Reject a metadata database truncated to the age header and nonce (closes #152)

An object holding just the age header and its 16-byte nonce decrypts
without error: the truncated read surfaces as io.ErrUnexpectedEOF at the
age layer, which the zstd decoder maps to a clean EOF at frame start.
blobgen then reported zero bytes and no error, so a truncated stream was
indistinguishable from a valid empty one, and the metadata database
export slipped through — restore built a fresh schema on the empty file
and reported success.

blobgen.Reader.Read now, on EOF, reads once more from the age reader and
surfaces io.ErrUnexpectedEOF unless that read is (0, io.EOF), the state a
genuine end leaves. downloadSnapshotDB additionally rejects a zero-length
decrypted database before any schema is built.

Model: opus-4-8

ARCHITECTURE.md

@@ -74,16 +74,16 @@ Maps files to their constituent chunks:
 #### Blob (`database.Blob`)
 The final storage unit uploaded to S3. Contains many compressed and encrypted chunks:
 - `ID`: UUID assigned at creation
-- `Hash`: `hex(SHA256(SHA256(uncompressed blob contents)))`, computed before compression and encryption (see [docs/REPOSTRUCTURE.md](docs/REPOSTRUCTURE.md#blobs-directory-blobs))
+- `Hash`: SHA256 of final compressed+encrypted content
 - `UncompressedSize`: Total raw chunk data before compression
 - `CompressedSize`: Size after zstd compression and age encryption
 - `CreatedTS`, `FinishedTS`, `UploadedTS`: Lifecycle timestamps
 
 Blob creation process:
 1. Chunks are accumulated (up to MaxBlobSize, typically 10GB)
-2. As each chunk is added, its uncompressed bytes are fed to a running SHA-256
-3. Concurrently, the same bytes are compressed with zstd, then encrypted with age (recipients configured in config), and streamed to storage
-4. On finalize, the blob's name is the double SHA-256 of the uncompressed contents — `hex(SHA256(SHA256(...)))` — not a hash of the compressed, encrypted bytes
+2. Compressed with zstd
+3. Encrypted with age (recipients configured in config)
+4. SHA256 hash computed → becomes filename in S3
 5. Uploaded to `blobs/{hash[0:2]}/{hash[2:4]}/{hash}`
 
 #### BlobChunk (`database.BlobChunk`)
@@ -284,10 +284,8 @@ Manages snapshot lifecycle and metadata export.
 
 Key methods:
 - `CreateSnapshot(ctx, hostname, version, commit)` → Create snapshot record
-- `PopulateSnapshotBlobs(ctx, snapshotID)` → Record every blob the snapshot references
+- `CompleteSnapshot(ctx, snapshotID)` → Mark snapshot complete
 - `ExportSnapshotMetadata(ctx, dbPath, snapshotID)` → Export to S3
-- `MarkSnapshotComplete(ctx, snapshotID)` → Record completion, only after a successful export
-- `CompleteSnapshot(ctx, snapshotID)` → Convenience: populate blobs, then mark complete (no export between)
 
 ### `internal/database`
 SQLite database for local index. Single-writer mode for thread safety.
@@ -337,18 +335,16 @@ CreateSnapshot(opts)
     │
     ├─► SnapshotManager.UpdateSnapshotStatsExtended()
     │
-    ├─► SnapshotManager.PopulateSnapshotBlobs()   // record referenced blobs
+    ├─► SnapshotManager.CompleteSnapshot()
     │
-    ├─► SnapshotManager.ExportSnapshotMetadata()
-    │       │
-    │       ├─► Copy database to temp file
-    │       ├─► Clean to only current snapshot data (VACUUM)
-    │       ├─► Compress binary SQLite with zstd
-    │       ├─► Encrypt with age
-    │       ├─► Upload db.zst.age to storage
-    │       └─► Upload manifest.json.zst to storage
-    │
-    └─► SnapshotManager.MarkSnapshotComplete()   // only after the export succeeds
+    └─► SnapshotManager.ExportSnapshotMetadata()
+            │
+            ├─► Copy database to temp file
+            ├─► Clean to only current snapshot data (VACUUM)
+            ├─► Compress binary SQLite with zstd
+            ├─► Encrypt with age
+            ├─► Upload db.zst.age to storage
+            └─► Upload manifest.json.zst to storage
 ```
 
 ## Deduplication Strategy

README.md

@@ -38,7 +38,7 @@ vaultik snapshot list
 
 Features:
 
-* modern encryption ([age](https://age-encryption.org/), X25519 + ChaCha20-Poly1305)
+* modern encryption ([age](https://age-encryption.org/), X25519 + XChaCha20-Poly1305)
 * content-defined chunking with deduplication (FastCDC)
 * incremental backups (only changed files are re-chunked)
 * multithreaded zstd compression at configurable levels
@@ -79,13 +79,11 @@ vaultik snapshot verify <snapshot-id>
 # with one or more identities, is accepted
 export VAULTIK_AGE_SECRET_KEY="$(cat vaultik_backup_private_key.txt)"
 
-# deep verify (downloads every blob, decrypts it, and re-hashes it to
-# detect corruption — this checks integrity, not who wrote the blob)
+# deep verify (downloads and cryptographically verifies every blob)
 vaultik snapshot verify --deep <snapshot-id>
 
-# restore (requires the private key). Restore into a new directory you own,
-# writable only by you — not a shared location like /tmp
-vaultik snapshot restore <snapshot-id> ~/vaultik-restore
+# restore (requires the private key)
+vaultik snapshot restore <snapshot-id> /tmp/restored
 
 # daily cron job: back up, keep a 4-week rolling window of snapshots
 # 0 3 * * * vaultik snapshot create --cron --prune --keep-newer-than 4w
@@ -130,13 +128,12 @@ full `remote_key` from `snapshot list --json` — to restore and verify:
 # keeps the key out of your shell history)
 export VAULTIK_AGE_SECRET_KEY="$(cat vaultik_backup_private_key.txt)"
 
-# restore everything to a new directory you own (writable only by you, not a
-# shared location like /tmp), then check every restored file's chunk hashes
-vaultik snapshot restore --verify <remote-key> ~/vaultik-restore
+# restore everything to /tmp/restored, then check every restored file's
+# chunk hashes
+vaultik snapshot restore --verify <remote-key> /tmp/restored
 
-# optionally, deep-verify the snapshot against the store (downloads every
-# blob, decrypts it, and re-hashes it to detect corruption — this checks
-# integrity, not who wrote the blob)
+# optionally, deep-verify the snapshot against the store (downloads and
+# cryptographically checks every blob)
 vaultik snapshot verify --deep <remote-key>
 ```
 
@@ -452,19 +449,14 @@ Snapshot IDs follow the human-readable format
 `<hostname>_<snapshot-name>_<RFC3339-timestamp>` (e.g.
 `server1_home_2025-06-01T12:00:00Z`), but this ID is never written to the
 destination store in plaintext. Each snapshot's metadata directory is named
-with its `<remote-key>`, a one-way double SHA-256 hash of the ID, so a plain
-listing of the store shows no hostname or snapshot name. The hash uses no
-secret, though, so an observer who guesses a candidate hostname and snapshot
-name can hash it and confirm the snapshot is present; the remote key keeps
-names out of a listing but does not hide them from a guess. The backup time is
-not hidden either: manifest.json.zst carries a plaintext timestamp, and object
+with its `<remote-key>`, a one-way double SHA-256 hash of the ID, so a listing
+of the store reveals no hostname or snapshot name. The backup time is not
+hidden: manifest.json.zst carries a plaintext timestamp, and object
 modification times are visible at the storage layer regardless. For example,
 `server1_home_2025-06-01T12:00:00Z` is stored under
 `metadata/17f97bcde958748af076b926af59823943db59e80ce7170b40f124dfa28f64aa/`.
 See [docs/REPOSTRUCTURE.md](docs/REPOSTRUCTURE.md#remote-key-derivation) for the
-derivation, and [Security Considerations](docs/REPOSTRUCTURE.md#security-considerations)
-(including [Accepted Risks](docs/REPOSTRUCTURE.md#accepted-risks)) for what the
-format does and does not protect.
+derivation.
 
 ### data flow
 
@@ -505,7 +497,7 @@ format does and does not protect.
 
 ### encryption
 
-* Asymmetric encryption using age (X25519 + ChaCha20-Poly1305)
+* Asymmetric encryption using age (X25519 + XChaCha20-Poly1305)
 * Only the public key is needed on the source host
 * Each blob and each metadata database is encrypted independently
 * Multiple recipients supported (encrypt to multiple keys)
@@ -645,26 +637,17 @@ priority.
 
 ## output style
 
-Every command's user-facing output is governed by `internal/ui`, in one
-of two ways. Color is enabled when stdout is a TTY and the `NO_COLOR`
-environment variable is unset (https://no-color.org/).
-
-* **Status, progress, warnings, and errors** go through the `internal/ui`
-  message methods below: marker-prefixed, colored on a TTY, and — except
-  warnings and errors — silenced by `--quiet`. This is the operational
-  narration of the long-running commands (`snapshot create`, `prune`,
-  `snapshot restore`, and the like) and the confirmations of
-  `config init`, `config set`, and `database delete`.
-* **The data a command exists to produce** is written plain, with no
-  marker and no color, because a marker would corrupt a table or a
-  parsed document. This covers the `version`, `info`, and `remote info`
-  reports, the `snapshot list` table, `config get` values, and every
-  `--json` document. `--quiet` silences the human reports and tables
-  (`version`, `info`, `remote info`, `snapshot list`) but never the
-  machine-consumed `config get` value or the `--json` documents, which a
-  script depends on. The `database delete` confirmation prompt is also
-  written this way and always shown: it is an interactive exchange the
-  operator must see.
+The operational narration of the long-running commands — the Begin,
+Complete, Progress, and status lines of `snapshot create`, `prune`,
+`snapshot restore`, and the like — goes through helpers in `internal/ui`
+and conforms to the uniform style below. Some commands instead write
+plain text straight to stdout (`version`, `info`, `config`, the
+`database delete` prompt, and the `snapshot list` table); that output is
+unstyled and does not honor `--quiet`. Routing it through `internal/ui`
+is tracked in
+[issue #149](https://git.eeqj.de/sneak/vaultik/issues/149). Color is
+enabled when stdout is a TTY and the `NO_COLOR` environment variable is
+unset (https://no-color.org/).
 
