Stop a cancelled backup at once under --skip-errors (closes #286)

After Ctrl-C or SIGTERM, phase 2 of a --skip-errors backup treated the
cancellation error from each remaining file like an unreadable file: it
opened the file, printed an error line, counted it as failed and moved
on to the next. The processing loop now checks for cancellation before
each file, and an error from a file once the run is cancelled stops the
run instead of being skipped. The loop check is what stops a run
cancelled while an empty file is open, since an empty file has no
chunks and nothing reads the context while it is backed up.

The --skip-errors test helper now takes the scan's context.

Model: opus-5-5

README.md

@@ -286,9 +286,7 @@ needed.
   remove orphaned blobs from remote storage. By default keeps only the latest
   snapshot per name; use `--keep-newer-than` for a rolling window.
 * `--keep-newer-than <duration>`: With `--prune`, keep snapshots newer than
-  this duration instead of only the latest (e.g. `4w`, `30d`, `6mo`, `1y`).
-  Without `--prune`, or with a value that is not a valid duration, the
-  command fails before the backup starts.
+  this duration instead of only the latest (e.g. `4w`, `30d`, `6mo`, `1y`)
 
 **`snapshot list`**: Show every snapshot known to this host — the union
 of the local index and the backup destination store — with timestamps
@@ -351,11 +349,9 @@ the backup destination store. Blobs are NOT touched — deleting blobs
 requires reading every remaining remote manifest (the destination store
 may hold snapshots this host doesn't know about), which is what
 `vaultik prune` does. On success the command prints the exact `vaultik
-prune` invocation to run as a follow-up. An ID that names no snapshot in
-the local index or on the destination store is an error; with
-`--local-only`, the snapshot must be in the local index. Local row
-cleanup (files, chunks, blobs the snapshot was the last referrer for)
-runs automatically. If the destination store is unreachable, the local-DB
+prune` invocation to run as a follow-up. Local row cleanup (files,
+chunks, blobs the snapshot was the last referrer for) runs
+automatically. If the destination store is unreachable, the local-DB
 removal still completes and a warning is emitted; run `vaultik snapshot
 remove <snapshot-id>` again once the store is reachable to remove the
 snapshot's metadata from it (`vaultik prune` does not). To wipe everything
@@ -416,8 +412,7 @@ destination store.
 entirely. Remote storage is unaffected; the next backup will do a full
 scan and re-deduplicate against existing remote blobs, and the local
 index will re-bind to the currently configured storage destination.
-Use this after changing `storage_url`, or `s3.endpoint`, `s3.bucket` or
-`s3.prefix`, to a different destination.
+Use this after changing `storage_url` to a different destination.
 * `--force`: Skip confirmation prompt
 
 ---

TODO.md

@@ -22,35 +22,6 @@ the tag exists and is exercised; what is left is merging `next` to
 
 # Completed Steps
 
-- 2026-10-13: Made `snapshot remove` fail for a snapshot that does not
-  exist ([issue #293](https://git.eeqj.de/sneak/vaultik/issues/293)).
-  The command never checked the ID: it reported the snapshot removed
-  from the local database and from the destination store and exited 0,
-  under `--json`, `--dry-run` and `--local-only` too. An ID that names
-  no snapshot in the local index or on the destination store is now an
-  error; with `--local-only`, the snapshot must be in the local index.
-  The command now reports a removal from either side only when one
-  happened, and `remote_removed` is true only when metadata was deleted.
-
-- 2026-10-12: Bound the local index to the destination an `s3.*` config
-  names ([issue #298](https://git.eeqj.de/sneak/vaultik/issues/298)).
-  Only `storage_url` was checked, so after `s3.bucket` or `s3.prefix`
-  changed, the next backup treated every chunk as already stored,
-  uploaded nothing, and completed a snapshot that could not be restored.
-  Without `storage_url`, the local index is now bound to `s3.endpoint`,
-  `s3.bucket` and `s3.prefix`, and a change is refused as a changed
-  `storage_url` is.
-
-- 2026-10-12: Rejected a retention duration longer than about 292 years
-  ([issue #289](https://git.eeqj.de/sneak/vaultik/issues/289)). The
-  number given to `--older-than` or `--keep-newer-than` was multiplied
-  by the length of its unit with no limit, so from `293y`, `15251w`,
-  `3559mo` or `106752d`, or a sum of parts such as `200y200y`, the
-  result wrapped to a negative duration. The cutoff then lay in the
-  future, every snapshot of the name was deleted, the one just made
-  included, and the command exited 0. Such a duration is now rejected
-  as invalid and nothing is deleted.
-
 - 2026-10-08: Made a backup cancelled under `--skip-errors` stop at once
   ([issue #286](https://git.eeqj.de/sneak/vaultik/issues/286)). After
   Ctrl-C or SIGTERM, phase 2 treated the cancellation error from each
@@ -59,13 +30,6 @@ the tag exists and is exercised; what is left is merging `next` to
   The run now stops at the first file after the cancellation, and no
   file is counted as failed because of it.
 
-- 2026-10-08: Made `remote nuke` delete the `.partial` files that
-  uploads cut off part-way leave on the destination store
-  ([issue #281](https://git.eeqj.de/sneak/vaultik/issues/281)). The
-  file and rclone listings skip such a file, so the command left it in
-  place and still reported the store empty. It now removes them under
-  `metadata/` and `blobs/` as its last step.
-
 - 2026-10-08: Made a local index error while recording a directory or
   symlink stop a backup under `--skip-errors`
   ([issue #284](https://git.eeqj.de/sneak/vaultik/issues/284)). Phase 2

