Stop snapshot purge when a snapshot cannot leave the local index (closes #337)

snapshot purge, and the purge step of snapshot create --prune, logged a
failed local index delete, then deleted that snapshot's metadata from
the destination store anyway and exited 0, leaving a local record whose
metadata was gone. It now stops at that snapshot with an error, before
touching its metadata, so the command exits non-zero; snapshots already
purged stay purged. This matches how the same loop already handles a
failed metadata delete.

Model: opus-5-5

README.md

@@ -271,17 +271,8 @@ existing file. Created with mode `0600` since it will contain credentials.
 **`config set`**: Set a scalar config value by dotted YAML path
 (e.g. `vaultik config set compression_level 9`,
 `vaultik config set storage_url "file:///mnt/backups"`). Comments and
-formatting in the file are preserved. Missing keys along the path are
-created: as a list when the next path element is a number (so
-`vaultik config set age_recipients.0 age1...` works on a file without
-`age_recipients`), otherwise as a map. If the config loads, a change
-after which it would not, such as `vaultik config set compression_level 99`,
-is refused and the file is left unchanged. A config that does not load,
-such as the one `config init` writes before `storage_url` is set or one
-with a `${ENV:...}` reference to a variable not set in this shell, is
-checked one setting at a time: only a change after which the changed
-setting cannot be read, such as one giving it the wrong type (a single
-value where a list belongs or a word where a number belongs), is refused.
+formatting in the file are preserved; intermediate maps are created as
+needed.
 
 **`snapshot create`**: Perform incremental backup of configured snapshots.
 * Optional snapshot names argument to create specific snapshots (default: all)
@@ -323,11 +314,7 @@ read from the manifest.
 
 Snapshots in the local index with no counterpart on the destination
 store are reported below the table as drift, with the `vaultik prune`
-invocation that reconciles them. If the local index is bound to a
-different destination than the configured one (after a change to
-`storage_url`, or `s3.endpoint`, `s3.bucket` or `s3.prefix`), the
-command says so instead and gives the same two ways out that `prune`
-gives: revert the configuration, or run `vaultik database delete`.
+invocation that reconciles them.
 
 If the destination store cannot be listed (unmounted volume,
 permission denied, network down), the command warns, falls back to the
@@ -336,11 +323,9 @@ local index alone, and still exits zero.
   (whether the snapshot is in the local index), `remote_key` (the full
   64-character storage key), and `remote_present` (whether it was seen
   on the destination store, or `null` if the destination could not be
-  listed). Warnings about an unlistable destination, a local index
-  bound to a different destination (with both destinations and the
-  same two ways out), unreadable manifests, and a truncated listing all
-  go to stderr through the logger, so stdout stays a single parseable
-  document.
+  listed). Warnings about an unlistable destination, unreadable
+  manifests, and a truncated listing all go to stderr through the
+  logger, so stdout stays a single parseable document.
 
 **`snapshot verify`**: Verify snapshot integrity.
 * Default (shallow): checks that every blob the manifest lists is present in
@@ -354,7 +339,9 @@ local index alone, and still exits zero.
 
 **`snapshot purge`**: Remove old snapshots based on criteria. Retention is
 per-snapshot-name (`--keep-latest` keeps the latest of each name, not the
-latest globally).
+latest globally). If a snapshot cannot be removed from the local index, the
+command stops there, leaves that snapshot's metadata on the destination store
+and exits non-zero; `snapshot create --prune` fails the same way.
 * `--keep-latest`: Keep only the most recent snapshot of each name
 * `--older-than <duration>`: Remove snapshots older than duration (e.g. `30d`,
   `4w`, `6mo`, `1y`; `m` is minutes, `mo` is months)
@@ -366,20 +353,16 @@ snapshot from the local index and strips the snapshot's metadata from
 the backup destination store. Blobs are NOT touched — deleting blobs
 requires reading every remaining remote manifest (the destination store
 may hold snapshots this host doesn't know about), which is what
-`vaultik prune` does. The command prints the `vaultik prune` invocation
-to run as a follow-up only when it removed the snapshot's metadata from
-the destination store, and never under `--json`. An ID that names no
-snapshot in the local index or on the destination store is an error;
-with `--local-only`, the snapshot must be in the local index. Local row
+`vaultik prune` does. On success the command prints the exact `vaultik
+prune` invocation to run as a follow-up. An ID that names no snapshot in
+the local index or on the destination store is an error; with
+`--local-only`, the snapshot must be in the local index. Local row
 cleanup (files, chunks, blobs the snapshot was the last referrer for)
-runs automatically. If removing the snapshot's metadata from the
-destination store fails (for example because the store is unreachable),
-the local-DB removal still completes and a warning is emitted; run
-`vaultik snapshot remove <snapshot-id>` again once the store is reachable
-to remove the snapshot's metadata from it (`vaultik prune` does not). For
-a snapshot that is only on the destination store, that failure is an
-error. To wipe everything on the destination in one go, use `vaultik
-remote nuke --force`.
+runs automatically. If the destination store is unreachable, the local-DB
+removal still completes and a warning is emitted; run `vaultik snapshot
+remove <snapshot-id>` again once the store is reachable to remove the
+snapshot's metadata from it (`vaultik prune` does not). To wipe everything
+on the destination in one go, use `vaultik remote nuke --force`.
 * `--local-only`: Skip remote cleanup; only touch the local index
 * `--dry-run`: Show what would be deleted without deleting
 * `--force`: Skip confirmation prompt
@@ -392,9 +375,7 @@ remote nuke --force`.
   store — its remote key (or an unambiguous leading part of it) as shown
   by `snapshot list`. See
   [restoring on another machine](#restoring-on-another-machine).
-* Optional path arguments to restore specific files/directories (default: all).
-  A path that matches nothing in the snapshot is named in a warning, and the
-  command exits non-zero after restoring the paths that match.
+* Optional path arguments to restore specific files/directories (default: all)
 * Preserves file permissions, timestamps, ownership (ownership requires root),
   symlinks, and empty directories
 * `--verify`: After restoring, verify every restored file's chunk hashes
@@ -434,12 +415,11 @@ under `blobs/` whose name is not a blob hash is not counted as a blob,
 since `prune` never deletes it.
 * `--json`: Output as JSON
 
-**`remote nuke`**: Delete every object under `metadata/` and `blobs/` on
-the backup destination store, whatever its name, leaving the bucket prefix
-empty. Destructive and irreversible. This is the single supported way to
-wipe the entire destination store. If a listing afterwards still finds
-anything there, the command names each object left and exits non-zero;
-running it again deletes what is left.
+**`remote nuke`**: Delete every snapshot's metadata and every blob from the
+backup destination store, leaving the bucket prefix empty. Destructive and
+irreversible. This is the single supported way to wipe the entire
+destination store. If anything cannot be deleted, the command exits
+non-zero; running it again deletes what is left.
 * `--force`: Required to confirm destruction.
 
 **`database delete`**: Delete the local SQLite state database file
@@ -722,10 +702,8 @@ the `NO_COLOR` environment variable is unset (https://no-color.org/).
   reports and tables (`version`, `info`, `remote info`, `snapshot
   verify`, `snapshot list`) but never the machine-consumed `config get`
   value or the `--json` documents, which a script depends on. The
-  confirmation prompts of `database delete`, `prune`, `snapshot purge`
-  and `snapshot remove`, each with what it asks to delete, are also
-  written this way and always shown: they are an interactive exchange
-  the operator must see.
+  `database delete` confirmation prompt is also written this way and
+  always shown: it is an interactive exchange the operator must see.
 
 `internal/ui` writes to stdout; it is the output the user asked for. The
 exceptions are the startup banner and the error a failed command ends

config.example.yml

@@ -302,8 +302,7 @@ storage_url: "rclone://myremote/path/to/backups"
 
 # Average chunk size for content-defined chunking
 # Smaller chunks = better deduplication but more metadata
-# Minimum 1MB
-# Supports: 10MB, 5M, 1GB, 64MiB, etc.
+# Supports: 10MB, 5M, 1GB, 500KB, 64MiB, etc.
 # Default: 10MB
 #chunk_size: 10MB
 

go.mod

@@ -22,7 +22,6 @@ require (
 	github.com/spf13/cobra v1.10.1
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
-	go.uber.org/dig v1.19.0
 	go.uber.org/fx v1.24.0
 	golang.org/x/sync v0.18.0
 	golang.org/x/sys v0.38.0
@@ -257,6 +256,7 @@ require (
 	go.opentelemetry.io/otel/metric v1.38.0 // indirect
 	go.opentelemetry.io/otel/trace v1.38.0 // indirect
 	go.shabbyrobe.org/gocovmerge v0.0.0-20230507111327-fa4f82cfbf4d // indirect
+	go.uber.org/dig v1.19.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect

internal/cli/app.go

@@ -8,12 +8,12 @@ import (
 	"errors"
 	"fmt"
 	"path/filepath"
+	"strings"
 	"sync"
 	"time"
 
 	"github.com/adrg/xdg"
 	"github.com/spf13/cobra"
-	"go.uber.org/dig"
 	"go.uber.org/fx"
 	"sneak.berlin/go/vaultik/internal/config"
 	"sneak.berlin/go/vaultik/internal/database"
@@ -146,12 +146,16 @@ func (e *startupError) Error() string {
 //	could not build arguments for function "Y" (file:line): failed to build U:
 //	received non-nil error from function "Z" (file:line): <real error>
 //
-// Users care about the real error, not the DI plumbing. dig.RootCause,
-// from the library fx is built on, unwraps those layers and returns the
-// real error whole. Cutting the text at "): " instead would also cut a
-// real error that contains it, such as the blob_size_limit one.
+// Users care about the real error, not the DI plumbing. We strip everything
+// up through the last "): " (which is always the close-paren of an fx
+// function-location annotation followed by the wrapped error).
 func cleanStartupError(err error) error {
-	return &startupError{msg: dig.RootCause(err).Error()}
+	msg := err.Error()
+	if idx := strings.LastIndex(msg, "): "); idx >= 0 {
+		msg = msg[idx+3:]
+	}
+
+	return &startupError{msg: msg}
 }
 
 // RunApp starts the fx application, blocks until it is asked to stop, and

internal/cli/app_test.go

@@ -2,65 +2,58 @@ package cli //nolint:testpackage // needs access to unexported cleanStartupError
 
 import (
 	"errors"
-	"os"
 	"path/filepath"
 	"testing"
 
-	"go.uber.org/fx"
-	"sneak.berlin/go/vaultik/internal/config"
 	"sneak.berlin/go/vaultik/internal/pidlock"
 )
 
-// TestCleanStartupError starts a real fx app whose config has a
-// blob_size_limit below the minimum. fx puts annotations naming the
-// functions it was building in front of the config error; only those
-// may be removed, although the config error itself contains "): ".
 func TestCleanStartupError(t *testing.T) {
 	t.Parallel()
 
-	path := filepath.Join(t.TempDir(), "config.yml")
-
-	err := os.WriteFile(path, []byte("snapshots:\n"+
-		"  test:\n"+
-		"    paths: [/tmp/vaultik-test-source]\n"+
-		"storage_url: file:///tmp/vaultik-test-storage\n"+
-		"chunk_size: 10MB\n"+
-		"blob_size_limit: 30MB\n"), 0o600)
-	if err != nil {
-		t.Fatalf("write config: %v", err)
+	tests := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{
+			name: "real fx error chain",
+			in: `could not build arguments for function ` +
+				`"sneak.berlin/go/vaultik/internal/cli".newSnapshotCreateCommand.func1.1 ` +
+				`(/Users/user/dev/vaultik/internal/cli/snapshot.go:71): ` +
+				`failed to build *vaultik.Vaultik: ` +
+				`could not build arguments for function ` +
+				`"sneak.berlin/go/vaultik/internal/vaultik".New ` +
+				`(/Users/user/dev/vaultik/internal/vaultik/vaultik.go:59): ` +
+				`failed to build storage.Storer: ` +
+				`received non-nil error from function ` +
+				`"sneak.berlin/go/vaultik/internal/storage".NewStorer ` +
+				`(/Users/user/dev/vaultik/internal/storage/module.go:23): ` +
+				`creating base path: mkdir /Volumes/BACKUPS: permission denied`,
+			want: `creating base path: mkdir /Volumes/BACKUPS: permission denied`,
+		},
+		{
+			name: "no fx wrapping",
+			in:   "plain error",
+			want: "plain error",
+		},
+		{
+			name: "single fx wrapping",
+			in:   `received non-nil error from function "foo" (file.go:1): underlying problem`,
+			want: "underlying problem",
+		},
 	}
 
-	app := fx.New(
-		fx.NopLogger,
-		fx.Supply(config.Path(path)),
-		config.Module,
-		fx.Invoke(func(*config.Config) {}),
-	)
-
-	err = app.Start(t.Context())
-	if err == nil {
-		t.Fatal("app started; want a blob_size_limit error")
-	}
-
-	want := "failed to load config: invalid config: blob_size_limit must " +
-		"be at least the largest chunk the chunker can emit (chunk_size " +
-		"times the FastCDC size spread): need at least 40000000 bytes"
-
-	got := cleanStartupError(err).Error()
-	if got != want {
-		t.Errorf("got %q, want %q", got, want)
-	}
-}
-
-// TestCleanStartupErrorNotFromFx checks that an error fx did not wrap is
-// shown unchanged.
-func TestCleanStartupErrorNotFromFx(t *testing.T) {
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-	//nolint:err113 // a one-off error standing in for a startup failure
-	got := cleanStartupError(errors.New("plain error")).Error()
-	if got != "plain error" {
-		t.Errorf("got %q, want %q", got, "plain error")
+			//nolint:err113 // test constructs errors from table input
+			got := cleanStartupError(errors.New(tt.in)).Error()
+			if got != tt.want {
+				t.Errorf("got %q, want %q", got, tt.want)
+			}
+		})
 	}
 }
 

internal/cli/config.go

@@ -8,7 +8,6 @@ import (
 	"os/exec"
 	"path/filepath"
 	"reflect"
-	"slices"
 	"strconv"
 	"strings"
 	"unicode/utf8"
@@ -45,9 +44,6 @@ var (
 	errNeedNumericIndex = errors.New("key is a list; use a numeric index")
 	errIndexOutOfRange  = errors.New("index out of range")
 	errNotMapOrList     = errors.New("key is not a map or list")
-	errWouldNotLoad     = errors.New(
-		"vaultik would not load the config after this change, " +
-			"so the file was not changed")
 )
 
 const defaultConfigTemplate = `# vaultik configuration
@@ -224,7 +220,7 @@ storage_url: ""
 
 # Average chunk size for content-defined chunking (FastCDC).
 # Smaller = better deduplication but more metadata overhead.
-# Minimum 1MB. Accepts: 1MB, 10M, 64MiB, etc.
+# Accepts: 1MB, 10M, 64KB, etc.
 # Default: 10MB
 # chunk_size: 10MB
 
@@ -333,15 +329,8 @@ func newConfigEditCommand() *cobra.Command {
 				editor = "vi"
 			}
 
-			// Run $EDITOR through the shell, as git does, so a value
-			// with arguments such as "code --wait" works. The path
-			// goes in as an argument ("$@"), not into the command
-			// text, so a path with spaces or quotes arrives whole.
-			// sh -c takes the word after the command as $0, which
-			// is why editor appears twice.
 			//nolint:gosec // G204: launching the operator's own $EDITOR is the point
-			ed := exec.CommandContext(cmd.Context(),
-				"sh", "-c", editor+` "$@"`, editor, path)
+			ed := exec.CommandContext(cmd.Context(), editor, path)
 			ed.Stdin = os.Stdin
 			ed.Stdout = os.Stdout
 			ed.Stderr = os.Stderr
@@ -402,17 +391,8 @@ func newConfigSetCommand() *cobra.Command {
 		Use:   "set <key> <value>",
 		Short: "Set a config value by dotted path (e.g. compression_level 5)",
 		Long: `Sets a scalar config value addressed by dotted YAML path and writes
-the file back, preserving comments and formatting. Missing keys along
-the path are created: as a list when the next path element is a
-number, otherwise as a map.
-
-If the config loads, a change after which it would not, such as
-compression_level 99, is refused and the file is left unchanged. A
-config that does not load, such as the one config init writes before
-storage_url is set or one with a ${ENV:...} reference to a variable
-not set here, is checked one setting at a time: only a change after
-which the changed setting cannot be read, such as one giving it the
-wrong type, is refused.
+the file back, preserving comments and formatting. Intermediate maps
+are created as needed.
 
 Examples:
   vaultik config set storage_url "file:///mnt/backups"
@@ -442,14 +422,7 @@ func writeConfigSet(out *ui.Writer, path, key, value string) error {
 		return err
 	}
 
-	oldData, err := marshalConfigYAML(root)
-	if err != nil {
-		return fmt.Errorf("marshaling config: %w", err)
-	}
-
-	keys := strings.Split(key, ".")
-
-	err = yamlPathSet(root, keys, value)
+	err = yamlPathSet(root, strings.Split(key, "."), value)
 	if err != nil {
 		return err
 	}
@@ -459,21 +432,6 @@ func writeConfigSet(out *ui.Writer, path, key, value string) error {
 		return fmt.Errorf("marshaling config: %w", err)
 	}
 
-	setting, err := yamlPathOnly(root, keys)
-	if err != nil {
-		return err
-	}
-
-	settingData, err := marshalConfigYAML(setting)
-	if err != nil {
-		return fmt.Errorf("marshaling config: %w", err)
-	}
-
-	err = checkConfigChange(oldData, data, settingData)
-	if err != nil {
-		return fmt.Errorf("%w: %w", errWouldNotLoad, err)
-	}
-
 	err = os.WriteFile(path, data, configFileMode)
 	if err != nil {
 		return fmt.Errorf("writing config file: %w", err)
@@ -495,58 +453,6 @@ func writeConfigSet(out *ui.Writer, path, key, value string) error {
 	return nil
 }
 
-// checkConfigChange returns the reason vaultik would not load newData, the
-// config after a change, if the change brings that failure in. If oldData,
-// the config before it, loads, the new one must load too. A config that
-// does not load, such as one still being filled in or one with a ${...}
-// reference that cannot be filled in here, is checked one setting at a
-// time: settingData, the changed setting on its own, must decode into the
-// config type.
-func checkConfigChange(oldData, newData, settingData []byte) error {
-	oldCfg, err := config.Parse(oldData)
-	if err == nil && oldCfg.Validate() == nil {
-		newCfg, err := config.Parse(newData)
-		if err != nil {
-			return err
-		}
-
-		return newCfg.Validate()
-	}
-
-	_, err = config.Parse(settingData)
-
-	return err
-}
-
-// yamlPathOnly returns a document holding only the value at the dotted key
-// path in root, inside the maps and lists that lead to it there.
-func yamlPathOnly(root *yaml.Node, keys []string) (*yaml.Node, error) {
-	node, err := yamlPathGet(root, keys)
-	if err != nil {
-		return nil, err
-	}
-
-	for i, key := range slices.Backward(keys) {
-		parent, err := yamlPathGet(root, keys[:i])
-		if err != nil {
-			return nil, err
-		}
-
-		if parent.Kind == yaml.SequenceNode {
-			node = &yaml.Node{
-				Kind: yaml.SequenceNode, Content: []*yaml.Node{node},
-			}
-		} else {
-			keyNode := &yaml.Node{Kind: yaml.ScalarNode, Value: key}
-			node = &yaml.Node{
-				Kind: yaml.MappingNode, Content: []*yaml.Node{keyNode, node},
-			}
-		}
-	}
-
-	return &yaml.Node{Kind: yaml.DocumentNode, Content: []*yaml.Node{node}}, nil
-}
-
 // marshalConfigYAML renders a config document tree with 2-space indentation,
 // matching defaultConfigTemplate. yaml.Marshal defaults to 4 spaces, which
 // would reindent the whole file on the first `config set` despite the promise
@@ -653,8 +559,8 @@ func yamlPathGet(root *yaml.Node, keys []string) (*yaml.Node, error) {
 	return node, nil
 }
 