 `internal/ui` writes to stdout; it is the output the user asked for.
 Structured log records are a different thing and go through

TODO.md

@@ -25,21 +25,6 @@ release" is exactly the contradiction
 
 # Completed Steps
 
-- 2026-09-22: Routed the last direct-to-stdout command output through
-  `internal/ui`
-  ([issue #149](https://git.eeqj.de/sneak/vaultik/issues/149)). The
-  `version`, `info`, `remote info`, `config`, and `database delete`
-  commands wrote plain text straight to stdout, so they were unstyled and
-  ignored `--quiet`. Output now falls in two buckets, both governed by
-  `internal/ui`: status lines and confirmations go through its message
-  methods (styled, and `--quiet` silences them), while the data a command
-  exists to produce — the reports, the `snapshot list` table, `config get`
-  values, and the `--json` documents — is written plain. `--quiet`
-  silences the human reports and tables but never the `config get` value
-  or the `--json` documents, which a script depends on, and the
-  `database delete` confirmation prompt is always shown. The README
-  output-style section now states this rule.
-
 - 2026-09-22: Validated blob hashes, offsets and lengths read back from
   the destination before using them
   ([issue #155](https://git.eeqj.de/sneak/vaultik/issues/155)). A blob

config.example.yml

@@ -306,9 +306,6 @@ storage_url: "rclone://myremote/path/to/backups"
 # Multiple chunks are packed into blobs up to this size
 # Must be at least four times chunk_size (the largest chunk the chunker can
 # emit); a smaller limit would let a single-chunk blob exceed it.
-# Chunking uses no secret (the FastCDC parameters are fixed and public). At a
-# large limit a blob holds hundreds of chunks, so individual chunk lengths are
-# not visible in its size; lowering the limit toward chunk_size exposes them.
 # Supports: 1GB, 10G, 500MB, 1GiB, etc.
 # Default: 10GB
 #blob_size_limit: 10GB

docs/DATAMODEL.md

@@ -90,7 +90,7 @@ Stores information about packed, compressed, and encrypted blob files.
 
 **Columns:**
 - `id` (TEXT PRIMARY KEY) - UUID assigned when blob creation starts
-- `blob_hash` (TEXT UNIQUE) - `hex(SHA256(SHA256(uncompressed blob contents)))`, computed before compression and encryption (NULL until finalized); see [REPOSTRUCTURE.md](REPOSTRUCTURE.md#blobs-directory-blobs)
+- `blob_hash` (TEXT UNIQUE) - SHA256 hash of final blob (NULL until finalized)
 - `created_ts` (INTEGER NOT NULL) - Creation timestamp
 - `finished_ts` (INTEGER) - Finalization timestamp (NULL if in progress)
 - `uncompressed_size` (INTEGER NOT NULL DEFAULT 0) - Total size of chunks before compression
@@ -216,7 +216,7 @@ After a snapshot is completed:
 5. Upload to S3 as `metadata/{remote-key}/db.zst.age`
 6. Generate blob manifest and upload as `metadata/{remote-key}/manifest.json.zst`
 
-The `{remote-key}` directory name is a one-way hash of the human snapshot ID, so the ID is never written to the store in plaintext. The hash uses no secret, so a guessed hostname and snapshot name can still be confirmed against a listing; see [REPOSTRUCTURE.md](REPOSTRUCTURE.md#remote-key-derivation) and its [Accepted Risks](REPOSTRUCTURE.md#accepted-risks).
+The `{remote-key}` directory name is a one-way hash of the human snapshot ID, so the ID is never written to the store in plaintext; see [REPOSTRUCTURE.md](REPOSTRUCTURE.md#remote-key-derivation).
 
 ### 4. Restore Process
 

docs/REPOSTRUCTURE.md

@@ -35,7 +35,7 @@ The metadata subdirectory is named with the **remote key**, a one-way hash of th
 - **What it contains**: Packed collections of content-defined chunks from files
 - **Format**: Zstandard compressed, then Age encrypted
 - **Encryption**: Always encrypted with Age using the configured recipients
-- **Naming**: Content-addressed. The blob's name is `hex(SHA256(SHA256(uncompressed blob contents)))` — the double SHA-256 of the concatenated chunk data, computed before compression and encryption, not a hash of the stored (compressed, encrypted) bytes. One consequence: only a holder of the age private key can check a stored blob's integrity, because matching a blob to its name means decrypting and decompressing it first — which is what `restore` and `verify --deep` do. Implemented in `internal/blobgen` (`DoubleSHA256`). This is the canonical description of blob naming; other documents and comments point here.
+- **Naming**: Content-addressed using SHA256 hash of the encrypted blob
 
 ### Why Encrypted
 Blobs contain the actual file data from backups and must be encrypted for security. The content-addressing ensures deduplication while the encryption ensures privacy.
@@ -59,14 +59,14 @@ This ID reveals the hostname, the configured snapshot name, and the backup time,
 
 ### Remote Key Derivation
 
-The remote key is `hex(SHA256(SHA256("vaultik|" + snapshot-id)))`: a double SHA-256 over the snapshot ID, with a `vaultik|` domain-separation prefix. The result is a 64-character hex string. The hash is not reversible, but it uses no secret: an observer who guesses a candidate hostname and snapshot name can hash it the same way and confirm whether that snapshot is present. The remote key keeps names out of a plain listing; it does not hide them from a guess. Implemented in `internal/snapshot/remotekey.go`.
+The remote key is `hex(SHA256(SHA256("vaultik|" + snapshot-id)))`: a double SHA-256 over the snapshot ID, with a `vaultik|` domain-separation prefix. The result is a 64-character hex string with no structure a remote observer can reverse. Implemented in `internal/snapshot/remotekey.go`.
 
 Worked example:
 - Snapshot ID: `server1_home_2025-06-01T12:00:00Z`
 - Remote key: `17f97bcde958748af076b926af59823943db59e80ce7170b40f124dfa28f64aa`
 - Directory: `metadata/17f97bcde958748af076b926af59823943db59e80ce7170b40f124dfa28f64aa/`
 
-A plain listing of the destination store therefore shows only these hashes, not the hostname or snapshot name of any backup — but because the hash uses no secret, a guessed hostname and snapshot name can be hashed and confirmed against the listing. The same remote key is stored in the manifest's `snapshot_id` field.
+Because the hash is one-way, a listing of the destination store reveals neither the hostname nor the snapshot name of any backup. The same remote key is stored in the manifest's `snapshot_id` field.
 
 ### Files in Each Snapshot Directory
 
@@ -124,36 +124,23 @@ From the unencrypted data, an observer of the destination store can determine:
 - **When each backup was taken** — not from the directory name, which is a one-way hash, but from the plaintext `timestamp` field in manifest.json.zst, which is published in the clear
 - How many blobs each snapshot references, and the total compressed size
 - The compressed size of each blob, and which blobs are shared between snapshots (deduplication patterns)
-- **Whether a guessed hostname and snapshot name are present** — the remote key is an unkeyed hash, so an observer holding candidate names can hash each one and match it against the directory listing. The human ID is never published, so it cannot be read off directly, but it can be confirmed by guessing.
 
 Together these give an observer a timing-and-size profile of every snapshot. This is an accepted, documented property of the format, not a defect: the manifest is unencrypted so that pruning can run without the private key, and the timing channel could not be closed by encrypting it anyway — object creation times and per-object sizes stay visible at the storage layer on both `s3://` and `file://` destinations regardless.
 