internal/cli/entry_snapshot_create_prune_test.go

@@ -1,108 +0,0 @@
-package cli //nolint:testpackage // shares runEntry and the hermetic config helpers
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// Flags of `snapshot create` used to build argument vectors below.
-const (
-	flagPrune         = "--prune"
-	flagKeepNewerThan = "--keep-newer-than"
-)
-
-// TestEntrySnapshotCreateRejectsKeepNewerThanBeforeBackup checks that a
-// --keep-newer-than the post-backup prune could not use stops `snapshot
-// create` before the backup: the command fails and the destination
-// store stays empty. It used to be read only by the prune, after the
-// snapshot was uploaded, and without --prune it was ignored.
-//
-//nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
-func TestEntrySnapshotCreateRejectsKeepNewerThanBeforeBackup(t *testing.T) {
-	for _, testCase := range []struct {
-		name string
-		args []string
-	}{
-		{
-			name: "decimal in a day count",
-			args: []string{flagPrune, flagKeepNewerThan, "1.5d"},
-		},
-		{
-			name: "unknown unit",
-			args: []string{flagPrune, flagKeepNewerThan, "4x"},
-		},
-		{
-			name: "without --prune",
-			args: []string{flagKeepNewerThan, "4w"},
-		},
-	} {
-		t.Run(testCase.name, func(t *testing.T) {
-			configPath, storeDir := writeBackupConfig(t)
-
-			code, _, _ := runEntry(t, append(
-				[]string{flagConfig, configPath, cmdSnapshot, cmdCreate},
-				testCase.args...)...)
-
-			assert.Equal(t, 1, code)
-
-			stored, err := os.ReadDir(storeDir)
-			require.NoError(t, err)
-			assert.Empty(t, stored, "nothing may be uploaded")
-		})
-	}
-}
-
-// TestEntrySnapshotCreateReportsPostBackupPruneFailure makes the
-// post-backup prune fail after a good backup, by planting a manifest
-// that cannot be decoded, and checks that the failure is reported as the
-// prune's and not as a failed snapshot creation.
-//
-//nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
-func TestEntrySnapshotCreateReportsPostBackupPruneFailure(t *testing.T) {
-	configPath, storeDir := writeBackupConfig(t)
-
-	// A remote key is 64 lowercase hex characters. The prune reads every
-	// manifest on the store and fails on one it cannot decode.
-	plantedDir := filepath.Join(storeDir, "metadata", strings.Repeat("a", 64))
-	require.NoError(t, os.MkdirAll(plantedDir, 0o750))
-	require.NoError(t, os.WriteFile(
-		filepath.Join(plantedDir, "manifest.json.zst"),
-		[]byte("not a valid manifest"), 0o600))
-
-	code, _, stderr := runEntry(t,
-		flagConfig, configPath, cmdSnapshot, cmdCreate, flagPrune)
-
-	assert.Equal(t, 1, code)
-	assert.Contains(t, stderr, "Backup completed, but post-backup prune failed")
-	assert.NotContains(t, stderr, "Snapshot creation failed")
-
-	snapshots, err := os.ReadDir(filepath.Join(storeDir, "metadata"))
-	require.NoError(t, err)
-	assert.Len(t, snapshots, 2,
-		"the new snapshot is on the store beside the planted one")
-}
-
-// writeBackupConfig builds a hermetic config with one small file in its
-// source directory and an empty destination store directory. Returns the
-// config path and the store directory.
-func writeBackupConfig(t *testing.T) (string, string) {
-	t.Helper()
-
-	configPath := writeHermeticPruneConfig(t, false)
-
-	// writeHermeticPruneConfig puts the source and store directories
-	// beside the config file.
-	dir := filepath.Dir(configPath)
-	sourceDir := filepath.Join(dir, "source")
-
-	require.NoError(t, os.Mkdir(sourceDir, 0o750))
-	require.NoError(t, os.WriteFile(
-		filepath.Join(sourceDir, "file.txt"), []byte("hello"), 0o600))
-
-	return configPath, filepath.Join(dir, "store")
-}

internal/cli/snapshot.go

@@ -71,11 +71,6 @@ otherwise from the platform config directory (~/.config/vaultik/config.yml
 on Linux), then /etc/vaultik/config.yml.`,
 		Args: cobra.ArbitraryArgs,
 		RunE: func(cmd *cobra.Command, args []string) error {
-			err := opts.Validate()
-			if err != nil {
-				return err
-			}
-
 			// Pass snapshot names from args
 			opts.Snapshots = args
 			// --skip-errors is a global flag on the root command.
@@ -102,13 +97,6 @@ on Linux), then /etc/vaultik/config.yml.`,
 			}, func(v *vaultik.Vaultik) error {
 				return v.CreateSnapshot(opts)
 			}, func(err error) {
-				if errors.Is(err, vaultik.ErrPostBackupPruneFailed) {
-					log.Error("Post-backup prune failed", "error", err)
-					ReportErrorf("Backup completed, but %v", err)
-
-					return
-				}
-
 				log.Error("Snapshot creation failed", "error", err)
 				ReportErrorf("Snapshot creation failed: %v", err)
 			})
@@ -267,12 +255,8 @@ manifest (the destination store may hold snapshots this host doesn't
 know about), which is what 'vaultik prune' does. On success the command
 prints the exact 'vaultik prune' invocation to run as a follow-up.
 
-An ID that names no snapshot in the local index or on the destination
-store is an error.
-
 Use --local-only to skip the remote half (e.g. when you want to forget a
-snapshot locally without touching the destination store); the snapshot
-must then be in the local index.
+snapshot locally without touching the destination store).
 
 If the remote is unreachable, the local-database removal still completes
 and a warning is emitted; run 'vaultik snapshot remove <snapshot-id>' again

internal/storage/faultstore/faultstore.go

@@ -171,11 +171,6 @@ func (f *Storer) ListStream(
 	return f.inner.ListStream(ctx, prefix)
 }
 
-// DeletePartialUploads delegates unchanged.
-func (f *Storer) DeletePartialUploads(ctx context.Context, prefix string) error {
-	return f.inner.DeletePartialUploads(ctx, prefix)
-}
-
 // Info delegates unchanged.
 func (f *Storer) Info() storage.Info {
 	return f.inner.Info()

internal/storage/file.go

@@ -242,42 +242,6 @@ func (f *FileStorer) ListStream(ctx context.Context, prefix string) <-chan Objec
 	return ch
 }
 
