captchakraken 2.6.1 → 2.9.0

package/dist/solver.js

@@ -34,14 +34,18 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CaptchaKrakenSolver = exports.SOLVE_DEFAULTS = void 0;
+exports.answerNeedsElementBox = answerNeedsElementBox;
+exports.isStaleHandleError = isStaleHandleError;
+exports.burstHangDeadlineMs = burstHangDeadlineMs;
 const watcher_1 = require("./watcher");
-const trajectory_js_1 = require("./trajectory.js");
+const humanize_js_1 = require("./humanize.js");
 const child_process_1 = require("child_process");
 const util_1 = require("util");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
 const crypto_1 = require("crypto");
+const timing_1 = require("./timing");
 const token_usage_1 = require("./token-usage");
 const errors_1 = require("./errors");
 const limits_1 = require("./limits");
@@ -138,14 +142,84 @@ var CaptchaState;
  */
 const VENDOR_WIDGET_LOCATORS = [
     { puzzleSource: 'geetest', selectors: ['.geetest_box', '.geetest_panel_box', '.geetest_popup_window', '.geetest_widget'] },
-    { puzzleSource: 'tencent', selectors: ['iframe#tcaptcha_iframe_dy', 'iframe[id*="tcaptcha"]', 'iframe[src*="captcha.gtimg.com"]', 'iframe[src*="captcha.qq.com"]'] },
+    // Tencent renders IN THE HOST DOCUMENT since 2026-08-11; before that it was
+    // `iframe#tcaptcha_iframe_dy`. Both shapes are listed, in-page first, because
+    // the iframe build is still deployed on sites pinning an older widget and
+    // costs nothing to keep. Dropping the in-page selectors is what made the
+    // client blind to every live Tencent captcha for twelve days.
+    //
+    // `iframe[id^="tcaptcha"]`, NOT `[id*=...]`. The substring form also matched
+    // MTCaptcha's `mtcaptcha-iframe-1` — "mtcaptcha" contains "tcaptcha" — so
+    // Tencent's entry was silently the only thing detecting MTCaptcha at all,
+    // which is why `.mtcap` matching nothing went unnoticed. Anchored, it still
+    // matches the real `tcaptcha_iframe_dy` and claims nobody else's widget.
+    { puzzleSource: 'tencent', selectors: ['#tcaptcha_transform_dy', '#tCaptchaDyContent', '.tencent-captcha-dy__content', 'iframe#tcaptcha_iframe_dy', 'iframe[id^="tcaptcha"]', 'iframe[src*="captcha.gtimg.com"]', 'iframe[src*="captcha.qq.com"]'] },
     { puzzleSource: 'yidun', selectors: ['.yidun_panel', '.yidun'] },
-    { puzzleSource: 'yandex', selectors: ['.CheckboxCaptcha'] },
+    // Yandex SmartCaptcha is IFRAMED, and `.CheckboxCaptcha` is a class inside
+    // that frame's document — querySelector does not cross a frame boundary, so
+    // the host page never carried it and this entry matched nothing, ever.
+    // Challenge frame first, anchor second, exactly like reCAPTCHA above.
+    // `.CheckboxCaptcha` stays for an inline embed that renders it directly.
+    { puzzleSource: 'yandex', selectors: ['iframe[src*="smartcaptcha.yandexcloud.net/advanced"]', 'iframe[src*="smartcaptcha.yandexcloud.net"]', '.CheckboxCaptcha'] },
     { puzzleSource: 'lemin', selectors: ['#lemin-cropped-captcha', '.lemin-captcha-popup'] },
     { puzzleSource: 'prosopo', selectors: ['.prosopo-modalInner', '.procaptcha-checkbox'] },
-    { puzzleSource: 'mtcaptcha', selectors: ['.mtcap'] },
+    // MTCaptcha is IFRAMED too: `<div class="mtcaptcha"><iframe
+    // id="mtcaptcha-iframe-1" src="https://service.mtcaptcha.com/...">`. `.mtcap`
+    // is the class prefix used INSIDE that frame (`mtcap-inputtext`), and a CSS
+    // class selector matches whole tokens, so it never matched the host page's
+    // `class="mtcaptcha"` either. Kept last for an inline embed.
+    { puzzleSource: 'mtcaptcha', selectors: ['iframe[src*="service.mtcaptcha.com"]', 'iframe[id^="mtcaptcha-iframe"]', '.mtcaptcha', '.mtcap'] },
     { puzzleSource: 'botdetect', selectors: ['.BDC_CaptchaDiv'] },
 ];
+/**
+ * Which vendor's code the page LOADED, as opposed to what it rendered.
+ * Mirrors VENDOR_URL_MARKERS in page_solver.py — CLAUDE.md 1c.
+ *
+ * A selector is a claim about markup, and markup is the half of a captcha the
+ * vendor is free to rewrite overnight — it is an anti-bot surface, so churn is
+ * the point. The REQUEST is far more stable: Tencent moved its widget out of an
+ * iframe and renamed every class on 2026-08-11, and went on fetching from
+ * `turing.captcha.gtimg.com` and `turing.captcha.qcloud.com` throughout. The
+ * substring `captcha.gtimg.com` — already in the table above, on a selector
+ * that stopped matching — never left the wire.
+ *
+ * This is a TRIPWIRE, not a detection path. A URL says which vendor is on the
+ * page; it cannot say where the widget is, and the solver needs an ELEMENT to
+ * screenshot, to scope its controls against, and to drag. What it buys is
+ * telling apart the two things a null detection can mean: no captcha here, or
+ * the vendor's code is loaded and running and nothing we look for matches.
+ *
+ * Hosts measured 2026-08-24 from each vendor's demo page.
+ */
+/**
+ * The two vendors with bespoke handling in this file. EVERYTHING else shares the
+ * generic path, and the two behaviours below are gated on "not one of these" —
+ * spelled as this set rather than as `=== 'unknown'`, which is what they used to
+ * say. The two were identical only while `unknown` was the sole third value, so
+ * the day anyone reports a vendor by name — to constrain which grid shapes it may
+ * be solved as, say — `=== 'unknown'` silently turns OFF typed-challenge detection
+ * for MTCaptcha, Yandex and BotDetect (all three ARE typed captchas) and the
+ * animated settle probe for GeeTest and Tencent. Neither failure throws; the text
+ * captcha just becomes unsolvable and the animated board gets answered from one
+ * arbitrary frame. Mirrors VENDORS_WITH_BESPOKE_HANDLING in page_solver.py.
+ */
+const VENDORS_WITH_BESPOKE_HANDLING = new Set(['hcaptcha', 'recaptcha']);
+const VENDOR_URL_MARKERS = [
+    { puzzleSource: 'hcaptcha', hosts: ['hcaptcha.com'] },
+    { puzzleSource: 'recaptcha', hosts: ['google.com/recaptcha', 'recaptcha.net'] },
+    { puzzleSource: 'turnstile', hosts: ['challenges.cloudflare.com'] },
+    { puzzleSource: 'geetest', hosts: ['geetest.com'] },
+    { puzzleSource: 'tencent', hosts: ['captcha.gtimg.com', 'captcha.qcloud.com'] },
+    { puzzleSource: 'yidun', hosts: ['dun.163.com', 'cstaticdun.126.net', 'necaptcha.nosdn.127.net'] },
+    { puzzleSource: 'yandex', hosts: ['smartcaptcha.yandexcloud.net'] },
+    { puzzleSource: 'lemin', hosts: ['leminnow.com'] },
+    { puzzleSource: 'prosopo', hosts: ['prosopo.io'] },
+    { puzzleSource: 'mtcaptcha', hosts: ['mtcaptcha.com'] },
+    // BotDetect is deliberately absent and must stay absent: it is a SELF-HOSTED
+    // library, so the image comes from the application's own origin and there is
+    // no vendor host to see. An empty result for a BotDetect page means "this
+    // check does not apply", not "no captcha".
+];
 /**
  * Where the answer goes, when it is not a click. Mirrors TEXT_INPUT_SELECTORS /
  * SLIDER_HANDLE_SELECTORS / DRAGGABLE_PIECE_SELECTORS in page_solver.py — keep
@@ -161,7 +235,12 @@ const VENDOR_WIDGET_LOCATORS = [
  * pages. Vendors rename these classes without notice, and our own Tier 3
  * fixtures render neither vendor's DOM.
  */
-const TEXT_INPUT_SELECTORS = [
+// Split in two because the two halves are safe in different places. The NAMED
+// half identifies a captcha's answer box wherever it sits; the GENERIC half only
+// means "the text box in this widget" and is trustworthy only when the scope
+// already is the widget. `answerBox` widens past the widget for BotDetect and
+// may take the named half with it, never the generic one.
+const TEXT_INPUT_VENDOR_SELECTORS = [
     // BotDetect — the input is application-defined, so match the id fragment its
     // own docs and samples use (the three the nightly collector already drives).
     'input[id*=captchaCode]',
@@ -175,6 +254,8 @@ const TEXT_INPUT_SELECTORS = [
     '.AdvancedCaptcha-Input input',
     'input.Textinput-Control',
     'input[name="rep"]',
+];
+const TEXT_INPUT_GENERIC_SELECTORS = [
     // Generic — an input the page itself labels as the captcha answer.
     'input[name*="captcha" i]',
     'input[id*="captcha" i]',
@@ -188,6 +269,9 @@ const TEXT_INPUT_SELECTORS = [
     'input[type=tel]',
     'textarea',
 ];
+const TEXT_INPUT_SELECTORS = [
+    ...TEXT_INPUT_VENDOR_SELECTORS, ...TEXT_INPUT_GENERIC_SELECTORS,
+];
 /**
  * The handle you drag on a puzzle-piece slider. NOT the piece: on every one of
  * these vendors the piece is inert decoration that the handle carries, so a
@@ -198,7 +282,10 @@ const SLIDER_HANDLE_SELECTORS = [
     '.geetest_slider_button',
     '.geetest_btn',
     '.geetest_slider .geetest_arrow',
-    // Tencent
+    // Tencent. The post-2026-08-11 knob is a bare div — no id, no role=slider,
+    // no aria-valuenow — so every generic fallback below misses it and it has to
+    // be named. The three after it are the pre-redesign widget.
+    '.tencent-captcha-dy__slider-block',
     '#tcaptcha_drag_thumb',
     '.tc-slider-normal',
     '[id*=slideBlock]',
@@ -246,11 +333,115 @@ const SLIDE_MAX_CORRECTIONS = 2;
  * can be pinned by a test — see no-progress.test.ts. The Python port keeps the
  * same pair on `PageSolverConfig`.
  */
+/**
+ * Does this answer need the widget's box to be performed?
+ *
+ * Only a coordinate-bearing action does. `done` means "nothing left to click"
+ * and is the answer a vendor that closes on success will be showing no widget
+ * for, so requiring a box for it fails the solve at the moment it succeeded.
+ *
+ * Written as an ALLOW-LIST of what needs nothing rather than a list of what
+ * does: a new coordinate action added later must default to needing the box,
+ * because that is the direction where being wrong throws instead of clicking
+ * nowhere.
+ */
+function answerNeedsElementBox(actions) {
+    return actions.some((a) => a?.action !== 'done');
+}
+/**
+ * Is this the challenge TRANSITIONING under us, rather than a dead puzzle?
+ *
+ * hCaptcha swaps in the next round while we hold the old iframe, so a
+ * screenshot on it fails "not visible" / "Timeout" / "not attached". GeeTest
+ * does the mirror image: it CLOSES the panel the moment it accepts an answer,
+ * so the widget we are holding loses its layout box between the screenshot and
+ * the click. Both are the widget moving on, and the answer to both is to
+ * re-detect on the next round rather than to fail the solve.
+ *
+ * The caller gates this on having ALREADY INTERACTED, which is what keeps it
+ * honest: a first-frame failure is a genuine problem and still surfaces.
+ *
+ * Measured 2026-09-07 on gt4.geetest.com — every live GeeTest attempt ended
+ * "Could not get bounding box of captcha element" on a panel the vendor had
+ * just accepted, and each was recorded as the model being wrong.
+ */
+function isStaleHandleError(message) {
+    return /Timeout .*exceeded|not visible|not attached|detached|Target closed|bounding box of captcha element/i
+        .test(message);
+}
+/**
+ * How unlike the chosen keyframe the widget has to look before the gate calls
+ * it a different board, and over how many polls.
+ *
+ * Measured on GeeTest svg: two SCREENS of one board differ by 0.0056 (thin line
+ * art, a few glyph strokes); a different board reads 0.77. Two orders of
+ * magnitude apart, so this threshold is a plateau rather than a knife edge.
+ * Several polls, not one, because a transition frame caught mid-swap can read
+ * high for a moment.
+ */
+const NOT_THIS_BOARD_DIFF = 0.5;
+/**
+ * How much the widget must change during inference to count as MOVING.
+ *
+ * A separate, much tighter number than `staleFrameDiffThreshold` (0.02),
+ * because it answers a different question. 0.02 asks "did this answer go
+ * stale" — did tiles move enough that the coordinates no longer land. This asks
+ * "is this picture the same picture", which is the noise floor, and the two are
+ * an order of magnitude apart.
+ *
+ * Using the stale threshold for both made the guard BLIND to the board it most
+ * needed to see: GeeTest svg's screens differ by 0.0056, comfortably under
+ * 0.02, so a board cycling all the way through a 2.7s inference reported no
+ * change at all. Third time this file has applied a coarse threshold to a fine
+ * question (see `distinct_ratio` in keyframes.py and NOT_THIS_BOARD_DIFF).
+ *
+ * 0.002 sits above the measured frame-to-frame noise floor (0.001) and well
+ * under the 0.0056 separation.
+ */
+const MOVED_DURING_INFERENCE_DIFF = 0.002;
+const NOT_THIS_BOARD_POLLS = 3;
 exports.SOLVE_DEFAULTS = {
     maxSolveLoops: 6,
     overallSolveTimeoutMs: 45000,
+    /**
+     * How long to hold a click waiting for the screen the model answered about.
+     *
+     * 9000, not the 6000 it was. A GeeTest svg board dwells p50 1.5s / p75 2.0s /
+     * max 2.7s per screen, so a 3-screen cycle runs 4.5s median and 8.1s worst
+     * case — a 6s budget could not catch the worst case however well aimed, and
+     * gave up one screen short. Named here rather than left as a literal in two
+     * places because `video_budget_ms` is derived from it on both ports and the
+     * arithmetic has to agree.
