Caddy told every client that asked app.bsky.unspecced.getAgeAssuranceState that the account was assured. With the override off, Tranquil forwards age-assurance calls that carry atproto-proxy to Bluesky's AppView, which knows whether the account has been through age assurance. Tranquil still answers "assured" itself to clients that don't send the header.