultik",
-			want: &storage.URL{Scheme: "file", Prefix: "/var/backups/vaultik"},
+			want: &storage.URL{Scheme: fileScheme, Prefix: "/var/backups/vaultik"},
+		},
+		{
+			name: "file percent-escaped path is decoded",
+			raw:  "file:///Volumes/my%20stick/backup",
+			want: &storage.URL{Scheme: fileScheme, Prefix: "/Volumes/my stick/backup"},
+		},
+		{
+			name: "file path with a literal space",
+			raw:  "file:///Volumes/my stick/backup",
+			want: &storage.URL{Scheme: fileScheme, Prefix: "/Volumes/my stick/backup"},
 		},
 		{
 			name: "s3 bucket and prefix, ssl defaults on",
@@ -90,6 +103,7 @@ func TestParseStorageURLErrors(t *testing.T) {
 	}{
 		{"empty url", "", storage.ErrEmptyStorageURL},
 		{"file empty path", "file://", storage.ErrEmptyFilePath},
+		{"file relative path", "file://dest", storage.ErrRelativeFilePath},
 		{"s3 missing bucket", "s3://", storage.ErrMissingBucket},
 		{"s3 missing bucket with path", "s3:///justprefix", storage.ErrMissingBucket},
 		{"rclone missing remote", "rclone://", storage.ErrMissingRemote},

internal/vaultik/info.go

@@ -167,10 +167,6 @@ const (
 	// metadataKeyParts is the minimum "/"-separated segment count of a
 	// metadata object key (metadata/<snapshot-id>/<filename>).
 	metadataKeyParts = 3
-
-	// blobKeyParts is the minimum "/"-separated segment count of a blob
-	// object key (blobs/<aa>/<bb>/<hash>).
-	blobKeyParts = 4
 )
 
 // SnapshotMetadataInfo contains information about a single snapshot's metadata
@@ -454,23 +450,16 @@ func (v *Vaultik) scanRemoteBlobStorage(
 		v.stdoutf("Scanning blobs...\n")
 	}
 
-	blobCh := v.Storage.ListStream(v.ctx, "blobs/")
-	allBlobs := make(map[string]int64)
+	// Use prune's listing, so a file under blobs/ that prune would never
+	// delete is not counted as a blob, and so not as an orphaned one.
+	allBlobs, err := v.listAllRemoteBlobs()
+	if err != nil {
+		return err
+	}
 
-	for obj := range blobCh {
-		if obj.Err != nil {
-			return fmt.Errorf("listing blobs: %w", obj.Err)
-		}
-
-		parts := strings.Split(obj.Key, "/")
-		if len(parts) < blobKeyParts {
-			continue
-		}
-
-		hash := parts[3]
-		allBlobs[hash] = obj.Size
+	for _, size := range allBlobs {
 		result.TotalBlobCount++
-		result.TotalBlobSize += obj.Size
+		result.TotalBlobSize += size
 	}
 
