Quiet only the stdout UI under --json, not the log level (closes #112)

--json was folded into Quiet, which pinned the stderr log level to WARN.
So `prune --json` gave a machine consumer no record of the local index
rows it deleted, even under --verbose: the audit records were gated off
stdout and pinned below the level on stderr.

--json now quiets only the stdout UI, keeping the JSON document clean
(issue #108); the stderr log level follows --verbose/--debug again, since
diagnostics have gone to stderr since #82. The same coupling is removed
for `snapshot verify`, `snapshot remove`, and `remote info`, which
carried it for the same outdated reason.

A test asserts `--verbose prune --json` emits the cleanup record on
stderr while stdout stays exactly one document, and that --json alone
keeps it below the level.

model: claude-opus-4-8

AGENTS.md

@@ -104,12 +104,7 @@ Version: 2025-06-08
 
 13. Pre-1.0: NEVER write database migrations. There are no live databases
     anywhere — every user's local index can be rebuilt from a fresh full
-    backup. To change the schema, edit `internal/database/schema/001.sql`
+    backup. When the schema changes, just change `schema.sql` (and any code
-    (and any code that touches the affected tables) directly; do not add new
+    that touches the affected tables). The local index is disposable until
-    numbered schema files. Those numbered files and the `schema_migrations`
+    1.0 ships and is tagged.
-    table they populate only bootstrap a fresh database — they are not an
-    upgrade path. The local index is disposable until 1.0 ships and is
-    tagged; once 1.0 is tagged that clause expires and the question of
-    upgrading existing indexes returns. See [`docs/DATAMODEL.md`](docs/DATAMODEL.md)
-    for the full explanation.
 

Dockerfile

@@ -20,6 +20,8 @@
 # golang:1.26.1-alpine, 2026-03-17
 FROM golang:1.26.1-alpine@sha256:2389ebfa5b7f43eeafbd6be0c3700cc46690ef842ad962f6c5bd6be49ed82039 AS builder
 
+ARG VERSION=dev
+
 # Build tooling: make, plus a C toolchain because `go test -race` needs cgo.
 # The sqlite driver is pure Go (modernc.org/sqlite), so no sqlite library or
 # CLI is required.
@@ -64,31 +66,8 @@ RUN [ -n "$CHECK_EPOCH" ] || exit 1
 RUN echo "check epoch: ${CHECK_EPOCH}" && make fmt-check
 RUN echo "check epoch: ${CHECK_EPOCH}" && make test
 
-# Version, commit and build date are computed on the host by
-# script/docker and script/cibuild (where .git exists) and passed in as
-# build args. The build context excludes .git (see .dockerignore), so
-# the build cannot derive them itself: it used to try, with `git
-# rev-parse` inside this stage, and always got "unknown". VERSION comes
-# from script/version, the source of truth shared with the Makefile, so
-# it carries the same tag / dev-<sha> / -dirty rules and a Docker image
-# reports the same string a local build of the same tree would.
-#
-# The defaults are the fallback for a bare `docker build .` that passes
-# none of them: an unset arg would otherwise stamp an empty string and
-# produce an image that cannot report its own version, commit or date.
-# They match what an out-of-git build reports elsewhere.
-#
-# These ARGs sit here, after the checks, rather than at the top of the
-# stage: every commit changes their values, and a value change
-# invalidates all layers below the ARG. Declared up top they would bust
-# `go mod download`; here they only rekey this build layer, which the
-# COPY of the sources above already rebuilds on any change anyway.
-ARG VERSION=dev
-ARG COMMIT=unknown
-ARG COMMIT_DATE=unknown
-
 # Build (pure Go, no CGO required since we use modernc.org/sqlite)
-RUN CGO_ENABLED=0 go build -ldflags "-X 'sneak.berlin/go/vaultik/internal/globals.Version=${VERSION}' -X 'sneak.berlin/go/vaultik/internal/globals.Commit=${COMMIT}' -X 'sneak.berlin/go/vaultik/internal/globals.CommitDate=${COMMIT_DATE}'" -o /vaultik ./cmd/vaultik
+RUN CGO_ENABLED=0 go build -ldflags "-X 'sneak.berlin/go/vaultik/internal/globals.Version=${VERSION}' -X 'sneak.berlin/go/vaultik/internal/globals.Commit=$(git rev-parse HEAD 2>/dev/null || echo unknown)' -X 'sneak.berlin/go/vaultik/internal/globals.CommitDate=$(git show -s --format=%cs HEAD 2>/dev/null || echo unknown)'" -o /vaultik ./cmd/vaultik
 
 # Runtime stage
 # alpine:3.21, 2026-02-25

README.md

@@ -84,57 +84,6 @@ VAULTIK_AGE_SECRET_KEY='AGE-SECRET-KEY-...' vaultik snapshot restore <snapshot-i
 # 0 3 * * * vaultik snapshot create --cron --prune --keep-newer-than 4w
 ```
 
-## restoring on another machine
-
-Restoring on a host that never ran the backup — a replacement machine
-after the original is gone — is the case vaultik is built for. That host
-needs only three things: the `vaultik` binary, the age **private** key,
-and the storage credentials for the destination. It does **not** need the
-local index, the original config file, or the original hostname.
-
-```sh
-# install
-go install sneak.berlin/go/vaultik/cmd/vaultik@latest
-
-# create a config and point it at the ORIGINAL backup destination
-vaultik config init
-vaultik config set storage_url "s3://bucket/prefix?endpoint=https://s3.example.com"
-vaultik config set s3.access_key_id "..."
-vaultik config set s3.secret_access_key "..."
-
-# see what is on the destination store
-vaultik snapshot list
-```
-
-`snapshot list` reads the destination store without the private key. A
-snapshot that is not in this host's (empty) local index is shown as
-remote-only: its row is identified by `<remote only:...>` rather than by
-a `hostname_name_timestamp` name, because the name lives only in the
-local index and the encrypted database and cannot be recovered from the
-store. Its timestamp and compressed size are real. (See the `snapshot
-list` description under [command details](#command-details) for the full
-explanation.)
-
-Use that remote key — the hex printed inside `<remote only:...>`, or the
-full `remote_key` from `snapshot list --json` — to restore and verify:
-
-```sh
-# restore everything to /tmp/restored, then check every restored file's
-# chunk hashes
-VAULTIK_AGE_SECRET_KEY='AGE-SECRET-KEY-...' \
-  vaultik snapshot restore --verify <remote-key> /tmp/restored
-
-# optionally, deep-verify the snapshot against the store (downloads and
-# cryptographically checks every blob)
-VAULTIK_AGE_SECRET_KEY='AGE-SECRET-KEY-...' \
-  vaultik snapshot verify --deep <remote-key>
-```
-
-`age_recipients` (the public key) is not needed to restore — only the
-private key in `VAULTIK_AGE_SECRET_KEY`. Both the abbreviated key printed
-in the table and the full 64-character key from `--json` are accepted; a
-leading part of the key is enough as long as it is unambiguous.
-
 ---
 
 ## cli
@@ -296,8 +245,6 @@ local index alone, and still exits zero.
 * Default (shallow): checks that all blobs referenced in the manifest exist in storage
 * `--deep`: Downloads and decrypts each blob, verifies chunk hashes against the
   encrypted metadata database
-* Accepts the same identifiers as `snapshot restore`: a snapshot ID, or a
-  remote-only snapshot's remote key (or an unambiguous leading part of it)
 * `--json`: Output results as JSON
 
 **`snapshot purge`**: Remove old snapshots based on criteria. Retention is
@@ -328,10 +275,6 @@ on the destination in one go, use `vaultik remote nuke --force`.
 
 **`snapshot restore`**: Restore files from a backup snapshot.
 * Requires `VAULTIK_AGE_SECRET_KEY` environment variable
-* Accepts a snapshot ID, or — for a snapshot only on the destination
-  store — its remote key (or an unambiguous leading part of it) as shown
-  by `snapshot list`. See
-  [restoring on another machine](#restoring-on-another-machine).
 * Optional path arguments to restore specific files/directories (default: all)
 * Preserves file permissions, timestamps, ownership (ownership requires root),
   symlinks, and empty directories
@@ -514,13 +457,9 @@ Key fields:
   sequentially. Restore speed is bound by single-stream throughput.
 * **Device nodes, named pipes, and sockets are silently skipped.** Only
   regular files, directories, and symlinks are backed up.
-* **No upgrade path between versions.** There is no supported way to carry
+* **No database migrations.** If the local SQLite schema changes between
-  an existing local index across a schema change; if the local SQLite
+  versions, delete the local database (`vaultik database delete`) and run
-  schema changes between versions, delete the local database (`vaultik
+  a full backup. Remote storage is unaffected.
-  database delete`) and run a full backup. Remote storage is unaffected.
-  (The binary does embed numbered schema files and a `schema_migrations`
-  table to bootstrap a fresh database — see [`docs/DATAMODEL.md`](docs/DATAMODEL.md)
-  — but that is not an upgrade path.)
 * **Files that change during backup may be inconsistent.** There is no
   filesystem snapshot or freeze. If a file is modified between the scan
   and chunk phases, the backed-up copy may reflect a partial write.
@@ -586,12 +525,14 @@ priority.
 
 ### infrastructure
 
-* **Cross-version schema upgrades.** There is no upgrade path between
+* **Cross-machine restore documentation.** The "restore from
-  released versions — pre-1.0 schema changes are handled by `vaultik
+  another host" workflow works but isn't documented as a
-  database delete` plus a full re-scan (see
+  first-class operation in this README. Worth a dedicated section
-  [`docs/DATAMODEL.md`](docs/DATAMODEL.md)). Post-1.0 we'll need a
+  once it's settled.
-  migration story to keep existing index databases usable across
+* **Schema migrations.** Currently nonexistent — pre-1.0 schema
-  upgrades.
+  changes are handled by `vaultik database delete` plus a full
+  re-scan. Post-1.0 we'll need a migration story to keep existing
+  index databases usable across upgrades.
 * **Storage backend coverage tests.** S3, file://, and rclone://
   all share the Storer interface but the rclone path is the least
   exercised in CI.

TODO.md

@@ -25,15 +25,16 @@ release" is exactly the contradiction
 
 # Completed Steps
 
-- 2026-09-21: Stopped `prune` from reporting a failed row count as 0
+- 2026-09-21: Stopped `--json` from silencing stderr diagnostics
-  ([issue #96](https://git.eeqj.de/sneak/vaultik/issues/96)). The seven
+  ([issue #112](https://git.eeqj.de/sneak/vaultik/issues/112)). `--json`
-  `getTableCount` reads in `PruneDatabase` discarded their error, so a
+  used to be folded into `Quiet`, which pinned the log level to `WARN`,
-  query that could not run became a plausible `0` and the before/after
+  so `prune --json` gave a machine consumer no record of the local index
-  delta computed from it looked like real work. Each read now logs at
+  rows it deleted even under `--verbose`. `--json` now quiets only the
-  warn on failure and renders as `unknown`, never `0`, so an empty table
+  stdout UI (the JSON document must stay clean, per
-  is distinguishable from one that could not be queried. The counts have
+  [issue #108](https://git.eeqj.de/sneak/vaultik/issues/108)); the stderr
-  no `--json` representation — under `--json` the summary is suppressed
+  log level follows `--verbose`/`--debug` again. The coupling was
-  entirely — so nothing there can show a false `0`.
+  removed the same way for `snapshot verify`, `snapshot remove`, and
+  `remote info`, which carried it for the same outdated reason.
 
 - 2026-09-21: Made the s3 storage backend report a missing object as
   `storage.ErrNotFound`, like the `file` and `rclone` backends and as the
@@ -43,6 +44,7 @@ release" is exactly the contradiction
   helper (reused by `HeadObject`) and a test that a missing key maps to
   `ErrNotFound`
   ([issue #129](https://git.eeqj.de/sneak/vaultik/issues/129)).