-// DeletePartialUploads removes every file under prefix whose name ends in
-// tempSuffix. A missing prefix has none to remove.
-func (f *FileStorer) DeletePartialUploads(ctx context.Context, prefix string) error {
-	basePath := f.fullPath(prefix)
-
-	exists, err := afero.Exists(f.fs, basePath)
-	if err != nil {
-		return fmt.Errorf("checking path: %w", err)
-	}
-
-	if !exists {
-		return nil
-	}
-
-	err = afero.Walk(f.fs, basePath, func(path string, info os.FileInfo, err error) error {
-		if err != nil {
-			return err
-		}
-
-		if ctx.Err() != nil {
-			return ctx.Err()
-		}
-
-		if info.IsDir() || !strings.HasSuffix(info.Name(), tempSuffix) {
-			return nil
-		}
-
-		return f.fs.Remove(path)
-	})
-	if err != nil {
-		return fmt.Errorf("walking directory: %w", err)
-	}
-
-	return nil
-}
-
 // Info returns human-readable storage location information.
 func (f *FileStorer) Info() Info {
 	return Info{

internal/storage/file_atomic_test.go

@@ -120,45 +120,3 @@ func TestFileStorer_ListSkipsPartialFiles(t *testing.T) {
 		t.Fatalf("ListStream should return only the real key, got %v", streamed)
 	}
 }
-
-// TestFileStorer_DeletePartialUploads checks that a leftover temp file is
-// removed and the object at the real key is kept.
-func TestFileStorer_DeletePartialUploads(t *testing.T) {
-	t.Parallel()
-
-	base := t.TempDir()
-
-	f, err := storage.NewFileStorer(base)
-	if err != nil {
-		t.Fatalf("NewFileStorer: %v", err)
-	}
-
-	ctx := context.Background()
-
-	err = f.Put(ctx, testBlobKey, strings.NewReader("blob-bytes"))
-	if err != nil {
-		t.Fatalf("Put: %v", err)
-	}
-
-	leftover := filepath.Join(base, testBlobKey+"-123456.partial")
-
-	err = os.WriteFile(leftover, []byte("half"), 0o600)
-	if err != nil {
-		t.Fatalf("writing leftover temp file: %v", err)
-	}
-
-	err = f.DeletePartialUploads(ctx, "blobs/")
-	if err != nil {
-		t.Fatalf("DeletePartialUploads: %v", err)
-	}
-
-	_, err = os.Stat(leftover)
-	if !os.IsNotExist(err) {
-		t.Errorf("leftover temp file was not removed: %v", err)
-	}
-
-	_, err = f.Stat(ctx, testBlobKey)
-	if err != nil {
-		t.Errorf("Stat of the real key: %v", err)
-	}
-}

internal/storage/rclone.go

@@ -213,31 +213,6 @@ func (r *RcloneStorer) ListStream(
 	return ch
 }
 
-// DeletePartialUploads removes every object under prefix whose name ends
-// in tempSuffix.
-func (r *RcloneStorer) DeletePartialUploads(ctx context.Context, prefix string) error {
-	var partial []fs.Object
-
-	err := operations.ListFn(ctx, r.fsys, func(obj fs.Object) {
-		key := obj.Remote()
-		if strings.HasPrefix(key, prefix) && strings.HasSuffix(key, tempSuffix) {
-			partial = append(partial, obj)
-		}
-	})
-	if err != nil {
-		return fmt.Errorf("listing objects: %w", err)
-	}
-
-	for _, obj := range partial {
-		err = obj.Remove(ctx)
-		if err != nil {
-			return fmt.Errorf("removing object: %w", err)
-		}
-	}
-
-	return nil
-}
-
 // Info returns human-readable storage location information.
 func (r *RcloneStorer) Info() Info {
 	location := r.remote

internal/storage/rclone_test.go

@@ -198,47 +198,6 @@ func TestRcloneStorerListSkipsPartialFiles(t *testing.T) {
 	}
 }
 
-// TestRcloneStorerDeletePartialUploads checks that a temporary file left
-// by a killed upload is removed and the object at the real key is kept.
-//
-//nolint:paralleltest // NewRcloneStorer installs the process-global rclone config
-func TestRcloneStorerDeletePartialUploads(t *testing.T) {
-	dir := t.TempDir()
-	ctx := context.Background()
-
-	s, err := storage.NewRcloneStorer(ctx, ":local", dir)
-	if err != nil {
-		t.Fatalf("NewRcloneStorer: %v", err)
-	}
-
-	err = s.Put(ctx, testBlobKey, strings.NewReader("blob-bytes"))
-	if err != nil {
-		t.Fatalf("Put: %v", err)
-	}
-
-	leftover := filepath.Join(dir, testBlobKey+"-123456.partial")
-
-	err = os.WriteFile(leftover, []byte("half"), 0o600)
-	if err != nil {
-		t.Fatalf("writing leftover temp file: %v", err)
-	}
-
-	err = s.DeletePartialUploads(ctx, "blobs/")
-	if err != nil {
-		t.Fatalf("DeletePartialUploads: %v", err)
-	}
-
-	_, err = os.Stat(leftover)
-	if !os.IsNotExist(err) {
-		t.Errorf("leftover temp file was not removed: %v", err)
-	}
-
-	_, err = s.Stat(ctx, testBlobKey)
-	if err != nil {
-		t.Errorf("Stat of the real key: %v", err)
-	}
-}
-
 // newRcloneStorerOnWrappedLocal registers name as rclone's local backend
 // wrapped by wrap, and builds an rclone backend on it rooted at a fresh
 // temp directory. wrap changes the features the local backend reports, so

internal/storage/s3.go

@@ -99,12 +99,6 @@ func (s *S3Storer) ListStream(ctx context.Context, prefix string) <-chan ObjectI
 	return ch
 }
 
-// DeletePartialUploads has nothing to remove: S3 shows an object only once
-// its upload has completed, so an upload cut off part-way leaves none.
-func (s *S3Storer) DeletePartialUploads(_ context.Context, _ string) error {
-	return nil
-}
-
 // Info returns human-readable storage location information.
 func (s *S3Storer) Info() Info {
 	return Info{

internal/storage/storer.go

@@ -71,12 +71,6 @@ type Storer interface {
 	// If an error occurs during listing, the final item will have Err set.
 	ListStream(ctx context.Context, prefix string) <-chan ObjectInfo
 