-// yamlPathSet navigates a dotted key path, creating missing keys as needed,
-// and sets the final key to the given scalar value. Numeric path
+// yamlPathSet navigates a dotted key path, creating intermediate maps as
+// needed, and sets the final key to the given scalar value. Numeric path
 // components index into sequences; an index equal to the sequence length
 // appends a new element (e.g. "age_recipients.1" on a 1-element list).
 func yamlPathSet(root *yaml.Node, keys []string, value string) error {
@@ -667,12 +573,12 @@ func yamlPathSet(root *yaml.Node, keys []string, value string) error {
 		node = node.Content[0]
 	}
 
-	for i := range keys {
+	for i, key := range keys {
 		last := i == len(keys)-1
 
 		switch node.Kind {
 		case yaml.MappingNode:
-			node = yamlSetInMapping(node, keys, i, value, last)
+			node = yamlSetInMapping(node, key, value, last)
 		case yaml.SequenceNode:
 			next, err := yamlSetInSequence(node, keys, i, value, last)
 			if err != nil {
@@ -741,16 +647,14 @@ func yamlField(typ reflect.Type, key string) (reflect.StructField, bool) {
 	return reflect.StructField{}, false
 }
 
-// yamlSetInMapping resolves (creating if needed) the value node for the
-// path element keys[i] within a mapping node, setting it to value when it
-// is the final path element, and returns the node to descend into.
-func yamlSetInMapping(
-	node *yaml.Node, keys []string, i int, value string, last bool,
-) *yaml.Node {
+// yamlSetInMapping resolves (creating if needed) the value node for key
+// within a mapping node, setting it to value when it is the final path
+// element, and returns the node to descend into.
+func yamlSetInMapping(node *yaml.Node, key, value string, last bool) *yaml.Node {
 	var valueNode *yaml.Node
 
 	for j := 0; j+1 < len(node.Content); j += 2 {
-		if node.Content[j].Value == keys[i] {
+		if node.Content[j].Value == key {
 			valueNode = node.Content[j+1]
 
 			break
@@ -758,8 +662,13 @@ func yamlSetInMapping(
 	}
 
 	if valueNode == nil {
-		keyNode := &yaml.Node{Kind: yaml.ScalarNode, Value: keys[i]}
-		valueNode = newPathNode(keys, i, value)
+		keyNode := &yaml.Node{Kind: yaml.ScalarNode, Value: key}
+
+		valueNode = &yaml.Node{Kind: yaml.MappingNode}
+		if last {
+			valueNode = &yaml.Node{Kind: yaml.ScalarNode, Value: value}
+		}
+
 		node.Content = append(node.Content, keyNode, valueNode)
 	} else if last {
 		setScalar(valueNode, value)
@@ -787,7 +696,12 @@ func yamlSetInSequence(
 	}
 
 	if idx == len(node.Content) {
-		node.Content = append(node.Content, newPathNode(keys, i, value))
+		newNode := &yaml.Node{Kind: yaml.MappingNode}
+		if last {
+			newNode = &yaml.Node{Kind: yaml.ScalarNode, Value: value}
+		}
+
+		node.Content = append(node.Content, newNode)
 	} else if last {
 		setScalar(node.Content[idx], value)
 	}
@@ -795,22 +709,6 @@ func yamlSetInSequence(
 	return node.Content[idx], nil
 }
 
-// newPathNode returns the node to create for the missing path element
-// keys[i]: the value when it is the final path element, otherwise an empty
-// list when the next path element is a number and an empty map when not.
-func newPathNode(keys []string, i int, value string) *yaml.Node {
-	if i == len(keys)-1 {
-		return &yaml.Node{Kind: yaml.ScalarNode, Value: value}
-	}
-
-	_, err := strconv.Atoi(keys[i+1])
-	if err == nil {
-		return &yaml.Node{Kind: yaml.SequenceNode}
-	}
-
-	return &yaml.Node{Kind: yaml.MappingNode}
-}
-
 // setScalar overwrites a node in place with a plain scalar value.
 func setScalar(n *yaml.Node, value string) {
 	n.Kind = yaml.ScalarNode

internal/cli/config_test.go

@@ -58,17 +58,14 @@ func TestDefaultConfigTemplateParses(t *testing.T) {
 	}
 }
 
-// testRecipient is a valid age public key.
-const testRecipient = "age1278m9q7dp3chsh2dcy82qk27v047zywyvtxwnj4cvt0z65jw6a7q5dqhfj"
-
 // TestConfigSetRecipientOnFreshConfig follows the README quickstart: on the
 // file `config init` writes, `config set age_recipients.0` and
 // `config set storage_url` give a config that loads with that recipient.
-// Neither is refused, although the config does not load until both are set;
-// once it loads, a recipient that is not a valid key is.
 func TestConfigSetRecipientOnFreshConfig(t *testing.T) {
 	t.Parallel()
 
+	const recipient = "age1278m9q7dp3chsh2dcy82qk27v047zywyvtxwnj4cvt0z65jw6a7q5dqhfj"
+
 	path := filepath.Join(t.TempDir(), "config.yml")
 
 	err := os.WriteFile(path, []byte(defaultConfigTemplate), configFileMode)
@@ -78,7 +75,7 @@ func TestConfigSetRecipientOnFreshConfig(t *testing.T) {
 
 	out := ui.NewWithColor(&bytes.Buffer{}, false)
 
-	err = writeConfigSet(out, path, "age_recipients.0", testRecipient)
+	err = writeConfigSet(out, path, "age_recipients.0", recipient)
 	if err != nil {
 		t.Fatalf("config set age_recipients.0: %v", err)
 	}
@@ -93,211 +90,8 @@ func TestConfigSetRecipientOnFreshConfig(t *testing.T) {
 		t.Fatalf("config.Load: %v", err)
 	}
 
-	if len(cfg.AgeRecipients) != 1 || cfg.AgeRecipients[0] != testRecipient {
-		t.Errorf("age_recipients = %v, want [%s]", cfg.AgeRecipients, testRecipient)
-	}
-
-	err = writeConfigSet(out, path, "age_recipients.0", "notakey")
-	if err == nil || !strings.Contains(err.Error(), "not a valid recipient") {
-		t.Errorf("config set age_recipients.0 notakey gives error %v, "+
-			"want one saying it is not a valid recipient", err)
-	}
-
-	_, err = config.Load(path)
-	if err != nil {
-		t.Errorf("config.Load after the refused change: %v", err)
-	}
-}
-
-// configWithoutRecipients loads, but has no age_recipients key and no
-// snapshot named work.
-const configWithoutRecipients = `storage_url: file:///mnt/backups
-snapshots:
-  home:
-    paths:
-      - "~"
-`
-
-// configWithUnsetReference loads only where VAULTIK_TEST_UNSET_SECRET is
-// set, as a backup job's environment might set it. No test sets it.
-const configWithUnsetReference = configWithoutRecipients + `s3:
-  secret_access_key: ${ENV:VAULTIK_TEST_UNSET_SECRET}
-`
-
-// configWithLevelReference returns configWithoutRecipients with a ${FILE:...}
-// reference on compression_level to a file holding 9, so that the config
-// loads once the reference is filled in.
-func configWithLevelReference(t *testing.T) string {
-	t.Helper()
-
-	levelPath := filepath.Join(t.TempDir(), "level")
-
-	err := os.WriteFile(levelPath, []byte("9"), configFileMode)
-	if err != nil {
-		t.Fatalf("write level: %v", err)
-	}
-
-	return configWithoutRecipients +
-		"compression_level: ${FILE:" + levelPath + "}\n"
-}
-
-// TestConfigSetIndexUnderMissingKey checks that a list index under a key
-// the file does not have creates a list, and that the result loads.
-func TestConfigSetIndexUnderMissingKey(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		key   string
-		value string
-		field func(cfg *config.Config) []string
-	}{
-		{"age_recipients.0", testRecipient,
-			func(cfg *config.Config) []string { return cfg.AgeRecipients }},
-		{"snapshots.work.paths.0", "/srv/work",
-			func(cfg *config.Config) []string { return cfg.Snapshots["work"].Paths }},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.key, func(t *testing.T) {
-			t.Parallel()
-
-			path := filepath.Join(t.TempDir(), "config.yml")
-
-			err := os.WriteFile(path, []byte(configWithoutRecipients), configFileMode)
-			if err != nil {
-				t.Fatalf("write config: %v", err)
-			}
-
-			err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
-				path, tt.key, tt.value)
-			if err != nil {
-				t.Fatalf("config set %s: %v", tt.key, err)
-			}
-
-			cfg, err := config.Load(path)
-			if err != nil {
-				t.Fatalf("config.Load: %v", err)
-			}
-
-			got := tt.field(cfg)
-			if len(got) != 1 || got[0] != tt.value {
-				t.Errorf("%s gives %v, want [%s]", tt.key, got, tt.value)
-			}
-		})
-	}
-}
-
-// TestConfigSetKeepsFileThatWouldNotLoad checks that config set refuses a
-// change after which the config would not load, with an error giving the
-// reason, and leaves the file as it was. On the file `config init` writes,
-// which does not load until storage_url is set, and on one that cannot be
-// read here, only a value of the wrong type is refused.
-func TestConfigSetKeepsFileThatWouldNotLoad(t *testing.T) {
-	t.Parallel()
-
-	levelReference := configWithLevelReference(t)
-
-	tests := []struct {
-		config string
-		key    string
-		value  string
-		reason string
-	}{
-		// Index 1 of the empty list the missing key gives.
-		{configWithoutRecipients, "age_recipients.1", testRecipient,
-			"index out of range"},
-		// A list set to a single value.
-		{configWithoutRecipients, "snapshots.home.paths", "/srv",
-			"into []string"},
-		{configWithoutRecipients, "chunk_size", "fast",
-			"invalid size format"},
-		// Values of the right type that fail validation.
-		{configWithoutRecipients, "compression_level", "99",
-			"compression_level must be between 1 and 19"},
-		{configWithoutRecipients, "chunk_size", "1KB",
-			"chunk_size must be at least 1MB"},
-		// With its reference filled in, the config loads.
-		{levelReference, "blob_size_limit", "1MB",
-			"blob_size_limit must be at least"},
-		// The type check on a config that does not load yet.
-		{defaultConfigTemplate, "snapshots.apps.paths", "/srv",
-			"into []string"},
-		// The type check on a config that cannot be read here.
-		{configWithUnsetReference, "snapshots.home.paths", "/x",
-			"cannot unmarshal !!str `/x`"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.key+" "+tt.value, func(t *testing.T) {
-			t.Parallel()
-
-			path := filepath.Join(t.TempDir(), "config.yml")
-
-			err := os.WriteFile(path, []byte(tt.config), configFileMode)
-			if err != nil {
-				t.Fatalf("write config: %v", err)
-			}
-
-			err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
-				path, tt.key, tt.value)
-			if err == nil || !strings.Contains(err.Error(), tt.reason) {
-				t.Errorf("config set %s %s gives error %v, want one saying %q",
-					tt.key, tt.value, err, tt.reason)
-			}
-
-			data, err := os.ReadFile(path) //nolint:gosec // G304: test-controlled path
-			if err != nil {
-				t.Fatalf("read config: %v", err)
-			}
-
-			if string(data) != tt.config {
-				t.Errorf("config set %s changed the file to:\n%s",
-					tt.key, data)
-			}
-		})
-	}
-}
-
-// TestConfigSetRefusesOnlyItsOwnFailure checks that setting another key
-// works on a config with a ${...} reference on compression_level, which
-// loads because loading fills the reference in, on one whose
-// compression_level already fails to load, and on one with a reference
-// that cannot be filled in here.
-func TestConfigSetRefusesOnlyItsOwnFailure(t *testing.T) {
-	t.Parallel()
-
-	configs := map[string]string{
-		"reference":       configWithLevelReference(t),
-		"failing":         configWithoutRecipients + "compression_level: fast\n",
-		"unset reference": configWithUnsetReference,
-	}
-
-	for name, configYAML := range configs {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			path := filepath.Join(t.TempDir(), "config.yml")
-
-			err := os.WriteFile(path, []byte(configYAML), configFileMode)
-			if err != nil {
-				t.Fatalf("write config: %v", err)
-			}
-
-			err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
-				path, "hostname", "myhost")
-			if err != nil {
-				t.Fatalf("config set hostname: %v", err)
-			}
-
-			data, err := os.ReadFile(path) //nolint:gosec // G304: test-controlled path
-			if err != nil {
-				t.Fatalf("read config: %v", err)
-			}
-
-			if !strings.Contains(string(data), "hostname: myhost") {
-				t.Errorf("config set hostname wrote:\n%s", data)
-			}
-		})
+	if len(cfg.AgeRecipients) != 1 || cfg.AgeRecipients[0] != recipient {
+		t.Errorf("age_recipients = %v, want [%s]", cfg.AgeRecipients, recipient)
 	}
 }
 
@@ -647,30 +441,6 @@ func TestWriteConfigSetTightensMode(t *testing.T) {
 	}
 }
 
-// TestConfigEditEditorWithArgument checks that an $EDITOR carrying an
-// argument works and that a config path with a space reaches it whole.
-// The "editor" is cp with the replacement file as its argument, so the
-// config ends up with the replacement's content only if both arrived.
-func TestConfigEditEditorWithArgument(t *testing.T) {
-	dir := t.TempDir()
-	path := seedFile(t, dir, "my config.yml", "compression_level: 3\n")
-	edited := seedFile(t, dir, "edited.yml", "compression_level: 9\n")
-
-	setRootFlags(t, RootFlags{ConfigPath: path})
-	t.Setenv("EDITOR", "cp '"+edited+"'")
-
-	mustExecute(t, newConfigEditCommand())
-
-	data, err := os.ReadFile(path) //nolint:gosec // G304: test-controlled path
-	if err != nil {
-		t.Fatalf("reading config back: %v", err)
-	}
-
-	if string(data) != "compression_level: 9\n" {
-		t.Errorf("config after edit = %q, want the edited content", data)
-	}
-}
-
 func splitPath(s string) []string {
 	return strings.Split(s, ".")
 }

internal/cli/entry_prune_quiet_test.go

@@ -1,123 +0,0 @@
-package cli //nolint:testpackage // shares runEntry and the hermetic config helpers
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// flagCron is used to build the argument vectors below.
-const flagCron = "--cron"
-
-// plantUnreferencedBlob writes a blob that no snapshot references to the
-// destination store at storeDir, so that a prune deletes it. Returns its
-// path.
-func plantUnreferencedBlob(t *testing.T, storeDir string) string {
-	t.Helper()
-
-	hash := strings.Repeat("b", 64)
-	path := filepath.Join(storeDir, "blobs", hash[:2], hash[2:4], hash)
-
-	require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o750))
-	require.NoError(t, os.WriteFile(path, []byte("unreferenced"), 0o600))
-
-	return path
-}
-
-// TestEntrySnapshotCreatePruneIsSilent checks that a successful
-// `snapshot create --prune` under --cron or --quiet prints nothing on
-// stdout or stderr, whether or not the prune finds a blob to delete.
-//
-//nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
-func TestEntrySnapshotCreatePruneIsSilent(t *testing.T) {
-	for _, testCase := range []struct {
-		name      string
-		args      []string
-		plantBlob bool
-	}{
-		{
-			name: "cron, no blob to delete",
-			args: []string{cmdSnapshot, cmdCreate, flagCron, flagPrune},
-		},
-		{
-			name:      "cron, blob to delete",
-			args:      []string{cmdSnapshot, cmdCreate, flagCron, flagPrune},
-			plantBlob: true,
-		},
-		{
-			name: "cron with keep-newer-than",
-			args: []string{
-				cmdSnapshot, cmdCreate, flagCron, flagPrune,
-				flagKeepNewerThan, "4w",
-			},
-			plantBlob: true,
-		},
-		{
-			name:      "quiet",
-			args:      []string{flagQuiet, cmdSnapshot, cmdCreate, flagPrune},
-			plantBlob: true,
-		},
-	} {
-		t.Run(testCase.name, func(t *testing.T) {
-			configPath, storeDir := writeBackupConfig(t)
-
-			var blob string
-			if testCase.plantBlob {
-				blob = plantUnreferencedBlob(t, storeDir)
-			}
-
-			code, stdout, stderr := runEntry(t,
-				append([]string{flagConfig, configPath}, testCase.args...)...)
-
-			assert.Equal(t, 0, code)
-			assert.Empty(t, stdout)
-			assert.Empty(t, stderr)
-
-			if testCase.plantBlob {
-				assert.NoFileExists(t, blob, "the prune must delete the blob")
-			}
-		})
-	}
-}
-
-// TestEntryPruneQuietIsSilent checks that a successful `prune --force`
-// under --quiet prints nothing on stdout or stderr, both when there is
-// nothing to remove and when it removes a stale local snapshot record
-// and an unreferenced blob.
-//
-//nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
-func TestEntryPruneQuietIsSilent(t *testing.T) {
-	for _, testCase := range []struct {
-		name               string
-		staleRecordAndBlob bool
-	}{
-		{name: "nothing to remove"},
-		{name: "stale record and blob to remove", staleRecordAndBlob: true},
-	} {
-		t.Run(testCase.name, func(t *testing.T) {
-			configPath := writeHermeticPruneConfig(t, testCase.staleRecordAndBlob)
-
-			var blob string
-			if testCase.staleRecordAndBlob {
-				// writeHermeticPruneConfig puts the store beside the config.
-				blob = plantUnreferencedBlob(t,
-					filepath.Join(filepath.Dir(configPath), "store"))
-			}
-
-			code, stdout, stderr := runEntry(t,
-				flagConfig, configPath, flagQuiet, cmdPrune, flagForce)
-
-			assert.Equal(t, 0, code)
-			assert.Empty(t, stdout)
-			assert.Empty(t, stderr)
-
-			if testCase.staleRecordAndBlob {
-				assert.NoFileExists(t, blob, "the prune must delete the blob")
-			}
-		})
-	}
-}

internal/cli/entry_snapshot_purge_test.go

@@ -2,67 +2,89 @@ package cli //nolint:testpackage // shares runEntry and the hermetic config help
 
 import (
 	"context"
+	"database/sql"
 	"os"
 	"path/filepath"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"sneak.berlin/go/vaultik/internal/database"
 	"sneak.berlin/go/vaultik/internal/snapshot"
+	"sneak.berlin/go/vaultik/internal/types"
 )
 
-// Words and flags of `snapshot purge` used to build argument vectors
-// below.
+// The `snapshot purge` command word and flags used below.
 const (
 	cmdPurge       = "purge"
-	flagOlderThan = "--older-than"
+	flagKeepLatest = "--keep-latest"
 	flagForce      = "--force"
 )
 