+
 - 2026-09-21: Fixed `verify --deep` reporting healthy snapshots as
   corrupt. Its final blob-integrity check hashed the encrypted
   downloaded bytes with a single SHA256 and compared that to the blob

cmd/vaultik/dockerversion_test.go

@@ -1,102 +0,0 @@
-package main_test
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// This file guards the version stamping of the product image (issue
-// #75). The failure it protects against is silent: the image still
-// builds and runs, but `vaultik version` inside it reports "commit:
-// unknown", so an operator cannot tell which source produced a given
-// backup. .dockerignore excludes .git, so the build cannot derive the
-// commit itself; the values must be computed on the host and passed in.
-//
-// These are parses of the committed files, for the same reason the lint
-// guards next door are: shelling out to docker would nest a build
-// inside `make test`. That `vaultik version` in the built image really
-// prints the host's version is verified by hand and recorded on the
-// pull request.
-
-// dockerScript is script/docker, relative to the repository root.
-const dockerScript = "script/docker"
-
-// versionArgs are the ldflag targets the build stamps and, matching
-// them, the build args the host must supply. The names line up so the
-// same list checks both files.
-func versionArgs() []string {
-	return []string{"VERSION", "COMMIT", "COMMIT_DATE"}
-}
-
-// TestProductDockerfileTakesVersionAsBuildArgs fails unless the build
-// declares each version arg and stamps it into the binary by ldflag
-// reference, rather than computing it in the container.
-func TestProductDockerfileTakesVersionAsBuildArgs(t *testing.T) {
-	t.Parallel()
-
-	found := instructions(t, productDockerfile)
-
-	for _, arg := range versionArgs() {
-		require.GreaterOrEqual(t, indexOf(found, "ARG "+arg), 0,
-			"%s must declare `ARG %s` so the host can pass it in",
-			productDockerfile, arg)
-
-		assertLdflagReferences(t, found, arg)
-	}
-}
-
-// TestProductDockerfileDoesNotDeriveVersionItself is the anti-regression
-// for the original defect: the container ran `git rev-parse`, but .git
-// is not in the build context, so it always resolved to "unknown". No
-// git command may reach into a build that cannot see the history.
-func TestProductDockerfileDoesNotDeriveVersionItself(t *testing.T) {
-	t.Parallel()
-
-	text := instructionText(readRepoFile(t, productDockerfile))
-
-	assert.NotContains(t, text, "git ",
-		"%s must not run git: .git is excluded from the build context, so"+
-			" any value it derives is wrong. Pass version, commit and date"+
-			" in as build args instead.", productDockerfile)
-}
-
-// TestDockerScriptComputesVersionOnTheHost fails unless script/docker
-// derives each value where .git exists and passes it as a build arg,
-// with VERSION coming from script/version so a Docker build reports the
-// same string a local build of the same tree would.
-func TestDockerScriptComputesVersionOnTheHost(t *testing.T) {
-	t.Parallel()
-
-	script := readRepoFile(t, dockerScript)
-
-	for _, arg := range versionArgs() {
-		assert.Contains(t, script, "--build-arg "+arg+"=",
-			"%s must pass --build-arg %s to the build", dockerScript, arg)
-	}
-
-	assert.Contains(t, script, "/version",
-		"%s must take VERSION from script/version, the source of truth"+
-			" shared with the Makefile", dockerScript)
-}
-
-// assertLdflagReferences fails unless some build instruction stamps the
-// named variable from the ARG (a ${arg} reference), not from a value
-// computed inside the container.
-func assertLdflagReferences(t *testing.T, found []string, arg string) {
-	t.Helper()
-
-	for _, instruction := range found {
-		if strings.HasPrefix(instruction, "RUN ") &&
-			strings.Contains(instruction, "go build") &&
-			strings.Contains(instruction, "${"+arg+"}") {
-			return
-		}
-	}
-
-	assert.Fail(t, "version arg is declared but never stamped",
-		"the go build in %s must reference ${%s} in its ldflags, or the"+
-			" arg is passed and discarded", productDockerfile, arg)
-}

cmd/vaultik/lintdocker_test.go

@@ -304,14 +304,10 @@ func instructionText(contents string) string {
 }
 
 // indexOf returns the position of the first instruction equal to, or
-// beginning with, want; -1 if there is none. An `ARG NAME=default`
+// beginning with, want; -1 if there is none.
-// counts as beginning with `ARG NAME`, so a declared arg is found
-// whether or not it carries a default.
 func indexOf(found []string, want string) int {
 	for i, instruction := range found {
-		if instruction == want ||
+		if instruction == want || strings.HasPrefix(instruction, want+" ") {
-			strings.HasPrefix(instruction, want+" ") ||
-			strings.HasPrefix(instruction, want+"=") {
 			return i
 		}
 	}

cmd/vaultik/main.go

@@ -10,16 +10,6 @@ import (
 )
 
 func main() {
-	os.Exit(run())
-}
-
-// run sets up optional profiling, runs the CLI, and returns the process
-// exit code. os.Exit lives in main so it fires only after run's deferred
-// profile writers have flushed. cli.Entry returns a status code rather
-// than calling os.Exit itself: an os.Exit from inside it would skip
-// these defers and truncate the profile of a failing command -- exactly
-// the command one most often wants to profile.
-func run() int {
 	// CPU profiling: set VAULTIK_CPUPROFILE=/path/to/cpu.prof
 	if cpuProfile := os.Getenv("VAULTIK_CPUPROFILE"); cpuProfile != "" {
 		f, err := os.Create(cpuProfile) //nolint:gosec // G304: operator-set path
@@ -56,5 +46,5 @@ func run() int {
 		}()
 	}
 
-	return cli.Entry()
+	cli.Entry()
 }

docs/DATAMODEL.md

@@ -5,30 +5,11 @@
 Vaultik uses a local SQLite database to track file metadata, chunk mappings, and blob associations during the backup process. This database serves as an index for incremental backups and enables efficient deduplication.
 
 **Important Notes:**
-
+- **No Migration Support (pre-1.0)**: Vaultik does not support database schema
-This section is the authoritative explanation of the schema/migration story;
+  migrations. The local index is treated as disposable — if the schema changes,
-other documents (the README and `AGENTS.md`) link here.
+  delete the local SQLite database (`vaultik database delete`) and run a full
-
+  backup. The remote storage is unaffected; the new index will re-deduplicate
-- **No upgrade path between versions (pre-1.0)**: Vaultik has no supported way to
+  against existing remote blobs.
-  carry an existing local index across a schema change. The index is disposable
-  — if the on-disk schema changes between versions, delete the local SQLite
-  database (`vaultik database delete`) and run a full backup. Remote storage is
-  unaffected; the new index re-deduplicates against existing remote blobs. This
-  is the standing project policy, and it is separate from the schema bootstrap
-  described next.
-- **Schema bootstrap**: a fresh database is populated from numbered SQL files
-  embedded in the binary under `internal/database/schema/`. `000.sql` creates the
-  `schema_migrations` table; `001.sql` creates the application tables. On opening
-  a database the code applies each numbered file that has not yet run and records
-  its version in `schema_migrations`. This bootstraps a new database; it does not
-  upgrade an existing one between released versions.
-- **Changing the schema (pre-1.0)**: edit `internal/database/schema/001.sql` (and
-  the code that touches the affected tables) directly. Do not add new numbered
-  files — there is no installed base to migrate.
-- **Disposability expires at 1.0**: the index is treated as disposable only until
-  1.0 ships and is tagged. Once 1.0 is tagged that clause expires and the
-  question of upgrading existing indexes returns. It is deliberately left open
-  here.
 - **Version Compatibility**: In rare cases, you may need to use the same version
   of Vaultik to restore a backup as was used to create it. This ensures
   compatibility with the metadata format stored in S3.

internal/cli/app.go

@@ -11,7 +11,6 @@ import (
 	"os/signal"
 	"path/filepath"
 	"strings"
-	"sync"
 	"syscall"
 	"time"
 
@@ -49,6 +48,11 @@ type AppOptions struct {
 // silenced — per the documented convention that --quiet suppresses
 // non-error output only. The startup banner is printed by Entry
 // before cobra parses arguments, gated by the same arg-level check.
+//
+// --json quiets the UI here too, because stdout then carries a JSON
+// document and human narration would corrupt it. Unlike Quiet it does
+// not lower the stderr log level (issue #112), so --verbose/--debug
+// still surface diagnostics alongside the document.
 func setupGlobals(
 	lc fx.Lifecycle, g *globals.Globals, v *vaultik.Vaultik, opts log.Options,
 ) {
@@ -56,7 +60,7 @@ func setupGlobals(
 		OnStart: func(_ context.Context) error {
 			g.StartTime = time.Now().UTC()
 
-			if opts.Cron || opts.Quiet {
+			if opts.Cron || opts.Quiet || opts.JSON {
 				v.UI.SetQuiet(true)
 			}
 
@@ -197,92 +201,16 @@ func RunApp(ctx context.Context, app *fx.App) error {
 	}
 }
 
-// errReported marks a failure the operation has already shown the user
-// (and deliberately withheld under --json). Entry turns it into a
-// non-zero exit status without printing anything further, so the error
-// line is not doubled. It flows up from RunOperation through cobra to
-// Entry.
-var errReported = errors.New("operation failed")
-
-// RunOperation runs op against the Vaultik instance inside the fx app
-// and turns a failure into a returned error rather than an os.Exit from
-// within the goroutine. An os.Exit there skipped main's deferred
-// profile writers -- so profiling a failing command yielded a truncated
-// profile (issue #75) -- and RunWithApp's PID-lock release, and denied
-// the app any graceful shutdown; returning the error to the top runs
-// all three.
-//
-// op runs in a goroutine so OnStart returns promptly and an interrupt
-// can still cancel through OnStop; when it finishes, success or failure,
-// it triggers shutdown, which is what lets RunWithApp return. report is
-// called with a non-canceled failure so the caller can log it (and
-// suppress it under --json) before it becomes errReported. A context
-// cancellation is the interrupt path, not a failure: it is neither
-// reported nor counted as one.
-func RunOperation(
-	ctx context.Context, opts AppOptions,
-	op func(v *vaultik.Vaultik) error, report func(err error),
-) error {
-	var (
-		mu     sync.Mutex
-		failed bool
-	)
-
-	opts.Invokes = append(opts.Invokes,
-		fx.Invoke(func(v *vaultik.Vaultik, lc fx.Lifecycle) {
-			lc.Append(fx.Hook{
-				OnStart: func(_ context.Context) error {
-					go func() {
-						err := op(v)
-						if err != nil && !errors.Is(err, context.Canceled) {
-							report(err)
-
-							mu.Lock()
-							failed = true
-							mu.Unlock()
-						}
-
-						stopErr := v.Shutdowner.Shutdown()
-						if stopErr != nil {
-							log.Error("Failed to shutdown", "error", stopErr)
-						}
-					}()
-
-					return nil
-				},
-				OnStop: func(_ context.Context) error {
-					v.Cancel()
-
-					return nil
-				},
-			})
-		}))
-
-	err := RunWithApp(ctx, opts)
-	if err != nil {
-		return err
-	}
-
-	// The goroutine sets failed before triggering the shutdown that lets
-	// RunWithApp return, so the write is in place by the time we read it.
-	mu.Lock()
-	defer mu.Unlock()
-
-	if failed {
-		return errReported
-	}
-
-	return nil
-}
-
 // runVaultikApp runs the standard single-operation command lifecycle
 // shared by the list/purge/verify/remove/remote-info subcommands:
-// resolve the config, then run op against the Vaultik instance through
+// resolve the config, start the fx app, run op against the Vaultik
-// RunOperation, reporting a failure prefixed with failMsg (suppressed
+// instance in a goroutine, report a failure prefixed with failMsg
-// while suppressErrors is true, e.g. under --json). extraQuiet is OR-ed
+// (suppressed while suppressErrors is true, e.g. under --json), then
-// into LogOptions.Quiet (e.g. --json output modes).
+// trigger shutdown. The operation is cancelled when the app stops.