-	// DeletePartialUploads removes every object under prefix that an
-	// upload cut off part-way left under a temporary name ending in
-	// `.partial`. The file and rclone backends' List and ListStream skip
-	// such an object.
-	DeletePartialUploads(ctx context.Context, prefix string) error
-
 	// Info returns human-readable storage location information.
 	Info() Info
 }

internal/vaultik/destination_validation_test.go

@@ -257,10 +257,6 @@ func (s *stubLister) List(_ context.Context, _ string) ([]string, error) {
 	return nil, errStubUnused
 }
 
-func (s *stubLister) DeletePartialUploads(_ context.Context, _ string) error {
-	return errStubUnused
-}
-
 func (s *stubLister) Info() storage.Info {
 	return storage.Info{}
 }

internal/vaultik/helpers.go

@@ -3,7 +3,6 @@ package vaultik
 import (
 	"errors"
 	"fmt"
-	"math"
 	"regexp"
 	"strconv"
 	"strings"
@@ -48,10 +47,6 @@ const (
 	year  = 365 * day
 )
 
-// maxDuration is the largest value a time.Duration can hold, about 292
-// years.
-const maxDuration = time.Duration(math.MaxInt64)
-
 // A snapshot ID split on "_" has at least a hostname and a trailing
 // timestamp.
 const minSnapshotIDParts = 2
@@ -150,10 +145,10 @@ func parseSnapshotName(snapshotID, hostname string) string {
 // parseDuration parses a duration string with support for human-friendly units:
 // d/day/days, w/week/weeks, mo/month/months, y/year/years, plus standard Go
 // duration units. Following Go, m is minutes and mo is months. A bare number,
-// an unknown unit, a negative value, and a total longer than maxDuration are
-// all rejected. Outside the Go units the input must be whole numbers each
-// followed directly by a unit (2w3d), so 1.0y and 30 days are errors;
-// decimals work only in Go units (1.5h).
+// an unknown unit, and a negative value are all rejected. Outside the Go
+// units the input must be whole numbers each followed directly by a unit
+// (2w3d), so 1.0y and 30 days are errors; decimals work only in Go units
+// (1.5h).
 func parseDuration(s string) (time.Duration, error) {
 	if strings.HasPrefix(strings.TrimSpace(s), "-") {
 		return 0, errNegativeDuration
@@ -186,30 +181,19 @@ func parseDuration(s string) (time.Duration, error) {
 			return 0, fmt.Errorf("invalid number %q: %w", match[1], err)
 		}
 
-		var unitLength time.Duration
-
 		unit := strings.ToLower(match[2])
 		switch unit {
 		case "d", "day", "days":
-			unitLength = day
+			total += time.Duration(n) * day
 		case "w", "week", "weeks":
-			unitLength = week
+			total += time.Duration(n) * week
 		case "mo", "month", "months":
-			unitLength = month
+			total += time.Duration(n) * month
 		case "y", "year", "years":
-			unitLength = year
+			total += time.Duration(n) * year
 		default:
 			return 0, fmt.Errorf("%w %q", errUnknownTimeUnit, unit)
 		}
-
-		// Past maxDuration the sum wraps to a negative value, which would
-		// put the purge cutoff in the future.
-		if time.Duration(n) > (maxDuration-total)/unitLength {
-			return 0, fmt.Errorf("%w: %q is longer than about 292 years",
-				errInvalidDuration, s)
-		}
-
-		total += time.Duration(n) * unitLength
 	}
 
 	return total, nil

internal/vaultik/helpers_test.go

@@ -111,17 +111,6 @@ func TestParseDuration(t *testing.T) {
 		{"30 days", 0, true},
 		{"30 days ago", 0, true},
 		{"x7d", 0, true},
-		// The largest time.Duration is about 292 years. A larger value
-		// must be rejected, not wrapped to a negative one, which would
-		// put the cutoff in the future and select every snapshot.
-		{"292y", 292 * 365 * 24 * time.Hour, false},
-		{"293y", 0, true},
-		{"3559mo", 0, true},
-		{"15251w", 0, true},
-		{"106752d", 0, true},
-		{"2562048h", 0, true},
-		{"200y200y", 0, true},
-		{"292y6mo", 0, true},
 	}
 
 	for _, tt := range tests {

internal/vaultik/integration_test.go

@@ -155,12 +155,6 @@ func (m *MockStorer) ListStream(
 	return ch
 }
 
-// DeletePartialUploads has nothing to remove: Put stores each object
-// under its key at once.
-func (m *MockStorer) DeletePartialUploads(_ context.Context, _ string) error {
-	return nil
-}
-
 func (m *MockStorer) Info() storage.Info {
 	return storage.Info{
 		Type:     "mock",

internal/vaultik/nuke_remote_test.go

@@ -1,64 +0,0 @@
-package vaultik_test
-
-import (
-	"context"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/vaultik/internal/log"
-	"sneak.berlin/go/vaultik/internal/snapshot"
-)
-
-// TestNukeRemoteLeavesNoFiles checks that remote nuke leaves no file
-// under a file:// destination, including the `.partial` files uploads
-// killed part-way leave next to a snapshot's metadata and next to where a
-// blob would have been.
-func TestNukeRemoteLeavesNoFiles(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	storeDir := filepath.Join(t.TempDir(), "store")
-	v, repos, _ := backUpToFileDestination(ctx, t, storeDir)
-
-	snapshots, err := repos.Snapshots.ListRecent(ctx, listRecentTestLimit)
-	require.NoError(t, err)
-	require.Len(t, snapshots, 1)
-
-	snapshotKey := snapshot.RemoteSnapshotKey(snapshots[0].ID.String())
-	hash := testBlobHashA
-	leftovers := []string{
-		filepath.Join(storeDir, "metadata", snapshotKey,
-			"db.zst.age-123456.partial"),
-		filepath.Join(storeDir, "blobs", hash[:2], hash[2:4],
-			hash+"-123456.partial"),
-	}
-
-	for _, leftover := range leftovers {
-		require.NoError(t, os.MkdirAll(filepath.Dir(leftover), 0o750))
-		require.NoError(t, os.WriteFile(leftover, []byte("half an upload"), 0o600))
-	}
-
-	require.NoError(t, v.NukeRemote(true))
-
-	var files []string
-
-	err = filepath.WalkDir(storeDir,
-		func(path string, entry fs.DirEntry, err error) error {
-			if err != nil {
-				return err
-			}
-
-			if !entry.IsDir() {
-				files = append(files, path)
-			}
-
-			return nil
-		})
-	require.NoError(t, err)
-	assert.Empty(t, files)
-}

internal/vaultik/prune.go

@@ -24,9 +24,8 @@ var errNukeRequiresForce = errors.New(
 const metadataDirName = "metadata"
 