 // TestEntrySnapshotPurgeKeepsMetadataWhenLocalIndexDeleteFails makes
-// the local index refuse to delete an old snapshot and checks that
+// removing a snapshot from the local index fail and checks that
 // `snapshot purge` exits non-zero and leaves that snapshot's metadata on
 // the destination store. It used to log the error, delete the metadata
-// and exit 0.
-//
-// `snapshot create --prune` runs the same purge, but cannot be driven
-// this way: the refusal also breaks the backup's metadata export, which
-// deletes the other snapshots from its copy of the local index.
+// anyway and exit 0.
 //
 //nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
 func TestEntrySnapshotPurgeKeepsMetadataWhenLocalIndexDeleteFails(t *testing.T) {
-	configPath := writeHermeticPruneConfig(t, false)
-	dir := filepath.Dir(configPath)
-	indexPath := filepath.Join(dir, "index.sqlite")
-
-	// seedStaleSnapshotRecord writes an old snapshot to the local index
-	// only; the manifest planted here puts it on the destination store
-	// too, so the purge selects it rather than dropping it as stale.
-	seedStaleSnapshotRecord(t, indexPath)
-
-	manifestDir := filepath.Join(dir, "store", "metadata",
-		snapshot.RemoteSnapshotKey(stalePruneSnapshotID))
-	require.NoError(t, os.MkdirAll(manifestDir, 0o750))
-
-	manifestPath := filepath.Join(manifestDir, "manifest.json.zst")
-	require.NoError(t, os.WriteFile(manifestPath, []byte("stub"), 0o600))
-
 	ctx := context.Background()
+	configPath := writeHermeticPruneConfig(t, false)
 
-	db, err := database.New(ctx, indexPath)
+	// writeHermeticPruneConfig puts the index and the store directory
+	// beside the config file.
+	dir := filepath.Dir(configPath)
+
+	// Two snapshots of the same name: --keep-latest purges the older.
+	olderStart := time.Date(2026, 5, 1, 9, 0, 0, 0, time.UTC)
+	newerStart := olderStart.Add(time.Hour)
+	olderID := "test-host_test_" + olderStart.Format(time.RFC3339)
+	newerID := "test-host_test_" + newerStart.Format(time.RFC3339)
+
+	db, err := database.New(ctx, filepath.Join(dir, "index.sqlite"))
 	require.NoError(t, err)
 
+	repos := database.NewRepositories(db)
+
+	manifestPaths := make(map[string]string)
+
+	for id, startedAt := range map[string]time.Time{
+		olderID: olderStart,
+		newerID: newerStart,
+	} {
+		completedAt := startedAt.Add(time.Minute)
+		snap := &database.Snapshot{
+			ID:             types.SnapshotID(id),
+			Hostname:       "test-host",
+			VaultikVersion: "test",
+			StartedAt:      startedAt,
+			CompletedAt:    &completedAt,
+		}
+
+		err = repos.WithTx(ctx, func(ctx context.Context, tx *sql.Tx) error {
+			return repos.Snapshots.Create(ctx, tx, snap)
+		})
+		require.NoError(t, err)
+
+		manifestPaths[id] = filepath.Join(dir, "store", "metadata",
+			snapshot.RemoteSnapshotKey(id), "manifest.json.zst")
+		require.NoError(t, os.MkdirAll(filepath.Dir(manifestPaths[id]), 0o750))
+		require.NoError(t, os.WriteFile(manifestPaths[id], []byte("stub"), 0o600))
+	}
+
 	_, err = db.Conn().ExecContext(ctx, `
 		CREATE TRIGGER refuse_snapshot_delete BEFORE DELETE ON snapshots
 		BEGIN SELECT RAISE(ABORT, 'simulated index error'); END`)
 	require.NoError(t, err)
 	require.NoError(t, db.Close())
 
-	code, _, _ := runEntry(t, flagConfig, configPath,
-		cmdSnapshot, cmdPurge, flagOlderThan, "30d", flagForce)
+	code, _, stderr := runEntry(t,
+		flagConfig, configPath, cmdSnapshot, cmdPurge, flagKeepLatest, flagForce)
 
 	assert.Equal(t, 1, code)
-	assert.FileExists(t, manifestPath,
-		"the snapshot is still in the local index, so its metadata must stay")
+	assert.Contains(t, stderr, "simulated index error")
+	assert.FileExists(t, manifestPaths[olderID],
+		"a snapshot still in the local index keeps its metadata")
 }

internal/cli/snapshot.go

@@ -270,9 +270,8 @@ By default, this removes the snapshot from the local index database and
 strips the snapshot's metadata from the backup destination store. Blobs
 are NOT touched: deleting them requires reading every remaining remote
 manifest (the destination store may hold snapshots this host doesn't
-know about), which is what 'vaultik prune' does. The command prints the
-'vaultik prune' invocation to run as a follow-up only when it removed the
-snapshot's metadata from the destination store, and never under --json.
+know about), which is what 'vaultik prune' does. On success the command
+prints the exact 'vaultik prune' invocation to run as a follow-up.
 
 An ID that names no snapshot in the local index or on the destination
 store is an error.
@@ -281,12 +280,10 @@ Use --local-only to skip the remote half (e.g. when you want to forget a
 snapshot locally without touching the destination store); the snapshot
 must then be in the local index.
 
-If removing the snapshot's metadata from the destination store fails (for
-example because the remote is unreachable), the local-database removal
-still completes and a warning is emitted; run 'vaultik snapshot remove
-<snapshot-id>' again once the destination store is reachable to remove
-the snapshot's metadata from it ('vaultik prune' does not). For a
-snapshot that is only on the destination store, that failure is an error.
+If the remote is unreachable, the local-database removal still completes
+and a warning is emitted; run 'vaultik snapshot remove <snapshot-id>' again
+once the destination store is reachable to remove the snapshot's metadata
+from it ('vaultik prune' does not).
 
 To wipe the entire destination store and start over, use 'vaultik remote
 nuke --force' — it is the single supported entry point for that.`,

internal/cli/snapshot_restore.go

@@ -30,8 +30,6 @@ This command will restore files from the specified snapshot to the
 target directory.
 If no paths are specified, all files are restored.
 If paths are specified, only matching files/directories are restored.
-A path that matches nothing in the snapshot is named in a warning, and
-the command exits non-zero after restoring the paths that match.
 
 The snapshot may be named by its ID or, when restoring on a host with no
 local index, by the remote key that 'snapshot list' prints for a

internal/config/config.go

@@ -4,7 +4,6 @@
 package config
 
 import (
-	"bytes"
 	"errors"
 	"fmt"
 	"os"
@@ -30,15 +29,13 @@ const appName = "vaultik"
 //nolint:gosec // G101: marker for detecting a pasted secret key, not a credential
 const secretKeyPrefix = "AGE-SECRET-KEY-"
 
-// Defaults and validation bounds for tunable settings. MB and GB are
-// 1000-based, as the size parser reads them; the S3 part sizes are S3's own
-// limits, which are 1024-based (MiB, GiB).
+// Defaults and validation bounds for tunable settings.
 const (
-	defaultBlobSizeLimit    = Size(10 * 1000 * 1000 * 1000) // 10GB
-	defaultChunkSize        = Size(10 * 1000 * 1000)        // 10MB
+	defaultBlobSizeLimit    = Size(10 * 1024 * 1024 * 1024) // 10GB
+	defaultChunkSize        = Size(10 * 1024 * 1024)        // 10MB
 	defaultS3PartSize       = Size(5 * 1024 * 1024)         // 5MiB
 	defaultCompressionLevel = 3
-	minChunkSize            = 1000 * 1000 // 1MB
+	minChunkSize            = 1024 * 1024 // 1MB
 	minCompressionLevel     = 1
 	maxCompressionLevel     = 19
 	// S3 accepts a multipart upload part from 5MiB to 5GiB.
@@ -236,48 +233,14 @@ func New(path Path) (*Config, error) {
 	return cfg, nil
 }
 
-// Load reads the configuration file at path, parses it with Parse, warns
-// when others can read the file, and validates the configuration.
-// Returns an error if the file cannot be read, parsed, or if validation
-// fails.
+// Load reads and parses the configuration file from the specified path.
+// It applies default values for optional fields, performs environment variable
+// substitution using smartconfig, and validates the configuration.
+// The configuration file should be in YAML format. Returns an error if the file
+// cannot be read, parsed, or if validation fails.
 func Load(path string) (*Config, error) {
-	data, err := os.ReadFile(path) //nolint:gosec // G304: config path is operator-supplied
-	if err != nil {
-		return nil, fmt.Errorf("failed to load config file: %w", err)
-	}
-
-	cfg, err := Parse(data)
-	if err != nil {
-		return nil, err
-	}
-
-	// Check config file permissions (warn if world or group readable)
-	//nolint:gosec // G703: config path is operator-supplied by design
-	info, statErr := os.Stat(path)
-	if statErr == nil {
-		mode := info.Mode().Perm()
-		if mode&0044 != 0 { // group or world readable
-			log.Warn(cfg.readableByOthersWarning(),
-				"path", path,
-				"mode", fmt.Sprintf("%04o", mode),
-				"recommendation", "chmod 600 "+path)
-		}
-	}
-
-	err = cfg.Validate()
-	if err != nil {
-		return nil, fmt.Errorf("invalid config: %w", err)
-	}
-
-	return cfg, nil
-}
-
-// Parse reads YAML config data as Load does, without validating it. It
-// applies default values for optional fields, fills in ${...} references
-// using smartconfig, and expands ~ in paths.
-func Parse(data []byte) (*Config, error) {
 	// Load config using smartconfig for interpolation
-	sc, err := smartconfig.NewFromReader(bytes.NewReader(data))
+	sc, err := smartconfig.NewFromConfigPath(path)
 	if err != nil {
 		return nil, fmt.Errorf("failed to load config file: %w", err)
 	}
@@ -339,6 +302,24 @@ func Parse(data []byte) (*Config, error) {
 		cfg.S3.Region = "us-east-1"
 	}
 
+	// Check config file permissions (warn if world or group readable)
+	//nolint:gosec // G703: config path is operator-supplied by design
+	info, statErr := os.Stat(path)
+	if statErr == nil {
+		mode := info.Mode().Perm()
+		if mode&0044 != 0 { // group or world readable
+			log.Warn(cfg.readableByOthersWarning(),
+				"path", path,
+				"mode", fmt.Sprintf("%04o", mode),
+				"recommendation", "chmod 600 "+path)
+		}
+	}
+
+	err = cfg.Validate()
+	if err != nil {
+		return nil, fmt.Errorf("invalid config: %w", err)
+	}
+
 	return cfg, nil
 }
 

internal/config/config_test.go

@@ -337,81 +337,6 @@ func TestLoadS3PartSize(t *testing.T) {
 	})
 }
 
-// TestDocumentedSizeDefaults checks that the defaults are the documented
-// chunk_size 10MB and blob_size_limit 10GB as the parser reads those values
-// (1000-based), so writing a default out in the config file changes nothing.
-func TestDocumentedSizeDefaults(t *testing.T) {
-	t.Parallel()
-
-	cfg, err := Parse([]byte("chunk_size: 10MB\nblob_size_limit: 10GB\n"))
-	if err != nil {
-		t.Fatalf("Parse() unexpected error: %v", err)
-	}
-
-	if cfg.ChunkSize != defaultChunkSize {
-		t.Errorf("chunk_size: 10MB is %d bytes, the default is %d",
-			cfg.ChunkSize, defaultChunkSize)
-	}
-
-	if cfg.BlobSizeLimit != defaultBlobSizeLimit {
-		t.Errorf("blob_size_limit: 10GB is %d bytes, the default is %d",
-			cfg.BlobSizeLimit, defaultBlobSizeLimit)
-	}
-}
-
-// TestDocumentedSizeExamples checks the 1MB minimum chunk_size and that
-// every size the README, config.example.yml and the config init template
-// list as an example is accepted.
-func TestDocumentedSizeExamples(t *testing.T) {
-	t.Parallel()
-
-	const withoutSizes = "snapshots:\n" +
-		"  test:\n" +
-		"    paths: [/tmp/vaultik-test-source]\n" +
-		"storage_url: file:///tmp/vaultik-test-storage\n"
-
-	tests := []struct {
-		setting string
-		wantErr error
-	}{
-		{"chunk_size: 1MB", nil},
-		{"chunk_size: 999999", errChunkSizeTooSmall},
-		{"chunk_size: 5M", nil},
-		{"chunk_size: 10M", nil},
-		{"chunk_size: 10MB", nil},
-		{"chunk_size: 64MiB", nil},
-		{"chunk_size: 1GB", nil},
-		// Four times the default chunk_size, the documented minimum.
-		{"blob_size_limit: 40MB", nil},
-		{"blob_size_limit: 500MB", nil},
-		{"blob_size_limit: 1GB", nil},
-		{"blob_size_limit: 1GiB", nil},
-		{"blob_size_limit: 10G", nil},
-		{"blob_size_limit: 10GB", nil},
-		{"s3: {part_size: 5MiB}", nil},
-		{"s3: {part_size: 10MB}", nil},
-		{"s3: {part_size: 16MiB}", nil},
-		{"s3: {part_size: 100MiB}", nil},
-		{"s3: {part_size: 5GiB}", nil},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.setting, func(t *testing.T) {
-			t.Parallel()
-
-			cfg, err := Parse([]byte(withoutSizes + tt.setting + "\n"))
-			if err != nil {
-				t.Fatalf("Parse() unexpected error: %v", err)
-			}
-
-			err = cfg.Validate()
-			if !errors.Is(err, tt.wantErr) {
-				t.Fatalf("Validate() error = %v, want %v", err, tt.wantErr)
-			}
-		})
-	}
-}
-
 // TestLoadRejectsRelativeFileURL checks that a file:// storage_url with a
 // relative path fails at load. Accepted, it would resolve against the
 // working directory, so a backup run from another directory would write

internal/snapshot/exclude_test.go

@@ -578,54 +578,3 @@ func TestExcludePatterns_DoubleStarFileAtEveryDepth(t *testing.T) {
 	require.Equal(t, 1, result.FilesScanned,
 		"**/ file pattern should match at the top level and nested")
 }
-
-func TestExcludePatterns_AnchoredDoubleStarAtEveryDepth(t *testing.T) {
-	t.Parallel()
-
-	// As in gitignore, /**/ also matches directly under the source dir
-	fs := setupAnchoredTestFS(t)
-
-	scanner, repos, cleanup := createTestScanner(t, fs, []string{"/**/projectname"})
-	defer cleanup()
-
-	ctx := context.Background()
-	createSnapshotRecord(ctx, t, repos, "test-snapshot")
-
-	result, err := scanner.Scan(ctx, "/backup", "test-snapshot")
-	require.NoError(t, err)
-
-	// /**/projectname should exclude BOTH:
-	// - /backup/projectname/file.txt
-	// - /backup/otherproject/projectname/file.txt
-	// Total files: 4, excluded: 2
-	require.Equal(t, 2, result.FilesScanned,
-		"/**/ pattern should match at the top level and nested")
-}
-
-func TestExcludePatterns_DoubleStarInMiddleMatchesZeroDirectories(t *testing.T) {
-	t.Parallel()
-
-	// As in gitignore, a/**/b matches a/b as well as a/c/b. The last part
-	// is a glob: with a plain name the glob library already matched a/b.
-	fs := &afero.MemMapFs{}
-	files := []string{"/backup/a/x.log", "/backup/a/c/y.log", "/backup/a/c/kept.txt"}
-
-	for _, path := range files {
-		require.NoError(t, fs.MkdirAll(filepath.Dir(path), 0755))
-		require.NoError(t, afero.WriteFile(fs, path, []byte(path), 0644))
-	}
-
-	scanner, repos, cleanup := createTestScanner(t, fs, []string{"a/**/*.log"})
-	defer cleanup()
-
-	ctx := context.Background()
-	createSnapshotRecord(ctx, t, repos, "test-snapshot")
-
-	result, err := scanner.Scan(ctx, "/backup", "test-snapshot")
-	require.NoError(t, err)
-
-	// a/**/*.log should exclude /backup/a/x.log and /backup/a/c/y.log
-	// Total files: 3, excluded: 2
-	require.Equal(t, 1, result.FilesScanned,
-		"a/**/*.log should match a/x.log as well as a/c/y.log")
-}

internal/snapshot/scanner.go

@@ -2035,28 +2035,21 @@ func compileExcludePatterns(patterns []string) []compiledPattern {
 		pattern = strings.TrimSuffix(pattern, "/")
 
 		// A leading "**/" demands a "/" before the name and so misses an
-		// entry directly under the source path. It means "at every depth",
-		// which is what an unanchored pattern already does, so drop the
-		// prefix and match unanchored: as in gitignore, "**/x" and
-		// "/**/x" then also match a top-level "x".
-		if rest, found := strings.CutPrefix(pattern, "**/"); found {
-			pattern = rest
-			anchored = false
+		// entry directly under the source path. An unanchored pattern
+		// already matches at every depth, so drop the prefix: as in
+		// gitignore, "**/x" then also matches a top-level "x".
+		if !anchored {
+			pattern = strings.TrimPrefix(pattern, "**/")
 		}
 
-		// Likewise "/**/" inside a pattern demands two slashes, so
-		// "a/**/*.log" misses "a/x.log". As in gitignore it stands for
-		// zero or more directories, so also compile the pattern with it
-		// made a single "/". The glob library's {a,b} is no help: with a
-		// "**" inside it in mid-pattern, it misses paths it should match.
-		for _, variant := range doubleStarVariants(pattern) {
+		// Compile the glob pattern
 		// For patterns without path separators, we need to match them as components
 		// e.g., ".git" should match ".git" anywhere in the path
-			g, err := glob.Compile(variant, '/')
+		g, err := glob.Compile(pattern, '/')
 		if err != nil {
 			log.Warn("Invalid exclude pattern, skipping", "pattern", p, "error", err)
 
-				break
+			continue
 		}
 
 		compiled = append(compiled, compiledPattern{
@@ -2065,30 +2058,10 @@ func compileExcludePatterns(patterns []string) []compiledPattern {
 			original: p,
 		})
 	}
-	}
 
 	return compiled
 }
 
-// doubleStarVariants returns pattern once for every way of keeping each
-// "/**/" in it or making it a single "/".
-func doubleStarVariants(pattern string) []string {
-	const doubleStar = "/**/"
-
-	before, after, found := strings.Cut(pattern, doubleStar)
-	if !found {
-		return []string{pattern}
-	}
-
-	var variants []string
-
-	for _, rest := range doubleStarVariants(after) {
-		variants = append(variants, before+doubleStar+rest, before+"/"+rest)
-	}
-
-	return variants
-}
-
 // shouldExclude checks if a path should be excluded based on exclude patterns
 // filePath is the full path to the file
 // rootPath is the root of the backup source directory

internal/storage/file.go

@@ -120,10 +120,9 @@ func (f *FileStorer) Delete(_ context.Context, key string) error {
 	return nil
 }
 
-// List returns all keys with the given prefix, reading through symlinked
-// directories. It fails when the destination directory is missing, or
-// when the prefix or a directory above it is a symlink whose target is
-// missing; a prefix that is truly missing is an empty listing.
+// List returns all keys with the given prefix. It fails when the
+// destination directory is missing; a missing prefix under it is an
+// empty listing.
 func (f *FileStorer) List(ctx context.Context, prefix string) ([]string, error) {
 	var keys []string
 
@@ -134,7 +133,8 @@ func (f *FileStorer) List(ctx context.Context, prefix string) ([]string, error)
 
 	basePath := f.fullPath(prefix)
 