+     */
+    keyframeWaitTimeoutMs: 9000,
 };
+/**
+ * How long a keyframe burst may run before it is called HUNG.
+ *
+ * A hang detector, not a budget: the solve timeout is what bounds real time.
+ * This only has to notice a screenshot that never returns, so it is
+ * deliberately slack.
+ *
+ * Sized off the CEILING, because that is what sizes the loop — the burst plans
+ * `videoBurstMaxMs` worth of frames, not `videoBurstDurationMs` worth. Must
+ * match `burst_hang_deadline_ms` in the python port, which had this guard
+ * first and had it sized off the floor: a 120-frame burst got 17s, i.e. 141ms
+ * per frame against a 100ms interval, and a burst that simply ran to its
+ * ceiling killed the attempt.
+ */
+function burstHangDeadlineMs(cfg) {
+    return 3 * (cfg.videoBurstMaxMs ?? 12000) + 5000;
+}
 class CaptchaKrakenSolver {
+    /**
+     * Attribute the enclosed wall-clock to `name` for this solve's budget.
+     *
+     * A no-op outside a solve, so every helper stays callable from tests and from
+     * the watcher without a budget having been opened.
+     */
+    ph(name, fn) {
+        return this.budget ? this.budget.phase(name, fn) : fn();
+    }
     constructor(config = {}) {
         /** Extra ms this solve has been granted for a recording; see recordKeyframeBurst. */
         this.videoBudgetMs = 0;
@@ -292,16 +483,63 @@ class CaptchaKrakenSolver {
         // and the challenge is re-solved from a recorded burst. See
         // repeated-answer.test.ts.
         this.repeatedAnswerSeen = false;
+        /**
+         * The ONE recording and the ONE answer for the animated challenge on screen.
+         *
+         * A cycling board needs a single inference and no more. The burst shows the
+         * model every screen; the answer names the cell AND the screen it is on
+         * (`frame` / `await_keyframe`); the gate then holds the click until that
+         * screen is back up. Nothing about that changes between rounds — the board
+         * keeps cycling through the same pictures with the same target — so asking
+         * again buys nothing and costs a burst plus a multi-image inference.
+         *
+         * It was asking again every round. Loops 3, 4 and 5 each re-recorded and
+         * re-inferred, which is what exhausted a 66s budget on a puzzle whose whole
+         * task is one click.
+         *
+         * Dropped when the gate reports it never saw the chosen screen: that means
+         * the widget is no longer the board this plan was made for, which is exactly
+         * when a fresh recording is warranted.
+         */
+        this.animatedPlan = null;
         // Slicing mode of the burst the current answer came from, as reported by
         // `solve-animated`. `waitForKeyframe` reads it: `even` means the slicer found
         // no state that RECURS, so there is nothing for the page to come back to and
         // the gate can only ever time out. See test_even_clips_do_not_wait.py.
         this.keyframeMode = null;
+        /**
+         * How many distinct steady screens the current clip sits on; 0 if it is not
+         * that kind of clip. THE GATE KEYS ON THIS, NOT ON `keyframeMode`.
+         *
+         * `even` was being read as "no state recurs, do not wait". It does not mean
+         * that — it means the slicer could not PROVE recurrence, which for a board
+         * whose loop is longer than a 4s burst it never can. 32 of 60 real clips
+         * sliced `even` while sitting on 2-3 steady screens, so the gate was off on
+         * every real animated captcha and the driver clicked whichever screen was up.
+         */
+        this.keyframeSteadyScreens = 0;
+        /**
+         * When the current solve must be over, in `Date.now()` terms. 0 outside one.
+         *
+         * The budget used to be checked ONLY at the top of each solve loop, so any
+         * single round could overrun it without limit — and an animated round is the
+         * long one: a 4s burst of 40 element screenshots, a multi-image inference,
+         * then a gated click per target. Measured on GeeTest svg, 2026-09-07: rounds
+         * that re-recorded ran past a 66s budget to the harness's own 180s ceiling
+         * and were reported "hung, not slow", which is a message about the model for
+         * a driver that simply never looked at the clock.
+         *
+         * The Python port has always checked mid-wait (`_check_deadline`), so this
+         * was also a cross-port divergence on exactly the puzzles Tier 3 times.
+         */
+        this.solveDeadlineAt = 0;
         // Repeat detection; see `maxNoProgressRounds`. `lastAnswerSig` is the answer
         // the previous round EXECUTED, `noProgressRounds` how many rounds running
         // have re-executed it.
         this.lastAnswerSig = null;
         this.noProgressRounds = 0;
+        /** How far up planner.RESAMPLE_TEMPERATURES this BOARD has escalated. */
+        this.resampleLevel = 0;
         // Current challenge lifecycle state (see CaptchaState). Diagnostic + used to
         // gate behaviours; transitions are logged via gridDebug when CAPTCHA_DEBUG=1.
         this.state = CaptchaState.Detecting;
@@ -317,24 +555,108 @@ class CaptchaKrakenSolver {
         // session id lets the gateway bill them as one capped attempt rather than N
         // independent ones. Null outside a solve; ignored entirely when self-hosting.
         this.solveSessionId = null;
+        /** Interpreter + CLI root, resolved once. See resolveCli. */
+        this.cliCache = null;
+        /** The LoRA name models.json calls `latest`, read once. See askModel. */
+        this.loraNameCache = null;
+        /**
+         * Phase accounting for the CURRENT or MOST RECENT solve; see timing.ts.
+         * Null before the first solve, and readable after a failed one.
+         */
+        this.budget = null;
         this.config = config;
-        this.lastMousePosition = config.startingMousePosition ?? { x: 100, y: 100 };
+        this.human = (0, humanize_js_1.resolveHumanizer)({
+            ...config,
+            startingMousePosition: config.startingMousePosition ?? { x: 100, y: 100 },
+        });
+    }
+    /**
+     * Where the pointer is. Owned by the humanizer, because a mode that
+     * dispatches no motion (mobile, between taps) still has to answer this.
+     */
+    get lastMousePosition() {
+        return { x: this.human.at[0], y: this.human.at[1] };
+    }
+    set lastMousePosition(v) {
+        this.human.at = [v.x, v.y];
     }
     async solve(page) {
         this.solveSessionId = (0, crypto_1.randomUUID)();
+        this.budget = new timing_1.PhaseBudget();
+        // FALSE unless the solve returns a solved result. A solve that throws never
+        // sets it, which is the right default: the widget did not accept, and the
+        // boards that made it throw are exactly the ones worth keeping.
+        let solvedForReport = false;
         try {
-            return await this.solveImpl(page);
+            const result = await this.solveImpl(page);
+            // Attached HERE rather than at each of the four `isSolved:` sites, so a
+            // new early exit cannot forget it.
+            if (result)
+                result.phases = this.budget.toObject();
+            solvedForReport = result?.isSolved === true;
+            return result;
         }
         finally {
+            // Printed on the way out of every solve, success or failure — a solve
+            // that FAILED is exactly the one whose time you want itemised.
+            if ((0, timing_1.timingsEnabled)())
+                console.error(this.budget.report());
+            // NOT cleared. A solve that FAILED is exactly the one whose time you want
+            // itemised, and by the time the caller catches the error the result — the
+            // only thing `phases` rides on — does not exist. `solve()` replaces it on
+            // entry, so the next solve cannot read the last one's. Same lifetime as
+            // page_solver.py's `_budget`.
             // Always shut the persistent CV worker down when a solve ends (success,
             // failure, or timeout) so we never leak a python process between solves.
             this.teardownCvWorker();
             this.cvWorkerReady = null;
+            // BEFORE the id is cleared, so the report names this solve.
+            this.reportOutcome(this.solveSessionId, solvedForReport);
             // Clear last: a stale id leaking into the NEXT solve would merge two
             // separate captchas into one billable attempt.
             this.solveSessionId = null;
         }
     }
+    /**
+     * Tell the hosted API whether the widget accepted — the one fact the server
+     * cannot see for itself, since a wrong answer reaches it as a 200 with
+     * well-formed JSON in it.
+     *
+     * THROUGH THE PYTHON CLI, not a `fetch` here. The endpoint, the credential,
+     * the extra-header handling and the "one 404 and stop asking" rule all live
+     * in `planner.report_outcome`; a second copy in TypeScript would agree with
+     * it until one of them was edited. That is the drift `model-name.ts` exists
+     * to prevent, on the same seam, and this port already crosses that subprocess
+     * boundary for every model call.
+     *
+     * NOT AWAITED, and detached. The solve is over and its result is decided, so
+     * nothing here may add latency to what the caller gets back or keep the
+     * process alive past it. `unref()` is what makes the second true.
+     */
+    reportOutcome(sessionId, solved) {
+        if (!sessionId)
+            return;
+        // CHECKED HERE, NOT ONLY IN PYTHON. The Python side honours the same
+        // variable, but this port spawns a PROCESS to ask it — and against an
+        // endpoint with no such route (a local vLLM, every fixture run) that
+        // process exists only to be told 404. Python's "one 404 and stop asking"
+        // latch cannot help here either, because each solve is a fresh process.
+        // Tier 3 sets this, and drives ~100 solves per run on one box.
+        if (process.env.CAPTCHA_REPORT_OUTCOME === '0')
+            return;
+        try {
+            const { cliRoot, py } = this.resolveCli();
+            const child = (0, child_process_1.spawn)(py, ['-m', 'captchakraken.cli', 'report-outcome', sessionId, solved ? 'solved' : 'failed'], { cwd: cliRoot, env: cliEnv(cliRoot), detached: true, stdio: 'ignore' });
+            // A report that cannot be sent is not the caller's problem, and an
+            // unhandled 'error' event on a spawn is an uncaught exception in Node.
+            child.on('error', () => { });
+            child.unref();
+        }
+        catch {
+            // resolveCli throws when the bundled engine is missing, which is already
+            // a loud failure everywhere it matters. Not here.
+        }
+    }
     /**
      * Install an auto-solver: probe `page` on a timer and solve any captcha that
      * becomes visible, until `stop()`.
@@ -365,6 +687,7 @@ class CaptchaKrakenSolver {
         this.imageCounter = 0;
         this.stepIndex = 0;
         this.solveStartMs = start;
+        await this.human.reset(page);
         this.resetSolveState();
         this.setState(CaptchaState.Detecting);
         // Initialize session debug directory if debugging is enabled
@@ -416,6 +739,9 @@ class CaptchaKrakenSolver {
             // `videoBudgetMs` is 0 until this solve records something, so a solve
             // that never escalates gets exactly the deadline the caller configured.
             const budgetMs = overallSolveTimeoutMs + this.videoBudgetMs;
+            // Published so the burst and the keyframe gate can stop on their own
+            // rather than overrunning and being noticed a round later.
+            this.solveDeadlineAt = start + budgetMs;
             if (Date.now() - start > budgetMs) {
                 throw new Error(`Captcha solve timed out after ${budgetMs}ms (attempt ${attempt}/${maxSolveLoops})`
                     + (this.videoBudgetMs ? `, including ${this.videoBudgetMs}ms granted for recording an animated challenge` : '')
@@ -444,7 +770,7 @@ class CaptchaKrakenSolver {
                     tokenUsage: (0, token_usage_1.aggregateTokenUsage)(cumulativeTokenUsage),
                 };
             }
-            const captchaElement = await this.detectCaptcha(page);
+            const captchaElement = await this.ph('detect', () => this.detectCaptcha(page));
             if (!captchaElement) {
                 // Two-stage detection. detectCaptcha() returns null when there's no
                 // VISIBLE, unsolved widget — but that splits into two cases:
@@ -470,8 +796,7 @@ class CaptchaKrakenSolver {
                 // No interactive widget in the DOM (reCAPTCHA v3 / invisible, or an
                 // hCaptcha that only triggers on user action), or it never rendered.
                 // Fail fast rather than burning the whole loop budget.
-                throw new Error('No interactive captcha widget detected (likely reCAPTCHA v3 / '
-                    + 'invisible or a click-triggered challenge). Failing fast.');
+                throw new Error(await this.noWidgetMessage(page));
             }
             console.log(`\n--- Captcha Solve Loop ${attempt}/${maxSolveLoops} ---`);
             const retryModeThisLoop = pendingRetryMode;
@@ -503,7 +828,7 @@ class CaptchaKrakenSolver {
                         // it to settle before retrying; if it never settles it's animated.
                         const el = await this.detectCaptcha(page);
                         if (el) {
-                            const s = await this.waitForElementSettled(el);
+                            const s = await this.ph('settle', () => this.waitForElementSettled(el));
                             if (s === 'animated') {
                                 // Used to be terminal. Now it just means the next round is an
                                 // animated puzzle: retry the loop and solveSingle takes the
@@ -540,7 +865,7 @@ class CaptchaKrakenSolver {
                 const emsg = String((e && e.message) || e);
                 if (hasInteracted
                     && staleElementRetries < maxStaleElementRetries
-                    && /Timeout .*exceeded|not visible|not attached|detached|Target closed/i.test(emsg)) {
+                    && isStaleHandleError(emsg)) {
                     staleElementRetries++;
                     console.log(`stale challenge handle after submit ("${emsg.split('\n')[0]}"); `
                         + `re-detecting next round (${staleElementRetries}/${maxStaleElementRetries}).`);
@@ -561,32 +886,78 @@ class CaptchaKrakenSolver {
             }
             renderWaits = 0;
             cumulativeTokenUsage.push(...tokenUsage);
-            // After acting, poll for the vendor's SOLVED signal (anchor checkbox
-            // checked / response token) for a short window before falling back to the
-            // normal re-detect. hCaptcha keeps the challenge iframe visible for a
-            // couple seconds while it verifies the final answer; without this, the
-            // loop re-entered the pipeline on that closing frame and burned ~18s
-            // (waitForHcaptchaChallengeImages timing out on a prompt-less frame).
-            // This ONLY early-returns on a definitive solved signal — it never
-            // re-solves, so it can't loop. If not solved in the window, the original
-            // detectCaptcha path below handles a genuine next round exactly as before.
+            // ONE wait after a round, polled, whichever kind of round it was.
