@enricai/barnacle 1.12.39 → 1.12.41

package/dist/scraper/flow-runner.js

@@ -17,6 +17,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.TRAILING_GRACE_WINDOW = exports.STEP_WATCHDOG_MS = exports.OPENER_PAIRED_HIDDEN_SELECT_EL_EXPR = exports.GOTO_TIMEOUT_MS = exports.waitForSpaReady = void 0;
 exports.mergeResponseHeaders = mergeResponseHeaders;
 exports.wireSignalCapture = wireSignalCapture;
+exports.shouldRetryCaptchaRegistry = shouldRetryCaptchaRegistry;
 exports.prepareFailureDumpBody = prepareFailureDumpBody;
 exports.snapshotPage = snapshotPage;
 exports.findRecentBackendError = findRecentBackendError;
@@ -73,6 +74,7 @@ exports.parseWidgetOptionClickStep = parseWidgetOptionClickStep;
 exports.parseCheckStep = parseCheckStep;
 exports.pollEnumerate = pollEnumerate;
 exports.waitForTransitionBody = waitForTransitionBody;
+exports.hasOriginOrPathChanged = hasOriginOrPathChanged;
 exports.injectCaptchaTokenAndSubmit = injectCaptchaTokenAndSubmit;
 exports.submitCaptchaGatedForm = submitCaptchaGatedForm;
 exports.trySelectPrimitive = trySelectPrimitive;
@@ -110,24 +112,24 @@ const logging_1 = require("../lib/logging");
 const call_capture_1 = require("../lib/telemetry/call-capture");
 const call_types_1 = require("../lib/telemetry/call-types");
 const capture_filters_1 = require("../recon/capture-filters");
-const browser_click_expr_1 = require("../scraper/browser-click-expr");
-const captcha_callback_capture_1 = require("../scraper/captcha-callback-capture");
-const captcha_solver_1 = require("../scraper/captcha-solver");
-const deep_locator_actuate_1 = require("../scraper/deep-locator-actuate");
-const deep_locator_candidates_1 = require("../scraper/deep-locator-candidates");
-const deep_locator_click_1 = require("../scraper/deep-locator-click");
-const deep_locator_scan_1 = require("../scraper/deep-locator-scan");
-const errors_2 = require("../scraper/errors");
-const frame_target_1 = require("../scraper/frame-target");
-const phantom_click_1 = require("../scraper/phantom-click");
-const session_teardown_1 = require("../scraper/session-teardown");
-const spa_readiness_1 = require("../scraper/spa-readiness");
-const stagehand_guard_1 = require("../scraper/stagehand-guard");
-const submit_control_1 = require("../scraper/submit-control");
-const watchdog_1 = require("../scraper/watchdog");
+const browser_click_expr_1 = require("./browser-click-expr");
+const captcha_callback_capture_1 = require("./captcha-callback-capture");
+const captcha_solver_1 = require("./captcha-solver");
+const deep_locator_actuate_1 = require("./deep-locator-actuate");
+const deep_locator_candidates_1 = require("./deep-locator-candidates");
+const deep_locator_click_1 = require("./deep-locator-click");
+const deep_locator_scan_1 = require("./deep-locator-scan");
+const errors_2 = require("./errors");
+const frame_target_1 = require("./frame-target");
+const phantom_click_1 = require("./phantom-click");
+const session_teardown_1 = require("./session-teardown");
+const spa_readiness_1 = require("./spa-readiness");
+const stagehand_guard_1 = require("./stagehand-guard");
+const submit_control_1 = require("./submit-control");
+const watchdog_1 = require("./watchdog");
 const recon_shared_1 = require("../scripts/recon-shared");
 const client_1 = require("../testmail/client");
-var spa_readiness_2 = require("../scraper/spa-readiness");
+var spa_readiness_2 = require("./spa-readiness");
 Object.defineProperty(exports, "waitForSpaReady", { enumerable: true, get: function () { return spa_readiness_2.waitForSpaReady; } });
 const logger = (0, logging_1.getLogger)({ name: "scraper/flow-runner" });
 /** Cap on the rolling capture-filename window held in memory for failure dumps. */
@@ -463,16 +465,52 @@ const PROMPT_TRIGGER_SELECTORS = [
     "[data-automation-id='multiSelectContainer']",
     "[data-automation-id='promptSelectionLabel']",
 ].join(",");
+/**
+ * Cross-vendor selector union for an OPTION rendered inside the opened popup —
+ * standards first (`role=option`), then the widget-kit option markers. Sibling
+ * of {@link PROMPT_TRIGGER_SELECTORS}; same union discipline and guard treatment.
