Record the stored size of a blob a backup finds already stored (closes #300)

When a finished blob already existed at the destination, the upload was
skipped but the blob row, and so the manifest, kept the size of the
local copy. That copy differs from the stored object when
compression_level or the recipients changed since it was written, so
shallow and deep verify failed on a good snapshot. Marking a blob
uploaded now records the size of the object in storage: for an existing
blob, the size Stat reports.

Judgement call: the test adds a recipient rather than changing the
compression level, because an extra age recipient always makes the
local copy larger, while two zstd levels need not compress the test
data differently.

Model: opus-5-5

README.md

@@ -349,9 +349,11 @@ the backup destination store. Blobs are NOT touched — deleting blobs
 requires reading every remaining remote manifest (the destination store
 may hold snapshots this host doesn't know about), which is what
 `vaultik prune` does. On success the command prints the exact `vaultik
-prune` invocation to run as a follow-up. Local row cleanup (files,
+prune` invocation to run as a follow-up. An ID that names no snapshot in
-chunks, blobs the snapshot was the last referrer for) runs
+the local index or on the destination store is an error; with
-automatically. If the destination store is unreachable, the local-DB
+`--local-only`, the snapshot must be in the local index. Local row
+cleanup (files, chunks, blobs the snapshot was the last referrer for)
+runs automatically. If the destination store is unreachable, the local-DB
 removal still completes and a warning is emitted; run `vaultik snapshot
 remove <snapshot-id>` again once the store is reachable to remove the
 snapshot's metadata from it (`vaultik prune` does not). To wipe everything

TODO.md

@@ -22,14 +22,25 @@ the tag exists and is exercised; what is left is merging `next` to
 
 # Completed Steps
 
-- 2026-10-13: Made a failed or interrupted backup remove the temporary
+- 2026-10-13: Recorded the size of the stored object for a blob a backup
-  file of the blob it was packing
+  found already stored
-  ([issue #302](https://git.eeqj.de/sneak/vaultik/issues/302)). When
+  ([issue #300](https://git.eeqj.de/sneak/vaultik/issues/300)). When the
-  `snapshot create` stopped on a file error, a full temporary directory
+  upload was skipped, the blob row and the manifest kept the size of the
-  or Ctrl-C, that blob was never finalized and its `vaultik-blob-*.tmp`
+  local copy, which differs from the stored object's when
-  file, up to `blob_size_limit` of encrypted data, stayed in `$TMPDIR`;
+  `compression_level` or the recipients changed since it was written.
-  every such run left another. Phase 2 now removes it whenever it stops
+  `snapshot verify` then failed on a good snapshot, shallow and deep,
-  before the last blob is finalized.
+  and the listed sizes were wrong. Marking the blob uploaded now records
+  the size of the object in storage.
+
+- 2026-10-13: Made `snapshot remove` fail for a snapshot that does not
+  exist ([issue #293](https://git.eeqj.de/sneak/vaultik/issues/293)).
+  The command never checked the ID: it reported the snapshot removed
+  from the local database and from the destination store and exited 0,
+  under `--json`, `--dry-run` and `--local-only` too. An ID that names
+  no snapshot in the local index or on the destination store is now an
+  error; with `--local-only`, the snapshot must be in the local index.
+  The command now reports a removal from either side only when one
+  happened, and `remote_removed` is true only when metadata was deleted.
 
 - 2026-10-12: Bound the local index to the destination an `s3.*` config
   names ([issue #298](https://git.eeqj.de/sneak/vaultik/issues/298)).

docs/DATAMODEL.md

@@ -90,7 +90,7 @@ Stores information about packed, compressed, and encrypted blob files.
 - `created_ts` (INTEGER NOT NULL) - Creation timestamp
 - `finished_ts` (INTEGER) - Finalization timestamp (NULL if in progress)
 - `uncompressed_size` (INTEGER NOT NULL DEFAULT 0) - Total size of chunks before compression
-- `compressed_size` (INTEGER NOT NULL DEFAULT 0) - Size after compression and encryption
+- `compressed_size` (INTEGER NOT NULL DEFAULT 0) - Size after compression and encryption. Once uploaded, the size of the object in storage: when the blob was already stored, under another compression level or other recipients, this differs from the size of the local copy
 - `uploaded_ts` (INTEGER) - Upload completion timestamp (NULL if not uploaded)
 