+            //
+            // There used to be two: this poll when the round interacted, and a flat
+            // `delay(postSolveDelayMs + jitter)` when it did not. The flat sleep
+            // observed NOTHING — it ran to the end and only then asked whether the
+            // widget was still there — so a round that had in fact finished the
+            // captcha paid 1200-1500ms to find that out. The poll below already asks
+            // exactly that question and answers it the moment it becomes true.
+            //
+            // The two windows keep different LENGTHS, because different things size
+            // them: postSolveOutcomeTimeoutMs covers how late a vendor's success
+            // signal can arrive (measured — see types.ts), while postSolveDelayMs is
+            // the dwell a round that answered nothing takes before deciding the page
+            // has settled. Mirrors page_solver.py; the ports must not disagree about
+            // how long a round costs.
+            //
+            // hCaptcha keeps the challenge iframe visible for a couple of seconds
+            // while it verifies the final answer; without this window the loop
+            // re-entered the pipeline on that closing frame and burned ~18s. It ONLY
+            // early-returns on a definitive signal, so it cannot loop.
             const settleMs = didInteract
                 ? (this.config.postSolveOutcomeTimeoutMs ?? 1000)
                 : postSolveDelayMs + Math.random() * 300;
-            if (didInteract) {
+            {
                 const deadline = Date.now() + settleMs;
+                const verdictT0 = Date.now();
                 let solved = false;
+                let widgetGone = 0;
                 while (Date.now() < deadline) {
                     if (await this.isCaptchaSolved(page)) {
                         solved = true;
                         break;
                     }
+                    // The eight inline vendors have NO response token, so
+                    // `isCaptchaSolved` — which reads only the hCaptcha and reCAPTCHA
+                    // anchors — can never fire for them, and this loop ran out its whole
+                    // window on EVERY round waiting for a signal that cannot arrive.
+                    // "The widget is gone" is their completion signal and is already the
+                    // authority immediately after this loop, so this only reaches the
+                    // same verdict sooner — confirmed over two polls so a frame caught
+                    // mid-swap between rounds cannot read as a solve. page_solver.py has
+                    // had this since the a GeeTest v4 slider measurement (5.2s of a 12.3s
+                    // solve, spent after the puzzle was already answered); this port had
+                    // not, which is most of why it measured slower on those vendors.
+                    if (!(await this.detectCaptcha(page))) {
+                        widgetGone += 1;
+                        if (widgetGone >= 2) {
+                            solved = true;
+                            break;
+                        }
+                    }
+                    else {
+                        widgetGone = 0;
+                    }
                     // A fresh next round has rendered → stop waiting, go solve it now
                     // (keeps multi-round solves fast instead of burning the full window).
-                    if (await this.isChallengeFreshlyRendered(page))
+                    if (await this.isChallengeFreshlyRendered(page)) {
+                        // A DIFFERENT puzzle, so the greedy answer has not been tested
+                        // against it and the escalation must not carry over.
+                        if (this.resampleLevel)
+                            console.log('[resample] fresh board — back to greedy');
+                        this.resampleLevel = 0;
                         break;
+                    }
                     await delay(this.config.postSolveOutcomePollMs ?? 75);
                 }
+                this.budget?.add(didInteract ? 'await-verdict' : 'post-submit-delay', Date.now() - verdictT0);
+                // How long a SUCCESS actually took to show itself — the only number
+                // that can size postSolveOutcomeTimeoutMs. A round that ends any other
+                // way spends the whole window by construction.
+                if (solved)
+                    console.log(`[verdict] success signal arrived after ${Date.now() - verdictT0}ms`);
                 if (solved) {
                     return {
                         isSolved: true,
@@ -595,9 +966,6 @@ class CaptchaKrakenSolver {
                     };
                 }
             }
-            else {
-                await delay(settleMs);
-            }
             // Detect reCAPTCHA's under-selection error banner. If present, the
             // vendor rejected our last submission because the model missed at
             // least one matching tile. Set the retry flag for the next loop so
@@ -605,8 +973,8 @@ class CaptchaKrakenSolver {
             // some" instruction. If we've already retried once and the error is
             // STILL showing, bail — the model is stuck and the loop will just
             // keep flipping between "done" and Verify until timeout.
-            const recaptchaUnderselect = await this.hasRecaptchaUnderselectError(page);
-            if (recaptchaUnderselect) {
+            const banner = await this.recaptchaBannerKind(page);
+            if (banner && this.bannerIsFatalAfterRetry(banner)) {
                 if (alreadyRetriedRecaptchaError) {
                     throw new Error('reCAPTCHA still showing the under-selection error after retry; '
                         + 'aborting (model unable to identify the missed tile). Total usage: '
@@ -645,9 +1013,17 @@ class CaptchaKrakenSolver {
         this.stepIndex++;
         let screenshotPath = path.join(os.tmpdir(), `step_${this.stepIndex}_${Date.now()}_${Math.floor(Math.random() * 1e9)}.png`);
         try {
+            // ITS OWN, SHORT TIMEOUT — not `elementScreenshotTimeoutMs`, which is
+            // sized for the picture the MODEL reads and is 8s. This one is an
+            // observability snapshot, and `animations: 'disabled'` makes Playwright
+            // wait for the element to stop moving before it will take it. On a widget
+            // that is still animating that wait ran to the full 8s, per step:
+            // measured 8.0s of a 12.0s an MTCaptcha distorted-text puzzle solve, spent photographing a
+            // text box for a trace. An observer must never cost more than the action
+            // it is observing, and a missed frame in a trace costs nothing.
             await captchaElement.screenshot({
                 path: screenshotPath,
-                timeout: this.config.elementScreenshotTimeoutMs ?? 8000,
+                timeout: this.config.stepScreenshotTimeoutMs ?? 2000,
                 animations: 'disabled',
             });
         }
@@ -672,9 +1048,13 @@ class CaptchaKrakenSolver {
         }
     }
     async solveSingle(page, captchaElement, attempt, retryMode = null) {
-        // Vendor hint helps the CLI route to the right pipeline (hCaptcha click
-        // puzzles must never go through grid detection — find_grid false-positives
-        // on the header+footer bands).
+        // Vendor hint constrains which grid SHAPES the CLI may solve a detection as.
+        // find_grid false-positives on the header+footer bands of hCaptcha's click
+        // puzzles, and hCaptcha ships only a 3x3 — so a 16-cell lattice on one is a
+        // contradiction and is dropped back to the click path. It is not a blanket
+        // skip: an hCaptcha 3x3 property grid is a real grid and still solves as one.
+        // Anything that is not hCaptcha or reCAPTCHA reports 'unknown' and is
+        // allowed every shape (GeeTest and Prosopo both ship real 3x3 grids).
         const src = await captchaElement.getAttribute('src').catch(() => null);
         const puzzleSource = src && src.includes('hcaptcha.com')
             ? 'hcaptcha'
@@ -705,8 +1085,8 @@ class CaptchaKrakenSolver {
         // opposite answers. Restricted to `unknown` because neither hCaptcha nor
         // reCAPTCHA has ever served a typed challenge, so a match inside one of
         // their frames would be a false positive by definition.
-        const textMode = puzzleSource === 'unknown'
-            && (await this.findControl(scope, TEXT_INPUT_SELECTORS)) !== null;
+        const textMode = !VENDORS_WITH_BESPOKE_HANDLING.has(puzzleSource)
+            && (await this.answerBox(scope, captchaElement)) !== null;
         if (textMode) {
             console.log('Widget has a text box; solving as a distorted-text captcha.');
         }
@@ -725,12 +1105,12 @@ class CaptchaKrakenSolver {
         if (puzzleSource === 'hcaptcha' && src && src.includes('frame=challenge')) {
             if (this.lastSubmitFrameHash) {
                 this.setState(CaptchaState.Transitioning);
-                await this.waitForChangeSince(captchaElement, this.lastSubmitFrameHash);
+                await this.ph('await-next-round', () => this.waitForChangeSince(captchaElement, this.lastSubmitFrameHash));
                 this.lastSubmitFrameHash = null;
             }
             this.setState(CaptchaState.Loading);
-            await this.waitForHcaptchaChallengeImages(captchaElement);
-            const settle = await this.waitForElementSettled(captchaElement);
+            await this.ph('hcaptcha-images', () => this.waitForHcaptchaChallengeImages(captchaElement));
+            const settle = await this.ph('settle', () => this.waitForElementSettled(captchaElement));
             if (settle === 'animated') {
                 // A challenge that never settles is animated BY DESIGN — hCaptcha's
                 // "select the odd animal" fades its sprites on independent cycles, and
@@ -754,14 +1134,15 @@ class CaptchaKrakenSolver {
             }
             this.setState(CaptchaState.Ready);
         }
-        else if (puzzleSource === 'unknown' && this.config.videoSolveEnabled !== false) {
+        else if (!VENDORS_WITH_BESPOKE_HANDLING.has(puzzleSource)
+            && this.config.videoSolveEnabled !== false) {
             // Non-hCaptcha, non-reCAPTCHA widgets (GeeTest, Tencent, …). The settle probe
             // was never run for these, so an animated one — GeeTest's svg board cycles its
             // glyph set — was screenshotted mid-cycle and answered from whatever single
             // moment we happened to catch. reCAPTCHA is excluded on purpose: it has its own
             // readiness gate below, its grids are never animated, and a second probe would
             // only add latency to a path that already works.
-            if (await this.waitForElementSettled(captchaElement) === 'animated') {
+            if (await this.ph('settle', () => this.waitForElementSettled(captchaElement)) === 'animated') {
                 console.log('[animated] challenge never settles — recording it');
                 isAnimated = true;
             }
@@ -794,7 +1175,7 @@ class CaptchaKrakenSolver {
         // reCAPTCHA attempts into 3x3 vs 4x4 without scraping debug logs.
         let establishedGridSize = null;
         if (isRecaptchaChallenge) {
-            await this.waitForGridCellsLoaded(captchaElement);
+            await this.ph('grid-load', () => this.waitForGridCellsLoaded(captchaElement));
             // Only a 3x3 reCAPTCHA ever refreshes its tiles in place (blank/fade →
             // new image), so only a 3x3 can need the multi-round driver: click →
             // hover/wait for fades → re-solve. Whether THIS one does is decided inside
@@ -815,11 +1196,11 @@ class CaptchaKrakenSolver {
         }
         // 1. Take Screenshot
         const screenshotPath = path.join(os.tmpdir(), `captcha_${Date.now()}_${Math.floor(Math.random() * 1e9)}.png`);
-        await captchaElement.screenshot({
+        await this.ph('screenshot', () => captchaElement.screenshot({
             path: screenshotPath,
             timeout: this.config.elementScreenshotTimeoutMs ?? 8000,
             animations: 'disabled',
-        });
+        }));
         // Save image to debug directory if debugging is enabled
         this.saveImageForDebug(screenshotPath);
         // Baseline screenshot before any action is taken. Emitted once per solve
@@ -843,11 +1224,71 @@ class CaptchaKrakenSolver {
             //    a stale frame, so we re-screenshot and re-solve on the developed one.
             let response;
             if (isAnimated) {
-                burstDir = await this.recordKeyframeBurst(captchaElement);
-                response = await this.withIdleWander(page, captchaElement, () => this.getAnimatedSolution(burstDir));
+                // ONE burst, ONE inference, for as long as this board is on screen.
+                if (this.animatedPlan) {
+                    burstDir = this.animatedPlan.burstDir;
+                    response = this.animatedPlan.response;
+                    console.log('[animated] reusing the recorded answer — same board, same screens');
+                }
+                else {
+                    burstDir = await this.ph('burst', () => this.recordKeyframeBurst(captchaElement));
+                    response = await this.ph('inference', () => this.withIdleWander(page, captchaElement, () => this.getAnimatedSolution(burstDir)));
+                    this.animatedPlan = { burstDir, response };
+                }
+            }
+            else if (this.shouldSpeculate(puzzleSource, textMode)) {
+                /*
+                 * ASK AND WATCH AT THE SAME TIME.
+                 *
+                 * The screenshot goes to the model and the recording starts in the same
+                 * breath. Whichever the board turns out to be, the answer arrives about
+                 * one inference from now:
+                 *
+                 *   still  — the recording saw one picture, so the still answer stands
+                 *            and the frames are dropped. Identical to the old behaviour
+                 *            and identical in cost; the burst happened inside a wait we
+                 *            were making anyway.
+                 *   moving — the still answer is discarded UNREAD, because it describes
+                 *            a screen that has already gone. The burst runs on to the
+                 *            end of the cycle and the multi-image answer is used. Two
+                 *            inference CALLS, roughly one inference of wall-clock.
+                 *
+                 * The old shape learned the same thing in whole ROUNDS — answer a
+                 * still, act, notice nothing moved, answer another, then record — which
+                 * measured ~15s of a 40s solve.
+                 *
+                 * NO IDLE WANDER while speculating: the cursor drifts across the widget
+                 * during inference, and every frame of the burst would have a mouse
+                 * pointer in a different place. That is a new picture each time, which
+                 * reads as a board with a dozen screens.
+                 */
+                const rec = this.startKeyframeBurst(captchaElement);
+                let still = null;
+                let stillError = null;
+                try {
+                    still = await this.ph('inference', () => this.solveFrameFreshnessGuarded(captchaElement, screenshotPath, (imagePath) => this.getSolution(imagePath, puzzleSource, retryMode, textMode)));
+                }
+                catch (e) {
+                    stillError = e; // rethrown below only if the board turns out still
+                }
+                if (!rec.moved()) {
+                    await rec.abandon();
+                    if (stillError)
+                        throw stillError;
+                    response = still;
+                }
+                else {
+                    console.log('[animated] the widget moved while the model was reading it — dropping '
+                        + 'the still answer and finishing the recording.');
+                    isAnimated = true;
+                    this.repeatedAnswerSeen = true; // so later rounds go straight to it
+                    burstDir = await this.ph('burst', () => rec.finish());
+                    response = await this.ph('inference', () => this.withIdleWander(page, captchaElement, () => this.getAnimatedSolution(burstDir)));
+                    this.animatedPlan = { burstDir, response };
+                }
             }
             else {
-                response = await this.solveFrameFreshnessGuarded(captchaElement, screenshotPath, (imagePath) => this.withIdleWander(page, captchaElement, () => this.getSolution(imagePath, puzzleSource, retryMode, textMode)));
+                response = await this.ph('inference', () => this.solveFrameFreshnessGuarded(captchaElement, screenshotPath, (imagePath) => this.withIdleWander(page, captchaElement, () => this.getSolution(imagePath, puzzleSource, retryMode, textMode))));
             }
             const actions = response.actions;
             allTokenUsage = response.token_usage;
@@ -855,11 +1296,42 @@ class CaptchaKrakenSolver {
             this.archiveLatestDebugRun(attempt, actions);
             // 3. Execute Actions
             const actionList = Array.isArray(actions) ? actions : [actions];
-            // We need the element's bounding box to translate coordinates
+            /*
+             * The box translates NORMALISED coordinates into page ones, so it is
+             * needed only by an action that carries coordinates. A `done` answer
+             * carries none — it means "nothing left to click", and falls through to
+             * the submit block below.
