Stop a stalled blob read when restore or deep verify is interrupted (closes #325)

Restore and deep verify looked for a cancel only between blobs, and the
file backend's reader ignores the context. A blob read stalled on a
slow USB stick or network share outlasted the 30-second shutdown
timeout, so the process exited before removing the decrypted snapshot
database and blob cache from the temp directory.

FetchBlob, through which both read every blob, now closes the storage
reader as soon as the context is cancelled, ending a blocked read on
any backend; Read then returns the context's error, not the closed
reader's.

Limitation: a read stuck in the kernel that closing cannot interrupt,
such as one on an unresponsive hard NFS mount, still cannot be stopped.

Model: opus-5-5

README.md

@@ -271,14 +271,8 @@ existing file. Created with mode `0600` since it will contain credentials.
 **`config set`**: Set a scalar config value by dotted YAML path
 (e.g. `vaultik config set compression_level 9`,
 `vaultik config set storage_url "file:///mnt/backups"`). Comments and
-formatting in the file are preserved. Missing keys along the path are
-created: as a list when the next path element is a number (so
-`vaultik config set age_recipients.0 age1...` works on a file without
-`age_recipients`), otherwise as a map. A change that gives a setting the
-wrong type, such as a single value where a list belongs or a word where
-a number belongs, is refused and the file is left unchanged. Whether the
-config is complete and its values are in range is checked when a command
-loads it, not by `config set`, so settings can be set one at a time.
+formatting in the file are preserved; intermediate maps are created as
+needed.
 
 **`snapshot create`**: Perform incremental backup of configured snapshots.
 * Optional snapshot names argument to create specific snapshots (default: all)

internal/cli/config.go

@@ -44,8 +44,6 @@ var (
 	errNeedNumericIndex = errors.New("key is a list; use a numeric index")
 	errIndexOutOfRange  = errors.New("index out of range")
 	errNotMapOrList     = errors.New("key is not a map or list")
-	errWouldNotLoad     = errors.New(
-		"the config would no longer load, so the file was not changed")
 )
 
 const defaultConfigTemplate = `# vaultik configuration
@@ -253,12 +251,6 @@ func NewConfigCommand() *cobra.Command {
 		Use:   "config",
 		Short: "Manage the configuration file",
 		Long:  "Commands for creating, editing, and querying the vaultik config file.",
-		// cobra checks Args only on a command that has a Run: without
-		// one, a mistyped subcommand printed help and exited 0.
-		Args: cobra.NoArgs,
-		Run: func(cmd *cobra.Command, _ []string) {
-			_ = cmd.Help()
-		},
 	}
 
 	cmd.AddCommand(newConfigInitCommand())
@@ -393,11 +385,8 @@ func newConfigSetCommand() *cobra.Command {
 		Use:   "set <key> <value>",
 		Short: "Set a config value by dotted path (e.g. compression_level 5)",
 		Long: `Sets a scalar config value addressed by dotted YAML path and writes
-the file back, preserving comments and formatting. Missing keys along
-the path are created: as a list when the next path element is a
-number, otherwise as a map. A change that gives a setting the wrong
-type, such as a single value where a list belongs, is refused and the
-file is left unchanged.
+the file back, preserving comments and formatting. Intermediate maps
+are created as needed.
 
 Examples:
   vaultik config set storage_url "file:///mnt/backups"
@@ -437,14 +426,6 @@ func writeConfigSet(out *ui.Writer, path, key, value string) error {
 		return fmt.Errorf("marshaling config: %w", err)
 	}
 
-	// Refuse a result that config.Load could not decode. Load also
-	// validates the config; that is left out here because settings are set
-	// one at a time, so a config being filled in is incomplete in between.
-	err = yaml.Unmarshal(data, &config.Config{})
-	if err != nil {
-		return fmt.Errorf("%w: %w", errWouldNotLoad, err)
-	}
-
 	err = os.WriteFile(path, data, configFileMode)
 	if err != nil {
 		return fmt.Errorf("writing config file: %w", err)
@@ -572,8 +553,8 @@ func yamlPathGet(root *yaml.Node, keys []string) (*yaml.Node, error) {
 	return node, nil
 }
 