+// jsonOutput marks a command whose stdout is a JSON document: it quiets
+// the UI but, unlike Quiet, leaves the stderr log level alone.
 func runVaultikApp(
-	cmd *cobra.Command, extraQuiet, suppressErrors bool,
+	cmd *cobra.Command, jsonOutput, suppressErrors bool,
 	failMsg string, op func(v *vaultik.Vaultik) error,
 ) error {
 	configPath, err := ResolveConfigPath()
@@ -292,20 +220,48 @@ func runVaultikApp(
 
 	rootFlags := GetRootFlags()
 
-	return RunOperation(cmd.Context(), AppOptions{
+	return RunWithApp(cmd.Context(), AppOptions{
 		ConfigPath: configPath,
 		LogOptions: log.Options{
 			Verbose: rootFlags.Verbose,
 			Debug:   rootFlags.Debug,
-			Quiet:   rootFlags.Quiet || extraQuiet,
+			Quiet:   rootFlags.Quiet,
+			JSON:    jsonOutput,
 		},
-	}, op, func(err error) {
+		Modules: []fx.Option{},
-		if suppressErrors {
+		Invokes: []fx.Option{
-			return
+			fx.Invoke(func(v *vaultik.Vaultik, lc fx.Lifecycle) {
-		}
+				lc.Append(fx.Hook{
+					OnStart: func(_ context.Context) error {
+						go func() {
+							err := op(v)
+							if err != nil {
+								if !errors.Is(err, context.Canceled) {
+									if !suppressErrors {
+										log.Error(failMsg, "error", err)
+										ReportErrorf("%s: %v", failMsg, err)
+									}
 
-		log.Error(failMsg, "error", err)
+									os.Exit(1)
-		ReportErrorf("%s: %v", failMsg, err)
+								}
+							}
+
+							err = v.Shutdowner.Shutdown()
+							if err != nil {
+								log.Error("Failed to shutdown", "error", err)
+							}
+						}()
+
+						return nil
+					},
+					OnStop: func(_ context.Context) error {
+						v.Cancel()
+
+						return nil
+					},
+				})
+			}),
+		},
 	})
 }
 

internal/cli/entry.go

@@ -1,7 +1,6 @@
 package cli
 
 import (
-	"errors"
 	"io"
 	"os"
 	"strings"
@@ -20,11 +19,7 @@ const shortCommitLen = 12
 // flag is present in os.Args — see bannerSuppressedInArgs), executes the
 // root cobra command, and routes any returned error through the
 // ui.Writer so the user sees a properly formatted "🛑 ERROR:" line.
-//
+func Entry() {
-// It returns the process exit code (0 on success, 1 on error) rather
-// than calling os.Exit, so that main's deferred profile writers run
-// before the process ends. See run in cmd/vaultik/main.go.
-func Entry() int {
 	emitStartupBanner(os.Args[1:], os.Stdout)
 
 	rootCmd := NewRootCommand()
@@ -32,19 +27,9 @@ func Entry() int {
 
 	err := rootCmd.Execute()
 	if err != nil {
-		// An operation that ran inside the fx app has already reported
+		ReportErrorf("%s", err.Error())
-		// its own failure (and suppressed it under --json); errReported
+		os.Exit(1)
-		// says so. Printing it again here would double the error line.
-		// Every other error — bad arguments, a config that would not
-		// load — reaches Entry unreported, so it is shown here.
-		if !errors.Is(err, errReported) {
-			ReportErrorf("%s", err.Error())
-		}
-
-		return 1
 	}
-
-	return 0
 }
 
 // emitStartupBanner writes the startup banner to w unless args (the

internal/cli/entry_banner_test.go

@@ -230,7 +230,7 @@ func TestEntryJSONStdoutIsExactlyOneDocument(t *testing.T) {
 		programName, flagConfig, configPath, cmdSnapshot, cmdList, flagJSON,
 	}
 
-	stdout := captureProcessStdout(t, func() { _ = Entry() })
+	stdout := captureProcessStdout(t, Entry)
 
 	requireExactlyOneJSONDocument(t, stdout)
 

internal/cli/entry_prune_json_stderr_test.go

@@ -0,0 +1,139 @@
+package cli //nolint:testpackage // shares the prune fixtures and capture helpers
+
+import (
+	"bytes"
+	"io"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// staleRecordLogMessage is the local-cleanup audit line CleanupLocalSnapshots
+// logs for each stale record. It is exactly the signal issue #112 says a
+// machine consumer lost under --json: gated off stdout, and pinned below
+// the log level on stderr because --json used to force Quiet.
+const staleRecordLogMessage = "Removing stale local snapshot record"
+
+// TestEntryPruneJSONStderrHonoursVerbosity is the end-to-end regression
+// guard for issue #112. Under --json the log level must still follow
+// --verbose/--debug rather than being pinned to WARN, so the
+// local-cleanup records reach stderr under --verbose while stdout stays
+// exactly one JSON document; without --verbose they stay below the
+// level, as they do without --json.
+//
+// Both halves are asserted together on the same run, because the fix has
+// to keep the document clean (issue #108) while freeing stderr.
+//
+// Not parallel: it replaces os.Args, os.Stdout, os.Stderr and the xdg
+// globals.
+//
+//nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
+func TestEntryPruneJSONStderrHonoursVerbosity(t *testing.T) {
+	for _, testCase := range []struct {
+		name         string
+		verbose      bool
+		wantOnStderr bool
+	}{
+		{
+			name:         "verbose json surfaces the cleanup record on stderr",
+			verbose:      true,
+			wantOnStderr: true,
+		},
+		{
+			name:         "json alone keeps the cleanup record below the level",
+			verbose:      false,
+			wantOnStderr: false,
+		},
+	} {
+		t.Run(testCase.name, func(t *testing.T) {
+			configPath := writeHermeticPruneConfig(t, true)
+
+			previousArgs := os.Args
+
+			t.Cleanup(func() {
+				os.Args = previousArgs
+				rootFlags = RootFlags{}
+			})
+
+			args := []string{
+				programName, flagConfig, configPath, cmdPrune, flagJSON,
+			}
+			if testCase.verbose {
+				args = append(args, "--verbose")
+			}
+
+			os.Args = args
+
+			stdout, stderr := captureProcessStdoutAndStderr(t, Entry)
+
+			// The document stays clean in both cases: freeing stderr must
+			// not regress issue #108.
+			requireExactlyOneJSONDocument(t, stdout)
+
+			if testCase.wantOnStderr {
+				assert.Contains(t, stderr, staleRecordLogMessage,
+					"--verbose --json must emit the cleanup record on stderr")
+				assert.Contains(t, stderr, stalePruneSnapshotID,
+					"the record must name the snapshot it removed")
+			} else {
+				assert.NotContains(t, stderr, staleRecordLogMessage,
+					"without --verbose the record stays below the log level")
+			}
+		})
+	}
+}
+
+// captureProcessStdoutAndStderr redirects both of the process's own
+// standard streams to pipes for the duration of fn and returns what was
+// written to each. The redirection is at the file-descriptor level
+// because the logger binds os.Stderr when it initializes inside fn, and
+// the JSON document reaches os.Stdout independently; the point is to see
+// where each actually lands.
+//
+// Not parallel-safe: os.Stdout and os.Stderr are process-global.
+func captureProcessStdoutAndStderr(t *testing.T, fn func()) (string, string) {
+	t.Helper()
+
+	outReader, outWriter, err := os.Pipe()
+	require.NoError(t, err)
+
+	errReader, errWriter, err := os.Pipe()
+	require.NoError(t, err)
+
+	previousOut, previousErr := os.Stdout, os.Stderr
+	os.Stdout, os.Stderr = outWriter, errWriter
+
+	capturedOut := drain(outReader)
+	capturedErr := drain(errReader)
+
+	fn()
+
+	os.Stdout, os.Stderr = previousOut, previousErr
+
+	require.NoError(t, outWriter.Close())
+	require.NoError(t, errWriter.Close())
+
+	out, errOut := <-capturedOut, <-capturedErr
+
+	require.NoError(t, outReader.Close())
+	require.NoError(t, errReader.Close())
+
+	return out, errOut
+}
+
+// drain copies a reader to a string on a goroutine and delivers the
+// result once the writer end is closed.
+func drain(reader io.Reader) <-chan string {
+	captured := make(chan string, 1)
+
+	go func() {
+		var buf bytes.Buffer
+
+		_, _ = io.Copy(&buf, reader)
+		captured <- buf.String()
+	}()
+
+	return captured
+}

internal/cli/entry_prune_json_test.go

@@ -81,7 +81,7 @@ func TestEntryPruneJSONStdoutIsExactlyOneDocument(t *testing.T) {
 				programName, flagConfig, configPath, cmdPrune, flagJSON,
 			}
 
-			stdout := captureProcessStdout(t, func() { _ = Entry() })
+			stdout := captureProcessStdout(t, Entry)
 
 			requireExactlyOneJSONDocument(t, stdout)
 

internal/cli/entry_status_test.go

@@ -1,58 +0,0 @@
-package cli //nolint:testpackage // shares programName and the capture helpers
-
-import (
-	"os"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// TestEntryReturnsStatusCode pins the contract main() relies on for
-// issue #75: Entry reports success or failure through its return value
-// and never calls os.Exit. An os.Exit from inside Entry would skip
-// main's deferred profile writers and truncate the profile of a failing
-// command. main turns this code into os.Exit only after those defers
-// run, so a failing command must come back with a non-zero code rather
-// than ending the process here.
-//
-// Stdout is captured only to keep the banner and command output off the
-// test log; the assertion is on the returned code.
-//
-//nolint:paralleltest // replaces os.Args and rootFlags
-func TestEntryReturnsStatusCode(t *testing.T) {
-	for _, testCase := range []struct {
-		name string
-		args []string
-		want int
-	}{
-		{
-			// version is self-contained: it needs no config and no
-			// destination store, so it exercises the success path.
