Refuse config keys that no setting has (closes #419)

config.Parse walks the file as written and fails on the first key that
matches no setting, naming its dotted path and line, so a typo in
exclude or prune_grace_period no longer falls back silently. Keys that a
${...} reference brings in are checked once smartconfig has filled it
in, and named without a line. YAML merge keys and a top-level env
section, which smartconfig reads, still load; an anchor that contains
itself is an error. config set refuses such a key before writing, with
the same error. The key-to-field lookup moves from internal/cli to
config.SettingType so both use it.

Model: opus-5-5

.prettierignore

@@ -0,0 +1,2 @@
+node_modules/
+yarn.lock

.prettierrc

@@ -0,0 +1,4 @@
+{
+    "tabWidth": 4,
+    "proseWrap": "always"
+}

AGENTS.md

@@ -4,127 +4,122 @@ Version: 2025-06-08
 
 # Instructions and Contextual Information
 
-* Be direct, robotic, expert, accurate, and professional.
+- Be direct, robotic, expert, accurate, and professional.
 
-* Do not butter me up or kiss my ass.
+- Do not butter me up or kiss my ass.
 
-* Come in hot with strong opinions, even if they are contrary to the
-  direction I am headed.
+- Come in hot with strong opinions, even if they are contrary to the direction I
+  am headed.
 
-* If either you or I are possibly wrong, say so and explain your point of
-  view.
+- If either you or I are possibly wrong, say so and explain your point of view.
 
-* Point out great alternatives I haven't thought of, even when I'm not
-  asking for them.
+- Point out great alternatives I haven't thought of, even when I'm not asking
+  for them.
 
-* Treat me like the world's leading expert in every situation and every
+- Treat me like the world's leading expert in every situation and every
   conversation, and deliver the absolute best recommendations.
 
-* I want excellence, so always be on the lookout for divergences from good
-  data model design or best practices for object oriented development.
+- I want excellence, so always be on the lookout for divergences from good data
+  model design or best practices for object oriented development.
 
-* IMPORTANT: This is production code, not a research or teaching exercise.
+- IMPORTANT: This is production code, not a research or teaching exercise.
   Deliver professional-level results, not prototypes.
 
-* Please read and understand the `README.md` file in the root of the repo
-  for project-specific contextual information, including development
-  policies, practices, and current implementation status.
+- Please read and understand the `README.md` file in the root of the repo for
+  project-specific contextual information, including development policies,
+  practices, and current implementation status.
 
-* Be proactive in suggesting improvements or refactorings in places where we
+- Be proactive in suggesting improvements or refactorings in places where we
   diverge from best practices for clean, modular, maintainable code.
 
 # Policies
 
 1. Before committing, tests must pass (`make test`), linting must pass
-   (`make lint`), and code must be formatted (`make fmt`).  For go, those
+   (`make lint`), and code must be formatted (`make fmt`). For go, those
    makefile targets should use `go fmt` and `go test -v ./...` and
-   `golangci-lint run`.  Each Makefile target does exactly one thing — to
-   run lint + fmt-check + test together (the standard pre-commit gate),
-   use `make check`.
+   `golangci-lint run`. Each Makefile target does exactly one thing — to run
+   lint + fmt-check + test together (the standard pre-commit gate), use
+   `make check`.
 
-2. Always write a `Makefile` with the default target being `test`, and with
-   a `fmt` target that formats the code.  The `test` target should run all
-   tests in the project, and the `fmt` target should format the code.
-   `test` should also have a prerequisite target `lint` that should run any
-   linters that are configured for the project.
+2. Always write a `Makefile` with the default target being `test`, and with a
+   `fmt` target that formats the code. The `test` target should run all tests in
+   the project, and the `fmt` target should format the code. `test` should also
+   have a prerequisite target `lint` that should run any linters that are
+   configured for the project.
 
-3. After each completed bugfix or feature, the code must be committed.  Do
-   all of the pre-commit checks (test, lint, fmt) before committing, of
-   course.
+3. After each completed bugfix or feature, the code must be committed. Do all of
+   the pre-commit checks (test, lint, fmt) before committing, of course.
 
 4. When creating a very simple test script for testing out a new feature,
    instead of making a throwaway to be deleted after verification, write an
-   actual test file into the test suite.  It doesn't need to be very big or
+   actual test file into the test suite. It doesn't need to be very big or
    complex, but it should be a real test that can be run.
 
 5. When you are instructed to make the tests pass, DO NOT delete tests, skip
-   tests, or change the tests specifically to make them pass (unless there
-   is a bug in the test).  This is cheating, and it is bad.  You should only
-   be modifying the test if it is incorrect or if the test is no longer
-   relevant.  In almost all cases, you should be fixing the code that is
-   being tested, or updating the tests to match a refactored implementation.
+   tests, or change the tests specifically to make them pass (unless there is a
+   bug in the test). This is cheating, and it is bad. You should only be
+   modifying the test if it is incorrect or if the test is no longer relevant.
+   In almost all cases, you should be fixing the code that is being tested, or
+   updating the tests to match a refactored implementation.
 
 6. When dealing with dates and times or timestamps, always use, display, and
-   store UTC.  Set the local timezone to UTC on startup.  If the user needs
-   to see the time in a different timezone, store the user's timezone in a
-   separate field and convert the UTC time to the user's timezone when
-   displaying it.  For internal use and internal applications and
-   administrative purposes, always display UTC.
+   store UTC. Set the local timezone to UTC on startup. If the user needs to see
+   the time in a different timezone, store the user's timezone in a separate
+   field and convert the UTC time to the user's timezone when displaying it. For
+   internal use and internal applications and administrative purposes, always
+   display UTC.
 
 7. Always write tests, even if they are extremely simple and just check for
-   correct syntax (ability to compile/import). If you are writing a new
-   feature, write a test for it.  You don't need to target complete
-   coverage, but you should at least test any new functionality you add.  If
-   you are fixing a bug, write a test first that reproduces the bug, and
-   then fix the bug in the code.
+   correct syntax (ability to compile/import). If you are writing a new feature,
+   write a test for it. You don't need to target complete coverage, but you
+   should at least test any new functionality you add. If you are fixing a bug,
+   write a test first that reproduces the bug, and then fix the bug in the code.
 
-8. When implementing new features, be aware of potential side-effects (such
-   as state files on disk, data in the database, etc.) and ensure that it is
+8. When implementing new features, be aware of potential side-effects (such as
+   state files on disk, data in the database, etc.) and ensure that it is
    possible to mock or stub these side-effects in tests.
 
-9. Always use structured logging.  Log any relevant state/context with the
-   messages (but do not log secrets).  If the log stream is not a terminal,
+9. Always use structured logging. Log any relevant state/context with the
+   messages (but do not log secrets). If the log stream is not a terminal,
    output the structured logs in jsonl format.
 
 10. Avoid using bare strings or numbers in code, especially if they appear
-    anywhere more than once.  Always define a constant (usually at the top
-    of the file) and give it a descriptive name, then use that constant in
-    the code instead of the bare string or number.
+    anywhere more than once. Always define a constant (usually at the top of the
+    file) and give it a descriptive name, then use that constant in the code
+    instead of the bare string or number.
 
 11. You do not need to summarize your changes in the chat after making them.
-    Making the changes and committing them is sufficient.  If anything out
-    of the ordinary happened, please explain it, but in the normal case
-    where you found and fixed the bug, or implemented the feature, there is
-    no need for the end-of-change summary.
+    Making the changes and committing them is sufficient. If anything out of the
+    ordinary happened, please explain it, but in the normal case where you found
+    and fixed the bug, or implemented the feature, there is no need for the
+    end-of-change summary.
 
-12. Do not create additional files in the root directory of the project
-    without asking permission first. Configuration files, documentation, and
-    build files are acceptable in the root, but source code and other files
-    should be organized in appropriate subdirectories.
+12. Do not create additional files in the root directory of the project without
+    asking permission first. Configuration files, documentation, and build files
+    are acceptable in the root, but source code and other files should be
+    organized in appropriate subdirectories.
 
 13. Pre-1.0: NEVER add a database migration. Migrations are supported, but
-    nothing is installed anywhere yet, so there is nothing to migrate. To
-    change the schema, edit `internal/database/schema/001.sql` (and any
-    code that touches the affected tables) directly. After 1.0, each schema
-    change is a new numbered file in that directory and a released file is
-    never edited; an existing local database is then migrated when vaultik
-    is updated. Before 1.0, a local database left on an older schema is
-    deleted and re-created by a full backup. See
-    [`docs/DATAMODEL.md`](docs/DATAMODEL.md#schema-migrations).
+    nothing is installed anywhere yet, so there is nothing to migrate. To change
+    the schema, edit `internal/database/schema/001.sql` (and any code that
+    touches the affected tables) directly. After 1.0, each schema change is a
+    new numbered file in that directory and a released file is never edited; an
+    existing local database is then migrated when vaultik is updated. Before
+    1.0, a local database left on an older schema is deleted and re-created by a
+    full backup. See [`docs/DATAMODEL.md`](docs/DATAMODEL.md#schema-migrations).
 
-14. Never use `git add -A`.  Stage only the files you intentionally
-    changed.
+14. Never use `git add -A`. Stage only the files you intentionally changed.
 
-15. Commit messages carry no attribution or advertising trailers for the
-    tool that helped write the code, or for its vendor: the owner is the
-    sole author of code written with a tool.
+15. Commit messages carry no attribution or advertising trailers for the tool
+    that helped write the code, or for its vendor: the owner is the sole author
+    of code written with a tool.
 
 16. Run the whole test suite with `make test` every time, and read its full
-    output.  Never run `go test`, a single test or a single package, and
-    never grep the output.
+    output. Never run `go test`, a single test or a single package, and never
+    grep the output.
 
 17. Do not stop working on a task until the definition of done given in the
     initial instruction is met: all of the work, not part or most of it.
 
-18. For estimates: backing up over 2.5Gbit/s ethernet to an S3 server
-    backed by 2000MB/sec SSD takes about 4 seconds per gigabyte.
+18. For estimates: backing up over 2.5Gbit/s ethernet to an S3 server backed by
+    2000MB/sec SSD takes about 4 seconds per gigabyte.

docs/ARCHITECTURE.md

@@ -1,10 +1,14 @@
 # Vaultik Architecture
 
-This document describes the internal architecture of Vaultik, focusing on the data model, type instantiation, and the relationships between core modules.
+This document describes the internal architecture of Vaultik, focusing on the
+data model, type instantiation, and the relationships between core modules.
 
 ## Overview
 
-Vaultik is a backup system that uses content-defined chunking for deduplication and packs chunks into large, compressed, encrypted blobs for efficient cloud storage. The system is built around dependency injection using [uber-go/fx](https://github.com/uber-go/fx).
+Vaultik is a backup system that uses content-defined chunking for deduplication
+and packs chunks into large, compressed, encrypted blobs for efficient cloud
+storage. The system is built around dependency injection using
+[uber-go/fx](https://github.com/uber-go/fx).
 
 ## Data Flow
 
@@ -53,57 +57,88 @@ The database tracks five primary entities and their relationships:
 ### Entity Descriptions
 
 #### File (`database.File`)
-Represents a file, directory, or symlink in the backup system. Stores metadata needed for restoration:
+
+Represents a file, directory, or symlink in the backup system. Stores metadata
+needed for restoration:
+
 - Path, mtime
 - Size, mode, ownership (uid, gid)
 - Symlink target (if applicable)
 
-It also stores `source_path`, the source directory the scan found it under, made absolute and with symlinks resolved. Restore does not read it.
+It also stores `source_path`, the source directory the scan found it under, made
+absolute and with symlinks resolved. Restore does not read it.
 
 #### Chunk (`database.Chunk`)
-A content-addressed unit of data. Files are split into variable-size chunks using the FastCDC algorithm:
+
+A content-addressed unit of data. Files are split into variable-size chunks
+using the FastCDC algorithm:
+
 - `ChunkHash`: SHA256 hash of chunk content (primary key)
 - `Size`: Chunk size in bytes
 
-Chunk sizes vary between `avgChunkSize/4` and `avgChunkSize*4` (2.5MB-40MB for the 10MB default average).
+Chunk sizes vary between `avgChunkSize/4` and `avgChunkSize*4` (2.5MB-40MB for
+the 10MB default average).
 
 #### FileChunk (`database.FileChunk`)
+
 Maps files to their constituent chunks:
+
 - `FileID`: Reference to the file
 - `Idx`: Position of this chunk within the file (0-indexed)
 - `ChunkHash`: Reference to the chunk
 
 #### Blob (`database.Blob`)
-The final storage unit uploaded to S3. Contains many compressed and encrypted chunks:
+
+The final storage unit uploaded to S3. Contains many compressed and encrypted
+chunks:
+
 - `ID`: UUID assigned at creation
-- `Hash`: `hex(SHA256(SHA256(uncompressed blob contents)))`, computed before compression and encryption (see [docs/REPOSTRUCTURE.md](docs/REPOSTRUCTURE.md#blobs-directory-blobs))
+- `Hash`: `hex(SHA256(SHA256(uncompressed blob contents)))`, computed before
+  compression and encryption (see
+  [docs/REPOSTRUCTURE.md](REPOSTRUCTURE.md#blobs-directory-blobs))
 - `UncompressedSize`: Total raw chunk data before compression
 - `CompressedSize`: Size after zstd compression and age encryption
 - `CreatedTS`, `FinishedTS`, `UploadedTS`: Lifecycle timestamps
 
 Blob creation process:
+
 1. Chunks are accumulated (up to MaxBlobSize, typically 10GB)
 2. As each chunk is added, its uncompressed bytes are fed to a running SHA-256
-3. Concurrently, the same bytes are compressed with zstd, then encrypted with age (recipients configured in config), and written to a temporary file
-4. On finalize, the blob's name is the double SHA-256 of the uncompressed contents — `hex(SHA256(SHA256(...)))` — not a hash of the compressed, encrypted bytes
-5. The finished file is uploaded to `blobs/{hash[0:2]}/{hash[2:4]}/{hash}` and then deleted
+3. Concurrently, the same bytes are compressed with zstd, then encrypted with
+   age (recipients configured in config), and written to a temporary file
+4. On finalize, the blob's name is the double SHA-256 of the uncompressed
+   contents — `hex(SHA256(SHA256(...)))` — not a hash of the compressed,
+   encrypted bytes
+5. The finished file is uploaded to `blobs/{hash[0:2]}/{hash[2:4]}/{hash}` and
+   then deleted
 
-A backup needs free temporary space, because each blob is written whole to a temporary file before it is uploaded (up to about `blob_size_limit`; an rclone destination that cannot stream uploads needs about twice that) and the metadata export writes copies of the local index. Temporary files go to `$TMPDIR` (default `/tmp`); with `TMPDIR` unset, SQLite writes one of those copies to `/var/tmp`.
+A backup needs free temporary space, because each blob is written whole to a
+temporary file before it is uploaded (up to about `blob_size_limit`; an rclone
+destination that cannot stream uploads needs about twice that) and the metadata
+export writes copies of the local index. Temporary files go to `$TMPDIR`
+(default `/tmp`); with `TMPDIR` unset, SQLite writes one of those copies to
+`/var/tmp`.
 