 	// A blob named only by a manifest that could not be read, or by one

internal/vaultik/new_chunk_size_test.go

@@ -0,0 +1,133 @@
+package vaultik_test
+
+import (
+	"bytes"
+	"context"
+	"maps"
+	"path/filepath"
+	"testing"
+
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/vaultik/internal/chunker"
+	"sneak.berlin/go/vaultik/internal/database"
+	"sneak.berlin/go/vaultik/internal/log"
+	"sneak.berlin/go/vaultik/internal/storage"
+	"sneak.berlin/go/vaultik/internal/vaultik"
+)
+
+// TestNewChunkSizeOfChangedFileStaysFixed covers
+// https://git.eeqj.de/sneak/vaultik/issues/311. A backup whose only change
+// is a modified file lists the size of the chunks that change added as its
+// NEW CHUNK SIZE, and a later backup that changes the file again leaves
+// every earlier snapshot's figure as it was. The file's row in the local
+// index is shared by all three snapshots and rewritten by each backup.
+func TestNewChunkSizeOfChangedFileStaysFixed(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	fs := afero.NewOsFs()
+	tempDir := t.TempDir()
+	dataDir := filepath.Join(tempDir, "src")
+	dbPath := filepath.Join(tempDir, "index.sqlite")
+	changedPath := filepath.Join(dataDir, "changed.bin")
+
+	ctx := context.Background()
+	files := writeFaultSourceTree(t, fs, dataDir)
+	cfg := changedFileConfig(dataDir, dbPath)
+
+	appendRandomBytes(t, fs, files, changedPath, appendedFileSize)
+
+	store, err := storage.NewFileStorer(filepath.Join(tempDir, "remote"))
+	require.NoError(t, err)
+
+	db, err := database.New(ctx, dbPath)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = db.Close() })
+
+	repos := database.NewRepositories(db)
+	v := newBackupVaultik(ctx, cfg, store, repos, db, fs)
+
+	require.NoError(t, backUp(v, "first"))
+
+	firstFiles := maps.Clone(files)
+	firstID := localSnapshotID(ctx, t, repos, "first")
+
+	appendRandomBytes(t, fs, files, changedPath, faultChunkSize)
+	require.NoError(t, backUp(v, "second"))
+
+	secondID := localSnapshotID(ctx, t, repos, "second")
+	secondAdded := sizeOfNewChunks(t, files, firstFiles)
+	require.Positive(t, secondAdded)
+	assert.Equal(t, secondAdded, listedNewChunkSizes(t, v)[secondID],
+		"the second snapshot must count the chunks the change added")
+
+	appendRandomBytes(t, fs, files, changedPath, faultChunkSize)
+	require.NoError(t, backUp(v, "third"))
+
+	sizes := listedNewChunkSizes(t, v)
+	assert.Equal(t, sizeOfNewChunks(t, firstFiles, nil), sizes[firstID],
+		"a later backup must not change the first snapshot's figure")
+	assert.Equal(t, secondAdded, sizes[secondID],
+		"a later backup must not change the second snapshot's figure")
+}
+
+// sizeOfNewChunks returns the total size of the distinct chunks of the
+// files in after that no file in before has, cut the way the backup cuts
+// them.
+func sizeOfNewChunks(t *testing.T, after, before map[string][]byte) int64 {
+	t.Helper()
+
+	known := make(map[string]bool)
+	for _, chunk := range chunksOf(t, before) {
+		known[chunk.Hash] = true
+	}
+
+	var total int64
+
+	for _, chunk := range chunksOf(t, after) {
+		if !known[chunk.Hash] {
+			known[chunk.Hash] = true
+			total += chunk.Size
+		}
+	}
+
+	return total
+}
+
+// chunksOf returns the chunks of every file in files.
+func chunksOf(t *testing.T, files map[string][]byte) []chunker.Chunk {
+	t.Helper()
+
+	c := chunker.NewChunker(faultChunkSize)
+
+	var all []chunker.Chunk
+
+	for _, content := range files {
+		chunks, err := c.ChunkReader(bytes.NewReader(content))
+		require.NoError(t, err)
+
+		all = append(all, chunks...)
+	}
+
+	return all
+}
+
+// listedNewChunkSizes runs `snapshot list --json` and returns each listed
+// snapshot's new_chunk_size by snapshot ID.
+func listedNewChunkSizes(t *testing.T, v *vaultik.Vaultik) map[string]int64 {
+	t.Helper()
+
+	var out bytes.Buffer
+
+	v.Stdout = &out
+	require.NoError(t, v.ListSnapshots(true))
+
+	sizes := make(map[string]int64)
+	for _, row := range decodeListJSON(t, out.String()) {
+		sizes[row.ID] = row.NewChunkSize
+	}
+
+	return sizes
+}

internal/vaultik/nuke_remote_test.go

@@ -5,14 +5,12 @@ import (
 	"io/fs"
 	"os"
 	"path/filepath"
-	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"sneak.berlin/go/vaultik/internal/log"
 	"sneak.berlin/go/vaultik/internal/snapshot"
-	"sneak.berlin/go/vaultik/internal/storage/faultstore"
 )
 