-			name: "successful command returns zero",
-			args: []string{programName, "version"},
-			want: 0,
-		},
-		{
-			name: "unknown command returns one",
-			args: []string{programName, "no-such-command"},
-			want: 1,
-		},
-	} {
-		t.Run(testCase.name, func(t *testing.T) {
-			previousArgs := os.Args
-
-			t.Cleanup(func() {
-				os.Args = previousArgs
-				rootFlags = RootFlags{}
-			})
-
-			os.Args = testCase.args
-
-			var code int
-
-			_ = captureProcessStdout(t, func() { code = Entry() })
-
-			assert.Equal(t, testCase.want, code)
-		})
-	}
-}

internal/cli/info.go

@@ -1,7 +1,12 @@
 package cli
 
 import (
+	"context"
+	"errors"
+	"os"
+
 	"github.com/spf13/cobra"
+	"go.uber.org/fx"
 	"sneak.berlin/go/vaultik/internal/log"
 	"sneak.berlin/go/vaultik/internal/vaultik"
 )
@@ -28,18 +33,44 @@ func NewInfoCommand() *cobra.Command {
 			// Use the app framework
 			rootFlags := GetRootFlags()
 
-			return RunOperation(cmd.Context(), AppOptions{
+			return RunWithApp(cmd.Context(), AppOptions{
 				ConfigPath: configPath,
 				LogOptions: log.Options{
 					Verbose: rootFlags.Verbose,
 					Debug:   rootFlags.Debug,
 					Quiet:   rootFlags.Quiet,
 				},
-			}, func(v *vaultik.Vaultik) error {
+				Modules: []fx.Option{},
-				return v.ShowInfo()
+				Invokes: []fx.Option{
-			}, func(err error) {
+					fx.Invoke(func(v *vaultik.Vaultik, lc fx.Lifecycle) {
-				log.Error("Failed to show info", "error", err)
+						lc.Append(fx.Hook{
-				ReportErrorf("Failed to show info: %v", err)
+							OnStart: func(_ context.Context) error {
+								go func() {
+									err := v.ShowInfo()
+									if err != nil {
+										if !errors.Is(err, context.Canceled) {
+											log.Error("Failed to show info", "error", err)
+											ReportErrorf("Failed to show info: %v", err)
+											os.Exit(1)
+										}
+									}
+
+									err = v.Shutdowner.Shutdown()
+									if err != nil {
+										log.Error("Failed to shutdown", "error", err)
+									}
+								}()
+
+								return nil
+							},
+							OnStop: func(_ context.Context) error {
+								v.Cancel()
+
+								return nil
+							},
+						})
+					}),
+				},
 			})
 		},
 	}

internal/cli/prune.go

@@ -1,7 +1,12 @@
 package cli
 
 import (
+	"context"
+	"errors"
+	"os"
+
 	"github.com/spf13/cobra"
+	"go.uber.org/fx"
 	"sneak.berlin/go/vaultik/internal/log"
 	"sneak.berlin/go/vaultik/internal/vaultik"
 )
@@ -36,22 +41,52 @@ work (e.g. after a crashed backup or to reclaim storage).`,
 			// Use the app framework like other commands
 			rootFlags := GetRootFlags()
 
-			return RunOperation(cmd.Context(), AppOptions{
+			return RunWithApp(cmd.Context(), AppOptions{
 				ConfigPath: configPath,
 				LogOptions: log.Options{
 					Verbose: rootFlags.Verbose,
 					Debug:   rootFlags.Debug,
-					Quiet:   rootFlags.Quiet || opts.JSON,
+					Quiet:   rootFlags.Quiet,
+					JSON:    opts.JSON,
 				},
-			}, func(v *vaultik.Vaultik) error {
+				Modules: []fx.Option{},
-				return v.Prune(opts)
+				Invokes: []fx.Option{
-			}, func(err error) {
+					fx.Invoke(func(v *vaultik.Vaultik, lc fx.Lifecycle) {
-				if opts.JSON {
+						lc.Append(fx.Hook{
-					return
+							OnStart: func(_ context.Context) error {
-				}
+								// Start the prune operation in a goroutine
+								go func() {
+									// Run the prune operation
+									err := v.Prune(opts)
+									if err != nil {
+										if !errors.Is(err, context.Canceled) {
+											if !opts.JSON {
+												log.Error("Prune operation failed", "error", err)
+												ReportErrorf("Prune failed: %v", err)
+											}
 
-				log.Error("Prune operation failed", "error", err)
+											os.Exit(1)
-				ReportErrorf("Prune failed: %v", err)
+										}
+									}
+
+									// Shutdown the app when prune completes
+									err = v.Shutdowner.Shutdown()
+									if err != nil {
+										log.Error("Failed to shutdown", "error", err)
+									}
+								}()
+
+								return nil
+							},
+							OnStop: func(_ context.Context) error {
+								log.Debug("Stopping prune operation")
+								v.Cancel()
+
+								return nil
+							},
+						})
+					}),
+				},
 			})
 		},
 	}

internal/cli/remote.go

@@ -1,9 +1,12 @@
 package cli
 
 import (
+	"context"
 	"errors"
+	"os"
 
 	"github.com/spf13/cobra"
+	"go.uber.org/fx"
 	"sneak.berlin/go/vaultik/internal/log"
 	"sneak.berlin/go/vaultik/internal/vaultik"
 )
@@ -80,22 +83,48 @@ func newRemoteInfoCommand() *cobra.Command {
 
 			rootFlags := GetRootFlags()
 
-			return RunOperation(cmd.Context(), AppOptions{
+			return RunWithApp(cmd.Context(), AppOptions{
 				ConfigPath: configPath,
 				LogOptions: log.Options{
 					Verbose: rootFlags.Verbose,
 					Debug:   rootFlags.Debug,
-					Quiet:   rootFlags.Quiet || jsonOutput,
+					Quiet:   rootFlags.Quiet,
+					JSON:    jsonOutput,
 				},
-			}, func(v *vaultik.Vaultik) error {
+				Modules: []fx.Option{},
-				return v.RemoteInfo(jsonOutput)
+				Invokes: []fx.Option{
-			}, func(err error) {
+					fx.Invoke(func(v *vaultik.Vaultik, lc fx.Lifecycle) {
-				if jsonOutput {
+						lc.Append(fx.Hook{
-					return
+							OnStart: func(_ context.Context) error {
-				}
+								go func() {
+									err := v.RemoteInfo(jsonOutput)
+									if err != nil {
+										if !errors.Is(err, context.Canceled) {
+											if !jsonOutput {
+												log.Error("Failed to get remote info", "error", err)
+												ReportErrorf("Failed to get remote info: %v", err)
+											}
 
-				log.Error("Failed to get remote info", "error", err)
+											os.Exit(1)
-				ReportErrorf("Failed to get remote info: %v", err)
+										}
+									}
+
+									err = v.Shutdowner.Shutdown()
+									if err != nil {
+										log.Error("Failed to shutdown", "error", err)
+									}
+								}()
+
+								return nil
+							},
+							OnStop: func(_ context.Context) error {
+								v.Cancel()
+
+								return nil
+							},
+						})
+					}),
+				},
 			})
 		},
 	}

internal/cli/snapshot.go

@@ -1,10 +1,13 @@
 package cli
 
 import (
+	"context"
 	"errors"
 	"fmt"
+	"os"
 
 	"github.com/spf13/cobra"
+	"go.uber.org/fx"
 	"sneak.berlin/go/vaultik/internal/log"
 	"sneak.berlin/go/vaultik/internal/vaultik"
 )
@@ -83,8 +86,7 @@ specifying a path using --config or by setting VAULTIK_CONFIG to a path.`,
 			// Use the backup functionality from cli package
 			rootFlags := GetRootFlags()
 
-			// --cron suppression is wired through v.UI by setupGlobals.
+			return RunWithApp(cmd.Context(), AppOptions{
-			return RunOperation(cmd.Context(), AppOptions{
 				ConfigPath: configPath,
 				LogOptions: log.Options{
 					Verbose: rootFlags.Verbose,
@@ -92,11 +94,42 @@ specifying a path using --config or by setting VAULTIK_CONFIG to a path.`,
 					Cron:    opts.Cron,
 					Quiet:   rootFlags.Quiet,
 				},
-			}, func(v *vaultik.Vaultik) error {
+				Modules: []fx.Option{},
-				return v.CreateSnapshot(opts)
+				Invokes: []fx.Option{
-			}, func(err error) {
+					fx.Invoke(func(v *vaultik.Vaultik, lc fx.Lifecycle) {
-				log.Error("Snapshot creation failed", "error", err)
+						lc.Append(fx.Hook{
-				ReportErrorf("Snapshot creation failed: %v", err)
+							OnStart: func(_ context.Context) error {
+								// Start the snapshot creation in a goroutine
+								go func() {
+									// --cron suppression is wired through v.UI by setupGlobals.
+									err := v.CreateSnapshot(opts)
+									if err != nil {
+										if !errors.Is(err, context.Canceled) {
+											log.Error("Snapshot creation failed", "error", err)
+											ReportErrorf("Snapshot creation failed: %v", err)
+											os.Exit(1)
+										}
+									}
+
+									// Shutdown the app when snapshot completes
+									err = v.Shutdowner.Shutdown()
+									if err != nil {
+										log.Error("Failed to shutdown", "error", err)
+									}
+								}()
+
+								return nil
+							},
+							OnStop: func(_ context.Context) error {
+								log.Debug("Stopping snapshot creation")
+								// Cancel the Vaultik context
+								v.Cancel()
+
+								return nil
+							},
+						})
+					}),
+				},
 			})
 		},
 	}
@@ -188,11 +221,8 @@ func newSnapshotVerifyCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "verify <snapshot-id>",
 		Short: "Verify snapshot integrity",
-		Long: "Verifies that all blobs referenced in a snapshot exist.\n\n" +
+		Long:  "Verifies that all blobs referenced in a snapshot exist",
-			"The snapshot may be named by its ID or, on a host with no local\n" +
+		Args:  requireSnapshotIDArg,
-			"index, by the remote key that 'snapshot list' prints for a\n" +
-			"remote-only snapshot (an unambiguous leading part is enough).",
-		Args: requireSnapshotIDArg,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			snapshotID := args[0]
 
@@ -204,22 +234,48 @@ func newSnapshotVerifyCommand() *cobra.Command {
 
 			rootFlags := GetRootFlags()
 
-			return RunOperation(cmd.Context(), AppOptions{
+			return RunWithApp(cmd.Context(), AppOptions{
 				ConfigPath: configPath,
 				LogOptions: log.Options{
 					Verbose: rootFlags.Verbose,
 					Debug:   rootFlags.Debug,
-					Quiet:   rootFlags.Quiet || opts.JSON,
+					Quiet:   rootFlags.Quiet,
+					JSON:    opts.JSON,
 				},
-			}, func(v *vaultik.Vaultik) error {
+				Modules: []fx.Option{},
-				return v.VerifySnapshotWithOptions(snapshotID, opts)
+				Invokes: []fx.Option{
-			}, func(err error) {
+					fx.Invoke(func(v *vaultik.Vaultik, lc fx.Lifecycle) {
-				if opts.JSON {
+						lc.Append(fx.Hook{
-					return
+							OnStart: func(_ context.Context) error {
-				}
+								go func() {
+									err := v.VerifySnapshotWithOptions(snapshotID, opts)
+									if err != nil {
+										if !errors.Is(err, context.Canceled) {
+											if !opts.JSON {
+												log.Error("Verification failed", "error", err)
+												ReportErrorf("Verification failed: %v", err)
+											}
 
-				log.Error("Verification failed", "error", err)
+											os.Exit(1)
-				ReportErrorf("Verification failed: %v", err)
+										}
+									}
+
+									err = v.Shutdowner.Shutdown()
+									if err != nil {
+										log.Error("Failed to shutdown", "error", err)
+									}
+								}()
+
+								return nil
+							},
+							OnStop: func(_ context.Context) error {
+								v.Cancel()
+
+								return nil
+							},
+						})
+					}),
+				},
 			})
 		},
 	}

internal/cli/snapshot_restore.go

@@ -1,8 +1,16 @@
 package cli
 
 import (
+	"context"
+	"errors"
+	"os"
+
 	"github.com/spf13/cobra"
+	"go.uber.org/fx"
+	"sneak.berlin/go/vaultik/internal/config"
+	"sneak.berlin/go/vaultik/internal/globals"
 	"sneak.berlin/go/vaultik/internal/log"
+	"sneak.berlin/go/vaultik/internal/storage"
 	"sneak.berlin/go/vaultik/internal/vaultik"
 )
 
@@ -17,6 +25,15 @@ type RestoreOptions struct {
 	Verify    bool     // Verify restored files after restore
 }
 
+// RestoreApp contains all dependencies needed for restore
+type RestoreApp struct {
+	Globals    *globals.Globals
+	Config     *config.Config
+	Storage    storage.Storer
+	Vaultik    *vaultik.Vaultik
+	Shutdowner fx.Shutdowner
+}
+
 // newSnapshotRestoreCommand creates the 'snapshot restore' subcommand
 func newSnapshotRestoreCommand() *cobra.Command {
 	opts := &RestoreOptions{}
@@ -31,10 +48,6 @@ target directory.
 If no paths are specified, all files are restored.
 If paths are specified, only matching files/directories are restored.
 
-The snapshot may be named by its ID or, when restoring on a host with no
-local index, by the remote key that 'snapshot list' prints for a
-remote-only snapshot (an unambiguous leading part is enough).
-
 Requires the VAULTIK_AGE_SECRET_KEY environment variable to be set with
 the age private key.