 **Purpose:** Tracks blob lifecycle from creation through upload. The UUID primary key allows immediate association of chunks with blobs.
@@ -183,7 +183,7 @@ Tracks blob upload metrics.
    - `UPDATE blobs SET blob_hash = ?, finished_ts = ?` - Finalize blob after packing
 
 4. **Upload**
-   - `UPDATE blobs SET uploaded_ts = ?` - Mark blob as uploaded
+   - `UPDATE blobs SET uploaded_ts = ?, compressed_size = ?` - Mark blob as uploaded, with the size of the object in storage (the upload is skipped when the blob is already stored)
    - `INSERT INTO uploads` - Record upload metrics with snapshot_id
    - `INSERT INTO snapshot_blobs` - Associate blob with snapshot
 

internal/blob/packer.go

@@ -245,17 +245,6 @@ func (p *Packer) Flush(ctx context.Context) error {
 	return nil
 }
 
-// DiscardCurrentBlob closes and removes the temp file of the blob being
-// packed, if any, and drops that blob. A caller that stops before Flush
-// must call it, or the temp file is left behind. Thread-safe.
-func (p *Packer) DiscardCurrentBlob() {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-
-	p.cleanupTempFile()
-	p.currentBlob = nil
-}
-
 // FinalizeBlob finalizes the current blob being assembled.
 // This compresses the accumulated chunks, encrypts the result, and computes
 // the content-addressed hash. The finalized blob is either passed to the

internal/cli/snapshot.go

@@ -255,8 +255,12 @@ manifest (the destination store may hold snapshots this host doesn't
 know about), which is what 'vaultik prune' does. On success the command
 prints the exact 'vaultik prune' invocation to run as a follow-up.
 
+An ID that names no snapshot in the local index or on the destination
+store is an error.
+
 Use --local-only to skip the remote half (e.g. when you want to forget a
-snapshot locally without touching the destination store).
+snapshot locally without touching the destination store); the snapshot
+must then be in the local index.
 
 If the remote is unreachable, the local-database removal still completes
 and a warning is emitted; run 'vaultik snapshot remove <snapshot-id>' again

internal/database/blobs.go

@@ -159,13 +159,16 @@ func (r *BlobRepository) UpdateFinished(
 	return nil
 }
 
-// UpdateUploaded marks a blob as uploaded
+// UpdateUploaded marks a blob as uploaded and records the size of the
+// stored object as its compressed size. That size can differ from the
+// local copy's when an identical blob was already stored with another
+// compression level or other recipients.
 func (r *BlobRepository) UpdateUploaded(
-	ctx context.Context, tx *sql.Tx, id string,
+	ctx context.Context, tx *sql.Tx, id string, storedSize int64,
 ) error {
 	query := `
-		UPDATE blobs 
+		UPDATE blobs
-		SET uploaded_ts = ?
+		SET uploaded_ts = ?, compressed_size = ?
 		WHERE id = ?
 	`
 
@@ -173,9 +176,9 @@ func (r *BlobRepository) UpdateUploaded(
 
 	var err error
 	if tx != nil {
-		_, err = tx.ExecContext(ctx, query, now, id)
+		_, err = tx.ExecContext(ctx, query, now, storedSize, id)
 	} else {
-		_, err = r.db.ExecWithLog(ctx, query, now, id)
+		_, err = r.db.ExecWithLog(ctx, query, now, storedSize, id)
 	}
 
 	if err != nil {

internal/database/blobs_test.go

@@ -122,8 +122,8 @@ func TestBlobRepositoryUpdates(t *testing.T) {
 		t.Errorf("expected compressed size 500, got %d", updated.CompressedSize)
 	}
 
-	// Test UpdateUploaded
+	// Test UpdateUploaded, with a stored object larger than the local copy
-	err = repo.UpdateUploaded(ctx, nil, blob.ID.String())
+	err = repo.UpdateUploaded(ctx, nil, blob.ID.String(), 600)
 	if err != nil {
 		t.Fatalf("failed to update blob as uploaded: %v", err)
 	}
@@ -141,6 +141,10 @@ func TestBlobRepositoryUpdates(t *testing.T) {
 	if uploaded.UploadedTS.Before(now.Add(-1 * time.Second)) {
 		t.Error("uploaded timestamp should be around test time")
 	}
+
+	if uploaded.CompressedSize != 600 {
+		t.Errorf("expected the stored size 600, got %d", uploaded.CompressedSize)
+	}
 }
 
