Across a portfolio of WordPress sites with restrictive admin policies — read-only WPCode, KSES filtering on inline scripts, role-capped Custom Code, Cloudflare WAF rules blocking admin script POSTs — the solution was to stop fighting the CMS and solve the problem at the edge...