-// yamlPathSet navigates a dotted key path, creating missing keys as needed,
-// and sets the final key to the given scalar value. Numeric path
+// yamlPathSet navigates a dotted key path, creating intermediate maps as
+// needed, and sets the final key to the given scalar value. Numeric path
 // components index into sequences; an index equal to the sequence length
 // appends a new element (e.g. "age_recipients.1" on a 1-element list).
 func yamlPathSet(root *yaml.Node, keys []string, value string) error {
@@ -586,12 +567,12 @@ func yamlPathSet(root *yaml.Node, keys []string, value string) error {
 		node = node.Content[0]
 	}
 
-	for i := range keys {
+	for i, key := range keys {
 		last := i == len(keys)-1
 
 		switch node.Kind {
 		case yaml.MappingNode:
-			node = yamlSetInMapping(node, keys, i, value, last)
+			node = yamlSetInMapping(node, key, value, last)
 		case yaml.SequenceNode:
 			next, err := yamlSetInSequence(node, keys, i, value, last)
 			if err != nil {
@@ -660,16 +641,14 @@ func yamlField(typ reflect.Type, key string) (reflect.StructField, bool) {
 	return reflect.StructField{}, false
 }
 
-// yamlSetInMapping resolves (creating if needed) the value node for the
-// path element keys[i] within a mapping node, setting it to value when it
-// is the final path element, and returns the node to descend into.
-func yamlSetInMapping(
-	node *yaml.Node, keys []string, i int, value string, last bool,
-) *yaml.Node {
+// yamlSetInMapping resolves (creating if needed) the value node for key
+// within a mapping node, setting it to value when it is the final path
+// element, and returns the node to descend into.
+func yamlSetInMapping(node *yaml.Node, key, value string, last bool) *yaml.Node {
 	var valueNode *yaml.Node
 
 	for j := 0; j+1 < len(node.Content); j += 2 {
-		if node.Content[j].Value == keys[i] {
+		if node.Content[j].Value == key {
 			valueNode = node.Content[j+1]
 
 			break
@@ -677,8 +656,13 @@ func yamlSetInMapping(
 	}
 
 	if valueNode == nil {
-		keyNode := &yaml.Node{Kind: yaml.ScalarNode, Value: keys[i]}
-		valueNode = newPathNode(keys, i, value)
+		keyNode := &yaml.Node{Kind: yaml.ScalarNode, Value: key}
+
+		valueNode = &yaml.Node{Kind: yaml.MappingNode}
+		if last {
+			valueNode = &yaml.Node{Kind: yaml.ScalarNode, Value: value}
+		}
+
 		node.Content = append(node.Content, keyNode, valueNode)
 	} else if last {
 		setScalar(valueNode, value)
@@ -706,7 +690,12 @@ func yamlSetInSequence(
 	}
 
 	if idx == len(node.Content) {
-		node.Content = append(node.Content, newPathNode(keys, i, value))
+		newNode := &yaml.Node{Kind: yaml.MappingNode}
+		if last {
+			newNode = &yaml.Node{Kind: yaml.ScalarNode, Value: value}
+		}
+
+		node.Content = append(node.Content, newNode)
 	} else if last {
 		setScalar(node.Content[idx], value)
 	}
@@ -714,22 +703,6 @@ func yamlSetInSequence(
 	return node.Content[idx], nil
 }
 