+             *
+             * DEMANDING IT UNCONDITIONALLY TURNED SUCCESSES INTO ERRORS. Several
+             * vendors CLOSE the challenge the moment it is satisfied, so the widget
+             * is legitimately gone by the time the model says `done` — and the throw
+             * landed on the one answer that proves the solve worked. Measured
+             * 2026-09-07 on gt4.geetest.com: loop 1 clicked three tiles, loop 2
+             * returned `{"action":"done"}`, the panel went `display:none` because
+             * GeeTest had accepted it, and the driver reported
+             * "Could not get bounding box of captcha element". Every live GeeTest
+             * attempt failed that way — 22 of 22 across four puzzles — and each was
+             * recorded as the model being wrong.
+             *
+             * Without a box, a `done` answer now reaches the submit block and then
+             * the next loop, where `detectCaptcha` finds nothing and the existing
+             * post-interaction rule reports the solve. A coordinate action with no
+             * box still throws, because that one genuinely cannot be performed.
+             */
             const elementBox = await captchaElement.boundingBox();
-            if (!elementBox) {
+            if (!elementBox && answerNeedsElementBox(actionList)) {
                 throw new Error('Could not get bounding box of captcha element');
             }
+            // Read at the point of use rather than asserted once: every reader below
+            // sits inside a coordinate action's branch, which the guard above has
+            // already made unreachable without a box. Keeping the check here means
+            // the type is honest AND the original error survives for the case that
+            // genuinely cannot be performed.
+            const requireBox = () => {
+                if (!elementBox)
+                    throw new Error('Could not get bounding box of captcha element');
+                return elementBox;
+            };
             // Recorded at the moment of EXECUTION, which is what makes a repeat mean
             // something: this exact answer is about to be performed, so if it matches
             // the last one, the last one already ran and the page is still asking the
@@ -884,15 +1356,18 @@ class CaptchaKrakenSolver {
                             // in the state the model answered about. Per-click, not once per
                             // action: these puzzles keep cycling, so by the time click 2 comes
                             // round the state has moved on again.
+                            const one = { ...c, target_bounding_box: bbox };
                             if (c.await_keyframe) {
-                                await this.waitForKeyframe(captchaElement, c.await_keyframe, ...bboxCenter(bbox));
+                                await this.clickWhenFrameMatches(page, captchaElement, one, requireBox(), c.await_keyframe);
+                            }
+                            else {
+                                await this.executeClick(page, captchaElement, one, requireBox());
                             }
-                            await this.executeClick(page, captchaElement, { ...c, target_bounding_box: bbox }, elementBox);
-                            await delay(Math.random() * 80 + 80);
+                            await this.human.pause('between');
                         }
                     }
                     else {
-                        await this.executeClick(page, captchaElement, c, elementBox);
+                        await this.executeClick(page, captchaElement, c, requireBox());
                     }
                     performedAction = true;
                     clicked = true;
@@ -902,7 +1377,7 @@ class CaptchaKrakenSolver {
                     // No source — a puzzle-piece slider. What you grab is not what has to
                     // arrive, so this cannot go through executeDrag: pressing the gap the
                     // model named and dragging from there picks up nothing at all.
-                    if (await this.executeSlide(page, captchaElement, scope, action, elementBox)) {
+                    if (await this.executeSlide(page, captchaElement, scope, action, requireBox())) {
                         performedAction = true;
                         slid = true;
                         await this.emitStep(captchaElement, 'drag', 'slid the piece into the slot', puzzleSource, frameRole, attempt, { action });
@@ -917,13 +1392,13 @@ class CaptchaKrakenSolver {
                     if (d.await_keyframe && d.source_bounding_box) {
                         await this.waitForKeyframe(captchaElement, d.await_keyframe, ...bboxCenter(d.source_bounding_box));
                     }
-                    await this.executeDrag(page, captchaElement, action, elementBox);
+                    await this.executeDrag(page, captchaElement, action, requireBox());
                     performedAction = true;
                     placed = true;
                     await this.emitStep(captchaElement, 'drag', 'drag', puzzleSource, frameRole, attempt, { action });
                 }
                 else if (action.action === 'type') {
-                    if (await this.executeType(page, scope, action)) {
+                    if (await this.executeType(page, scope, action, captchaElement)) {
                         performedAction = true;
                         typed = true;
                         await this.emitStep(captchaElement, 'type', 'typed the code', puzzleSource, frameRole, attempt, { action });
@@ -958,12 +1433,15 @@ class CaptchaKrakenSolver {
             // reach by construction. The press itself is bounded by
             // `shouldClickSubmit` below, which is where that hazard belongs.
             const lookup = frame ?? (slid ? null : scope);
-            if (lookup) {
+            if (lookup)
                 verifyButton = await this.getVerifyButton(lookup);
-                if (verifyButton) {
-                    await this.move(page, verifyButton);
-                }
-            }
+            // RESOLVED, not travelled to. `moveAndClick` below moves to the button
+            // itself, and it picks its own random point inside it — so moving here
+            // first bought a second humanised trajectory that ended a few dozen
+            // pixels from where the first one stopped, plus a second bounded
+            // scroll-into-view. Two hops to one button is slower AND is not
+            // something a hand does. A round that decides not to submit no longer
+            // walks to the control either.
             // 'done' actions fall through to the submit block below, same as before.
             // Submit policy: press the widget's own submit control whenever we have
             // put an ANSWER into it — a selection, a placed piece, a typed code — or
@@ -1000,7 +1478,7 @@ class CaptchaKrakenSolver {
                 // caller aborts a round that reports none, so submitting a `done`
                 // answer and then reporting false re-arms the very guard this
                 // satisfies — the puzzle is sent and the solve gives up on it one line
-                // later, which is what `prosopo_grid_3x3` did.
+                // later, which is what a Prosopo 3x3 grid did.
                 performedAction = true;
                 await this.emitStep(captchaElement, 'submit', 'submitted (Verify/Next)', puzzleSource, frameRole, attempt);
                 // Snapshot the frame at submit time so the NEXT attempt waits for the
@@ -1018,7 +1496,9 @@ class CaptchaKrakenSolver {
             // Only now: the wait gate re-reads the keyframe PNGs (which live inside this
             // directory) on every poll, so removing it any earlier would break the click
             // it is gating.
-            if (burstDir) {
+            // ...and not while the PLAN still holds them: the next round re-executes
+            // this same answer, and the gate reads these PNGs on every poll.
+            if (burstDir && this.animatedPlan?.burstDir !== burstDir) {
                 try {
                     fs.rmSync(burstDir, { recursive: true, force: true });
                 }
@@ -1106,30 +1586,53 @@ class CaptchaKrakenSolver {
         }
     }
     /**
-     * Detect reCAPTCHA's "Please select all matching images" error banner
-     * (and the related "Please try again" / "Please also check the new images"
-     * variants). These appear in the bframe AFTER clicking Verify with an
-     * incomplete selection. The tiles do NOT refresh on this error — without
-     * special handling the LoRA sees the same image, returns "done" (because
-     * to it everything matching IS selected), we click Verify again, and we
-     * loop until the session times out. We use this signal to switch the next
-     * grid call into "missed-tiles" retry mode.
+     * WHICH of reCAPTCHA's three bframe banners is showing, if any.
+     *
+     * They share a corner and a look and they mean different things:
+     *
+     *   `rejected`      "Please try again."  The answer was wrong; a fresh board
+     *                   follows, so the useful response is to solve that one.
+     *   `select-more`   "Please select all matching images."  Under-selected, and
+     *                   the tiles do NOT refresh — so a driver that re-submits
+     *                   the same answer loops until the session times out. This
+     *                   is the one the missed-tiles retry and the abort exist for.
+     *   `dynamic-more`  "Please also check the new images."  NOT AN ERROR. It is
+     *                   the dynamic 3x3's normal flow: cleared tiles fade out,
+     *                   replacements fade in, and the widget says so — on
+     *                   essentially every round of that variant.
+     *
+     * This used to return a boolean over all three, which made the third one
+     * indistinguishable from the first two and armed the one-retry abort with the
+     * sentence that means "you are doing fine". Every dynamic board therefore
+     * died at round two while the vendor was still dealing. Measured 2026-09-06:
+     * three of three `recaptcha_3x3_fade` attempts stopped at exactly boards=2,
+     * against `recaptcha_4x4` passing at 2, 3 and 5 boards on the same run.
      */
-    async hasRecaptchaUnderselectError(page) {
+    /**
+     * May a repeat of this banner end the solve?
+     *
+     * Only for the banners where repeating means STUCK. `dynamic-more` repeating
+     * means the board is still being cleared, which is progress, and treating it
+     * as fatal is the bug this pair of methods was split to fix.
+     */
+    bannerIsFatalAfterRetry(kind) {
+        return kind === 'select-more' || kind === 'rejected';
+    }
+    async recaptchaBannerKind(page) {
         try {
             const bframe = await page.$('iframe[src*="recaptcha/api2/bframe"]');
             if (!bframe)
-                return false;
+                return null;
             const frame = await bframe.contentFrame();
             if (!frame)
-                return false;
-            // Three selector variants reCAPTCHA uses for the same family of errors.
-            const selectors = [
-                '.rc-imageselect-error-select-more',
-                '.rc-imageselect-error-dynamic-more',
-                '.rc-imageselect-incorrect-response',
+                return null;
+            // One selector per MEANING. Order is irrelevant — reCAPTCHA shows one.
+            const banners = [
+                ['.rc-imageselect-error-select-more', 'select-more'],
+                ['.rc-imageselect-error-dynamic-more', 'dynamic-more'],
+                ['.rc-imageselect-incorrect-response', 'rejected'],
             ];
-            for (const sel of selectors) {
+            for (const [sel, kind] of banners) {
                 const el = await frame.$(sel);
                 if (el) {
                     // reCAPTCHA toggles these elements between visible / hidden via
@@ -1140,13 +1643,13 @@ class CaptchaKrakenSolver {
                     const visible = await el.isVisible().catch(() => false);
                     const text = (await el.textContent().catch(() => null)) ?? '';
                     if (visible && text.trim().length > 0)
-                        return true;
+                        return kind;
                 }
             }
-            return false;
+            return null;
         }
         catch {
-            return false;
+            return null;
         }
     }
     async isRecaptchaAnchorChecked(anchorIframe) {
@@ -1193,7 +1696,7 @@ class CaptchaKrakenSolver {
             // couple of seconds after the winning submit. Gating this on the anchor's
             // visibility meant the one signal that was already true went unread, and
             // the loop ground on against a frame being torn down. Mirrors the Python
-            // driver; pinned by tests/test_solved_detection.py in the finetune repo.
+            // driver; pinned by the training repo's solved-detection tests in the training repo.
             if (await this.hasNonEmptyFieldValue(page, '[name="h-captcha-response"]'))
                 return true;
             if (await this.hasNonEmptyFieldValue(page, '[name="g-recaptcha-response"]'))
@@ -1349,6 +1852,64 @@ class CaptchaKrakenSolver {
      * `size=invisible` in the src, and never an `api2/bframe` challenge frame, so
      * we exclude the invisible variant here.
      */
+    /**
+     * Which vendors' code this page actually loaded.
+     *
+     * Read out of the page's own resource timing plus the `src`/`href` of
+     * everything it linked, so it works whenever it is called — a request
+     * listener would have to have been attached before navigation, and by the
+     * time a solve fails that ship has sailed.
+     *
+     * Best-effort by construction: the resource-timing buffer is finite and a
+     * page may have cleared it. An empty answer is "nothing seen", never "no
+     * captcha here". Mirrors `vendors_on_the_wire` in page_solver.py.
+     */
+    async vendorsOnTheWire(page) {
+        let names = [];
+        try {
+            // `$eval('html', ...)` rather than `evaluate`: PlaywrightPage is a
+            // structural subset carrying exactly the members the solver uses, and
+            // widening it would oblige every adapter (puppeteer-adapter.ts) to grow a
+            // member for one diagnostic. The callback runs in the page either way.
+            names = await page.$eval('html', () => {
+                const out = [];
+                try {
+                    for (const e of performance.getEntriesByType('resource'))
+                        out.push(e.name);
+                }
+                catch (err) { /* buffer unavailable */ }
+                for (const el of Array.from(document.querySelectorAll('script[src],iframe[src],link[href],img[src]'))) {
+                    out.push(el.getAttribute('src') || el.getAttribute('href') || '');
+                }
+                return out;
+            });
+        }
+        catch {
+            return [];
+        }
+        const blob = (names ?? []).join(' ');
+        return VENDOR_URL_MARKERS
+            .filter(({ hosts }) => hosts.some((h) => blob.includes(h)))
+            .map(({ puzzleSource }) => puzzleSource);
+    }
+    /**
+     * Why nothing was found — the two cases told apart. The old text guessed
+     * "reCAPTCHA v3 / invisible" every time, including the times a vendor had
+     * simply moved its DOM. See VENDOR_URL_MARKERS.
+     */
+    async noWidgetMessage(page) {
+        const base = 'No interactive captcha widget detected';
+        const loaded = await this.vendorsOnTheWire(page);
+        if (!loaded.length) {
+            return `${base} (no vendor captcha code loaded on this page — likely `
+                + 'reCAPTCHA v3 / invisible, or a click-triggered challenge that has '
+                + 'not been triggered). Failing fast.';
+        }
+        return `${base}, BUT ${loaded.join('/')} code IS loaded and running on this `
+            + 'page. The vendor\'s markup no longer matches anything in '
+            + 'VENDOR_WIDGET_LOCATORS — re-measure with '
+            + 'scripts/check_vendor_selectors.py and update BOTH solver ports.';
+    }
     async hasInteractiveWidgetInDom(page) {
         // reCAPTCHA v2 anchor, but NOT the invisible (v3 / invisible-v2) variant.
         const recaptchaAnchors = await page.$$('iframe[src*="recaptcha/api2/anchor"]');
@@ -1559,7 +2120,28 @@ class CaptchaKrakenSolver {
      * falling back to the configured/`python` command. Throws if the CLI folder
      * is missing — callers that must not throw (e.g. runCliTool) wrap this.