 An observer cannot determine:
-- The hostname or snapshot name of any backup by reading it off the store — the directory name and the manifest `snapshot_id` are unkeyed hashes of the human ID, so the text is never published (though a guessed name can be confirmed, as above)
+- The hostname or snapshot name of any backup (the directory name and the manifest `snapshot_id` are one-way hashes of the human ID)
 - File names or paths
 - File contents
 - File permissions or ownership
 - Directory structure
 - Which chunks belong to which files
 
-### Accepted Risks
-
-These are known, deliberate properties of the format and the tooling, recorded so an operator can weigh them rather than discover them.
-
-1. **No proof of authorship.** Restore and `verify --deep` prove that data decrypts with the age private key and matches its unkeyed content hashes. They do not prove who wrote it: anyone who knows a recipient public key and can replace objects on the destination can substitute a snapshot they built. The recipient string is not stored at the destination, but a compromised backed-up host has it. Defences live on the destination side — bucket versioning or object lock, credentials for the source host that cannot delete or overwrite existing versions, and pruning from a trusted host. Note that S3 `PutObject` overwrites an existing key, so PUT permission alone is not append-only.
-2. **Compression reveals sizes.** Blobs and `db.zst.age` are zstd-compressed then age-encrypted; the manifest is compressed only. age does not pad, so an object's size is the exact compressed length of its contents. All new chunks packed into one blob share a single zstd stream (8 MiB window, 4 MiB at compression levels 1-2), and a blob is closed at `blob_size_limit` and at the end of each configured path. Because a stored chunk is never packed again, someone who can write into a backed-up file and watch blob sizes learns something only when their controlled data and a secret land in the same chunk of a file that keeps changing. Advice: back up any outsider-writable directory as its own snapshot.
-3. **Chunking uses no secret.** The FastCDC parameters are fixed and public. The default 10 MB average yields chunks between 2.5 MB and 40 MB, and any file of 2.5 MB or less is a single chunk. At the default 10 GB `blob_size_limit` a blob holds hundreds of chunks, so individual chunk lengths are not visible in the blob's size; lowering the limit toward the chunk size begins to expose them.
-4. **Decrypted data on local disk.** Several commands stage plaintext under `$TMPDIR`: `snapshot restore` writes decrypted blobs under `vaultik-blobcache-*/` (no size cap) and the decrypted metadata database at `vaultik-restore-*/snapshot.db`; `verify --deep` writes that database at `vaultik-verify-*/snapshot.db`; `snapshot create` keeps a plaintext copy of the index at `vaultik-snapshot-*/snapshot.db`. These files are created `0600` and removed on success, but a `kill -9` or a power loss leaves them behind — delete any leftover `vaultik-*` directory under `$TMPDIR` by hand. `$TMPDIR` should be trusted to the same degree as the restore target.
-5. **Store permissions differ per command.** The backed-up host needs only PUT to run `snapshot create`: it writes blobs and metadata and neither reads nor deletes them. Other commands need more — `snapshot verify`, `snapshot restore`, and `prune` list and read; `prune`, `snapshot purge`, `snapshot remove`, and `remote nuke` also delete. The recommended cron line uses `--prune`, which runs `prune` on the backed-up host, so granting that host `--prune` gives it credentials that can delete its own backups. To keep the source host to PUT only, prune from a separate trusted host instead.
-6. **Changing recipients does not re-encrypt existing data.** Deduplicated chunks and same-named blobs already on the destination stay encrypted to the recipients in force when they were written. A new snapshot that reuses them cannot be restored with a newly added recipient's key alone, because those reused objects were never encrypted to it. To make everything readable by a new key, run `vaultik database delete` and take a full backup to a fresh destination or prefix.
-7. **X25519 recipients only.** vaultik rejects age ssh and plugin recipients. Long-lived ciphertext held by a third party (the destination operator) has no fallback if X25519 is ever broken: there is no second recipient type and no post-quantum option.
-
 ## Consistency Guarantees
 
 1. **Blobs are immutable** - Once written, a blob is never modified
 2. **Blobs are written before metadata** - A snapshot's metadata is only written after all its blobs are successfully uploaded
 3. **Metadata is written atomically** - Both db.zst.age and manifest.json.zst are written as complete files
-4. **A snapshot is marked complete in the local DB only after its metadata is uploaded** - `finalizeSnapshotMetadata` runs `ExportSnapshotMetadata` first and records completion (`MarkSnapshotComplete`) only once the export succeeds (see the backup data flow in [ARCHITECTURE.md](../ARCHITECTURE.md)). A crash during the export therefore leaves the snapshot incomplete, so the next backup's `PruneDatabase` drops it and re-backs-up its data, rather than leaving a completed-looking row in the local index with no matching metadata on the destination store. (A crash in the brief moment after the export succeeds but before completion is recorded leaves a fully-restorable snapshot on the destination that the local index drops as incomplete on the next run; `snapshot list` then reports it honestly as remote-only, which is the safe direction: the destination copy stays restorable.)
+4. **Snapshots are marked complete in local DB only after metadata upload** - Ensures consistency between local and remote state
 
 ## Pruning Safety
 

internal/blob/packer.go

@@ -1,16 +1,14 @@
 // Package blob handles the creation of blobs - the final storage units for Vaultik.
 // A blob is a large file (up to 10GB) containing many compressed and encrypted chunks
-// from multiple source files. Blobs are content-addressed: a blob's filename is
-// hex(SHA256(SHA256(uncompressed blob contents))), computed from the concatenated
-// chunk data before compression and encryption, not from the stored bytes. See
-// blobgen.DoubleSHA256 and docs/REPOSTRUCTURE.md.
+// from multiple source files. Blobs are content-addressed, meaning their filename
+// is derived from the SHA256 hash of their compressed and encrypted content.
 //
 // The blob creation process:
-//  1. Chunks are accumulated from multiple files
-//  2. Each chunk's uncompressed bytes are fed to a running SHA-256 and, in the same
-//     pass, compressed with zstd and encrypted with age into the temp file
-//  3. On finalize, the name is the double SHA-256 of that uncompressed content
-//  4. The blob is uploaded to S3 using the name as the filename
+// 1. Chunks are accumulated from multiple files
+// 2. The collection is compressed using zstd
+// 3. The compressed data is encrypted using age
+// 4. The encrypted blob is hashed to create its content-addressed name
+// 5. The blob is uploaded to S3 using the hash as the filename
 //
 // This design optimizes storage efficiency by batching many small chunks into
 // larger blobs, reducing the number of S3 operations and associated costs.

internal/blobgen/writer.go

@@ -16,17 +16,11 @@ import (
 )
 
 // DoubleSHA256 returns the double SHA-256 of content whose single SHA-256
-// digest is sum: it hashes that digest once more. Stored objects — a blob, and
-// the metadata database export — are named by this second hash.
-//
-// The second hash does not hide whether known content is stored: an attacker
-// who can reproduce an object's entire plaintext computes the same name simply
-// by hashing twice, exactly as this code does. What limits that is blob
-// packing, not the double hash — a blob's name covers all of its concatenated
-// chunk plaintext, so a name can be confirmed only by someone who can
-// reproduce the whole blob (a snapshot made entirely of known content, or a
-// known file large enough to fill blobs on its own). An ordinary file that
-// shares a blob with other, unknown data cannot be confirmed this way.
+// digest is sum: it hashes that digest once more. Stored objects are named by
+// this second hash so that a name never reveals whether known content is
+// present — an attacker who knows a plaintext, and thus its SHA-256, still
+// cannot derive the stored name without hashing the digest again. Both a blob
+// and the metadata database export are named this way.
 func DoubleSHA256(sum []byte) []byte {
 	h := sha256.Sum256(sum)
 
@@ -153,8 +147,8 @@ func (w *Writer) Close() error {
 
 // ContentID returns the double SHA-256 of the uncompressed input data: the
 // name under which this content is stored. It is the second hash of the
-// running SHA-256, via DoubleSHA256; see that function for what naming content
-// this way does and does not hide.
+// running SHA-256, via DoubleSHA256; see that function for why content is
+// named this way rather than by its plain SHA-256.
 func (w *Writer) ContentID() []byte {
 	return DoubleSHA256(w.hasher.Sum(nil))
 }

internal/cli/config.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"errors"
 	"fmt"
+	"io"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -12,7 +13,6 @@ import (
 
 	"github.com/spf13/cobra"
 	"gopkg.in/yaml.v3"
-	"sneak.berlin/go/vaultik/internal/ui"
 )
 
 // configFileMode is the permission set for freshly written config files;
@@ -46,11 +46,8 @@ const defaultConfigTemplate = `# vaultik configuration
 # ─── REQUIRED ────────────────────────────────────────────────────────────────
 
 # Age recipient public keys for encryption.
-# Backups are encrypted to ALL listed recipients; any one of the corresponding
-# private keys can decrypt. Adding a recipient later does not re-encrypt data
-# already stored: deduplicated chunks and existing blobs stay encrypted to the
-# earlier recipients, so a newly added key cannot restore them on its own (see
-# docs/REPOSTRUCTURE.md, Accepted Risks). Generate a keypair with:
+# Backups are encrypted to ALL listed recipients. Any one of the corresponding
+# private keys can decrypt. Generate a keypair with:
 #   age-keygen -o vaultik_backup_private_key.txt
 #   grep 'public key' vaultik_backup_private_key.txt
 age_recipients:
@@ -265,7 +262,7 @@ The config is written to the path from --config, $VAULTIK_CONFIG, or
 the platform default config directory (e.g. ~/Library/Application Support/
 on macOS, ~/.config/ on Linux, /etc/vaultik/ as root).`,
 		Args: cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, _ []string) error {
+		RunE: func(_ *cobra.Command, _ []string) error {
 			path := configPathForInit()
 
 			_, err := os.Stat(path)
@@ -285,11 +282,8 @@ on macOS, ~/.config/ on Linux, /etc/vaultik/ as root).`,
 				return fmt.Errorf("writing config file: %w", err)
 			}
 
-			// A written-confirmation, not scriptable output: route it
-			// through the UI so it is styled and --quiet silences it.
-			out := commandUI(cmd)
-			out.Infof("Config written to %s.", path)
-			out.Infof(
+			_, _ = fmt.Fprintf(os.Stdout, "Config written to %s\n", path)
+			_, _ = fmt.Fprintln(os.Stdout,
 				"Edit it to set your age_recipients, snapshots, and storage_url.")
 
 			return nil
@@ -331,7 +325,7 @@ func newConfigGetCommand() *cobra.Command {
 		Use:   "get <key>",
 		Short: "Print a config value by dotted path (e.g. storage_url, compression_level)",
 		Args:  cobra.ExactArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			path, err := ResolveConfigPath()
 			if err != nil {
 				return err
@@ -347,13 +341,8 @@ func newConfigGetCommand() *cobra.Command {
 				return err
 			}
 