-// newPathNode returns the node to create for the missing path element
-// keys[i]: the value when it is the final path element, otherwise an empty
-// list when the next path element is a number and an empty map when not.
-func newPathNode(keys []string, i int, value string) *yaml.Node {
-	if i == len(keys)-1 {
-		return &yaml.Node{Kind: yaml.ScalarNode, Value: value}
-	}
-
-	_, err := strconv.Atoi(keys[i+1])
-	if err == nil {
-		return &yaml.Node{Kind: yaml.SequenceNode}
-	}
-
-	return &yaml.Node{Kind: yaml.MappingNode}
-}
-
 // setScalar overwrites a node in place with a plain scalar value.
 func setScalar(n *yaml.Node, value string) {
 	n.Kind = yaml.ScalarNode

internal/cli/config_test.go

@@ -58,15 +58,14 @@ func TestDefaultConfigTemplateParses(t *testing.T) {
 	}
 }
 
-// testRecipient is a valid age public key.
-const testRecipient = "age1278m9q7dp3chsh2dcy82qk27v047zywyvtxwnj4cvt0z65jw6a7q5dqhfj"
-
 // TestConfigSetRecipientOnFreshConfig follows the README quickstart: on the
 // file `config init` writes, `config set age_recipients.0` and
 // `config set storage_url` give a config that loads with that recipient.
 func TestConfigSetRecipientOnFreshConfig(t *testing.T) {
 	t.Parallel()
 
+	const recipient = "age1278m9q7dp3chsh2dcy82qk27v047zywyvtxwnj4cvt0z65jw6a7q5dqhfj"
+
 	path := filepath.Join(t.TempDir(), "config.yml")
 
 	err := os.WriteFile(path, []byte(defaultConfigTemplate), configFileMode)
@@ -76,7 +75,7 @@ func TestConfigSetRecipientOnFreshConfig(t *testing.T) {
 
 	out := ui.NewWithColor(&bytes.Buffer{}, false)
 
-	err = writeConfigSet(out, path, "age_recipients.0", testRecipient)
+	err = writeConfigSet(out, path, "age_recipients.0", recipient)
 	if err != nil {
 		t.Fatalf("config set age_recipients.0: %v", err)
 	}
@@ -91,111 +90,8 @@ func TestConfigSetRecipientOnFreshConfig(t *testing.T) {
 		t.Fatalf("config.Load: %v", err)
 	}
 
-	if len(cfg.AgeRecipients) != 1 || cfg.AgeRecipients[0] != testRecipient {
-		t.Errorf("age_recipients = %v, want [%s]", cfg.AgeRecipients, testRecipient)
-	}
-}
-
-// configWithoutRecipients loads, but has no age_recipients key and no
-// snapshot named work.
-const configWithoutRecipients = `storage_url: file:///mnt/backups
-snapshots:
-  home:
-    paths:
-      - "~"
-`
-
-// TestConfigSetIndexUnderMissingKey checks that a list index under a key
-// the file does not have creates a list, and that the result loads.
-func TestConfigSetIndexUnderMissingKey(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		key   string
-		value string
-		field func(cfg *config.Config) []string
-	}{
-		{"age_recipients.0", testRecipient,
-			func(cfg *config.Config) []string { return cfg.AgeRecipients }},
-		{"snapshots.work.paths.0", "/srv/work",
-			func(cfg *config.Config) []string { return cfg.Snapshots["work"].Paths }},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.key, func(t *testing.T) {
-			t.Parallel()
-
-			path := filepath.Join(t.TempDir(), "config.yml")
-
-			err := os.WriteFile(path, []byte(configWithoutRecipients), configFileMode)
-			if err != nil {
-				t.Fatalf("write config: %v", err)
-			}
-
-			err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
-				path, tt.key, tt.value)
-			if err != nil {
-				t.Fatalf("config set %s: %v", tt.key, err)
-			}
-
-			cfg, err := config.Load(path)
-			if err != nil {
-				t.Fatalf("config.Load: %v", err)
-			}
-
-			got := tt.field(cfg)
-			if len(got) != 1 || got[0] != tt.value {
-				t.Errorf("%s gives %v, want [%s]", tt.key, got, tt.value)
-			}
-		})
-	}
-}
-
-// TestConfigSetKeepsFileThatWouldNotLoad checks that config set refuses a
-// change after which the config would not load, and leaves the file as it
-// was.
-func TestConfigSetKeepsFileThatWouldNotLoad(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		key   string
-		value string
-	}{
-		// Index 1 of the empty list the missing key gives.
-		{"age_recipients.1", testRecipient},
-		// A list set to a single value.
-		{"snapshots.home.paths", "/srv"},
-		{"compression_level", "fast"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.key, func(t *testing.T) {
-			t.Parallel()
-
-			path := filepath.Join(t.TempDir(), "config.yml")
-
-			err := os.WriteFile(path, []byte(configWithoutRecipients), configFileMode)
-			if err != nil {
-				t.Fatalf("write config: %v", err)
-			}
-
-			err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
-				path, tt.key, tt.value)
-			if err == nil {
-				t.Errorf("config set %s %s succeeded, want an error",
-					tt.key, tt.value)
-			}
-
-			data, err := os.ReadFile(path) //nolint:gosec // G304: test-controlled path
-			if err != nil {
-				t.Fatalf("read config: %v", err)
-			}
-
-			if string(data) != configWithoutRecipients {
-				t.Errorf("config set %s changed the file to:\n%s",
-					tt.key, data)
-			}
-		})
+	if len(cfg.AgeRecipients) != 1 || cfg.AgeRecipients[0] != recipient {
+		t.Errorf("age_recipients = %v, want [%s]", cfg.AgeRecipients, recipient)
 	}
 }
 