 // NukeRemote deletes every snapshot's metadata and every blob from remote
-// storage, along with any object an upload cut off part-way left under a
-// temporary `.partial` name. After this returns successfully the bucket
-// prefix is empty and the next backup starts from scratch.
+// storage. After this returns successfully the bucket prefix is empty and
+// the next backup starts from scratch.
 //
 // Refuses to run unless force is true. The caller is responsible for
 // confirming with the user.
@@ -49,15 +48,6 @@ func (v *Vaultik) NukeRemote(force bool) error {
 		return fmt.Errorf("pruning blobs: %w", err)
 	}
 
-	// The file and rclone listings skip `.partial` objects, so the two
-	// steps above never delete them.
-	for _, prefix := range []string{"metadata/", "blobs/"} {
-		err = v.Storage.DeletePartialUploads(v.ctx, prefix)
-		if err != nil {
-			return fmt.Errorf("deleting partial uploads: %w", err)
-		}
-	}
-
 	v.UI.Completef("Backup destination store is now empty.")
 
 	return nil

internal/vaultik/purge_per_name_test.go

@@ -267,29 +267,6 @@ func TestPurgeOlderThan_WithNameFilter(t *testing.T) {
 	assert.Contains(t, remaining, snapHomeT0)
 }
 
-func TestPurgeOlderThan_TooLargeDeletesNothing(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	snapshotIDs := []string{snapHomeT0, snapHomeT1}
-
-	v := setupPurgeTest(t, snapHostname, snapshotIDs)
-
-	err := v.PurgeSnapshotsWithOptions(&vaultik.SnapshotPurgeOptions{
-		OlderThan: "1000y",
-		Force:     true,
-	})
-	require.Error(t, err)
-
-	err = v.PurgeSnapshotsWithOptions(&vaultik.SnapshotPurgeOptions{
-		OlderThan: "292y",
-		Force:     true,
-	})
-	require.NoError(t, err)
-
-	assert.ElementsMatch(t, snapshotIDs, listRemainingSnapshots(t, v))
-}
-
 func TestPurgeKeepLatest_ThreeNames(t *testing.T) {
 	log.Initialize(log.Config{})
 	t.Parallel()

internal/vaultik/remove_snapshot_test.go

@@ -3,21 +3,17 @@ package vaultik_test
 import (
 	"bytes"
 	"context"
-	"database/sql"
 	"io"
 	"strings"
 	"sync"
 	"testing"
-	"time"
 
 	"github.com/klauspost/compress/zstd"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/vaultik/internal/database"
 	"sneak.berlin/go/vaultik/internal/log"
 	"sneak.berlin/go/vaultik/internal/snapshot"
 	"sneak.berlin/go/vaultik/internal/storage"
-	"sneak.berlin/go/vaultik/internal/types"
 	"sneak.berlin/go/vaultik/internal/vaultik"
 )
 
@@ -129,12 +125,6 @@ func (s *testStorer) ListStream(
 	return ch
 }
 
-// DeletePartialUploads has nothing to remove: Put stores each object
-// under its key at once.
-func (s *testStorer) DeletePartialUploads(_ context.Context, _ string) error {
-	return nil
-}
-
 func (s *testStorer) Info() storage.Info {
 	return storage.Info{
 		Type:     testLabel,
@@ -218,37 +208,6 @@ func addBlob(t *testing.T, store *testStorer, hash string) {
 	require.NoError(t, err)
 }
 
-// newLocalIndex returns an in-memory local index holding a completed
-// snapshot row for each of ids.
-func newLocalIndex(t *testing.T, ids ...string) *database.Repositories {
-	t.Helper()
-
-	ctx := context.Background()
-
-	db, err := database.New(ctx, ":memory:")
-	require.NoError(t, err)
-	t.Cleanup(func() { _ = db.Close() })
-
-	repos := database.NewRepositories(db)
-
-	for _, id := range ids {
-		completedAt := time.Now().UTC()
-		snap := &database.Snapshot{
-			ID:          types.SnapshotID(id),
-			Hostname:    snapHostname,
-			StartedAt:   completedAt,
-			CompletedAt: &completedAt,
-		}
-
-		err = repos.WithTx(ctx, func(ctx context.Context, tx *sql.Tx) error {
-			return repos.Snapshots.Create(ctx, tx, snap)
-		})
-		require.NoError(t, err)
-	}
-
-	return repos
-}
-
 // ============================================================================
 // Unit Tests for RemoveSnapshot
 // ============================================================================
@@ -268,7 +227,6 @@ func TestRemoveSnapshot_LocalOnly_PreservesRemote(t *testing.T) {
 	addBlob(t, store, blobA)
 
 	tv := vaultik.NewForTesting(store)
-	tv.Repositories = newLocalIndex(t, "snapshot-001")
 
 	opts := &vaultik.RemoveOptions{Force: true, LocalOnly: true}
 	result, err := tv.RemoveSnapshot("snapshot-001", opts)
@@ -304,7 +262,6 @@ func TestRemoveSnapshot_DefaultRemovesMetadataNotBlobs(t *testing.T) {
 	addBlob(t, store, blobShared)
 
 	tv := vaultik.NewForTesting(store)
-	tv.Repositories = newLocalIndex(t, "snapshot-001", "snapshot-002")
 
 	opts := &vaultik.RemoveOptions{Force: true}
 	result, err := tv.RemoveSnapshot("snapshot-001", opts)
@@ -353,84 +310,6 @@ func TestRemoveSnapshot_DryRun(t *testing.T) {
 	assert.Contains(t, tv.Stdout.String(), "[Dry run - no changes made]")
 }
 