      */
+    /**
+     * The adapter name models.json calls `latest`, resolved once per solver.
+     *
+     * `resolveLoraName` reads models.json (and pinned_model.json) off disk
+     * SYNCHRONOUSLY, and it was doing that on every inference for a file that
+     * cannot change inside one process.
+     */
+    loraName(cliRoot) {
+        if (this.loraNameCache === null)
+            this.loraNameCache = (0, model_name_1.resolveLoraName)({ cliRoot });
+        return this.loraNameCache;
+    }
     resolveCli() {
+        // MEMOISED. `resolvePythonCommand` probes the interpreter with a
+        // `spawnSync(cmd, ['--version'])`, which blocks the whole Node event loop —
+        // Playwright's socket pump and every timer with it — and this was called on
+        // EVERY inference, every CV fallback and every worker start. On the
+        // npm-install default (no bundled venv, nothing configured) that is up to
+        // two blocking process spawns per model call, for an answer that cannot
+        // change inside one process.
+        if (this.cliCache)
+            return this.cliCache;
         const { repoPath, pythonCommand } = this.config;
         const cliRoot = repoPath ?? (0, model_name_1.getBundledCliRoot)();
         if (!fs.existsSync(cliRoot)) {
@@ -1575,7 +2157,8 @@ class CaptchaKrakenSolver {
             venvPython: getVenvPython(cliRoot),
             exists: commandExists,
         });
-        return { cliRoot, py };
+        this.cliCache = { cliRoot, py };
+        return this.cliCache;
     }
     /**
      * Run an OpenCV tool subcommand of the CLI (e.g. `grid-cell-states a.png
@@ -1927,6 +2510,10 @@ class CaptchaKrakenSolver {
     }
     /** Smooth-move the mouse over one cell's center with intra-cell jitter. */
     async hoverCell(page, session, cell) {
+        // A hover is mimicry of a resting CURSOR, so on a device that has none it
+        // is not weaker mimicry — it is a mousemove at a touch-only widget.
+        if (!this.human.hovers)
+            return;
         const cellWPage = (session.gridBoxes[0][2] - session.gridBoxes[0][0]) * session.scaleX;
         const cellHPage = (session.gridBoxes[0][3] - session.gridBoxes[0][1]) * session.scaleY;
         const center = this.cellCenterPage(cell, session);
@@ -2238,13 +2825,19 @@ class CaptchaKrakenSolver {
         });
         for (let round = 1; round <= maxRounds; round++) {
             // 1. Settle and screenshot.
-            await this.waitForGridCellsLoaded(captchaElement);
+            //
+            // Round 1 skips the wait: `solveSingle` has just paid it, read the grid
+            // boxes off the loaded board and handed over, and nothing has touched
+            // the widget in between. Rounds 2..N still wait, because by then THIS
+            // driver has clicked and the tiles really are reloading.
+            if (round > 1)
+                await this.ph('grid-load', () => this.waitForGridCellsLoaded(captchaElement));
             const shotA = path.join(os.tmpdir(), `recap_${Date.now()}_${Math.floor(Math.random() * 1e9)}.png`);
             try {
                 // Explicit timeout — after a Verify this element is being torn down,
                 // and the 30s default waits for it to go stable first. See
                 // screenshot-timeouts.test.ts.
-                await captchaElement.screenshot({ path: shotA, timeout: 2500, animations: 'disabled' });
+                await this.ph('screenshot', () => captchaElement.screenshot({ path: shotA, timeout: 2500, animations: 'disabled' }));
             }
             catch {
                 // The board is gone. Stop driving rounds and let the outer loop
@@ -2275,7 +2868,7 @@ class CaptchaKrakenSolver {
                 //    (the dynamic 3x3 puzzle is the case this matters most for).
                 const retryForThisRound = pendingRetry;
                 pendingRetry = null; // only the first round carries the inbound retry hint
-                const response = await this.solveFrameFreshnessGuarded(captchaElement, shotA, (imagePath) => this.getSolution(imagePath, 'recaptcha', retryForThisRound));
+                const response = await this.ph('inference', () => this.solveFrameFreshnessGuarded(captchaElement, shotA, (imagePath) => this.getSolution(imagePath, 'recaptcha', retryForThisRound)));
                 this.archiveLatestDebugRun(attempt, response.actions);
                 allTokenUsage.push(...response.token_usage);
                 const actionList = Array.isArray(response.actions) ? response.actions : [response.actions];
@@ -2302,8 +2895,10 @@ class CaptchaKrakenSolver {
                 // Tiles are still loading; the CLI explicitly told us NOT to submit.
                 // Find what's loading, hover it, and wait for at least one to settle.
                 console.log(`[recaptcha-grid] round ${round}: CLI says wait (${action.duration_ms ?? 0}ms).`);
-                const { loading } = await this.watchClickedTiles(page, captchaElement, session, clickedOrder);
-                await this.waitForAnyClickedTileLoaded(page, captchaElement, session, loading);
+                await this.ph('fade-wait', async () => {
+                    const { loading } = await this.watchClickedTiles(page, captchaElement, session, clickedOrder);
+                    await this.waitForAnyClickedTileLoaded(page, captchaElement, session, loading);
+                });
                 continue;
             }
             if (action.action === 'click') {
@@ -2327,7 +2922,7 @@ class CaptchaKrakenSolver {
                         clickedOrder.push(cell);
                         clickedThisRound.push(cell);
                     }
-                    await delay(Math.random() * 80 + 80);
+                    await this.human.pause('between');
                 }
                 performedAction = true;
                 console.log(`[recaptcha-grid] round ${round}: clicked ${bboxes.length} tile(s) -> cells ${JSON.stringify(clickedThisRound)}.`);
@@ -2337,7 +2932,7 @@ class CaptchaKrakenSolver {
                 //    this board is answered) or go blank / fade out for a replacement
                 //    (dynamic puzzle: read it again). reCAPTCHA's reply lags the click,
                 //    so we watch a grace window, not a single instant-after snapshot.
-                const { loading, chipped } = await this.watchClickedTiles(page, captchaElement, session, clickedThisRound);
+                const { loading, chipped } = await this.ph('fade-wait', () => this.watchClickedTiles(page, captchaElement, session, clickedThisRound));
                 if (chipped || !loading.length) {
                     // Either the widget ticked our clicks and kept the photos — a board
                     // that does that is fully answered by the round that clicked it — or
@@ -2351,7 +2946,7 @@ class CaptchaKrakenSolver {
                 // Tiles are reloading — wait (while hovering) for at least one to settle
                 // before re-solving, so we don't feed the model a mid-fade grid.
                 console.log(`[recaptcha-grid] round ${round}: tiles loading ${JSON.stringify(loading)}; waiting.`);
-                await this.waitForAnyClickedTileLoaded(page, captchaElement, session, loading);
+                await this.ph('fade-wait', () => this.waitForAnyClickedTileLoaded(page, captchaElement, session, loading));
                 continue;
             }
             // Unexpected action type for a grid (drag/type) — re-solve.
@@ -2369,6 +2964,13 @@ class CaptchaKrakenSolver {
                 if (verifyButton) {
                     console.log('[recaptcha-grid] clicking Verify to submit.');
                     await this.moveAndClick(page, verifyButton);
+                    // The press IS an interaction, and saying so is load-bearing: the
+                    // caller polls for the vendor's verdict on a round that interacted
+                    // and sleeps postSolveDelayMs flat on one that did not — and throws
+                    // 'performed no interactions' if the widget outlives that sleep. A
+                    // `done` round clicks no tile, so without this line the one answer
+                    // shape that submits and nothing else reports having done nothing.
+                    performedAction = true;
                     await this.emitStep(captchaElement, 'submit', 'submitted (Verify)', 'recaptcha', 'challenge', attempt);
                     // Snapshot the submitted frame, exactly as the one-shot path does.
                     // Without it isChallengeFreshlyRendered reads the CLOSING board as a
@@ -2396,70 +2998,165 @@ class CaptchaKrakenSolver {
      * keyframes the wait gate re-reads on every poll live inside it.
      */
     async recordKeyframeBurst(captchaElement) {
+        const rec = this.startKeyframeBurst(captchaElement);
+        return rec.finish();
+    }
+    /**
+     * Start recording NOW, and let the caller decide later what it was for.
+     *
+     * This is what makes the speculative path possible. The burst is the only
+     * thing that can tell a cycling board from a still one, and it is also the
+     * recording that answers it — so it is started at the same moment the still
+     * screenshot goes to the model, and the two run together.
+     *
+     *   - the board never moves  -> `moved()` stays false, the still answer is
+     *     used, and the frames are thrown away. The recording cost nothing but
+     *     CPU, because it happened inside an inference we were already waiting
+     *     for.
+     *   - the board moves        -> the still answer is DISCARDED unread, the
+     *     burst runs on to the end of the cycle, and the multi-image answer is
+     *     the one acted on. Two inference CALLS, but only about one inference of
+     *     wall-clock, because the first ran during the recording.
+     *
+     * The old shape paid for that knowledge in whole ROUNDS: answer a still, act
+     * on it, notice nothing changed, answer another still, and only then record.
+     * ~15s of a 40s solve to learn something the first four frames already knew.
+     */
+    startKeyframeBurst(captchaElement) {
         const fps = Math.max(1, this.config.videoBurstFps ?? 10);
         const durationMs = this.config.videoBurstDurationMs ?? 4000;
-        /*
-         * THE ESCALATION BUYS ITS OWN BUDGET, once per solve.
-         *
-         * `overallSolveTimeoutMs` counts rounds and a recording is not a round —
-         * see `videoExtraInferenceMs` for the arithmetic and for what it cost not
-         * to have it. Recorded as an EXTENSION rather than by loosening the config,
-         * so a solve that never escalates keeps the deadline the caller asked for.
-         *
-         * Same one-shot, same total, same reason as page_solver.py's
-         * `video_budget_ms`: the ports must not disagree about how long a video
-         * solve may take, or the same fixture passes on one and times out on the
-         * other and it reads as a driver bug.
-         */
-        if (this.config.videoSolveEnabled !== false && !this.videoBudgetGranted) {
-            this.videoBudgetGranted = true;
-            this.videoBudgetMs =
-                durationMs +
-                    (this.config.keyframeWaitTimeoutMs ?? 6000) +
-                    (this.config.videoExtraInferenceMs ?? 8000);
-        }
-        const total = Math.max(1, Math.round(durationMs / (1000 / fps)));
+        const floorFrames = Math.max(1, Math.round(durationMs / (1000 / fps)));
+        const ceilingMs = this.config.videoBurstMaxMs ?? 12000;
+        const total = Math.max(floorFrames, Math.round(ceilingMs / (1000 / fps)));
         const intervalMs = 1000 / fps;
+        // A burst that runs far past its own length is a hung screenshot, not a
+        // tight budget — bounded separately so the two cannot be confused. Mirrors
+        // `_record_keyframes` in the python port.
+        const hangDeadline = Date.now() + burstHangDeadlineMs(this.config);
         const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ck_burst_'));
+        const order = []; // distinct screens, in first-seen order
         let captured = 0;
-        for (let i = 0; i < total; i++) {
-            const started = Date.now();
-            const frame = path.join(dir, `frame_${String(i).padStart(4, '0')}.png`);
-            try {
-                await captchaElement.screenshot({
-                    path: frame,
-                    timeout: this.config.elementScreenshotTimeoutMs ?? 8000,
-                    // ANIMATIONS STAY ON. Everywhere else in this file screenshots are
-                    // taken with animations: 'disabled', which is right when the goal is
-                    // a stable still — it fast-forwards finite animations and FREEZES
-                    // infinite ones. Here the motion IS the subject, so freezing it
-                    // records the same picture forty times: GeeTest's svg board cycles in
-                    // CSS, and the slicer correctly reported the burst as `mode=static`
-                    // and cut it down to a single keyframe, putting us back to answering
-                    // a still. hCaptcha's animated challenges hid this because they
-                    // animate in canvas, which that flag does not touch.
-                    animations: 'allow',
-                });
-                captured++;
-            }
-            catch {
-                // A dropped frame costs a sample, not the recording.
+        let lastDigest = null;
+        // Frame index of the most recent NEW screen. A board that has shown
+        // nothing new for a whole floor-length window has SETTLED.
+        let lastNewAt = 0;
+        let cycleClosed = false;
+        let stopped = false;
+        let runToEnd = false; // set by finish(): keep going past the floor
+        const loop = (async () => {
+            for (let i = 0; i < total && !stopped; i++) {
+                if (Date.now() > hangDeadline) {
+                    console.warn(`[animated] the recording stalled: ${captured} of ${total} frames in `
+                        + `${burstHangDeadlineMs(this.config)}ms — the widget is not screenshotting`);
+                    break;
+                }
+                const started = Date.now();
+                const frame = path.join(dir, `frame_${String(i).padStart(4, '0')}.png`);
+                try {
+                    await captchaElement.screenshot({
+                        path: frame,
+                        timeout: this.config.elementScreenshotTimeoutMs ?? 8000,
+                        // ANIMATIONS STAY ON. Everywhere else in this file screenshots are
+                        // taken with animations: 'disabled', which is right when the goal is
+                        // a stable still — it fast-forwards finite animations and FREEZES
+                        // infinite ones. Here the motion IS the subject, so freezing it
+                        // records the same picture forty times: GeeTest's svg board cycles
+                        // in CSS, and the slicer correctly reported the burst as
+                        // `mode=static` and cut it to a single keyframe, putting us back to
+                        // answering a still. hCaptcha's animated challenges hid this because
+                        // they animate in canvas, which that flag does not touch.
+                        animations: 'allow',
+                    });
+                    captured++;
+                    try {
+                        const d = (0, crypto_1.createHash)('sha1').update(fs.readFileSync(frame)).digest('hex');
+                        if (d !== lastDigest) {
+                            // A screen already recorded, coming back after another one: the
+                            // loop has closed and every screen is now in the clip.