internal/cli/database.go

@@ -15,12 +15,6 @@ func NewDatabaseCommand() *cobra.Command {
 		Use:   "database",
 		Short: "Manage the local state database",
 		Long:  `Commands for managing the local SQLite state database.`,
-		// cobra checks Args only on a command that has a Run: without
-		// one, a mistyped subcommand printed help and exited 0.
-		Args: cobra.NoArgs,
-		Run: func(cmd *cobra.Command, _ []string) {
-			_ = cmd.Help()
-		},
 	}
 
 	cmd.AddCommand(

internal/cli/entry_unknown_subcommand_test.go

@@ -1,43 +0,0 @@
-package cli //nolint:testpackage // shares runEntry and the command-word constants
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// TestEntryGroupRejectsUnknownSubcommand runs each group command with a
-// mistyped subcommand, as a crontab line might carry one. It must fail
-// with exit 1 and name the word, as `vaultik bogus` does at the top
-// level, instead of printing the group's help and exiting 0 having done
-// nothing. The group name alone still prints its help.
-//
-//nolint:paralleltest // replaces os.Args, os.Stdout and os.Stderr
-func TestEntryGroupRejectsUnknownSubcommand(t *testing.T) {
-	for _, testCase := range []struct {
-		group    string
-		mistyped string
-	}{
-		{group: cmdSnapshot, mistyped: "craete"},
-		{group: "config", mistyped: "inti"},
-		{group: cmdRemote, mistyped: "ifno"},
-		{group: "database", mistyped: "delte"},
-		{group: "completion", mistyped: "nosuchshell"},
-	} {
-		t.Run(testCase.group, func(t *testing.T) {
-			code, stdout, stderr := runEntry(t,
-				testCase.group, testCase.mistyped)
-
-			assert.Equal(t, 1, code)
-			assert.Empty(t, stdout)
-			assert.Contains(t, stderr,
-				`unknown command "`+testCase.mistyped+`"`)
-
-			code, stdout, _ = runEntry(t, testCase.group)
-
-			assert.Equal(t, 0, code)
-			assert.Contains(t, stdout,
-				programName+" "+testCase.group+" [command]")
-		})
-	}
-}

internal/cli/remote.go

@@ -18,12 +18,6 @@ func NewRemoteCommand() *cobra.Command {
 		Use:   "remote",
 		Short: "Remote storage management commands",
 		Long:  "Commands for inspecting and managing remote storage",
-		// cobra checks Args only on a command that has a Run: without
-		// one, a mistyped subcommand printed help and exited 0.
-		Args: cobra.NoArgs,
-		Run: func(cmd *cobra.Command, _ []string) {
-			_ = cmd.Help()
-		},
 	}
 