 
@@ -64,8 +77,7 @@ Examples:
 	return cmd
 }
 
-// runRestore parses arguments and runs the restore operation through the
+// runRestore parses arguments and runs the restore operation through the app framework
-// app framework.
 func runRestore(cmd *cobra.Command, args []string, opts *RestoreOptions) error {
 	snapshotID := args[0]
 
@@ -74,30 +86,87 @@ func runRestore(cmd *cobra.Command, args []string, opts *RestoreOptions) error {
 		opts.Paths = args[restoreMinArgs:]
 	}
 
+	// Use unified config resolution
 	configPath, err := ResolveConfigPath()
 	if err != nil {
 		return err
 	}
 
+	// Use the app framework like other commands
 	rootFlags := GetRootFlags()
 
-	return RunOperation(cmd.Context(), AppOptions{
+	return RunWithApp(cmd.Context(), AppOptions{
 		ConfigPath: configPath,
 		LogOptions: log.Options{
 			Verbose: rootFlags.Verbose,
 			Debug:   rootFlags.Debug,
 			Quiet:   rootFlags.Quiet,
 		},
-	}, func(v *vaultik.Vaultik) error {
+		Modules: buildRestoreModules(),
-		return v.Restore(&vaultik.RestoreOptions{
+		Invokes: buildRestoreInvokes(snapshotID, opts),
-			SnapshotID: snapshotID,
-			TargetDir:  opts.TargetDir,
-			Paths:      opts.Paths,
-			Verify:     opts.Verify,
-			SkipErrors: rootFlags.SkipErrors,
-		})
-	}, func(err error) {
-		log.Error("Restore operation failed", "error", err)
-		ReportErrorf("Restore failed: %v", err)
 	})
 }
+
+// buildRestoreModules returns the fx.Options for dependency injection in restore
+func buildRestoreModules() []fx.Option {
+	return []fx.Option{
+		fx.Provide(fx.Annotate(
+			func(g *globals.Globals, cfg *config.Config,
+				storer storage.Storer, v *vaultik.Vaultik, shutdowner fx.Shutdowner) *RestoreApp {
+				return &RestoreApp{
+					Globals:    g,
+					Config:     cfg,
+					Storage:    storer,
+					Vaultik:    v,
+					Shutdowner: shutdowner,
+				}
+			},
+		)),
+	}
+}
+
+// buildRestoreInvokes returns the fx.Options that wire up the restore lifecycle
+func buildRestoreInvokes(snapshotID string, opts *RestoreOptions) []fx.Option {
+	return []fx.Option{
+		fx.Invoke(func(app *RestoreApp, lc fx.Lifecycle) {
+			lc.Append(fx.Hook{
+				OnStart: func(_ context.Context) error {
+					// Start the restore operation in a goroutine
+					go func() {
+						// Run the restore operation
+						restoreOpts := &vaultik.RestoreOptions{
+							SnapshotID: snapshotID,
+							TargetDir:  opts.TargetDir,
+							Paths:      opts.Paths,
+							Verify:     opts.Verify,
+							SkipErrors: GetRootFlags().SkipErrors,
+						}
+
+						err := app.Vaultik.Restore(restoreOpts)
+						if err != nil {
+							if !errors.Is(err, context.Canceled) {
+								log.Error("Restore operation failed", "error", err)
+								ReportErrorf("Restore failed: %v", err)
+								os.Exit(1)
+							}
+						}
+
+						// Shutdown the app when restore completes
+						err = app.Shutdowner.Shutdown()
+						if err != nil {
+							log.Error("Failed to shutdown", "error", err)
+						}
+					}()
+
+					return nil
+				},
+				OnStop: func(_ context.Context) error {
+					log.Debug("Stopping restore operation")
+					app.Vaultik.Cancel()
+
+					return nil
+				},
+			})
+		}),
+	}
+}

internal/log/module.go

@@ -14,8 +14,18 @@ var Module = fx.Module("log",
 )
 
 // New creates a new logger configuration from provided options.
+//
+// JSON is intentionally not carried into Config: a command emitting a
+// JSON document on stdout must keep its stderr log level under
+// --verbose/--debug, so --json must not lower it (issue #112). JSON
+// silences the stdout UI in setupGlobals instead.
 func New(opts Options) Config {
-	return Config(opts)
+	return Config{
+		Verbose: opts.Verbose,
+		Debug:   opts.Debug,
+		Cron:    opts.Cron,
+		Quiet:   opts.Quiet,
+	}
 }
 
 // Options are provided by the CLI.
@@ -24,4 +34,8 @@ type Options struct {
 	Debug   bool
 	Cron    bool
 	Quiet   bool
+	// JSON marks a command whose stdout carries a machine-readable
+	// document. It silences the human UI on stdout (see setupGlobals),
+	// but unlike Quiet it leaves the stderr log level alone.
+	JSON bool
 }

internal/storage/conformance_test.go

@@ -1,198 +0,0 @@
-package storage_test
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"io"
-	"reflect"
-	"sort"
-	"testing"
-
-	"sneak.berlin/go/vaultik/internal/storage"
-)
-
-// runStorerConformance is the shared Storer contract. Every backend that
-// can run in-process is expected to pass it: TestFileStorer runs it against
-// file://, TestS3Storer against s3://. A new backend inherits this coverage
-// by passing its own constructor, so the contract is defined once.
-//
-// It exercises the public Storer interface: round-trip, stat, list with
-// prefix filtering, overwrite, delete, delete-of-missing, and not-found on
-// Get and Stat. Each section takes its own fresh backend instance, so the
-// order of sections never matters and no section sees another's objects.
-func runStorerConformance(t *testing.T, newStorer func(*testing.T) storage.Storer) {
-	t.Helper()
-
-	conformanceRoundTrip(t, newStorer(t))
-	conformanceOverwrite(t, newStorer(t))
-	conformanceList(t, newStorer(t))
-	conformanceDelete(t, newStorer(t))
-	conformanceNotFound(t, newStorer(t))
-}
-
-// conformanceRoundTrip stores a nested key, then reads it back and stats it.
-func conformanceRoundTrip(t *testing.T, s storage.Storer) {
-	t.Helper()
-
-	ctx := context.Background()
-	key := "blobs/aa/bb/object.bin"
-	want := []byte("round-trip payload")
-
-	err := s.Put(ctx, key, bytes.NewReader(want))
-	if err != nil {
-		t.Fatalf("Put: %v", err)
-	}
-
-	got := getBytes(t, s, key)
-	if !bytes.Equal(got, want) {
-		t.Errorf("Get returned %q, want %q", got, want)
-	}
-
-	info, err := s.Stat(ctx, key)
-	if err != nil {
-		t.Fatalf("Stat: %v", err)
-	}
-
-	if info.Key != key {
-		t.Errorf("Stat key = %q, want %q", info.Key, key)
-	}
-
-	if info.Size != int64(len(want)) {
-		t.Errorf("Stat size = %d, want %d", info.Size, len(want))
-	}
-}
-
-// conformanceOverwrite checks that a second Put replaces the first.
-func conformanceOverwrite(t *testing.T, s storage.Storer) {
-	t.Helper()
-
-	ctx := context.Background()
-	key := "meta/snapshot.json"
-
-	err := s.Put(ctx, key, bytes.NewReader([]byte("first")))
-	if err != nil {
-		t.Fatalf("first Put: %v", err)
-	}
-
-	want := []byte("second and longer payload")
-
-	err = s.Put(ctx, key, bytes.NewReader(want))
-	if err != nil {
-		t.Fatalf("second Put: %v", err)
-	}
-
-	got := getBytes(t, s, key)
-	if !bytes.Equal(got, want) {
-		t.Errorf("after overwrite Get returned %q, want %q", got, want)
-	}
-}
-
-// conformanceList checks prefix filtering and the empty result for a
-// prefix that matches nothing.
-func conformanceList(t *testing.T, s storage.Storer) {
-	t.Helper()
-
-	ctx := context.Background()
-	keys := []string{"blobs/aa/one", "blobs/bb/two", "meta/three"}
-
-	for _, k := range keys {
-		err := s.Put(ctx, k, bytes.NewReader([]byte("data")))
-		if err != nil {
-			t.Fatalf("Put %q: %v", k, err)
-		}
-	}
-
-	if got := listSorted(t, s, ""); !reflect.DeepEqual(got, keys) {
-		t.Errorf("List(\"\") = %v, want %v", got, keys)
-	}
-
-	wantBlobs := []string{"blobs/aa/one", "blobs/bb/two"}
-	if got := listSorted(t, s, "blobs/"); !reflect.DeepEqual(got, wantBlobs) {
-		t.Errorf("List(\"blobs/\") = %v, want %v", got, wantBlobs)
-	}
-
-	if got := listSorted(t, s, "absent/"); len(got) != 0 {
-		t.Errorf("List(\"absent/\") = %v, want empty", got)
-	}
-}
-
-// conformanceDelete checks that Delete removes an object and that deleting
-// a missing key is not an error.
-func conformanceDelete(t *testing.T, s storage.Storer) {
-	t.Helper()
-
-	ctx := context.Background()
-	key := "blobs/cc/gone.bin"
-
-	err := s.Put(ctx, key, bytes.NewReader([]byte("temporary")))
-	if err != nil {
-		t.Fatalf("Put: %v", err)
-	}
-
-	err = s.Delete(ctx, key)
-	if err != nil {
-		t.Fatalf("Delete: %v", err)
-	}
-
-	_, err = s.Get(ctx, key)
-	if !errors.Is(err, storage.ErrNotFound) {
-		t.Errorf("Get after Delete error = %v, want ErrNotFound", err)
-	}
-
-	err = s.Delete(ctx, key)
-	if err != nil {
-		t.Errorf("Delete of missing key = %v, want nil", err)
-	}
-}
-
-// conformanceNotFound checks Get and Stat on an absent key.
-func conformanceNotFound(t *testing.T, s storage.Storer) {
-	t.Helper()
-
-	ctx := context.Background()
-	key := "never/written"
-
-	_, err := s.Get(ctx, key)
-	if !errors.Is(err, storage.ErrNotFound) {
-		t.Errorf("Get error = %v, want ErrNotFound", err)
-	}
-
-	_, err = s.Stat(ctx, key)
-	if !errors.Is(err, storage.ErrNotFound) {
-		t.Errorf("Stat error = %v, want ErrNotFound", err)
-	}
-}
-
-// getBytes reads a key fully and closes the reader.
-func getBytes(t *testing.T, s storage.Storer, key string) []byte {
-	t.Helper()
-
-	rc, err := s.Get(context.Background(), key)
-	if err != nil {
-		t.Fatalf("Get %q: %v", key, err)
-	}
-
-	defer func() { _ = rc.Close() }()
-
-	data, err := io.ReadAll(rc)
-	if err != nil {
-		t.Fatalf("read %q: %v", key, err)
-	}
-
-	return data
-}
-
-// listSorted returns the keys under a prefix in a stable order.
-func listSorted(t *testing.T, s storage.Storer, prefix string) []string {
-	t.Helper()
-
-	keys, err := s.List(context.Background(), prefix)
-	if err != nil {
-		t.Fatalf("List %q: %v", prefix, err)
-	}
-
-	sort.Strings(keys)
-
-	return keys
-}

internal/storage/file_backend_test.go

@@ -1,27 +0,0 @@
-package storage_test
-
-import (
-	"testing"
-
-	"sneak.berlin/go/vaultik/internal/storage"
-)
-
-// newFileStorer builds a file:// backend rooted at a fresh temp directory.
-//
-//nolint:ireturn // conformance runs against the Storer interface by design
-func newFileStorer(t *testing.T) storage.Storer {
-	t.Helper()
-
-	s, err := storage.NewFileStorer(t.TempDir())
-	if err != nil {
-		t.Fatalf("NewFileStorer: %v", err)
-	}
-
-	return s
-}
-
-// TestFileStorer runs the shared Storer contract against the file:// backend.
-func TestFileStorer(t *testing.T) {
-	t.Parallel()
-	runStorerConformance(t, newFileStorer)
-}

internal/storage/rclone_test.go

@@ -1,58 +0,0 @@
-package storage_test
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"sneak.berlin/go/vaultik/internal/storage"
-)
-
-// The rclone backend is a thin adapter over the rclone library: it turns a
-// (remote, path) pair into rclone's "remote:path" string, hands it to
-// rclone, and maps rclone's own results back to the Storer interface. What
-// can be tested in-process, without a configured remote or network, is that
-// adapter layer — how the arguments are shaped and how construction errors
-// are reported. The data-plane operations (Put/Get/List/Delete) are rclone's
-// own, exercised against a real provider (drive, s3-via-rclone, ...), which
-// needs a configured remote with credentials and network access and so is
-// out of reach of a unit test. The shared Storer conformance suite therefore
-// runs against the in-process file and s3 backends; the rclone backend
-// inherits that contract once a remote is configured.
-//
-// These tests use rclone's ":local:" on-the-fly backend, which addresses the
-// local filesystem directly without any configured remote, so construction
-// runs entirely in-process.
