what enforceReadOnly did, so a caller can assert the surface was actually covered
whether a mutating inner function was reached; must be false before a primary retry
refusals so far this request, most recent last
every capability the guard wrapped, with its verdict
what enforceReadOnly did, so a caller can assert the surface was actually covered