 // TestNukeRemoteLeavesNoFiles checks that remote nuke leaves no file
@@ -25,7 +23,7 @@ func TestNukeRemoteLeavesNoFiles(t *testing.T) {
 
 	ctx := context.Background()
 	storeDir := filepath.Join(t.TempDir(), "store")
-	v, repos, out := backUpToFileDestination(ctx, t, storeDir)
+	v, repos, _ := backUpToFileDestination(ctx, t, storeDir)
 
 	snapshots, err := repos.Snapshots.ListRecent(ctx, listRecentTestLimit)
 	require.NoError(t, err)
@@ -63,82 +61,4 @@ func TestNukeRemoteLeavesNoFiles(t *testing.T) {
 		})
 	require.NoError(t, err)
 	assert.Empty(t, files)
-
-	// Nuke deletes the blobs itself, so advice to run prune is wrong.
-	assert.Contains(t, out.String(), "Backup destination store is now empty.")
-	assert.NotContains(t, out.String(), "vaultik prune")
-}
-
-// TestNukeRemoteFailsWhenADeleteFails checks that remote nuke returns an
-// error when a snapshot's metadata or a blob cannot be deleted, does not
-// report the store empty, and advises running nuke again: prune deletes
-// no metadata.
-func TestNukeRemoteFailsWhenADeleteFails(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	for _, refusedPrefix := range []string{"metadata/", "blobs/"} {
-		t.Run(refusedPrefix, func(t *testing.T) {
-			t.Parallel()
-
-			ctx := context.Background()
-			storeDir := filepath.Join(t.TempDir(), "store")
-			v, _, out := backUpToFileDestination(ctx, t, storeDir)
-
-			store := faultstore.New(v.Storage)
-			store.OnDelete = func(key string) bool {
-				return strings.HasPrefix(key, refusedPrefix)
-			}
-			v.Storage = store
-
-			require.Error(t, v.NukeRemote(true))
-
-			assert.NotContains(t, out.String(), "now empty")
-			assert.Contains(t, out.String(), "vaultik remote nuke --force")
-			assert.NotContains(t, out.String(), "vaultik prune")
-		})
-	}
-}
-
-// TestNukeRemoteRefusesAnotherDestinationWithoutRetryAdvice checks that
-// remote nuke, when the local index belongs to a different destination
-// than the configured one, fails without advising to run nuke again:
-// that run would fail the same way.
-func TestNukeRemoteRefusesAnotherDestinationWithoutRetryAdvice(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	storeDir := filepath.Join(t.TempDir(), "store")
-	v, _, out := backUpToFileDestination(ctx, t, storeDir)
-
-	v.Config.StorageURL = "file://" + filepath.Join(t.TempDir(), "elsewhere")
-
-	err := v.NukeRemote(true)
-
-	require.ErrorContains(t, err, "bound to a different backup destination")
-	assert.NotContains(t, out.String(), "vaultik remote nuke --force")
-}
-
-// TestNukeRemoteFailsWhenALocalSnapshotCannotBeRemoved checks that a
-// snapshot remote nuke cannot remove from the local index fails the
-// run: nuke then leaves that snapshot's metadata on the destination
-// store.
-func TestNukeRemoteFailsWhenALocalSnapshotCannotBeRemoved(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	storeDir := filepath.Join(t.TempDir(), "store")
-	v, _, out := backUpToFileDestination(ctx, t, storeDir)
-
-	_, err := v.DB.Conn().ExecContext(ctx, `
-		CREATE TRIGGER refuse_snapshot_delete BEFORE DELETE ON snapshots
-		BEGIN SELECT RAISE(ABORT, 'simulated index error'); END`)
-	require.NoError(t, err)
-
-	require.Error(t, v.NukeRemote(true))
-
-	assert.NotContains(t, out.String(), "now empty")
-	assert.Contains(t, out.String(), "vaultik remote nuke --force")
 }

internal/vaultik/prune.go

@@ -19,18 +19,14 @@ type PruneOptions struct {
 var errNukeRequiresForce = errors.New(
 	"nuke requires --force (this deletes ALL remote snapshots and blobs)")
 
-// errBlobDeleteFailed reports unreferenced blobs prune could not delete.
-var errBlobDeleteFailed = errors.New("blob(s) could not be deleted")
-
-// nukeCommandHint is the command suggested when a remote nuke could not
-// delete everything: running it again deletes what is left, which
-// `vaultik prune` does not do for snapshot metadata.
-const nukeCommandHint = "vaultik remote nuke --force"
-
 // metadataDirName is the top-level remote directory holding snapshot
 // metadata.
 const metadataDirName = "metadata"
 
