what a write attempt did, so a caller can report the names it refused
names the caller cleared, which fall back to the deployed var
allow-listed names whose value is outside LEVER_DOMAINS, left as they were
names the caller sent that are not on KV_OVERRIDABLE
what a write attempt did, so a caller can report the names it refused