 func TestBlobRepositoryDuplicate(t *testing.T) {

internal/snapshot/scanner.go

@@ -1295,11 +1295,6 @@ func (s *Scanner) batchAddFilesToSnapshot(
 func (s *Scanner) processPhase(
 	ctx context.Context, filesToProcess []*FileToProcess, result *ScanResult,
 ) error {
-	// On an error or cancellation the blob being packed is never
-	// finalized, so its temp file must be removed here. After a
-	// successful flush there is no such blob and this does nothing.
-	defer s.packer.DiscardCurrentBlob()
-
 	// Calculate total bytes to process
 	var totalBytes int64
 	for _, f := range filesToProcess {
@@ -1514,7 +1509,8 @@ func (s *Scanner) finalizeProcessPhase(ctx context.Context, result *ScanResult)
 			// snapshot references has uploaded_ts set, so deduplication and
 			// interrupted-run repair treat these blobs as trustworthy.
 			err = s.repos.WithTx(ctx, func(ctx context.Context, tx *sql.Tx) error {
-				err := s.repos.Blobs.UpdateUploaded(ctx, tx, b.ID)
+				err := s.repos.Blobs.UpdateUploaded(
+					ctx, tx, b.ID, b.Compressed)
 				if err != nil {
 					return fmt.Errorf("marking blob uploaded: %w", err)
 				}
@@ -1550,7 +1546,7 @@ func (s *Scanner) handleBlobReady(
 	blobPath := fmt.Sprintf("blobs/%s/%s/%s",
 		finishedBlob.Hash[:2], finishedBlob.Hash[2:4], finishedBlob.Hash)
 
-	blobExists, err := s.uploadBlobIfNeeded(
+	storedSize, blobExists, err := s.uploadBlobIfNeeded(
 		ctx, blobPath, blobWithReader, startTime, result)
 	if err != nil {
 		s.cleanupBlobTempFile(blobWithReader)
@@ -1558,7 +1554,8 @@ func (s *Scanner) handleBlobReady(
 		return fmt.Errorf("uploading blob %s: %w", finishedBlob.Hash, err)
 	}
 
-	err = s.recordBlobMetadata(ctx, finishedBlob, blobExists, startTime)
+	err = s.recordBlobMetadata(
+		ctx, finishedBlob, storedSize, blobExists, startTime)
 	if err != nil {
 		s.cleanupBlobTempFile(blobWithReader)
 
@@ -1580,20 +1577,22 @@ func (s *Scanner) handleBlobReady(
 }
 
 // uploadBlobIfNeeded uploads the blob to storage if it doesn't already
-// exist, returns whether it existed
+// exist. It returns the size of the object in storage, which for an
+// existing object can differ from the local copy's, and whether it
+// already existed.
 func (s *Scanner) uploadBlobIfNeeded(
 	ctx context.Context,
 	blobPath string,
 	blobWithReader *blob.WithReader,
 	startTime time.Time,
 	result *ScanResult,
-) (bool, error) {
+) (int64, bool, error) {
 	finishedBlob := blobWithReader.FinishedBlob
 
 	// Check if blob already exists (deduplication after restart)
 	destination := s.storage.Info().Location
 
-	_, err := s.storage.Stat(ctx, blobPath)
+	stored, err := s.storage.Stat(ctx, blobPath)
 	if err == nil {
 		log.Info("Blob already exists in storage, skipping upload",
 			"hash", finishedBlob.Hash,
@@ -1602,7 +1601,7 @@ func (s *Scanner) uploadBlobIfNeeded(
 			s.ui.Hex(finishedBlob.Hash), s.ui.Size(finishedBlob.Compressed),
 			s.ui.Path(destination))
 
-		return true, nil
+		return stored.Size, true, nil
 	}
 
 	s.ui.Beginf("Uploading blob %s (%s) to %s.",
@@ -1616,7 +1615,7 @@ func (s *Scanner) uploadBlobIfNeeded(
 	if err != nil {
 		log.Error("Failed to upload blob", "hash", finishedBlob.Hash, "error", err)
 
-		return false, fmt.Errorf("uploading blob to storage: %w", err)
+		return 0, false, fmt.Errorf("uploading blob to storage: %w", err)
 	}
 
 	uploadDuration := time.Since(startTime)
@@ -1647,7 +1646,7 @@ func (s *Scanner) uploadBlobIfNeeded(
 		stats.BytesUploaded.Add(finishedBlob.Compressed)
 	}
 