+// blobKeyParts is the "/"-separated segment count of a blob object key
+// (blobs/<aa>/<bb>/<hash>).
+const blobKeyParts = 4
+
 // NukeRemote deletes every snapshot's metadata and every blob from remote
 // storage, along with any object an upload cut off part-way left under a
 // temporary `.partial` name. After this returns successfully the bucket
@@ -43,29 +39,6 @@ func (v *Vaultik) NukeRemote(force bool) error {
 		return errNukeRequiresForce
 	}
 
-	// Checked before anything is deleted: running nuke again would fail
-	// the same way, so the advice below must not follow this error.
-	err := v.EnsureStorageBinding()
-	if err != nil {
-		return err
-	}
-
-	err = v.emptyDestinationStore()
-	if err != nil {
-		v.UI.Warningf("Run '%s' again to delete what is left on the "+
-			"backup destination store.", nukeCommandHint)
-
-		return err
-	}
-
-	v.UI.Completef("Backup destination store is now empty.")
-
-	return nil
-}
-
-// emptyDestinationStore does the deleting for NukeRemote and stops at
-// the first step that fails.
-func (v *Vaultik) emptyDestinationStore() error {
 	v.UI.Beginf("Removing all snapshot metadata from backup destination store.")
 
 	_, err := v.RemoveAllSnapshots(&RemoveOptions{Force: true})
@@ -89,6 +62,8 @@ func (v *Vaultik) emptyDestinationStore() error {
 		}
 	}
 
+	v.UI.Completef("Backup destination store is now empty.")
+
 	return nil
 }
 
@@ -191,17 +166,14 @@ func (v *Vaultik) PruneBlobs(opts *PruneOptions) error {
 	v.deleteUnreferencedBlobs(unreferencedBlobs, allBlobs, result)
 
 	if opts.JSON {
-		err = v.outputPruneBlobsJSON(result)
-		if err != nil {
-			return err
-		}
-	} else {
-		v.stdoutf("\nDeleted %d blob(s) totaling %s\n",
-			result.BlobsDeleted, ubytes(result.BytesFreed))
+		return v.outputPruneBlobsJSON(result)
 	}
 
+	v.stdoutf("\nDeleted %d blob(s) totaling %s\n",
+		result.BlobsDeleted, ubytes(result.BytesFreed))
+
 	if result.BlobsFailed > 0 {
-		return fmt.Errorf("%d %w", result.BlobsFailed, errBlobDeleteFailed)
+		v.stdoutf("Failed to delete %d blob(s)\n", result.BlobsFailed)
 	}
 
