Original files are never overwritten. A repair receipt is generated for every successful output.
Diagnose suspicious PDF structure, try a semantics-preserving rewrite first, then fall back to page-by-page visual salvage when necessary. Every output is reopened, sampled and verified before it is offered for download.