-	return false, nil
+	return finishedBlob.Compressed, false, nil
 }
 
 // makeUploadProgressCallback creates a progress callback for blob uploads.
@@ -1717,6 +1716,7 @@ func (s *Scanner) makeUploadProgressCallback(
 func (s *Scanner) recordBlobMetadata(
 	ctx context.Context,
 	finishedBlob *blob.FinishedBlob,
+	storedSize int64,
 	blobExists bool,
 	startTime time.Time,
 ) error {
@@ -1728,7 +1728,8 @@ func (s *Scanner) recordBlobMetadata(
 	uploadDuration := time.Since(startTime)
 
 	return s.repos.WithTx(ctx, func(txCtx context.Context, tx *sql.Tx) error {
-		err := s.repos.Blobs.UpdateUploaded(txCtx, tx, finishedBlob.ID)
+		err := s.repos.Blobs.UpdateUploaded(
+			txCtx, tx, finishedBlob.ID, storedSize)
 		if err != nil {
 			return fmt.Errorf("updating blob upload timestamp: %w", err)
 		}

internal/snapshot/skip_errors_test.go

@@ -381,60 +381,3 @@ func TestScannerCancelStopsSkipErrorsRun(t *testing.T) {
 		})
 	}
 }
-
-// TestScannerRemovesBlobTempFileWhenRunStops checks that a run stopped
-// part-way, by a file it cannot read or by a cancellation, removes the
-// temp file of the blob it was packing.
-func TestScannerRemovesBlobTempFileWhenRunStops(t *testing.T) {
-	t.Parallel()
-
-	// a.txt is backed up first and starts a blob; the run stops at b.txt.
-	const target = "/source/b.txt"
-
-	tests := []struct {
-		name  string
-		newFs func(cancel context.CancelFunc) afero.Fs
-	}{
-		{
-			name: "file cannot be read",
-			newFs: func(context.CancelFunc) afero.Fs {
-				return &readFailFs{Fs: afero.NewMemMapFs(), target: target}
-			},
-		},
-		{
-			name: "cancelled",
-			newFs: func(cancel context.CancelFunc) afero.Fs {
-				return &cancelOnOpenFs{
-					Fs: afero.NewMemMapFs(), target: target, cancel: cancel,
-				}
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			ctx, cancel := context.WithCancel(context.Background())
-			defer cancel()
-
-			fs := tt.newFs(cancel)
-			writeSkipErrorTestFile(t, fs, "/source/a.txt", "first file content")
-			writeSkipErrorTestFile(t, fs, target, "second file content")
-
-			_, err := runSkipErrorScan(ctx, t, fs, "/source", false, nil)
-			if err == nil {
-				t.Fatal("expected the scan to stop with an error, got nil")
-			}
-
-			left, err := afero.Glob(fs, filepath.Join(os.TempDir(), "vaultik-blob-*"))
-			if err != nil {
-				t.Fatalf("listing blob temp files: %v", err)
-			}
-
-			if len(left) != 0 {
-				t.Fatalf("expected no blob temp file left, got %v", left)
-			}
-		})
-	}
-}

internal/vaultik/remove_snapshot_test.go

@@ -3,17 +3,21 @@ package vaultik_test
 import (
 	"bytes"
 	"context"
+	"database/sql"
 	"io"
 	"strings"
 	"sync"
 	"testing"
+	"time"
 
 	"github.com/klauspost/compress/zstd"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/vaultik/internal/database"
 	"sneak.berlin/go/vaultik/internal/log"
 	"sneak.berlin/go/vaultik/internal/snapshot"
 	"sneak.berlin/go/vaultik/internal/storage"
+	"sneak.berlin/go/vaultik/internal/types"
 	"sneak.berlin/go/vaultik/internal/vaultik"
 )
 
@@ -214,6 +218,37 @@ func addBlob(t *testing.T, store *testStorer, hash string) {
 	require.NoError(t, err)
 }
 
