v0.4.1

Added

• Drive health panel (h) — select a disk and press h to open a Health dialog showing Windows' health status, media type (with spindle RPM for HDDs) and usage, plus SMART/reliability counters: wear (% of rated endurance used), current and max recorded temperature, power-on hours (with an approximate years figure), and total read/write error counts. Values are colour-coded: wear turns yellow at 70 % and red at 90 %, temperature turns yellow at 55 °C and red at 70 °C, any non-zero error count is highlighted. The panel is listed in the footer and the ? help screen; c copies the session log from inside it.
• Health panel explains missing counters — if SMART counters are unavailable, the dialog tells you why: either the app is not running elevated (restart as administrator), or the device blocks SMART passthrough (typical for USB enclosures — connect via SATA/NVMe instead).
• diskutility --health <disk number> CLI flag — prints the same health summary and SMART counters to the console and exits, for scripting or quick checks without opening the TUI.
• Surface scan (safe) — new second entry in the b Test menu. Reads every sector of the disk non-destructively and, when a chunk fails, re-probes it 4 KiB at a time to pinpoint the exact unreadable blocks. Reports PASSED with 0 bad blocks and elapsed time, or lists the count and first/last bad block offsets with a back-up warning. Aborts early after more than 2000 unreadable blocks with a "this drive is failing" message. Runs without a confirmation dialog (like the read benchmark), is cancellable, and works on protected disks.
• Confirmation dialog now shows what's on the target — a new "Contains" line lists each recognised volume on the disk with its drive letter, filesystem and used space (or "no recognised volumes"), so picking the wrong disk is obvious before you type the phrase.
• --no-update-check flag / DISKUTILITY_NO_UPDATE_CHECK=1 env var — disables the start-up update check, which is the TUI's only network access. The opt-out is recorded in the log.
• Log rotation — diskutility.log is now capped at 5 MiB; once it exceeds that it is parked as diskutility.log.1 (replacing any previous backup) and a fresh log is started.
• CI now runs cargo test alongside clippy, build and the smoke test; new unit tests cover the updater's URL allow-list and checksum verification.

Changed

• Internal (non-removable) disks get extra friction — disks whose bus is not USB, SD, MMC, 1394 or virtual are no longer treated like a USB stick. They are not blocked, but the confirmation dialog shows a bold "⚠ INTERNAL DISK: not a removable device (bus …)" warning and requires the long DESTROY <n> phrase instead of just the disk number.
• Test menu reordered — with the surface scan inserted, the b menu now has five entries: Read benchmark, Surface scan, Full benchmark, Capacity (quick), Capacity (full).
• Help screen updated — b is described as "benchmark, surface scan & capacity tests" and a new h entry for drive health was added.
• Update success message now states "(SHA-256 verified)".

Fixed

• Destructive actions act on the disk you confirmed, not the currently highlighted row — the target disk is snapshotted when you enter a menu, and the confirmation dialog and image-size check use that snapshot. If a rescan (e.g. a drive being unplugged) changes the list while the dialog is open, the operation is refused with "the disk list changed since you selected disk N — nothing was touched" instead of running on whatever now occupies that row.
• Image-on-target refusal — writing an image that is stored on the very disk being written is rejected up front ("it would be destroyed while being written"), since the prep step would wipe the image's volume mid-write. UNC share paths are allowed; volume-GUID paths that can't be placed are refused rather than guessed.
• Double-check of protection and elevation at launch time — protection reasons (not only boot/system flags) and administrator rights are re-verified right before an operation starts, rather than relying solely on the earlier menu guard.
• Clipboard temp file cleanup — the temporary file used by c (copy log) is now deleted after the copy.

Security

• Device identity re-check before any write — every destructive operation's prep script now compares the live disk's serial number, size and friendly name against the snapshot you confirmed and throws "disk N is no longer the device you confirmed … rescan (r) and retry" if any differ. This protects against Windows renumbering disks when drives are plugged or unplugged between selection and execution.
• PowerShell is launched by absolute path (%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe) instead of by name, so a powershell.exe dropped next to the (user-writable) app binary can't be picked up while running elevated. The script prelude also pins PSModulePath to system directories so a rogue module in the user's Documents folder can't shadow the Storage cmdlets.
• All string values passed into PowerShell are now single-quote-escaped, including file paths for the clipboard helper, updater URLs and disk serial/name in the identity check.
• Self-updater hardening (--update) — downloads are only accepted from https://github.com/<this repo>/releases/download/ (URLs containing quotes or whitespace are rejected), TLS 1.2 is forced, the release's checksums.txt is fetched and the SHA-256 of the download must match its diskutility.exe entry, the file must be a MZ PE image at least 200 KB, and the new binary is executed with --version and must identify itself as diskutility v… before it replaces the running exe. Any failure deletes the staged download and aborts.
• install.ps1 hardening — the installer now also requires checksums.txt in the release, verifies both asset URLs point at this repo's GitHub releases, downloads to a staged .new file, checks its SHA-256 against checksums.txt, and only then moves it into place; a mismatch deletes the download and aborts with a "corrupted or tampered" error.
• README documents the safety model — new bullets describe internal-disk warnings, the identity re-check, the image-on-target refusal, PowerShell launch hardening, and the verified updater / opt-out flags.

Full Changelog: v0.4.0...v0.4.1