-// TestRemoveSnapshot_UnknownIDIsError checks that an ID naming no
-// snapshot in the local index or on the destination store is an error
-// under every option, and that nothing is reported as removed.
-func TestRemoveSnapshot_UnknownIDIsError(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	for name, opts := range map[string]vaultik.RemoveOptions{
-		"force":      {Force: true},
-		"json":       {JSON: true},
-		"dry-run":    {Force: true, DryRun: true},
-		"local-only": {Force: true, LocalOnly: true},
-	} {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			store := newTestStorer()
-			addManifest(t, store, "snapshot-001", nil)
-
-			tv := vaultik.NewForTesting(store)
-			tv.Repositories = newLocalIndex(t, "snapshot-001")
-
-			result, err := tv.RemoveSnapshot("snapshot-999", &opts)
-
-			require.ErrorContains(t, err, "snapshot not found")
-			assert.False(t, result.RemoteRemoved)
-			assert.Empty(t, tv.Stdout.String())
-			assert.True(t, store.hasKey(remoteKeyPath("snapshot-001")))
-		})
-	}
-}
-
-// TestRemoveSnapshot_NoMetadataOnDestination checks that removing a
-// snapshot whose metadata is not on the destination store does not
-// report metadata removed from it.
-func TestRemoveSnapshot_NoMetadataOnDestination(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	tv := vaultik.NewForTesting(newTestStorer())
-	tv.Repositories = newLocalIndex(t, "snapshot-001")
-
-	result, err := tv.RemoveSnapshot("snapshot-001",
-		&vaultik.RemoveOptions{Force: true})
-
-	require.NoError(t, err)
-	assert.False(t, result.RemoteRemoved)
-
-	out := tv.Stdout.String()
-	assert.Contains(t, out, "Removed snapshot 'snapshot-001' from local database")
-	assert.NotContains(t, out, "Removed snapshot metadata from remote storage")
-}
-
-// TestRemoveSnapshot_NotInLocalIndex checks that removing a snapshot
-// only the destination store holds removes its metadata there without
-// reporting a removal from the local database.
-func TestRemoveSnapshot_NotInLocalIndex(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	store := newTestStorer()
-	addManifest(t, store, "snapshot-001", nil)
-
-	tv := vaultik.NewForTesting(store)
-	tv.Repositories = newLocalIndex(t)
-
-	result, err := tv.RemoveSnapshot("snapshot-001",
-		&vaultik.RemoveOptions{Force: true})
-
-	require.NoError(t, err)
-	assert.True(t, result.RemoteRemoved)
-	assert.False(t, store.hasKey(remoteKeyPath("snapshot-001")))
-
-	out := tv.Stdout.String()
-	assert.NotContains(t, out, "from local database")
-	assert.Contains(t, out, "Removed snapshot metadata from remote storage")
-}
-
 func TestRemoveAllSnapshots_RequiresForce(t *testing.T) {
 	log.Initialize(log.Config{})
 	t.Parallel()

internal/vaultik/snapshot.go

@@ -23,19 +23,12 @@ var (
 	errNoSnapshotsInConfig  = errors.New("no snapshots configured")
 	errSnapshotVerifyFailed = errors.New("verification failed")
 	errRemoveAllNeedsForce  = errors.New("--all requires --force")
-	errSnapshotNotFound     = errors.New("snapshot not found")
 	errInvalidTableName     = errors.New("invalid table name")
 	errNoAgeRecipients      = errors.New(
 		"creating a snapshot needs at least one public key in " +
 			"age_recipients (generate a keypair with: age-keygen)")
-	errKeepNewerThanNeedsPrune = errors.New("--keep-newer-than requires --prune")
 )
 
-// ErrPostBackupPruneFailed wraps a failure of the post-backup prune,
-// which runs only after every snapshot was created and uploaded, so the
-// caller can report it apart from a failed backup.
-var ErrPostBackupPruneFailed = errors.New("post-backup prune failed")
-
 // listRecentLimit caps how many snapshot rows are fetched from the
 // local index for listing and purge operations.
 const listRecentLimit = 10000
@@ -51,26 +44,6 @@ type SnapshotCreateOptions struct {
 	Snapshots     []string // Optional list of snapshot names to process (empty = all)
 }
 
-// Validate fails when KeepNewerThan is set without Prune or is not a
-// valid duration. Only the post-backup prune reads KeepNewerThan, after
-// the backup, so the caller checks it before starting one.
-func (opts *SnapshotCreateOptions) Validate() error {
-	if opts.KeepNewerThan == "" {
-		return nil
-	}
-
-	if !opts.Prune {
-		return errKeepNewerThanNeedsPrune
-	}
-
-	_, err := parseDuration(opts.KeepNewerThan)
-	if err != nil {
-		return fmt.Errorf("--keep-newer-than: %w", err)
-	}
-
-	return nil
-}
-
 // CreateSnapshot executes the snapshot creation operation
 func (v *Vaultik) CreateSnapshot(opts *SnapshotCreateOptions) error {
 	// config.Load accepts an empty list, since listing, verifying and
@@ -149,7 +122,7 @@ func (v *Vaultik) CreateSnapshot(opts *SnapshotCreateOptions) error {
 	if opts.Prune {
 		err = v.runPostBackupPrune(snapshotNames, opts.KeepNewerThan)
 		if err != nil {
-			return fmt.Errorf("%w: %w", ErrPostBackupPruneFailed, err)
+			return fmt.Errorf("post-backup prune: %w", err)
 		}
 	}
 
@@ -670,7 +643,7 @@ func (v *Vaultik) confirmAndExecutePurge(
 				"snapshot_id", snapshotID, "error", err)
 		}
 
-		_, err = v.deleteRemoteSnapshotByKey(snapshot.RemoteSnapshotKey(snapshotID))
+		err = v.deleteRemoteSnapshotByKey(snapshot.RemoteSnapshotKey(snapshotID))
 		if err != nil {
 			return fmt.Errorf("deleting snapshot %s from remote: %w", snapshotID, err)
 		}
@@ -1180,11 +1153,6 @@ func (v *Vaultik) RemoveSnapshot(
 		return result, err
 	}
 