 #### BlobChunk (`database.BlobChunk`)
+
 Maps chunks to their position within blobs:
+
 - `BlobID`: Reference to the blob
 - `ChunkHash`: Reference to the chunk
 - `Offset`: Byte offset within the uncompressed blob
 - `Length`: Chunk size
 
 #### Snapshot (`database.Snapshot`)
+
 Represents a point-in-time backup:
-- `ID`: Format is `{hostname}_{snapshot-name}_{RFC3339}` (e.g. `server1_home_2025-06-01T12:00:00Z`)
+
+- `ID`: Format is `{hostname}_{snapshot-name}_{RFC3339}` (e.g.
+  `server1_home_2025-06-01T12:00:00Z`)
 - Tracks file count, chunk count, blob count, sizes, compression ratio
 - `CompletedAt`: Null until snapshot finishes successfully
 
 #### SnapshotFile / SnapshotBlob
+
 Join tables linking snapshots to their files and blobs.
 
 ### Relationship Summary
@@ -140,21 +175,27 @@ fx.New(
 ### Key Type Instantiation Points
 
 #### 1. Config (`config.Config`)
+
 - **Created by**: `config.Module` via `config.LoadConfig()`
 - **When**: Application startup (fx DI)
-- **Contains**: All configuration from YAML file (S3 credentials, encryption keys, paths, etc.)
+- **Contains**: All configuration from YAML file (S3 credentials, encryption
+  keys, paths, etc.)
 
 #### 2. Database (`database.DB`)
+
 - **Created by**: `database.Module` via `database.New()`
 - **When**: Application startup (fx DI)
 - **Contains**: SQLite connection, path reference
 
 #### 3. Repositories (`database.Repositories`)
+
 - **Created by**: `database.Module` via `database.NewRepositories()`
 - **When**: Application startup (fx DI)
-- **Contains**: All repository interfaces (Files, Chunks, Blobs, Snapshots, etc.)
+- **Contains**: All repository interfaces (Files, Chunks, Blobs, Snapshots,
+  etc.)
 
 #### 4. Vaultik (`vaultik.Vaultik`)
+
 - **Created by**: `vaultik.New(VaultikParams)`
 - **When**: Application startup (fx DI)
 - **Contains**: All dependencies for backup operations
@@ -176,11 +217,13 @@ type Vaultik struct {
 ```
 
 #### 5. SnapshotManager (`snapshot.SnapshotManager`)
+
 - **Created by**: `snapshot.Module` via `snapshot.NewSnapshotManager()`
 - **When**: Application startup (fx DI)
 - **Responsibility**: Creates/completes snapshots, exports metadata to S3
 
 #### 6. Scanner (`snapshot.Scanner`)
+
 - **Created by**: `ScannerFactory(ScannerParams)`
 - **When**: Each `CreateSnapshot()` call
 - **Contains**: Chunker, Packer, progress reporter
@@ -194,20 +237,22 @@ scanner := v.ScannerFactory(snapshot.ScannerParams{
 ```
 
 #### 7. Chunker (`chunker.Chunker`)
+
 - **Created by**: `chunker.NewChunker(avgChunkSize)`
 - **When**: Inside `snapshot.NewScanner()`
 - **Configuration**:
-  - `avgChunkSize`: From config (default 10MB)
-  - `minChunkSize`: avgChunkSize / 4
-  - `maxChunkSize`: avgChunkSize * 4
+    - `avgChunkSize`: From config (default 10MB)
+    - `minChunkSize`: avgChunkSize / 4
+    - `maxChunkSize`: avgChunkSize \* 4
 
 #### 8. Packer (`blob.Packer`)
+
 - **Created by**: `blob.NewPacker(PackerConfig)`
 - **When**: Inside `snapshot.NewScanner()`
 - **Configuration**:
-  - `MaxBlobSize`: Maximum blob size before finalization (typically 10GB)
-  - `CompressionLevel`: zstd level (1-19)
-  - `Recipients`: age public keys for encryption
+    - `MaxBlobSize`: Maximum blob size before finalization (typically 10GB)
+    - `CompressionLevel`: zstd level (1-19)
+    - `Recipients`: age public keys for encryption
 
 ```go
 // snapshot/scanner.go: NewScanner()
@@ -224,17 +269,22 @@ packer, err := blob.NewPacker(packerCfg)
 ## Module Responsibilities
 
 ### `internal/cli`
-Entry point for fx application. Combines all modules and handles signal interrupts.
+
+Entry point for fx application. Combines all modules and handles signal
+interrupts.
 
 Key functions:
+
 - `NewApp(AppOptions)` → Creates fx.App with all modules
 - `RunApp(ctx, app)` → Starts app, handles graceful shutdown
 - `RunWithApp(ctx, opts)` → Convenience wrapper
 
 ### `internal/vaultik`
+
 Main orchestrator containing all dependencies and command implementations.
 
 Key methods:
+
 - `New(VaultikParams)` → Constructor (fx DI)
 - `CreateSnapshot(opts)` → Main backup operation
 - `ListSnapshots(jsonOutput)` → List available snapshots
@@ -242,27 +292,34 @@ Key methods:
 - `PurgeSnapshots(...)` → Remove old snapshots
 
 ### `internal/chunker`
+
 Content-defined chunking using FastCDC algorithm.
 
 Key types:
+
 - `Chunk` → Hash, Data, Offset, Size
 - `Chunker` → avgChunkSize, minChunkSize, maxChunkSize
 
 Key methods:
+
 - `NewChunker(avgChunkSize)` → Constructor
-- `ChunkReaderStreaming(reader, callback)` → Stream chunks with callback (preferred)
+- `ChunkReaderStreaming(reader, callback)` → Stream chunks with callback
+  (preferred)
 - `ChunkReader(reader)` → Return all chunks at once (memory-intensive)
 
 ### `internal/blob`
+
 Blob packing: accumulates chunks, compresses, encrypts, tracks metadata.
 
 Key types:
+
 - `Packer` → Thread-safe blob accumulator
 - `ChunkRef` → Hash + Data for adding to packer
 - `FinishedBlob` → Completed blob ready for upload
 - `BlobWithReader` → FinishedBlob + io.Reader for streaming upload
 
 Key methods:
+
 - `NewPacker(PackerConfig)` → Constructor
 - `AddChunk(ChunkRef)` → Add chunk to current blob
 - `FinalizeBlob()` → Compress, encrypt, hash current blob
@@ -272,35 +329,48 @@ Key methods:
 ### `internal/snapshot`
 
 #### Scanner
+
 Orchestrates the backup process for a directory.
 
 Key methods:
+
 - `NewScanner(ScannerConfig)` → Constructor (creates Chunker + Packer)
 - `Scan(ctx, path, snapshotID)` → Main scan operation
 
 Scan phases:
+
 1. **Phase 1**: Walk directory, identify files needing processing
-2. **Phase 1b**: Count as deleted the files that the previous snapshot of the same name lists, the walk did not find, and are gone from disk; a file that is excluded, or inside an excluded directory, is not counted
+2. **Phase 1b**: Count as deleted the files that the previous snapshot of the
+   same name lists, the walk did not find, and are gone from disk; a file that
+   is excluded, or inside an excluded directory, is not counted
 3. **Phase 2**: Process files (chunk → pack → upload)
 
 #### SnapshotManager
+
 Manages snapshot lifecycle and metadata export.
 
 Key methods:
+
 - `CreateSnapshot(ctx, hostname, version, commit)` → Create snapshot record
-- `PopulateSnapshotBlobs(ctx, snapshotID)` → Record every blob the snapshot references
+- `PopulateSnapshotBlobs(ctx, snapshotID)` → Record every blob the snapshot
+  references
 - `ExportSnapshotMetadata(ctx, dbPath, snapshotID)` → Export to S3
-- `MarkSnapshotComplete(ctx, snapshotID)` → Record completion, only after a successful export
-- `CompleteSnapshot(ctx, snapshotID)` → Convenience: populate blobs, then mark complete (no export between)
+- `MarkSnapshotComplete(ctx, snapshotID)` → Record completion, only after a
+  successful export
+- `CompleteSnapshot(ctx, snapshotID)` → Convenience: populate blobs, then mark
+  complete (no export between)
 
 ### `internal/database`
+
 SQLite database for local index. Single-writer mode for thread safety.
 
 Key types:
+
 - `DB` → Database connection wrapper
 - `Repositories` → Collection of all repository interfaces
 
 Repository interfaces:
+
 - `FilesRepository` → CRUD for File records
 - `ChunksRepository` → CRUD for Chunk records
 - `BlobsRepository` → CRUD for Blob records
@@ -359,11 +429,16 @@ CreateSnapshot(opts)
 
 ## Deduplication Strategy
 
-1. **File-level**: Files and symlinks unchanged since last backup are skipped (metadata comparison: size, mtime, mode, uid, gid, and a symlink's target), unless the file lists a chunk that no uploaded blob holds; such a file is re-chunked
+1. **File-level**: Files and symlinks unchanged since last backup are skipped
+   (metadata comparison: size, mtime, mode, uid, gid, and a symlink's target),
+   unless the file lists a chunk that no uploaded blob holds; such a file is
+   re-chunked
 
-2. **Chunk-level**: Chunks are content-addressed by SHA256 hash. If a chunk hash already exists in the database, the chunk data is not re-uploaded.
+2. **Chunk-level**: Chunks are content-addressed by SHA256 hash. If a chunk hash
+   already exists in the database, the chunk data is not re-uploaded.
 
-3. **Blob-level**: Blobs contain only unique chunks. Duplicate chunks within a blob are skipped.
+3. **Blob-level**: Blobs contain only unique chunks. Duplicate chunks within a
+   blob are skipped.
 
 ## Storage Layout in S3
 
@@ -382,30 +457,30 @@ bucket/
         └── manifest.json.zst        # Blob list (for pruning/verification)
 ```
 
-A destination that answers a look-up of `vaultik-destination.txt` with not
-found is treated as not present while the local index holds snapshots stored
-there (`checkDestinationMarker` in `internal/vaultik/destination_marker.go`):
+A destination that answers a look-up of `vaultik-destination.txt` with not found
+is treated as not present while the local index holds snapshots stored there
+(`checkDestinationMarker` in `internal/vaultik/destination_marker.go`):
 `snapshot create` refuses to write to it, `prune`, `snapshot purge` and
 `remote nuke` fail, and `snapshot list` and `snapshot remove` behave as for a
 destination that cannot be listed. This keeps those commands from taking an
-unplugged volume's empty mount point for a destination whose snapshots are
-all gone. When the look-up fails for any reason other than not found, for
-example when S3 refuses it to credentials that allow only PUT, the check is
-skipped, so a host with such credentials does not notice an emptied
-destination; see
-[docs/REPOSTRUCTURE.md](docs/REPOSTRUCTURE.md#marker-file-vaultik-destinationtxt).
+unplugged volume's empty mount point for a destination whose snapshots are all
+gone. When the look-up fails for any reason other than not found, for example
+when S3 refuses it to credentials that allow only PUT, the check is skipped, so
+a host with such credentials does not notice an emptied destination; see
+[docs/REPOSTRUCTURE.md](REPOSTRUCTURE.md#marker-file-vaultik-destinationtxt).
 The `file://` backend never creates its destination directory, so a write to a
 missing one fails.
 
 The `{remote-key}` directory name is a one-way double SHA-256 hash of the human
 snapshot ID, so the human ID (hostname, snapshot name, timestamp) is never
 written to the store as a directory name. See
-[docs/REPOSTRUCTURE.md](docs/REPOSTRUCTURE.md#remote-key-derivation) for the
+[docs/REPOSTRUCTURE.md](REPOSTRUCTURE.md#remote-key-derivation) for the
 derivation and a worked example.
 
 ## Thread Safety
 
 - `Packer`: Thread-safe via mutex. Multiple goroutines can call `AddChunk()`.
 - `Scanner`: Uses `packerMu` mutex to coordinate blob finalization.
-- `Database`: Single-writer mode (`MaxOpenConns=1`) ensures SQLite thread safety.
+- `Database`: Single-writer mode (`MaxOpenConns=1`) ensures SQLite thread
+  safety.
 - `Repositories.WithTx()`: Handles transaction lifecycle automatically.

docs/DATAMODEL.md

@@ -2,7 +2,9 @@
 
 ## Overview
 
-Vaultik uses a local SQLite database to track file metadata, chunk mappings, and blob associations during the backup process. This database serves as an index for incremental backups and enables efficient deduplication.
+Vaultik uses a local SQLite database to track file metadata, chunk mappings, and
+blob associations during the backup process. This database serves as an index
+for incremental backups and enables efficient deduplication.
 
 **Important Notes:**
 
@@ -25,19 +27,23 @@ recorded `001.sql` as run, so it keeps the old schema and can become unusable;
 `vaultik database delete` followed by a full backup rebuilds it.
 
 **After 1.0** each schema change is a new numbered file, so an existing local
-database is migrated the first time an updated vaultik opens it. A file that
-has shipped in a release is never edited.
+database is migrated the first time an updated vaultik opens it. A file that has
+shipped in a release is never edited.
 
 ## Database Tables
 
 ### 1. `files`
+
 Stores metadata about files in the filesystem being backed up.
 
 **Columns:**
+
 - `id` (TEXT PRIMARY KEY) - UUID for the file record
 - `path` (TEXT NOT NULL UNIQUE) - Absolute file path
-- `mtime` (INTEGER NOT NULL) - Modification time, whole seconds since the Unix epoch
-- `mtime_nsec` (INTEGER NOT NULL) - Nanoseconds within that second, 0 to 999999999
+- `mtime` (INTEGER NOT NULL) - Modification time, whole seconds since the Unix
+  epoch
+- `mtime_nsec` (INTEGER NOT NULL) - Nanoseconds within that second, 0 to
+  999999999
 - `size` (INTEGER NOT NULL) - File size in bytes
 - `mode` (INTEGER NOT NULL) - Unix file permissions and type
 - `uid` (INTEGER NOT NULL) - User ID of file owner
@@ -45,23 +51,30 @@ Stores metadata about files in the filesystem being backed up.
 - `link_target` (TEXT) - Symlink target path (NULL for regular files)
 
 **Indexes:**
+
 - `idx_files_path` on `path` for efficient lookups
 
-**Purpose:** Tracks file metadata to detect changes between backup runs. Used for incremental backup decisions. The UUID primary key provides stable references that don't change if files are moved.
+**Purpose:** Tracks file metadata to detect changes between backup runs. Used
+for incremental backup decisions. The UUID primary key provides stable
+references that don't change if files are moved.
 
 ### 2. `chunks`
+
 Stores information about content-defined chunks created from files.
 
 **Columns:**
+
 - `chunk_hash` (TEXT PRIMARY KEY) - SHA256 hash of chunk content
 - `size` (INTEGER NOT NULL) - Chunk size in bytes
 
 **Purpose:** Enables deduplication by tracking unique chunks across all files.
 
 ### 3. `file_chunks`
+
 Maps files to their constituent chunks in order.
 
 **Columns:**
+
 - `file_id` (TEXT) - File ID (FK to files.id)
 - `idx` (INTEGER) - Chunk index within file (0-based)
 - `chunk_hash` (TEXT) - Chunk hash (FK to chunks.chunk_hash)
@@ -70,35 +83,49 @@ Maps files to their constituent chunks in order.
 **Purpose:** Allows reconstruction of files from chunks during restore.
 
 ### 4. `chunk_files`
+
 Reverse mapping showing which files contain each chunk.
 
 **Columns:**
+
 - `chunk_hash` (TEXT) - Chunk hash (FK to chunks.chunk_hash)
 - `file_id` (TEXT) - File ID (FK to files.id)
 - `file_offset` (INTEGER) - Byte offset of chunk within file
 - `length` (INTEGER) - Length of chunk in bytes
 - PRIMARY KEY (`chunk_hash`, `file_id`)
 
-**Purpose:** Supports efficient queries for chunk usage and deduplication statistics.
+**Purpose:** Supports efficient queries for chunk usage and deduplication
+statistics.
 
