What probably matters to youSection of the release
What
Permission code no longer hardcodes a single circuit-breaker name when deciding what cannot be bypassed, and cross-machine isolation denials now survive the bypass path.
Details
A table marks each circuit breaker as bypassImmune / classifierRouted: dangerousRemoval, backgroundOperator, suspiciousWindowsPath, isolatePeerMachines. Previously only dangerousRemoval was checked directly.
The isolatePeerMachines file-transfer denial now stamps circuitBreaker: "isolatePeerMachines" on its decision reason, which makes it bypass-immune in the multi-cd ask path.
The isolatePeerMachines setting still has to be enabled for that breaker to fire at all.
Evidence
isBypassImmuneCircuitBreaker
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