 	// Add subcommands

internal/cli/root.go

@@ -74,21 +74,6 @@ on the source system.`,
 		NewDatabaseCommand(),
 	)
 
-	// cobra adds the completion command only when Execute runs, and with
-	// no Run, so it skipped its own cobra.NoArgs and a mistyped shell name
-	// printed help and exited 0. Adding it here lets it have a Run. Its
-	// scripts go to os.Stdout as it is now: a later SetOut does not
-	// redirect them.
-	cmd.InitDefaultCompletionCmd()
-
-	for _, sub := range cmd.Commands() {
-		if sub.Name() == "completion" {
-			sub.Run = func(completion *cobra.Command, _ []string) {
-				_ = completion.Help()
-			}
-		}
-	}
-
 	return cmd
 }
 

internal/cli/snapshot.go

@@ -41,12 +41,6 @@ func NewSnapshotCommand() *cobra.Command {
 		Use:   "snapshot",
 		Short: "Snapshot management commands",
 		Long:  "Commands for creating, listing, and managing snapshots",
-		// cobra checks Args only on a command that has a Run: without
-		// one, a mistyped subcommand printed help and exited 0.
-		Args: cobra.NoArgs,
-		Run: func(cmd *cobra.Command, _ []string) {
-			_ = cmd.Help()
-		},
 	}
 
 	// Add subcommands

internal/snapshot/exclude_test.go

@@ -531,50 +531,3 @@ func TestExcludePatterns_UnanchoredPatternFile(t *testing.T) {
 	require.Equal(t, 1, result.FilesScanned,
 		"Unanchored pattern for file should match anywhere")
 }
-
-func TestExcludePatterns_DoubleStarDirectoryAtEveryDepth(t *testing.T) {
-	t.Parallel()
-
-	// As in gitignore, a leading **/ also matches directly under the source dir
-	fs := setupAnchoredTestFS(t)
-
-	scanner, repos, cleanup := createTestScanner(t, fs, []string{"**/projectname"})
-	defer cleanup()
-
-	ctx := context.Background()
-	createSnapshotRecord(ctx, t, repos, "test-snapshot")
-
-	result, err := scanner.Scan(ctx, "/backup", "test-snapshot")
-	require.NoError(t, err)
-
-	// **/projectname should exclude BOTH:
-	// - /backup/projectname/file.txt
-	// - /backup/otherproject/projectname/file.txt
-	// Total files: 4, excluded: 2
-	require.Equal(t, 2, result.FilesScanned,
-		"**/ directory pattern should match at the top level and nested")
-}
-
-func TestExcludePatterns_DoubleStarFileAtEveryDepth(t *testing.T) {
-	t.Parallel()
-
-	// As in gitignore, a leading **/ also matches directly under the source dir
-	fs := setupAnchoredTestFS(t)
-
-	scanner, repos, cleanup := createTestScanner(t, fs, []string{"**/*.txt"})
-	defer cleanup()
-
-	ctx := context.Background()
-	createSnapshotRecord(ctx, t, repos, "test-snapshot")
-
-	result, err := scanner.Scan(ctx, "/backup", "test-snapshot")
-	require.NoError(t, err)
-
-	// **/*.txt should exclude ALL .txt files:
-	// - /backup/file.txt
-	// - /backup/projectname/file.txt
-	// - /backup/otherproject/projectname/file.txt
-	// Total files: 4, excluded: 3
-	require.Equal(t, 1, result.FilesScanned,
-		"**/ file pattern should match at the top level and nested")
-}

internal/snapshot/scanner.go

@@ -2018,14 +2018,6 @@ func compileExcludePatterns(patterns []string) []compiledPattern {
 		// Remove trailing slash if present (directory indicator)
 		pattern = strings.TrimSuffix(pattern, "/")
 