 ### 5. `blobs`
+
 Stores information about packed, compressed, and encrypted blob files.
 
 **Columns:**
+
 - `id` (TEXT PRIMARY KEY) - UUID assigned when blob creation starts
-- `blob_hash` (TEXT UNIQUE) - `hex(SHA256(SHA256(uncompressed blob contents)))`, computed before compression and encryption (NULL until finalized); see [REPOSTRUCTURE.md](REPOSTRUCTURE.md#blobs-directory-blobs)
+- `blob_hash` (TEXT UNIQUE) - `hex(SHA256(SHA256(uncompressed blob contents)))`,
+  computed before compression and encryption (NULL until finalized); see
+  [REPOSTRUCTURE.md](REPOSTRUCTURE.md#blobs-directory-blobs)
 - `created_ts` (INTEGER NOT NULL) - Creation timestamp
 - `finished_ts` (INTEGER) - Finalization timestamp (NULL if in progress)
-- `uncompressed_size` (INTEGER NOT NULL DEFAULT 0) - Total size of chunks before compression
-- `compressed_size` (INTEGER NOT NULL DEFAULT 0) - Size after compression and encryption. Once uploaded, the size of the object in storage: when the blob was already stored, under another compression level or other recipients, this can differ from the size of the local copy
+- `uncompressed_size` (INTEGER NOT NULL DEFAULT 0) - Total size of chunks before
+  compression
+- `compressed_size` (INTEGER NOT NULL DEFAULT 0) - Size after compression and
+  encryption. Once uploaded, the size of the object in storage: when the blob
+  was already stored, under another compression level or other recipients, this
+  can differ from the size of the local copy
 - `uploaded_ts` (INTEGER) - Upload completion timestamp (NULL if not uploaded)
 
-**Purpose:** Tracks blob lifecycle from creation through upload. The UUID primary key allows immediate association of chunks with blobs.
+**Purpose:** Tracks blob lifecycle from creation through upload. The UUID
+primary key allows immediate association of chunks with blobs.
 
 ### 6. `blob_chunks`
+
 Maps chunks to the blobs that contain them.
 
 **Columns:**
+
 - `blob_id` (TEXT) - Blob ID (FK to blobs.id)
 - `chunk_hash` (TEXT) - Chunk hash (FK to chunks.chunk_hash)
 - `offset` (INTEGER) - Byte offset of chunk within blob (before compression)
@@ -108,34 +135,46 @@ Maps chunks to the blobs that contain them.
 **Purpose:** Enables chunk retrieval from blobs during restore operations.
 
 ### 7. `snapshots`
+
 Tracks backup snapshots.
 
 **Columns:**
-- `id` (TEXT PRIMARY KEY) - Snapshot ID (format: `hostname_name_timestamp`, e.g. `server1_home_2025-06-01T12:00:00Z`: the hostname up to its first `.`, the snapshot name, and an RFC 3339 UTC timestamp)
+
+- `id` (TEXT PRIMARY KEY) - Snapshot ID (format: `hostname_name_timestamp`, e.g.
+  `server1_home_2025-06-01T12:00:00Z`: the hostname up to its first `.`, the
+  snapshot name, and an RFC 3339 UTC timestamp)
 - `hostname` (TEXT) - Hostname where backup was created
 - `vaultik_version` (TEXT) - Version of Vaultik used
 - `vaultik_git_revision` (TEXT) - Git revision of Vaultik used
 - `started_at` (INTEGER) - Start timestamp
 - `completed_at` (INTEGER) - Completion timestamp (NULL if in progress)
 - `file_count` (INTEGER) - Number of files in snapshot
-- `chunk_count` (INTEGER) - Number of chunks this snapshot stored that were not stored before
-- `new_chunk_size` (INTEGER) - Total size of those chunks before compression; `snapshot list` shows it as NEW CHUNK SIZE
+- `chunk_count` (INTEGER) - Number of chunks this snapshot stored that were not
+  stored before
+- `new_chunk_size` (INTEGER) - Total size of those chunks before compression;
+  `snapshot list` shows it as NEW CHUNK SIZE
 - `blob_count` (INTEGER) - Number of blobs this snapshot created
 - `total_size` (INTEGER) - Total size of all files
-- `uncompressed_chunk_size` (INTEGER) - Total size before compression of the distinct chunks the snapshot's files reference, recorded when its backup ran; `snapshot list` shows it as UNCOMPRESSED SIZE
+- `uncompressed_chunk_size` (INTEGER) - Total size before compression of the
+  distinct chunks the snapshot's files reference, recorded when its backup ran;
+  `snapshot list` shows it as UNCOMPRESSED SIZE
 - `blob_size` (INTEGER) - Total compressed size of all referenced blobs
-- `blob_uncompressed_size` (INTEGER) - Total uncompressed size of all referenced blobs
+- `blob_uncompressed_size` (INTEGER) - Total uncompressed size of all referenced
+  blobs
 - `compression_ratio` (REAL) - Compression ratio achieved
 - `compression_level` (INTEGER) - Compression level used for this snapshot
 - `upload_bytes` (INTEGER) - Total bytes uploaded during this snapshot
 - `upload_duration_ms` (INTEGER) - Total milliseconds spent uploading to S3
 
-**Purpose:** Provides snapshot metadata and statistics including version tracking for compatibility.
+**Purpose:** Provides snapshot metadata and statistics including version
+tracking for compatibility.
 
 ### 8. `snapshot_files`
+
 Maps snapshots to the files they contain.
 
 **Columns:**
+
 - `snapshot_id` (TEXT) - Snapshot ID (FK to snapshots.id)
 - `file_id` (TEXT) - File ID (FK to files.id)
 - PRIMARY KEY (`snapshot_id`, `file_id`)
@@ -143,114 +182,146 @@ Maps snapshots to the files they contain.
 **Purpose:** Records which files are included in each snapshot.
 
 ### 9. `snapshot_blobs`
+
 Maps snapshots to the blobs they reference.
 
 **Columns:**
+
 - `snapshot_id` (TEXT) - Snapshot ID (FK to snapshots.id)
 - `blob_id` (TEXT) - Blob ID (FK to blobs.id)
 - `blob_hash` (TEXT) - Denormalized blob hash for manifest generation
 - PRIMARY KEY (`snapshot_id`, `blob_id`)
 
-**Purpose:** Tracks blob dependencies for snapshots and enables manifest generation.
+**Purpose:** Tracks blob dependencies for snapshots and enables manifest
+generation.
 
 ### 10. `snapshot_mount_points`
-The directories at or below a configured path, the configured path itself included, that a snapshot's backup found an entry in and, once it had listed them, found on a different filesystem from their parent directory (a different device number), as a mount point is. An automount point whose volume cannot be mounted is not recorded, because the backup finds no entry in it.
+
+The directories at or below a configured path, the configured path itself
+included, that a snapshot's backup found an entry in and, once it had listed
+them, found on a different filesystem from their parent directory (a different
+device number), as a mount point is. An automount point whose volume cannot be
+mounted is not recorded, because the backup finds no entry in it.
 
 **Columns:**
+
 - `snapshot_id` (TEXT) - Snapshot ID (FK to snapshots.id)
 - `path` (TEXT) - Absolute path of the directory
 - PRIMARY KEY (`snapshot_id`, `path`)
 
-**Purpose:** Lets `snapshot create --prune` skip the prune when a backup does not find a mount point that an earlier snapshot of the same name found, as when the volume is not mounted.
+**Purpose:** Lets `snapshot create --prune` skip the prune when a backup does
+not find a mount point that an earlier snapshot of the same name found, as when
+the volume is not mounted.
 
 ### 11. `uploads`
+
 Tracks blob upload metrics.
 
 **Columns:**
+
 - `blob_hash` (TEXT PRIMARY KEY) - Hash of uploaded blob
-- `snapshot_id` (TEXT NOT NULL) - The snapshot that triggered this upload (FK to snapshots.id)
+- `snapshot_id` (TEXT NOT NULL) - The snapshot that triggered this upload (FK to
+  snapshots.id)
 - `uploaded_at` (INTEGER) - Upload timestamp
 - `size` (INTEGER) - Size of uploaded blob
 - `duration_ms` (INTEGER) - Upload duration in milliseconds
 
-**Purpose:** Performance monitoring and tracking which blobs were newly created (uploaded) during each snapshot.
+**Purpose:** Performance monitoring and tracking which blobs were newly created
+(uploaded) during each snapshot.
 
 ## Data Flow and Operations
 
 ### 1. Backup Process
 
 1. **File Scanning**
-   - `INSERT OR REPLACE INTO files` - Update file metadata
-   - `SELECT * FROM files WHERE path = ?` - Check if file has changed
-   - `INSERT INTO snapshot_files` - Add file to current snapshot
-   - `INSERT OR IGNORE INTO snapshot_mount_points` - Record each directory on a different filesystem from its parent that the walk found an entry in
+    - `INSERT OR REPLACE INTO files` - Update file metadata
+    - `SELECT * FROM files WHERE path = ?` - Check if file has changed
+    - `INSERT INTO snapshot_files` - Add file to current snapshot
+    - `INSERT OR IGNORE INTO snapshot_mount_points` - Record each directory on a
+      different filesystem from its parent that the walk found an entry in
 
 2. **Chunking** (for changed files)
-   - `INSERT OR IGNORE INTO chunks` - Store new chunks
-   - `INSERT INTO file_chunks` - Map chunks to file
-   - `INSERT INTO chunk_files` - Create reverse mapping
+    - `INSERT OR IGNORE INTO chunks` - Store new chunks
+    - `INSERT INTO file_chunks` - Map chunks to file
+    - `INSERT INTO chunk_files` - Create reverse mapping
 
 3. **Blob Packing**
-   - `INSERT INTO blobs` - Create blob record with UUID (blob_hash NULL)
-   - `INSERT INTO blob_chunks` - Associate chunks with blob immediately
-   - `UPDATE blobs SET blob_hash = ?, finished_ts = ?` - Finalize blob after packing
+    - `INSERT INTO blobs` - Create blob record with UUID (blob_hash NULL)
+    - `INSERT INTO blob_chunks` - Associate chunks with blob immediately
+    - `UPDATE blobs SET blob_hash = ?, finished_ts = ?` - Finalize blob after
+      packing
 
 4. **Upload**
-   - `UPDATE blobs SET uploaded_ts = ?, compressed_size = ?` - Mark blob as uploaded, with the size of the object in storage (the upload is skipped when the blob is already stored)
-   - `INSERT INTO uploads` - Record upload metrics with snapshot_id
-   - `INSERT INTO snapshot_blobs` - Associate blob with snapshot
+    - `UPDATE blobs SET uploaded_ts = ?, compressed_size = ?` - Mark blob as
+      uploaded, with the size of the object in storage (the upload is skipped
+      when the blob is already stored)
+    - `INSERT INTO uploads` - Record upload metrics with snapshot_id
+    - `INSERT INTO snapshot_blobs` - Associate blob with snapshot
 
 5. **Snapshot Completion**
-   - `UPDATE snapshots SET completed_at = ?, stats...` - Finalize snapshot
-   - Generate and upload blob manifest from `snapshot_blobs`
+    - `UPDATE snapshots SET completed_at = ?, stats...` - Finalize snapshot
+    - Generate and upload blob manifest from `snapshot_blobs`
 
 ### 2. Incremental Backup
 
 1. **Change Detection**
-   - `SELECT * FROM files WHERE path = ?` - Get previous file metadata
-   - Compare mtime, size, mode to detect changes
-   - Re-chunk a file that lists a chunk no uploaded blob holds, even when its metadata is unchanged
-   - Skip unchanged files but still add to `snapshot_files`
+    - `SELECT * FROM files WHERE path = ?` - Get previous file metadata
+    - Compare mtime, size, mode to detect changes
+    - Re-chunk a file that lists a chunk no uploaded blob holds, even when its
+      metadata is unchanged
+    - Skip unchanged files but still add to `snapshot_files`
 
 2. **Chunk Reuse**
-   - `SELECT * FROM blob_chunks WHERE chunk_hash = ?` - Find existing chunks
-   - `INSERT INTO snapshot_blobs` - Reference existing blobs for unchanged files
+    - `SELECT * FROM blob_chunks WHERE chunk_hash = ?` - Find existing chunks
+    - `INSERT INTO snapshot_blobs` - Reference existing blobs for unchanged
+      files
 
 ### 3. Snapshot Metadata Export
 
 After a snapshot is completed:
+
 1. Copy database to temporary file
 2. Clean temporary database to contain only current snapshot data
 3. VACUUM the trimmed database so deleted rows leave no pages behind
 4. Compress with zstd and encrypt with age
 5. Upload to S3 as `metadata/{remote-key}/db.zst.age`
-6. Generate blob manifest and upload as `metadata/{remote-key}/manifest.json.zst`
+6. Generate blob manifest and upload as
+   `metadata/{remote-key}/manifest.json.zst`
 
-The `{remote-key}` directory name is a one-way hash of the human snapshot ID, so the ID is never written to the store in plaintext. The hash uses no secret, so a guessed hostname and snapshot name can still be confirmed against a listing; see [REPOSTRUCTURE.md](REPOSTRUCTURE.md#remote-key-derivation) and its [Accepted Risks](REPOSTRUCTURE.md#accepted-risks).
+The `{remote-key}` directory name is a one-way hash of the human snapshot ID, so
+the ID is never written to the store in plaintext. The hash uses no secret, so a
+guessed hostname and snapshot name can still be confirmed against a listing; see
+[REPOSTRUCTURE.md](REPOSTRUCTURE.md#remote-key-derivation) and its
+[Accepted Risks](REPOSTRUCTURE.md#accepted-risks).
 
