fn require_unsealed(file: &File, path: &Path) -> Result<()>
Query a retained source’s sealing state without opening a mutable pathname.