Incremental encryption compatible with released clients.
Write nonce, each update result, and the final authentication tag to a private staged file. Publish that file only after finish succeeds.
Fresh 12-byte nonce that must prefix the encrypted output.
Zeroize state and reject further updates without publishing output.
Cancel unfinished work and release the native stream.
Finalize authentication and return hashes plus the tag to append.
Encrypt the next plaintext chunk and return its ciphertext bytes.