 ### 4. Restore Process
 
 The restore process doesn't use the local database. Instead:
-1. Downloads and decrypts the snapshot's metadata database (`db.zst.age`) from S3
-2. Downloads the blobs holding the chunks of the files being restored, found through that database's `blob_chunks` table; the manifest is not read
+
+1. Downloads and decrypts the snapshot's metadata database (`db.zst.age`) from
+   S3
+2. Downloads the blobs holding the chunks of the files being restored, found
+   through that database's `blob_chunks` table; the manifest is not read
 3. Reconstructs files from decrypted and decompressed chunks
 
 ### 5. Pruning
 
 1. **Identify Unreferenced Blobs**
-   - Query blobs not referenced by any remaining snapshot
-   - Delete from S3, once older than `prune_grace_period`, and from the local
-     database
+    - Query blobs not referenced by any remaining snapshot
+    - Delete from S3, once older than `prune_grace_period`, and from the local
+      database
 2. **Delete Metadata Directories With No Manifest**
-   - Delete each directory under `metadata/` that has no `manifest.json.zst`
-     and no local snapshot record, once every object in it is older than
-     `prune_grace_period`
+    - Delete each directory under `metadata/` that has no `manifest.json.zst`
+      and no local snapshot record, once every object in it is older than
+      `prune_grace_period`
 
 ### 6. Incomplete Snapshot Cleanup
 
 Before each backup:
+
 1. Query incomplete snapshots (where `completed_at IS NULL`)
-2. Delete each one and all its associations, without checking S3 for its metadata
+2. Delete each one and all its associations, without checking S3 for its
+   metadata
 3. Clean up orphaned files, chunks, and blobs
 
 ## Repository Pattern
@@ -267,11 +338,13 @@ Vaultik uses a repository pattern for database access:
 - `UploadRepository` - Track blob upload metrics
 
 Each repository provides methods like:
+
 - `Create()` - Insert new record
 - `GetByID()` / `GetByPath()` / `GetByHash()` - Retrieve records
 - `Update()` - Update existing records
 - `Delete()` - Remove records
-- Specialized queries for each entity type (e.g., `DeleteOrphaned()`, `GetIncompleteByHostname()`)
+- Specialized queries for each entity type (e.g., `DeleteOrphaned()`,
+  `GetIncompleteByHostname()`)
 
 ## Transaction Management
 
@@ -284,6 +357,7 @@ err := repos.WithTx(ctx, func(ctx context.Context, tx *sql.Tx) error {
 ```
 
 This ensures consistency, especially important for operations like:
+
 - Creating file-chunk mappings
 - Associating chunks with blobs
 - Updating snapshot statistics
@@ -291,18 +365,25 @@ This ensures consistency, especially important for operations like:
 ## Performance Considerations
 
 1. **Indexes**:
-   - Primary keys are automatically indexed
-   - `idx_files_path` on `files(path)` for efficient file lookups
+    - Primary keys are automatically indexed
+    - `idx_files_path` on `files(path)` for efficient file lookups
 
-2. **Prepared Statements**: All queries use prepared statements for performance and security
+2. **Prepared Statements**: All queries use prepared statements for performance
+   and security
 
-3. **Batch Operations**: Where possible, operations are batched within transactions
+3. **Batch Operations**: Where possible, operations are batched within
+   transactions
 
-4. **Write-Ahead Logging**: The local index runs in SQLite WAL mode with a 10-second busy timeout, so a read-only command such as `snapshot list` can read it while a backup writes to it. Committed rows can sit in the `-wal` file beside the index until a checkpoint, so the metadata export copies the index through SQLite (`VACUUM INTO`), not as a file
+4. **Write-Ahead Logging**: The local index runs in SQLite WAL mode with a
+   10-second busy timeout, so a read-only command such as `snapshot list` can
+   read it while a backup writes to it. Committed rows can sit in the `-wal`
+   file beside the index until a checkpoint, so the metadata export copies the
+   index through SQLite (`VACUUM INTO`), not as a file
 
 ## Data Integrity
 
-1. **Foreign Keys**: Enforced through CASCADE DELETE and application-level repository methods
+1. **Foreign Keys**: Enforced through CASCADE DELETE and application-level
+   repository methods
 2. **Unique Constraints**: Chunk hashes, file paths, and blob hashes are unique
 3. **Null Handling**: Nullable fields clearly indicate in-progress operations
 4. **Timestamp Tracking**: All major operations record timestamps for auditing

docs/REPOSTRUCTURE.md

@@ -1,10 +1,13 @@
 # Vaultik S3 Repository Structure
 
-This document describes the structure and organization of data stored in the S3 bucket by Vaultik.
+This document describes the structure and organization of data stored in the S3
+bucket by Vaultik.
 
 ## Overview
 
-Vaultik stores all backup data in an S3-compatible object store. The repository consists of two main components, plus a marker file:
+Vaultik stores all backup data in an S3-compatible object store. The repository
+consists of two main components, plus a marker file:
+
 1. **Blobs** - The actual backup data (content-addressed, encrypted)
 2. **Metadata** - Snapshot information and manifests (partially encrypted)
 
@@ -23,120 +26,208 @@ Vaultik stores all backup data in an S3-compatible object store. The repository
         └── manifest.json.zst
 ```
 
-The metadata subdirectory is named with the **remote key**, a one-way hash of the snapshot ID, not with the human-readable snapshot ID itself. See [Remote Key Derivation](#remote-key-derivation).
+The metadata subdirectory is named with the **remote key**, a one-way hash of
+the snapshot ID, not with the human-readable snapshot ID itself. See
+[Remote Key Derivation](#remote-key-derivation).
 
 ## Marker File (`vaultik-destination.txt`)
 
-Every backup writes this file at the root before it uploads anything. It holds one fixed line of plain text and names no host, path or time. While the local index holds snapshots stored there, a destination that answers a look-up of the marker with not found is treated as not present: `snapshot create` refuses to write to it, and `prune`, `snapshot purge`, `snapshot remove`, `snapshot list` and `remote nuke` behave as for a destination that cannot be listed. An unplugged volume leaves an empty directory at its mount point, and without the marker that directory would read as a destination whose snapshots are all gone. `remote nuke` deletes the marker last.
+Every backup writes this file at the root before it uploads anything. It holds
+one fixed line of plain text and names no host, path or time. While the local
+index holds snapshots stored there, a destination that answers a look-up of the
+marker with not found is treated as not present: `snapshot create` refuses to
+write to it, and `prune`, `snapshot purge`, `snapshot remove`, `snapshot list`
+and `remote nuke` behave as for a destination that cannot be listed. An
+unplugged volume leaves an empty directory at its mount point, and without the
+marker that directory would read as a destination whose snapshots are all gone.
+`remote nuke` deletes the marker last.
 
-When the look-up of the marker fails for any reason other than not found, the check is skipped and the command goes on. S3 refuses it on every run to credentials that allow only PUT, so a host with such credentials does not notice a destination emptied since its last backup, and its next backup would leave out the data its local index records as already stored. After the destination is emptied, run `vaultik database delete` on such a host before it backs up again.
+When the look-up of the marker fails for any reason other than not found, the
+check is skipped and the command goes on. S3 refuses it on every run to
+credentials that allow only PUT, so a host with such credentials does not notice
+a destination emptied since its last backup, and its next backup would leave out
+the data its local index records as already stored. After the destination is
+emptied, run `vaultik database delete` on such a host before it backs up again.
 
 ## Blobs Directory (`blobs/`)
 
 ### Structure
+
 - **Path format**: `blobs/<first-2-chars>/<next-2-chars>/<full-hash>`
-- **Example**: `blobs/ca/fe/cafebabe1234567890abcdef1234567890abcdef1234567890abcdef12345678`
-- **Sharding**: The two-level directory structure (using the first 4 characters of the hash) prevents any single directory from containing too many objects
+- **Example**:
+  `blobs/ca/fe/cafebabe1234567890abcdef1234567890abcdef1234567890abcdef12345678`
+- **Sharding**: The two-level directory structure (using the first 4 characters
+  of the hash) prevents any single directory from containing too many objects
 
 ### Content
+
 - **What it contains**: Packed collections of content-defined chunks from files
 - **Format**: Zstandard compressed, then Age encrypted
 - **Encryption**: Always encrypted with Age using the configured recipients
-- **Naming**: Content-addressed. The blob's name is `hex(SHA256(SHA256(uncompressed blob contents)))` — the double SHA-256 of the concatenated chunk data, computed before compression and encryption, not a hash of the stored (compressed, encrypted) bytes. One consequence: only a holder of the age private key can check a stored blob's integrity, because matching a blob to its name means decrypting and decompressing it first — which is what `restore` and `verify --deep` do. Implemented in `internal/blobgen` (`DoubleSHA256`). This is the canonical description of blob naming; other documents and comments point here.
+- **Naming**: Content-addressed. The blob's name is
+  `hex(SHA256(SHA256(uncompressed blob contents)))` — the double SHA-256 of the
+  concatenated chunk data, computed before compression and encryption, not a
+  hash of the stored (compressed, encrypted) bytes. One consequence: only a
+  holder of the age private key can check a stored blob's integrity, because
+  matching a blob to its name means decrypting and decompressing it first —
+  which is what `restore` and `verify --deep` do. Implemented in
+  `internal/blobgen` (`DoubleSHA256`). This is the canonical description of blob
+  naming; other documents and comments point here.
 
 ### Why Encrypted
-Blobs contain the actual file data from backups and must be encrypted for security. The content-addressing ensures deduplication while the encryption ensures privacy.
+
+Blobs contain the actual file data from backups and must be encrypted for
+security. The content-addressing ensures deduplication while the encryption
+ensures privacy.
 
 ## Metadata Directory (`metadata/`)
 
-Each snapshot has its own subdirectory. The directory is **not** named with the human-readable snapshot ID; it is named with the remote key — a one-way hash of that ID. The human ID is never written to the destination store as a directory name (see [Remote Key Derivation](#remote-key-derivation)).
+Each snapshot has its own subdirectory. The directory is **not** named with the
+human-readable snapshot ID; it is named with the remote key — a one-way hash of
+that ID. The human ID is never written to the destination store as a directory
+name (see [Remote Key Derivation](#remote-key-derivation)).
 
 ### Snapshot ID Format
 
-The human-readable snapshot ID is used in CLI arguments, log lines, and the local database. It is not written to the destination store.
-- **Format**: `<hostname>_<snapshot-name>_<RFC3339>` (or `<hostname>_<RFC3339>` if no
-  name was specified)
+The human-readable snapshot ID is used in CLI arguments, log lines, and the
+local database. It is not written to the destination store.
+
+- **Format**: `<hostname>_<snapshot-name>_<RFC3339>` (or `<hostname>_<RFC3339>`
+  if no name was specified)
 - **Example**: `laptop_home_2024-01-15T14:30:52Z`
 - **Components**:
-  - Short hostname (everything before the first dot is stripped from the FQDN)
-  - Snapshot name from the configured `snapshots:` map (optional)
-  - RFC3339 UTC timestamp
+    - Short hostname (everything before the first dot is stripped from the FQDN)
+    - Snapshot name from the configured `snapshots:` map (optional)
+    - RFC3339 UTC timestamp
 
-This ID reveals the hostname, the configured snapshot name, and the backup time, so it is never used as the on-disk directory name — the remote key is used instead.
+This ID reveals the hostname, the configured snapshot name, and the backup time,
+so it is never used as the on-disk directory name — the remote key is used
+instead.
 
 ### Remote Key Derivation
 
-The remote key is `hex(SHA256(SHA256("vaultik|" + snapshot-id)))`: a double SHA-256 over the snapshot ID, with a `vaultik|` domain-separation prefix. The result is a 64-character hex string. The hash is not reversible, but it uses no secret: an observer who guesses a candidate hostname and snapshot name can hash it the same way and confirm whether that snapshot is present. The remote key keeps names out of a plain listing; it does not hide them from a guess. Implemented in `internal/snapshot/remotekey.go`.
+The remote key is `hex(SHA256(SHA256("vaultik|" + snapshot-id)))`: a double
+SHA-256 over the snapshot ID, with a `vaultik|` domain-separation prefix. The
+result is a 64-character hex string. The hash is not reversible, but it uses no
+secret: an observer who guesses a candidate hostname and snapshot name can hash
+it the same way and confirm whether that snapshot is present. The remote key
+keeps names out of a plain listing; it does not hide them from a guess.
+Implemented in `internal/snapshot/remotekey.go`.
 
 Worked example:
+
 - Snapshot ID: `server1_home_2025-06-01T12:00:00Z`
 - Remote key: `17f97bcde958748af076b926af59823943db59e80ce7170b40f124dfa28f64aa`
-- Directory: `metadata/17f97bcde958748af076b926af59823943db59e80ce7170b40f124dfa28f64aa/`
+- Directory:
+  `metadata/17f97bcde958748af076b926af59823943db59e80ce7170b40f124dfa28f64aa/`
 
-A plain listing of the destination store therefore shows only these hashes, not the hostname or snapshot name of any backup — but because the hash uses no secret, a guessed hostname and snapshot name can be hashed and confirmed against the listing. The same remote key is stored in the manifest's `snapshot_id` field.
+A plain listing of the destination store therefore shows only these hashes, not
+the hostname or snapshot name of any backup — but because the hash uses no
+secret, a guessed hostname and snapshot name can be hashed and confirmed against
+the listing. The same remote key is stored in the manifest's `snapshot_id`
+field.
 
 ### Files in Each Snapshot Directory
 
 #### `db.zst.age` - Encrypted Database
+
 - **What it contains**: Pruned binary SQLite database for this snapshot
 - **Format**: Binary SQLite → Zstandard compressed → Age encrypted
 - **Encryption**: Encrypted with Age
-- **Purpose**: Contains full file metadata, chunk mappings, and all relationships
-- **Why encrypted**: Contains sensitive metadata like file paths, permissions, and ownership
+- **Purpose**: Contains full file metadata, chunk mappings, and all
+  relationships
+- **Why encrypted**: Contains sensitive metadata like file paths, permissions,
+  and ownership
 
 #### `manifest.json.zst` - Unencrypted Blob Manifest
+
 - **What it contains**: JSON list of all blob hashes referenced by this snapshot
 - **Format**: JSON → Zstandard compressed (NOT encrypted)
 - **Encryption**: NOT encrypted
 - **Purpose**: Enables pruning operations without requiring decryption keys
 - **Structure**:
+
 ```json
 {
-  "snapshot_id": "17f97bcde958748af076b926af59823943db59e80ce7170b40f124dfa28f64aa",
-  "timestamp": "2025-06-01T12:00:00Z",
-  "blob_count": 42,
-  "total_compressed_size": 1048576,
-  "blobs": [
-    { "hash": "cafebabe1234567890abcdef1234567890abcdef1234567890abcdef12345678", "compressed_size": 24576 },
-    { "hash": "deadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678", "compressed_size": 32768 }
-  ]
+    "snapshot_id": "17f97bcde958748af076b926af59823943db59e80ce7170b40f124dfa28f64aa",
+    "timestamp": "2025-06-01T12:00:00Z",
+    "blob_count": 42,
+    "total_compressed_size": 1048576,
+    "blobs": [
+        {
+            "hash": "cafebabe1234567890abcdef1234567890abcdef1234567890abcdef12345678",
+            "compressed_size": 24576
+        },
+        {
+            "hash": "deadbeef1234567890abcdef1234567890abcdef1234567890abcdef12345678",
+            "compressed_size": 32768
+        }
+    ]
 }
 ```
-`snapshot_id` is the remote key (a hash), not the human ID; `timestamp` is written in the clear.
+
+`snapshot_id` is the remote key (a hash), not the human ID; `timestamp` is
+written in the clear.
 
 ### Why Manifest is Unencrypted
+
 The manifest must be readable without the private key to enable:
+
 1. **Pruning operations** - Identifying unreferenced blobs for deletion
 2. **Storage analysis** - Understanding space usage without decryption
 3. **Verification** - Checking blob existence without decryption
-4. **Cross-snapshot deduplication analysis** - Finding shared blobs between snapshots
+4. **Cross-snapshot deduplication analysis** - Finding shared blobs between
+   snapshots
 
-The manifest contains the remote key, the backup timestamp, the blob count and total compressed size, and each blob's hash and compressed size. It contains no file names, paths, or other decrypted metadata.
+The manifest contains the remote key, the backup timestamp, the blob count and
+total compressed size, and each blob's hash and compressed size. It contains no
+file names, paths, or other decrypted metadata.
 
 ## Security Considerations
 
 ### What's Encrypted
+
 - **All file content** (in blobs)
-- **All file metadata** (paths, permissions, timestamps, ownership in db.zst.age)
+- **All file metadata** (paths, permissions, timestamps, ownership in
+  db.zst.age)
 - **File-to-chunk mappings** (in db.zst.age)
 
 ### What's Not Encrypted
-- **The remote key** — directory names and the manifest `snapshot_id`, a one-way hash of the snapshot ID (see [Remote Key Derivation](#remote-key-derivation))
+
+- **The remote key** — directory names and the manifest `snapshot_id`, a one-way
+  hash of the snapshot ID (see [Remote Key Derivation](#remote-key-derivation))
 - **The backup timestamp** (in manifest.json.zst)
 - **Blob hashes and their compressed sizes** (in manifest.json.zst)
 - **Blob count and total compressed size per snapshot** (in manifest.json.zst)
 
 ### Privacy Implications
-From the unencrypted data, an observer of the destination store can determine:
-- **When each backup was taken** — not from the directory name, which is a one-way hash, but from the plaintext `timestamp` field in manifest.json.zst, which is published in the clear
-- How many blobs each snapshot references, and the total compressed size
-- The compressed size of each blob, and which blobs are shared between snapshots (deduplication patterns)
-- **Whether a guessed hostname and snapshot name are present** — the remote key is an unkeyed hash, so an observer holding candidate names can hash each one and match it against the directory listing. The human ID is never published, so it cannot be read off directly, but it can be confirmed by guessing.
 
