Was pulling CSRF from a meta tag that doesn't exist; the POST landed without a valid token and the server dropped it before the plugin handler could reply. Use the imported csrf() helper like the rest of the suite does. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>