-	exists, err := f.prefixExists(prefix)
+	// Check if the prefix exists
+	exists, err := afero.Exists(f.fs, basePath)
 	if err != nil {
 		return nil, fmt.Errorf("checking path: %w", err)
 	}
@@ -143,7 +143,7 @@ func (f *FileStorer) List(ctx context.Context, prefix string) ([]string, error)
 		return keys, nil // Empty list for non-existent prefix
 	}
 
-	err = f.walk(basePath, func(path string, info os.FileInfo, err error) error {
+	err = afero.Walk(f.fs, basePath, func(path string, info os.FileInfo, err error) error {
 		if err != nil {
 			return err
 		}
@@ -176,9 +176,7 @@ func (f *FileStorer) List(ctx context.Context, prefix string) ([]string, error)
 }
 
 // ListStream returns a channel of ObjectInfo for large result sets. Like
-// List, it reads through symlinked directories and sends an error when
-// the destination directory is missing, or when the prefix or a directory
-// above it is a symlink whose target is missing.
+// List, it sends an error when the destination directory is missing.
 func (f *FileStorer) ListStream(ctx context.Context, prefix string) <-chan ObjectInfo {
 	ch := make(chan ObjectInfo)
 
@@ -194,7 +192,8 @@ func (f *FileStorer) ListStream(ctx context.Context, prefix string) <-chan Objec
 
 		basePath := f.fullPath(prefix)
 
-		exists, err := f.prefixExists(prefix)
+		// Check if the prefix exists
+		exists, err := afero.Exists(f.fs, basePath)
 		if err != nil {
 			ch <- ObjectInfo{Err: fmt.Errorf("checking path: %w", err)}
 
@@ -205,7 +204,7 @@ func (f *FileStorer) ListStream(ctx context.Context, prefix string) <-chan Objec
 			return // Empty channel for non-existent prefix
 		}
 
-		_ = f.walk(basePath, func(path string, info os.FileInfo, err error) error {
+		_ = afero.Walk(f.fs, basePath, func(path string, info os.FileInfo, err error) error {
 			// Check context cancellation
 			select {
 			case <-ctx.Done():
@@ -244,12 +243,11 @@ func (f *FileStorer) ListStream(ctx context.Context, prefix string) <-chan Objec
 }
 
 // DeletePartialUploads removes every file under prefix whose name ends in
-// tempSuffix. Like List, it reads through symlinked directories and fails
-// on one whose target is missing. A missing prefix has none to remove.
+// tempSuffix. A missing prefix has none to remove.
 func (f *FileStorer) DeletePartialUploads(ctx context.Context, prefix string) error {
 	basePath := f.fullPath(prefix)
 
-	exists, err := f.prefixExists(prefix)
+	exists, err := afero.Exists(f.fs, basePath)
 	if err != nil {
 		return fmt.Errorf("checking path: %w", err)
 	}
@@ -258,7 +256,7 @@ func (f *FileStorer) DeletePartialUploads(ctx context.Context, prefix string) er
 		return nil
 	}
 
-	err = f.walk(basePath, func(path string, info os.FileInfo, err error) error {
+	err = afero.Walk(f.fs, basePath, func(path string, info os.FileInfo, err error) error {
 		if err != nil {
 			return err
 		}
@@ -354,54 +352,6 @@ func (f *FileStorer) writeAtomic(
 	return nil
 }
 
-// walk is afero.Walk, except that it reads through a symlinked directory
-// the way Get and Stat do, where afero.Walk reports the link as one file.
-// afero.Walk uses Lstat, which does not follow a link, whenever the
-// filesystem has one; the struct below carries only the afero.Fs methods,
-// so the walk uses Stat instead. A link back up the tree is followed until
-// the operating system refuses the path for too many levels of links, and
-// the walk then fails.
-func (f *FileStorer) walk(root string, fn filepath.WalkFunc) error {
-	return afero.Walk(struct{ afero.Fs }{f.fs}, root, fn)
-}
-
-// prefixExists reports whether prefix exists under the destination
-// directory. It checks each directory on the way down to prefix in turn,
-// and the first one Stat cannot find decides: if it is not there at all,
-// prefix is missing; if it is a symlink whose target is missing, such as
-// a link to a volume that is not mounted, prefixExists fails, since
-// listing it as empty would let prune delete every blob.
-func (f *FileStorer) prefixExists(prefix string) (bool, error) {
-	lstater, canLstat := f.fs.(afero.Lstater)
-	path := f.basePath
-
-	for name := range strings.SplitSeq(prefix, "/") {
-		path = filepath.Join(path, name)
-
-		_, err := f.fs.Stat(path)
-		if err == nil {
-			continue
-		}
-
-		if !os.IsNotExist(err) {
-			return false, err
-		}
-
-		// Lstat does not follow a symlink at path, so it finds the link
-		// that Stat could not follow.
-		if canLstat {
-			_, _, lstatErr := lstater.LstatIfPossible(path)
-			if lstatErr == nil {
-				return false, err
-			}
-		}
-
-		return false, nil
-	}
-
-	return true, nil
-}
-
 // fullPath returns the full filesystem path for a key.
 func (f *FileStorer) fullPath(key string) string {
 	return filepath.Join(f.basePath, key)

internal/storage/file_backend_test.go

@@ -4,10 +4,7 @@ import (
 	"context"
 	"errors"
 	"io/fs"
-	"os"
 	"path/filepath"
-	"reflect"
-	"strings"
 	"testing"
 
 	"sneak.berlin/go/vaultik/internal/storage"
@@ -63,232 +60,3 @@ func TestFileStorerListMissingDestination(t *testing.T) {
 		t.Errorf("ListStream error = %v, want a not-exist error", streamErr)
 	}
 }
-
-// The two directories at the top of a destination, either of which the
-// tests below replace with a symlink.
-const (
-	metadataDir = "metadata"
-	blobsDir    = "blobs"
-)
-
-// moveBehindSymlink moves base/dir to a directory elsewhere and puts a
-// symlink to it in its place.
-func moveBehindSymlink(t *testing.T, base, dir string) {
-	t.Helper()
-
-	linkPath := filepath.Join(base, dir)
-	movedPath := filepath.Join(t.TempDir(), dir)
-
-	err := os.Rename(linkPath, movedPath)
-	if err != nil {
-		t.Fatalf("moving %s away: %v", dir, err)
-	}
-
-	err = os.Symlink(movedPath, linkPath)
-	if err != nil {
-		t.Fatalf("linking %s: %v", dir, err)
-	}
-}
-
-// TestFileStorerListsThroughSymlinkedDirectory checks that List and
-// ListStream read through a symlinked metadata/ or blobs/ directory, as Get
-// and Stat do, instead of listing the link as one key. Listing the whole
-// destination meets the link part-way through the walk; listing its prefix
-// starts the walk at the link. A prefix missing behind the link lists as
-// empty.
-func TestFileStorerListsThroughSymlinkedDirectory(t *testing.T) {
-	t.Parallel()
-
-	for _, dir := range []string{metadataDir, blobsDir} {
-		t.Run(dir, func(t *testing.T) {
-			t.Parallel()
-
-			base := t.TempDir()
-			key := dir + "/aa/bb/object"
-
-			s, err := storage.NewFileStorer(base)
-			if err != nil {
-				t.Fatalf("NewFileStorer: %v", err)
-			}
-
-			err = s.Put(context.Background(), key, strings.NewReader("data"))
-			if err != nil {
-				t.Fatalf("Put: %v", err)
-			}
-
-			moveBehindSymlink(t, base, dir)
-
-			want := []string{key}
-
-			for _, prefix := range []string{"", dir + "/"} {
-				got := listSorted(t, s, prefix)
-				if !reflect.DeepEqual(got, want) {
-					t.Errorf("List(%q) = %v, want %v", prefix, got, want)
-				}
-
-				got = listStreamKeys(t, s, prefix)
-				if !reflect.DeepEqual(got, want) {
-					t.Errorf("ListStream(%q) = %v, want %v", prefix, got, want)
-				}
-			}
-
-			absent := dir + "/absent/"
-
-			if got := listSorted(t, s, absent); len(got) != 0 {
-				t.Errorf("List(%q) = %v, want empty", absent, got)
-			}
-
-			if got := listStreamKeys(t, s, absent); len(got) != 0 {
-				t.Errorf("ListStream(%q) = %v, want empty", absent, got)
-			}
-		})
-	}
-}
-
-// TestFileStorerListFailsOnSymlinkWithMissingTarget checks that List and
-// ListStream fail on a symlinked metadata/ or blobs/ directory whose target
-// is missing, such as a link to a volume that is not mounted, as they do on
-// a missing destination directory, instead of listing it as empty. That
-// holds for a prefix below the link too.
-func TestFileStorerListFailsOnSymlinkWithMissingTarget(t *testing.T) {
-	t.Parallel()
-
-	ctx := context.Background()
-
-	for _, dir := range []string{metadataDir, blobsDir} {
-		t.Run(dir, func(t *testing.T) {
-			t.Parallel()
-
-			base := t.TempDir()
-
-			s, err := storage.NewFileStorer(base)
-			if err != nil {
-				t.Fatalf("NewFileStorer: %v", err)
-			}
-
-			unmounted := filepath.Join(t.TempDir(), "unmounted")
-
-			err = os.Symlink(unmounted, filepath.Join(base, dir))
-			if err != nil {
-				t.Fatalf("Symlink: %v", err)
-			}
-
-			for _, prefix := range []string{"", dir + "/", dir + "/aa/"} {
-				keys, err := s.List(ctx, prefix)
-				if !errors.Is(err, fs.ErrNotExist) {
-					t.Errorf("List(%q) = %v, %v; want a not-exist error",
-						prefix, keys, err)
-				}
-
-				var streamErr error
-
-				for object := range s.ListStream(ctx, prefix) {
-					if object.Err != nil {
-						streamErr = object.Err
-					}
-				}
-
-				if !errors.Is(streamErr, fs.ErrNotExist) {
-					t.Errorf("ListStream(%q) error = %v, want a not-exist error",
-						prefix, streamErr)
-				}
-			}
-		})
-	}
-}
-
-// TestFileStorerListFailsOnSymlinkLoop checks that a symlink pointing back
-// at the destination makes List and ListStream fail instead of walking it
-// forever.
-func TestFileStorerListFailsOnSymlinkLoop(t *testing.T) {
-	t.Parallel()
-
-	ctx := context.Background()
-	base := t.TempDir()
-
-	s, err := storage.NewFileStorer(base)
-	if err != nil {
-		t.Fatalf("NewFileStorer: %v", err)
-	}
-
-	err = s.Put(ctx, testBlobKey, strings.NewReader("data"))
-	if err != nil {
-		t.Fatalf("Put: %v", err)
-	}
-
-	err = os.Symlink(base, filepath.Join(base, "blobs", "loop"))
-	if err != nil {
-		t.Fatalf("Symlink: %v", err)
-	}
-
-	keys, err := s.List(ctx, "blobs/")
-	if err == nil {
-		t.Errorf("List = %d keys and no error, want an error", len(keys))
-	}
-
-	var streamErr error
-
-	for object := range s.ListStream(ctx, "blobs/") {
-		if object.Err != nil {
-			streamErr = object.Err
-		}
-	}
-
-	if streamErr == nil {
-		t.Error("ListStream sent no error, want one")
-	}
-}
-
-// TestFileStorerDeletePartialUploadsThroughSymlinkedDirectory checks that
-// DeletePartialUploads, which remote nuke uses, removes a leftover temp
-// file behind a symlinked metadata/ or blobs/ directory and keeps the
-// object at the real key.
-func TestFileStorerDeletePartialUploadsThroughSymlinkedDirectory(t *testing.T) {
-	t.Parallel()
-
-	ctx := context.Background()
-
-	for _, dir := range []string{metadataDir, blobsDir} {
-		t.Run(dir, func(t *testing.T) {
-			t.Parallel()
-
-			base := t.TempDir()
-			key := dir + "/aa/bb/object"
-
-			s, err := storage.NewFileStorer(base)
-			if err != nil {
-				t.Fatalf("NewFileStorer: %v", err)
-			}
-
-			err = s.Put(ctx, key, strings.NewReader("data"))
-			if err != nil {
-				t.Fatalf("Put: %v", err)
-			}
-
-			leftover := filepath.Join(base, key+"-123456.partial")
-
-			err = os.WriteFile(leftover, []byte("half"), 0o600)
-			if err != nil {
-				t.Fatalf("writing leftover temp file: %v", err)
-			}
-
-			moveBehindSymlink(t, base, dir)
-
-			err = s.DeletePartialUploads(ctx, dir+"/")
-			if err != nil {
-				t.Fatalf("DeletePartialUploads: %v", err)
-			}
-
-			// leftover runs through the link.
-			_, err = os.Stat(leftover)
-			if !os.IsNotExist(err) {
-				t.Errorf("leftover temp file was not removed: %v", err)
-			}
-
-			_, err = s.Stat(ctx, key)
-			if err != nil {
-				t.Errorf("Stat of the real key: %v", err)
-			}
-		})
-	}
-}

internal/storage/rclone.go

@@ -7,12 +7,10 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"os"
 	"strings"
 	"time"
 
 	"github.com/rclone/rclone/fs"
-	"github.com/rclone/rclone/fs/config"
 	"github.com/rclone/rclone/fs/config/configfile"
 	"github.com/rclone/rclone/fs/operations"
 
@@ -35,15 +33,6 @@ type RcloneStorer struct {
 // The remote parameter is the rclone remote name (as configured via `rclone config`).
 // The path parameter is the path within the remote.
 func NewRcloneStorer(ctx context.Context, remote, path string) (*RcloneStorer, error) {
-	// rclone reads RCLONE_CONFIG only as the value of its --config flag,
-	// which vaultik does not have, so it is applied here as that flag would.
-	if configPath, ok := os.LookupEnv("RCLONE_CONFIG"); ok {
-		err := config.SetConfigPath(configPath)
-		if err != nil {
-			return nil, fmt.Errorf("using RCLONE_CONFIG %q: %w", configPath, err)
-		}
-	}
-
 	// Install the default config file handler
 	configfile.Install()
 

internal/storage/rclone_test.go

@@ -11,7 +11,6 @@ import (
 	"testing"
 
 	"github.com/rclone/rclone/fs"
-	"github.com/rclone/rclone/fs/config"
 	"github.com/rclone/rclone/fs/config/configmap"
 	"sneak.berlin/go/vaultik/internal/storage"
 )
@@ -391,41 +390,3 @@ func TestNewRcloneStorerUnknownRemote(t *testing.T) {
 		t.Errorf("NewRcloneStorer error = %v, want ErrRemoteNotFound", err)
 	}
 }
-
-// TestNewRcloneStorerReadsRcloneConfigEnv checks that a remote defined only
-// in the file RCLONE_CONFIG names is found and written to, as rclone itself
-// would.
-func TestNewRcloneStorerReadsRcloneConfigEnv(t *testing.T) {
-	// rclone keeps the config file path in a process-global variable, which
-	// NewRcloneStorer leaves pointing at this test's file.
-	previous := config.GetConfigPath()
-
-	t.Cleanup(func() { _ = config.SetConfigPath(previous) })
-
-	confFile := filepath.Join(t.TempDir(), "rclone.conf")
-
-	err := os.WriteFile(confFile, []byte("[loc]\ntype = local\n"), 0o600)
-	if err != nil {
-		t.Fatalf("writing rclone config: %v", err)
-	}
-
-	t.Setenv("RCLONE_CONFIG", confFile)
-
-	dir := t.TempDir()
-	ctx := context.Background()
-
-	s, err := storage.NewRcloneStorer(ctx, "loc", dir)
-	if err != nil {
-		t.Fatalf("NewRcloneStorer: %v", err)
-	}
-
-	err = s.Put(ctx, testBlobKey, strings.NewReader("blob-bytes"))
-	if err != nil {
-		t.Fatalf("Put: %v", err)
-	}
-
-	_, err = os.Stat(filepath.Join(dir, testBlobKey))
-	if err != nil {
-		t.Errorf("object is not in the remote's directory: %v", err)
-	}
-}

internal/vaultik/blobcache.go

@@ -39,9 +39,9 @@ type blobDiskCacheEntry struct {
 // internally and will fall back to LRU eviction if curBytes exceeds
 // maxBytes. Restore passes math.MaxInt64 as maxBytes and drives
 // eviction itself via Delete() through restoreSweeper, which deletes
-// each blob once no file still to be restored in this run needs it.
-// LRU never fires under that configuration; it is kept as a safety net
-// for callers that don't manage eviction themselves.
+// each blob the moment every file that references its chunks has been
+// written. LRU never fires under that configuration; it is kept as a
+// safety net for callers that don't manage eviction themselves.
 //
 // Get/ReadAt/peak-Len counters are debugging instrumentation used by
 // tests to assert that the restore code path uses ReadAt rather than

internal/vaultik/nuke_remote_test.go

@@ -18,8 +18,7 @@ import (
 // TestNukeRemoteLeavesNoFiles checks that remote nuke leaves no file
 // under a file:// destination, including the `.partial` files uploads
 // killed part-way leave next to a snapshot's metadata and next to where a
-// blob would have been, a snapshot's database whose manifest was never
-// uploaded, and a file under blobs/ whose name is not a blob hash.
+// blob would have been.
 func TestNukeRemoteLeavesNoFiles(t *testing.T) {
 	log.Initialize(log.Config{})
 	t.Parallel()
@@ -39,9 +38,6 @@ func TestNukeRemoteLeavesNoFiles(t *testing.T) {
 			"db.zst.age-123456.partial"),
 		filepath.Join(storeDir, "blobs", hash[:2], hash[2:4],
 			hash+"-123456.partial"),
-		filepath.Join(storeDir, "metadata",
-			snapshot.RemoteSnapshotKey("no-manifest"), "db.zst.age"),
-		filepath.Join(storeDir, "blobs", "0b", "01", ".DS_Store"),
 	}
 
 	for _, leftover := range leftovers {
@@ -104,34 +100,6 @@ func TestNukeRemoteFailsWhenADeleteFails(t *testing.T) {
 	}
 }
 
-// TestNukeRemoteNamesWhatIsLeft checks that remote nuke, when an object
-// it does not recognise cannot be deleted, does not report the store
-// empty but names that object and fails.
-func TestNukeRemoteNamesWhatIsLeft(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	storeDir := filepath.Join(t.TempDir(), "store")
-	v, _, out := backUpToFileDestination(ctx, t, storeDir)
-
-	const leftKey = "blobs/0b/01/.DS_Store"
-
-	leftPath := filepath.Join(storeDir, filepath.FromSlash(leftKey))
-	require.NoError(t, os.MkdirAll(filepath.Dir(leftPath), 0o750))
-	require.NoError(t, os.WriteFile(leftPath, []byte("finder"), 0o600))
-
-	store := faultstore.New(v.Storage)
-	store.OnDelete = func(key string) bool { return key == leftKey }
-	v.Storage = store
-
-	require.Error(t, v.NukeRemote(true))
-
-	assert.Contains(t, out.String(), leftKey)
-	assert.NotContains(t, out.String(), "now empty")
-	assert.Contains(t, out.String(), "vaultik remote nuke --force")
-}
-
 // TestNukeRemoteRefusesAnotherDestinationWithoutRetryAdvice checks that
 // remote nuke, when the local index belongs to a different destination
 // than the configured one, fails without advising to run nuke again:

internal/vaultik/prune.go

@@ -22,11 +22,6 @@ var errNukeRequiresForce = errors.New(
 // errBlobDeleteFailed reports unreferenced blobs prune could not delete.
 var errBlobDeleteFailed = errors.New("blob(s) could not be deleted")
 
-// errObjectsLeft reports objects remote nuke still finds on the backup
-// destination store after deleting.
-var errObjectsLeft = errors.New(
-	"object(s) still on the backup destination store")
-
 // nukeCommandHint is the command suggested when a remote nuke could not
 // delete everything: running it again deletes what is left, which
 // `vaultik prune` does not do for snapshot metadata.
@@ -40,11 +35,10 @@ const metadataDirName = "metadata"
 // (blobs/<aa>/<bb>/<hash>).
 const blobKeyParts = 4
 
-// NukeRemote deletes every object under metadata/ and blobs/ in remote
-// storage, whatever its name, along with any object an upload cut off
-// part-way left under a temporary `.partial` name. It returns
-// successfully only when a listing afterwards finds nothing left there,
-// and the next backup then starts from scratch.
+// NukeRemote deletes every snapshot's metadata and every blob from remote
+// storage, along with any object an upload cut off part-way left under a
+// temporary `.partial` name. After this returns successfully the bucket
+// prefix is empty and the next backup starts from scratch.
 //
 // Refuses to run unless force is true. The caller is responsible for
 // confirming with the user.
@@ -74,8 +68,7 @@ func (v *Vaultik) NukeRemote(force bool) error {
 }
 
 // emptyDestinationStore does the deleting for NukeRemote and stops at
-// the first step that fails. It also fails when objects are still
-// listed at the end, naming each one.
+// the first step that fails.
 func (v *Vaultik) emptyDestinationStore() error {
 	v.UI.Beginf("Removing all snapshot metadata from backup destination store.")
 