-Together these give an observer a timing-and-size profile of every snapshot. This is an accepted, documented property of the format, not a defect: the manifest is unencrypted so that pruning can run without the private key, and the timing channel could not be closed by encrypting it anyway — object creation times and per-object sizes stay visible at the storage layer on both `s3://` and `file://` destinations regardless.
+From the unencrypted data, an observer of the destination store can determine:
+
+- **When each backup was taken** — not from the directory name, which is a
+  one-way hash, but from the plaintext `timestamp` field in manifest.json.zst,
+  which is published in the clear
+- How many blobs each snapshot references, and the total compressed size
+- The compressed size of each blob, and which blobs are shared between snapshots
+  (deduplication patterns)
+- **Whether a guessed hostname and snapshot name are present** — the remote key
+  is an unkeyed hash, so an observer holding candidate names can hash each one
+  and match it against the directory listing. The human ID is never published,
+  so it cannot be read off directly, but it can be confirmed by guessing.
+
+Together these give an observer a timing-and-size profile of every snapshot.
+This is an accepted, documented property of the format, not a defect: the
+manifest is unencrypted so that pruning can run without the private key, and the
+timing channel could not be closed by encrypting it anyway — object creation
+times and per-object sizes stay visible at the storage layer on both `s3://` and
+`file://` destinations regardless.
 
 An observer cannot determine:
-- The hostname or snapshot name of any backup by reading it off the store — the directory name and the manifest `snapshot_id` are unkeyed hashes of the human ID, so the text is never published (though a guessed name can be confirmed, as above)
+
+- The hostname or snapshot name of any backup by reading it off the store — the
+  directory name and the manifest `snapshot_id` are unkeyed hashes of the human
+  ID, so the text is never published (though a guessed name can be confirmed, as
+  above)
 - File names or paths
 - File contents
 - File permissions or ownership
@@ -145,39 +236,118 @@ An observer cannot determine:
 
 ### Accepted Risks
 
-These are known, deliberate properties of the format and the tooling, recorded so an operator can weigh them rather than discover them.
+These are known, deliberate properties of the format and the tooling, recorded
+so an operator can weigh them rather than discover them.
 
-1. **No proof of authorship.** Restore and `verify --deep` prove that data decrypts with the age private key and matches its unkeyed content hashes. They do not prove who wrote it: anyone who knows a recipient public key and can replace objects on the destination can substitute a snapshot they built. The recipient string is not stored at the destination, but a compromised backed-up host has it. Defences live on the destination side — bucket versioning or object lock, credentials for the source host that cannot delete or overwrite existing versions, and pruning from a trusted host. Note that S3 `PutObject` overwrites an existing key, so PUT permission alone is not append-only.
-2. **Compression reveals sizes.** Blobs and `db.zst.age` are zstd-compressed then age-encrypted; the manifest is compressed only. age does not pad, so an object's size is the exact compressed length of its contents. All new chunks packed into one blob share a single zstd stream (8 MiB window, 4 MiB at compression levels 1-2), and a blob is closed at `blob_size_limit` and at the end of each configured path. Because a stored chunk is never packed again, someone who can write into a backed-up file and watch blob sizes learns something only when their controlled data and a secret land in the same chunk of a file that keeps changing. Advice: back up any outsider-writable directory as its own snapshot.
-3. **Chunking uses no secret.** The FastCDC parameters are fixed and public. The default 10 MB average yields chunks between 2.5 MB and 40 MB, and any file of 2.5 MB or less is a single chunk. At the default 10 GB `blob_size_limit` a blob holds hundreds of chunks, so individual chunk lengths are not visible in the blob's size; lowering the limit toward the chunk size begins to expose them.
-4. **Decrypted data on local disk.** Several commands stage plaintext under `$TMPDIR`: `snapshot restore` writes decrypted blobs under `vaultik-blobcache-*/` (no size cap) and the decrypted metadata database at `vaultik-restore-*/snapshot.db`; `verify --deep` writes that database at `vaultik-verify-*/snapshot.db`; `snapshot create` keeps a plaintext copy of the index at `vaultik-snapshot-*/snapshot.db`. These files are created `0600` and removed on success, but a `kill -9` or a power loss leaves them behind — delete any leftover `vaultik-*` directory under `$TMPDIR` by hand. `$TMPDIR` should be trusted to the same degree as the restore target.
-5. **Store permissions differ per command.** The backed-up host needs only PUT to run `snapshot create`: it writes blobs and metadata and neither reads nor deletes them. Other commands need more — `snapshot verify`, `snapshot restore`, and `prune` list and read; `prune`, `snapshot purge`, `snapshot remove`, and `remote nuke` also delete. The recommended cron line uses `--prune`, which runs `prune` on the backed-up host, so granting that host `--prune` gives it credentials that can delete its own backups. To keep the source host to PUT only, prune from a separate trusted host instead.
-6. **Changing recipients does not re-encrypt existing data.** Deduplicated chunks and same-named blobs already on the destination stay encrypted to the recipients in force when they were written. A new snapshot that reuses them cannot be restored with a newly added recipient's key alone, because those reused objects were never encrypted to it. To make everything readable by a new key, run `vaultik database delete` and take a full backup to a fresh destination or prefix.
-7. **X25519 recipients only.** vaultik rejects age ssh and plugin recipients. Long-lived ciphertext held by a third party (the destination operator) has no fallback if X25519 is ever broken: there is no second recipient type and no post-quantum option.
+1. **No proof of authorship.** Restore and `verify --deep` prove that data
+   decrypts with the age private key and matches its unkeyed content hashes.
+   They do not prove who wrote it: anyone who knows a recipient public key and
+   can replace objects on the destination can substitute a snapshot they built.
+   The recipient string is not stored at the destination, but a compromised
+   backed-up host has it. Defences live on the destination side — bucket
+   versioning or object lock, credentials for the source host that cannot delete
+   or overwrite existing versions, and pruning from a trusted host. Note that S3
+   `PutObject` overwrites an existing key, so PUT permission alone is not
+   append-only.
+2. **Compression reveals sizes.** Blobs and `db.zst.age` are zstd-compressed
+   then age-encrypted; the manifest is compressed only. age does not pad, so an
+   object's size is the exact compressed length of its contents. All new chunks
+   packed into one blob share a single zstd stream (8 MiB window, 4 MiB at
+   compression levels 1-2), and a blob is closed at `blob_size_limit` and at the
+   end of each configured path. Because a stored chunk is never packed again,
+   someone who can write into a backed-up file and watch blob sizes learns
+   something only when their controlled data and a secret land in the same chunk
+   of a file that keeps changing. Advice: back up any outsider-writable
+   directory as its own snapshot.
+3. **Chunking uses no secret.** The FastCDC parameters are fixed and public. The
+   default 10 MB average yields chunks between 2.5 MB and 40 MB, and any file of
+   2.5 MB or less is a single chunk. At the default 10 GB `blob_size_limit` a
+   blob holds hundreds of chunks, so individual chunk lengths are not visible in
+   the blob's size; lowering the limit toward the chunk size begins to expose
+   them.
+4. **Decrypted data on local disk.** Several commands stage plaintext under
+   `$TMPDIR`: `snapshot restore` writes decrypted blobs under
+   `vaultik-blobcache-*/` (no size cap) and the decrypted metadata database at
+   `vaultik-restore-*/snapshot.db`; `verify --deep` writes that database at
+   `vaultik-verify-*/snapshot.db`; `snapshot create` keeps a plaintext copy of
+   the index at `vaultik-snapshot-*/snapshot.db`. These files are created `0600`
+   and removed on success, but a `kill -9` or a power loss leaves them behind —
+   delete any leftover `vaultik-*` directory under `$TMPDIR` by hand. `$TMPDIR`
+   should be trusted to the same degree as the restore target.
+5. **Store permissions differ per command.** The backed-up host needs only PUT
+   to run `snapshot create`: it writes blobs and metadata and neither reads nor
+   deletes them. Other commands need more — `snapshot verify`,
+   `snapshot restore`, and `prune` list and read; `prune`, `snapshot purge`,
+   `snapshot remove`, and `remote nuke` also delete. The recommended cron line
+   uses `--prune`, which runs `prune` on the backed-up host, so granting that
+   host `--prune` gives it credentials that can delete its own backups. To keep
+   the source host to PUT only, prune from a separate trusted host instead.
+6. **Changing recipients does not re-encrypt existing data.** Deduplicated
+   chunks and same-named blobs already on the destination stay encrypted to the
+   recipients in force when they were written. A new snapshot that reuses them
+   cannot be restored with a newly added recipient's key alone, because those
+   reused objects were never encrypted to it. To make everything readable by a
+   new key, run `vaultik database delete` and take a full backup to a fresh
+   destination or prefix.
+7. **X25519 recipients only.** vaultik rejects age ssh and plugin recipients.
+   Long-lived ciphertext held by a third party (the destination operator) has no
+   fallback if X25519 is ever broken: there is no second recipient type and no
+   post-quantum option.
 
 ## Consistency Guarantees
 
 1. **Blobs are immutable** - Once written, a blob is never modified
-2. **Blobs are written before metadata** - A snapshot's metadata is only written after all its blobs are successfully uploaded
-3. **Metadata is written atomically** - Both db.zst.age and manifest.json.zst are written as complete files
-4. **A snapshot is marked complete in the local DB only after its metadata is uploaded** - `finalizeSnapshotMetadata` runs `ExportSnapshotMetadata` first and records completion (`MarkSnapshotComplete`) only once the export succeeds (see the backup data flow in [ARCHITECTURE.md](../ARCHITECTURE.md)). A crash during the export therefore leaves the snapshot incomplete, so the next backup's `PruneDatabase` drops it and re-backs-up its data, rather than leaving a completed-looking row in the local index with no matching metadata on the destination store. (A crash in the brief moment after the export succeeds but before completion is recorded leaves a fully-restorable snapshot on the destination that the local index drops as incomplete on the next run; `snapshot list` then reports it honestly as remote-only, which is the safe direction: the destination copy stays restorable.)
+2. **Blobs are written before metadata** - A snapshot's metadata is only written
+   after all its blobs are successfully uploaded
+3. **Metadata is written atomically** - Both db.zst.age and manifest.json.zst
+   are written as complete files
+4. **A snapshot is marked complete in the local DB only after its metadata is
+   uploaded** - `finalizeSnapshotMetadata` runs `ExportSnapshotMetadata` first
+   and records completion (`MarkSnapshotComplete`) only once the export succeeds
+   (see the backup data flow in [ARCHITECTURE.md](ARCHITECTURE.md)). A crash
+   during the export therefore leaves the snapshot incomplete, so the next
+   backup's `PruneDatabase` drops it and re-backs-up its data, rather than
+   leaving a completed-looking row in the local index with no matching metadata
+   on the destination store. (A crash in the brief moment after the export
+   succeeds but before completion is recorded leaves a fully-restorable snapshot
+   on the destination that the local index drops as incomplete on the next run;
+   `snapshot list` then reports it honestly as remote-only, which is the safe
+   direction: the destination copy stays restorable.)
 
 ## Pruning Safety
 
 The prune operation is safe because:
-1. It keeps every blob listed in any snapshot's manifest and deletes only blobs that no manifest references. Under `metadata/` it deletes only a directory that has no `manifest.json.zst`, whose name is a remote key, and that no local snapshot record claims
+
+1. It keeps every blob listed in any snapshot's manifest and deletes only blobs
+   that no manifest references. Under `metadata/` it deletes only a directory
+   that has no `manifest.json.zst`, whose name is a remote key, and that no
+   local snapshot record claims
 2. Manifests are unencrypted and can be read without keys
-3. If any manifest cannot be downloaded or decoded, prune deletes nothing and exits with an error, rather than treating that snapshot's blobs as unreferenced
-4. It deletes an unreferenced blob only once the blob is older than `prune_grace_period` (default `24h`), and a directory under `metadata/` with no manifest only once every object in it is. A backup uploads its blobs and its `db.zst.age` before its manifest, so a prune running meanwhile, on this host or another sharing the destination, leaves them as long as no backup run takes longer than the grace period. The grace period does not protect a blob a backup reuses from an earlier run that stopped before its manifest: the backup skips the upload of a blob already on the destination, so that blob keeps the time of its first upload, and a prune before the backup's manifest is written can delete it; the new snapshot then cannot be restored. `remote nuke` has no such check
+3. If any manifest cannot be downloaded or decoded, prune deletes nothing and
+   exits with an error, rather than treating that snapshot's blobs as
+   unreferenced
+4. It deletes an unreferenced blob only once the blob is older than
+   `prune_grace_period` (default `24h`), and a directory under `metadata/` with
+   no manifest only once every object in it is. A backup uploads its blobs and
+   its `db.zst.age` before its manifest, so a prune running meanwhile, on this
+   host or another sharing the destination, leaves them as long as no backup run
+   takes longer than the grace period. The grace period does not protect a blob
+   a backup reuses from an earlier run that stopped before its manifest: the
+   backup skips the upload of a blob already on the destination, so that blob
+   keeps the time of its first upload, and a prune before the backup's manifest
+   is written can delete it; the new snapshot then cannot be restored.
+   `remote nuke` has no such check
 
 ## Restoration Requirements
 
 To restore from a backup, you need:
+
 1. **The Age private key** - To decrypt blobs and database
 2. **The snapshot metadata** - Both files from the snapshot's metadata directory
 3. **All referenced blobs** - As listed in the manifest
 
 The restoration process:
+
 1. Download and decrypt the database dump to understand file structure
 2. Download and decrypt the required blobs
 3. Reconstruct files from their chunks

docs/TODO.md

@@ -0,0 +1,22 @@
+# Workflow
+
+- branch (from `main`)
+- do the work in Next Step
+- delete Next Step from `TODO.md`
+- move the top item of Future Steps into Next Step
+- commit (`TODO.md` changes in the same commit as the work)
+- merge to `main` if the branch is not protected, otherwise open a PR
+- push
+
+# Status
+
+pre-1.0
+
+# Next Step
+
+Fix the open bugs on the issue tracker that block the release. Merging `next`
+into `main` is the owner's.
+
+# Future Steps
+
+Work planned after 1.0 is listed in the README [roadmap](../README.md#roadmap).

internal/cli/app.go

@@ -90,7 +90,7 @@ func setupGlobals(
 // blank line. Used both from the fx hook (for subcommand invocations) and
 // from the root cobra Run handler (for `vaultik` with no subcommand).
 func writeStartupBanner(w *ui.Writer, startTime time.Time, shortCommit string) {
-	w.Bannerf("%s %s by %s (commit %s, built on %s) starting up at %s.",
+	w.Bannerf("%s %s by %s (commit %s, commit date %s) starting up at %s.",
 		globals.Appname, globals.Version, globals.Author,
 		shortCommit, globals.CommitDate,
 		startTime.Format(time.RFC3339))

internal/cli/config.go

@@ -8,6 +8,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"reflect"
+	"runtime"
 	"slices"
 	"strconv"
 	"strings"
@@ -30,7 +31,7 @@ const configSetArgs = 2
 // parent config dirs (e.g. ~/.config) are conventionally traversable.
 const configDirMode = 0o755
 
-// configYAMLIndent matches the 2-space indentation of defaultConfigTemplate,
+// configYAMLIndent matches the 2-space indentation of the default config,
 // so `config set` writes the file back with the same indentation rather than
 // yaml.Marshal's 4-space default.
 const configYAMLIndent = 2
@@ -50,7 +51,22 @@ var (
 			"so the file was not changed")
 )
 
-const defaultConfigTemplate = `# vaultik configuration
+// macOS is the value of runtime.GOOS on macOS.
+const macOS = "darwin"
+
+// defaultConfigText returns the file `config init` writes on the operating
+// system goos, named as runtime.GOOS names it. Only macOS gets the apps
+// snapshot, since /Applications exists nowhere else.
+func defaultConfigText(goos string) string {
+	if goos == macOS {
+		return defaultConfigHead + appsSnapshotConfig + defaultConfigTail
+	}
+
+	return defaultConfigHead + defaultConfigTail
+}
+
+// defaultConfigHead is the default config up to the end of the home snapshot.
+const defaultConfigHead = `# vaultik configuration
 # Documentation: https://sneak.berlin/go/vaultik
 
 # ─── REQUIRED ────────────────────────────────────────────────────────────────
@@ -168,7 +184,10 @@ snapshots:
       - "/Movies/ProxyMedia"
       - "/Music/iTunes/Album Artwork"
       - "/Pictures/iPod Photo Cache"
+`
 
+// appsSnapshotConfig is the apps snapshot of the default config.
+const appsSnapshotConfig = `
   # Third-party applications. OS-provided apps live in /System/Applications
   # on modern macOS and are never in /Applications, but Apple-installed
   # App Store apps (Safari, GarageBand, iWork, iMovie) are excluded since
@@ -189,7 +208,10 @@ snapshots:
       - "/Steam.app"
       - "/VirtualBox.app"
       - "/Utilities/Adobe Installers"
+`
 
+// defaultConfigTail is the default config after the snapshots.
+const defaultConfigTail = `
 # Storage backend (pick ONE of the three forms below).
 #
 # S3-compatible:
@@ -311,7 +333,8 @@ on macOS, ~/.config/ on Linux, /etc/vaultik/ as root).`,
 				return fmt.Errorf("creating config directory %s: %w", dir, err)
 			}
 
-			err = os.WriteFile(path, []byte(defaultConfigTemplate), configFileMode)
+			err = os.WriteFile(path, []byte(defaultConfigText(runtime.GOOS)),
+				configFileMode)
 			if err != nil {
 				return fmt.Errorf("writing config file: %w", err)
 			}
@@ -420,11 +443,10 @@ number, otherwise as a map.
 
