bypassed

True when a rejection was downgraded to a warning by the diagnostic escape hatch.

The escape hatch is opt-in, never the default, and never quiet: setting it prints a warning once per process naming both identities. It exists so that a false rejection is not an outage inside an application that cannot patch KiteFFmpeg. It is not a supported configuration, and this flag is here so that no investigation ever starts from a gate that was bypassed silently.