@@ -84,62 +77,25 @@ func (v *Vaultik) emptyDestinationStore() error {
 		return fmt.Errorf("removing all snapshots: %w", err)
 	}
 
-	v.UI.Beginf("Removing everything still present in backup destination store.")
+	v.UI.Beginf("Removing any blobs still present in backup destination store.")
 
-	var left []string
-
-	for _, prefix := range []string{"metadata/", "blobs/"} {
-		keys, err := v.deleteEverythingUnder(prefix)
+	err = v.PruneBlobs(&PruneOptions{Force: true})
 	if err != nil {
-			return err
+		return fmt.Errorf("pruning blobs: %w", err)
 	}
 
-		left = append(left, keys...)
+	// The file and rclone listings skip `.partial` objects, so the two
+	// steps above never delete them.
+	for _, prefix := range []string{"metadata/", "blobs/"} {
+		err = v.Storage.DeletePartialUploads(v.ctx, prefix)
+		if err != nil {
+			return fmt.Errorf("deleting partial uploads: %w", err)
 		}
-
-	for _, key := range left {
-		v.UI.Warningf("Still on the backup destination store: %s", key)
-	}
-
-	if len(left) > 0 {
-		return fmt.Errorf("%d %w", len(left), errObjectsLeft)
 	}
 
 	return nil
 }
 
-// deleteEverythingUnder deletes every object under prefix, whatever its
-// name, and returns the keys a listing afterwards still finds. A delete
-// that fails is logged and the others still run; that object then
-// shows up in the listing afterwards.
-func (v *Vaultik) deleteEverythingUnder(prefix string) ([]string, error) {
-	keys, err := v.Storage.List(v.ctx, prefix)
-	if err != nil {
-		return nil, fmt.Errorf("listing %s: %w", prefix, err)
-	}
-
-	for _, key := range keys {
-		err = v.Storage.Delete(v.ctx, key)
-		if err != nil {
-			log.Error("Failed to delete object", "key", key, "error", err)
-		}
-	}
-
-	// The file and rclone listings skip `.partial` objects, so the
-	// deletes above never reach them.
-	err = v.Storage.DeletePartialUploads(v.ctx, prefix)
-	if err != nil {
-		return nil, fmt.Errorf("deleting partial uploads: %w", err)
-	}
-
-	left, err := v.Storage.List(v.ctx, prefix)
-	if err != nil {
-		return nil, fmt.Errorf("listing %s: %w", prefix, err)
-	}
-
-	return left, nil
-}
-
 // PruneBlobsResult contains the result of a blob prune operation
 //
 //nolint:tagliatelle // snake_case is the established JSON output format
@@ -204,7 +160,7 @@ func (v *Vaultik) PruneBlobs(opts *PruneOptions) error {
 			return v.outputPruneBlobsJSON(result)
 		}
 
-		v.UI.Infof("No unreferenced blobs to remove.")
+		v.printlnStdout("No unreferenced blobs to remove.")
 
 		return nil
 	}
@@ -212,17 +168,12 @@ func (v *Vaultik) PruneBlobs(opts *PruneOptions) error {
 	log.Info("Found unreferenced blobs",
 		"count", len(unreferencedBlobs), "total_size", ubytes(totalSize))
 
-	if opts.Force && !opts.JSON {
-		v.UI.Infof("Found %d unreferenced blob(s) totaling %s.",
+	if !opts.JSON {
+		v.stdoutf("Found %d unreferenced blob(s) totaling %s\n",
 			len(unreferencedBlobs), ubytes(totalSize))
 	}
 
 	if !opts.Force && !opts.JSON {
-		// The count, the prompt and its answer bypass the UI: they are an
-		// interactive exchange the operator must see, so --quiet does not
-		// silence them.
-		v.stdoutf("Found %d unreferenced blob(s) totaling %s.\n",
-			len(unreferencedBlobs), ubytes(totalSize))
 		v.stdoutf("\nDelete %d unreferenced blob(s)? [y/N] ", len(unreferencedBlobs))
 
 		var confirm string
@@ -249,7 +200,7 @@ func (v *Vaultik) PruneBlobs(opts *PruneOptions) error {
 			return err
 		}
 	} else {
-		v.UI.Infof("Deleted %d blob(s) totaling %s.",
+		v.stdoutf("\nDeleted %d blob(s) totaling %s\n",
 			result.BlobsDeleted, ubytes(result.BytesFreed))
 	}
 

internal/vaultik/prune_count_test.go

@@ -1,17 +1,13 @@
 package vaultik //nolint:testpackage // exercises unexported count helpers
 
 import (
-	"bytes"
 	"context"
 	"testing"
-	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"sneak.berlin/go/vaultik/internal/database"
 	"sneak.berlin/go/vaultik/internal/log"
-	"sneak.berlin/go/vaultik/internal/snapshot"
-	"sneak.berlin/go/vaultik/internal/ui"
 )
 
 // TestTableCountForReportSurfacesReadFailure is the regression guard for
@@ -80,59 +76,3 @@ func TestCountDiffUnknownWhenEitherSideUnknown(t *testing.T) {
 	assert.Nil(t, countDiff(&before, nil), "unknown after yields unknown delta")
 	assert.Nil(t, countDiff(nil, nil))
 }
-
-// TestPruneDatabaseSummaryLabelsTotals removes the only incomplete
-// snapshot from an index that also holds a complete one. The figure in
-// brackets is every snapshot left in the local index, so the line must
-// say so rather than read as incomplete snapshots that remain.
-func TestPruneDatabaseSummaryLabelsTotals(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-
-	db, err := database.New(ctx, ":memory:")
-	require.NoError(t, err)
-	t.Cleanup(func() { _ = db.Close() })
-
-	repos := database.NewRepositories(db)
-
-	startedAt := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
-	completedAt := startedAt.Add(time.Minute)
-
-	require.NoError(t, repos.Snapshots.Create(ctx, nil, &database.Snapshot{
-		ID:          "host_complete_2026-01-02T03:04:05Z",
-		Hostname:    "host",
-		StartedAt:   startedAt,
-		CompletedAt: &completedAt,
-	}))
-	require.NoError(t, repos.Snapshots.Create(ctx, nil, &database.Snapshot{
-		ID:        "host_incomplete_2026-01-02T03:04:05Z",
-		Hostname:  "host",
-		StartedAt: startedAt,
-	}))
-
-	var out bytes.Buffer
-
-	v := &Vaultik{
-		DB:           db,
-		Repositories: repos,
-		SnapshotManager: snapshot.NewSnapshotManager(
-			snapshot.SnapshotManagerParams{Repos: repos}),
-		UI: ui.NewWithColor(&out, false),
-	}
-	v.SetContext(ctx)
-
-	result, err := v.PruneDatabase()
-	require.NoError(t, err)
-	require.Equal(t, int64(1), result.SnapshotsDeleted)
-
-	assert.Contains(t, out.String(), "Incomplete snapshots: 1 removed "+
-		"(total snapshots left in the local index: 1).")
-	assert.Contains(t, out.String(), "Orphaned files: 0 removed "+
-		"(total files left in the local index: 0).")
-	assert.Contains(t, out.String(), "Orphaned chunks: 0 removed "+
-		"(total chunks left in the local index: 0).")
-	assert.Contains(t, out.String(), "Orphaned blobs: 0 removed "+
-		"(total blobs left in the local index: 0).")
-}

internal/vaultik/purge_local_remote_consistency_test.go

@@ -14,7 +14,6 @@ import (
 	"sneak.berlin/go/vaultik/internal/log"
 	"sneak.berlin/go/vaultik/internal/snapshot"
 	"sneak.berlin/go/vaultik/internal/types"
-	"sneak.berlin/go/vaultik/internal/ui"
 	"sneak.berlin/go/vaultik/internal/vaultik"
 )
 
@@ -59,16 +58,13 @@ func setupConsistencyTest(
 		require.NoError(t, err)
 	}
 
-	stdout := &bytes.Buffer{}
-
 	v := &vaultik.Vaultik{
 		Storage:      mockStorage,
 		Repositories: repos,
 		DB:           db,
-		Stdout:       stdout,
+		Stdout:       &bytes.Buffer{},
 		Stderr:       &bytes.Buffer{},
 		Stdin:        &bytes.Buffer{},
-		UI:           ui.NewWithColor(stdout, false),
 	}
 	v.SetContext(ctx)
 

internal/vaultik/purge_per_name_test.go

@@ -14,7 +14,6 @@ import (
 	"sneak.berlin/go/vaultik/internal/log"
 	"sneak.berlin/go/vaultik/internal/snapshot"
 	"sneak.berlin/go/vaultik/internal/types"
-	"sneak.berlin/go/vaultik/internal/ui"
 	"sneak.berlin/go/vaultik/internal/vaultik"
 )
 
@@ -87,7 +86,6 @@ func setupPurgeTest(
 		Stdout:       stdout,
 		Stderr:       stderr,
 		Stdin:        stdin,
-		UI:           ui.NewWithColor(stdout, false),
 	}
 	v.SetContext(ctx)
 

internal/vaultik/remove_quiet_test.go

@@ -1,148 +0,0 @@
-package vaultik_test
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/vaultik/internal/log"
-	"sneak.berlin/go/vaultik/internal/ui"
-	"sneak.berlin/go/vaultik/internal/vaultik"
-)
-
-// TestPurgeSnapshots_QuietSuppressesReport checks that `snapshot purge
-// --keep-latest --force` under --quiet deletes the older snapshot and
-// prints nothing.
-func TestPurgeSnapshots_QuietSuppressesReport(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	v := setupPurgeTest(t, snapHostname, []string{snapHomeT0, snapHomeT1})
-
-	var out bytes.Buffer
-
-	v.Stdout = &out
-	v.UI = ui.NewWithColor(&out, false)
-	v.UI.SetQuiet(true)
-
-	require.NoError(t, v.PurgeSnapshotsWithOptions(&vaultik.SnapshotPurgeOptions{
-		KeepLatest: true,
-		Force:      true,
-	}))
-
-	assert.Equal(t, []string{snapHomeT1}, listRemainingSnapshots(t, v))
-	assert.Empty(t, out.String())
-}
-
-// TestPurgeSnapshots_QuietPromptListsSnapshots checks that `snapshot
-// purge --keep-latest` without --force still lists the snapshots its
-// prompt asks to delete under --quiet.
-func TestPurgeSnapshots_QuietPromptListsSnapshots(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	v := setupPurgeTest(t, snapHostname, []string{snapHomeT0, snapHomeT1})
-
-	var out bytes.Buffer
-
-	v.Stdout = &out
-	v.UI = ui.NewWithColor(&out, false)
-	v.UI.SetQuiet(true)
-
-	// Stdin is empty, so the prompt reads no answer and cancels.
-	require.NoError(t, v.PurgeSnapshotsWithOptions(&vaultik.SnapshotPurgeOptions{
-		KeepLatest: true,
-	}))
-
-	assert.Contains(t, out.String(), snapHomeT0)
-	assert.Contains(t, out.String(), "Delete 1 snapshot(s)? [y/N]")
-	assert.Len(t, listRemainingSnapshots(t, v), 2)
-}
-
-// TestPruneBlobs_QuietPromptShowsBlobTotal checks that `prune` without
-// --force still states the count and total size of the blobs its prompt
-// asks to delete under --quiet.
-func TestPruneBlobs_QuietPromptShowsBlobTotal(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	env := newListEnv(t)
-	env.v.UI.SetQuiet(true)
-
-	// The store holds no manifest, so nothing references this blob.
-	addBlob(t, env.store.testStorer, testBlobHashA)
-
-	// Stdin is empty, so the prompt reads no answer and cancels.
-	require.NoError(t, env.v.PruneBlobs(&vaultik.PruneOptions{}))
-
-	assert.Contains(t, env.stdout.String(),
-		"Found 1 unreferenced blob(s) totaling")
-	assert.Contains(t, env.stdout.String(),
-		"Delete 1 unreferenced blob(s)? [y/N]")
-}
-
-// TestRemoveSnapshot_QuietSuppressesReport checks that `snapshot remove`
-// under --quiet prints nothing with --dry-run or with --force, and that
-// the --json document still prints.
-func TestRemoveSnapshot_QuietSuppressesReport(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	newQuietRemover := func() (*vaultik.TestVaultik, *testStorer) {
-		store := newTestStorer()
-		addManifest(t, store, "snapshot-001", nil)
-
-		tv := vaultik.NewForTesting(store)
-		tv.Repositories = newLocalIndex(t, "snapshot-001")
-		tv.UI.SetQuiet(true)
-
-		return tv, store
-	}
-
-	tv, store := newQuietRemover()
-
-	_, err := tv.RemoveSnapshot("snapshot-001",
-		&vaultik.RemoveOptions{DryRun: true})
-	require.NoError(t, err)
-	assert.Empty(t, tv.Stdout.String(),
-		"--dry-run must print nothing under --quiet")
-
-	_, err = tv.RemoveSnapshot("snapshot-001",
-		&vaultik.RemoveOptions{Force: true})
-	require.NoError(t, err)
-	assert.False(t, store.hasKey(remoteKeyPath("snapshot-001")))
-	assert.Empty(t, tv.Stdout.String(),
-		"--force must print nothing under --quiet")
-
-	tv, _ = newQuietRemover()
-
-	_, err = tv.RemoveSnapshot("snapshot-001",
-		&vaultik.RemoveOptions{JSON: true})
-	require.NoError(t, err)
-
-	var result vaultik.RemoveResult
-
-	require.NoError(t, json.Unmarshal(tv.Stdout.Bytes(), &result),
-		"the --json document must still print under --quiet")
-	assert.True(t, result.RemoteRemoved)
-}
-
-// TestNukeRemote_QuietSuppressesReport checks that `remote nuke --force`
-// under --quiet prints nothing while it removes a snapshot's metadata
-// and its blobs.
-func TestNukeRemote_QuietSuppressesReport(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	storeDir := filepath.Join(t.TempDir(), "store")
-	v, _, out := backUpToFileDestination(ctx, t, storeDir)
-	v.UI.SetQuiet(true)
-
-	require.NoError(t, v.NukeRemote(true))
-	assert.Empty(t, out.String())
-}

internal/vaultik/remove_snapshot_test.go

@@ -17,7 +17,6 @@ import (
 	"sneak.berlin/go/vaultik/internal/log"
 	"sneak.berlin/go/vaultik/internal/snapshot"
 	"sneak.berlin/go/vaultik/internal/storage"
-	"sneak.berlin/go/vaultik/internal/storage/faultstore"
 	"sneak.berlin/go/vaultik/internal/types"
 	"sneak.berlin/go/vaultik/internal/vaultik"
 )
@@ -351,7 +350,7 @@ func TestRemoveSnapshot_DryRun(t *testing.T) {
 	assert.True(t, store.hasKey("blobs/aa/aa/"+blobA))
 	assert.True(t, store.hasKey(remoteKeyPath("snapshot-001")))
 
-	assert.Contains(t, tv.Stdout.String(), "Dry run: no changes made.")
+	assert.Contains(t, tv.Stdout.String(), "[Dry run - no changes made]")
 }
 
 // TestRemoveSnapshot_UnknownIDIsError checks that an ID naming no
@@ -432,40 +431,6 @@ func TestRemoveSnapshot_NotInLocalIndex(t *testing.T) {
 	assert.Contains(t, out, "Removed snapshot metadata from remote storage")
 }
 
-// TestRemoveSnapshot_NotInLocalIndexDeleteFails checks that removing a
-// snapshot only the destination store holds fails when its metadata
-// cannot be deleted there, under --force and under --json: nothing was
-// removed, so the command must not succeed.
-func TestRemoveSnapshot_NotInLocalIndexDeleteFails(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	for name, opts := range map[string]vaultik.RemoveOptions{
-		"force": {Force: true},
-		"json":  {JSON: true},
-	} {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			store := newTestStorer()
-			addManifest(t, store, "snapshot-001", nil)
-
-			faulty := faultstore.New(store)
-			faulty.OnDelete = func(string) bool { return true }
-
-			tv := vaultik.NewForTesting(faulty)
-			tv.Repositories = newLocalIndex(t)
-
-			result, err := tv.RemoveSnapshot("snapshot-001", &opts)
-
-			require.ErrorIs(t, err, faultstore.ErrInjectedDelete)
-			assert.False(t, result.RemoteRemoved)
-			assert.True(t, store.hasKey(remoteKeyPath("snapshot-001")))
-			assert.Empty(t, tv.Stdout.String())
-		})
-	}
-}
-
 func TestRemoveAllSnapshots_RequiresForce(t *testing.T) {
 	log.Initialize(log.Config{})
 	t.Parallel()
@@ -539,7 +504,7 @@ func TestRemoveAllSnapshots_DryRun(t *testing.T) {
 
 	assert.Equal(t, initialCount, store.keyCount())
 
-	assert.Contains(t, tv.Stdout.String(), "Dry run: no changes made.")
+	assert.Contains(t, tv.Stdout.String(), "[Dry run - no changes made]")
 }
 
 func TestRemoveAllSnapshots_NoSnapshots(t *testing.T) {

internal/vaultik/restore.go

@@ -27,7 +27,6 @@ import (
 // Sentinel errors for restore failures.
 var (
 	errFilesFailedRestore    = errors.New("file(s) failed to restore")
-	errPathsNotInSnapshot    = errors.New("requested path(s) not in the snapshot")
 	errFilesFailedVerify     = errors.New("files failed verification")
 	errDecryptionKeyRequired = errors.New(
 		"decryption key required for restore\n\n" +
@@ -151,20 +150,16 @@ func (v *Vaultik) Restore(opts *RestoreOptions) error {
 	repos := database.NewRepositories(tempDB)
 
 	// Step 2: Get list of files to restore
-	files, unmatched, err := v.getFilesToRestore(v.ctx, repos, opts.Paths)
+	files, err := v.getFilesToRestore(v.ctx, repos, opts.Paths)
 	if err != nil {
 		return fmt.Errorf("getting files to restore: %w", err)
 	}
 
-	// Named before anything is restored, so the names are shown even
-	// when the restore stops on an error.
-	unmatchedErr := v.reportUnmatchedPaths(unmatched)
-
 	if len(files) == 0 {
 		log.Warn("No files found to restore")
 		v.UI.Warningf("No files found to restore.")
 