-			// The value is scriptable output: it must stay machine-plain
-			// (no marker, no color) and is never silenced by --quiet, so it
-			// is written straight to stdout rather than through the UI.
-			w := cmd.OutOrStdout()
-
 			if node.Kind == yaml.ScalarNode {
-				_, _ = fmt.Fprintln(w, node.Value)
+				_, _ = fmt.Fprintln(os.Stdout, node.Value)
 
 				return nil
 			}
@@ -363,7 +352,7 @@ func newConfigGetCommand() *cobra.Command {
 				return fmt.Errorf("marshaling value: %w", err)
 			}
 
-			_, _ = fmt.Fprint(w, string(out))
+			_, _ = fmt.Fprint(os.Stdout, string(out))
 
 			return nil
 		},
@@ -385,23 +374,23 @@ Examples:
   vaultik config set compression_level 9
   vaultik config set s3.bucket mybucket  # legacy S3 fields still supported`,
 		Args: cobra.ExactArgs(configSetArgs),
-		RunE: func(cmd *cobra.Command, args []string) error {
+		RunE: func(_ *cobra.Command, args []string) error {
 			path, err := ResolveConfigPath()
 			if err != nil {
 				return err
 			}
 
-			return writeConfigSet(commandUI(cmd), path, args[0], args[1])
+			return writeConfigSet(os.Stdout, path, args[0], args[1])
 		},
 	}
 }
 
 // writeConfigSet applies key=value to the config at path, writes it back
-// owner-only, and confirms the write by naming just the key through the
-// UI writer (styled, and silenced by --quiet). The value is never
-// echoed: it may be a secret such as s3.secret_access_key, and captured
-// stdout or a pasted terminal would then leak it.
-func writeConfigSet(out *ui.Writer, path, key, value string) error {
+// owner-only, and confirms the write by printing just the key name to w.
+// The value is never echoed: it may be a secret such as
+// s3.secret_access_key, and captured stdout or a pasted terminal would
+// then leak it.
+func writeConfigSet(w io.Writer, path, key, value string) error {
 	root, err := loadYAMLFile(path)
 	if err != nil {
 		return err
@@ -412,12 +401,12 @@ func writeConfigSet(out *ui.Writer, path, key, value string) error {
 		return err
 	}
 
-	data, err := marshalConfigYAML(root)
+	out, err := marshalConfigYAML(root)
 	if err != nil {
 		return fmt.Errorf("marshaling config: %w", err)
 	}
 
-	err = os.WriteFile(path, data, configFileMode)
+	err = os.WriteFile(path, out, configFileMode)
 	if err != nil {
 		return fmt.Errorf("writing config file: %w", err)
 	}
@@ -433,7 +422,7 @@ func writeConfigSet(out *ui.Writer, path, key, value string) error {
 		}
 	}
 
-	out.Infof("Set %s.", key)
+	_, _ = fmt.Fprintln(w, key)
 
 	return nil
 }

internal/cli/config_test.go

@@ -9,7 +9,6 @@ import (
 
 	"gopkg.in/yaml.v3"
 	"sneak.berlin/go/vaultik/internal/config"
-	"sneak.berlin/go/vaultik/internal/ui"
 )
 
 // TestDefaultConfigTemplateParses ensures the init template is valid YAML
@@ -247,20 +246,19 @@ func TestWriteConfigSetHidesSecret(t *testing.T) {
 		t.Fatalf("seed config: %v", err)
 	}
 
-	var buf bytes.Buffer
+	var out bytes.Buffer
 
-	err = writeConfigSet(ui.NewWithColor(&buf, false), path,
-		"s3.secret_access_key", secret)
+	err = writeConfigSet(&out, path, "s3.secret_access_key", secret)
 	if err != nil {
 		t.Fatalf("writeConfigSet: %v", err)
 	}
 
-	if strings.Contains(buf.String(), secret) {
-		t.Errorf("output echoed the secret value: %q", buf.String())
+	if strings.Contains(out.String(), secret) {
+		t.Errorf("output echoed the secret value: %q", out.String())
 	}
 
-	if !strings.Contains(buf.String(), "s3.secret_access_key") {
-		t.Errorf("output did not confirm the key name: %q", buf.String())
+	if !strings.Contains(out.String(), "s3.secret_access_key") {
+		t.Errorf("output did not confirm the key name: %q", out.String())
 	}
 }
 
@@ -279,10 +277,9 @@ func TestWriteConfigSetTightensMode(t *testing.T) {
 		t.Fatalf("seed config: %v", err)
 	}
 
-	var buf bytes.Buffer
+	var out bytes.Buffer
 
-	err = writeConfigSet(ui.NewWithColor(&buf, false), path,
-		"compression_level", "9")
+	err = writeConfigSet(&out, path, "compression_level", "9")
 	if err != nil {
 		t.Fatalf("writeConfigSet: %v", err)
 	}

internal/cli/database.go

@@ -48,7 +48,7 @@ storage destination on that run.
 
 Use --force to skip the confirmation prompt.`,
 		Args: cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, _ []string) error {
+		RunE: func(_ *cobra.Command, _ []string) error {
 			// Resolve config path
 			configPath, err := ResolveConfigPath()
 			if err != nil {
@@ -62,31 +62,26 @@ Use --force to skip the confirmation prompt.`,
 			}
 
 			dbPath := cfg.IndexPath
-			out := commandUI(cmd)
 
 			// Check if database exists
 			_, err = os.Stat(dbPath)
 			if os.IsNotExist(err) {
-				out.Infof("Local state database does not exist: %s.", dbPath)
+				_, _ = fmt.Fprintf(os.Stdout, "Database does not exist: %s\n", dbPath)
 
 				return nil
 			}
 
-			// Confirm unless --force. The prompt and its immediate result
-			// are an interactive exchange the operator must see, so they go
-			// straight to stdout rather than through the UI and --quiet does
-			// not silence them.
+			// Confirm unless --force
 			if !force {
-				w := cmd.OutOrStdout()
-				_, _ = fmt.Fprintf(w,
+				_, _ = fmt.Fprintf(os.Stdout,
 					"This will delete the local state database at:\n  %s\n\n", dbPath)
-				_, _ = fmt.Fprint(w, "Are you sure? Type 'yes' to confirm: ")
+				_, _ = fmt.Fprint(os.Stdout, "Are you sure? Type 'yes' to confirm: ")
 
 				var confirm string
 
 				_, err = fmt.Scanln(&confirm)
 				if err != nil || confirm != "yes" {
-					_, _ = fmt.Fprintln(w, "Aborted.")
+					_, _ = fmt.Fprintln(os.Stdout, "Aborted.")
 
 					//nolint:nilerr // a failed/aborted confirmation is a clean abort
 					return nil
@@ -105,7 +100,11 @@ Use --force to skip the confirmation prompt.`,
 			_ = os.Remove(walPath) // Ignore errors - files may not exist
 			_ = os.Remove(shmPath)
 
-			out.Infof("Local state database deleted: %s.", dbPath)
+			rootFlags := GetRootFlags()
+			if !rootFlags.Quiet {
+				_, _ = fmt.Fprintf(os.Stdout, "Database deleted: %s\n", dbPath)
+			}
+
 			log.Info("Local state database deleted", "path", dbPath)
 