+ */
+const PROMPT_OPTION_SELECTORS = [
+    "[role='option']",
+    "[data-automation-id='promptOption']",
+    "[data-uxi-widget-type='selectinputlistitem']",
+].join(",");
 /**
  * In-page predicate source for `(el) => boolean`: true when `el` is a
  * `<select>` that is a design-system combobox opener's paired-but-hidden
  * shadow control (Base Web `bb-customSelect` and any other vendor matching
- * {@link PROMPT_TRIGGER_SELECTORS}) — a `<select>` with no layout box
- * (`offsetParent === null`, the same idiom `DOM_SNAPSHOT_EXPR` uses for
- * `display:none`-driven hiding classes like `dropdown-hide`) whose nearby
- * container also holds a {@link PROMPT_TRIGGER_SELECTORS} opener element
- * other than itself. The bounded-ancestor-climb-then-subtree-search shape
- * mirrors {@link NEARBY_SELECTION_CONTAINER_FN_SRC}, but searches for
+ * {@link PROMPT_TRIGGER_SELECTORS}). Two independent signals both have to
+ * hold, and each is deliberately technique-agnostic rather than an exact
+ * enumeration: (1) hiddenness — `offsetParent === null`, a zero-size rect,
+ * `display:none`/`visibility:hidden`/`opacity:0`, off-screen positioning, OR
+ * any of the layout-fingerprint checks that generalize across the remaining
+ * CSS hiding techniques (`hasTinyFootprint` for the sr-only clip idiom and
+ * `transform:scale(0)`'s collapsed rect, a parsed `clip:` rect of zero area,
+ * an active `clip-path`, a `scale(0)`/zero `matrix()` transform, or an
+ * ancestor whose own box is collapsed to near-zero while clipping overflow)
+ * — and (2) opener-pairing — described below — which is what makes the
+ * hiddenness check safe to broaden: a false-positive on hiddenness alone
+ * (e.g. some other reason a real, standalone select reports a tiny rect)
+ * still can't misfire unless that same select also sits paired with a
+ * rendered combobox opener, which an ordinary select never does. Signal (2)
+ * requires the select's nearby container to also hold a
+ * {@link PROMPT_TRIGGER_SELECTORS} opener element, other than itself, that is
+ * ARIA-wired to a listbox panel — via `aria-owns`/`aria-controls`/
+ * `aria-haspopup="listbox"` declared on the opener (accepted unresolved only
+ * when the opener sits in the select's own immediate container, since many
+ * widgets mount their popup lazily on first open and haven't rendered it
+ * yet), or, once the referenced id does resolve (at any climbed depth), only
+ * when the target actually is `role=listbox` or contains a
+ * {@link PROMPT_OPTION_SELECTORS} match, or, for an opener declaring no
+ * owns/controls/haspopup at all, a {@link PROMPT_OPTION_SELECTORS} match
+ * rendered in THAT OPENER's own immediate container (never the whole climbed
+ * ancestor — scanning the ancestor would credit an unrelated already-open
+ * widget elsewhere in a shared ancestor as this select's pairing). Requiring
+ * resolution past the immediate container keeps the broadened hidden test
+ * from misclassifying an unrelated widget elsewhere in a shared ancestor as
+ * a paired shadow select.
+ * The bounded-ancestor-climb-then-subtree-search shape mirrors
+ * {@link NEARBY_SELECTION_CONTAINER_FN_SRC}, but searches for
  * {@link PROMPT_TRIGGER_SELECTORS} instead of the selection-marker union —
  * this ties "opener" to the exact same union `tryPromptSelectorPrimitive`
  * recognizes, so a select is excluded precisely when the primitive that
@@ -483,26 +521,70 @@ const PROMPT_TRIGGER_SELECTORS = [
  * when the opener's own readback is inconclusive.