 If the config loads, a change after which it would not, such as
 compression_level 99, is refused and the file is left unchanged. A
-config that does not load, such as the one config init writes before
-storage_url is set or one with a ${ENV:...} reference to a variable
-not set here, is checked one setting at a time: only a change after
-which the changed setting cannot be read, such as one giving it the
-wrong type, is refused.
+config that does not load is checked one setting at a time. Examples
+are the file config init writes before storage_url is set, and one
+with a ${ENV:...} reference to a variable not set in this shell. In
+such a config, an unknown key or a value of the wrong type is refused.
 
 Examples:
   vaultik config set storage_url "file:///mnt/backups"
@@ -461,6 +483,11 @@ func writeConfigSet(out *ui.Writer, path, key, value string) error {
 
 	keys := strings.Split(key, ".")
 
+	_, err = config.SettingType(keys)
+	if err != nil {
+		return err
+	}
+
 	err = yamlPathSet(root, keys, value)
 	if err != nil {
 		return err
@@ -560,7 +587,7 @@ func yamlPathOnly(root *yaml.Node, keys []string) (*yaml.Node, error) {
 }
 
 // marshalConfigYAML renders a config document tree with 2-space indentation,
-// matching defaultConfigTemplate. yaml.Marshal defaults to 4 spaces, which
+// matching the default config. yaml.Marshal defaults to 4 spaces, which
 // would reindent the whole file on the first `config set` despite the promise
 // to preserve formatting.
 func marshalConfigYAML(root *yaml.Node) ([]byte, error) {
@@ -716,41 +743,11 @@ func yamlPathSet(root *yaml.Node, keys []string, value string) error {
 }
 
 // configKeyIsString reports whether the dotted key names a string in
-// config.Config, following the fields' yaml tags, as s3.access_key_id and
-// snapshots.home.exclude.0 do.
+// config.Config, as s3.access_key_id and snapshots.home.exclude.0 do.
 func configKeyIsString(keys []string) bool {
-	typ := reflect.TypeFor[config.Config]()
+	typ, err := config.SettingType(keys)
 
-	for _, key := range keys {
-		switch {
-		case typ.Kind() == reflect.Map || typ.Kind() == reflect.Slice:
-			// The key is a snapshot name or a list index.
-			typ = typ.Elem()
-		case typ.Kind() == reflect.Struct:
-			field, ok := yamlField(typ, key)
-			if !ok {
-				return false
-			}
-
-			typ = field.Type
-		default:
-			return false
-		}
-	}
-
-	return typ.Kind() == reflect.String
-}
-
-// yamlField returns the field of struct type typ whose yaml tag names key.
-func yamlField(typ reflect.Type, key string) (reflect.StructField, bool) {
-	for field := range typ.Fields() {
-		name, _, _ := strings.Cut(field.Tag.Get("yaml"), ",")
-		if name == key {
-			return field, true
-		}
-	}
-
-	return reflect.StructField{}, false
+	return err == nil && typ.Kind() == reflect.String
 }
 
 // yamlSetInMapping resolves (creating if needed) the value node for the

internal/cli/config_test.go

@@ -13,14 +13,15 @@ import (
 	"sneak.berlin/go/vaultik/internal/ui"
 )
 
-// TestDefaultConfigTemplateParses ensures the init template is valid YAML
-// that unmarshals into the Config struct with the expected snapshots.
-func TestDefaultConfigTemplateParses(t *testing.T) {
+// TestDefaultConfigParsesOnMacOS ensures the config `config init` writes on
+// macOS is valid YAML that unmarshals into the Config struct with the
+// expected snapshots.
+func TestDefaultConfigParsesOnMacOS(t *testing.T) {
 	t.Parallel()
 
 	var cfg config.Config
 
-	err := yaml.Unmarshal([]byte(defaultConfigTemplate), &cfg)
+	err := yaml.Unmarshal([]byte(defaultConfigText("darwin")), &cfg)
 	if err != nil {
 		t.Fatalf("default config template is not valid YAML: %v", err)
 	}
@@ -58,6 +59,39 @@ func TestDefaultConfigTemplateParses(t *testing.T) {
 	}
 }
 
+// TestDefaultConfigOnLinux checks that the config `config init` writes on
+// Linux loads with its home snapshot and without the apps snapshot, whose
+// /Applications exists only on macOS.
+func TestDefaultConfigOnLinux(t *testing.T) {
+	t.Parallel()
+
+	path := filepath.Join(t.TempDir(), "config.yml")
+
+	err := os.WriteFile(path, []byte(defaultConfigText("linux")), configFileMode)
+	if err != nil {
+		t.Fatalf("write config: %v", err)
+	}
+
+	err = writeConfigSet(ui.NewWithColor(&bytes.Buffer{}, false),
+		path, "storage_url", "file:///mnt/backups")
+	if err != nil {
+		t.Fatalf("config set storage_url: %v", err)
+	}
+
+	cfg, err := config.Load(path)
+	if err != nil {
+		t.Fatalf("config.Load: %v", err)
+	}
+
+	if _, ok := cfg.Snapshots["home"]; !ok {
+		t.Error("expected 'home' snapshot in the Linux default config")
+	}
+
+	if _, ok := cfg.Snapshots["apps"]; ok {
+		t.Error("the Linux default config should have no 'apps' snapshot")
+	}
+}
+
 // testRecipient is a valid age public key.
 const testRecipient = "age1278m9q7dp3chsh2dcy82qk27v047zywyvtxwnj4cvt0z65jw6a7q5dqhfj"
 
@@ -71,7 +105,7 @@ func TestConfigSetRecipientOnFreshConfig(t *testing.T) {
 
 	path := filepath.Join(t.TempDir(), "config.yml")
 
-	err := os.WriteFile(path, []byte(defaultConfigTemplate), configFileMode)
+	err := os.WriteFile(path, []byte(defaultConfigText(macOS)), configFileMode)
 	if err != nil {
 		t.Fatalf("write config: %v", err)
 	}
@@ -191,7 +225,7 @@ func TestConfigSetIndexUnderMissingKey(t *testing.T) {
 // change after which the config would not load, with an error giving the
 // reason, and leaves the file as it was. On the file `config init` writes,
 // which does not load until storage_url is set, and on one that cannot be
-// read here, only a value of the wrong type is refused.
+// read here, only an unknown key or a value of the wrong type is refused.
 func TestConfigSetKeepsFileThatWouldNotLoad(t *testing.T) {
 	t.Parallel()
 
@@ -203,6 +237,14 @@ func TestConfigSetKeepsFileThatWouldNotLoad(t *testing.T) {
 		value  string
 		reason string
 	}{
+		// Keys that no setting has, on a config that loads and on one
+		// that does not.
+		{configWithoutRecipients, "nosuchkey", "1",
+			`unknown config key "nosuchkey"`},
+		{configWithoutRecipients, "snapshots.home.exlude", "/tmp",
+			`unknown config key "snapshots.home.exlude"`},
+		{defaultConfigText(macOS), "compression_lvl", "9",
+			`unknown config key "compression_lvl"`},
 		// Index 1 of the empty list the missing key gives.
 		{configWithoutRecipients, "age_recipients.1", testRecipient,
 			"index out of range"},
@@ -220,7 +262,7 @@ func TestConfigSetKeepsFileThatWouldNotLoad(t *testing.T) {
 		{levelReference, "blob_size_limit", "1MB",
 			"blob_size_limit must be at least"},
 		// The type check on a config that does not load yet.
-		{defaultConfigTemplate, "snapshots.apps.paths", "/srv",
+		{defaultConfigText(macOS), "snapshots.apps.paths", "/srv",
 			"into []string"},
 		// The type check on a config that cannot be read here.
 		{configWithUnsetReference, "snapshots.home.paths", "/x",
@@ -380,7 +422,7 @@ func loadAfterConfigSet(t *testing.T, key, value string) *config.Config {
 
 	path := filepath.Join(t.TempDir(), "config.yml")
 
-	err := os.WriteFile(path, []byte(defaultConfigTemplate), configFileMode)
+	err := os.WriteFile(path, []byte(defaultConfigText(macOS)), configFileMode)
 	if err != nil {
 		t.Fatalf("write config: %v", err)
 	}

internal/cli/entry_banner_test.go

@@ -13,6 +13,7 @@ import (
 	"github.com/adrg/xdg"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/vaultik/internal/globals"
 )
 
 // Command words and flags used to build argument vectors below. They are
@@ -112,6 +113,35 @@ func TestBannerStillPrintedWithoutSuppressingFlag(t *testing.T) {
 	}
 }
 
+// TestBannerLabelsCommitDate checks that the banner prints the commit
+// and the commit date, each after its own label. Commit and CommitDate
+// get different values, so printing the wrong one fails.
+//
+//nolint:paralleltest // sets globals.Commit and globals.CommitDate
+func TestBannerLabelsCommitDate(t *testing.T) {
+	const (
+		commit     = "abc1234"
+		commitDate = "2026-11-09"
+	)
+
+	previousCommit, previousCommitDate := globals.Commit, globals.CommitDate
+
+	t.Cleanup(func() {
+		globals.Commit = previousCommit
+		globals.CommitDate = previousCommitDate
+	})
+
+	globals.Commit = commit
+	globals.CommitDate = commitDate
+
+	var banner bytes.Buffer
+
+	emitStartupBanner(nil, &banner)
+
+	assert.Contains(t, banner.String(),
+		"(commit "+commit+", commit date "+commitDate+")")
+}
+
 // TestBannerSuppressedInArgs covers the suppression scan directly,
 // including the flags that suppressed the banner before --json joined
 // them, so that adding --json cannot regress them.

internal/cli/version.go

@@ -37,13 +37,13 @@ func writeVersion(out *ui.Writer) {
 	w := out.Out()
 
 	_, _ = fmt.Fprintf(w, "vaultik %s\n", globals.Version)
-	_, _ = fmt.Fprintf(w, "  commit:     %s\n", globals.Commit)
-	_, _ = fmt.Fprintf(w, "  build date: %s\n", globals.CommitDate)
-	_, _ = fmt.Fprintf(w, "  go:         %s\n", runtime.Version())
-	_, _ = fmt.Fprintf(w, "  os/arch:    %s/%s\n", runtime.GOOS, runtime.GOARCH)
-	_, _ = fmt.Fprintf(w, "  author:     %s\n", globals.Author)
-	_, _ = fmt.Fprintf(w, "  homepage:   %s\n", globals.Homepage)
-	_, _ = fmt.Fprintf(w, "  license:    %s\n", globals.License)
+	_, _ = fmt.Fprintf(w, "  commit:      %s\n", globals.Commit)
+	_, _ = fmt.Fprintf(w, "  commit date: %s\n", globals.CommitDate)
+	_, _ = fmt.Fprintf(w, "  go:          %s\n", runtime.Version())
+	_, _ = fmt.Fprintf(w, "  os/arch:     %s/%s\n", runtime.GOOS, runtime.GOARCH)
+	_, _ = fmt.Fprintf(w, "  author:      %s\n", globals.Author)
+	_, _ = fmt.Fprintf(w, "  homepage:    %s\n", globals.Homepage)
+	_, _ = fmt.Fprintf(w, "  license:     %s\n", globals.License)
 
 	if globals.IsDevVersion(globals.Version) {
 		_, _ = fmt.Fprintln(w)

internal/cli/version_test.go

@@ -2,6 +2,7 @@ package cli_test
 
 import (
 	"bytes"
+	"runtime"
 	"strings"
 	"testing"
 
@@ -49,6 +50,42 @@ func TestVersionCommandReportsBuildVersion(t *testing.T) {
 	}
 }
 
+// TestVersionCommandReportLines checks the label, padding and value of
+// every line of the report. Commit and CommitDate get different values,
+// so a line that prints the wrong one fails.
+//
+//nolint:paralleltest // sets globals.Commit and globals.CommitDate
+func TestVersionCommandReportLines(t *testing.T) {
+	const (
+		commit     = "abc1234"
+		commitDate = "2026-11-09"
+	)
+
+	previousCommit, previousCommitDate := globals.Commit, globals.CommitDate
+
+	t.Cleanup(func() {
+		globals.Commit = previousCommit
+		globals.CommitDate = previousCommitDate
+	})
+
+	globals.Commit = commit
+	globals.CommitDate = commitDate
+
+	want := "vaultik " + globals.Version + "\n" +
+		"  commit:      " + commit + "\n" +
+		"  commit date: " + commitDate + "\n" +
+		"  go:          " + runtime.Version() + "\n" +
+		"  os/arch:     " + runtime.GOOS + "/" + runtime.GOARCH + "\n" +
+		"  author:      " + globals.Author + "\n" +
+		"  homepage:    " + globals.Homepage + "\n" +
+		"  license:     " + globals.License + "\n"
+
+	out := runVersionCommand(t)
+	if !strings.HasPrefix(out, want) {
+		t.Errorf("report:\n%s\nwant it to start with:\n%s", out, want)
+	}
+}
+
 // TestVersionCommandFlagsDevelopmentBuild is the regression test for
 // the thing this command exists to prevent: a build that is not a
 // release must say so. The notice used to be gated on the version

internal/config/config.go

@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"reflect"
 	"sort"
 	"strings"
 	"time"
@@ -56,7 +57,7 @@ var (
 	errRecipientNotX25519 = errors.New(
 		"not a valid recipient; only X25519 age1... public keys are supported")
 	errNoSnapshots = errors.New(
-		"at least one snapshot must be configured (see config.example.yml)")
+		"at least one snapshot must be configured (see configs/config.example.yml)")
 	errSnapshotNoPaths   = errors.New("snapshot must have at least one path")
 	errChunkSizeTooSmall = errors.New("chunk_size must be at least 1MB")
 	errBlobSizeTooSmall  = errors.New(
@@ -286,15 +287,36 @@ func Load(path string) (*Config, error) {
 }
 