 			return nil

internal/cli/quiet_test.go

@@ -1,206 +0,0 @@
-package cli //nolint:testpackage // sets the unexported rootFlags directly
-
-import (
-	"bytes"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/spf13/cobra"
-)
-
-// setRootFlags overrides the global rootFlags for the duration of one
-// test and restores it afterward. These tests must not run in parallel:
-// the flags are process-global, so the whole struct is saved and put
-// back rather than left mutated for the next test.
-func setRootFlags(t *testing.T, f RootFlags) {
-	t.Helper()
-
-	old := rootFlags
-	rootFlags = f
-
-	t.Cleanup(func() { rootFlags = old })
-}
-
-// seedFile writes content to a fresh file and returns its path.
-func seedFile(t *testing.T, dir, name, content string) string {
-	t.Helper()
-
-	path := filepath.Join(dir, name)
-
-	err := os.WriteFile(path, []byte(content), 0o600)
-	if err != nil {
-		t.Fatalf("seeding %s: %v", name, err)
-	}
-
-	return path
-}
-
-// mustExecute runs a command with its output captured and fails the test
-// if it errors, returning what the command printed.
-func mustExecute(t *testing.T, cmd *cobra.Command, args ...string) string {
-	t.Helper()
-
-	var out bytes.Buffer
-
-	cmd.SetOut(&out)
-	cmd.SetArgs(args)
-
-	err := cmd.Execute()
-	if err != nil {
-		t.Fatalf("%s failed: %v", cmd.Name(), err)
-	}
-
-	return out.String()
-}
-
-// TestVersionQuietSuppressesReport checks that --quiet silences the whole
-// version report: it is human-facing output, not a scriptable value.
-//
-//nolint:paralleltest // mutates the process-global rootFlags
-func TestVersionQuietSuppressesReport(t *testing.T) {
-	setRootFlags(t, RootFlags{Quiet: true})
-
-	out := mustExecute(t, NewVersionCommand())
-
-	if out != "" {
-		t.Errorf("--quiet version printed %q, want nothing", out)
-	}
-}
-
-// TestConfigGetIgnoresQuiet checks that a config value is printed even
-// under --quiet: it is scriptable output a caller depends on, so --quiet
-// must not suppress it, and it stays machine-plain (no marker, no color).
-//
-//nolint:paralleltest // mutates the process-global rootFlags
-func TestConfigGetIgnoresQuiet(t *testing.T) {
-	dir := t.TempDir()
-	path := seedFile(t, dir, "config.yml", "storage_url: file:///mnt/x\n")
-
-	setRootFlags(t, RootFlags{Quiet: true, ConfigPath: path})
-
-	out := mustExecute(t, newConfigGetCommand(), "storage_url")
-
-	if out != "file:///mnt/x\n" {
-		t.Errorf("config get --quiet = %q, want the plain value", out)
-	}
-}
-
-// TestConfigSetQuietSuppressesConfirmation checks that --quiet silences
-// the confirmation line while still writing the value to the file.
-//
-//nolint:paralleltest // mutates the process-global rootFlags
-func TestConfigSetQuietSuppressesConfirmation(t *testing.T) {
-	dir := t.TempDir()
-	path := seedFile(t, dir, "config.yml", "compression_level: 3\n")
-
-	setRootFlags(t, RootFlags{Quiet: true, ConfigPath: path})
-
-	out := mustExecute(t, newConfigSetCommand(), "compression_level", "9")
-
-	if out != "" {
-		t.Errorf("--quiet config set printed %q, want nothing", out)
-	}
-
-	data, err := os.ReadFile(path) //nolint:gosec // G304: test-controlled path
-	if err != nil {
-		t.Fatalf("reading config back: %v", err)
-	}
-
-	if !strings.Contains(string(data), "compression_level: 9") {
-		t.Errorf("config set did not write the value under --quiet:\n%s", data)
-	}
-}
-
-// TestConfigSetConfirmsWhenNotQuiet checks that the confirmation names
-// the key (styled) when --quiet is not set.
-//
-//nolint:paralleltest // mutates the process-global rootFlags
-func TestConfigSetConfirmsWhenNotQuiet(t *testing.T) {
-	dir := t.TempDir()
-	path := seedFile(t, dir, "config.yml", "compression_level: 3\n")
-
-	setRootFlags(t, RootFlags{ConfigPath: path})
-
-	out := mustExecute(t, newConfigSetCommand(), "compression_level", "9")
-
-	if !strings.Contains(out, "compression_level") {
-		t.Errorf("config set did not confirm the key: %q", out)
-	}
-}
-
-// TestConfigInitQuietSuppressesConfirmation checks that --quiet silences
-// the "config written" confirmation while still writing the file.
-//
-//nolint:paralleltest // mutates the process-global rootFlags
-func TestConfigInitQuietSuppressesConfirmation(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "new-config.yml")
-
-	setRootFlags(t, RootFlags{Quiet: true, ConfigPath: path})
-
-	out := mustExecute(t, newConfigInitCommand())
-
-	if out != "" {
-		t.Errorf("--quiet config init printed %q, want nothing", out)
-	}
-
-	_, err := os.Stat(path)
-	if err != nil {
-		t.Errorf("config init did not write the file under --quiet: %v", err)
-	}
-}
-
-// seedDatabaseDeleteConfig writes a valid config whose index_path is a
-// seeded database file, and returns both paths.
-func seedDatabaseDeleteConfig(t *testing.T, dir string) (string, string) {
-	t.Helper()
-
-	dbPath := seedFile(t, dir, "index.sqlite", "not-a-real-db")
-	cfg := fmt.Sprintf(hermeticConfig,
-		filepath.Join(dir, "source"), filepath.Join(dir, "store"), dbPath)
-	cfgPath := seedFile(t, dir, "config.yml", cfg)
-
-	return dbPath, cfgPath
-}
-
-// TestDatabaseDeleteQuietSuppressesMessage checks that --quiet silences
-// the "database deleted" line while still removing the file.
-//
-//nolint:paralleltest // mutates the process-global rootFlags
-func TestDatabaseDeleteQuietSuppressesMessage(t *testing.T) {
-	dir := t.TempDir()
-	dbPath, cfgPath := seedDatabaseDeleteConfig(t, dir)
-
-	setRootFlags(t, RootFlags{Quiet: true, ConfigPath: cfgPath})
-
-	out := mustExecute(t, newDatabaseDeleteCommand(), "--force")
-
-	if out != "" {
-		t.Errorf("--quiet database delete printed %q, want nothing", out)
-	}
-
-	_, err := os.Stat(dbPath)
-	if !os.IsNotExist(err) {
-		t.Errorf("database delete did not remove the file: stat err = %v", err)
-	}
-}
-
-// TestDatabaseDeleteReportsWhenNotQuiet checks that the deletion is
-// reported when --quiet is not set.
-//
-//nolint:paralleltest // mutates the process-global rootFlags
-func TestDatabaseDeleteReportsWhenNotQuiet(t *testing.T) {
-	dir := t.TempDir()
-	_, cfgPath := seedDatabaseDeleteConfig(t, dir)
-
-	setRootFlags(t, RootFlags{ConfigPath: cfgPath})
-
-	out := mustExecute(t, newDatabaseDeleteCommand(), "--force")
-
-	if !strings.Contains(out, "deleted") {
-		t.Errorf("database delete did not report the deletion: %q", out)
-	}
-}

internal/cli/root.go

@@ -9,7 +9,6 @@ import (
 
 	"github.com/adrg/xdg"
 	"github.com/spf13/cobra"
-	"sneak.berlin/go/vaultik/internal/ui"
 )
 
 // errConfigNotFound is wrapped by all config-resolution failures.
@@ -82,20 +81,6 @@ func GetRootFlags() RootFlags {
 	return rootFlags
 }
 
-// commandUI returns a UI writer for a command's stdout, in quiet mode
-// when the global --quiet flag is set. This is how the pure-cli
-// commands (version, config, database) reach internal/ui: color follows
-// the writer (a TTY gets color, a captured test buffer does not), and
-// --quiet silences the same message classes it silences everywhere else.
-func commandUI(cmd *cobra.Command) *ui.Writer {
-	w := ui.New(cmd.OutOrStdout())
-	if GetRootFlags().Quiet {
-		w.SetQuiet(true)
-	}
-
-	return w
-}
-
 // ResolveConfigPath resolves the config file path from flags, environment, or default.
 // Search order: --config flag, VAULTIK_CONFIG env, XDG config dir,
 // /etc/vaultik/config.yml.

internal/cli/snapshot.go

@@ -192,8 +192,7 @@ func newSnapshotVerifyCommand() *cobra.Command {
 		Long: "Checks that every blob the snapshot's manifest lists is present\n" +
 			"in storage with the size the manifest records, and that the\n" +
 			"snapshot's encrypted database is present. It does not read blob\n" +
-			"contents; use --deep to download, decrypt, and re-hash every blob\n" +
-			"to detect corruption -- integrity, not who wrote it.\n\n" +
+			"contents; use --deep to download and cryptographically verify them.\n\n" +
 			"The snapshot may be named by its ID or, on a host with no local\n" +
 			"index, by the remote key that 'snapshot list' prints for a\n" +
 			"remote-only snapshot (an unambiguous leading part is enough).",

internal/cli/version.go

@@ -2,11 +2,11 @@ package cli
 
 import (
 	"fmt"
+	"io"
 	"runtime"
 
 	"github.com/spf13/cobra"
 	"sneak.berlin/go/vaultik/internal/globals"
-	"sneak.berlin/go/vaultik/internal/ui"
 )
 
 // NewVersionCommand creates the version command
@@ -17,25 +17,16 @@ func NewVersionCommand() *cobra.Command {
 		Long:  `Print version, git commit, and build information for vaultik.`,
 		Args:  cobra.NoArgs,
 		Run: func(cmd *cobra.Command, _ []string) {
-			writeVersion(commandUI(cmd))
+			writeVersion(cmd.OutOrStdout())
 		},
 	}
 
 	return cmd
 }
 
-// writeVersion prints the version report through the UI writer. The
-// report is the output this command exists to produce, so it is written
-// plain (markers would corrupt the aligned report) via the writer's
-// underlying stdout; --quiet silences it like any other non-error
-// output.
-func writeVersion(out *ui.Writer) {
-	if out.Quiet() {
-		return
-	}
-
-	w := out.Out()
-
+// writeVersion prints the version report. It takes a writer rather than
+// using os.Stdout directly so the output can be asserted on in tests.
+func writeVersion(w io.Writer) {
 	_, _ = fmt.Fprintf(w, "vaultik %s\n", globals.Version)
 	_, _ = fmt.Fprintf(w, "  commit:     %s\n", globals.Commit)
 	_, _ = fmt.Fprintf(w, "  build date: %s\n", globals.CommitDate)

internal/cli/version_test.go

@@ -34,9 +34,9 @@ func runVersionCommand(t *testing.T) string {
 // the report is the version the binary was actually built with. The
 // test binary carries no -ldflags, so that is the "dev" default -- the
 // same string an untagged `make vaultik` build stamps a prefix of.
-//
-//nolint:paralleltest // executes a command that reads the global rootFlags
 func TestVersionCommandReportsBuildVersion(t *testing.T) {
+	t.Parallel()
+
 	out := runVersionCommand(t)
 
 	wantFirst := "vaultik " + globals.Version
@@ -55,9 +55,9 @@ func TestVersionCommandReportsBuildVersion(t *testing.T) {
 // being exactly "dev", so once untagged builds started carrying their
 // commit sha it would have gone silent and an unreleased binary would
 // have looked like a release.
-//
-//nolint:paralleltest // executes a command that reads the global rootFlags
 func TestVersionCommandFlagsDevelopmentBuild(t *testing.T) {
+	t.Parallel()
+
 	if !globals.IsDevVersion(globals.Version) {
 		t.Skipf("test binary was stamped with release version %q",
 			globals.Version)