+// newLocalIndex returns an in-memory local index holding a completed
+// snapshot row for each of ids.
+func newLocalIndex(t *testing.T, ids ...string) *database.Repositories {
+	t.Helper()
+
+	ctx := context.Background()
+
+	db, err := database.New(ctx, ":memory:")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = db.Close() })
+
+	repos := database.NewRepositories(db)
+
+	for _, id := range ids {
+		completedAt := time.Now().UTC()
+		snap := &database.Snapshot{
+			ID:          types.SnapshotID(id),
+			Hostname:    snapHostname,
+			StartedAt:   completedAt,
+			CompletedAt: &completedAt,
+		}
+
+		err = repos.WithTx(ctx, func(ctx context.Context, tx *sql.Tx) error {
+			return repos.Snapshots.Create(ctx, tx, snap)
+		})
+		require.NoError(t, err)
+	}
+
+	return repos
+}
+
 // ============================================================================
 // Unit Tests for RemoveSnapshot
 // ============================================================================
@@ -233,6 +268,7 @@ func TestRemoveSnapshot_LocalOnly_PreservesRemote(t *testing.T) {
 	addBlob(t, store, blobA)
 
 	tv := vaultik.NewForTesting(store)
+	tv.Repositories = newLocalIndex(t, "snapshot-001")
 
 	opts := &vaultik.RemoveOptions{Force: true, LocalOnly: true}
 	result, err := tv.RemoveSnapshot("snapshot-001", opts)
@@ -268,6 +304,7 @@ func TestRemoveSnapshot_DefaultRemovesMetadataNotBlobs(t *testing.T) {
 	addBlob(t, store, blobShared)
 
 	tv := vaultik.NewForTesting(store)
+	tv.Repositories = newLocalIndex(t, "snapshot-001", "snapshot-002")
 
 	opts := &vaultik.RemoveOptions{Force: true}
 	result, err := tv.RemoveSnapshot("snapshot-001", opts)
@@ -316,6 +353,84 @@ func TestRemoveSnapshot_DryRun(t *testing.T) {
 	assert.Contains(t, tv.Stdout.String(), "[Dry run - no changes made]")
 }
 
+// TestRemoveSnapshot_UnknownIDIsError checks that an ID naming no
+// snapshot in the local index or on the destination store is an error
+// under every option, and that nothing is reported as removed.
+func TestRemoveSnapshot_UnknownIDIsError(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	for name, opts := range map[string]vaultik.RemoveOptions{
+		"force":      {Force: true},
+		"json":       {JSON: true},
+		"dry-run":    {Force: true, DryRun: true},
+		"local-only": {Force: true, LocalOnly: true},
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			store := newTestStorer()
+			addManifest(t, store, "snapshot-001", nil)
+
+			tv := vaultik.NewForTesting(store)
+			tv.Repositories = newLocalIndex(t, "snapshot-001")
+
+			result, err := tv.RemoveSnapshot("snapshot-999", &opts)
+
+			require.ErrorContains(t, err, "snapshot not found")
+			assert.False(t, result.RemoteRemoved)
+			assert.Empty(t, tv.Stdout.String())
+			assert.True(t, store.hasKey(remoteKeyPath("snapshot-001")))
+		})
+	}
+}
+
+// TestRemoveSnapshot_NoMetadataOnDestination checks that removing a
+// snapshot whose metadata is not on the destination store does not
+// report metadata removed from it.
+func TestRemoveSnapshot_NoMetadataOnDestination(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	tv := vaultik.NewForTesting(newTestStorer())
+	tv.Repositories = newLocalIndex(t, "snapshot-001")
+
+	result, err := tv.RemoveSnapshot("snapshot-001",
+		&vaultik.RemoveOptions{Force: true})
+
+	require.NoError(t, err)
+	assert.False(t, result.RemoteRemoved)
+
+	out := tv.Stdout.String()
+	assert.Contains(t, out, "Removed snapshot 'snapshot-001' from local database")
+	assert.NotContains(t, out, "Removed snapshot metadata from remote storage")
+}
+
+// TestRemoveSnapshot_NotInLocalIndex checks that removing a snapshot
+// only the destination store holds removes its metadata there without
+// reporting a removal from the local database.
+func TestRemoveSnapshot_NotInLocalIndex(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	store := newTestStorer()
+	addManifest(t, store, "snapshot-001", nil)
+
+	tv := vaultik.NewForTesting(store)
+	tv.Repositories = newLocalIndex(t)
+
+	result, err := tv.RemoveSnapshot("snapshot-001",
+		&vaultik.RemoveOptions{Force: true})
+
+	require.NoError(t, err)
+	assert.True(t, result.RemoteRemoved)
+	assert.False(t, store.hasKey(remoteKeyPath("snapshot-001")))
+
+	out := tv.Stdout.String()
+	assert.NotContains(t, out, "from local database")
+	assert.Contains(t, out, "Removed snapshot metadata from remote storage")
+}
+
 func TestRemoveAllSnapshots_RequiresForce(t *testing.T) {
 	log.Initialize(log.Config{})
 	t.Parallel()

