How the WordPress 6.9 Abilities API affects custom roles
A client’s custom roles suddenly locked users out after WordPress 6.9 shipped its Abilities API. The fix was to register capabilities and map_meta_cap the way core now expects, not to brute-force add_cap calls.