  */
 exports.OPENER_PAIRED_HIDDEN_SELECT_EL_EXPR = `(el) => {
-    if (!el || el.tagName !== "SELECT" || el.offsetParent !== null) return false;
+    if (!el || el.tagName !== "SELECT") return false;
+    const rect = el.getBoundingClientRect();
+    const style = getComputedStyle(el);
+    const isOffscreen = rect.right <= 0 || rect.bottom <= 0 || rect.left >= window.innerWidth || rect.top >= window.innerHeight;
+    // A near-zero footprint (<=1px either dimension) is the layout-level fingerprint
+    // shared by the classic sr-only clip technique (explicit width:1px;height:1px) and
+    // a real browser's transform:scale(0) (which collapses the bounding rect itself) —
+    // technique-agnostic, unlike enumerating every CSS property that can shrink a box.
+    const hasTinyFootprint = rect.width <= 1 || rect.height <= 1;
+    const clipMatch = /rect\\(\\s*([\\d.]+)px[,\\s]+([\\d.]+)px[,\\s]+([\\d.]+)px[,\\s]+([\\d.]+)px\\s*\\)/.exec(style.clip || "");
+    const isClipZeroArea = !!clipMatch && (parseFloat(clipMatch[3]) - parseFloat(clipMatch[1]) <= 0 || parseFloat(clipMatch[2]) - parseFloat(clipMatch[4]) <= 0);
+    // Only treat clip-path as a hiding signal when it collapses the element to
+    // zero visible area (circle(0), inset(50%), a degenerate polygon whose
+    // points share a single coordinate) — a decorative clip-path (rounded
+    // corners, an avatar circle) leaves the element fully visible and must
+    // not be misread as hidden.
+    const cp = style.clipPath || "";
+    const hasClipPath = /circle\\(\\s*0(?:px|%)?\\s*(?:at\\s[^)]*)?\\)/i.test(cp) || /ellipse\\(\\s*0(?:px|%)?\\s+0(?:px|%)?\\s*(?:at\\s[^)]*)?\\)/i.test(cp) || /inset\\(\\s*50%\\s*\\)/i.test(cp) || /polygon\\(\\s*(?:0%?\\s+0%?\\s*,?\\s*)+\\)/i.test(cp);
+    const hasZeroScale = /scale\\(\\s*0(?:\\.0+)?\\s*(?:,\\s*0(?:\\.0+)?\\s*)?\\)/.test(style.transform || "") || /matrix\\(\\s*0\\s*,\\s*0\\s*,\\s*0\\s*,\\s*0\\s*,/.test(style.transform || "");
+    // Ancestor overflow-clipping: a wrapper with overflow:hidden collapsed to a
+    // near-zero box clips its whole subtree to invisibility even though the
+    // select's own box, style and offsetParent all look ordinary.
+    const isAncestorClipped = (() => {
+      let anc = el.parentElement;
+      for (let d = 0; d < ${browser_click_expr_1.MAX_SELECTION_ANCESTOR_DEPTH} && anc; d++) {
+        const ancStyle = getComputedStyle(anc);
+        const overflowHides = ancStyle.overflow === "hidden" || ancStyle.overflow === "clip" || ancStyle.overflowX === "hidden" || ancStyle.overflowY === "hidden";
+        if (overflowHides) {
+          const ancRect = anc.getBoundingClientRect();
+          if (ancRect.width <= 1 || ancRect.height <= 1) return true;
+        }
+        anc = anc.parentElement;
+      }
+      return false;
+    })();
+    const isHidden = el.offsetParent === null || (rect.width === 0 && rect.height === 0) || style.display === "none" || style.visibility === "hidden" || parseFloat(style.opacity) === 0 || isOffscreen || hasTinyFootprint || isClipZeroArea || hasClipPath || hasZeroScale || isAncestorClipped;
+    if (!isHidden) return false;
     const triggerSel = ${JSON.stringify(PROMPT_TRIGGER_SELECTORS)};
+    const optionSel = ${JSON.stringify(PROMPT_OPTION_SELECTORS)};
+    const hasRenderedPanel = (opener, allowUnresolvedDeclaration) => {
+      const ownsId = opener.getAttribute("aria-owns") || opener.getAttribute("aria-controls");
+      const target = ownsId ? document.getElementById(ownsId) : null;
+      if (target) return target.getAttribute("role") === "listbox" || target.querySelector(optionSel) !== null;
+      if (!allowUnresolvedDeclaration) return false;
+      if (!!ownsId || opener.getAttribute("aria-haspopup") === "listbox") return true;
+      return !!(opener.parentElement && opener.parentElement.querySelector(optionSel));
+    };
     let node = el.parentElement;
     for (let depth = 0; depth < ${browser_click_expr_1.MAX_SELECTION_ANCESTOR_DEPTH} && node; depth++) {
       const openers = node.querySelectorAll ? Array.from(node.querySelectorAll(triggerSel)) : [];
-      if (openers.some((opener) => opener !== el)) return true;
+      // Only the select's own immediate container may pair on a merely-declared
+      // (not-yet-rendered) aria-owns/aria-controls/aria-haspopup target — an
+      // opener found only by climbing further up must have its panel actually
+      // resolve, or an unrelated sibling widget elsewhere in a shared ancestor
+      // (e.g. a distant visible field's own opener) would false-positive. An
+      // opener with no ARIA pairing declaration at all is credited only when
+      // an option-shaped element sits in ITS OWN immediate container — never
+      // by scanning the whole climbed ancestor, which would credit an
+      // unrelated already-open widget elsewhere in a shared ancestor.