internal/vaultik/reused_blob_verify_test.go

@@ -0,0 +1,83 @@
+package vaultik_test
+
+import (
+	"context"
+	"io"
+	"path/filepath"
+	"testing"
+
+	"filippo.io/age"
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/vaultik/internal/log"
+	"sneak.berlin/go/vaultik/internal/ui"
+	"sneak.berlin/go/vaultik/internal/vaultik"
+)
+
+// TestVerifyPassesWhenBackupReusesStoredBlob backs up a file, then backs it
+// up again from an empty local index, as after `database delete`, with an
+// extra age recipient. The second backup builds the same blob, finds it
+// already stored and skips the upload, but its own copy is larger, because
+// age writes a header entry for each recipient. The second snapshot must
+// record the size of the stored object, so shallow and deep verify pass.
+func TestVerifyPassesWhenBackupReusesStoredBlob(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	fs := afero.NewOsFs()
+	tempDir := t.TempDir()
+
+	dataDir := filepath.Join(tempDir, "source")
+	storeDir := filepath.Join(tempDir, "remote")
+	secondDBPath := filepath.Join(tempDir, "second.sqlite")
+
+	chunkSize := int64(64 * 1024)
+	maxBlobSize := int64(512 * 1024)
+
+	require.NoError(t, fs.MkdirAll(dataDir, 0o755))
+	require.NoError(t, afero.WriteFile(fs,
+		filepath.Join(dataDir, "data.bin"),
+		bytesPattern("reuse-", int(chunkSize*3)), 0o644))
+
+	ctx := context.Background()
+
+	runFileStorageBackup(ctx, t, fs, dataDir, storeDir,
+		filepath.Join(tempDir, "first.sqlite"), chunkSize, maxBlobSize)
+
+	env := setupDedupBackupEnv(
+		ctx, t, fs, storeDir, secondDBPath, chunkSize, maxBlobSize)
+
+	defer func() { _ = env.db.Close() }()
+
+	extra, err := age.GenerateX25519Identity()
+	require.NoError(t, err)
+
+	env.cfg.AgeRecipients = append(env.cfg.AgeRecipients,
+		extra.Recipient().String())
+
+	snapshotID, result := runDedupSnapshot(ctx, t, env.sm, env.makeScanner(),
+		env.cfg.Hostname, "second", dataDir, secondDBPath)
+	require.Positive(t, result.BlobsCreated)
+	require.Zero(t, result.BlobsUploaded,
+		"the second backup should find every blob already stored")
+
+	require.NoError(t, env.db.Close())
+
+	verifier := &vaultik.Vaultik{
+		Config:  env.cfg,
+		Storage: env.storer,
+		Fs:      fs,
+		Stdout:  io.Discard,
+		Stderr:  io.Discard,
+		UI:      ui.NewWithColor(io.Discard, false),
+	}
+	verifier.SetContext(ctx)
+
+	require.NoError(t,
+		verifier.VerifySnapshotWithOptions(snapshotID, &vaultik.VerifyOptions{}),
+		"shallow verify should pass")
+	require.NoError(t,
+		verifier.VerifySnapshotWithOptions(snapshotID,
+			&vaultik.VerifyOptions{Deep: true}),
+		"deep verify should pass")
+}

internal/vaultik/snapshot.go

@@ -23,6 +23,7 @@ var (
 	errNoSnapshotsInConfig  = errors.New("no snapshots configured")
 	errSnapshotVerifyFailed = errors.New("verification failed")
 	errRemoveAllNeedsForce  = errors.New("--all requires --force")
+	errSnapshotNotFound     = errors.New("snapshot not found")
 	errInvalidTableName     = errors.New("invalid table name")
 	errNoAgeRecipients      = errors.New(
 		"creating a snapshot needs at least one public key in " +
@@ -643,7 +644,7 @@ func (v *Vaultik) confirmAndExecutePurge(
 				"snapshot_id", snapshotID, "error", err)
 		}
 
