ZCC forwarding decision explainer
Paste a Client Connector posture (network state, ZIA action, tunnel version) and read the documented forwarding spine back layer by layer - with the bypass mechanisms explained, and the reason this is an explainer rather than a simulator stated up front.
NetworkingPaste setting lines like "network = off-trusted" and "zia-action = tunnel" to walk the documented decision spine.