+      if (openers.some((opener) => opener !== el && hasRenderedPanel(opener, depth === 0))) return true;
       node = node.parentElement;
     }
     return false;
   }`;
-/**
- * Cross-vendor selector union for an OPTION rendered inside the opened popup —
- * standards first (`role=option`), then the widget-kit option markers. Sibling
- * of {@link PROMPT_TRIGGER_SELECTORS}; same union discipline and guard treatment.
- */
-const PROMPT_OPTION_SELECTORS = [
-    "[role='option']",
-    "[data-automation-id='promptOption']",
-    "[data-uxi-widget-type='selectinputlistitem']",
-].join(",");
 /**
  * Cross-vendor selector union for an in-popup filter/typeahead input — standards
  * first, then the widget-kit's bare filter `<input>` (which carries no
@@ -636,6 +718,31 @@ const ADVANCE_TRANSITION_POLL_INTERVAL_MS = 350;
  * {@link ADVANCE_TRANSITION_POLL_MS} unchanged.
  */
 const CAPTCHA_TRANSITION_POLL_MS = 45_000;
+/**
+ * Bounded retry budget for the captchaGated solve+inject+registryState-check
+ * sequence. The registry-empty/absent condition (the hCaptcha render callback
+ * hasn't attached to `HCAPTCHA_CALLBACK_REGISTRY_GLOBAL` yet when the solve
+ * finishes) is an intermittent attach-timing race, not a deterministic
+ * failure, so a single attempt is too eager to give up. Mirrors the
+ * MAX_STEP_ATTEMPTS/PRIMITIVE_ENUMERATE_ATTEMPTS=5 naming precedent, but a
+ * captcha solve is expensive (10-30s+ round trip via a real solver service),
+ * so the budget is kept small.
+ */
+const CAPTCHA_REGISTRY_RETRY_ATTEMPTS = 3;
+/**
+ * Pure decision gate for the captchaGated registry-retry loop: isolates the
+ * retry-vs-give-up call from the solve+inject+poll I/O so the attach-timing
+ * race (registry empty/absent, or a callback that fired without a confirmed
+ * transition) can be pinned with a unit test independent of any browser
+ * evaluate() call.
+ */
+function shouldRetryCaptchaRegistry(attemptNumber, maxAttempts, registryState, callbackDiscovered, confirmed) {
+    if (confirmed)
+        return false;
+    const registryRace = registryState === "empty" || registryState === "absent";
+    const callbackFiredButNoNav = callbackDiscovered && !confirmed;
+    return (registryRace || callbackFiredButNoNav) && attemptNumber < maxAttempts;
+}
 /**
  * Attempts to decode opaque request parameters: tries JSON parse, then
  * URL-decode, then base64. Returns the decoded value or null if none worked.
@@ -4374,6 +4481,52 @@ async function waitForTransitionBody(params) {
     }
     return false;
 }
+/**
+ * Reduces a URL to origin+pathname (query/hash ignored) so a captcha
+ * target's post-submit `url()` can be compared to its pre-submit baseline
+ * without a same-page query-string change (e.g. a step counter) registering
+ * as a false advance. Unparseable URLs compare equal only to themselves.