 	return nil

internal/vaultik/prune_delete_failure_test.go

@@ -1,98 +0,0 @@
-package vaultik_test
-
-import (
-	"context"
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/vaultik/internal/log"
-	"sneak.berlin/go/vaultik/internal/storage/faultstore"
-	"sneak.berlin/go/vaultik/internal/vaultik"
-)
-
-// refuseBlobDeletes is an OnDelete hook that fails every blob delete.
-func refuseBlobDeletes(key string) bool {
-	return strings.HasPrefix(key, "blobs/")
-}
-
-// TestPruneBlobs_FailedDeleteReturnsError checks that prune returns an
-// error, so the command exits non-zero, when an unreferenced blob cannot
-// be deleted.
-func TestPruneBlobs_FailedDeleteReturnsError(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	env := newListEnv(t)
-
-	// The store holds no manifest, so nothing references this blob.
-	addBlob(t, env.store.testStorer, testBlobHashA)
-
-	store := faultstore.New(env.store)
-	store.OnDelete = refuseBlobDeletes
-	env.v.Storage = store
-
-	err := env.v.PruneBlobs(&vaultik.PruneOptions{Force: true})
-
-	require.ErrorContains(t, err, "1 blob(s) could not be deleted")
-}
-
-// TestPruneBlobs_JSONFailedDeleteReturnsError checks that prune --json
-// prints its document and then returns an error when an unreferenced
-// blob cannot be deleted.
-func TestPruneBlobs_JSONFailedDeleteReturnsError(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	env := newListEnv(t)
-	addBlob(t, env.store.testStorer, testBlobHashA)
-
-	store := faultstore.New(env.store)
-	store.OnDelete = refuseBlobDeletes
-	env.v.Storage = store
-
-	err := env.v.PruneBlobs(&vaultik.PruneOptions{JSON: true})
-
-	require.Error(t, err, "prune must fail when a blob cannot be deleted")
-
-	var result vaultik.PruneBlobsResult
-
-	require.NoError(t, json.Unmarshal(env.stdout.Bytes(), &result),
-		"stdout must hold the JSON document, got:\n%s", env.stdout.String())
-	assert.Equal(t, 1, result.BlobsFailed)
-	assert.Equal(t, 0, result.BlobsDeleted)
-}
-
-// TestCreateSnapshotPrune_FailedBlobDeleteReturnsError checks that the
-// prune step of snapshot create --prune fails the run when an
-// unreferenced blob cannot be deleted.
-func TestCreateSnapshotPrune_FailedBlobDeleteReturnsError(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	storeDir := filepath.Join(t.TempDir(), "store")
-	v, _, _ := backUpToFileDestination(ctx, t, storeDir)
-
-	// No snapshot references this blob, so the prune step deletes it.
-	orphan := filepath.Join(storeDir, "blobs", testBlobHashA[:2],
-		testBlobHashA[2:4], testBlobHashA)
-	require.NoError(t, os.MkdirAll(filepath.Dir(orphan), 0o750))
-	require.NoError(t, os.WriteFile(orphan, []byte("orphan"), 0o600))
-
-	store := faultstore.New(v.Storage)
-	store.OnDelete = refuseBlobDeletes
-	v.Storage = store
-
-	err := v.CreateSnapshot(&vaultik.SnapshotCreateOptions{
-		Cron:  true,
-		Prune: true,
-	})
-
-	require.ErrorContains(t, err, "1 blob(s) could not be deleted")
-	assert.FileExists(t, orphan)
-}

internal/vaultik/remote_info_test.go

@@ -185,6 +185,39 @@ func TestRemoteInfo_SkipsNonConformingMetadataName(t *testing.T) {
 	assert.NotContains(t, doc, "unreadable_manifests")
 }
 
+// TestRemoteInfo_DoesNotCountNonBlobFileUnderBlobs checks that a file
+// under blobs/ whose name is not a blob hash is not counted as a blob.
+// prune never deletes such a file, so counting it as an orphaned blob
+// would advise a prune that removes nothing.
+func TestRemoteInfo_DoesNotCountNonBlobFileUnderBlobs(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	env := newListEnv(t)
+	env.addRemote(t, listRemoteID, time.Date(2026, 3, 2, 0, 0, 0, 0, time.UTC))
+	addBlob(t, env.store.testStorer, testBlobHashA)
+	require.NoError(t, env.store.Put(context.Background(),
+		"blobs/"+testBlobHashA[:2]+"/"+testBlobHashA[2:4]+"/.DS_Store",
+		bytes.NewReader([]byte("junk"))))
+
+	require.NoError(t, env.v.RemoteInfo(false))
+
+	text := env.stdout.String()
+	assert.Contains(t, text, "Total blobs on remote:      1 (")
+	assert.Contains(t, text, "Orphaned (unreferenced):    0 (")
+	assert.NotContains(t, text, "vaultik prune")
+
+	env.stdout.Reset()
+	require.NoError(t, env.v.RemoteInfo(true))
+
+	var doc map[string]any
+
+	require.NoError(t, json.Unmarshal(env.stdout.Bytes(), &doc))
+	assert.InDelta(t, 1, doc["total_blob_count"], 0)
+	assert.InDelta(t, 0, doc["orphaned_blob_count"], 0)
+	assert.InDelta(t, 0, doc["orphaned_blob_size"], 0)
+}
+
 // TestRemoteInfo_DirectoryWithoutManifestLeavesOrphansKnown checks that
 // a directory under metadata/ holding no manifest.json.zst, such as one
 // left by a backup interrupted before its manifest upload, leaves the

internal/vaultik/remove_snapshot_test.go

@@ -476,8 +476,7 @@ func TestRemoveAllSnapshots_WithForce(t *testing.T) {
 	out := tv.Stdout.String()
 	assert.Contains(t, out, "Removed 2 snapshot(s)")
 	assert.Contains(t, out, "Removed snapshot metadata from remote storage")
-	// Remote nuke, the only caller, deletes the blobs next itself.
-	assert.NotContains(t, out, "vaultik prune")
+	assert.Contains(t, out, "vaultik prune")
 }
 
