fix: implement recovery safety guardrails and collision-safe atomic output

CMakeLists.txt

@@ -58,6 +58,8 @@ endfunction()
 add_library(jgmd_core
     src/Scanner.cpp
     src/Recover.cpp
+    src/PathSafety.cpp
+    src/RecoveryOutput.cpp
     src/MftRecord.cpp
     src/Database.cpp
     src/Utf.cpp)
@@ -101,8 +103,6 @@ if (JUSTGIVEMYDISK_BUILD_APP)
 endif()
 
 if (BUILD_TESTING)
-    add_subdirectory(tests)
-
     add_executable(MftRecordParserTests
         tests/MftRecordParserTests.cpp
         tests/NtfsFixtures.cpp
@@ -116,6 +116,38 @@ if (BUILD_TESTING)
     justgivemydisk_enable_sanitizers(MftRecordParserTests)
 
     add_test(NAME MftRecordParserTests COMMAND MftRecordParserTests)
+
+    if (JUSTGIVEMYDISK_BUILD_APP)
+        add_subdirectory(tests)
+
+        add_executable(path_safety_tests
+            tests/PathSafetyTests.cpp
+            src/PathSafety.cpp)
+        target_include_directories(path_safety_tests PRIVATE src)
+        target_link_libraries(path_safety_tests PRIVATE fmt::fmt)
+        add_test(NAME path_safety_unit COMMAND path_safety_tests)
+
+        add_executable(recovery_output_tests
+            tests/RecoveryOutputTests.cpp
+            src/RecoveryOutput.cpp)
+        target_include_directories(recovery_output_tests PRIVATE src)
+        target_link_libraries(recovery_output_tests PRIVATE fmt::fmt)
+        add_test(NAME recovery_output_unit COMMAND recovery_output_tests)
+
+        add_test(
+            NAME path_safety_cli_integration
+            COMMAND ${CMAKE_COMMAND}
+                -DPROGRAM=$<TARGET_FILE:JustGiveMyDisk>
+                -DTEST_ROOT=${CMAKE_CURRENT_BINARY_DIR}/path-safety-integration
+                -P ${CMAKE_CURRENT_SOURCE_DIR}/tests/PathSafetyIntegration.cmake)
+
+        add_test(
+            NAME recovery_output_cli_integration
+            COMMAND ${CMAKE_COMMAND}
+                -DPROGRAM=$<TARGET_FILE:JustGiveMyDisk>
+                -DTEST_ROOT=${CMAKE_CURRENT_BINARY_DIR}/recovery-output-integration
+                -P ${CMAKE_CURRENT_SOURCE_DIR}/tests/RecoveryOutputIntegration.cmake)
+    endif()
 endif()
 
 if (JUSTGIVEMYDISK_BUILD_FUZZER)

README.md

@@ -23,6 +23,8 @@ JustGiveMyDisk is an experimental, terminal-only C++20 recovery helper for corru
 - Supports resident and non-resident unnamed `$DATA` attributes (`0x80`).
 - Parses NTFS data runs and copies only each file's real size.
 - Provides a `--dry-run` recovery preview.
+- Validates database and recovery paths against the open source device before writing.
+- Publishes recovered files atomically from `.partial` files without overwriting by default.
 
 ## Dependencies
 
@@ -91,6 +93,8 @@ Recover the indexed tree into a separate destination:
 sudo ./build/JustGiveMyDisk recover /dev/nvme0n1p3 scan.db --id 1189298 --dest /media/bkcpdisco/RECUP_IN_ROMANCE
 ```
 
+Existing files are skipped by default. Pass `--overwrite` only when replacing existing regular files is intentional. Incomplete writes are removed; a stale `.partial` left by an interrupted process is reported and can be replaced with the same explicit flag.
+
 The `recover` command uses `scan.db` to recursively collect children whose `parent_ref` matches the current directory `record_id_guess`. It then scans the source for MFT `FILE` records and matches the record number stored in the MFT header before reading `$DATA`; it does not assume that `record_id_guess * 1024` is the source offset.
 
 ## SQLite Schema