+ */
+function originAndPathOf(url) {
+    try {
+        const parsed = new URL(url);
+        return `${parsed.origin}${parsed.pathname}`;
+    }
+    catch {
+        return url;
+    }
+}
+/**
+ * Credits a captchaGated advance from an observed navigation: true only
+ * when origin or pathname actually changed, so a same-page query-string
+ * mutation (e.g. a step counter) never counts as an advance.
+ */
+function hasOriginOrPathChanged(preUrl, postUrl) {
+    return originAndPathOf(preUrl) !== originAndPathOf(postUrl);
+}
+/**
+ * Polls the captcha target's URL for an origin/path change after a
+ * multipart form submit, which navigates the page without producing any
+ * matchable XHR body for {@link waitForTransitionBody} to catch — the
+ * regex-based poll alone silently misses a full-page submit advance. Runs
+ * independently of whether `advanceTransitionBodyPattern` is configured.
+ */
+async function waitForCaptchaNavigation(params) {
+    const { page, captchaTarget, baselineUrl, timeoutMs, intervalMs } = params;
+    const check = async () => {
+        const currentUrl = await captchaTarget.url().catch(() => baselineUrl);
+        return hasOriginOrPathChanged(baselineUrl, currentUrl);
+    };
+    if (await check())
+        return true;
+    const deadline = performance.now() + timeoutMs;
+    while (performance.now() < deadline) {
+        await page.waitForTimeout(intervalMs);
+        if (await check())
+            return true;
+    }
+    return false;
+}
 /**
  * Shared in-page discovery of the widget's callback, used identically by
  * `injectCaptchaTokenAndSubmit`'s precheck (to decide the branch) and its
@@ -7552,49 +7705,48 @@ async function executeStepWithHealing(params) {
             const pageUrl = await captchaTarget.url();
             const uaRaw = await page.evaluate("navigator.userAgent").catch(() => null);
             const userAgent = typeof uaRaw === "string" ? uaRaw : undefined;
-            const solved = await (0, captcha_solver_1.solveCaptcha)({
-                type: "hcaptcha",
-                siteKey,
-                pageUrl,
-                isInvisible,
-                userAgent,
-            }).catch((err) => {
-                logger.error(`${formatStepPrefix(stepIndex, totalSteps)} captchaGated step: solve failed (${(0, errors_1.toErrorMessage)(err)}); failing the step rather than silently proceeding`);
-                throw err;
-            });
-            const preCaptchaCaptureIdx = latestCaptureIndex(recentCaptures);
-            const injectResult = await injectCaptchaTokenAndSubmit(captchaTarget, solved.token);
-            const registryState = await captchaTarget.evaluate(`(() => {
+            // Bounded retry around the solve+inject+registryState-check+poll unit:
+            // the registry-empty/absent condition is an intermittent attach-timing
+            // race (the render callback hasn't registered by the time the solve
+            // finishes), not a deterministic failure, so a single attempt is too
+            // eager to give up and route straight to a global replan. Also retries
+            // when the widget's own callback fired (callbackDiscovered) but neither
+            // transition poll below confirmed an advance — the callback-fired-but-
+            // no-nav case is the same underlying race from the other side.
+            for (let captchaAttempt = 1; captchaAttempt <= CAPTCHA_REGISTRY_RETRY_ATTEMPTS; captchaAttempt++) {
+                if (captchaAttempt > 1) {
+                    // Re-assert the capture install in the target frame before
+                    // retrying: a late-attaching registry may not exist yet on the
+                    // first attempt, and re-running this idempotent install gives a
+                    // widget that renders on demand another chance to be caught.