 // Parse reads YAML config data as Load does, without validating it. It
-// applies default values for optional fields, fills in ${...} references
-// using smartconfig, and expands ~ in paths.
+// refuses a key that no setting has, applies default values for optional
+// fields, fills in ${...} references using smartconfig, and expands ~ in
+// paths.
 func Parse(data []byte) (*Config, error) {
+	// smartconfig drops line numbers, so keys are checked in the data as
+	// written.
+	var root yaml.Node
+
+	err := yaml.Unmarshal(data, &root)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse config: %w", err)
+	}
+
+	err = checkKeys(&root, reflect.TypeFor[Config](), "", map[*yaml.Node]bool{})
+	if err != nil {
+		return nil, err
+	}
+
 	// Load config using smartconfig for interpolation
 	sc, err := smartconfig.NewFromReader(bytes.NewReader(data))
 	if err != nil {
 		return nil, fmt.Errorf("failed to load config file: %w", err)
 	}
 
+	// A ${...} reference can bring in keys that are not in the file.
+	err = checkFilledKeys(sc.Data())
+	if err != nil {
+		return nil, err
+	}
+
 	cfg := &Config{
 		// Set defaults
 		BlobSizeLimit:    defaultBlobSizeLimit,

internal/config/config_test.go

@@ -90,12 +90,12 @@ func TestConfigLoad(t *testing.T) {
 }
 
 // TestExampleConfigIsScrubbedAndLoads checks that the shipped
-// config.example.yml carries only neutral placeholders (no real credentials,
-// private addresses, or internal host names) and still parses.
+// configs/config.example.yml carries only neutral placeholders (no real
+// credentials, private addresses, or internal host names) and still parses.
 func TestExampleConfigIsScrubbedAndLoads(t *testing.T) {
 	t.Parallel()
 
-	examplePath := filepath.Join("..", "..", "config.example.yml")
+	examplePath := filepath.Join("..", "..", "configs", "config.example.yml")
 
 	cfg, err := Load(examplePath)
 	if err != nil {
@@ -361,7 +361,7 @@ func TestDocumentedSizeDefaults(t *testing.T) {
 }
 
 // TestDocumentedSizeExamples checks the 1MB minimum chunk_size and that
-// every size the README, config.example.yml and the config init template
+// every size the README, configs/config.example.yml and the config init template
 // list as an example is accepted.
 func TestDocumentedSizeExamples(t *testing.T) {
 	t.Parallel()

internal/config/keys.go

@@ -0,0 +1,193 @@
+package config
+
+import (
+	"errors"
+	"fmt"
+	"reflect"
+	"strconv"
+	"strings"
+
+	"gopkg.in/yaml.v3"
+)
+
+// yamlMergeTag is the tag YAML gives a merge key (<<), which adds the keys
+// of the map it names to the map it sits in.
+const yamlMergeTag = "!!merge"
+
+// envSection is the top-level key of a map of environment variables that
+// smartconfig sets while it loads the config. It is not a vaultik setting,
+// so its keys are not checked.
+const envSection = "env"
+
+var (
+	errUnknownKey           = errors.New("unknown config key")
+	errAnchorContainsItself = errors.New("anchor contains itself")
+)
+
+// SettingType returns the type of the setting that the dotted key names in
+// Config, following the fields' yaml tags, as for s3.bucket or
+// snapshots.home.exclude.0. A snapshot name or a list index may be any
+// word. It returns an unknown key error when no setting has that key.
+func SettingType(keys []string) (reflect.Type, error) {
+	typ := reflect.TypeFor[Config]()
+
+	for _, key := range keys {
+		switch {
+		case typ.Kind() == reflect.Map || typ.Kind() == reflect.Slice:
+			typ = typ.Elem()
+		case typ.Kind() == reflect.Struct:
+			field, ok := yamlField(typ, key)
+			if !ok {
+				return nil, fmt.Errorf("%w %q", errUnknownKey, strings.Join(keys, "."))
+			}
+
+			typ = field.Type
+		default:
+			return nil, fmt.Errorf("%w %q", errUnknownKey, strings.Join(keys, "."))
+		}
+	}
+
+	return typ, nil
+}
+
+// yamlField returns the field of struct type typ whose yaml tag names key.
+func yamlField(typ reflect.Type, key string) (reflect.StructField, bool) {
+	for field := range typ.Fields() {
+		name, _, _ := strings.Cut(field.Tag.Get("yaml"), ",")
+		if name == key && name != "-" {
+			return field, true
+		}
+	}
+
+	return reflect.StructField{}, false
+}
+
+// checkKeys returns an error naming the first key in node, a parsed config
+// or part of one at the dotted path, that no setting in typ has. The error
+// gives the key's line in the file, when it has one. A value of the wrong
+// type is left for the YAML decoder to report. following holds the aliases
+// the walk is inside. Meeting one of them again means its anchor contains
+// itself, which is an error.
+func checkKeys(node *yaml.Node, typ reflect.Type, path string,
+	following map[*yaml.Node]bool,
+) error {
+	switch node.Kind {
+	case yaml.DocumentNode:
+		for _, child := range node.Content {
+			err := checkKeys(child, typ, path, following)
+			if err != nil {
+				return err
+			}
+		}
+	case yaml.AliasNode:
+		if following[node] {
+			return fmt.Errorf("%w: %q on line %d",
+				errAnchorContainsItself, node.Value, node.Line)
+		}
+
+		following[node] = true
+		defer delete(following, node)
+
+		return checkKeys(node.Alias, typ, path, following)
+	case yaml.SequenceNode:
+		if typ.Kind() != reflect.Slice {
+			return nil
+		}
+
+		for i, child := range node.Content {
+			err := checkKeys(child, typ.Elem(), joinKey(path, strconv.Itoa(i)), following)
+			if err != nil {
+				return err
+			}
+		}
+	case yaml.MappingNode:
+		return checkMappingKeys(node, typ, path, following)
+	case yaml.ScalarNode:
+		// A scalar has no keys.
+	}
+
+	return nil
+}
+
+// checkFilledKeys is checkKeys for data, the config after smartconfig has
+// filled in its ${...} references. A key that a reference brings in is not
+// in the file, and the copy that Encode makes has no line numbers.
+func checkFilledKeys(data map[string]any) error {
+	var filled yaml.Node
+
+	err := filled.Encode(data)
+	if err != nil {
+		return fmt.Errorf("failed to marshal config data: %w", err)
+	}
+
+	return checkKeys(&filled, reflect.TypeFor[Config](), "", map[*yaml.Node]bool{})
+}
+
+// checkMappingKeys is checkKeys for a map.
+func checkMappingKeys(node *yaml.Node, typ reflect.Type, path string,
+	following map[*yaml.Node]bool,
+) error {
+	for i := 0; i+1 < len(node.Content); i += 2 {
+		key, value := node.Content[i], node.Content[i+1]
+
+		if key.Tag == yamlMergeTag {
+			// The value is one map or a list of maps.
+			merged := []*yaml.Node{value}
+			if value.Kind == yaml.SequenceNode {
+				merged = value.Content
+			}
+
+			for _, m := range merged {
+				err := checkKeys(m, typ, path, following)
+				if err != nil {
+					return err
+				}
+			}
+
+			continue
+		}
+
+		keyPath := joinKey(path, key.Value)
+		if keyPath == envSection {
+			continue
+		}
+
+		var valueType reflect.Type
+
+		switch {
+		case typ.Kind() == reflect.Map:
+			valueType = typ.Elem()
+		case typ.Kind() == reflect.Struct:
+			field, ok := yamlField(typ, key.Value)
+			if !ok && key.Line == 0 {
+				// A key that a ${...} reference brought in has no line.
+				return fmt.Errorf("%w %q", errUnknownKey, keyPath)
+			}
+
+			if !ok {
+				return fmt.Errorf("%w %q on line %d",
+					errUnknownKey, keyPath, key.Line)
+			}
+
+			valueType = field.Type
+		default:
+			return nil
+		}
+
+		err := checkKeys(value, valueType, keyPath, following)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// joinKey appends key to the dotted path.
+func joinKey(path, key string) string {
+	if path == "" {
+		return key
+	}
+
+	return path + "." + key
+}

internal/config/keys_test.go

@@ -0,0 +1,134 @@
+package config //nolint:testpackage // checks the unexported errUnknownKey
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// keysTestConfig loads; each case below adds one line to it.
+const keysTestConfig = "storage_url: file:///tmp/vaultik-test-storage\n" +
+	"s3:\n" +
+	"  region: us-east-1\n" +
+	"snapshots:\n" +
+	"  test:\n" +
+	"    paths: [/tmp/vaultik-test-source]\n"
+
+// TestParseRefusesUnknownKey checks that a key no setting has, at any
+// depth, fails the parse with an error naming the key and its line. A key
+// that a ${...} reference brings in is not in the file, so its error gives
+// no line.
+func TestParseRefusesUnknownKey(t *testing.T) {
+	t.Parallel()
+
+	snapshotPath := filepath.Join(t.TempDir(), "snapshot.yml")
+
+	err := os.WriteFile(snapshotPath, []byte("other:\n"+
+		"  paths: [/tmp/vaultik-test-source]\n"+
+		"  exlude: [/tmp/cache]\n"), 0o600)
+	if err != nil {
+		t.Fatalf("write snapshot: %v", err)
+	}
+
+	tests := []struct {
+		name string
+		yaml string
+		want string
+	}{
+		{"top level", keysTestConfig + "compression_lvl: 9\n",
+			`unknown config key "compression_lvl" on line 7`},
+		{"in a snapshot", keysTestConfig + "    exlude: [/tmp/cache]\n",
+			`unknown config key "snapshots.test.exlude" on line 7`},
+		{"in s3", strings.Replace(keysTestConfig, "  region:",
+			"  bukcet: b\n  region:", 1),
+			`unknown config key "s3.bukcet" on line 3`},
+		{"from a reference",
+			keysTestConfig + "  other: ${YAML:" + snapshotPath + ":other}\n",
+			`unknown config key "snapshots.other.exlude"`},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			_, err := Parse([]byte(tt.yaml))
+			if !errors.Is(err, errUnknownKey) {
+				t.Fatalf("Parse() error = %v, want errUnknownKey", err)
+			}
+
+			if err.Error() != tt.want {
+				t.Errorf("Parse() error = %q, want %q", err.Error(), tt.want)
+			}
+		})
+	}
+}
+
+// TestParseRefusesAnchorThatContainsItself checks that a YAML merge key (<<)
+// naming the anchor of the map it sits in fails the parse with an error.
+func TestParseRefusesAnchorThatContainsItself(t *testing.T) {
+	t.Parallel()
+
+	data := strings.Replace(keysTestConfig, "  test:", "  test: &test", 1) +
+		"    <<: *test\n"
+
+	_, err := Parse([]byte(data))
+	if !errors.Is(err, errAnchorContainsItself) {
+		t.Fatalf("Parse() error = %v, want errAnchorContainsItself", err)
+	}
+
+	want := `anchor contains itself: "test" on line 7`
+	if err.Error() != want {
+		t.Errorf("Parse() error = %q, want %q", err.Error(), want)
+	}
+}
+
+// TestParseAcceptsKnownKeys checks that a config with a ${...} reference
+// and a YAML merge key (<<) still parses.
+func TestParseAcceptsKnownKeys(t *testing.T) {
+	t.Parallel()
+
+	levelPath := filepath.Join(t.TempDir(), "level")
+
+	err := os.WriteFile(levelPath, []byte("9"), 0o600)
+	if err != nil {
+		t.Fatalf("write level: %v", err)
+	}
+
+	data := strings.Replace(keysTestConfig, "  test:", "  test: &test", 1) +
+		"  other:\n" +
+		"    <<: *test\n" +
+		"    exclude: [/tmp/vaultik-test-source/cache]\n" +
+		"compression_level: ${FILE:" + levelPath + "}\n"
+
+	cfg, err := Parse([]byte(data))
+	if err != nil {
+		t.Fatalf("Parse() unexpected error: %v", err)
+	}
+
+	if cfg.CompressionLevel != 9 {
+		t.Errorf("compression_level = %d, want 9", cfg.CompressionLevel)
+	}
+
+	other := cfg.Snapshots["other"]
+	if len(other.Paths) != 1 || len(other.Exclude) != 1 {
+		t.Errorf("snapshot other = %+v, want the paths of test and one exclude",
+			other)
+	}
+}
+
+// TestParseAcceptsEnvSection checks that a config with a top-level env
+// section still parses. smartconfig sets the environment variables it
+// lists, so its keys are not settings.
+func TestParseAcceptsEnvSection(t *testing.T) {
+	const name = "VAULTIK_TEST_ENV_SECTION"
+
+	// Parse sets the variable; t.Setenv restores it after the test.
+	t.Setenv(name, "")
+
+	_, err := Parse([]byte(keysTestConfig + "env:\n  " + name + ": set\n"))
+	if err != nil {
+		t.Fatalf("Parse() unexpected error: %v", err)
+	}
+}

internal/snapshot/snapshot.go

@@ -271,16 +271,18 @@ func (sm *SnapshotManager) CompleteSnapshot(
 	return sm.MarkSnapshotComplete(ctx, snapshotID)
 }
 
-// ExportSnapshotMetadata exports snapshot metadata to S3
+// ExportSnapshotMetadata exports snapshot metadata to the backup destination store
 //
 // This method executes the complete snapshot metadata export process:
 // 1. Creates a temporary directory for working files
 // 2. Copies the main database to preserve its state
 // 3. Cleans the copy to contain only current snapshot data
-// 4. Dumps the cleaned database to SQL
-// 5. Compresses the SQL dump with zstd
-// 6. Encrypts the compressed data with age (always; recipients are required)
-// 7. Uploads to S3 at: snapshots/{snapshot-id}.sql.zst[.age]
+// 4. Vacuums the copy to remove the deleted data
+// 5. Compresses the copy with zstd
+// 6. Encrypts the compressed copy with age (always; recipients are required)
+// 7. Builds the blob manifest from the copy, compressed but not encrypted
+// 8. Uploads the database to metadata/{remote-key}/db.zst.age
+// 9. Uploads the manifest to metadata/{remote-key}/manifest.json.zst
 //
 // The only caller (finalizeSnapshotMetadata) does not close the main database
 // before calling this method: the index is copied at dbPath while it is still

internal/vaultik/info.go

@@ -246,7 +246,7 @@ func (v *Vaultik) RemoteInfo(jsonOutput bool) error {
 		v.stdoutf("Type:     %s\n", storageInfo.Type)
 		v.stdoutf("Location: %s\n", storageInfo.Location)
 		v.printlnStdout()
-		v.stdoutf("Scanning snapshot metadata...\n")
+		v.UI.Beginf("Scanning snapshot metadata...")
 	}
 
 	snapshotMetadata, snapshotIDs, skippedManifestCount, err := v.collectSnapshotMetadata()
@@ -265,7 +265,7 @@ func (v *Vaultik) RemoteInfo(jsonOutput bool) error {
 			}
 		}
 
-		v.stdoutf("Downloading %d manifest(s)...\n", manifestCount)
+		v.UI.Beginf("Downloading %d manifest(s)...", manifestCount)
 	}
 
 	referencedBlobs, unreadableManifests := v.collectReferencedBlobsFromManifests(
@@ -447,7 +447,7 @@ func (v *Vaultik) scanRemoteBlobStorage(
 	result *RemoteInfoResult, referencedBlobs map[string]int64, showText bool,
 ) error {
 	if showText {
-		v.stdoutf("Scanning blobs...\n")
+		v.UI.Beginf("Scanning blobs...")
 	}
 