-		// A leading "**/" demands a "/" before the name and so misses an
-		// entry directly under the source path. An unanchored pattern
-		// already matches at every depth, so drop the prefix: as in
-		// gitignore, "**/x" then also matches a top-level "x".
-		if !anchored {
-			pattern = strings.TrimPrefix(pattern, "**/")
-		}
-
 		// Compile the glob pattern
 		// For patterns without path separators, we need to match them as components
 		// e.g., ".git" should match ".git" anywhere in the path

internal/vaultik/blob_fetch.go

@@ -103,6 +103,8 @@ func (v *Vaultik) FetchAndDecryptBlob(
 }
 
 // FetchBlob downloads a blob and returns a reader for the encrypted data.
+// The reader is closed as soon as ctx is cancelled, which ends a read
+// blocked inside it.
 func (v *Vaultik) FetchBlob(
 	ctx context.Context, blobHash string,
 ) (io.ReadCloser, error) {
@@ -120,5 +122,47 @@ func (v *Vaultik) FetchBlob(
 		return nil, fmt.Errorf("downloading blob %s: %w", shortHash(blobHash), err)
 	}
 
-	return rc, nil
+	return newCloseOnCancelReader(ctx, rc), nil
+}
+
+// closeOnCancelReader closes the reader it wraps when ctx is cancelled.
+// Not every backend's reader stops on cancel by itself (the file
+// backend's does not), and a read stalled on a slow or hung source would
+// otherwise outlast the shutdown timeout, so the process would exit
+// before restore or deep verify removed its decrypted temporary files.
+type closeOnCancelReader struct {
+	io.ReadCloser
+
+	ctx  context.Context //nolint:containedctx // Read reports its error
+	stop func() bool
+}
+
+func newCloseOnCancelReader(
+	ctx context.Context, rc io.ReadCloser,
+) *closeOnCancelReader {
+	return &closeOnCancelReader{
+		ReadCloser: rc,
+		ctx:        ctx,
+		stop:       context.AfterFunc(ctx, func() { _ = rc.Close() }),
+	}
+}
+
+// Read returns the context's error, not the closed reader's, once ctx
+// has been cancelled.
+func (r *closeOnCancelReader) Read(p []byte) (int, error) {
+	n, err := r.ReadCloser.Read(p)
+	if err != nil && r.ctx.Err() != nil {
+		return n, r.ctx.Err()
+	}
+
+	return n, err
+}
+
+// Close closes the wrapped reader, unless the cancel already closed it.
+func (r *closeOnCancelReader) Close() error {
+	if !r.stop() {
+		return nil
+	}
+
+	return r.ReadCloser.Close()
 }

internal/vaultik/restore_interrupt_test.go

@@ -142,14 +142,14 @@ func TestRestoreCleansTempDirOnInterrupt(t *testing.T) {
 }
 
 // scratchEntries returns the vaultik blob-cache and snapshot-database
-// scratch entries currently present in dir.
+// scratch entries (restore's and deep verify's) currently present in dir.
 func scratchEntries(t *testing.T, dir string) []string {
 	t.Helper()
 