+                    await captchaTarget.evaluate((0, captcha_callback_capture_1.buildHcaptchaCallbackCaptureScript)()).catch(() => undefined);
+                }
+                const solved = await (0, captcha_solver_1.solveCaptcha)({
+                    type: "hcaptcha",
+                    siteKey,
+                    pageUrl,
+                    isInvisible,
+                    userAgent,
+                }).catch((err) => {
+                    logger.error(`${formatStepPrefix(stepIndex, totalSteps)} captchaGated step: solve failed (${(0, errors_1.toErrorMessage)(err)}); failing the step rather than silently proceeding`);
+                    throw err;
+                });
+                const preCaptchaCaptureIdx = latestCaptureIndex(recentCaptures);
+                const injectResult = await injectCaptchaTokenAndSubmit(captchaTarget, solved.token);
+                const registryState = await captchaTarget.evaluate(`(() => {
           const registry = window[${JSON.stringify(captcha_callback_capture_1.HCAPTCHA_CALLBACK_REGISTRY_GLOBAL)}];
           if (!registry) return "absent";
           return Object.keys(registry).length === 0 ? "empty" : "populated";
         })()`);
-            logger.info(`${formatStepPrefix(stepIndex, totalSteps)} captchaGated step: token injected=${injectResult.injected} hasForm=${injectResult.hasForm} callbackDiscovered=${injectResult.callbackDiscovered} registryState=${registryState}`);
-            // Reuse the EXISTING waitForTransitionBody poll (no new captcha-specific
-            // poll loop), just with a widened budget so the solve+submit round trip
-            // doesn't eat into the plain ADVANCE_TRANSITION_POLL_MS window. A
-            // pattern-confirmed transition here is treated as verified the same way
-            // the probe-absent branch below treats a detected transition — the
-            // normal cascade/verifier still runs when the pattern doesn't confirm
-            // (or none is configured), so this never replaces that verifier.
-            let confirmed = false;
-            if (advanceTransitionBodyPattern) {
-                confirmed = await waitForTransitionBody({
-                    page,
-                    preIdx: preCaptchaCaptureIdx,
-                    advanceTransitionBodyPattern,
-                    timeoutMs: CAPTCHA_TRANSITION_POLL_MS,
-                    intervalMs: ADVANCE_TRANSITION_POLL_INTERVAL_MS,
-                });
-                logger.info(`${formatStepPrefix(stepIndex, totalSteps)} captchaGated step: post-submit transition poll confirmed=${confirmed}`);
-            }
-            // Some widgets' own render callback already submitted the form as a
-            // side effect of the inject (the poll above would have confirmed it);
-            // only issue an explicit submit when no transition was observed AND a
-            // form is known to exist to submit — otherwise this would double-submit
-            // a form the widget's own callback already advanced.
-            if (!confirmed && injectResult.hasForm) {
-                await submitCaptchaGatedForm(captchaTarget);
+                logger.info(`${formatStepPrefix(stepIndex, totalSteps)} captchaGated step: attempt=${captchaAttempt}/${CAPTCHA_REGISTRY_RETRY_ATTEMPTS} token injected=${injectResult.injected} hasForm=${injectResult.hasForm} callbackDiscovered=${injectResult.callbackDiscovered} registryState=${registryState}`);
+                // Reuse the EXISTING waitForTransitionBody poll (no new captcha-specific
+                // poll loop), just with a widened budget so the solve+submit round trip
+                // doesn't eat into the plain ADVANCE_TRANSITION_POLL_MS window. A
+                // pattern-confirmed transition here is treated as verified the same way
+                // the probe-absent branch below treats a detected transition — the
+                // normal cascade/verifier still runs when the pattern doesn't confirm
+                // (or none is configured), so this never replaces that verifier.
+                let confirmed = false;
                 if (advanceTransitionBodyPattern) {
                     confirmed = await waitForTransitionBody({
                         page,
@@ -7603,24 +7755,71 @@ async function executeStepWithHealing(params) {
                         timeoutMs: CAPTCHA_TRANSITION_POLL_MS,
                         intervalMs: ADVANCE_TRANSITION_POLL_INTERVAL_MS,
                     });
-                    logger.info(`${formatStepPrefix(stepIndex, totalSteps)} captchaGated step: post-fallback-submit transition poll confirmed=${confirmed}`);
+                    logger.info(`${formatStepPrefix(stepIndex, totalSteps)} captchaGated step: post-submit transition poll confirmed=${confirmed}`);
                 }
-            }
-            if (confirmed) {
-                trajectory?.push({ stepIndex, verifiedBy: "network" });
-                return "completed";
-            }
-            // No render-config callback was discoverable AND neither the inject's
-            // own submit path nor the explicit fallback submit produced a
-            // confirmed transition: the token was never actually delivered
-            // through the site's own submit machinery. Fail loudly instead of
-            // falling through to the normal cascade as if the solve had worked —
-            // that's exactly the misleading "token injected=true" silent no-op
-            // this hook must not produce. Only applies when a pattern is actually
-            // configured to poll for — with none configured, no poll ever ran, so
-            // there's nothing here to contradict the normal cascade/verifier.
