Cryptext x64 0.6 full encryption transaction test
====================================================

WARNING: This is the first build that can really delete the selected plaintext
source. Use disposable COPIES for testing.

The checkbox "Originaldatei beibehalten" is now active:
- checked   -> source.ext remains beside source.ext.$#!
- unchecked -> source.ext is deleted only after the complete safety chain succeeds

Safety chain before source deletion
-----------------------------------
1. Open source read-only.
2. Create source.ext.$#!.temp with CREATE_NEW and HIDDEN.
3. Encrypt metadata + data records using CT64FILE v1 / AES-256-GCM.
4. FlushFileBuffers.
5. Close the writer key and writer handle.
6. Reopen the actual temp file read-only from disk.
7. Validate header and expected size.
8. Re-derive the key from the stored salt/iteration count and the password.
9. Authenticate/decrypt metadata and every data record.
10. Compare all recovered plaintext bytes against the still-existing source.
11. Rename .$#!.temp -> .$#! with no overwrite and WRITE_THROUGH.
12. Restore original creation/access/write FILETIMEs on the final encrypted file.
13. Apply the source's basic READONLY/HIDDEN/SYSTEM/ARCHIVE state to the final file.
14. ONLY NOW, if the checkbox is unchecked, close the source handle and delete it.

If deletion fails, the verified final .$#! is kept and Cryptext reports that the
original still exists. A read-only source is handled by clearing READONLY only at
this last stage; if deletion then fails, restoration of the original attributes is
attempted best-effort.

Recommended tests
-----------------
A. Checkbox CHECKED: use each disposable boundary file and confirm both source and
   final .$#! remain. Sizes are unchanged from 0.5b.
B. Checkbox UNCHECKED: use fresh COPIES and confirm only the final .$#! remains.
C. Existing-final test: if source.ext.$#! already exists, Cryptext must refuse and
   must not delete or modify the source.
D. Optional: try a read-only disposable source. The final encrypted file must be
   completed first; then the plaintext should be removed if Windows permits it.
E. A large file (hundreds of MB) is useful for observing the temporary hidden file.

Expected encrypted sizes for boundary files
-------------------------------------------
0 bytes        -> 136 bytes
1 byte         -> 153 bytes
4 MiB          -> 4,194,456 bytes
4 MiB + 1 byte -> 4,194,473 bytes

Still NOT enabled
-----------------
- standalone plaintext decryption/output
- Explorer shell integration
- password cache/vault behavior
- free-space fallback to another volume