 	var matches []string
 
 	for _, pattern := range []string{
-		"vaultik-blobcache-*", "vaultik-restore-*",
+		"vaultik-blobcache-*", "vaultik-restore-*", "vaultik-verify-*",
 	} {
 		found, err := filepath.Glob(filepath.Join(dir, pattern))
 		require.NoError(t, err)
@@ -206,3 +206,119 @@ func TestRestoreSkipErrorsCancelDuringBlobDownload(t *testing.T) {
 	assert.NotContains(t, out.String(), srcPath,
 		"the cancel was reported as a failed file")
 }
+
+// stallingBlobStorer wraps a Storer so that every blob download hands
+// over the first half of the blob and then stalls, ignoring the context,
+// as a file:// blob on a hung USB stick or network share does. Only
+// closing the returned reader ends the stall.
+type stallingBlobStorer struct {
+	storage.Storer
+
+	once    sync.Once
+	stalled chan struct{}
+}
+
+func newStallingBlobStorer(inner storage.Storer) *stallingBlobStorer {
+	return &stallingBlobStorer{Storer: inner, stalled: make(chan struct{})}
+}
+
+func (s *stallingBlobStorer) Get(
+	ctx context.Context, key string,
+) (io.ReadCloser, error) {
+	rc, err := s.Storer.Get(ctx, key)
+	if err != nil || !strings.HasPrefix(key, "blobs/") {
+		return rc, err
+	}
+
+	blob, err := io.ReadAll(rc)
+	_ = rc.Close()
+
+	if err != nil {
+		return nil, err
+	}
+
+	// The writer is never closed, so once the first half has been read
+	// the next Read blocks until the reader is closed.
+	pr, pw := io.Pipe()
+
+	go func() {
+		_, _ = pw.Write(blob[:len(blob)/2])
+
+		s.once.Do(func() { close(s.stalled) })
+	}()
+
+	return pr, nil
+}
+
+// TestInterruptDuringStalledBlobReadCleansTempDir stops a restore and a
+// deep verify while a blob read is stalled on a source that ignores the
+// context. Stopping must end that read, so the operation unwinds and
+// removes its decrypted scratch files well within the shutdown timeout
+// (issue #325).
+//
+// Not parallel: it points TMPDIR at a private directory (via t.Setenv)
+// so it can assert on exactly the scratch files the operation created.
+func TestInterruptDuringStalledBlobReadCleansTempDir(t *testing.T) {
+	log.Initialize(log.Config{})
+
+	operations := map[string]func(v *Vaultik, snapshotID, targetDir string) error{
+		"restore": func(v *Vaultik, snapshotID, targetDir string) error {
+			return v.Restore(&RestoreOptions{
+				SnapshotID: snapshotID,
+				TargetDir:  targetDir,
+			})
+		},
+		"deep verify": func(v *Vaultik, snapshotID, _ string) error {
+			return v.RunDeepVerify(snapshotID, &VerifyOptions{Deep: true})
+		},
+	}
+
+	for name, op := range operations {
+		t.Run(name, func(t *testing.T) {
+			fs := afero.NewOsFs()
+			root := t.TempDir()
+
+			// Random content, so the blob stays large enough to stall
+			// part-way through its compressed, encrypted body.
+			cfg, storer, snapshotID, _ := backupOneFile(context.Background(),
+				t, fs, root, "a.bin", randomBytes(t, 256*1024), 0o644)
+
+			scratch := filepath.Join(root, "scratch")
+			require.NoError(t, fs.MkdirAll(scratch, 0o755))
+			t.Setenv("TMPDIR", scratch)
+
+			stalling := newStallingBlobStorer(storer)
+
+			ctx, cancel := context.WithCancel(context.Background())
+			defer cancel()
+
+			v := newRestoreVaultik(ctx, cfg, stalling, fs)
+			v.cancel = cancel
+
+			var opErr error
+
+			stop := v.StartOperation(func() {
+				opErr = op(v, snapshotID, filepath.Join(root, "restored"))
+			})
+
+			select {
+			case <-stalling.stalled:
+			case <-time.After(30 * time.Second):
+				t.Fatal("the operation never reached a blob read")
+			}
+
+			require.NotEmpty(t, scratchEntries(t, scratch),
+				"expected decrypted scratch files to exist mid-read")
+
+			stopCtx, stopCancel := context.WithTimeout(
+				context.Background(), 10*time.Second)
+			defer stopCancel()
+
+			require.True(t, stop(stopCtx),
+				"stop timed out; the stalled blob read was not interrupted")
+			require.ErrorIs(t, opErr, context.Canceled)
+			require.Empty(t, scratchEntries(t, scratch),
+				"decrypted scratch files remained after the interrupt")
+		})
+	}
+}