AccessDeniedGate
Corex\Config\Access\AccessDeniedGate · class · Config layer
The menu-level access-denied gate (spec 067, design: “Corex Access & Abilities” → Access denied). WordPress blocks a user who lacks a page’s registered capability BEFORE the page callback runs and fires admin_page_access_denied right before its generic wp_die — so without this gate the designed denied state could never actually be reached. For CoreX pages, this hook publishes the denial to the access audit log (corex_admin_access_denied) and serves the designed request-access surface at a REAL HTTP 403. This class is no longer the whole of CoreX’s error surface. It used to say “it never touches non-CoreX pages”, and that was true in a way nobody had priced: measured on the running install, nine of eleven admin addresses still rendered WordPress’s white box, two of them CoreX’s own post-type screens (specs/083-admin-error-surface/evidence/before/refusal-matrix.md). Spec 083 added {@see \Corex\Admin\Errors\AdminDieHandler}, which catches every other human-facing admin refusal. What stays here is the part that address-specific knowledge makes possible and a generic handler cannot do: telling a refused CoreX screen apart from a CoreX address that was never a screen, and offering a request form for an ability that actually exists.