In addressing the buffer ownership API, I discovered a rogue member function that returned by value rather than by reference. It clearly intended to return by reference, but because the copy ctor wasn't deleted this wasn't caught.
It is not necessary to make this a move-only type, although that would be an alternative.