-
-// TestNewRcloneStorerConstruction checks that a valid remote constructs a
-// backend and that Info() reports the shaped "remote:path" location.
-//
-//nolint:paralleltest // NewRcloneStorer installs the process-global rclone config
-func TestNewRcloneStorerConstruction(t *testing.T) {
-	dir := t.TempDir()
-
-	s, err := storage.NewRcloneStorer(context.Background(), ":local", dir)
-	if err != nil {
-		t.Fatalf("NewRcloneStorer: %v", err)
-	}
-
-	// Info().Location is the "remote:path" string the adapter builds from
-	// its two arguments, so asserting it confirms the argument shaping.
-	want := ":local:" + dir
-	if got := s.Info().Location; got != want {
-		t.Errorf("Info().Location = %q, want %q", got, want)
-	}
-}
-
-// TestNewRcloneStorerUnknownRemote checks that a remote that is not in the
-// rclone config fails construction with the ErrRemoteNotFound sentinel,
-// rather than silently returning a backend pointed nowhere.
-//
-//nolint:paralleltest // NewRcloneStorer installs the process-global rclone config
-func TestNewRcloneStorerUnknownRemote(t *testing.T) {
-	_, err := storage.NewRcloneStorer(
-		context.Background(), "vaultik-no-such-remote", "path")
-	if !errors.Is(err, storage.ErrRemoteNotFound) {
-		t.Errorf("NewRcloneStorer error = %v, want ErrRemoteNotFound", err)
-	}
-}

internal/storage/s3_test.go

@@ -13,23 +13,18 @@ import (
 	"sneak.berlin/go/vaultik/internal/storage"
 )
 
-// s3TestBucket is the bucket created for each in-process S3 server.
+// TestS3StorerMissingKeyMapsToErrNotFound verifies that the s3 backend reports
-const s3TestBucket = "test-bucket"
+// a missing object as storage.ErrNotFound, matching the file and rclone
-
+// backends and the Storer contract. Without the mapping, Get and Stat leak the
-// newS3Storer builds an s3:// backend backed by a fresh in-process
+// raw SDK error and errors.Is(err, storage.ErrNotFound) is false.
-// S3 server. It reuses the same in-memory S3 harness (gofakes3 + s3mem
-// over httptest) that internal/s3 and the not-found regression test use,
-// so no new mock or dependency is introduced. Each call gets its own
-// server, bucket, and client, so the conformance suite's per-section
-// instances stay isolated.
 //
-//nolint:ireturn // conformance runs against the Storer interface by design
+//nolint:paralleltest // shares an in-process S3 server via t.Cleanup
-func newS3Storer(t *testing.T) storage.Storer {
+func TestS3StorerMissingKeyMapsToErrNotFound(t *testing.T) {
-	t.Helper()
+	const bucket = "test-bucket"
 
 	backend := s3mem.New()
 
-	err := backend.CreateBucket(s3TestBucket)
+	err := backend.CreateBucket(bucket)
 	if err != nil {
 		t.Fatalf("create bucket: %v", err)
 	}
@@ -37,9 +32,11 @@ func newS3Storer(t *testing.T) storage.Storer {
 	srv := httptest.NewServer(gofakes3.New(backend).Server())
 	t.Cleanup(srv.Close)
 
-	client, err := s3.NewClient(context.Background(), s3.Config{
+	ctx := context.Background()
+
+	client, err := s3.NewClient(ctx, s3.Config{
 		Endpoint:        srv.URL,
-		Bucket:          s3TestBucket,
+		Bucket:          bucket,
 		AccessKeyID:     "test",
 		SecretAccessKey: "test",
 		Region:          "us-east-1",
@@ -48,28 +45,9 @@ func newS3Storer(t *testing.T) storage.Storer {
 		t.Fatalf("new client: %v", err)
 	}
 
-	return storage.NewS3Storer(client)
+	storer := storage.NewS3Storer(client)
-}
 
-// TestS3Storer runs the shared Storer contract against the s3:// backend,
+	_, err = storer.Get(ctx, "does-not-exist")
-// so it is held to the same round-trip, list, delete, and not-found
-// behaviour as the file:// backend.
-func TestS3Storer(t *testing.T) {
-	t.Parallel()
-	runStorerConformance(t, newS3Storer)
-}
-
-// TestS3StorerMissingKeyMapsToErrNotFound pins the specific contract that a
-// missing object surfaces as storage.ErrNotFound rather than the raw AWS SDK
-// error. Without the mapping, errors.Is(err, storage.ErrNotFound) is false on
-// s3 and callers would branch differently per backend.
-func TestS3StorerMissingKeyMapsToErrNotFound(t *testing.T) {
-	t.Parallel()
-
-	storer := newS3Storer(t)
-	ctx := context.Background()
-
-	_, err := storer.Get(ctx, "does-not-exist")
 	if !errors.Is(err, storage.ErrNotFound) {
 		t.Errorf("Get on missing key: got %v, want ErrNotFound", err)
 	}

internal/storage/url_parse_test.go

@@ -1,110 +0,0 @@
-package storage_test
-
-import (
-	"errors"
-	"reflect"
-	"testing"
-
-	"sneak.berlin/go/vaultik/internal/storage"
-)
-
-// TestParseStorageURLValid checks that each supported scheme parses into
-// the expected fields, since those fields decide which backend is built.
-func TestParseStorageURLValid(t *testing.T) {
-	t.Parallel()
-
-	const bucket = "mybucket"
-
-	cases := []struct {
-		name string
-		raw  string
-		want *storage.URL
-	}{
-		{
-			name: "file absolute path",
-			raw:  "file:///var/backups/vaultik",
-			want: &storage.URL{Scheme: "file", Prefix: "/var/backups/vaultik"},
-		},
-		{
-			name: "s3 bucket and prefix, ssl defaults on",
-			raw:  "s3://mybucket/backups/host",
-			want: &storage.URL{
-				Scheme: "s3", Bucket: bucket,
-				Prefix: "backups/host", UseSSL: true,
-			},
-		},
-		{
-			name: "s3 bucket only",
-			raw:  "s3://mybucket",
-			want: &storage.URL{Scheme: "s3", Bucket: bucket, UseSSL: true},
-		},
-		{
-			name: "s3 with endpoint, region, ssl off",
-			raw:  "s3://mybucket?endpoint=minio.example.com&region=us-west-2&ssl=false",
-			want: &storage.URL{
-				Scheme: "s3", Bucket: bucket,
-				Endpoint: "minio.example.com", Region: "us-west-2", UseSSL: false,
-			},
-		},
-		{
-			name: "rclone remote and path",
-			raw:  "rclone://gdrive/backups/host",
-			want: &storage.URL{
-				Scheme: "rclone", RcloneRemote: "gdrive", Prefix: "backups/host",
-			},
-		},
-		{
-			name: "rclone remote only",
-			raw:  "rclone://gdrive",
-			want: &storage.URL{Scheme: "rclone", RcloneRemote: "gdrive"},
-		},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			got, err := storage.ParseStorageURL(tc.raw)
-			if err != nil {
-				t.Fatalf("ParseStorageURL(%q) returned error: %v", tc.raw, err)
-			}
-
-			if !reflect.DeepEqual(got, tc.want) {
-				t.Errorf("ParseStorageURL(%q) = %+v, want %+v", tc.raw, got, tc.want)
-			}
-		})
-	}
-}
-
-// TestParseStorageURLErrors checks that empty, missing, and unknown-scheme
-// inputs fail with the documented sentinel errors instead of parsing to a
-// wrong destination.
-func TestParseStorageURLErrors(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		name    string
-		raw     string
-		wantErr error
-	}{
-		{"empty url", "", storage.ErrEmptyStorageURL},
-		{"file empty path", "file://", storage.ErrEmptyFilePath},
-		{"s3 missing bucket", "s3://", storage.ErrMissingBucket},
-		{"s3 missing bucket with path", "s3:///justprefix", storage.ErrMissingBucket},
-		{"rclone missing remote", "rclone://", storage.ErrMissingRemote},
-		{"unknown scheme", "gs://bucket/x", storage.ErrUnsupportedScheme},
-		{"no scheme", "/local/path", storage.ErrUnsupportedScheme},
-	}
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			_, err := storage.ParseStorageURL(tc.raw)
-			if !errors.Is(err, tc.wantErr) {
-				t.Errorf("ParseStorageURL(%q) error = %v, want %v",
-					tc.raw, err, tc.wantErr)
-			}
-		})
-	}
-}

internal/vaultik/prune_count_test.go

@@ -1,79 +0,0 @@
-package vaultik //nolint:testpackage // exercises unexported count helpers
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/vaultik/internal/database"
-	"sneak.berlin/go/vaultik/internal/log"
-)
-
-// TestTableCountForReportSurfacesReadFailure is the regression guard for
-// the discarded-error bug: getTableCount for a table its query cannot
-// resolve must not silently become 0. A count that could not be read is
-// reported as unknown, which a reader can tell apart from an empty table.
-//
-//nolint:paralleltest // installs the global logger via log.Initialize
-func TestTableCountForReportSurfacesReadFailure(t *testing.T) {
-	log.Initialize(log.Config{})
-
-	ctx := context.Background()
-
-	db, err := database.New(ctx, ":memory:")
-	require.NoError(t, err)
-	t.Cleanup(func() { _ = db.Close() })
-
-	v := &Vaultik{DB: db}
-	v.SetContext(ctx)
-
-	// A table present in the schema reads as a real count.
-	blobs := v.tableCountForReport("blobs")
-	require.NotNil(t, blobs, "an existing table must read as a real count")
-	assert.Equal(t, int64(0), *blobs)
-
-	// A syntactically valid name the sanitizer accepts but whose table
-	// the query cannot resolve is the exact shape #96 describes: a
-	// would-be loud failure that used to be discarded into a 0.
-	_, err = v.getTableCount("snapshots_missing")
-	require.Error(t, err, "a query against a nonexistent table must fail")
-
-	missing := v.tableCountForReport("snapshots_missing")
-	assert.Nil(t, missing, "a failed read is unknown, not a count")
-
-	// The rendered count for a failed read must say unknown, never 0.
-	assert.Equal(t, countUnknown, countText(missing))
-	assert.NotEqual(t, "0", countText(missing))
-}
-
-// TestCountTextDistinguishesEmptyFromUnknown pins the distinction the
-// output has to preserve: 0 means the table was empty, "unknown" means
-// the count could not be read.
-func TestCountTextDistinguishesEmptyFromUnknown(t *testing.T) {
-	t.Parallel()
-
-	zero := int64(0)
-	seven := int64(7)
-
-	assert.Equal(t, "0", countText(&zero))
-	assert.Equal(t, "7", countText(&seven))
-	assert.Equal(t, countUnknown, countText(nil))
-}
-
-// TestCountDiffUnknownWhenEitherSideUnknown checks that a delta computed
-// from an unreadable count is itself unknown rather than a plausible
-// number.
-func TestCountDiffUnknownWhenEitherSideUnknown(t *testing.T) {
-	t.Parallel()
-
-	before := int64(10)
-	after := int64(3)
-
-	require.NotNil(t, countDiff(&before, &after))
-	assert.Equal(t, int64(7), *countDiff(&before, &after))
-
-	assert.Nil(t, countDiff(nil, &after), "unknown before yields unknown delta")
-	assert.Nil(t, countDiff(&before, nil), "unknown after yields unknown delta")
-	assert.Nil(t, countDiff(nil, nil))
-}

internal/vaultik/restore.go

@@ -18,6 +18,7 @@ import (
 	"sneak.berlin/go/vaultik/internal/blobgen"
 	"sneak.berlin/go/vaultik/internal/database"
 	"sneak.berlin/go/vaultik/internal/log"
+	"sneak.berlin/go/vaultik/internal/snapshot"
 	"sneak.berlin/go/vaultik/internal/types"
 )
 
@@ -576,20 +577,14 @@ func (v *Vaultik) handleRestoreVerification(
 }
 
 // downloadSnapshotDB downloads and decrypts the snapshot metadata
-// database. The identifier is resolved to the snapshot's remote key: a
+// database. The snapshotID is the human ID; we hash it to the remote
-// human ID is hashed, and a remote key (or its abbreviation, as printed
+// key for the storage path.