-	inLocalIndex, err := v.findSnapshotToRemove(snapshotID, opts)
-	if err != nil {
-		return result, err
-	}
-
 	if opts.DryRun {
 		return v.removeSnapshotDryRun(result, snapshotID, opts)
 	}
@@ -1193,13 +1161,11 @@ func (v *Vaultik) RemoveSnapshot(
 		return result, nil
 	}
 
-	if inLocalIndex {
-		log.Info("Removing snapshot from local database", "snapshot_id", snapshotID)
+	log.Info("Removing snapshot from local database", "snapshot_id", snapshotID)
 
-		err = v.deleteSnapshotFromLocalDB(snapshotID)
-		if err != nil {
-			return result, fmt.Errorf("removing from local database: %w", err)
-		}
+	err = v.deleteSnapshotFromLocalDB(snapshotID)
+	if err != nil {
+		return result, fmt.Errorf("removing from local database: %w", err)
 	}
 
 	if !opts.LocalOnly {
@@ -1218,11 +1184,9 @@ func (v *Vaultik) RemoveSnapshot(
 		return result, v.outputRemoveJSON(result)
 	}
 
-	if inLocalIndex {
-		v.stdoutf("Removed snapshot '%s' from local database\n", snapshotID)
-	}
+	v.stdoutf("Removed snapshot '%s' from local database\n", snapshotID)
 
-	if result.RemoteRemoved {
+	if !opts.LocalOnly && result.RemoteRemoved {
 		v.printlnStdout("Removed snapshot metadata from remote storage")
 		v.stdoutf("\nNote: The removed snapshot's blobs remain on the remote. "+
 			"Run '%s' to delete any blobs no longer referenced by any "+
@@ -1232,45 +1196,6 @@ func (v *Vaultik) RemoveSnapshot(
 	return result, nil
 }
 
-// findSnapshotToRemove reports whether the local index has a row for
-// snapshotID, and returns errSnapshotNotFound when there is nothing to
-// remove: no row and, unless LocalOnly is set, no metadata on the
-// destination store either. The destination store is consulted only
-// when the local index has no row, so a snapshot in the local index can
-// still be removed from it while the destination store is unreachable.
-func (v *Vaultik) findSnapshotToRemove(
-	snapshotID string, opts *RemoveOptions,
-) (bool, error) {
-	if v.Repositories != nil {
-		snap, err := v.Repositories.Snapshots.GetByID(v.ctx, snapshotID)
-		if err != nil {
-			return false, fmt.Errorf("looking up snapshot in local index: %w", err)
-		}
-
-		if snap != nil {
-			return true, nil
-		}
-	}
-
-	if opts.LocalOnly {
-		return false, fmt.Errorf("%w in the local index: %s",
-			errSnapshotNotFound, snapshotID)
-	}
-
-	objects, err := v.remoteSnapshotObjects(snapshot.RemoteSnapshotKey(snapshotID))
-	if err != nil {
-		return false, fmt.Errorf("looking up snapshot on destination store: %w", err)
-	}
-
-	if len(objects) == 0 {
-		return false, fmt.Errorf(
-			"%w in the local index or on the destination store: %s",
-			errSnapshotNotFound, snapshotID)
-	}
-
-	return false, nil
-}
-
 // removeSnapshotDryRun reports what RemoveSnapshot would do without
 // making changes.
 func (v *Vaultik) removeSnapshotDryRun(
@@ -1330,14 +1255,14 @@ func (v *Vaultik) confirmRemoveSnapshot(snapshotID string, opts *RemoveOptions)
 // didn't finish and to run `vaultik snapshot remove` for the snapshot
 // again once the destination store is reachable (`vaultik prune` never
 // removes snapshot metadata). Returns true when the remote removal
-// succeeded and deleted something.
+// succeeded.
 func (v *Vaultik) removeSnapshotRemote(snapshotID string, opts *RemoveOptions) bool {
 	log.Info("Removing snapshot metadata from remote storage",
 		"snapshot_id", snapshotID)
 
 	remoteKey := snapshot.RemoteSnapshotKey(snapshotID)
 
-	deleted, err := v.deleteRemoteSnapshotByKey(remoteKey)
+	err := v.deleteRemoteSnapshotByKey(remoteKey)
 	if err != nil {
 		log.Warn("Could not remove snapshot metadata from remote storage; "+
 			"run '"+snapshotRemoveCommandHint+"' with the snapshot's ID "+
@@ -1355,7 +1280,7 @@ func (v *Vaultik) removeSnapshotRemote(snapshotID string, opts *RemoveOptions) b
 		return false
 	}
 
-	return deleted > 0
+	return true
 }
 
 // RemoveAllSnapshots removes every snapshot known to the local
@@ -1647,7 +1572,7 @@ func (v *Vaultik) removeAllLocalSnapshots(
 		}
 
 		if !opts.LocalOnly {
-			_, err = v.deleteRemoteSnapshotByKey(
+			err = v.deleteRemoteSnapshotByKey(
 				snapshot.RemoteSnapshotKey(snapshotID))
 			if err != nil {
 				log.Warn("Failed to remove snapshot metadata from remote",
@@ -1673,7 +1598,7 @@ func (v *Vaultik) removeAllOrphanRemotes(
 	for _, key := range orphanRemoteKeys {
 		log.Info("Removing orphan remote snapshot", "remote_key", key)
 
-		_, err := v.deleteRemoteSnapshotByKey(key)
+		err := v.deleteRemoteSnapshotByKey(key)
 		if err != nil {
 			log.Warn("Failed to remove orphan from remote",
 				"remote_key", key, "error", err)
@@ -1720,44 +1645,34 @@ func (v *Vaultik) deleteSnapshotFromLocalDB(snapshotID string) error {
 }
 