-		return unmatchedErr
+		return nil
 	}
 
 	log.Info("Found files to restore", "count", len(files))
@@ -190,20 +185,6 @@ func (v *Vaultik) Restore(opts *RestoreOptions) error {
 
 	result.Duration = time.Since(startTime)
 
-	return v.finishRestore(repos, files, unmatchedErr, opts, result)
-}
-
-// finishRestore prints the restore summary and the post-restore
-// warnings, runs optional verification, and converts any failed-file
-// count into an error. Otherwise it returns unmatchedErr, the error for
-// the requested paths that matched nothing (nil when there are none).
-func (v *Vaultik) finishRestore(
-	repos *database.Repositories,
-	files []*database.File,
-	unmatchedErr error,
-	opts *RestoreOptions,
-	result *RestoreResult,
-) error {
 	log.Info("Restore complete",
 		"files_restored", result.FilesRestored,
 		"bytes_restored", ubytes(result.BytesRestored),
@@ -218,6 +199,17 @@ func (v *Vaultik) finishRestore(
 		v.UI.Duration(result.Duration),
 	)
 
+	return v.finishRestore(repos, files, opts, result)
+}
+
+// finishRestore emits the post-restore warnings, runs optional
+// verification, and converts any failed-file count into an error.
+func (v *Vaultik) finishRestore(
+	repos *database.Repositories,
+	files []*database.File,
+	opts *RestoreOptions,
+	result *RestoreResult,
+) error {
 	if os.Geteuid() != 0 {
 		v.UI.Warningf("Restore did not preserve file ownership: chown(2) " +
 			"requires root. Re-run as root (e.g. with sudo) if you need " +
@@ -244,25 +236,9 @@ func (v *Vaultik) finishRestore(
 		return fmt.Errorf("%d %w", result.FilesFailed, errFilesFailedRestore)
 	}
 
-	return unmatchedErr
-}
-
-// reportUnmatchedPaths warns, by name, about each requested path that
-// matched nothing in the snapshot, and returns an error counting them,
-// or nil when there are none.
-func (v *Vaultik) reportUnmatchedPaths(unmatched []string) error {
-	if len(unmatched) == 0 {
 	return nil
 }
 
-	for _, path := range unmatched {
-		log.Warn("Requested path matches nothing in the snapshot", "path", path)
-		v.UI.Warningf("%s matches nothing in the snapshot.", v.UI.Path(path))
-	}
-
-	return fmt.Errorf("%d %w", len(unmatched), errPathsNotInSnapshot)
-}
-
 // restoreIdentities parses the configured age secret key once into every
 // identity it contains. The value may be a single key line or a whole
 // age-keygen file with several identities; all of them are returned so
@@ -323,6 +299,12 @@ func (v *Vaultik) restoreAllFiles(
 		_ = blobCache.Close()
 	}()
 
+	// Per-restore sweep state: every blob_size_limit/100 bytes written,
+	// scan the cache and delete any blob whose remaining file references
+	// are all already restored.
+	sweeper := newRestoreSweeper(v.ctx, repos, blobCache,
+		v.Config.BlobSizeLimit.Int64()/sweepIntervalDivisor)
+
 	blobByHash, blobIDToHash, err := v.buildBlobIndexes(repos)
 	if err != nil {
 		return nil, err
@@ -334,12 +316,6 @@ func (v *Vaultik) restoreAllFiles(
 		return nil, fmt.Errorf("building restore plan: %w", err)
 	}
 
-	// Per-restore sweep state: every blob_size_limit/100 bytes written,
-	// scan the cache and delete any blob that no pending file in the
-	// plan references.
-	sweeper := newRestoreSweeper(plan, blobCache,
-		v.Config.BlobSizeLimit.Int64()/sweepIntervalDivisor)
-
 	// Ranging over files rather than the map reports them in a stable order.
 	for _, file := range files {
 		if planErr, ok := unplanned[file.ID]; ok {
@@ -427,8 +403,10 @@ func (v *Vaultik) runRestoreLoop(
 			continue
 		}
 
-		// Drop the file from the plan's indexes so future picks ignore
-		// it and the sweeper can free blobs no pending file needs.
+		// Record the file as restored so the sweeper can free blobs
+		// once all referencing files are done, and drop it from the
+		// plan's indexes so future picks ignore it.
+		session.sweeper.fileRestored(fileID.String())
 		plan.finishFile(fileID)
 
 		processed++
@@ -862,34 +840,27 @@ func (v *Vaultik) materializeSnapshotDB(
 	return db, tempDir, nil
 }
 
-// getFilesToRestore returns the list of files to restore based on path
-// filters, and the filters, as given, that matched no file.
+// getFilesToRestore returns the list of files to restore based on path filters
 func (v *Vaultik) getFilesToRestore(
 	ctx context.Context, repos *database.Repositories, pathFilters []string,
-) ([]*database.File, []string, error) {
+) ([]*database.File, error) {
 	// If no filters, get all files
 	if len(pathFilters) == 0 {
-		files, err := repos.Files.ListAll(ctx)
-
-		return files, nil, err
+		return repos.Files.ListAll(ctx)
 	}
 
 	// Get files matching the path filters
-	var (
-		result    []*database.File
-		unmatched []string
-	)
+	var result []*database.File
 
 	seen := make(map[string]bool)
 
 	for _, filter := range pathFilters {
-		files, err := repos.Files.ListUnderPath(ctx, filepath.Clean(filter))
-		if err != nil {
-			return nil, nil, fmt.Errorf("listing files under %s: %w", filter, err)
-		}
+		// Normalize the filter path
+		filter = filepath.Clean(filter)
 
-		if len(files) == 0 {
-			unmatched = append(unmatched, filter)
+		files, err := repos.Files.ListUnderPath(ctx, filter)
+		if err != nil {
+			return nil, fmt.Errorf("listing files under %s: %w", filter, err)
 		}
 
 		for _, file := range files {
@@ -900,7 +871,7 @@ func (v *Vaultik) getFilesToRestore(
 		}
 	}
 
-	return result, unmatched, nil
+	return result, nil
 }
 
 // buildChunkToBlobMap creates a mapping from chunk hash to blob information

internal/vaultik/restore_interrupt_test.go

@@ -74,8 +74,7 @@ func TestRestoreCleansTempDirOnInterrupt(t *testing.T) {
 	buildLocalityFixture(t, fs, dataDir)
 
 	cfg, storer, snapshotID := setupLocalityBackup(
-		context.Background(), t, fs, dataDir, storeDir, dbPath,
-		localitySourceBytes)
+		context.Background(), t, fs, dataDir, storeDir, dbPath)
 
 	// Point the "" temp paths (the blob cache directory and the
 	// snapshot-database directory) at a private directory so the test can

internal/vaultik/restore_locality_test.go

@@ -63,10 +63,6 @@ type localityCopy struct {
 	data []byte
 }
 
-// localitySourceBytes is the size of each source file of the locality
-// fixture.
-const localitySourceBytes = 1024 * 1024
-
 // buildLocalityFixture writes the adversarial source layout described
 // in TestRestoreLocalityAndReadAt: 15 sources of 1 MiB each (which the
 // backup packs into 3 blobs of 5 chunks) plus 9 interleaved-name copies
@@ -77,6 +73,7 @@ func buildLocalityFixture(
 	t.Helper()
 
 	const (
+		srcBytes   = 1024 * 1024
 		srcCount   = 15
 		blobsCount = 3
 		perBlob    = srcCount / blobsCount
@@ -86,7 +83,7 @@ func buildLocalityFixture(
 	for i := range srcCount {
 		s := &localitySource{
 			path: fmt.Sprintf("src-%03d.bin", i+1),
-			data: randomBytes(t, localitySourceBytes),
+			data: randomBytes(t, srcBytes),
 		}
 		sources[i] = s
 		require.NoError(t, afero.WriteFile(
@@ -118,20 +115,19 @@ func buildLocalityFixture(
 
 // setupLocalityBackup runs the backup half of the locality test: a
 // snapshot of dataDir into a file storer with sizes tuned so 15 one-chunk
-// files of srcBytes pack into 3 blobs. The index database is closed
-// before returning so the restore half runs from remote bytes only.
+// files pack into 3 blobs. The index database is closed before returning
+// so the restore half runs from remote bytes only.
 func setupLocalityBackup(
 	ctx context.Context, t *testing.T, fs afero.Fs,
-	dataDir, storeDir, dbPath string, srcBytes int64,
+	dataDir, storeDir, dbPath string,
 ) (*config.Config, *storage.FileStorer, string) {
 	t.Helper()
 
-	// An average chunk size of four times srcBytes makes the minimum
-	// chunk srcBytes, so each source file becomes one chunk. A blob limit
-	// of five times srcBytes packs exactly 5 chunks per blob, yielding 3
-	// blobs from 15 source files.
-	chunkSize := 4 * srcBytes
-	maxBlobSize := 5 * srcBytes
+	// chunkSize avg = 4 MiB makes minSize = 1 MiB, so a 1 MiB file
+	// becomes one chunk. maxBlobSize = 5 MiB packs exactly 5 chunks
+	// per blob, yielding 3 blobs from 15 source files.
+	chunkSize := int64(4 * 1024 * 1024)
+	maxBlobSize := int64(5 * 1024 * 1024)
 
 	storer, err := storage.NewFileStorer(storeDir)
 	require.NoError(t, err)
@@ -212,7 +208,7 @@ func TestRestoreLocalityAndReadAt(t *testing.T) {
 	ctx := context.Background()
 
 	cfg, storer, snapshotID := setupLocalityBackup(
-		ctx, t, fs, dataDir, storeDir, dbPath, localitySourceBytes)
+		ctx, t, fs, dataDir, storeDir, dbPath)
 
 	// Wrap the storer so we can count downloads per blob key.
 	counter := newCountingStorer(storer)

internal/vaultik/restore_plan.go

@@ -31,8 +31,7 @@ var (
 //     with no further downloads.
 //   - blobFiles: for each blob, the set of pending files referencing
 //     it. Used to short-circuit "when this blob lands, which files
-//     become ready" without a global scan, and by the sweeper to tell
-//     whether a cached blob is still needed.
+//     become ready" without a global scan.
 type restorePlan struct {
 	fileBlobs map[types.FileID]map[string]struct{}
 	blobFiles map[string]map[types.FileID]struct{}
@@ -238,12 +237,6 @@ func (p *restorePlan) filesReferencingBlob(blobHash string) []types.FileID {
 	return out
 }
 
-// pendingFileUsesBlob reports whether any pending file references the
-// named blob, whether or not the blob is cached.
-func (p *restorePlan) pendingFileUsesBlob(blobHash string) bool {
-	return len(p.blobFiles[blobHash]) > 0
-}
-
 // hasPending reports whether any unfinished files remain.
 func (p *restorePlan) hasPending() bool {
 	return len(p.fileBlobs) > 0

internal/vaultik/restore_plan_test.go

@@ -63,6 +63,15 @@ func TestRunRestoreLoopFailsOnAbandonedFiles(t *testing.T) {
 
 	t.Cleanup(func() { _ = cache.Close() })
 
+	v := &Vaultik{ctx: ctx}
+	session := &restoreSession{
+		v:       v,
+		ctx:     ctx,
+		repos:   repos,
+		sweeper: newRestoreSweeper(ctx, repos, cache, 1),
+		result:  &RestoreResult{},
+	}
+
 	// A file that is still pending but whose uncached-blob set is empty
 	// and which was never queued as ready: the loop can neither restore
 	// nor download it. This is the abandonment the guard must catch.
@@ -74,15 +83,6 @@ func TestRunRestoreLoopFailsOnAbandonedFiles(t *testing.T) {
 		cached:    map[string]struct{}{},
 	}
 
-	v := &Vaultik{ctx: ctx}
-	session := &restoreSession{
-		v:       v,
-		ctx:     ctx,
-		repos:   repos,
-		sweeper: newRestoreSweeper(plan, cache, 1),
-		result:  &RestoreResult{},
-	}
-
 	err = v.runRestoreLoop(session, plan, map[types.FileID]*database.File{}, 0)
 	require.ErrorIs(t, err, errRestoreIncomplete)
 }

internal/vaultik/restore_sweeper.go

@@ -1,30 +1,46 @@
 package vaultik
 
-// restoreSweeper frees cached blobs once no file still to be restored in
-// this run needs them. It works as follows:
+import (
+	"context"
+	"fmt"
+
+	"sneak.berlin/go/vaultik/internal/database"
+	"sneak.berlin/go/vaultik/internal/log"
+)
+
+// restoreSweeper frees cached blobs once all files that reference any of
+// their chunks have been restored. It works as follows:
 //
-//  1. After each chunk is restored, chunkRestored accumulates a running
+//  1. Callers add a file's ID to an in-memory restored set via
+//     fileRestored once the file is fully written to disk.
+//  2. After each chunk is restored, chunkRestored accumulates a running
 //     byte count.
-//  2. When the accumulator crosses a threshold (one hundredth of the
+//  3. When the accumulator crosses a threshold (one hundredth of the
 //     configured blob size — so a sweep runs about a hundred times per
 //     blob's worth of restored bytes), the sweeper iterates every key in
-//     the cache and deletes each blob that the restore plan no longer
-//     needs.
+//     the cache. For each cached blob it asks the DB which files
+//     reference any chunk in that blob, then compares that list against
+//     the in-memory restored set. If any referencing file is missing
+//     from the set the blob is kept; otherwise the cache entry is
+//     deleted.
 //
-// The plan drops a file once it is restored or has failed, and holds
-// only the files this run restores, so files outside the requested paths
-// never keep a blob.
+// All DB reads happen against the snapshot's temporary metadata DB,
+// which is local, indexed, and not under contention — the queries are
+// cheap and run at most once per blob per sweep interval.
 type restoreSweeper struct {
-	plan       *restorePlan
+	ctx        context.Context //nolint:containedctx // ctx bound at construction by design
+	repos      *database.Repositories
 	cache      *blobDiskCache
 	threshold  int64
 	bytesAccum int64
+	restored   map[string]struct{}
 }
 
 // newRestoreSweeper returns a sweeper that triggers eviction every
 // `threshold` bytes restored. Callers should pass blob_size_limit/100.
 func newRestoreSweeper(
-	plan *restorePlan,
+	ctx context.Context,
+	repos *database.Repositories,
 	cache *blobDiskCache,
 	threshold int64,
 ) *restoreSweeper {
@@ -33,12 +49,21 @@ func newRestoreSweeper(
 	}
 
 	return &restoreSweeper{
-		plan:      plan,
+		ctx:       ctx,
+		repos:     repos,
 		cache:     cache,
 		threshold: threshold,
+		restored:  make(map[string]struct{}),
 	}
 }
 
+// fileRestored records a file as fully restored. After this call, any
+// blob whose only remaining references come from files in the restored
+// set may be evicted on the next sweep.
+func (s *restoreSweeper) fileRestored(fileID string) {
+	s.restored[fileID] = struct{}{}
+}
+
 // chunkRestored accounts n bytes against the sweep threshold and runs a
 // sweep if the threshold has been crossed since the last sweep.
 func (s *restoreSweeper) chunkRestored(n int64) {
@@ -51,11 +76,60 @@ func (s *restoreSweeper) chunkRestored(n int64) {
 	s.sweep()
 }
 
-// sweep deletes every cached blob that no pending file references.
+// sweep deletes any cached blob whose chunks are no longer referenced
+// by an unrestored file. Per-blob DB failures are logged and the blob
+// is kept — we'd rather hold a blob longer than risk a re-download.
 func (s *restoreSweeper) sweep() {
 	for _, blobHash := range s.cache.Keys() {
-		if !s.plan.pendingFileUsesBlob(blobHash) {
+		needed, err := s.blobStillNeeded(blobHash)
+		if err != nil {
+			log.Debug("sweeper referencing-files query failed",
+				"blob_hash", blobHash[:16], "error", err)
+
+			continue
+		}
+
+		if !needed {
 			s.cache.Delete(blobHash)
 		}
 	}
 }
+
+// blobStillNeeded returns true if any file that references a chunk in
+// this blob has not yet been restored. On any error the function
+// returns true — keeping the blob is always the safe answer because we
+// can't prove we're done with it.
+func (s *restoreSweeper) blobStillNeeded(blobHash string) (bool, error) {
+	rows, err := s.repos.DB().Conn().QueryContext(s.ctx, `
+		SELECT DISTINCT fc.file_id
+		FROM file_chunks fc
+		JOIN blob_chunks bc ON bc.chunk_hash = fc.chunk_hash
+		JOIN blobs b ON b.id = bc.blob_id
+		WHERE b.blob_hash = ?
+	`, blobHash)
+	if err != nil {
+		return true, fmt.Errorf("querying referencing files: %w", err)
+	}
+
+	defer func() { _ = rows.Close() }()
+
+	for rows.Next() {
+		var fileID string
+
+		err := rows.Scan(&fileID)
+		if err != nil {
+			return true, fmt.Errorf("scanning file_id: %w", err)
+		}
+
+		if _, ok := s.restored[fileID]; !ok {
+			return true, nil
+		}
+	}
+
+	err = rows.Err()
+	if err != nil {
+		return true, err
+	}
+
+	return false, nil
+}

