[lloydsmart]

Summary

• harden CUE, GDI, and CCD descriptor source-set validation
• reject unsafe archive paths, links, and sanitised output-name collisions
• define transactional cleanup for direct descriptor companion files
• use available physical memory for bounded chdman thread selection
• remove forced hunk sizes, global sync calls, and fixed sleeps
• add documented thread and hunk-size overrides

Why

Descriptor references were resolved too loosely, companion files were not consistently validated, and archives could reach extraction without sufficient path and collision preflight. Resource selection also counted swap as usable compression memory and forced hunk sizes without measured justification.

The new validation builds a safe, complete source set before conversion or cleanup. Resource defaults now defer format-specific hunk sizing to chdman and select conservative concurrency from currently available physical memory.

Impact

Unsafe, incomplete, or ambiguous descriptor/archive inputs now fail before chdman runs and retain their originals. Successful direct descriptor conversions remove the validated source set together unless --keep-originals is enabled.

Advanced users can set CHDMAN_THREADS and CHDMAN_HUNK_SIZE; thread counts remain CPU-bounded. Dry-run output reports the effective direct-input command.

Validation

• shellcheck chdtool.sh tests/*.sh tests/bin/*
• complete Bash regression suite
• focused descriptor/archive security regressions
• focused resource-selection and command-construction regressions

Fixes #32.
Fixes #31.