 func TestRemoveAllSnapshots_DryRun(t *testing.T) {

internal/vaultik/snapshot.go

@@ -24,13 +24,18 @@ var (
 	errSnapshotVerifyFailed = errors.New("verification failed")
 	errRemoveAllNeedsForce  = errors.New("--all requires --force")
 	errSnapshotNotFound     = errors.New("snapshot not found")
-	errSnapshotRemoveFailed = errors.New("snapshot(s) could not be removed")
 	errInvalidTableName     = errors.New("invalid table name")
 	errNoAgeRecipients      = errors.New(
 		"creating a snapshot needs at least one public key in " +
 			"age_recipients (generate a keypair with: age-keygen)")
+	errKeepNewerThanNeedsPrune = errors.New("--keep-newer-than requires --prune")
 )
 
+// ErrPostBackupPruneFailed wraps a failure of the post-backup prune,
+// which runs only after every snapshot was created and uploaded, so the
+// caller can report it apart from a failed backup.
+var ErrPostBackupPruneFailed = errors.New("post-backup prune failed")
+
 // listRecentLimit caps how many snapshot rows are fetched from the
 // local index for listing and purge operations.
 const listRecentLimit = 10000
@@ -46,6 +51,26 @@ type SnapshotCreateOptions struct {
 	Snapshots     []string // Optional list of snapshot names to process (empty = all)
 }
 
+// Validate fails when KeepNewerThan is set without Prune or is not a
+// valid duration. Only the post-backup prune reads KeepNewerThan, after
+// the backup, so the caller checks it before starting one.
+func (opts *SnapshotCreateOptions) Validate() error {
+	if opts.KeepNewerThan == "" {
+		return nil
+	}
+
+	if !opts.Prune {
+		return errKeepNewerThanNeedsPrune
+	}
+
+	_, err := parseDuration(opts.KeepNewerThan)
+	if err != nil {
+		return fmt.Errorf("--keep-newer-than: %w", err)
+	}
+
+	return nil
+}
+
 // CreateSnapshot executes the snapshot creation operation
 func (v *Vaultik) CreateSnapshot(opts *SnapshotCreateOptions) error {
 	// config.Load accepts an empty list, since listing, verifying and
@@ -124,7 +149,7 @@ func (v *Vaultik) CreateSnapshot(opts *SnapshotCreateOptions) error {
 	if opts.Prune {
 		err = v.runPostBackupPrune(snapshotNames, opts.KeepNewerThan)
 		if err != nil {
-			return fmt.Errorf("post-backup prune: %w", err)
+			return fmt.Errorf("%w: %w", ErrPostBackupPruneFailed, err)
 		}
 	}
 
@@ -184,6 +209,7 @@ type snapshotStats struct {
 	totalFiles         int
 	totalBytes         int64
 	totalChunks        int
+	newChunkSize       int64
 	totalBlobs         int
 	totalBytesSkipped  int64
 	totalFilesSkipped  int
@@ -316,6 +342,7 @@ func (v *Vaultik) scanAllDirectories(
 		stats.totalFiles += result.FilesScanned
 		stats.totalBytes += result.BytesScanned
 		stats.totalChunks += result.ChunksCreated
+		stats.newChunkSize += result.NewChunkSize
 		stats.totalBlobs += result.BlobsCreated
 		stats.totalFilesSkipped += result.FilesSkipped
 		stats.totalFilesFailed += result.FilesFailed
@@ -378,6 +405,7 @@ func (v *Vaultik) finalizeSnapshotMetadata(
 		BlobUncompressedSize: stats.blobUncompressedSize,
 		CompressionLevel:     v.Config.CompressionLevel,
 		UploadDurationMs:     stats.uploadDuration.Milliseconds(),
+		NewChunkSize:         stats.newChunkSize,
 	}
 
 	err = v.SnapshotManager.UpdateSnapshotStatsExtended(v.ctx, snapshotID, extStats)
@@ -1514,8 +1542,8 @@ func (v *Vaultik) handleRemoveAllDryRun(
 