+                            if (order.includes(d) && order.length >= 2)
+                                cycleClosed = true;
+                            else if (!order.includes(d)) {
+                                order.push(d);
+                                lastNewAt = captured;
+                            }
+                            lastDigest = d;
+                        }
+                    }
+                    catch { /* a digest we could not take just means no early stop */ }
+                }
+                catch {
+                    // A dropped frame costs a sample, not the recording.
+                }
+                // Past the floor and the cycle has closed — anything more is the same
+                // screens again, paid for in wall-clock the solve budget needs.
+                // A board that never closes a cycle used to have no exit at all: the
+                // loop ran to `total`, so every escalation onto a non-cycling widget
+                // filmed the whole videoBurstMaxMs. Mirrors `_record_keyframes` in the
+                // python port, which carries the measurement — including why "one
+                // screen" is not enough: a board that transitions ONCE and then holds
+                // shows two screens, repeats neither, and ran the full ceiling.
+                if (runToEnd && i + 1 >= floorFrames && captured - lastNewAt >= floorFrames) {
+                    console.log(`[animated] no new screen for ${(floorFrames * intervalMs / 1000).toFixed(1)}s `
+                        + `(${order.length} seen) — the board has settled; stopping the burst`);
+                    break;
+                }
+                if (runToEnd && cycleClosed && i + 1 >= floorFrames) {
+                    console.log(`[animated] cycle closed after ${((i + 1) * intervalMs / 1000).toFixed(1)}s `
+                        + `(${order.length} screens); stopping the burst`);
+                    break;
+                }
+                // Drift-corrected: a slow screenshot must not stretch the clip, or the
+                // burst covers more wall-clock than the model trained on and a cycle's
+                // period lands differently across the frames.
+                const wait = intervalMs - (Date.now() - started);
+                if (wait > 0 && i < total - 1)
+                    await delay(wait);
             }
-            // Drift-corrected: a slow screenshot must not stretch the clip, or the
-            // burst covers more wall-clock than the model trained on and a cycle's
-            // period lands differently across the frames.
-            const wait = intervalMs - (Date.now() - started);
-            if (wait > 0 && i < total - 1)
-                await delay(wait);
-        }
-        if (!captured) {
-            fs.rmSync(dir, { recursive: true, force: true });
-            const e = new Error('ANIMATED_CHALLENGE: could not record the animated challenge (no frame screenshotted).');
-            e.animated = true;
-            throw e;
-        }
-        console.log(`[animated] recorded ${captured} frames at ${fps}fps -> ${dir}`);
-        return dir;
+        })();
+        return {
+            // More than one picture seen. This is the ONLY question the speculative
+            // caller needs answered, and the burst answers it for free.
+            moved: () => order.length >= 2,
+            abandon: async () => {
+                stopped = true;
+                try {
+                    await loop;
+                }
+                catch { /* the recording never fails a solve */ }
+                fs.rmSync(dir, { recursive: true, force: true });
+            },
+            finish: async () => {
+                runToEnd = true;
+                // THE ESCALATION BUYS ITS OWN BUDGET, once per solve.
+                //
+                // `overallSolveTimeoutMs` counts rounds and a recording is not a round.
+                // Granted HERE rather than when the burst starts, because a speculative
+                // burst that turns out to be unnecessary must not extend the deadline
+                // of a still solve. Recorded as an EXTENSION rather than by loosening
+                // the config, so a solve that never escalates keeps the deadline the
+                // caller asked for. Same one-shot, same total, same reason as
+                // page_solver.py's `video_budget_ms`.
+                if (this.config.videoSolveEnabled !== false && !this.videoBudgetGranted) {
+                    this.videoBudgetGranted = true;
+                    this.videoBudgetMs =
+                        (this.config.videoBurstMaxMs ?? 12000) +
+                            (this.config.keyframeWaitTimeoutMs ?? exports.SOLVE_DEFAULTS.keyframeWaitTimeoutMs) +
+                            (this.config.videoExtraInferenceMs ?? 8000);
+                }
+                try {
+                    await loop;
+                }
+                catch { /* fall through to the captured-count check */ }
+                if (!captured) {
+                    fs.rmSync(dir, { recursive: true, force: true });
+                    const e = new Error('ANIMATED_CHALLENGE: could not record the animated challenge (no frame screenshotted).');
+                    e.animated = true;
+                    throw e;
+                }
+                console.log(`[animated] recorded ${captured} frames at ${fps}fps -> ${dir}`);
+                return dir;
+            },
+        };
     }
     /**
      * Slice a recorded burst into keyframes and solve them in ONE model request.
@@ -2478,7 +3175,7 @@ class CaptchaKrakenSolver {
         // models.json, so the name and the prompt generation it selects come from
         // the same place the Python port reads them. See model-name.ts.
         const { cliRoot, py } = this.resolveCli();
-        const { model = (0, model_name_1.resolveLoraName)({ cliRoot }), apiKey = process.env.CAPTCHA_KRAKEN_API_KEY ?? process.env.VLLM_API_KEY, } = this.config;
+        const { model = this.loraName(cliRoot), apiKey = process.env.CAPTCHA_KRAKEN_API_KEY ?? process.env.VLLM_API_KEY, } = this.config;
         const args = [
             '-m', 'captchakraken.cli', 'solve-animated',
             '--frames-dir', framesDir,
@@ -2493,13 +3190,14 @@ class CaptchaKrakenSolver {
             // literally, with no quoting hazard.
             const { stdout, stderr } = await execFileAsync(py, args, {
                 cwd: cliRoot,
-                env: (0, cli_invocation_1.solveEnv)(cliEnv(cliRoot, this.solveSessionId ? { CAPTCHA_KRAKEN_SESSION: this.solveSessionId } : undefined), apiKey),
+                env: (0, cli_invocation_1.solveEnv)(cliEnv(cliRoot, this.solveSessionId ? { CAPTCHA_KRAKEN_SESSION: this.solveSessionId } : undefined), apiKey, this.resampleLevel),
                 maxBuffer: 10 * 1024 * 1024,
             });
             if (stderr)
                 console.error('CaptchaKraken CLI stderr:', stderr);
             const parsed = JSON.parse(stdout.trim());
             this.keyframeMode = parsed.keyframe_mode ?? null;
+            this.keyframeSteadyScreens = parsed.steady_screens ?? 0;
             console.log(`[animated] ${parsed.source_frames} frames -> ${(parsed.keyframes ?? []).length} `
                 + `keyframe(s) (mode=${parsed.keyframe_mode})`);
             return { actions: parsed.actions ?? [], token_usage: parsed.token_usage ?? [] };
@@ -2540,21 +3238,31 @@ class CaptchaKrakenSolver {
      * one-way fade, a sprite crossing — so there is no state to come back to and
      * this can only run out its full 6s, PER CLICK, before clicking the
      * coordinates it already had. It is also the normal case, not a corner: all
-     * 116 real clips under cleanSamples/test/raw are `even` and `cycle` has never
-     * fired on real footage. Measured on hcaptcha_rotating_obj_video: 6.0s of a
+     * 116 real clips under the held-out sample corpus are `even` and `cycle` has never
+     * fired on real footage. Measured on an hCaptcha rotating-object animation: 6.0s of a
      * 28.8s solve, closest region diff 0.0721 against a 0.05 tolerance, then the
      * same click, then solved. Kept for `cycle`/`static`, where the state does
      * come back and waiting is the difference between the sprite and background.
      */
     async waitForKeyframe(captchaElement, keyframePath, cx, cy) {
-        if (this.keyframeMode === 'even') {
-            console.log('[animated] clip is mode=even (no state recurs); '
-                + "acting on the model's frame without waiting");
+        // NOT `mode === 'even'`. See `keyframeSteadyScreens`: a board that holds a
+        // few screens is worth waiting for whether or not one burst was long enough
+        // to catch it repeating. What is NOT worth waiting for is a clip with no
+        // steady screens at all — a rotation, a one-way fade, a sprite crossing —
+        // where the gate can only ever time out. Measured: 0 steady screens for all
+        // five continuous hCaptcha video types, 2-3 for every real GeeTest svg.
+        if (this.keyframeSteadyScreens < 2) {
+            console.log(`[animated] clip sits on ${this.keyframeSteadyScreens} steady screen(s); `
+                + "nothing to come back to, acting on the model's frame without waiting");
             return false;
         }
-        const timeout = this.config.keyframeWaitTimeoutMs ?? 6000;
+        const timeout = this.config.keyframeWaitTimeoutMs ?? exports.SOLVE_DEFAULTS.keyframeWaitTimeoutMs;
         const interval = this.config.keyframeWaitPollMs ?? 120;
-        const deadline = Date.now() + timeout;
+        // Never past the solve's own deadline: waiting for a screen we no longer
+        // have time to click is pure overrun. Mirrors `_check_deadline` in the
+        // Python port's wait loop.
+        const deadline = Math.min(Date.now() + timeout, this.solveDeadlineAt || Number.MAX_SAFE_INTEGER);
+        let polls = 0;
         const probe = path.join(os.tmpdir(), `ck_kfwait_${Date.now()}_${Math.floor(Math.random() * 1e9)}.png`);
         let best = 1;
         try {
@@ -2563,7 +3271,18 @@ class CaptchaKrakenSolver {
                     await captchaElement.screenshot({
                         path: probe,
                         timeout: this.config.elementScreenshotTimeoutMs ?? 8000,
-                        animations: 'disabled',
+                        // 'allow', NOT 'disabled'. THE MOTION IS THE THING BEING WATCHED.
+                        //
+                        // Playwright's `disabled` fast-forwards finite animations and
+                        // FREEZES infinite ones — so a board cycling in CSS is photographed
+                        // in the same frozen state on every poll, and a gate whose whole
+                        // job is to notice the screen changing could never notice it. It
+                        // either matched immediately (on the frozen frame, i.e. whichever
+                        // screen the freeze happened to catch) or ran the full budget out.
+                        //
+                        // `recordKeyframeBurst` already learned this and says so; the probe
+                        // that watches for the SAME motion was still freezing it.
+                        animations: 'allow',
                     });
                     const r = await this.runCvTool('match-region', { ref: keyframePath, live: probe, cx, cy }, ['match-region', keyframePath, probe, String(cx), String(cy)]);
                     if (typeof r?.diff === 'number')
@@ -2572,6 +3291,22 @@ class CaptchaKrakenSolver {
                         console.log(`[animated] widget matched the chosen keyframe (diff=${r.diff.toFixed(4)})`);
                         return true;
                     }
+                    // NOT THIS BOARD AT ALL — stop waiting for a screen of it.
+                    //
+                    // The screens of one board differ from each other by very little:
+                    // 0.0056 measured on GeeTest svg, where a few glyph strokes change.
+                    // A different board reads 0.77. So a diff this large is not "the
+                    // wrong screen is up", it is "the puzzle we recorded is gone" —
+                    // solved, refreshed, or replaced — and the remaining budget buys
+                    // nothing. It was spending the full 9s on this, once per solve,
+                    // AFTER the click that had already succeeded.
+                    polls++;
+                    if (polls >= NOT_THIS_BOARD_POLLS && best > NOT_THIS_BOARD_DIFF) {
+                        console.log(`[animated] the widget no longer resembles the recorded board `
+                            + `(best diff=${best.toFixed(4)} over ${polls} polls); not waiting out the budget`);
+                        this.discardAnimatedPlan();
+                        return false;
+                    }
                 }
                 catch {
                     // A failed probe is one lost poll, not a failed solve.
@@ -2587,8 +3322,14 @@ class CaptchaKrakenSolver {
                 catch { /* best-effort */ }
             }
         }
+        // NEVER SAW IT. Either the board moved on to a different challenge, or the
+        // answer was for a screen this widget does not show. Both mean the plan is
+        // spent, so the next round records afresh rather than re-clicking a cell
+        // chosen from pictures that are gone.
+        this.discardAnimatedPlan();
         console.log(`[animated] widget never matched the chosen keyframe within ${timeout}ms `
-            + `(closest diff=${best.toFixed(4)}); clicking on the model's coordinates anyway`);
+            + `(closest diff=${best.toFixed(4)}); clicking on the model's coordinates anyway, `
+            + `and recording afresh next round`);
         return false;
     }
     /**
@@ -2600,10 +3341,14 @@ class CaptchaKrakenSolver {
     resetSolveState() {
         this.solutionCache.clear();
         this.repeatedAnswerSeen = false;
+        this.discardAnimatedPlan();
         this.lastSubmitFrameHash = null;
         this.keyframeMode = null;
+        this.keyframeSteadyScreens = 0;
+        this.solveDeadlineAt = 0;
         this.lastAnswerSig = null;
         this.noProgressRounds = 0;
+        this.resampleLevel = 0;
         // Per SOLVE, not per process: a grant leaking into the next captcha would
         // silently hand a still puzzle 18s it was never meant to have.
         this.videoBudgetMs = 0;
@@ -2654,9 +3399,14 @@ class CaptchaKrakenSolver {
             console.log(`[no-progress] the model returned the same answer again `
                 + `(${this.noProgressRounds}/${this.config.maxNoProgressRounds ?? 2}) — `
                 + `the previous one already ran and changed nothing`);
-            // A board that reads the same every round is the signature of a CYCLING
-            // challenge answered as a still. Let the recording path have a go before
-            // giving up on the solve entirely.
+            // THE SAME ANSWER IS NOT NEWS — IT IS ARITHMETIC. The CLI sends
+            // `temperature: 0`, so re-reading an unchanged board returns the
+            // identical answer by construction, and counting that to a limit
+            // measures the limit. Ask for a different SAMPLE instead.
+            this.resampleLevel++;
+            // A board that reads the same every round is ALSO the signature of a
+            // CYCLING challenge answered as a still. Let the recording path have a go
+            // before giving up on the solve entirely.
             this.repeatedAnswerSeen = true;
         }
         else {
@@ -2696,6 +3446,45 @@ class CaptchaKrakenSolver {
      * never animated, so escalating there would swap a path that works for one
      * that cannot read a grid.
      */
+    /** Forget the recorded answer, and delete the frames it was holding. */
+    discardAnimatedPlan() {
+        const dir = this.animatedPlan?.burstDir;
+        this.animatedPlan = null;
+        if (dir && fs.existsSync(dir)) {
+            try {
+                fs.rmSync(dir, { recursive: true, force: true });
+            }
+            catch { /* best-effort */ }
+        }
+    }
+    /**
+     * Should this round record while it asks?
