so the in effect fail would result in the snapshot being logically the same as at the start.
Excatly. That's a serious flaw, forget about "perhaps". If an operation can corrupt the entire system, then there has to be a check before the start and a fallback solution for the case of failure.
Especially, when that operation is part of the basic feature set. It's not that I wanted to do something out of the ordinary.
Trying to blame that on the user is denying sloppy programming through ignorance.