internal/database/database.go

@@ -3,10 +3,8 @@
 //
 // Blobs in Vaultik are the final storage units uploaded to S3. Each blob is a
 // large (up to 10GB) file containing many compressed and encrypted chunks from
-// multiple source files. Blobs are content-addressed: the filename in S3 is
-// hex(SHA256(SHA256(uncompressed blob contents))), computed from the chunk data
-// before compression and encryption (not from the stored bytes). See
-// blobgen.DoubleSHA256 and docs/REPOSTRUCTURE.md.
+// multiple source files. Blobs are content-addressed, meaning their filename
+// is derived from their SHA256 hash after compression and encryption.
 //
 // Schema is managed via numbered SQL migrations embedded in the schema/
 // directory. Migration 000.sql bootstraps the schema_migrations tracking

internal/database/models.go

@@ -51,15 +51,15 @@ type Chunk struct {
 // Blob represents a blob record in the database.
 // A blob is Vaultik's final storage unit - a large file (up to 10GB) containing
 // many compressed and encrypted chunks from multiple source files.
-// Blobs are content-addressed: the filename in S3 is
-// hex(SHA256(SHA256(uncompressed blob contents))), computed from the chunk data
-// before compression and encryption (not from the stored bytes). See
-// blobgen.DoubleSHA256 and docs/REPOSTRUCTURE.md.
+// Blobs are content-addressed, meaning their filename in S3 is derived from
+// the SHA256 hash of their compressed and encrypted content.
+// The blob creation process is: chunks are accumulated -> compressed with zstd
+// -> encrypted with age -> hashed -> uploaded to S3 with the hash as filename.
 type Blob struct {
 	ID types.BlobID // UUID assigned when blob creation starts
 
-	// Hash is hex(SHA256(SHA256(uncompressed blob contents)))
-	// (empty until finalized); see the type comment above.
+	// Hash is the SHA256 of the final compressed+encrypted content
+	// (empty until finalized).
 	Hash             types.BlobHash
 	CreatedTS        time.Time  // When blob creation started
 	FinishedTS       *time.Time // When blob was finalized (nil if still packing)

internal/snapshot/scanner.go

@@ -119,7 +119,7 @@ type ScannerConfig struct {
 	Storage          storage.Storer
 	MaxBlobSize      int64
 	CompressionLevel int
-	AgeRecipients    []string   // required; output is always encrypted
+	AgeRecipients    []string   // Optional, empty means no encryption
 	EnableProgress   bool       // Enable the live progress reporter (ETAs, throughput)
 	UI               *ui.Writer // Where user-facing scanner messages go; nil = discard
 	Exclude          []string   // Glob patterns for files/directories to exclude

internal/snapshot/snapshot.go

@@ -24,7 +24,7 @@ package snapshot
 // 7. Close the temporary database
 // 8. VACUUM the database to remove deleted data and compact (security critical)
 // 9. Compress the binary database with zstd
-// 10. Encrypt the compressed database with age (always; recipients are required)
+// 10. Encrypt the compressed database with age (if encryption is enabled)
 // 11. Upload to S3 as: metadata/{snapshot-id}/db.zst.age
 // 12. Reopen the main database
 //
@@ -201,14 +201,11 @@ func (sm *SnapshotManager) UpdateSnapshotStatsExtended(
 	})
 }
 
-// PopulateSnapshotBlobs ensures snapshot_blobs holds an entry for every
-// blob that stores a chunk referenced by the snapshot's files, including
-// blobs deduplicated from earlier snapshots. Without it, a fully
-// deduplicated snapshot would record no blobs and be unrestorable.
-//
-// This must run before ExportSnapshotMetadata: the blob manifest and the
-// trimmed metadata database are both built from snapshot_blobs.
-func (sm *SnapshotManager) PopulateSnapshotBlobs(
+// CompleteSnapshot marks a snapshot as completed and ensures snapshot_blobs
+// is populated with every blob holding any chunk referenced by the
+// snapshot's files (including deduplicated blobs uploaded by prior
+// snapshots). Without this, fully-deduplicated snapshots are unrestorable.
+func (sm *SnapshotManager) CompleteSnapshot(
 	ctx context.Context, snapshotID string,
 ) error {
 	err := sm.repos.WithTx(ctx, func(ctx context.Context, tx *sql.Tx) error {
@@ -222,25 +219,6 @@ func (sm *SnapshotManager) PopulateSnapshotBlobs(
 				"snapshot_id", snapshotID, "added", added)
 		}
 
-		return nil
-	})
-	if err != nil {
-		return fmt.Errorf("populating snapshot blobs: %w", err)
-	}
-
-	return nil
-}
-
-// MarkSnapshotComplete records the snapshot's completion timestamp. On the
-// backup path this runs only after ExportSnapshotMetadata has succeeded, so
-// the local index never marks a snapshot complete while the destination
-// holds no manifest or database for it. A crash before this point leaves the
-// snapshot incomplete, and the next run's PruneDatabase drops it. See
-// https://git.eeqj.de/sneak/vaultik/issues/177.
-func (sm *SnapshotManager) MarkSnapshotComplete(
-	ctx context.Context, snapshotID string,
-) error {
-	err := sm.repos.WithTx(ctx, func(ctx context.Context, tx *sql.Tx) error {
 		return sm.repos.Snapshots.MarkComplete(ctx, tx, snapshotID)
 	})
 	if err != nil {
@@ -252,22 +230,6 @@ func (sm *SnapshotManager) MarkSnapshotComplete(
 	return nil
 }
 
-// CompleteSnapshot populates snapshot_blobs and then marks the snapshot
-// complete. The backup path (finalizeSnapshotMetadata) instead calls the two
-// halves separately, with the metadata export between them, so completion is
-// recorded only after a successful export. This convenience is for callers
-// that do not interleave an export.
-func (sm *SnapshotManager) CompleteSnapshot(
-	ctx context.Context, snapshotID string,
-) error {
-	err := sm.PopulateSnapshotBlobs(ctx, snapshotID)
-	if err != nil {
-		return err
-	}
-
-	return sm.MarkSnapshotComplete(ctx, snapshotID)
-}
-
 // ExportSnapshotMetadata exports snapshot metadata to S3
 //
 // This method executes the complete snapshot metadata export process:
@@ -276,12 +238,14 @@ func (sm *SnapshotManager) CompleteSnapshot(
 // 3. Cleans the copy to contain only current snapshot data
 // 4. Dumps the cleaned database to SQL
 // 5. Compresses the SQL dump with zstd
-// 6. Encrypts the compressed data with age (always; recipients are required)
+// 6. Encrypts the compressed data (if encryption is enabled)
 // 7. Uploads to S3 at: snapshots/{snapshot-id}.sql.zst[.age]
 //
-// The only caller (finalizeSnapshotMetadata) does not close the main database
-// before calling this method: the index is copied at dbPath while it is still
-// open, and every step here operates on that copy, never on the live index.
+// The caller is responsible for:
+// - Ensuring the main database is closed before calling this method
+// - Reopening the main database after this method returns
+//
+// This ensures database consistency during the copy operation.
 func (sm *SnapshotManager) ExportSnapshotMetadata(
 	ctx context.Context, dbPath string, snapshotID string,
 ) error {
@@ -451,11 +415,9 @@ func (sm *SnapshotManager) prepareExportDB(
 // uploadSnapshotArtifacts uploads the database backup and blob manifest
 // to remote storage at metadata/<remote-key>/, where remote-key is the
 // double-SHA256 derivation of the snapshot ID (see RemoteSnapshotKey).
-// The human-readable snapshot ID is never written into an unencrypted part
-// of remote storage, so a plain listing shows only the hashed key, not the
-// hostname or snapshot name. The hash uses no secret, so a guessed hostname
-// and snapshot name can still be confirmed against a listing, and the backup
-// time is public: the manifest carries a plaintext timestamp.
+// We never write the human-readable snapshot ID into any unencrypted
+// part of remote storage so a listing of the destination bucket leaks
+// no host, configuration, or scheduling information.
 func (sm *SnapshotManager) uploadSnapshotArtifacts(
 	ctx context.Context, snapshotID string, dbData, manifestData []byte,
 ) error {
@@ -852,11 +814,10 @@ func (sm *SnapshotManager) generateBlobManifest(
 	}
 
 	// Create manifest. SnapshotID in the unencrypted manifest is the
-	// double-SHA256 remote key (see RemoteSnapshotKey), not the human ID, so
-	// neither this field nor the directory name spells out the hostname or
-	// snapshot name — but the key uses no secret, so a guessed hostname and
-	// snapshot name can be confirmed. Timestamp below is written in the clear,
-	// so the backup time is observable to anyone who can read the manifest.
+	// double-SHA256 remote key (see RemoteSnapshotKey), not the human ID,
+	// so neither this field nor the directory name reveals the hostname or
+	// snapshot name. Timestamp below is written in the clear, so the backup
+	// time is observable to anyone who can read the manifest.
 	manifest := &Manifest{
 		SnapshotID:          RemoteSnapshotKey(snapshotID),
 		Timestamp:           time.Now().UTC().Format(time.RFC3339),

internal/types/types.go

@@ -146,10 +146,8 @@ type SnapshotID string
 // Used for content-addressing and deduplication of file chunks.
 type ChunkHash string
 