+     *
+     * reCAPTCHA is excluded for the same reason it is excluded from the animated
+     * path at all: its dynamic 3x3 REPLACES tiles in place, has its own
+     * multi-round driver with its own fade gates, and its grids are never
+     * animated — so a burst there would film a fade and call it a cycle.
+     *
+     * Distorted-text rounds are excluded because the answer is a string, not a
+     * place, and nothing about a recording helps read one.
+     */
+    shouldSpeculate(puzzleSource, textMode) {
+        if (this.config.videoSolveEnabled === false)
+            return false;
+        // OPT-IN — `!== true`, so UNSET means off. Mirrors
+        // `PageSolverConfig.speculative_burst_enabled`, which carries the
+        // measurement: the burst calls a board "moving" on an exact frame hash, so
+        // render noise reads as a second screen, the cycle never closes, and a
+        // STILL board films to the ceiling while real animations stop at the floor.
+        // Both ports flip together or the driver gate measures two drivers.
+        if (this.config.speculativeBurstEnabled !== true)
+            return false;
+        if (puzzleSource === 'recaptcha')
+            return false;
+        if (textMode)
+            return false;
+        return true;
+    }
     shouldRetryAsAnimated(puzzleSource) {
         if (!this.repeatedAnswerSeen)
             return false;
@@ -2731,7 +3520,7 @@ class CaptchaKrakenSolver {
     async askModel(imagePath, puzzleSource = 'unknown', retryMode = null, textMode = false) {
         // resolveCli() FIRST — see getAnimatedSolution.
         const { cliRoot, py } = this.resolveCli();
-        const { model = (0, model_name_1.resolveLoraName)({ cliRoot }), apiKey = process.env.CAPTCHA_KRAKEN_API_KEY ?? process.env.VLLM_API_KEY, } = this.config;
+        const { model = this.loraName(cliRoot), apiKey = process.env.CAPTCHA_KRAKEN_API_KEY ?? process.env.VLLM_API_KEY, } = this.config;
         // An ARGV ARRAY for execFile, not a string for a shell.
         //
         // This was `cmdParts.join(' ')` handed to `exec`, so the bearer token sat in
@@ -2752,6 +3541,10 @@ class CaptchaKrakenSolver {
             // distorted-text prompt and skip grid detection. The picture alone cannot
             // decide this — see the textMode note in solveSingle.
             textMode,
+            // Undefined unless the caller pinned one, which is the normal case: a
+            // routed model picks its own expert from the prompt family the CLI is
+            // about to send.
+            expert: this.config.expert,
         });
         console.log(`Executing CaptchaKraken CLI: ${(0, cli_invocation_1.redactCommand)([py, ...args].join(' '), apiKey)}`);
         try {
@@ -2761,7 +3554,7 @@ class CaptchaKrakenSolver {
                 // session id — the other cliEnv() call sites run pure-OpenCV subcommands
                 // that never touch the inference endpoint. `solveEnv` adds the bearer
                 // token here, which is what keeps it out of argv.
-                env: (0, cli_invocation_1.solveEnv)(cliEnv(cliRoot, this.solveSessionId ? { CAPTCHA_KRAKEN_SESSION: this.solveSessionId } : undefined), apiKey),
+                env: (0, cli_invocation_1.solveEnv)(cliEnv(cliRoot, this.solveSessionId ? { CAPTCHA_KRAKEN_SESSION: this.solveSessionId } : undefined), apiKey, this.resampleLevel),
                 maxBuffer: 10 * 1024 * 1024 // Increase buffer for large outputs if needed
             });
             console.log('CaptchaKraken CLI stdout:', stdout);
@@ -2859,16 +3652,65 @@ class CaptchaKrakenSolver {
         const maxReSolves = this.config.maxStaleFrameReSolves ?? 2;
         const ownedFrames = []; // fresh frames WE captured (never initialShot)
         const mergedUsage = [];
+        // Declared out here so the `finally` can remove it.
+        const liveAnchor = path.join(os.tmpdir(), `ck_move_${Date.now()}_${Math.floor(Math.random() * 1e9)}.png`);
         try {
             let currentPath = initialShot;
+            // An anchor for the movement question, taken LIVE — the screenshot sent
+            // to the model was taken with animations frozen, so comparing against it
+            // asks "does the live widget differ from a frozen one", which is a
+            // different and much noisier question than "did it move".
+            let haveAnchor = false;
+            try {
+                await captchaElement.screenshot({ path: liveAnchor, timeout: 2500, animations: 'allow' });
+                haveAnchor = true;
+            }
+            catch { /* no anchor, no movement check — never fails a solve */ }
             let response = await runQuery(currentPath);
             mergedUsage.push(...response.token_usage);
             if (!enabled)
                 return response;
+            // DID THE PICTURE MOVE WHILE THE MODEL READ IT? Asked once per round, at
+            // the noise floor rather than the staleness threshold.
+            //
+            // A still puzzle answers no and pays one cheap frame diff. A cycling one
+            // answers yes, and the driver can stop pretending it is a still a whole
+            // round earlier than the "same answer came back twice" rule allows —
+            // which cost two still inferences and ~15s of a 40s solve.
+            //
+            // Acting on ONE observation is safe because the recording is
+            // self-checking: a widget that turns out not to move slices to a single
+            // keyframe and is solved as the still it is, for the price of one burst.
+            // page_solver.py makes that argument in `_settle_or_animated`.
+            if (!this.repeatedAnswerSeen && haveAnchor
+                && await this.captchaFrameChangedSince(captchaElement, liveAnchor, MOVED_DURING_INFERENCE_DIFF, 'allow')) {
+                this.repeatedAnswerSeen = true;
+                console.log('[freshness] the widget moved while the model was reading it, with '
+                    + 'nothing clicked — recording it rather than answering another still.');
+            }
+            let changedDuringInference = 0;
             for (let i = 0; i < maxReSolves; i++) {
                 if (!(await this.captchaFrameChangedSince(captchaElement, currentPath, threshold))) {
                     break; // frame held still through inference — the answer is valid.
                 }
+                // CHANGED AGAIN, having already re-solved once and touched nothing.
+                //
+                // One change is a board still developing — tiles fading in — which is
+                // what the re-solve below is for. A SECOND change in the same round is
+                // a board that does not stop, and re-solving it is futile: each answer
+                // is for a screen that will be gone before the click. Recording it is
+                // what works, and this is the earliest the driver can know.
+                //
+                // It used to learn it a round later, from the same answer coming back
+                // twice — two still inferences and ~10s of a 40s solve spent
+                // rediscovering something the guard had already watched happen.
+                if (++changedDuringInference >= 2) {
+                    this.repeatedAnswerSeen = true;
+                    console.log('[freshness] the frame changed twice during inference with nothing '
+                        + 'clicked — this board cycles; recording it rather than re-solving '
+                        + 'a screen that has gone.');
+                    return { actions: response.actions, token_usage: mergedUsage };
+                }
                 const fresh = path.join(os.tmpdir(), `freshsolve_${Date.now()}_${Math.floor(Math.random() * 1e9)}.png`);
                 try {
                     await captchaElement.screenshot({ path: fresh, timeout: 2500, animations: 'disabled' });
@@ -2889,6 +3731,12 @@ class CaptchaKrakenSolver {
             return { actions: response.actions, token_usage: mergedUsage };
         }
         finally {
+            if (fs.existsSync(liveAnchor)) {
+                try {
+                    fs.unlinkSync(liveAnchor);
+                }
+                catch { /* best-effort */ }
+            }
             for (const f of ownedFrames) {
                 if (fs.existsSync(f)) {
                     try {
@@ -2908,7 +3756,7 @@ class CaptchaKrakenSolver {
      * temp frame. Best-effort: any screenshot/diff failure returns false so the
      * caller acts on the answer it already has rather than spinning.
      */
-    async captchaFrameChangedSince(captchaElement, priorPath, threshold) {
+    async captchaFrameChangedSince(captchaElement, priorPath, threshold, animations = 'disabled') {
         const probe = path.join(os.tmpdir(), `freshcheck_${Date.now()}_${Math.floor(Math.random() * 1e9)}.png`);
         try {
             await captchaElement.screenshot({ path: probe, timeout: 2500, animations: 'disabled' });
@@ -3055,12 +3903,15 @@ class CaptchaKrakenSolver {
     /**
      * Run `fn` (typically the model query) while idly drifting the cursor over
      * the captcha, so the mouse behaves like a human weighing the options instead
-     * of freezing during inference. Uses the same generate_trajectory paths as real
-     * clicks; cancelled the instant `fn` resolves. Best-effort — any wander error
-     * is swallowed and never fails the solve. Disable via config.idleMouseWander.
+     * of freezing during inference. Uses the same humanizer as real clicks, so a
+     * mode with no cursor skips it entirely; cancelled the instant `fn` resolves.
+     * Best-effort — any wander error is swallowed and never fails the solve.
+     * Disable via config.idleMouseWander.
      */
     async withIdleWander(page, element, fn) {
-        if (this.config.idleMouseWander === false)
+        // Same rule as hoverCell: drifting a cursor that does not exist would emit
+        // mousemove at a touch-only widget.
+        if (this.config.idleMouseWander === false || !this.human.hovers)
             return fn();
         let box = null;
         try {
@@ -3073,10 +3924,22 @@ class CaptchaKrakenSolver {
             return fn();
         const b = box;
         let stop = false;
+        // The dwell is INTERRUPTIBLE, and that is not a detail. `fn` is the model
+        // call; the moment it returns there is a click to make, and the finally
+        // below waits for this loop to notice. With a plain `delay` it noticed only
+        // when the timer ran out, so every inference was followed by up to 540ms of
+        // waiting for a pause nobody was watching — paid once per round, and the
+        // Python port pays none of it because it does not wander at all. Same
+        // wake-able-sleep shape as watcher.ts.
+        const waker = { fn: null };
+        const nap = (ms) => new Promise((resolve) => {
+            const timer = setTimeout(() => { waker.fn = null; resolve(); }, ms);
+            waker.fn = () => { clearTimeout(timer); waker.fn = null; resolve(); };
+        });
         const pad = 0.18; // keep drift inside the tile area, off the extreme edges
         const wander = (async () => {
             // brief pause before the first drift — don't lurch the instant we ask
-            await delay(120 + Math.random() * 180);
+            await nap(120 + Math.random() * 180);
             while (!stop) {
                 const tx = b.x + b.width * (pad + Math.random() * (1 - 2 * pad));
                 const ty = b.y + b.height * (pad + Math.random() * (1 - 2 * pad));
@@ -3088,7 +3951,7 @@ class CaptchaKrakenSolver {
                 }
                 if (stop)
                     break;
-                await delay(180 + Math.random() * 360); // human dwell between glances
+                await nap(180 + Math.random() * 360); // human dwell between glances
             }
         })();
         try {
@@ -3096,6 +3959,7 @@ class CaptchaKrakenSolver {
         }
         finally {
             stop = true;
+            waker.fn?.();
             await wander.catch(() => { });
         }
     }
@@ -3111,7 +3975,21 @@ class CaptchaKrakenSolver {
         if (!elem) {
             throw new Error(`Element not found: ${selectorOrElement}`);
         }
-        await elem.scrollIntoViewIfNeeded();
+        // BOUNDED. Playwright's default is 30s and it waits for the element to be
+        // STABLE — not animating — before it will scroll. This runs once per action
+        // and once per submit, so on a challenge that is mid-animation it burned
+        // the full default every time: measured 10.1s of a 12.0s an MTCaptcha distorted-text puzzle
+        // solve, spent scrolling to a text box that was already on screen. The
+        // element is on screen in every real case here (we just screenshotted it),
+        // so a short bound loses nothing: on timeout we move to wherever it is.
+        // page_solver.py has had this since it turned a ~5s solve loop into minutes
+        // in live testing; this port never got it.
+        try {
+            await elem.scrollIntoViewIfNeeded({ timeout: 2000 });
+        }
+        catch {
+            /* an unscrolled element is still where boundingBox says it is */
+        }
         const box = await elem.boundingBox();
         if (!box) {
             throw new Error(`Element has no bounding box: ${selectorOrElement}`);
@@ -3127,64 +4005,77 @@ class CaptchaKrakenSolver {
     }
     async moveAndClick(page, element) {
         await this.move(page, element);
-        await page.mouse.down();
-        await delay(Math.random() * 20 + 20);
-        await page.mouse.up();
+        await this.ph('mouse', () => this.human.click(page, this.human.at));
     }
+    /**
+     * Travel to a point. What that MEANS is the humanizer's business — on a
+     * touchscreen with no finger down it is a bookkeeping update and emits
+     * nothing at all.
+     */
     async performSmoothMove(page, x, y) {
-        // 60Hz sampling; see src/trajectory.ts
-        const [points, timings] = (0, trajectory_js_1.generate_trajectory)([this.lastMousePosition.x, this.lastMousePosition.y], [x, y], 60 // 60 points per second
-        );
-        const SPEED_MULTIPLIER = 1;
-        const vectors = [];
-        for (let i = 0; i < points.length; i++) {
-            vectors.push({
-                x: points[i][0],
-                y: points[i][1],
-                timestamp: timings[i] / SPEED_MULTIPLIER // timings are cumulative from start
-            });
+        await this.ph('mouse', () => this.human.move(page, [x, y]));
+    }
+    /**
+     * Where in the element this click lands, in element-relative pixels.
+     *
+     * Split out of `executeClick` because on an animated board the point has to
+     * be chosen ONCE and then used three times — to park the pointer, to ask
+     * `match-region` about the right neighbourhood, and to press. Choosing it
+     * inside the click (it is randomised within the target) meant the gate
+     * watched the bbox centre while the press landed somewhere else.