 // executeRemoveAll deletes every local snapshot and, unless LocalOnly
 // is set, every corresponding remote metadata directory plus any
-// orphan remote keys. Blobs are not touched. It returns an error when
-// any snapshot could not be removed.
+// orphan remote keys. Blobs are not touched; the printed prune-command
+// hint is the next step.
 func (v *Vaultik) executeRemoveAll(
 	localSnaps, orphanRemoteKeys []string, opts *RemoveOptions,
 ) (*RemoveResult, error) {
@@ -1529,11 +1557,18 @@ func (v *Vaultik) executeRemoveAll(
 
 	result := &RemoveResult{}
 
-	failures := v.removeAllLocalSnapshots(localSnaps, opts, result)
+	remoteErrors := v.removeAllLocalSnapshots(localSnaps, opts, result)
 
 	if !opts.LocalOnly {
-		failures += v.removeAllOrphanRemotes(orphanRemoteKeys, result)
-		result.RemoteRemoved = failures == 0
+		remoteErrors += v.removeAllOrphanRemotes(orphanRemoteKeys, result)
+
+		if remoteErrors == 0 {
+			result.RemoteRemoved = true
+		} else if v.UI != nil {
+			v.UI.Warningf("Some remote metadata deletions failed. Run '%s' "+
+				"once the remote is healthy to clean up unreferenced blobs.",
+				pruneCommandHint)
+		}
 	}
 
 	if v.SnapshotManager != nil {
@@ -1543,10 +1578,6 @@ func (v *Vaultik) executeRemoveAll(
 		}
 	}
 
-	if failures > 0 {
-		return result, fmt.Errorf("%d %w", failures, errSnapshotRemoveFailed)
-	}
-
 	if opts.JSON {
 		return result, v.outputRemoveJSON(result)
 	}
@@ -1555,6 +1586,9 @@ func (v *Vaultik) executeRemoveAll(
 
 	if !opts.LocalOnly && result.RemoteRemoved {
 		v.printlnStdout("Removed snapshot metadata from remote storage")
+		v.stdoutf("\nNote: Removed snapshots' blobs remain on the remote. "+
+			"Run '%s' to delete any blobs no longer referenced by any "+
+			"remaining remote snapshot.\n", pruneCommandHint)
 	}
 
 	return result, nil
@@ -1597,13 +1631,12 @@ func (v *Vaultik) deleteIncompleteSnapshot(snapshotIDStr string, id any) bool {
 }
 
 // removeAllLocalSnapshots removes each known local snapshot (and, unless
-// --local-only, its remote metadata), returning the number of snapshots
-// it could not remove. A snapshot left in the local index keeps its
-// remote metadata too, since it is not an orphan remote key.
+// --local-only, its remote metadata), returning the number of remote
+// deletion failures.
 func (v *Vaultik) removeAllLocalSnapshots(
 	localSnaps []string, opts *RemoveOptions, result *RemoveResult,
 ) int {
-	failures := 0
+	remoteErrors := 0
 
 	for _, snapshotID := range localSnaps {
 		log.Info("Removing snapshot", "snapshot_id", snapshotID)
@@ -1613,8 +1646,6 @@ func (v *Vaultik) removeAllLocalSnapshots(
 			log.Error("Failed to remove from local database",
 				"snapshot_id", snapshotID, "error", err)
 
-			failures++
-
 			continue
 		}
 
@@ -1625,14 +1656,14 @@ func (v *Vaultik) removeAllLocalSnapshots(
 				log.Warn("Failed to remove snapshot metadata from remote",
 					"snapshot_id", snapshotID, "error", err)
 
-				failures++
+				remoteErrors++
 			}
 		}
 
 		result.SnapshotsRemoved = append(result.SnapshotsRemoved, snapshotID)
 	}
 
-	return failures
+	return remoteErrors
 }
 
 // removeAllOrphanRemotes deletes remote snapshot metadata that has no

internal/vaultik/snapshot_list_test.go

@@ -445,6 +445,7 @@ type listJSONRow struct {
 	RemoteKey      string `json:"remote_key"`
 	Timestamp      string `json:"timestamp"`
 	CompressedSize int64  `json:"compressed_size"`
+	NewChunkSize   int64  `json:"new_chunk_size"`
 	LocallyTracked bool   `json:"locally_tracked"`
 	RemotePresent  *bool  `json:"remote_present"`
 }