-		err = v.deleteRemoteSnapshotByKey(snapshot.RemoteSnapshotKey(snapshotID))
+		_, err = v.deleteRemoteSnapshotByKey(snapshot.RemoteSnapshotKey(snapshotID))
 		if err != nil {
 			return fmt.Errorf("deleting snapshot %s from remote: %w", snapshotID, err)
 		}
@@ -1153,6 +1154,11 @@ func (v *Vaultik) RemoveSnapshot(
 		return result, err
 	}
 
+	inLocalIndex, err := v.findSnapshotToRemove(snapshotID, opts)
+	if err != nil {
+		return result, err
+	}
+
 	if opts.DryRun {
 		return v.removeSnapshotDryRun(result, snapshotID, opts)
 	}
@@ -1161,11 +1167,13 @@ func (v *Vaultik) RemoveSnapshot(
 		return result, nil
 	}
 
-	log.Info("Removing snapshot from local database", "snapshot_id", snapshotID)
+	if inLocalIndex {
+		log.Info("Removing snapshot from local database", "snapshot_id", snapshotID)
 
-	err = v.deleteSnapshotFromLocalDB(snapshotID)
+		err = v.deleteSnapshotFromLocalDB(snapshotID)
-	if err != nil {
+		if err != nil {
-		return result, fmt.Errorf("removing from local database: %w", err)
+			return result, fmt.Errorf("removing from local database: %w", err)
+		}
 	}
 
 	if !opts.LocalOnly {
@@ -1184,9 +1192,11 @@ func (v *Vaultik) RemoveSnapshot(
 		return result, v.outputRemoveJSON(result)
 	}
 
-	v.stdoutf("Removed snapshot '%s' from local database\n", snapshotID)
+	if inLocalIndex {
+		v.stdoutf("Removed snapshot '%s' from local database\n", snapshotID)
+	}
 
-	if !opts.LocalOnly && result.RemoteRemoved {
+	if result.RemoteRemoved {
 		v.printlnStdout("Removed snapshot metadata from remote storage")
 		v.stdoutf("\nNote: The removed snapshot's blobs remain on the remote. "+
 			"Run '%s' to delete any blobs no longer referenced by any "+
@@ -1196,6 +1206,45 @@ func (v *Vaultik) RemoveSnapshot(
 	return result, nil
 }
 
+// findSnapshotToRemove reports whether the local index has a row for
+// snapshotID, and returns errSnapshotNotFound when there is nothing to
+// remove: no row and, unless LocalOnly is set, no metadata on the
+// destination store either. The destination store is consulted only
+// when the local index has no row, so a snapshot in the local index can
+// still be removed from it while the destination store is unreachable.
+func (v *Vaultik) findSnapshotToRemove(
+	snapshotID string, opts *RemoveOptions,
+) (bool, error) {
+	if v.Repositories != nil {
+		snap, err := v.Repositories.Snapshots.GetByID(v.ctx, snapshotID)
+		if err != nil {
+			return false, fmt.Errorf("looking up snapshot in local index: %w", err)
+		}
+
+		if snap != nil {
+			return true, nil
+		}
+	}
+
+	if opts.LocalOnly {
+		return false, fmt.Errorf("%w in the local index: %s",
+			errSnapshotNotFound, snapshotID)
+	}
+
+	objects, err := v.remoteSnapshotObjects(snapshot.RemoteSnapshotKey(snapshotID))
+	if err != nil {
+		return false, fmt.Errorf("looking up snapshot on destination store: %w", err)
+	}
+
+	if len(objects) == 0 {
+		return false, fmt.Errorf(
+			"%w in the local index or on the destination store: %s",
+			errSnapshotNotFound, snapshotID)
+	}
+
+	return false, nil
+}
+
 // removeSnapshotDryRun reports what RemoveSnapshot would do without
 // making changes.
 func (v *Vaultik) removeSnapshotDryRun(
@@ -1255,14 +1304,14 @@ func (v *Vaultik) confirmRemoveSnapshot(snapshotID string, opts *RemoveOptions)
 // didn't finish and to run `vaultik snapshot remove` for the snapshot
 // again once the destination store is reachable (`vaultik prune` never
 // removes snapshot metadata). Returns true when the remote removal
-// succeeded.
+// succeeded and deleted something.
 func (v *Vaultik) removeSnapshotRemote(snapshotID string, opts *RemoveOptions) bool {
 	log.Info("Removing snapshot metadata from remote storage",
 		"snapshot_id", snapshotID)
 
 	remoteKey := snapshot.RemoteSnapshotKey(snapshotID)
 