 	// Use prune's listing, so a file under blobs/ that prune would never

internal/vaultik/remote_info_test.go

@@ -12,6 +12,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"sneak.berlin/go/vaultik/internal/log"
 	"sneak.berlin/go/vaultik/internal/snapshot"
+	"sneak.berlin/go/vaultik/internal/ui"
 )
 
 // testBlobHashB is a blob that the manifest written by addRemote does
@@ -259,3 +260,24 @@ func TestRemoteInfo_DirectoryWithoutManifestLeavesOrphansKnown(t *testing.T) {
 	assert.NotContains(t, doc, "unreadable_manifests")
 	assert.NotContains(t, doc, "skipped_manifest_count")
 }
+
+// TestRemoteInfo_StatusLineUsesUIMarker checks that the remote info
+// status lines go through internal/ui: marker-prefixed, and silenced by
+// --quiet.
+func TestRemoteInfo_StatusLineUsesUIMarker(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	env := newListEnv(t)
+	env.addRemote(t, listRemoteID, time.Date(2026, 3, 2, 0, 0, 0, 0, time.UTC))
+
+	const statusLine = ui.Marker + " Scanning snapshot metadata...\n"
+
+	require.NoError(t, env.v.RemoteInfo(false))
+	assert.Contains(t, env.stdout.String(), statusLine)
+
+	env.stdout.Reset()
+	env.v.UI.SetQuiet(true)
+	require.NoError(t, env.v.RemoteInfo(false))
+	assert.NotContains(t, env.stdout.String(), "Scanning snapshot metadata")
+}

internal/vaultik/snapshot.go

@@ -1019,7 +1019,7 @@ func (v *Vaultik) VerifySnapshotWithOptions(
 		v.printlnStdout()
 
 		// Check each blob is present with the size the manifest records.
-		v.stdoutf("Checking blob presence and sizes...\n")
+		v.UI.Beginf("Checking blob presence and sizes...")
 	}
 
 	v.checkSnapshotDatabase(remoteKey, result)

internal/vaultik/storage_bind.go

@@ -30,7 +30,7 @@ var errStorageBindingMismatch = errors.New(
 //     nothing and return nil.
 //   - When the two differ, refuse with an error that tells the user
 //     how to recover (revert the config, or run `vaultik database
-//     purge` to discard the local index and rebuild against the new
+//     delete` to discard the local index and rebuild against the new
 //     destination on the next backup).
 //
 // Read-only inspection commands (remote info, snapshot list, etc.)

internal/vaultik/verify.go

@@ -190,7 +190,7 @@ func (v *Vaultik) loadVerificationData(
 	log.Info("Downloading manifest", "remote_key", remoteKey)
 
 	if !opts.JSON && !v.UI.Quiet() {
-		v.stdoutf("Downloading manifest...\n")
+		v.UI.Beginf("Downloading manifest...")
 	}
 
 	manifest, err := v.downloadManifestByKey(remoteKey)
@@ -205,9 +205,9 @@ func (v *Vaultik) loadVerificationData(
 		"manifest_total_size", ubytes(manifest.TotalCompressedSize))
 
 	if !opts.JSON && !v.UI.Quiet() {
-		v.stdoutf("Manifest loaded: %d blobs (%s)\n",
+		v.UI.Completef("Manifest loaded: %d blobs (%s)",
 			manifest.BlobCount, ubytes(manifest.TotalCompressedSize))
-		v.stdoutf("Downloading and decrypting database...\n")
+		v.UI.Beginf("Downloading and decrypting database...")
 	}
 
 	tdb, err := v.downloadVerifiedSnapshotDB(
@@ -235,7 +235,7 @@ func (v *Vaultik) loadVerificationData(
 		"db_total_size", ubytes(dbTotalSize))
 
 	if !opts.JSON && !v.UI.Quiet() {
-		v.stdoutf("Database loaded: %d blobs (%s)\n",
+		v.UI.Completef("Database loaded: %d blobs (%s)",
 			len(dbBlobs), ubytes(dbTotalSize))
 	}
 
@@ -295,7 +295,7 @@ func (v *Vaultik) runVerificationSteps(
 	identities []age.Identity,
 ) error {
 	if !opts.JSON && !v.UI.Quiet() {
-		v.stdoutf("Verifying manifest against database...\n")
+		v.UI.Beginf("Verifying manifest against database...")
 	}
 
 	err := v.verifyManifestAgainstDatabase(manifest, dbBlobs)
@@ -304,8 +304,8 @@ func (v *Vaultik) runVerificationSteps(
 	}
 
 	if !opts.JSON && !v.UI.Quiet() {
-		v.stdoutf("Manifest verified.\n")
-		v.stdoutf("Checking blob existence in remote storage...\n")
+		v.UI.Completef("Manifest verified.")
+		v.UI.Beginf("Checking blob existence in remote storage...")
 	}
 
 	err = v.verifyBlobExistenceFromDB(dbBlobs, result)
@@ -314,8 +314,8 @@ func (v *Vaultik) runVerificationSteps(
 	}
 
 	if !opts.JSON && !v.UI.Quiet() {
-		v.stdoutf("All blobs exist.\n")
-		v.stdoutf("Downloading and verifying blob contents (%d blobs, %s)...\n",
+		v.UI.Completef("All blobs exist.")
+		v.UI.Beginf("Downloading and verifying blob contents (%d blobs, %s)...",
 			len(dbBlobs), ubytes(totalSize))
 	}
 
@@ -790,7 +790,7 @@ func (v *Vaultik) performDeepVerificationFromDB(
 		)
 
 		if !opts.JSON && !v.UI.Quiet() {
-			v.stdoutf("  Verified %d/%d blobs (%d remaining) - %s/%s - elapsed %s, eta %s\n",
+			v.UI.Progressf("Verified %d/%d blobs (%d remaining) - %s/%s - elapsed %s, eta %s",
 				i+1, len(blobs), remaining,
 				ubytes(bytesProcessed),
 				ubytes(totalBytesExpected),

internal/vaultik/verify_quiet_test.go

@@ -100,3 +100,51 @@ func TestVerify_QuietSuppressesReport(t *testing.T) {
 	require.Empty(t, stdout.String(),
 		"a failed verify must write no report under --quiet")
 }
+
+// TestVerify_DeepStatusLineUsesUIMarker checks that the deep verify
+// status lines go through internal/ui: marker-prefixed, and silenced by
+// --quiet.
+func TestVerify_DeepStatusLineUsesUIMarker(t *testing.T) {
+	log.Initialize(log.Config{})
+	t.Parallel()
+
+	fs := afero.NewOsFs()
+	tempDir := t.TempDir()
+
+	dataDir := filepath.Join(tempDir, "source")
+	storeDir := t.TempDir()
+	dbPath := filepath.Join(tempDir, "index.sqlite")
+
+	require.NoError(t, fs.MkdirAll(dataDir, 0o755))
+	require.NoError(t, afero.WriteFile(fs,
+		filepath.Join(dataDir, "data.bin"),
+		bytesPattern("marker-", 64*1024), 0o644))
+
+	ctx := context.Background()
+
+	cfg, storer, snapshotID := runFileStorageBackup(
+		ctx, t, fs, dataDir, storeDir, dbPath, 32*1024, 128*1024)
+
+	var stdout bytes.Buffer
+
+	v := &vaultik.Vaultik{
+		Config:  cfg,
+		Storage: storer,
+		Fs:      fs,
+		Stdout:  &stdout,
+		Stderr:  io.Discard,
+		UI:      ui.NewWithColor(&stdout, false),
+	}
+	v.SetContext(ctx)
+
+	opts := &vaultik.VerifyOptions{Deep: true}
+
+	require.NoError(t, v.VerifySnapshotWithOptions(snapshotID, opts))
+	require.Contains(t, stdout.String(),
+		"\n"+ui.Marker+" Downloading manifest...\n")
+
+	stdout.Reset()
+	v.UI.SetQuiet(true)
+	require.NoError(t, v.VerifySnapshotWithOptions(snapshotID, opts))
+	require.NotContains(t, stdout.String(), "Downloading manifest")
+}

package.json

@@ -0,0 +1,5 @@
+{
+  "devDependencies": {
+    "prettier": "3.8.1"
+  }
+}

script/bootstrap

@@ -3,11 +3,20 @@
 # this repo. Idempotent: every install is guarded by a check so already
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
 # or apk (detected in that order); assumes NOTHING is present (not git,
-# make, or go).
+# make, or go). Node is used directly if installed; otherwise it is
+# installed at a pinned version via nvm (installing nvm itself first,
+# from a hash-verified release archive, never curl | sh).
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
+# Pinned versions, 2026-07-06
+NODE_VERSION="22.17.0"
+NVM_VERSION="0.40.3"
+# sha256 of https://github.com/nvm-sh/nvm/archive/refs/tags/v0.40.3.tar.gz
+NVM_SHA256="5f4d6aaa04a177dc93c985e31dbc411ab6b8c6e1e21d8015dbc1372625fcd1d0"
+YARN_VERSION="1.22.22"
+
 PKGMGR=""
 SUDO=""
 
@@ -48,6 +57,69 @@ missing() {
     ! command -v "$1" >/dev/null 2>&1
 }
 
+# verify_sha256 <file> <expected-hash>
+verify_sha256() {
+    if command -v sha256sum >/dev/null 2>&1; then
+        actual="$(sha256sum "$1" | cut -d' ' -f1)"
+    else
+        actual="$(shasum -a 256 "$1" | cut -d' ' -f1)"
+    fi
+    if [ "$actual" != "$2" ]; then
+        echo "bootstrap: sha256 mismatch for $1" >&2
+        echo "  expected: $2" >&2
+        echo "  actual:   $actual" >&2
+        exit 1
+    fi
+}
+
+# nvm is a bash script; run a command in a bash with nvm loaded
+nvm_sh() {
+    bash -c ". \"\$HOME/.nvm/nvm.sh\" && $*"
+}
+
+ensure_nvm() {
+    [ -s "$HOME/.nvm/nvm.sh" ] && return 0
+    # nvm prerequisites; nvm itself requires bash
+    if missing bash; then pkg_install bash bash bash bash; fi
+    if missing curl; then pkg_install curl curl curl curl; fi
+    if missing git; then pkg_install git git git git; fi
+    tmp="$(mktemp -d)"
+    curl -fsSL -o "$tmp/nvm.tar.gz" \
+        "https://github.com/nvm-sh/nvm/archive/refs/tags/v${NVM_VERSION}.tar.gz"
+    verify_sha256 "$tmp/nvm.tar.gz" "$NVM_SHA256"
+    mkdir -p "$HOME/.nvm"
+    tar -xzf "$tmp/nvm.tar.gz" -C "$HOME/.nvm" --strip-components=1
+    rm -rf "$tmp"
+}
+
+ensure_node() {
+    if ! missing node; then return 0; fi
+    ensure_nvm
+    nvm_sh "nvm install $NODE_VERSION"
+}
+
+ensure_yarn() {
+    if ! missing yarn; then return 0; fi
+    if ! missing corepack; then
+        corepack enable
+        corepack prepare "yarn@$YARN_VERSION" --activate
+    elif [ -s "$HOME/.nvm/nvm.sh" ]; then
+        nvm_sh "nvm use $NODE_VERSION >/dev/null && corepack enable && \
+            corepack prepare yarn@$YARN_VERSION --activate"
+    else
+        npm install -g "yarn@$YARN_VERSION"
+    fi
+}
+
+install_js_deps() {
+    if missing yarn && [ -s "$HOME/.nvm/nvm.sh" ]; then
+        nvm_sh "nvm use $NODE_VERSION >/dev/null && cd \"$ROOT\" && \
+            yarn install --frozen-lockfile"
+    else
+        yarn install --frozen-lockfile
+    fi
+}
+
 # Docker is a hard requirement, not a nice-to-have: script/lint and
 # script/test build the lint and test phases of the Dockerfile, the only
 # place the linter and the tests run, and script/check and
@@ -103,6 +175,8 @@ main() {
     # Base tooling (every repo)
     if missing git; then pkg_install git git git git; fi
     if missing make; then pkg_install gnumake make make make; fi
+    # script/install-go, script/install-goreleaser and nvm download with it.
+    if missing curl; then pkg_install curl curl curl curl; fi
 
     # Go toolchain: the host's own, or else the version go.mod names,
     # hash-verified, in .tool/go. That directory is not on the caller's
@@ -131,6 +205,11 @@ main() {
 
     go mod download
 
+    # prettier, which script/fmt and script/fmt-check run on Markdown.
+    ensure_node
+    ensure_yarn
+    install_js_deps
+
     # Last, so that everything installable is installed before the one
     # thing this script cannot install decides the outcome.
     require_docker

script/fmt

@@ -4,11 +4,31 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
+# Must match the pin in script/bootstrap.
+NODE_VERSION="22.17.0"
+
+# script/bootstrap installs node and yarn under nvm and leaves neither
+# on the PATH of the shell that called it, so resolve the pinned
+# toolchain here the way bootstrap's own install step does. nvm is a
+# bash script, hence the subshell.
+run_yarn() {
+    if command -v yarn >/dev/null 2>&1; then
+        exec yarn "$@"
+    fi
+    if [ ! -s "$HOME/.nvm/nvm.sh" ]; then
+        echo "fmt: no yarn; run script/bootstrap first" >&2
+        exit 1
+    fi
+    exec bash -c '. "$HOME/.nvm/nvm.sh" && nvm use "$1" >/dev/null &&
+        shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
+}
+
 main() {
     cd "$ROOT"
     # Where script/bootstrap installs Go when the host has none.
     PATH="$PATH:$ROOT/.tool/go/bin"
     go fmt ./...
+    run_yarn run prettier --write '**/*.md' --tab-width 4 --prose-wrap always
 }
 
 main "$@"

script/fmt-check

@@ -3,11 +3,30 @@
 # writing. It checks every Go file outside .tool, which is more than
 # script/fmt formats: `go fmt ./...` skips `testdata` directories and
 # files and directories whose names start with `.` or `_`. Fix a file
-# only this reports with `gofmt -w`.
+# only this reports with `gofmt -w`. Markdown is checked with prettier.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
+# Must match the pin in script/bootstrap.
+NODE_VERSION="22.17.0"
+
+# script/bootstrap installs node and yarn under nvm and leaves neither
+# on the PATH of the shell that called it, so resolve the pinned
+# toolchain here the way bootstrap's own install step does. nvm is a
+# bash script, hence the subshell.
+run_yarn() {
+    if command -v yarn >/dev/null 2>&1; then
+        exec yarn "$@"
+    fi
+    if [ ! -s "$HOME/.nvm/nvm.sh" ]; then
+        echo "fmt-check: no yarn; run script/bootstrap first" >&2
+        exit 1
+    fi
+    exec bash -c '. "$HOME/.nvm/nvm.sh" && nvm use "$1" >/dev/null &&
+        shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
+}
+
 main() {
     cd "$ROOT"
     # Where script/bootstrap installs Go when the host has none.
@@ -23,6 +42,7 @@ main() {
         echo "$unformatted" >&2
         exit 1
     fi
+    run_yarn run prettier --check '**/*.md' --tab-width 4 --prose-wrap always
 }
 
 main "$@"

yarn.lock

@@ -0,0 +1,8 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+prettier@3.8.1:
+  version "3.8.1"
+  resolved "https://registry.yarnpkg.com/prettier/-/prettier-3.8.1.tgz#edf48977cf991558f4fcbd8a3ba6015ba2a3a173"
+  integrity sha512-UOnG6LftzbdaHZcKoPFtOcCKztrQ57WkHDeRD9t/PTQtmT0NHSeWWepj6pS0z/N7+08BHFDQVUrfmfMRcZwbMg==