internal/vaultik/restore_sweeper_test.go

@@ -1,163 +0,0 @@
-package vaultik //nolint:testpackage // reads the restore blob cache's peak size
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"path/filepath"
-	"testing"
-
-	"github.com/spf13/afero"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/vaultik/internal/config"
-	"sneak.berlin/go/vaultik/internal/log"
-	"sneak.berlin/go/vaultik/internal/storage"
-	"sneak.berlin/go/vaultik/internal/ui"
-)
-
-// TestRestoreFreesBlobsNoPendingFileNeeds asserts that the restore cache
-// frees a blob once no file still to be restored in this run needs it.
-// Every original file has a copy with the same content, so every blob
-// holds chunks of copies: a restore that leaves the copies out of its
-// paths, or fails on them, must not keep the blobs for them.
-func TestRestoreFreesBlobsNoPendingFileNeeds(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	// Small files keep the backup and both restores quick.
-	const fileBytes = 16 * 1024
-
-	fs := afero.NewOsFs()
-	tempDir := t.TempDir()
-
-	dataDir := filepath.Join(tempDir, "source")
-	originalsDir := filepath.Join(dataDir, "originals")
-	copiesDir := filepath.Join(dataDir, "copies")
-	storeDir := filepath.Join(tempDir, "remote")
-	dbPath := filepath.Join(tempDir, "index.sqlite")
-
-	originals := writeFilesWithCopies(t, fs, originalsDir, copiesDir, fileBytes)
-
-	ctx := context.Background()
-
-	cfg, storer, snapshotID := setupLocalityBackup(
-		ctx, t, fs, dataDir, storeDir, dbPath, fileBytes)
-
-	t.Run("restore by path", func(t *testing.T) {
-		t.Parallel()
-
-		restoreDir := filepath.Join(tempDir, "by-path")
-
-		peak, err := restorePeakCachedBlobs(ctx, t, fs, cfg, storer,
-			&RestoreOptions{
-				SnapshotID: snapshotID,
-				TargetDir:  restoreDir,
-				Paths:      []string{originalsDir},
-			})
-		require.NoError(t, err)
-
-		requireRestoredFiles(t, fs, restoreDir, originals)
-		assert.LessOrEqualf(t, peak, 1,
-			"peak cached blobs was %d; blobs were kept for unselected files",
-			peak)
-	})
-
-	t.Run("restore with failed files", func(t *testing.T) {
-		t.Parallel()
-
-		restoreDir := filepath.Join(tempDir, "with-failures")
-
-		// A regular file where the copies directory belongs makes every
-		// copy fail to restore.
-		blocker := filepath.Join(restoreDir, copiesDir)
-		require.NoError(t, fs.MkdirAll(filepath.Dir(blocker), 0o755))
-		require.NoError(t, afero.WriteFile(fs, blocker, nil, 0o644))
-
-		peak, err := restorePeakCachedBlobs(ctx, t, fs, cfg, storer,
-			&RestoreOptions{
-				SnapshotID: snapshotID,
-				TargetDir:  restoreDir,
-				SkipErrors: true,
-			})
-		require.ErrorIs(t, err, errFilesFailedRestore)
-
-		requireRestoredFiles(t, fs, restoreDir, originals)
-		assert.LessOrEqualf(t, peak, 1,
-			"peak cached blobs was %d; blobs were kept for failed files", peak)
-	})
-}
-
-// writeFilesWithCopies writes 15 random files of fileBytes into
-// originalsDir and a copy of each into copiesDir. With
-// setupLocalityBackup given the same size, each file is one chunk and the
-// 15 chunks fill 3 blobs. Returns the originals' content by path.
-func writeFilesWithCopies(
-	t *testing.T, fs afero.Fs, originalsDir, copiesDir string, fileBytes int,
-) map[string][]byte {
-	t.Helper()
-
-	const fileCount = 15
-
-	require.NoError(t, fs.MkdirAll(originalsDir, 0o755))
-	require.NoError(t, fs.MkdirAll(copiesDir, 0o755))
-
-	originals := make(map[string][]byte, fileCount)
-
-	for i := range fileCount {
-		name := fmt.Sprintf("file-%02d.bin", i)
-		data := randomBytes(t, fileBytes)
-		original := filepath.Join(originalsDir, name)
-		originals[original] = data
-
-		require.NoError(t, afero.WriteFile(fs, original, data, 0o644))
-		require.NoError(t, afero.WriteFile(
-			fs, filepath.Join(copiesDir, name), data, 0o644))
-	}
-
-	return originals
-}
-
-// requireRestoredFiles requires every file in want to have been restored
-// under restoreDir with its content intact.
-func requireRestoredFiles(
-	t *testing.T, fs afero.Fs, restoreDir string, want map[string][]byte,
-) {
-	t.Helper()
-
-	for path, data := range want {
-		got, err := afero.ReadFile(fs, filepath.Join(restoreDir, path))
-		require.NoErrorf(t, err, "file missing after restore: %s", path)
-		require.Equalf(t, data, got, "byte mismatch for %s", path)
-	}
-}
-
-// restorePeakCachedBlobs runs a restore and returns the most blobs its
-// cache held at once, together with the restore's error.
-func restorePeakCachedBlobs(
-	ctx context.Context, t *testing.T, fs afero.Fs,
-	cfg *config.Config, storer storage.Storer, opts *RestoreOptions,
-) (int, error) {
-	t.Helper()
-
-	var cache *blobDiskCache
-
-	v := &Vaultik{
-		Config:  cfg,
-		Storage: storer,
-		Fs:      fs,
-		Stdout:  io.Discard,
-		Stderr:  io.Discard,
-		UI:      ui.NewWithColor(io.Discard, false),
-		restoreCacheObserver: func(c *blobDiskCache) {
-			cache = c
-		},
-	}
-	v.SetContext(ctx)
-
-	err := v.Restore(opts)
-
-	require.NotNil(t, cache, "restoreCacheObserver must fire during restore")
-
-	return cache.PeakLen(), err
-}

internal/vaultik/restore_unmatched_path_test.go

@@ -1,202 +0,0 @@
-package vaultik_test
-
-import (
-	"bytes"
-	"context"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/spf13/afero"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/vaultik/internal/config"
-	"sneak.berlin/go/vaultik/internal/database"
-	"sneak.berlin/go/vaultik/internal/log"
-	"sneak.berlin/go/vaultik/internal/storage"
-	"sneak.berlin/go/vaultik/internal/storage/faultstore"
-	"sneak.berlin/go/vaultik/internal/ui"
-	"sneak.berlin/go/vaultik/internal/vaultik"
-)
-
-// These tests cover https://git.eeqj.de/sneak/vaultik/issues/309: a path
-// given to restore that matches nothing in the snapshot is named in a
-// warning and makes the restore fail, after the paths that do match are
-// restored.
-
-func TestRestoreNamesUnmatchedPathAndRestoresTheMatchingOne(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	fs := afero.NewOsFs()
-	tempDir := t.TempDir()
-	dataDir := filepath.Join(tempDir, "src")
-	storeDir := filepath.Join(tempDir, "remote")
-	restoreDir := filepath.Join(tempDir, "restored")
-	dbPath := filepath.Join(tempDir, "index.sqlite")
-
-	ctx := context.Background()
-	cfg := faultTestConfig()
-	files := writeFaultSourceTree(t, fs, dataDir)
-
-	store, err := storage.NewFileStorer(storeDir)
-	require.NoError(t, err)
-
-	db, err := database.New(ctx, dbPath)
-	require.NoError(t, err)
-
-	id := fullFaultBackup(ctx, t, fs, store, cfg,
-		database.NewRepositories(db), dataDir, dbPath, "unmatched")
-	require.NoError(t, db.Close())
-
-	matched := filepath.Join(dataDir, "small.txt")
-	unmatched := filepath.Join(dataDir, "typo.txt")
-
-	var out bytes.Buffer
-
-	v := newReaderVaultik(ctx, cfg, store, nil, fs)
-	v.UI = ui.NewWithColor(&out, false)
-
-	err = v.Restore(&vaultik.RestoreOptions{
-		SnapshotID: id,
-		TargetDir:  restoreDir,
-		Paths:      []string{matched, unmatched},
-	})
-
-	require.Error(t, err, "a path that matches nothing must fail the restore")
-	assert.Contains(t, out.String(), unmatched,
-		"the path that matches nothing must be named")
-	assert.NotContains(t, out.String(), matched,
-		"the path that matches must not be reported")
-
-	got, err := afero.ReadFile(fs, filepath.Join(restoreDir, matched))
-	require.NoError(t, err, "the path that matches must still be restored")
-	assert.Equal(t, files[matched], got)
-}
-
-// When no requested path matches, nothing is restored and each path is
-// named. One path is relative. The other goes through the symlink that
-// is the snapshot's configured path, while the entries are stored under
-// the directory the symlink points to.
-func TestRestoreNamesEveryPathWhenNothingMatches(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	const snapshotName = "linked"
-
-	fs := afero.NewOsFs()
-	tempDir := t.TempDir()
-	dataDir := filepath.Join(tempDir, "src")
-	linkDir := filepath.Join(tempDir, "srclink")
-	storeDir := filepath.Join(tempDir, "remote")
-	restoreDir := filepath.Join(tempDir, "restored")
-	dbPath := filepath.Join(tempDir, "index.sqlite")
-
-	ctx := context.Background()
-
-	writeFaultSourceTree(t, fs, dataDir)
-	require.NoError(t, os.Symlink(dataDir, linkDir))
-
-	cfg := faultTestConfig()
-	cfg.IndexPath = dbPath
-	cfg.ChunkSize = config.Size(faultChunkSize)
-	cfg.Snapshots = map[string]config.SnapshotConfig{
-		snapshotName: {Paths: []string{linkDir}},
-	}
-
-	store, err := storage.NewFileStorer(storeDir)
-	require.NoError(t, err)
-
-	db, err := database.New(ctx, dbPath)
-	require.NoError(t, err)
-
-	repos := database.NewRepositories(db)
-	v := newBackupVaultik(ctx, cfg, store, repos, db, fs)
-
-	require.NoError(t, backUp(v, snapshotName))
-
-	id := localSnapshotID(ctx, t, repos, snapshotName)
-	require.NoError(t, db.Close())
-
-	throughLink := filepath.Join(linkDir, "sub")
-	relative := strings.TrimPrefix(filepath.Join(dataDir, "small.txt"), "/")
-
-	var out bytes.Buffer
-
-	reader := newReaderVaultik(ctx, cfg, store, nil, fs)
-	reader.UI = ui.NewWithColor(&out, false)
-
-	err = reader.Restore(&vaultik.RestoreOptions{
-		SnapshotID: id,
-		TargetDir:  restoreDir,
-		Paths:      []string{throughLink, relative},
-	})
-
-	require.Error(t, err, "a restore that matches nothing must fail")
-	assert.Contains(t, out.String(), throughLink,
-		"the path through the symlink must be named")
-	assert.Contains(t, out.String(), relative,
-		"the relative path must be named")
-
-	_, err = fs.Stat(restoreDir)
-	assert.True(t, os.IsNotExist(err), "nothing must be restored")
-}
-
-// Without --skip-errors a damaged blob stops the restore part way. The
-// path that matches nothing must still be named.
-func TestRestoreNamesUnmatchedPathWhenADamagedBlobStopsIt(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	fs := afero.NewOsFs()
-	tempDir := t.TempDir()
-	dataDir := filepath.Join(tempDir, "src")
-	storeDir := filepath.Join(tempDir, "remote")
-	restoreDir := filepath.Join(tempDir, "restored")
-	dbPath := filepath.Join(tempDir, "index.sqlite")
-
-	ctx := context.Background()
-	cfg := faultTestConfig()
-
-	writeFaultSourceTree(t, fs, dataDir)
-
-	inner, err := storage.NewFileStorer(storeDir)
-	require.NoError(t, err)
-
-	db, err := database.New(ctx, dbPath)
-	require.NoError(t, err)
-
-	id := fullFaultBackup(ctx, t, fs, inner, cfg,
-		database.NewRepositories(db), dataDir, dbPath, "damaged")
-	require.NoError(t, db.Close())
-
-	damaged := faultstore.New(inner)
-	damaged.OnGet = func(key string) faultstore.GetFault {
-		if strings.HasPrefix(key, "blobs/") {
-			return faultstore.GetCorrupt
-		}
-
-		return faultstore.GetNormal
-	}
-
-	matched := filepath.Join(dataDir, "small.txt")
-	unmatched := filepath.Join(dataDir, "typo.txt")
-
-	var out bytes.Buffer
-
-	v := newReaderVaultik(ctx, cfg, damaged, nil, fs)
-	v.UI = ui.NewWithColor(&out, false)
-
-	err = v.Restore(&vaultik.RestoreOptions{
-		SnapshotID: id,
-		TargetDir:  restoreDir,
-		Paths:      []string{matched, unmatched},
-	})
-
-	require.Error(t, err, "a damaged blob must stop the restore")
-	assert.Contains(t, err.Error(), "blob",
-		"the restore must stop on the damaged blob")
-	assert.Contains(t, out.String(), unmatched,
-		"the path that matches nothing must be named")
-}

internal/vaultik/snapshot.go

@@ -574,7 +574,7 @@ func (v *Vaultik) PurgeSnapshotsWithOptions(opts *SnapshotPurgeOptions) error {
 
 	if len(toDelete) == 0 {
 		if !opts.Quiet {
-			v.UI.Infof("No snapshots to delete.")
+			v.printlnStdout("No snapshots to delete")
 		}
 
 		return nil
@@ -627,23 +627,24 @@ func selectSnapshotsToPurge(
 }
 
 // confirmAndExecutePurge shows deletion candidates, confirms with the
-// user, and deletes snapshots.
+// user, and deletes snapshots. It stops with an error at the first
+// snapshot it cannot delete.
 func (v *Vaultik) confirmAndExecutePurge(
 	toDelete []SnapshotInfo, force, quiet bool,
 ) error {
-	// Confirm unless --force is used. The list, the prompt and its answer
-	// bypass the UI: they are an interactive exchange the operator must
-	// see, so --quiet does not silence them.
-	if !force {
+	if !quiet {
 		v.stdoutf("The following snapshots will be deleted:\n\n")
 
 		for _, snap := range toDelete {
 			v.stdoutf("  %s (%s, %s)\n",
 				snap.ID,
-				snap.Timestamp.Format(time.DateTime),
+				snap.Timestamp.Format("2006-01-02 15:04:05"),
 				ubytes(snap.CompressedSize))
 		}
+	}
 
+	// Confirm unless --force is used
+	if !force {
 		v.stdoutf("\nDelete %d snapshot(s)? [y/N] ", len(toDelete))
 
 		var confirm string
@@ -661,16 +662,7 @@ func (v *Vaultik) confirmAndExecutePurge(
 			return nil
 		}
 	} else if !quiet {
-		v.UI.Infof("The following snapshots will be deleted:")
-
-		for _, snap := range toDelete {
-			v.UI.Detailf("%s (%s, %s)",
-				v.UI.Snapshot(snap.ID.String()),
-				snap.Timestamp.Format(time.DateTime),
-				ubytes(snap.CompressedSize))
-		}
-
-		v.UI.Infof("Deleting %d snapshot(s) (--force specified).", len(toDelete))
+		v.stdoutf("\nDeleting %d snapshot(s) (--force specified)\n", len(toDelete))
 	}
 
 	// Delete snapshots (both local and remote)
@@ -678,8 +670,8 @@ func (v *Vaultik) confirmAndExecutePurge(
 		snapshotID := snap.ID.String()
 		log.Info("Deleting snapshot", "id", snapshotID)
 
-		// Stop before the remote delete, so a snapshot still in the local
-		// index keeps its metadata on the destination store.
+		// Stop before the remote delete: a snapshot still in the local
+		// index must keep its metadata on the destination store.
 		err := v.deleteSnapshotFromLocalDB(snapshotID)
 		if err != nil {
 			return fmt.Errorf("deleting snapshot %s from local index: %w", snapshotID, err)
@@ -703,9 +695,9 @@ func (v *Vaultik) confirmAndExecutePurge(
 	}
 
 	if !quiet {
-		v.UI.Infof("Deleted %d snapshot(s).", len(toDelete))
-		v.UI.Noticef("Run '%s' to clean up unreferenced remote blobs.",
-			pruneCommandHint)
+		v.stdoutf("Deleted %d snapshot(s)\n", len(toDelete))
+		v.printlnStdout(
+			"\nNote: Run 'vaultik prune' to clean up unreferenced remote blobs.")
 	}
 
 	return nil
@@ -1078,7 +1070,7 @@ func (v *Vaultik) CleanupLocalSnapshots(opts *PruneOptions) error {
 			log.Info("Removing stale local snapshot record", "snapshot_id", id)
 
 			if !opts.JSON {
-				v.UI.Infof("Removing stale local record: %s.", v.UI.Snapshot(id))
+				v.stdoutf("Removing stale local record: %s\n", id)
 			}
 
 			err = v.deleteSnapshotFromLocalDB(id)
@@ -1101,9 +1093,9 @@ func (v *Vaultik) CleanupLocalSnapshots(opts *PruneOptions) error {
 	}
 
 	if removed == 0 {
-		v.UI.Infof("No stale local snapshots found.")
+		v.printlnStdout("No stale local snapshots found.")
 	} else {
-		v.UI.Infof("Removed %d stale local snapshot record(s).", removed)
+		v.stdoutf("Removed %d stale local snapshot record(s).\n", removed)
 	}
 
 	return nil
@@ -1228,11 +1220,9 @@ const snapshotRemoveCommandHint = "vaultik snapshot remove"
 // destination store. Blobs are NOT touched: removing a snapshot's
 // blobs requires reading every remaining remote manifest (the remote
 // may hold snapshots this host doesn't know about), which is what
-// `vaultik prune` is for — when metadata was removed from the
-// destination store, the text output names the prune invocation to run
-// as a follow-up. When removing the metadata fails, a snapshot in the
-// local index is still removed from it, with a warning; a snapshot
-// only on the destination store is an error.
+// `vaultik prune` is for — the command prints the prune invocation to
+// run as a follow-up. When the remote is unreachable the command still
+// completes the local-DB removal and warns.
 func (v *Vaultik) RemoveSnapshot(
 	snapshotID string, opts *RemoveOptions,
 ) (*RemoveResult, error) {
@@ -1267,10 +1257,8 @@ func (v *Vaultik) RemoveSnapshot(
 		}
 	}
 
-	result.RemoteRemoved, err = v.removeSnapshotRemote(
-		snapshotID, inLocalIndex, opts)
-	if err != nil {
-		return result, err
+	if !opts.LocalOnly {
+		result.RemoteRemoved = v.removeSnapshotRemote(snapshotID, opts)
 	}
 
 	if v.SnapshotManager != nil {
@@ -1286,15 +1274,14 @@ func (v *Vaultik) RemoveSnapshot(
 	}
 
 	if inLocalIndex {
-		v.UI.Infof("Removed snapshot '%s' from local database.",
-			v.UI.Snapshot(snapshotID))
+		v.stdoutf("Removed snapshot '%s' from local database\n", snapshotID)
 	}
 
 	if result.RemoteRemoved {
-		v.UI.Infof("Removed snapshot metadata from remote storage.")
-		v.UI.Noticef("The removed snapshot's blobs remain on the remote. "+
+		v.printlnStdout("Removed snapshot metadata from remote storage")
+		v.stdoutf("\nNote: The removed snapshot's blobs remain on the remote. "+
 			"Run '%s' to delete any blobs no longer referenced by any "+
-			"remaining remote snapshot.", pruneCommandHint)
+			"remaining remote snapshot.\n", pruneCommandHint)
 	}
 
 	return result, nil
@@ -1350,23 +1337,21 @@ func (v *Vaultik) removeSnapshotDryRun(
 		return result, v.outputRemoveJSON(result)
 	}
 
-	v.UI.Infof("Would remove snapshot: %s.", v.UI.Snapshot(snapshotID))
+	v.stdoutf("Would remove snapshot: %s\n", snapshotID)
 
 	if !opts.LocalOnly {
-		v.UI.Infof("Would also remove snapshot metadata from " +
-			"remote storage (blobs untouched).")
+		v.printlnStdout("Would also remove snapshot metadata from " +
+			"remote storage (blobs untouched)")
 	}
 
-	v.UI.Noticef("Dry run: no changes made.")
+	v.printlnStdout("[Dry run - no changes made]")
 
 	return result, nil
 }
 
 // confirmRemoveSnapshot prompts for confirmation before removing a
 // snapshot. Returns false (treating EOF/read errors as "no") unless the
-// user answers "y". The prompt and its answer bypass the UI: they are an
-// interactive exchange the operator must see, so --quiet does not
-// silence them.
+// user answers "y".
 func (v *Vaultik) confirmRemoveSnapshot(snapshotID string, opts *RemoveOptions) bool {
 	if opts.LocalOnly {
 		v.stdoutf("Remove snapshot '%s' from local database "+
@@ -1395,33 +1380,19 @@ func (v *Vaultik) confirmRemoveSnapshot(snapshotID string, opts *RemoveOptions)
 }
 