-            if (advanceTransitionBodyPattern && !injectResult.callbackDiscovered) {
-                throw new errors_2.CaptchaError(`${formatStepPrefix(stepIndex, totalSteps)} captchaGated step: no render-config callback could be found and delivered, and no transition was confirmed after the solve`);
+                // Some widgets' own render callback already submitted the form as a
+                // side effect of the inject (the poll above would have confirmed it);
+                // only issue an explicit submit when no transition was observed AND a
+                // form is known to exist to submit — otherwise this would double-submit
+                // a form the widget's own callback already advanced.
+                if (!confirmed && injectResult.hasForm) {
+                    await submitCaptchaGatedForm(captchaTarget);
+                    if (advanceTransitionBodyPattern) {
+                        confirmed = await waitForTransitionBody({
+                            page,
+                            preIdx: preCaptchaCaptureIdx,
+                            advanceTransitionBodyPattern,
+                            timeoutMs: CAPTCHA_TRANSITION_POLL_MS,
+                            intervalMs: ADVANCE_TRANSITION_POLL_INTERVAL_MS,
+                        });
+                        logger.info(`${formatStepPrefix(stepIndex, totalSteps)} captchaGated step: post-fallback-submit transition poll confirmed=${confirmed}`);
+                    }
+                }
+                if (confirmed) {
+                    trajectory?.push({ stepIndex, verifiedBy: "network" });
+                    return "completed";
+                }
+                // A full-page multipart form submit (no matching XHR body, or no
+                // pattern configured at all) still navigates the page — that's a
+                // real advance the requestPostData-based poll above can never see.
+                // This poll runs regardless of whether advanceTransitionBodyPattern
+                // is set: it's an additional signal, not a replacement for the
+                // pattern-based one.
+                const navigationConfirmed = await waitForCaptchaNavigation({
+                    page,
+                    captchaTarget,
+                    baselineUrl: pageUrl,
+                    timeoutMs: CAPTCHA_TRANSITION_POLL_MS,
+                    intervalMs: ADVANCE_TRANSITION_POLL_INTERVAL_MS,
+                });
+                if (navigationConfirmed) {
+                    logger.info(`${formatStepPrefix(stepIndex, totalSteps)} captchaGated step: post-submit navigation to a new origin/path confirmed the advance`);
+                    trajectory?.push({ stepIndex, verifiedBy: "url" });
+                    return "completed";
+                }
+                // The intermittent race this loop exists for: a still-empty/absent
+                // registry means the callback attach hadn't landed when this attempt
+                // solved+injected, and a discovered-but-unconfirmed callback means it
+                // fired without a poll seeing the resulting transition. Both are
+                // worth another attempt within budget rather than an immediate throw.
+                if (shouldRetryCaptchaRegistry(captchaAttempt, CAPTCHA_REGISTRY_RETRY_ATTEMPTS, registryState, injectResult.callbackDiscovered, confirmed)) {
+                    logger.info(`${formatStepPrefix(stepIndex, totalSteps)} captchaGated step: registryState=${registryState} callbackDiscovered=${injectResult.callbackDiscovered} with no confirmed transition on attempt ${captchaAttempt}; retrying`);
+                    continue;
+                }
+                // No render-config callback was discoverable AND neither the inject's
+                // own submit path nor the explicit fallback submit produced a
+                // confirmed transition, network or navigation: the token was never
+                // actually delivered through the site's own submit machinery. Fail
+                // loudly instead of falling through to the normal cascade as if the
+                // solve had worked — that's exactly the misleading "token
+                // injected=true" silent no-op this hook must not produce. Only
+                // applies when a pattern is actually configured to poll for — with
+                // none configured, no network poll ever ran, so there's nothing here
+                // to contradict the normal cascade/verifier.
+                if (advanceTransitionBodyPattern && !injectResult.callbackDiscovered) {
+                    throw new errors_2.CaptchaError(`${formatStepPrefix(stepIndex, totalSteps)} captchaGated step: no render-config callback could be found and delivered, and no transition was confirmed after the solve`);
+                }
+                break;
             }
         }
     }