+     */
+    clickPointFor(action, elementBox) {
+        if (action.target_bounding_box) {
+            const [minX, minY, maxX, maxY] = action.target_bounding_box;
+            const pixelMinX = minX * elementBox.width;
+            const pixelMaxX = maxX * elementBox.width;
+            const pixelMinY = minY * elementBox.height;
+            const pixelMaxY = maxY * elementBox.height;
+            const paddingX = (pixelMaxX - pixelMinX) * 0.1;
+            const paddingY = (pixelMaxY - pixelMinY) * 0.1;
+            const safeMinX = pixelMinX + paddingX;
+            const safeMaxX = pixelMaxX - paddingX;
+            const safeMinY = pixelMinY + paddingY;
+            const safeMaxY = pixelMaxY - paddingY;
+            return [
+                safeMinX + Math.random() * (safeMaxX - safeMinX),
+                safeMinY + Math.random() * (safeMaxY - safeMinY),
+            ];
+        }
+        if (action.target_coordinates) {
+            const [xPct, yPct] = action.target_coordinates;
+            return [xPct * elementBox.width, yPct * elementBox.height];
         }
-        await this.tracePath(page, vectors);
+        return null;
     }
-    async tracePath(page, vectors) {
-        // Get viewport for clamping
-        let viewport = { width: 1920, height: 1080 };
-        try {
-            const vp = page.viewportSize();
-            if (vp)
-                viewport = vp;
-        }
-        catch (e) { }
-        const startTime = Date.now();
-        for (let i = 0; i < vectors.length; i++) {
-            const v = vectors[i];
-            try {
-                // Clamp coordinates to viewport
-                const clampedX = Math.max(0, Math.min(v.x, viewport.width));
-                const clampedY = Math.max(0, Math.min(v.y, viewport.height));
-                // Move mouse
-                await page.mouse.move(clampedX, clampedY);
-                // Update last position
-                this.lastMousePosition = { x: clampedX, y: clampedY };
-                // Calculate delay to match target timestamp
-                if (v.timestamp !== undefined) {
-                    const targetTime = startTime + v.timestamp;
-                    const now = Date.now();
-                    const delayMs = targetTime - now;
-                    if (delayMs > 0) {
-                        await delay(delayMs);
-                    }
-                }
-            }
-            catch (error) {
-                // Check if page closed or other fatal errors if needed, otherwise ignore
-                const errorMessage = error instanceof Error ? error.message : String(error);
-                if (errorMessage.includes('Target closed') || errorMessage.includes('Session closed')) {
-                    log('Warning: could not move mouse, page or session closed.');
-                    return;
-                }
-            }
+    /**
+     * Click one target on an ANIMATED board, at the moment its screen is up.
+     *
+     * The order is the point of it. The pointer is parked on the target FIRST,
+     * then the gate opens, then the press happens in place — so the only thing
+     * between "the right screen is showing" and the click is a mouse-down.
+     *
+     * It used to wait and then call `executeClick`, which begins with a humanised
+     * move: 274ms p10 / 398ms p50 / 647ms max across a 340x384 widget, against a
+     * 1500ms median dwell. A quarter to a third of the screen's life spent
+     * travelling after we had already confirmed it was the right one — so the
+     * gate could do its job and the click still land on the next screen.
+     * `move()` short-circuits when it is already at the target, so parking early
+     * costs nothing and removes all of it.
+     */
+    async clickWhenFrameMatches(page, element, action, elementBox, awaitKeyframe) {
+        const rel = this.clickPointFor(action, elementBox);
+        if (!rel) {
+            console.warn('Click action received without coordinates or bounding box', action);
+            return;
         }
+        const at = [elementBox.x + rel[0], elementBox.y + rel[1]];
+        await this.ph('mouse', () => this.human.move(page, at));
+        // The gate watches the neighbourhood of the point we are about to press,
+        // not the middle of the box — those differ on a wide target, and the one
+        // that matters is where the finger is.
+        await this.waitForKeyframe(element, awaitKeyframe, rel[0] / elementBox.width, rel[1] / elementBox.height);
+        await this.ph('mouse', () => this.human.click(page, at));
     }
     async executeClick(page, element, action, elementBox) {
         let relativeX;
@@ -3217,14 +4108,7 @@ class CaptchaKrakenSolver {
             console.warn('Click action received without coordinates or bounding box', action);
             return;
         }
-        const absoluteX = elementBox.x + relativeX;
-        const absoluteY = elementBox.y + relativeY;
-        // Use the shared smooth move method
-        await this.performSmoothMove(page, absoluteX, absoluteY);
-        // Perform click
-        await page.mouse.down();
-        await page.waitForTimeout(Math.random() * 30 + 20); // Random hold duration
-        await page.mouse.up();
+        await this.ph('mouse', () => this.human.click(page, [elementBox.x + relativeX, elementBox.y + relativeY]));
     }
     async executeDrag(page, _element, action, elementBox) {
         const bboxCenter = (bbox) => {
@@ -3234,12 +4118,7 @@ class CaptchaKrakenSolver {
         };
         const src = bboxCenter(action.source_bounding_box);
         const dst = bboxCenter(action.target_bounding_box);
-        await this.performSmoothMove(page, src.x, src.y);
-        await page.mouse.down();
-        await page.waitForTimeout(Math.random() * 50 + 50);
-        await this.performSmoothMove(page, dst.x, dst.y);
-        await page.waitForTimeout(Math.random() * 50 + 50);
-        await page.mouse.up();
+        await this.ph('mouse', () => this.human.drag(page, [src.x, src.y], [dst.x, dst.y]));
     }
     // ────────────────────────────────────────────────────────── typing + sliding
     // Mirrors _find_control / _execute_type / _execute_slide in page_solver.py.
@@ -3265,36 +4144,70 @@ class CaptchaKrakenSolver {
         }
         return null;
     }
+    /**
+     * Where a distorted-text captcha's answer goes.
+     *
+     * Inside the widget first. If the widget holds no text box at all, widen ONCE
+     * to its enclosing <fieldset>/<form> and look again for a VENDOR-NAMED box
+     * only.
+     *
+     * BotDetect is why, and nothing else needs it. BotDetect is a self-hosted
+     * LIBRARY, so the host application owns the layout: measured on captcha.com
+     * 2026-08-24, `.BDC_CaptchaDiv` — the element detectCaptcha returns — is
+     * 280x50 and holds the image alone, while `#captchaCode` sits in a sibling
+     * `<div class="validationDiv">` under the enclosing <fieldset>. Scoped to the
+     * widget the solver found no box, textMode stayed false, and it read the code
+     * correctly and never typed it. A clean solve thrown away, and
+     * indistinguishable in any report from a model that cannot read warped text.
+     *
+     * The widened pass is restricted to TEXT_INPUT_VENDOR_SELECTORS on purpose.
+     * The generic tail is what makes the in-widget lookup work for every other
+     * vendor, and OUTSIDE the widget it is exactly how a captcha's answer ends up
+     * in a login form's username box. One level, named selectors, never the page.
+     *
+     * Mirrors `_answer_box` in page_solver.py — CLAUDE.md 1c.
+     */
+    async answerBox(scope, element) {
+        const inside = await this.findControl(scope, TEXT_INPUT_SELECTORS);
+        if (inside !== null || !element)
+            return inside;
+        // Nearest first: a <fieldset> inside a <form> is the tighter box, and a
+        // union query hands back whichever comes first in document order — the
+        // outer one.
+        for (const axis of ['ancestor::fieldset[1]', 'ancestor::form[1]']) {
+            let host = null;
+            try {
+                host = await element.$(`xpath=${axis}`);
+            }
+            catch {
+                continue;
+            }
+            if (!host)
+                continue;
+            const found = await this.findControl(host, TEXT_INPUT_VENDOR_SELECTORS);
+            if (found) {
+                console.log('Widget holds no answer box; using the vendor-named one in '
+                    + 'its enclosing form.');
+                return found;
+            }
+        }
+        return null;
+    }
     /** Put the model's reading of a distorted-text captcha into its box. */
-    async executeType(page, scope, action) {
+    async executeType(page, scope, action, element) {
         const text = action.text ?? '';
         if (!text)
             return false;
-        const field = await this.findControl(scope, TEXT_INPUT_SELECTORS);
+        const field = await this.answerBox(scope, element);
         if (!field) {
             console.warn('Type action, but no text box in the widget; skipping.');
             return false;
         }
-        await this.moveAndClick(page, field); // travel there, then press to focus
-        // A retry round arrives with the previous attempt still in the box, and
-        // typing would APPEND to it — submitting a string the model never read.
-        try {
-            await page.keyboard.press('Control+A');
-        }
-        catch { /* an adapter without a keyboard shortcut path */ }
-        // Per character rather than one type(text, {delay}) call: a constant
-        // inter-key delay is itself a signal, and these are the vendors that score
-        // typing cadence.
-        for (const ch of text) {
-            try {
-                await page.keyboard.type(ch);
-            }
-            catch (e) {
-                console.warn('Could not type into the captcha field:', e);
-                return false;
-            }
-            await page.waitForTimeout(Math.random() * 90 + 45);
-        }
+        // Tapping the box is what focuses it — and on a phone it is also what
+        // raises the keyboard, so this is not decoration on either device.
+        await this.moveAndClick(page, field);
+        if (!(await this.human.typeText(page, field, text)))
+            return false;
         console.log(`Typed ${text.length} character(s) into the captcha field.`);
         return true;
     }
@@ -3334,6 +4247,17 @@ class CaptchaKrakenSolver {
      * Returns false if there is nothing here to drag, leaving the caller's normal
      * no-op handling to deal with it.
      */
+    /**
+     * Device pixels per CSS pixel, read off the shot we are about to measure.
+     * 1 when the image cannot be read — an unreadable shot is already the
+     * trackPiece-returns-null path, and guessing a ratio would steer by it.
+     */
+    shotScale(shot, cssWidth) {
+        const dims = this.readPngDimensions(shot);
+        if (!dims || cssWidth <= 0)
+            return 1;
+        return dims.width / cssWidth;
+    }
     async executeSlide(page, element, scope, action, elementBox) {
         const targetX = ((action.target_bounding_box[0] + action.target_bounding_box[2]) / 2)
             * elementBox.width;
@@ -3356,12 +4280,7 @@ class CaptchaKrakenSolver {
             const targetY = ((action.target_bounding_box[1] + action.target_bounding_box[3]) / 2)
                 * elementBox.height;
             console.log('No slider track; dragging the piece to the slot directly.');
-            await this.performSmoothMove(page, box.x + box.width / 2, box.y + box.height / 2);
-            await page.mouse.down();
-            await page.waitForTimeout(Math.random() * 50 + 50);
-            await this.performSmoothMove(page, elementBox.x + targetX, elementBox.y + targetY);
-            await page.waitForTimeout(Math.random() * 50 + 50);
-            await page.mouse.up();
+            await this.human.drag(page, [box.x + box.width / 2, box.y + box.height / 2], [elementBox.x + targetX, elementBox.y + targetY]);
             return true;
         }
         const hbox = await handle.boundingBox();
@@ -3374,7 +4293,7 @@ class CaptchaKrakenSolver {
         // track behind it as it goes. Either would otherwise be the largest moving
         // thing in frame, and we would track the handle instead of the piece.
         const pad = Math.max(4, hbox.height * 0.35);
-        const exclude = [
+        const band = [
             0,
             hbox.y - elementBox.y - pad,
             elementBox.width,
@@ -3383,22 +4302,33 @@ class CaptchaKrakenSolver {
         const shots = Array.from({ length: 4 }, (_, i) => path.join(os.tmpdir(), `slide_${Date.now()}_${i}_${Math.floor(Math.random() * 1e9)}.png`));
         try {
             await this.move(page, handle, { paddingPercentage: 30 });
-            await page.mouse.down();
-            await page.waitForTimeout(Math.random() * 60 + 60);
+            await this.human.press(page);
+            await this.human.pause('grab');
             await element.screenshot({
                 path: shots[0],
                 timeout: this.config.elementScreenshotTimeoutMs ?? 8000,
                 animations: 'disabled',
             });
+            // CSS pixels out here, DEVICE pixels inside the shots. The same number on
+            // a 1x desktop and 2.625x apart on a phone, which is why this loop
+            // measured a slider correctly for a year and then missed every attempt
+            // the moment Tier 3 grew a mobile arm: the mask landed above the handle,
+            // the widths came back 2.6x too wide, and solveSlideGeometry threw them
+            // out as wider than the widget. Measured from the shot rather than asked
+            // of the page, for the same reason the grid path does it (`scaleX` in
+            // driveRecaptchaGrid): what the CV reads is the image, whatever the
+            // window thinks its ratio is.
+            const scale = this.shotScale(shots[0], elementBox.width);
+            const exclude = band.map((v) => v * scale);
             const widths = [];
             let lastBox = null;
             for (let i = 0; i < SLIDE_PROBE_OFFSETS_PX.length; i++) {
                 const offset = SLIDE_PROBE_OFFSETS_PX[i];
                 await this.performSmoothMove(page, startX + offset, holdY);
-                await page.waitForTimeout(Math.random() * 40 + 40);
+                await this.human.pause('probe');
                 const box = await this.trackPiece(element, shots[0], shots[i + 1], exclude);
                 if (box) {
-                    widths.push([offset, box[2] - box[0]]);
+                    widths.push([offset, (box[2] - box[0]) / scale]);
                     lastBox = box;
                 }
             }
@@ -3419,13 +4349,13 @@ class CaptchaKrakenSolver {
                 // neither the model nor the screen asked for.
                 let offset = widths[widths.length - 1][0];
                 for (let i = 0; i < SLIDE_MAX_CORRECTIONS; i++) {
-                    const pieceCentre = lastBox[2] - pieceWidth / 2;
+                    const pieceCentre = lastBox[2] / scale - pieceWidth / 2;
                     const error = targetX - pieceCentre;
                     if (Math.abs(error) <= SLIDE_TOLERANCE_PX)
                         break;
                     offset += error / ratio;
                     await this.performSmoothMove(page, startX + offset, holdY);
-                    await page.waitForTimeout(Math.random() * 40 + 40);
+                    await this.human.pause('probe');
                     const box = await this.trackPiece(element, shots[0], shots[3], exclude);
                     if (!box)
                         break; // ran out of track; release where we are
@@ -3435,11 +4365,11 @@ class CaptchaKrakenSolver {
             // Settle before letting go. A release in the same tick as the last move
             // reads as a machine, and some vendors sample the final milliseconds of
             // the gesture.
-            await page.waitForTimeout(Math.random() * 120 + 90);
+            await this.human.pause('settle');
         }
         finally {
             try {
-                await page.mouse.up();
+                await this.human.release(page);
             }
             catch { /* the page may have navigated */ }
             for (const shot of shots) {