-// for a remote-only snapshot) is used as-is, so a host with no local
-// index can restore the snapshots it can only see on the store.
 func (v *Vaultik) downloadSnapshotDB(
 	snapshotID string, identity age.Identity,
 ) (*database.DB, error) {
-	remoteKey, err := v.resolveSnapshotRemoteKey(snapshotID)
-	if err != nil {
-		return nil, err
-	}
-
 	// Download encrypted database from storage
-	dbKey := fmt.Sprintf("metadata/%s/db.zst.age", remoteKey)
+	dbKey := fmt.Sprintf("metadata/%s/db.zst.age",
+		snapshot.RemoteSnapshotKey(snapshotID))
 
 	reader, err := v.Storage.Get(v.ctx, dbKey)
 	if err != nil {

internal/vaultik/restore_another_machine_test.go

@@ -1,167 +0,0 @@
-package vaultik_test
-
-import (
-	"bytes"
-	"context"
-	"io"
-	"path/filepath"
-	"testing"
-
-	"github.com/spf13/afero"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/vaultik/internal/config"
-	"sneak.berlin/go/vaultik/internal/database"
-	"sneak.berlin/go/vaultik/internal/log"
-	"sneak.berlin/go/vaultik/internal/snapshot"
-	"sneak.berlin/go/vaultik/internal/storage"
-	"sneak.berlin/go/vaultik/internal/ui"
-	"sneak.berlin/go/vaultik/internal/vaultik"
-)
-
-// TestRestoreOnAnotherMachine proves the disaster-recovery path: a host
-// that has only the vaultik binary, the age secret key, and the storage
-// credentials — no local index, a different hostname, and no
-// age_recipients configured — can list, restore, and verify a snapshot
-// straight from the destination store.
-//
-// The backup half writes a snapshot with one index and hostname. The
-// restore half throws that index away entirely: a fresh, empty index and
-// a config that shares nothing with the original but the storage location
-// and the secret key. If restore or verify needed the original local
-// index — or the human snapshot ID that only that index holds — this test
-// could not run, because the recovery host can know neither.
-func TestRestoreOnAnotherMachine(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	fs := afero.NewOsFs()
-	tempDir := t.TempDir()
-
-	dataDir := filepath.Join(tempDir, "source")
-	storeDir := filepath.Join(tempDir, "remote")
-	restoreDir := filepath.Join(tempDir, "restored")
-	dbPath := filepath.Join(tempDir, "index.sqlite")
-
-	chunkSize := int64(64 * 1024)
-	maxBlobSize := int64(512 * 1024)
-
-	sourceFiles := writeRecoverySourceTree(t, fs, dataDir, chunkSize)
-
-	ctx := context.Background()
-
-	// Backup host: one index, hostname test-host, age_recipients set.
-	// runFileStorageBackup closes the index before returning, so nothing
-	// below can lean on it.
-	_, storer, originalID := runFileStorageBackup(
-		ctx, t, fs, dataDir, storeDir, dbPath, chunkSize, maxBlobSize)
-
-	// Recovery host: a fresh empty index, a different hostname, and no
-	// age_recipients — only the secret key and the same storage location.
-	recovery, stdout := newRecoveryHost(ctx, t, fs, storer)
-
-	// The recovery index really is empty. This is the assertion that makes
-	// the test a guard against restore quietly depending on the original
-	// index: if it did, an empty index would make restore fail.
-	localSnaps, err := recovery.Repositories.Snapshots.ListRecent(ctx, 100)
-	require.NoError(t, err)
-	require.Empty(t, localSnaps, "recovery host must start with no local index")
-
-	// List: the snapshot shows up as remote-only, identified by its remote
-	// key, with no recoverable human ID.
-	require.NoError(t, recovery.ListSnapshots(true))
-
-	rows := decodeListJSON(t, stdout.String())
-	require.Len(t, rows, 1)
-
-	remote := rows[0]
-	assert.False(t, remote.LocallyTracked, "snapshot must be remote-only here")
-	assert.Empty(t, remote.ID, "the human ID is unknown to the recovery host")
-	require.Len(t, remote.RemoteKey, 64)
-	assert.Equal(t, snapshot.RemoteSnapshotKey(originalID), remote.RemoteKey,
-		"the listed key is the hashed snapshot ID")
-
-	// Restore driven by the abbreviated identifier the table prints (the
-	// first 12 hex of the remote key), then deep-verify from the store
-	// keyed by the full remote key. Both are what a recovery host can know.
-	require.NoError(t, recovery.Restore(&vaultik.RestoreOptions{
-		SnapshotID: remote.RemoteKey[:12],
-		TargetDir:  restoreDir,
-		Verify:     true,
-	}))
-	require.NoError(t, recovery.RunDeepVerify(
-		remote.RemoteKey, &vaultik.VerifyOptions{Deep: true}))
-
-	assertRestoredTreeMatches(t, fs, restoreDir, sourceFiles)
-}
-
-// writeRecoverySourceTree writes a small source tree spanning several
-// chunks (so restore reassembles real multi-chunk files) and returns the
-// content keyed by absolute path.
-func writeRecoverySourceTree(
-	t *testing.T, fs afero.Fs, dataDir string, chunkSize int64,
-) map[string][]byte {
-	t.Helper()
-
-	sourceFiles := map[string][]byte{
-		filepath.Join(dataDir, "notes.txt"):        []byte("recover me"),
-		filepath.Join(dataDir, "sub", "big.bin"):   bytesPattern("big-", int(chunkSize*3)),
-		filepath.Join(dataDir, "sub", "small.bin"): bytesPattern("small-", 128),
-	}
-
-	for path, content := range sourceFiles {
-		require.NoError(t, fs.MkdirAll(filepath.Dir(path), 0o755))
-		require.NoError(t, afero.WriteFile(fs, path, content, 0o644))
-	}
-
-	return sourceFiles
-}
-
-// newRecoveryHost builds the Vaultik a replacement machine would run: an
-// empty in-memory index, a hostname different from the backup host, no
-// age_recipients, and only the secret key plus the shared storer. It
-// returns the instance and the buffer its stdout is wired to.
-func newRecoveryHost(
-	ctx context.Context, t *testing.T, fs afero.Fs, storer storage.Storer,
-) (*vaultik.Vaultik, *bytes.Buffer) {
-	t.Helper()
-
-	recoveryDB, err := database.New(ctx, ":memory:")
-	require.NoError(t, err)
-	t.Cleanup(func() { _ = recoveryDB.Close() })
-
-	stdout := &bytes.Buffer{}
-
-	recovery := &vaultik.Vaultik{
-		Config: &config.Config{
-			AgeSecretKey: testAgeSecretKey,
-			Hostname:     "recovery-host",
-		},
-		Storage:      storer,
-		Fs:           fs,
-		Repositories: database.NewRepositories(recoveryDB),
-		DB:           recoveryDB,
-		Stdout:       stdout,
-		Stderr:       io.Discard,
-		UI:           ui.NewWithColor(io.Discard, false),
-	}
-	recovery.SetContext(ctx)
-
-	return recovery, stdout
-}
-
-// assertRestoredTreeMatches byte-compares every restored file against its
-// source content.
-func assertRestoredTreeMatches(
-	t *testing.T, fs afero.Fs, restoreDir string, sourceFiles map[string][]byte,
-) {
-	t.Helper()
-
-	for origPath, expected := range sourceFiles {
-		restored := filepath.Join(restoreDir, origPath)
-		got, err := afero.ReadFile(fs, restored)
-		require.NoErrorf(t, err, "restored file missing: %s", restored)
-		require.Truef(t, bytes.Equal(got, expected),
-			"byte mismatch for %s", origPath)
-	}
-}

internal/vaultik/snapshot.go

@@ -8,7 +8,6 @@ import (
 	"path/filepath"
 	"regexp"
 	"sort"
-	"strconv"
 	"strings"
 	"time"
 
@@ -670,11 +669,9 @@ func (v *Vaultik) VerifySnapshotWithOptions(
 
 	v.printVerifyHeader(snapshotID, opts)
 
-	// Resolve the identifier to the snapshot's remote key and download the
+	// Download and parse manifest. The caller supplies a human
-	// manifest. A human ID is hashed; a remote key (or its abbreviation,
+	// snapshot ID; we hash it to address remote storage.
-	// as printed for a remote-only snapshot) is used as-is, so a host with
+	manifest, err := v.downloadManifestByKey(snapshot.RemoteSnapshotKey(snapshotID))
-	// no local index can verify a snapshot it can only see on the store.
-	manifest, err := v.resolveAndDownloadManifest(snapshotID)
 	if err != nil {
 		if opts.JSON {
 			result.Status = verifyStatusFailed
@@ -1543,17 +1540,12 @@ func (v *Vaultik) outputRemoveJSON(result *RemoveResult) error {
 	return encoder.Encode(result)
 }
 
-// PruneResult contains statistics about the prune operation.
+// PruneResult contains statistics about the prune operation
-// SnapshotsDeleted counts snapshots actually deleted. FilesDeleted,
-// ChunksDeleted, and BlobsDeleted are derived from before/after row
-// counts of the local index; each is nil when a count could not be read,
-// so an unreadable count is reported as unknown rather than silently
-// as 0.
 type PruneResult struct {
 	SnapshotsDeleted int64
-	FilesDeleted     *int64
+	FilesDeleted     int64
-	ChunksDeleted    *int64
+	ChunksDeleted    int64
-	BlobsDeleted     *int64
+	BlobsDeleted     int64
 }
 
 // PruneDatabase removes incomplete snapshots and orphaned files, chunks,
@@ -1568,7 +1560,7 @@ func (v *Vaultik) PruneDatabase() (*PruneResult, error) {
 	result := &PruneResult{}
 
 	// Snapshot counts before deletion of incompletes.
-	snapshotCountBefore := v.tableCountForReport("snapshots")
+	snapshotCountBefore, _ := v.getTableCount("snapshots")
 
 	// First, delete any incomplete snapshots
 	incompleteSnapshots, err := v.Repositories.Snapshots.GetIncompleteSnapshots(v.ctx)
@@ -1583,9 +1575,9 @@ func (v *Vaultik) PruneDatabase() (*PruneResult, error) {
 	}
 
 	// Get counts before cleanup for reporting
-	fileCountBefore := v.tableCountForReport("files")
+	fileCountBefore, _ := v.getTableCount("files")
-	chunkCountBefore := v.tableCountForReport("chunks")
+	chunkCountBefore, _ := v.getTableCount("chunks")
-	blobCountBefore := v.tableCountForReport("blobs")
+	blobCountBefore, _ := v.getTableCount("blobs")
 
 	// Run the cleanup
 	err = v.SnapshotManager.CleanupOrphanedData(v.ctx)
@@ -1594,83 +1586,36 @@ func (v *Vaultik) PruneDatabase() (*PruneResult, error) {
 	}
 
 	// Get counts after cleanup
-	fileCountAfter := v.tableCountForReport("files")
+	fileCountAfter, _ := v.getTableCount("files")
-	chunkCountAfter := v.tableCountForReport("chunks")
+	chunkCountAfter, _ := v.getTableCount("chunks")
-	blobCountAfter := v.tableCountForReport("blobs")
+	blobCountAfter, _ := v.getTableCount("blobs")
 
-	result.FilesDeleted = countDiff(fileCountBefore, fileCountAfter)
+	result.FilesDeleted = fileCountBefore - fileCountAfter
-	result.ChunksDeleted = countDiff(chunkCountBefore, chunkCountAfter)
+	result.ChunksDeleted = chunkCountBefore - chunkCountAfter
-	result.BlobsDeleted = countDiff(blobCountBefore, blobCountAfter)
+	result.BlobsDeleted = blobCountBefore - blobCountAfter
 
 	log.Info("Local database prune complete",
 		"incomplete_snapshots", result.SnapshotsDeleted,
-		"orphaned_files", countText(result.FilesDeleted),
+		"orphaned_files", result.FilesDeleted,
-		"orphaned_chunks", countText(result.ChunksDeleted),
+		"orphaned_chunks", result.ChunksDeleted,
-		"orphaned_blobs", countText(result.BlobsDeleted),
+		"orphaned_blobs", result.BlobsDeleted,
 	)
 
-	// Snapshots remaining after removing the incomplete ones; unknown if
+	snapshotCountAfter := snapshotCountBefore - result.SnapshotsDeleted
-	// the pre-prune snapshot count could not be read.