-// BlobHash is hex(SHA256(SHA256(uncompressed blob contents))), computed before
-// compression and encryption (see blobgen.DoubleSHA256 and
-// docs/REPOSTRUCTURE.md). It is used as the filename in S3 storage for
-// content-addressed retrieval.
+// BlobHash is the SHA256 hash of a blob's compressed and encrypted content.
+// This is used as the filename in S3 storage for content-addressed retrieval.
 type BlobHash string
 
 // FilePath represents an absolute path to a file or directory.

internal/vaultik/fault_injection_test.go

@@ -14,7 +14,6 @@ import (
 	"github.com/stretchr/testify/require"
 	"sneak.berlin/go/vaultik/internal/config"
 	"sneak.berlin/go/vaultik/internal/database"
-	"sneak.berlin/go/vaultik/internal/globals"
 	"sneak.berlin/go/vaultik/internal/log"
 	"sneak.berlin/go/vaultik/internal/snapshot"
 	"sneak.berlin/go/vaultik/internal/storage"
@@ -418,10 +417,9 @@ func TestBackupRetryAfterInterruptedUploadIsRestorable(t *testing.T) {
 // database is uploaded but before the manifest. The destination is left
 // with blobs and a database but no manifest. verify and snapshot list
 // must report the damage honestly rather than crashing or passing.
-// Automatic detection and repair of this partial state on the next run is
-// covered by TestBackupCompletesOnlyAfterMetadataExport
-// (https://git.eeqj.de/sneak/vaultik/issues/177); this test exercises the
-// lower-level export path in isolation.
+// Automatic detection and repair of this partial state on the next run
+// is tracked in https://git.eeqj.de/sneak/vaultik/issues/177 and is not
+// asserted here.
 //
 //nolint:paralleltest // installs the global logger via log.Initialize
 func TestBackupSurvivesMetadataExportInterruption(t *testing.T) {
@@ -498,186 +496,6 @@ func TestBackupSurvivesMetadataExportInterruption(t *testing.T) {
 		"snapshot list must tolerate a partially-exported snapshot")
 }
 
-// Scenario 2, repair: the process dies during the metadata export of a
-// full backup run. Because completion is recorded only after the export
-// succeeds (finalizeSnapshotMetadata), the interrupted snapshot is left
-// incomplete rather than silently marked complete without metadata at the
-// destination. Rerunning the backup must then prune the incomplete
-// snapshot, produce a snapshot whose destination metadata and local index
-// agree, and restore. See https://git.eeqj.de/sneak/vaultik/issues/177.
-//
-//nolint:paralleltest // installs the global logger via log.Initialize
-func TestBackupCompletesOnlyAfterMetadataExport(t *testing.T) {
-	log.Initialize(log.Config{})
-
-	fs := afero.NewOsFs()
-	tempDir := t.TempDir()
-	dataDir := filepath.Join(tempDir, "src")
-	storeDir := filepath.Join(tempDir, "remote")
-	restoreDir := filepath.Join(tempDir, "restored")
-	dbPath := filepath.Join(tempDir, "index.sqlite")
-
-	ctx := context.Background()
-	testFiles := writeFaultSourceTree(t, fs, dataDir)
-
-	// A full-backup config: the fault-test defaults plus the fields the
-	// production create path reads (index location, chunk size, and the
-	// named snapshot to back up).
-	cfg := faultTestConfig()
-	cfg.IndexPath = dbPath
-	cfg.ChunkSize = config.Size(faultChunkSize)
-	cfg.Snapshots = map[string]config.SnapshotConfig{
-		"data": {Paths: []string{dataDir}},
-	}
-
-	inner, err := storage.NewFileStorer(storeDir)
-	require.NoError(t, err)
-
-	db, err := database.New(ctx, dbPath)
-	require.NoError(t, err)
-
-	repos := database.NewRepositories(db)
-
-	// failManifest is on for the first backup and off for the retry, so the
-	// manifest upload fails once — interrupting the export mid-way — then
-	// succeeds.
-	failManifest := true
-	store := faultstore.New(inner)
-	store.OnPut = func(key string) faultstore.PutAction {
-		if failManifest && strings.HasSuffix(key, "manifest.json.zst") {
-			return faultstore.PutFail
-		}
-
-		return faultstore.PutNormal
-	}
-
-	v := newBackupVaultik(ctx, cfg, store, repos, db, fs)
-	opts := &vaultik.SnapshotCreateOptions{Cron: true}
-
-	// First run: the export fails at the manifest upload, so the whole
-	// create fails and the snapshot is left incomplete.
-	require.Error(t, v.CreateSnapshot(opts),
-		"backup must fail when the metadata export is interrupted")
-
-	incompletes, err := repos.Snapshots.GetIncompleteSnapshots(ctx)
-	require.NoError(t, err)
-	require.Len(t, incompletes, 1,
-		"an interrupted export must leave exactly one incomplete snapshot")
-
-	afterFirst, err := repos.Snapshots.ListRecent(ctx, listRecentTestLimit)
-	require.NoError(t, err)
-
-	for _, s := range afterFirst {
-		require.Nil(t, s.CompletedAt,
-			"no snapshot may be marked complete before its metadata is exported")
-	}
-
-	// Second run on the same index and destination: the retry succeeds.
-	failManifest = false
-
-	require.NoError(t, v.CreateSnapshot(opts),
-		"a retry after an interrupted export must succeed")
-
-	assertRetryConsistentAndRestorable(
-		ctx, t, cfg, inner, repos, db, fs, restoreDir, testFiles)
-}
-
-// assertRetryConsistentAndRestorable checks the end state after the retry
-// backup in TestBackupCompletesOnlyAfterMetadataExport: the interrupted
-// snapshot is pruned, exactly one completed snapshot remains, its metadata
-// is at the destination, and it restores to the original tree.
-func assertRetryConsistentAndRestorable(
-	ctx context.Context, t *testing.T, cfg *config.Config,
-	inner storage.Storer, repos *database.Repositories, db *database.DB,
-	fs afero.Fs, restoreDir string, testFiles map[string][]byte,
-) {
-	t.Helper()
-
-	incompletes, err := repos.Snapshots.GetIncompleteSnapshots(ctx)
-	require.NoError(t, err)
-	assert.Empty(t, incompletes,
-		"the next run's prune must drop the interrupted snapshot")
-
-	local, err := repos.Snapshots.ListRecent(ctx, listRecentTestLimit)
-	require.NoError(t, err)
-	require.Len(t, local, 1, "exactly one snapshot must remain after the retry")
-
-	final := local[0]
-	require.NotNil(t, final.CompletedAt, "the retry's snapshot must be complete")
-
-	// The destination and the local index agree: the completed snapshot has
-	// both its metadata objects at the destination.
-	key := snapshot.RemoteSnapshotKey(final.ID.String())
-	_, err = inner.Stat(ctx, "metadata/"+key+"/manifest.json.zst")
-	require.NoError(t, err, "the completed snapshot's manifest must be at the destination")
-	_, err = inner.Stat(ctx, "metadata/"+key+"/db.zst.age")
-	require.NoError(t, err, "the completed snapshot's database must be at the destination")
-
-	require.NoError(t, db.Close())
-
-	// The snapshot restores from the destination alone.
-	reader := newReaderVaultik(ctx, cfg, inner, nil, fs)
-	require.NoError(t, reader.Restore(&vaultik.RestoreOptions{
-		SnapshotID: final.ID.String(),
-		TargetDir:  restoreDir,
-		Verify:     true,
-	}), "the retry's snapshot must be restorable")
-
-	assertRestoredTree(t, fs, restoreDir, testFiles)
-}
-
-// listRecentTestLimit is a generous cap for the handful of snapshots these
-// tests create when reading the local index directly.
-const listRecentTestLimit = 100
-
-// newBackupVaultik builds a Vaultik that runs the full create path
-// (CreateSnapshot) writing through storer, wiring the same scanner factory
-// and snapshot manager the production dependency graph provides.
-func newBackupVaultik(
-	ctx context.Context, cfg *config.Config, storer storage.Storer,
-	repos *database.Repositories, db *database.DB, fs afero.Fs,
-) *vaultik.Vaultik {
-	v := &vaultik.Vaultik{
-		Globals:         &globals.Globals{Version: "v", Commit: "g"},
-		Config:          cfg,
-		DB:              db,
-		Repositories:    repos,
-		Storage:         storer,
-		SnapshotManager: newFaultSnapshotManager(fs, storer, cfg, repos),
-		ScannerFactory:  faultScannerFactory(cfg, repos, storer),
-		Fs:              fs,
-		Stdout:          io.Discard,
-		Stderr:          io.Discard,
-		UI:              ui.NewWithColor(io.Discard, false),
-	}
-	v.SetContext(ctx)
-
-	return v
-}
-
-// faultScannerFactory mirrors the production provideScannerFactory, binding
-// the scanner to the given store, repositories, and config so a full
-// create-path backup writes through the fault-injecting store.
-func faultScannerFactory(
-	cfg *config.Config, repos *database.Repositories, storer storage.Storer,
-) snapshot.ScannerFactory {
-	return func(params snapshot.ScannerParams) *snapshot.Scanner {
-		return snapshot.NewScanner(snapshot.ScannerConfig{
-			FS:               params.Fs,
-			Storage:          storer,
-			ChunkSize:        faultChunkSize,
-			MaxBlobSize:      faultMaxBlobSize,
-			CompressionLevel: cfg.CompressionLevel,
-			AgeRecipients:    cfg.AgeRecipients,
-			Repositories:     repos,
-			EnableProgress:   params.EnableProgress,
-			UI:               params.UI,
-			Exclude:          params.Exclude,
-			SkipErrors:       params.SkipErrors,
-		})
-	}
-}
-
 // Scenario 5: the restore target runs out of space mid-file. Restore
 // must fail with an out-of-space error, and must not leave a truncated
 // file at the target path presenting as a complete restore. Restore

internal/vaultik/info.go

@@ -13,14 +13,6 @@ import (
 
 // ShowInfo displays system and configuration information
 func (v *Vaultik) ShowInfo() error {
-	// The info report is the output this command exists to produce, so it
-	// is written plain (markers would corrupt the aligned report) through
-	// the UI writer's stdout; --quiet silences it like any other
-	// non-error output.
-	if v.UI.Quiet() {
-		return nil
-	}
-
 	// System Information
 	v.stdoutf("=== System Information ===\n")
 	v.stdoutf("OS/Architecture: %s/%s\n", runtime.GOOS, runtime.GOARCH)
@@ -221,12 +213,7 @@ func (v *Vaultik) RemoteInfo(jsonOutput bool) error {
 	result.StorageType = storageInfo.Type
 	result.StorageLocation = storageInfo.Location
 