 // removeSnapshotRemote strips the snapshot's metadata from the
-// destination store. It returns true only when the delete finished
-// without an error and removed at least one object; under LocalOnly it
-// does nothing. When the snapshot is only on the destination store, a
-// failure is returned as an error, because that removal is all the
-// command does. When the snapshot was in the local index, its removal
-// there has already happened, so a failure is only a warning telling the
-// user to run `vaultik snapshot remove` for the snapshot again once the
-// destination store is reachable (`vaultik prune` never removes snapshot
-// metadata).
-func (v *Vaultik) removeSnapshotRemote(
-	snapshotID string, inLocalIndex bool, opts *RemoveOptions,
-) (bool, error) {
-	if opts.LocalOnly {
-		return false, nil
-	}
-
+// destination store, warning and proceeding on failure: the local-DB
+// removal has already happened, so the user is told the remote half
+// didn't finish and to run `vaultik snapshot remove` for the snapshot
+// again once the destination store is reachable (`vaultik prune` never
+// removes snapshot metadata). Returns true when the remote removal
+// succeeded and deleted something.
+func (v *Vaultik) removeSnapshotRemote(snapshotID string, opts *RemoveOptions) bool {
 	log.Info("Removing snapshot metadata from remote storage",
 		"snapshot_id", snapshotID)
 
 	remoteKey := snapshot.RemoteSnapshotKey(snapshotID)
 
 	deleted, err := v.deleteRemoteSnapshotByKey(remoteKey)
-	if err != nil && !inLocalIndex {
-		return false, fmt.Errorf(
-			"removing snapshot metadata from destination store: %w", err)
-	}
-
 	if err != nil {
 		log.Warn("Could not remove snapshot metadata from remote storage; "+
 			"run '"+snapshotRemoveCommandHint+"' with the snapshot's ID "+
@@ -1436,10 +1407,10 @@ func (v *Vaultik) removeSnapshotRemote(
 				err, snapshotRemoveCommandHint, snapshotID)
 		}
 
-		return false, nil
+		return false
 	}
 
-	return deleted > 0, nil
+	return deleted > 0
 }
 
 // RemoveAllSnapshots removes every snapshot known to the local
@@ -1486,7 +1457,7 @@ func (v *Vaultik) RemoveAllSnapshots(opts *RemoveOptions) (*RemoveResult, error)
 
 	if len(localSnaps) == 0 && len(orphanRemoteKeys) == 0 {
 		if !opts.JSON {
-			v.UI.Infof("No snapshots found.")
+			v.printlnStdout("No snapshots found")
 		}
 
 		return &RemoveResult{}, nil
@@ -1591,27 +1562,27 @@ func (v *Vaultik) handleRemoveAllDryRun(
 	}
 
 	if !opts.JSON {
-		v.UI.Infof("Would remove %d local snapshot(s):", len(localSnaps))
+		v.stdoutf("Would remove %d local snapshot(s):\n", len(localSnaps))
 
 		for _, id := range localSnaps {
-			v.UI.Detailf("%s", v.UI.Snapshot(id))
+			v.stdoutf("  %s\n", id)
 		}
 
 		if !opts.LocalOnly {
 			if len(orphanRemoteKeys) > 0 {
-				v.UI.Infof("Would also remove %d orphan remote snapshot key(s):",
+				v.stdoutf("Would also remove %d orphan remote snapshot key(s):\n",
 					len(orphanRemoteKeys))
 
 				for _, key := range orphanRemoteKeys {
-					v.UI.Detailf("%s", key)
+					v.stdoutf("  %s\n", key)
 				}
 			} else {
-				v.UI.Infof("Would also remove snapshot metadata from " +
-					"remote storage (blobs untouched).")
+				v.printlnStdout("Would also remove snapshot metadata from " +
+					"remote storage (blobs untouched)")
 			}
 		}
 
-		v.UI.Noticef("Dry run: no changes made.")
+		v.printlnStdout("[Dry run - no changes made]")
 	}
 
 	if opts.JSON {
@@ -1660,10 +1631,10 @@ func (v *Vaultik) executeRemoveAll(
 		return result, v.outputRemoveJSON(result)
 	}
 
-	v.UI.Infof("Removed %d snapshot(s).", len(result.SnapshotsRemoved))
+	v.stdoutf("Removed %d snapshot(s)\n", len(result.SnapshotsRemoved))
 
 	if !opts.LocalOnly && result.RemoteRemoved {
-		v.UI.Infof("Removed snapshot metadata from remote storage.")
+		v.printlnStdout("Removed snapshot metadata from remote storage")
 	}
 
 	return result, nil
@@ -1920,17 +1891,13 @@ func (v *Vaultik) PruneDatabase() (*PruneResult, error) {
 	snapshotsRemain := countDiff(snapshotCountBefore, &result.SnapshotsDeleted)
 
 	v.UI.Completef("Pruned local index database.")
-	v.UI.Detailf("Incomplete snapshots: %s removed "+
-		"(total snapshots left in the local index: %s).",
+	v.UI.Detailf("Incomplete snapshots: %s removed (%s remain).",
 		countText(&result.SnapshotsDeleted), countText(snapshotsRemain))
-	v.UI.Detailf("Orphaned files: %s removed "+
-		"(total files left in the local index: %s).",
+	v.UI.Detailf("Orphaned files: %s removed (%s remain).",
 		countText(result.FilesDeleted), countText(fileCountAfter))
-	v.UI.Detailf("Orphaned chunks: %s removed "+
-		"(total chunks left in the local index: %s).",
+	v.UI.Detailf("Orphaned chunks: %s removed (%s remain).",
 		countText(result.ChunksDeleted), countText(chunkCountAfter))
-	v.UI.Detailf("Orphaned blobs: %s removed "+
-		"(total blobs left in the local index: %s).",
+	v.UI.Detailf("Orphaned blobs: %s removed (%s remain).",
 		countText(result.BlobsDeleted), countText(blobCountAfter))
 
 	return result, nil

internal/vaultik/snapshot_list.go

@@ -61,9 +61,7 @@ const tabPadding = 3
 // attempt is made to recover or fabricate the human ID.
 //
 // Snapshots in the local index with no counterpart on the destination
-// store are reported as drift below the table, unless the local index
-// is bound to a different destination than the configured one: that is
-// reported instead.
+// store are reported as drift below the table.
 //
 // If remote listing fails (unmounted volume, permission denied,
 // network), we degrade to local-only with a warning. List never fails
@@ -105,26 +103,7 @@ func (v *Vaultik) ListSnapshots(jsonOutput bool) error {
 		return snapshots[i].Timestamp.After(snapshots[j].Timestamp)
 	})
 
-	stored, configured, err := v.storageBinding()
-	if err != nil {
-		return err
-	}
-
-	// A local index bound to another destination describes that one, so
-	// its records are expected to be missing here, and prune refuses to
-	// run. The binding is reported instead of advising prune.
-	boundElsewhere := stored != "" && stored != configured
-
 	if jsonOutput {
-		// stdout holds only the document, so this goes to the logger.
-		if boundElsewhere {
-			log.Warn("Local index is bound to a different backup "+
-				"destination; to proceed, revert storage_url (or the s3.* "+
-				"endpoint, bucket and prefix) to the bound destination, "+
-				"or run 'vaultik database delete'",
-				"bound_to", stored, "configured", configured)
-		}
-
 		if remoteErr == nil {
 			v.reportJSONListingLimits(listing)
 		}
@@ -146,13 +125,8 @@ func (v *Vaultik) ListSnapshots(jsonOutput bool) error {
 		}
 	}
 
-	if boundElsewhere {
-		v.UI.Warningf("%v\n%s", errStorageBindingMismatch,
-			buildBindingMismatchMessage(stored, configured))
-	}
-
 	if remoteErr == nil {
-		v.reportListDrift(snapshots, listing, boundElsewhere)
+		v.reportListDrift(snapshots, listing)
 	}
 
 	return nil
@@ -458,9 +432,7 @@ func (v *Vaultik) snapshotInfoFromLocal(ls *database.Snapshot) SnapshotInfo {
 // reportListDrift prints the reconciliation notes the merged table
 // cannot express on its own: local records with no counterpart on the
 // destination store, plus counts of remote snapshots that were
-// unreadable or omitted. Local records are not reported when
-// boundElsewhere is set: ListSnapshots has already said why they are
-// missing.
+// unreadable or omitted.
 //
 // This is what remains of the old reportRemoteDrift, and it no longer
 // touches the destination store. Its remote-only half collapsed into
@@ -469,7 +441,6 @@ func (v *Vaultik) snapshotInfoFromLocal(ls *database.Snapshot) SnapshotInfo {
 // so `snapshot list` lists the destination exactly once per invocation.
 func (v *Vaultik) reportListDrift(
 	snapshots []SnapshotInfo, listing *remoteSnapshotListing,
-	boundElsewhere bool,
 ) {
 	var localOnly []string
 
@@ -479,7 +450,7 @@ func (v *Vaultik) reportListDrift(
 		}
 	}
 
-	if len(localOnly) > 0 && !boundElsewhere {
+	if len(localOnly) > 0 {
 		v.UI.Warningf("%d local snapshot record(s) not found in backup "+
 			"destination store:", len(localOnly))
 

internal/vaultik/snapshot_list_test.go

@@ -421,74 +421,6 @@ func TestListSnapshots_LocalOnlyReportedAsDrift(t *testing.T) {
 	assert.NotContains(t, out, "snapshot cleanup")
 }
 
-// TestListSnapshots_BoundElsewhereDoesNotAdvisePrune covers a changed
-// storage_url: the local index is still bound to the old destination,
-// so its records are missing from the new one. prune refuses to run in
-// that state, so the listing must give the choices prune gives instead
-// of advising it.
-func TestListSnapshots_BoundElsewhereDoesNotAdvisePrune(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	const (
-		oldURL = "file:///mnt/backups/old"
-		newURL = "file:///mnt/backups/new"
-	)
-
-	env := newListEnv(t)
-	env.v.Config.StorageURL = newURL
-	require.NoError(t, env.v.Repositories.LocalMeta.Set(context.Background(),
-		database.LocalMetaKeyStorageURL, oldURL))
-	env.addLocal(t, listLocalID, time.Date(2026, 3, 1, 10, 0, 0, 0, time.UTC))
-
-	err := env.v.ListSnapshots(false)
-	require.NoError(t, err)
-
-	out := env.stdout.String()
-
-	assert.Contains(t, out, listLocalID)
-	assert.Contains(t, out,
-		"local index is bound to a different backup destination")
-	assert.Contains(t, out, oldURL)
-	assert.Contains(t, out, newURL)
-	assert.Contains(t, out, "revert storage_url")
-	assert.Contains(t, out, "vaultik database delete")
-	assert.NotContains(t, out, "vaultik prune")
-}
-
-// TestListSnapshots_JSONReportsBoundElsewhere is the --json side of the
-// test above. Every local row comes out with remote_present false, which
-// a script reads as stale local records unless it is told, on stderr,
-// that the local index is bound to a different destination.
-//
-//nolint:paralleltest // captureProcessStderr replaces os.Stderr
-func TestListSnapshots_JSONReportsBoundElsewhere(t *testing.T) {
-	const (
-		oldURL = "file:///mnt/backups/old"
-		newURL = "file:///mnt/backups/new"
-	)
-
-	env := newListEnv(t)
-	env.v.Config.StorageURL = newURL
-	require.NoError(t, env.v.Repositories.LocalMeta.Set(context.Background(),
-		database.LocalMetaKeyStorageURL, oldURL))
-	env.addLocal(t, listLocalID, time.Date(2026, 3, 1, 10, 0, 0, 0, time.UTC))
-
-	stderr := captureProcessStderr(t, func() {
-		require.NoError(t, env.v.ListSnapshots(true))
-	})
-
-	rows := decodeListJSON(t, env.stdout.String())
-	require.Len(t, rows, 1)
-	assert.Equal(t, listLocalID, rows[0].ID)
-
-	assert.Contains(t, stderr, "bound to a different backup destination")
-	assert.Contains(t, stderr, oldURL)
-	assert.Contains(t, stderr, newURL)
-	assert.Contains(t, stderr, "revert storage_url")
-	assert.Contains(t, stderr, "vaultik database delete")
-}
-
 // TestListSnapshots_UnreachableRemoteDegrades covers the promise in the
 // doc comment: an unreachable destination is a warning plus local-only
 // output, never a failure.

internal/vaultik/storage_bind.go

@@ -45,9 +45,17 @@ func (v *Vaultik) EnsureStorageBinding() error {
 		return nil
 	}
 
-	stored, configured, err := v.storageBinding()
+	configured := v.Config.StorageURL
+	if configured == "" {
+		// The s3.* form: bind on its endpoint, bucket and prefix,
+		// written the way storage_url would name the same destination.
+		s3 := v.Config.S3
+		configured = "s3://" + s3.Bucket + "/" + s3.Prefix + "?endpoint=" + s3.Endpoint
+	}
+
+	stored, err := v.Repositories.LocalMeta.Get(v.ctx, database.LocalMetaKeyStorageURL)
 	if err != nil {
-		return err
+		return fmt.Errorf("reading local storage binding: %w", err)
 	}
 
 	if stored == "" {
@@ -70,27 +78,6 @@ func (v *Vaultik) EnsureStorageBinding() error {
 		errStorageBindingMismatch, buildBindingMismatchMessage(stored, configured))
 }
 
-// storageBinding returns the destination the local index is bound to
-// ("" when no binding is recorded yet), then the configured destination
-// written the same way. It records nothing, so a read-only command can
-// call it.
-func (v *Vaultik) storageBinding() (string, string, error) {
-	configured := v.Config.StorageURL
-	if configured == "" {
-		// The s3.* form: bind on its endpoint, bucket and prefix,
-		// written the way storage_url would name the same destination.
-		s3 := v.Config.S3
-		configured = "s3://" + s3.Bucket + "/" + s3.Prefix + "?endpoint=" + s3.Endpoint
-	}
-
-	stored, err := v.Repositories.LocalMeta.Get(v.ctx, database.LocalMetaKeyStorageURL)
-	if err != nil {
-		return "", "", fmt.Errorf("reading local storage binding: %w", err)
-	}
-
-	return stored, configured, nil
-}
-
 // buildBindingMismatchMessage assembles the multi-line explanation
 // shown when the local index is bound to a different destination than
 // the currently-configured one (the first line lives in the

internal/vaultik/symlinked_destination_test.go

@@ -1,147 +0,0 @@
-package vaultik_test
-
-import (
-	"context"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/vaultik/internal/log"
-	"sneak.berlin/go/vaultik/internal/vaultik"
-)
-
-// TestPruneDeletesNothingThroughSymlinkedDirectory checks that prune keeps
-// every blob and the local snapshot record when the metadata/ or blobs/
-// directory of a file:// destination is a symlink to a directory elsewhere
-// (https://git.eeqj.de/sneak/vaultik/issues/296). A backup writes through
-// such a link, so prune has to list through it too.
-func TestPruneDeletesNothingThroughSymlinkedDirectory(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	for _, dir := range []string{"metadata", "blobs"} {
-		t.Run(dir, func(t *testing.T) {
-			t.Parallel()
-
-			ctx := context.Background()
-			storeDir := filepath.Join(t.TempDir(), "store")
-			v, repos, _ := backUpToFileDestination(ctx, t, storeDir)
-			blobFiles := blobFilesIn(t, storeDir)
-			moveBehindSymlink(t, storeDir, dir)
-
-			require.NoError(t, v.Prune(&vaultik.PruneOptions{Force: true}))
-
-			// When blobs/ is the link, these paths run through it.
-			for _, blobFile := range blobFiles {
-				assert.FileExists(t, blobFile, "prune must delete no blob")
-			}
-
-			snapshots, err := repos.Snapshots.ListRecent(ctx, listRecentTestLimit)
-			require.NoError(t, err)
-			assert.Len(t, snapshots, 1, "prune must delete no local snapshot record")
-		})
-	}
-}
-
-// TestPruneFailsOnSymlinkedDirectoryWithMissingTarget checks that prune
-// fails, deleting no blob and keeping the local snapshot record, when the
-// metadata/ or blobs/ directory of a file:// destination is a symlink
-// whose target is missing, as a link to a volume that is not mounted is.
-func TestPruneFailsOnSymlinkedDirectoryWithMissingTarget(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	for _, dir := range []string{"metadata", "blobs"} {
-		t.Run(dir, func(t *testing.T) {
-			t.Parallel()
-
-			ctx := context.Background()
-			storeDir := filepath.Join(t.TempDir(), "store")
-			v, repos, _ := backUpToFileDestination(ctx, t, storeDir)
-			blobFiles := blobFilesIn(t, storeDir)
-			targetPath := moveBehindSymlink(t, storeDir, dir)
-
-			// Unmount the volume the link points to, and mount it again
-			// once prune has run.
-			unmountedPath := targetPath + "-unmounted"
-			require.NoError(t, os.Rename(targetPath, unmountedPath))
-
-			err := v.Prune(&vaultik.PruneOptions{Force: true})
-			require.ErrorIs(t, err, fs.ErrNotExist)
-
-			require.NoError(t, os.Rename(unmountedPath, targetPath))
-
-			// When blobs/ is the link, these paths run through it.
-			for _, blobFile := range blobFiles {
-				assert.FileExists(t, blobFile, "prune must delete no blob")
-			}
-
-			snapshots, err := repos.Snapshots.ListRecent(ctx, listRecentTestLimit)
-			require.NoError(t, err)
-			assert.Len(t, snapshots, 1, "prune must delete no local snapshot record")
-		})
-	}
-}
-
-// TestRemoveSnapshotWarnsOnSymlinkedMetadataWithMissingTarget checks that
-// snapshot remove warns that the metadata could not be removed from the
-// destination when metadata/ is a symlink whose target is missing, as it
-// does when the destination directory is missing, instead of finding no
-// metadata to remove.
-func TestRemoveSnapshotWarnsOnSymlinkedMetadataWithMissingTarget(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	storeDir := filepath.Join(t.TempDir(), "store")
-	v, repos, out := backUpToFileDestination(ctx, t, storeDir)
-	targetPath := moveBehindSymlink(t, storeDir, "metadata")
-	require.NoError(t, os.Rename(targetPath, targetPath+"-unmounted"))
-
-	result, err := v.RemoveSnapshot(localSnapshotID(ctx, t, repos, "first"),
-		&vaultik.RemoveOptions{Force: true})
-	require.NoError(t, err)
-
-	assert.False(t, result.RemoteRemoved)
-	assert.Contains(t, out.String(),
-		"Could not remove snapshot metadata from remote")
-	assert.NotContains(t, out.String(),
-		"Removed snapshot metadata from remote storage")
-}
-
-// blobFilesIn returns the paths of the blob files under storeDir/blobs, and
-// fails the test when there are none.
-func blobFilesIn(t *testing.T, storeDir string) []string {
-	t.Helper()
-
-	var blobFiles []string
-
-	err := filepath.WalkDir(filepath.Join(storeDir, "blobs"),
-		func(path string, entry fs.DirEntry, err error) error {
-			if err == nil && !entry.IsDir() {
-				blobFiles = append(blobFiles, path)
-			}
-
-			return err
-		})
-	require.NoError(t, err)
-	require.NotEmpty(t, blobFiles)
-
-	return blobFiles
-}
-
-// moveBehindSymlink moves storeDir/dir to a directory elsewhere, puts a
-// symlink to it in its place, and returns where it went.
-func moveBehindSymlink(t *testing.T, storeDir, dir string) string {
-	t.Helper()
-
-	linkPath := filepath.Join(storeDir, dir)
-	targetPath := filepath.Join(t.TempDir(), dir)
-	require.NoError(t, os.Rename(linkPath, targetPath))
-	require.NoError(t, os.Symlink(targetPath, linkPath))
-
-	return targetPath
-}