This commit also documents (but doesn't enforce) that filters
are immutable while they're installed. This required a minor API
change.