-	// The human report is written only when it is neither the --json
-	// document (which needs stdout to itself) nor silenced by --quiet. The
-	// scan still runs in both cases so --json still gets a full result.
-	showText := !jsonOutput && !v.UI.Quiet()
-
-	if showText {
+	if !jsonOutput {
 		v.stdoutf("=== Remote Storage ===\n")
 		v.stdoutf("Type:     %s\n", storageInfo.Type)
 		v.stdoutf("Location: %s\n", storageInfo.Location)
@@ -239,7 +226,7 @@ func (v *Vaultik) RemoteInfo(jsonOutput bool) error {
 		return err
 	}
 
-	if showText {
+	if !jsonOutput {
 		v.stdoutf("Downloading %d manifest(s)...\n", len(snapshotIDs))
 	}
 
@@ -247,7 +234,7 @@ func (v *Vaultik) RemoteInfo(jsonOutput bool) error {
 
 	v.populateRemoteInfoResult(result, snapshotMetadata, snapshotIDs, referencedBlobs)
 
-	err = v.scanRemoteBlobStorage(result, referencedBlobs, showText)
+	err = v.scanRemoteBlobStorage(result, referencedBlobs, jsonOutput)
 	if err != nil {
 		return err
 	}
@@ -265,9 +252,7 @@ func (v *Vaultik) RemoteInfo(jsonOutput bool) error {
 		return enc.Encode(result)
 	}
 
-	if showText {
-		v.printRemoteInfoTable(result)
-	}
+	v.printRemoteInfoTable(result)
 
 	return nil
 }
@@ -377,13 +362,11 @@ func (v *Vaultik) populateRemoteInfoResult(
 	}
 }
 
-// scanRemoteBlobStorage lists all blobs on remote and computes orphan
-// stats. showText is true only when the human report is being printed
-// (not --json, not --quiet), gating the progress line.
+// scanRemoteBlobStorage lists all blobs on remote and computes orphan stats
 func (v *Vaultik) scanRemoteBlobStorage(
-	result *RemoteInfoResult, referencedBlobs map[string]int64, showText bool,
+	result *RemoteInfoResult, referencedBlobs map[string]int64, jsonOutput bool,
 ) error {
-	if showText {
+	if !jsonOutput {
 		v.stdoutf("Scanning blobs...\n")
 	}
 

internal/vaultik/info_quiet_test.go

@@ -1,30 +0,0 @@
-package vaultik_test
-
-import (
-	"bytes"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/vaultik/internal/ui"
-	"sneak.berlin/go/vaultik/internal/vaultik"
-)
-
-// TestShowInfo_QuietSuppressesReport checks that --quiet silences the
-// whole info report. The report is human-facing status, not a scriptable
-// value, so under --quiet the command produces nothing (and touches none
-// of its dependencies, which is why this minimal instance suffices).
-func TestShowInfo_QuietSuppressesReport(t *testing.T) {
-	t.Parallel()
-
-	var out bytes.Buffer
-
-	v := &vaultik.Vaultik{
-		Stdout: &out,
-		UI:     ui.NewWithColor(&out, false),
-	}
-	v.UI.SetQuiet(true)
-
-	require.NoError(t, v.ShowInfo())
-	require.Empty(t, out.String(),
-		"the info report must be suppressed under --quiet")
-}

internal/vaultik/snapshot.go

@@ -69,9 +69,6 @@ func (v *Vaultik) CreateSnapshot(opts *SnapshotCreateOptions) error {
 	// Prune the database before starting: delete incomplete snapshots and orphaned data.
 	// This ensures the database is consistent before we start a new snapshot.
 	// Since we use locking, only one vaultik instance accesses the DB at a time.
-	// A snapshot whose metadata export was interrupted is left incomplete by
-	// finalizeSnapshotMetadata, so it is among the incomplete snapshots dropped
-	// here (https://git.eeqj.de/sneak/vaultik/issues/177).
 	_, err = v.PruneDatabase()
 	if err != nil {
 		return fmt.Errorf("prune database: %w", err)
@@ -327,12 +324,7 @@ func (v *Vaultik) collectUploadStats(scanner *snapshot.Scanner, stats *snapshotS
 	}
 }
 
-// finalizeSnapshotMetadata updates stats, exports metadata, and only then
-// marks the snapshot complete. Recording completion last is deliberate: an
-// export interrupted by a crash leaves the snapshot incomplete rather than
-// looking complete with no manifest or database at the destination. The next
-// run's PruneDatabase drops the incomplete snapshot and re-backs-up its data.
-// See https://git.eeqj.de/sneak/vaultik/issues/177.
+// finalizeSnapshotMetadata updates stats, marks complete, and exports metadata
 func (v *Vaultik) finalizeSnapshotMetadata(
 	snapshotID string, stats *snapshotStats,
 ) error {
@@ -354,11 +346,9 @@ func (v *Vaultik) finalizeSnapshotMetadata(
 		return fmt.Errorf("updating snapshot stats: %w", err)
 	}
 
-	// snapshot_blobs must be populated before the export, which builds the
-	// manifest and the trimmed metadata database from it.
-	err = v.SnapshotManager.PopulateSnapshotBlobs(v.ctx, snapshotID)
+	err = v.SnapshotManager.CompleteSnapshot(v.ctx, snapshotID)
 	if err != nil {
-		return fmt.Errorf("populating snapshot blobs: %w", err)
+		return fmt.Errorf("completing snapshot: %w", err)
 	}
 
 	err = v.SnapshotManager.ExportSnapshotMetadata(
@@ -367,13 +357,6 @@ func (v *Vaultik) finalizeSnapshotMetadata(
 		return fmt.Errorf("exporting snapshot metadata: %w", err)
 	}
 
-	// Record completion last, so an interrupted export never leaves a
-	// snapshot marked complete without its metadata at the destination.
-	err = v.SnapshotManager.MarkSnapshotComplete(v.ctx, snapshotID)
-	if err != nil {
-		return fmt.Errorf("marking snapshot complete: %w", err)
-	}
-
 	return nil
 }
 

internal/vaultik/snapshot_list.go

@@ -114,15 +114,9 @@ func (v *Vaultik) ListSnapshots(jsonOutput bool) error {
 		return encoder.Encode(snapshots)
 	}
 
-	// The table is the output this command exists to produce, so it is
-	// written plain (markers would corrupt the columns) to the UI writer's
-	// stdout; --quiet silences it. Reconciliation notes below go through
-	// the UI methods, so their warnings still emit under --quiet.
-	if !v.UI.Quiet() {
-		err = v.printSnapshotTable(snapshots)
-		if err != nil {
-			return err
-		}
+	err = v.printSnapshotTable(snapshots)
+	if err != nil {
+		return err
 	}
 
 	if remoteErr == nil {

internal/vaultik/snapshot_list_quiet_test.go

@@ -1,41 +0,0 @@
-package vaultik_test
-
-import (
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/vaultik/internal/log"
-)
-
-// TestListSnapshots_QuietSuppressesTableNotJSON is the --quiet contract
-// for `snapshot list`: the human table is silenced, but the --json
-// document a script depends on still emits. A local snapshot with its
-// remote counterpart present is used so there are no drift notes, whose
-// warnings would emit even under --quiet.
-func TestListSnapshots_QuietSuppressesTableNotJSON(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	env := newListEnv(t)
-
-	ts := time.Date(2026, 3, 1, 10, 0, 0, 0, time.UTC)
-	env.addLocal(t, listLocalID, ts)
-	env.addRemote(t, listLocalID, ts)
-
-	env.v.UI.SetQuiet(true)
-
-	// Table mode: nothing on stdout.
-	require.NoError(t, env.v.ListSnapshots(false))
-	require.Empty(t, env.stdout.String(),
-		"the table must be suppressed under --quiet")
-
-	// JSON mode: the document is still written despite the quiet UI.
-	env.stdout.Reset()
-	require.NoError(t, env.v.ListSnapshots(true))
-
-	rows := decodeListJSON(t, env.stdout.String())
-	require.Len(t, rows, 1)
-	require.Equal(t, listLocalID, rows[0].ID,
-		"the --json document must still emit under --quiet")
-}

internal/vaultik/vaultik.go

@@ -215,7 +215,6 @@ func NewForTesting(storage storage.Storer) *TestVaultik {
 			Stdout:  stdout,
 			Stderr:  stderr,
 			Stdin:   stdin,
-			UI:      ui.NewWithColor(stdout, false),
 		},
 		Stdout: stdout,
 		Stderr: stderr,