-	err := v.deleteRemoteSnapshotByKey(remoteKey)
+	deleted, err := v.deleteRemoteSnapshotByKey(remoteKey)
 	if err != nil {
 		log.Warn("Could not remove snapshot metadata from remote storage; "+
 			"run '"+snapshotRemoveCommandHint+"' with the snapshot's ID "+
@@ -1280,7 +1329,7 @@ func (v *Vaultik) removeSnapshotRemote(snapshotID string, opts *RemoveOptions) b
 		return false
 	}
 
-	return true
+	return deleted > 0
 }
 
 // RemoveAllSnapshots removes every snapshot known to the local
@@ -1572,7 +1621,7 @@ func (v *Vaultik) removeAllLocalSnapshots(
 		}
 
 		if !opts.LocalOnly {
-			err = v.deleteRemoteSnapshotByKey(
+			_, err = v.deleteRemoteSnapshotByKey(
 				snapshot.RemoteSnapshotKey(snapshotID))
 			if err != nil {
 				log.Warn("Failed to remove snapshot metadata from remote",
@@ -1598,7 +1647,7 @@ func (v *Vaultik) removeAllOrphanRemotes(
 	for _, key := range orphanRemoteKeys {
 		log.Info("Removing orphan remote snapshot", "remote_key", key)
 
-		err := v.deleteRemoteSnapshotByKey(key)
+		_, err := v.deleteRemoteSnapshotByKey(key)
 		if err != nil {
 			log.Warn("Failed to remove orphan from remote",
 				"remote_key", key, "error", err)
@@ -1645,34 +1694,44 @@ func (v *Vaultik) deleteSnapshotFromLocalDB(snapshotID string) error {
 }
 
 // deleteRemoteSnapshotByKey removes everything under
-// metadata/<remoteKey>/ on the destination store. The argument is a
+// metadata/<remoteKey>/ on the destination store and returns how many
-// remote key (double-SHA256 derivation), not a human snapshot ID;
+// objects it deleted. The argument is a remote key (double-SHA256
-// callers that have a human ID must hash via snapshot.RemoteSnapshotKey
+// derivation), not a human snapshot ID; callers that have a human ID
-// first.
+// must hash via snapshot.RemoteSnapshotKey first.
-func (v *Vaultik) deleteRemoteSnapshotByKey(remoteKey string) error {
+func (v *Vaultik) deleteRemoteSnapshotByKey(remoteKey string) (int, error) {
-	prefix := fmt.Sprintf("metadata/%s/", remoteKey)
+	objectsToDelete, err := v.remoteSnapshotObjects(remoteKey)
-	objectCh := v.Storage.ListStream(v.ctx, prefix)
+	if err != nil {
-
+		return 0, err
-	var objectsToDelete []string
-
-	for object := range objectCh {
-		if object.Err != nil {
-			return fmt.Errorf("listing objects: %w", object.Err)
-		}
-
-		objectsToDelete = append(objectsToDelete, object.Key)
 	}
 
-	for _, key := range objectsToDelete {
+	for i, key := range objectsToDelete {
-		err := v.Storage.Delete(v.ctx, key)
+		err = v.Storage.Delete(v.ctx, key)
 		if err != nil {
-			return fmt.Errorf("removing %s: %w", key, err)
+			return i, fmt.Errorf("removing %s: %w", key, err)
 		}
 
 		log.Debug("Deleted remote object", "key", key)
 	}
 
-	return nil
+	return len(objectsToDelete), nil
+}
+
+// remoteSnapshotObjects lists the keys of every object under
+// metadata/<remoteKey>/ on the destination store.
+func (v *Vaultik) remoteSnapshotObjects(remoteKey string) ([]string, error) {
+	prefix := fmt.Sprintf("metadata/%s/", remoteKey)
+
+	var keys []string
+
+	for object := range v.Storage.ListStream(v.ctx, prefix) {
+		if object.Err != nil {
+			return nil, fmt.Errorf("listing objects: %w", object.Err)
+		}
+
+		keys = append(keys, object.Key)
+	}
+
+	return keys, nil
 }
 
 // outputRemoveJSON outputs the removal result as JSON