Upgraded my MacBook Pro and all was fine.
Next upgraded my iMac and all seemed pretty good until… I tried to use Infuse from my ATV.
Suddenly Infuse could no longer see the SMB shares on the iMac. Turns out there’s an undocumented feature that means you have to give SMB full disk access in system preferences if your shares are on external drives.
And then I realised my CRON jobs weren’t working and likewise needed to add CRON to full disk access, again undocumented as far as I can see.
Don’t understand why they’d do this and especially not document it.