Sub-ticket of PLUTO-44 Defense-in-depth: render-path requireCapForAction throw should render graceful acceso-denegado, not 500 + admin error-email storm (generic error-boundary / convert render-path cap checks to redirect variant). Surfaced by PLUTO-43 (dead-fetch was the trigger; this guards the class). · pluto