-	snapshotsRemain := countDiff(snapshotCountBefore, &result.SnapshotsDeleted)
 
 	v.UI.Completef("Pruned local index database.")
-	v.UI.Detailf("Incomplete snapshots: %s removed (%s remain).",
+	v.UI.Detailf("Incomplete snapshots: %d removed (%d remain).",
-		countText(&result.SnapshotsDeleted), countText(snapshotsRemain))
+		result.SnapshotsDeleted, snapshotCountAfter)
-	v.UI.Detailf("Orphaned files: %s removed (%s remain).",
+	v.UI.Detailf("Orphaned files: %d removed (%d remain).",
-		countText(result.FilesDeleted), countText(fileCountAfter))
+		result.FilesDeleted, fileCountAfter)
-	v.UI.Detailf("Orphaned chunks: %s removed (%s remain).",
+	v.UI.Detailf("Orphaned chunks: %d removed (%d remain).",
-		countText(result.ChunksDeleted), countText(chunkCountAfter))
+		result.ChunksDeleted, chunkCountAfter)
-	v.UI.Detailf("Orphaned blobs: %s removed (%s remain).",
+	v.UI.Detailf("Orphaned blobs: %d removed (%d remain).",
-		countText(result.BlobsDeleted), countText(blobCountAfter))
+		result.BlobsDeleted, blobCountAfter)
 
 	return result, nil
 }
 
-// countUnknown is what a count reads as when its query could not be run,
-// distinct from "0", which means the table really was empty.
-const countUnknown = "unknown"
-
-// tableCountForReport returns the row count of a table for the prune
-// summary, or nil if the count could not be read. A read failure is
-// logged at warn — visible even under --json, which routes warnings to
-// stderr — and then rendered as unknown rather than silently becoming 0,
-// so a broken query is a visible failure instead of a plausible wrong
-// number.
-func (v *Vaultik) tableCountForReport(tableName string) *int64 {
-	count, err := v.getTableCount(tableName)
-	if err != nil {
-		log.Warn("could not read table row count for prune summary",
-			"table", tableName, "error", err)
-
-		return nil
-	}
-
-	return &count
-}
-
-// countDiff returns before-after, or nil if either count is unknown so
-// that an unreadable count does not collapse into a plausible delta.
-func countDiff(before, after *int64) *int64 {
-	if before == nil || after == nil {
-		return nil
-	}
-
-	diff := *before - *after
-
-	return &diff
-}
-
-// countText renders a count that may be unknown: nil (the read failed)
-// becomes "unknown", never "0", so a reader can tell an empty table from
-// one that could not be queried.
-func countText(count *int64) string {
-	if count == nil {
-		return countUnknown
-	}
-
-	return strconv.FormatInt(*count, 10)
-}
-
 // validTableNameRe matches table names containing only lowercase
 // alphanumeric characters and underscores.
 var validTableNameRe = regexp.MustCompile(`^[a-z0-9_]+$`)

internal/vaultik/snapshot_identifier.go

@@ -1,101 +0,0 @@
-package vaultik
-
-import (
-	"errors"
-	"fmt"
-	"strings"
-
-	"sneak.berlin/go/vaultik/internal/snapshot"
-)
-
-// remoteKeyHexLen is the length of a full remote snapshot key: a SHA256
-// digest rendered as lowercase hex.
-const remoteKeyHexLen = 64
-
-// Sentinel errors for resolving a snapshot identifier against the store.
-var (
-	errSnapshotKeyNotFound = errors.New(
-		"no snapshot on the destination store matches this identifier")
-	errSnapshotKeyAmbiguous = errors.New(
-		"identifier matches more than one snapshot on the destination store")
-)
-
-// resolveSnapshotRemoteKey turns a snapshot identifier supplied on the
-// command line into the remote key that names the snapshot's metadata
-// directory on the destination store. Every remote path a restore or
-// verify reads is built from that key.
-//
-// Two forms are accepted, matching the two things a host can know:
-//
-//   - A human snapshot ID (hostname_name_timestamp), which a host holding
-//     the local index has. It is hashed to its remote key; the store is
-//     not consulted.
-//   - A remote key, or the leading part of one, which is all a host with
-//     no local index can know — it is exactly what `snapshot list` prints
-//     for a remote-only snapshot (see formatRemoteOnlyID). It is resolved
-//     against the destination store's metadata listing; an identifier that
-//     matches no snapshot, or more than one, is an error.
-//
-// The two are told apart by shape: a remote key is lowercase hex, and a
-// human snapshot ID never is (it carries a hostname, underscores, and an
-// RFC3339 timestamp).
-func (v *Vaultik) resolveSnapshotRemoteKey(identifier string) (string, error) {
-	if !isRemoteKeyOrPrefix(identifier) {
-		return snapshot.RemoteSnapshotKey(identifier), nil
-	}
-
-	keys, err := v.listAllRemoteSnapshotKeys()
-	if err != nil {
-		return "", fmt.Errorf(
-			"listing destination store to resolve %q: %w", identifier, err)
-	}
-
-	var matches []string
-
-	for _, key := range keys {
-		if strings.HasPrefix(key, identifier) {
-			matches = append(matches, key)
-		}
-	}
-
-	switch len(matches) {
-	case 1:
-		return matches[0], nil
-	case 0:
-		return "", fmt.Errorf("%w: %s", errSnapshotKeyNotFound, identifier)
-	default:
-		return "", fmt.Errorf("%w: %s (%d matches)",
-			errSnapshotKeyAmbiguous, identifier, len(matches))
-	}
-}
-
-// resolveAndDownloadManifest resolves a snapshot identifier to its remote
-// key (see resolveSnapshotRemoteKey) and downloads that snapshot's
-// manifest.
-func (v *Vaultik) resolveAndDownloadManifest(
-	identifier string,
-) (*snapshot.Manifest, error) {
-	remoteKey, err := v.resolveSnapshotRemoteKey(identifier)
-	if err != nil {
-		return nil, err
-	}
-
-	return v.downloadManifestByKey(remoteKey)
-}
-
-// isRemoteKeyOrPrefix reports whether s is a full remote key or the
-// leading part of one: 1 to 64 lowercase hex characters. A human snapshot
-// ID is never all hex, so this shape test is enough to tell the two apart.
-func isRemoteKeyOrPrefix(s string) bool {
-	if s == "" || len(s) > remoteKeyHexLen {
-		return false
-	}
-
-	for _, r := range s {
-		if (r < '0' || r > '9') && (r < 'a' || r > 'f') {
-			return false
-		}
-	}
-
-	return true
-}

internal/vaultik/verify.go

@@ -138,15 +138,8 @@ func (v *Vaultik) RunDeepVerify(snapshotID string, opts *VerifyOptions) error {
 func (v *Vaultik) loadVerificationData(
 	snapshotID string, opts *VerifyOptions, result *VerifyResult,
 ) (*snapshot.Manifest, *tempDB, []snapshot.BlobInfo, error) {
-	// Resolve the identifier to the snapshot's remote key. A human ID is
+	// All remote paths use the hashed key derived from the human ID.
-	// hashed; a remote key (or its abbreviation, as printed for a
+	remoteKey := snapshot.RemoteSnapshotKey(snapshotID)
-	// remote-only snapshot) is used as-is, so a host with no local index
-	// can verify a snapshot it can only see on the store.
-	remoteKey, err := v.resolveSnapshotRemoteKey(snapshotID)
-	if err != nil {
-		return nil, nil, nil, v.deepVerifyFailure(result, opts,
-			fmt.Sprintf("resolving snapshot identifier: %v", err), err)
-	}
 
 	// Download manifest. downloadManifestByKey is the single reader for
 	// remote manifests; see its doc comment.
@@ -193,7 +186,7 @@ func (v *Vaultik) loadVerificationData(
 			fmt.Errorf("failed to decrypt database: %w", err))
 	}
 
-	dbBlobs, err := v.getBlobsFromDatabase(tdb.DB)
+	dbBlobs, err := v.getBlobsFromDatabase(snapshotID, tdb.DB)
 	if err != nil {
 		_ = tdb.Close()
 
@@ -508,21 +501,19 @@ func (v *Vaultik) verifyBlobFinalIntegrity(
 	return nil
 }
 
-// getBlobsFromDatabase gets all blobs for the snapshot from the database.
+// getBlobsFromDatabase gets all blobs for the snapshot from the database
-//
+func (v *Vaultik) getBlobsFromDatabase(
-// The exported per-snapshot database holds exactly one snapshot's data
+	snapshotID string, db *sql.DB,
-// (see cleanSnapshotDB), so every row in snapshot_blobs belongs to it.
+) ([]snapshot.BlobInfo, error) {
-// We select them directly rather than filtering by the human snapshot ID,
-// which a host restoring from the store alone does not have.
-func (v *Vaultik) getBlobsFromDatabase(db *sql.DB) ([]snapshot.BlobInfo, error) {
 	query := `
 		SELECT b.blob_hash, b.compressed_size
 		FROM snapshot_blobs sb
 		JOIN blobs b ON sb.blob_hash = b.blob_hash
+		WHERE sb.snapshot_id = ?
 		ORDER BY b.blob_hash
 	`
 
-	rows, err := db.QueryContext(v.ctx, query)
+	rows, err := db.QueryContext(v.ctx, query, snapshotID)
 	if err != nil {
 		return nil, fmt.Errorf("failed to query snapshot blobs: %w", err)
 	}

script/cibuild

@@ -56,23 +56,8 @@ main() {
     docker build --output=type=cacheonly \
         --build-arg CHECK_EPOCH="$epoch" -f Dockerfile.lint .
 
-    # Version, commit and build date are computed here on the host, the
-    # same way script/docker does, and passed into the product build so
-    # the CI-built image reports its real source. The build context
-    # excludes .git (see .dockerignore), so the build cannot derive them
-    # itself; without these it would stamp the Dockerfile's dev/unknown
-    # fallbacks. VERSION comes from script/version, the source of truth
-    # shared with the Makefile.
-    version="$("$ROOT/script/version")"
-    commit="$(git rev-parse HEAD 2>/dev/null || echo unknown)"
-    commit_date="$(git show -s --format=%cs HEAD 2>/dev/null || echo unknown)"
-
     epoch="$(date +%s%N)$$"
-    docker build --build-arg CHECK_EPOCH="$epoch" \
+    docker build --build-arg CHECK_EPOCH="$epoch" .
-        --build-arg VERSION="$version" \
-        --build-arg COMMIT="$commit" \
-        --build-arg COMMIT_DATE="$commit_date" \
-        .
 }
 
 main "$@"

script/docker

@@ -24,24 +24,7 @@ main() {
     # whether the tree is clean. The Dockerfile now refuses to build
     # without a non-empty value, so this is required, not optional.
     epoch="$(date +%s%N)$$"
-
-    # Version, commit and build date are computed here on the host,
-    # where .git exists, and passed into the build. The build context
-    # excludes .git (see .dockerignore), so the container cannot derive
-    # them itself -- it used to try and always got "unknown", giving
-    # every image a "commit: unknown" it could not be traced from.
-    # VERSION comes from script/version, the source of truth shared with
-    # the Makefile, so a Docker build reports the same string (tag,
-    # dev-<sha>, or a -dirty variant) that a local build of the same
-    # tree would.
-    version="$("$SCRIPT_DIR/version")"
-    commit="$(git rev-parse HEAD 2>/dev/null || echo unknown)"
-    commit_date="$(git show -s --format=%cs HEAD 2>/dev/null || echo unknown)"
-
     docker build --build-arg CHECK_EPOCH="$epoch" \
-        --build-arg VERSION="$version" \
-        --build-arg COMMIT="$commit" \
-        --build-arg COMMIT_DATE="$commit_date" \
         -t "$("$SCRIPT_DIR/projectname")" .
 }