Label the version report's date line "commit date" (closes #409)

The value is the commit's date, which the Makefile and the Dockerfile
stamp in, not the time of the build. The other labels gain one space
so every value still starts in one column.

Model: opus-5-5

internal/cli/version.go

@@ -38,7 +38,7 @@ func writeVersion(out *ui.Writer) {
 
 	_, _ = fmt.Fprintf(w, "vaultik %s\n", globals.Version)
 	_, _ = fmt.Fprintf(w, "  commit:      %s\n", globals.Commit)
-	_, _ = fmt.Fprintf(w, "  build date: %s\n", globals.CommitDate)
+	_, _ = fmt.Fprintf(w, "  commit date: %s\n", globals.CommitDate)
 	_, _ = fmt.Fprintf(w, "  go:          %s\n", runtime.Version())
 	_, _ = fmt.Fprintf(w, "  os/arch:     %s/%s\n", runtime.GOOS, runtime.GOARCH)
 	_, _ = fmt.Fprintf(w, "  author:      %s\n", globals.Author)

internal/cli/version_test.go

@@ -49,6 +49,25 @@ func TestVersionCommandReportsBuildVersion(t *testing.T) {
 	}
 }
 
+// TestVersionCommandLabelsCommitDate checks that the date line is
+// labelled as the commit's date, which is what the build stamps into
+// it, and that its value starts in the same column as the commit's.
+//
+//nolint:paralleltest // executes a command that reads the global rootFlags
+func TestVersionCommandLabelsCommitDate(t *testing.T) {
+	out := runVersionCommand(t)
+
+	wantLine := "  commit date: " + globals.CommitDate
+	if !strings.Contains(out, wantLine+"\n") {
+		t.Errorf("output has no line %q:\n%s", wantLine, out)
+	}
+
+	wantCommit := "  commit:      " + globals.Commit
+	if !strings.Contains(out, wantCommit+"\n") {
+		t.Errorf("output has no line %q:\n%s", wantCommit, out)
+	}
+}
+
 // TestVersionCommandFlagsDevelopmentBuild is the regression test for
 // the thing this command exists to prevent: a build that is not a
 // release must say so. The notice used to be gated on the version

internal/snapshot/snapshot.go

@@ -271,16 +271,18 @@ func (sm *SnapshotManager) CompleteSnapshot(
 	return sm.MarkSnapshotComplete(ctx, snapshotID)
 }
 
-// ExportSnapshotMetadata exports snapshot metadata to S3
+// ExportSnapshotMetadata exports snapshot metadata to the backup destination store
 //
 // This method executes the complete snapshot metadata export process:
 // 1. Creates a temporary directory for working files
 // 2. Copies the main database to preserve its state
 // 3. Cleans the copy to contain only current snapshot data
-// 4. Dumps the cleaned database to SQL
+// 4. Vacuums the copy to remove the deleted data
-// 5. Compresses the SQL dump with zstd
+// 5. Compresses the copy with zstd
-// 6. Encrypts the compressed data with age (always; recipients are required)
+// 6. Encrypts the compressed copy with age (always; recipients are required)
-// 7. Uploads to S3 at: snapshots/{snapshot-id}.sql.zst[.age]
+// 7. Builds the blob manifest from the copy, compressed but not encrypted
+// 8. Uploads the database to metadata/{remote-key}/db.zst.age
+// 9. Uploads the manifest to metadata/{remote-key}/manifest.json.zst
 //
 // The only caller (finalizeSnapshotMetadata) does not close the main database
 // before calling this method: the index is copied at dbPath while it is still

internal/vaultik/storage_bind.go

@@ -30,7 +30,7 @@ var errStorageBindingMismatch = errors.New(
 //     nothing and return nil.
 //   - When the two differ, refuse with an error that tells the user
 //     how to recover (revert the config, or run `vaultik database
-//     purge` to discard the local index and rebuild against the new
+//     delete` to discard the local index and rebuild against the new
 //     destination on the next backup).
 //
 // Read-only inspection commands (remote info, snapshot list, etc.)