Let BitLocker judge the password, and say what it will want

README.md

@@ -118,7 +118,7 @@ After the drive exists, every setting is read back off the volume and reported -
 - **On a machine that denies write access to unencrypted fixed drives, BitLocker is not optional.** The setting is `FDVDenyWriteAccess` under `HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FVE`. Without encryption the new drive mounts read-only and the run stops at the write check, having already made the partition. The run reads that setting and says so before the BitLocker question
 - **Windows may open its own encryption prompt** on such a machine while the script is already encrypting. Leave it alone - answering it only produces "BitLocker encryption already enabled"
 - **A BitLocker failure does not end the run.** It offers retry, carry on without it, or stop, and says what state the drive is in either way. A refusal by group policy is not offered a retry that would meet the same refusal
-- **The recovery key is printed once and must be acknowledged.** Outside Entra ID it exists nowhere but on the volume and on the paper you write it on. A password is asked for in virtual hard disk mode only, and must be complex - 8 to 256 printable ASCII characters with upper, lower, digit and special. The ceiling and the ASCII rule are refusals BitLocker answers by its own error code; the floor and the four character classes are this script's own and are stricter than BitLocker's default, so a long passphrase it would have taken is refused here, and group policy can still refuse one this accepts
+- **The recovery key is printed once and must be acknowledged.** Outside Entra ID it exists nowhere but on the volume and on the paper you write it on. A password is asked for in virtual hard disk mode only. **The script does not judge it - BitLocker does.** Whatever you type is handed straight to Windows, and if Windows refuses it you are told what it said and asked for another. Measured on an unmanaged machine, that means at least 8 and at most 256 characters and nothing else: no character classes, and non-ASCII accepted. Group policy can require more, and a domain controller can require the password to meet the domain's complexity rules
 - **Where automatic unlocking cannot be set up** - Windows requires the operating system drive to be BitLocker-protected first - the drive has to be unlocked by hand after every restart
 - **A `.vhdx` carried to another machine loses its trusted designation.** See [Carrying the file to another machine](#carrying-the-file-to-another-machine)
 - **Do not run `compact vdisk` against a deduplicated `.vhdx`** without a backup. See [BitLocker and deduplication inside a virtual hard disk](#bitlocker-and-deduplication-inside-a-virtual-hard-disk)