 // deleteRemoteSnapshotByKey removes everything under
-// metadata/<remoteKey>/ on the destination store and returns how many
-// objects it deleted. The argument is a remote key (double-SHA256
-// derivation), not a human snapshot ID; callers that have a human ID
-// must hash via snapshot.RemoteSnapshotKey first.
-func (v *Vaultik) deleteRemoteSnapshotByKey(remoteKey string) (int, error) {
-	objectsToDelete, err := v.remoteSnapshotObjects(remoteKey)
-	if err != nil {
-		return 0, err
+// metadata/<remoteKey>/ on the destination store. The argument is a
+// remote key (double-SHA256 derivation), not a human snapshot ID;
+// callers that have a human ID must hash via snapshot.RemoteSnapshotKey
+// first.
+func (v *Vaultik) deleteRemoteSnapshotByKey(remoteKey string) error {
+	prefix := fmt.Sprintf("metadata/%s/", remoteKey)
+	objectCh := v.Storage.ListStream(v.ctx, prefix)
+
+	var objectsToDelete []string
+
+	for object := range objectCh {
+		if object.Err != nil {
+			return fmt.Errorf("listing objects: %w", object.Err)
+		}
+
+		objectsToDelete = append(objectsToDelete, object.Key)
 	}
 
-	for i, key := range objectsToDelete {
-		err = v.Storage.Delete(v.ctx, key)
+	for _, key := range objectsToDelete {
+		err := v.Storage.Delete(v.ctx, key)
 		if err != nil {
-			return i, fmt.Errorf("removing %s: %w", key, err)
+			return fmt.Errorf("removing %s: %w", key, err)
 		}
 
 		log.Debug("Deleted remote object", "key", key)
 	}
 
-	return len(objectsToDelete), nil
-}
-
-// remoteSnapshotObjects lists the keys of every object under
-// metadata/<remoteKey>/ on the destination store.
-func (v *Vaultik) remoteSnapshotObjects(remoteKey string) ([]string, error) {
-	prefix := fmt.Sprintf("metadata/%s/", remoteKey)
-
-	var keys []string
-
-	for object := range v.Storage.ListStream(v.ctx, prefix) {
-		if object.Err != nil {
-			return nil, fmt.Errorf("listing objects: %w", object.Err)
-		}
-
-		keys = append(keys, object.Key)
-	}
-
-	return keys, nil
+	return nil
 }
 
 // outputRemoveJSON outputs the removal result as JSON

internal/vaultik/storage_bind.go

@@ -9,7 +9,7 @@ import (
 )
 
 // errStorageBindingMismatch is returned when the local index database is
-// bound to a different destination than the configured one.
+// bound to a different destination than the configured storage_url.
 var errStorageBindingMismatch = errors.New(
 	"local index is bound to a different backup destination")
 
@@ -24,9 +24,8 @@ var errStorageBindingMismatch = errors.New(
 //
 // Behaviour:
 //   - On first use (empty stored value), record the configured
-//     destination (storage_url, or the s3.* endpoint, bucket and
-//     prefix) and log the binding.
-//   - When the stored value matches the configured destination, do
+//     storage_url and log the binding.
+//   - When the stored value matches the configured storage_url, do
 //     nothing and return nil.
 //   - When the two differ, refuse with an error that tells the user
 //     how to recover (revert the config, or run `vaultik database
@@ -47,10 +46,12 @@ func (v *Vaultik) EnsureStorageBinding() error {
 
 	configured := v.Config.StorageURL
 	if configured == "" {
-		// The s3.* form: bind on its endpoint, bucket and prefix,
-		// written the way storage_url would name the same destination.
-		s3 := v.Config.S3
-		configured = "s3://" + s3.Bucket + "/" + s3.Prefix + "?endpoint=" + s3.Endpoint
+		// Some legacy configs still use the split s3.* keys instead of
+		// storage_url. Falling back to a synthetic URL for those would
+		// hide the fact that the binding is loose. Instead, treat
+		// unset as "nothing to bind against" — the check is
+		// necessarily best-effort for those configs.
+		return nil
 	}
 
 	stored, err := v.Repositories.LocalMeta.Get(v.ctx, database.LocalMetaKeyStorageURL)
@@ -95,8 +96,7 @@ func buildBindingMismatchMessage(stored, configured string) string {
 		"future snapshots referencing blobs that don't exist at the new destination.\n" +
 		"\n" +
 		"To proceed, either:\n" +
-		"  - revert storage_url (or the s3.* endpoint, bucket and prefix) in your\n" +
-		"    config to the bound destination, or\n" +
+		"  - revert storage_url in your config to the bound destination, or\n" +
 		"  - run 'vaultik database delete' to discard the local index and rebuild it\n" +
 		"    from a fresh full backup against the new destination"
 }

internal/vaultik/storage_bind_test.go

@@ -76,51 +76,3 @@ func TestEnsureStorageBinding_MismatchRefuses(t *testing.T) {
 	assert.Contains(t, err.Error(), "file:///mnt/backups/new")
 	assert.Contains(t, err.Error(), "vaultik database delete")
 }
-
-// A config with no storage_url names its destination with s3.endpoint,
-// s3.bucket and s3.prefix; a change to any of them must be refused just
-// as a changed storage_url is.
-func TestEnsureStorageBinding_S3FieldsChangeRefuses(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	bound := config.S3Config{
-		Endpoint: "https://s3.example.com",
-		Bucket:   "bucket-a",
-		Prefix:   "backups",
-	}
-
-	tests := []struct {
-		name    string
-		changed config.S3Config
-	}{
-		{"bucket", config.S3Config{
-			Endpoint: bound.Endpoint, Bucket: "bucket-b", Prefix: bound.Prefix,
-		}},
-		{"prefix", config.S3Config{
-			Endpoint: bound.Endpoint, Bucket: bound.Bucket, Prefix: "other",
-		}},
-		{"endpoint", config.S3Config{
-			Endpoint: "https://s3.other.com", Bucket: bound.Bucket, Prefix: bound.Prefix,
-		}},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			tv, _ := buildBindTestVaultik(t, "")
-
-			tv.Config.S3 = bound
-			require.NoError(t, tv.EnsureStorageBinding(), "first use binds")
-			require.NoError(t, tv.EnsureStorageBinding(), "same destination passes")
-
-			tv.Config.S3 = tt.changed
-			err := tv.EnsureStorageBinding()
-			require.Error(t, err)
-			assert.Contains(t, err.Error(),
-				"local index is bound to a different backup destination")
-			assert.Contains(t, err.Error(), "vaultik database delete")
-		})
-	}
-}