captchakraken 2.6.1 → 2.9.0

package/python/src/captchakraken/page_solver.py

@@ -50,10 +50,11 @@ from contextlib import contextmanager
 from dataclasses import dataclass, field
 from typing import Any, Callable, Dict, List, Optional, Sequence, Tuple
 
+from . import planner
 from .action_types import CaptchaAction
 from .solver import CaptchaSolver, UnsupportedCaptchaError
 from .timing import PhaseBudget, timings_enabled
-from .trajectory import generate_trajectory
+from .humanize import Humanizer, resolve as resolve_humanizer
 
 DEBUG = os.getenv("CAPTCHA_DEBUG", "0") == "1"
 
@@ -156,6 +157,21 @@ _CLOSED_TARGET_RE = re.compile(
 )
 
 
+def answer_needs_element_box(actions: List[Dict[str, Any]]) -> bool:
+    """Does this answer need the widget's box to be performed?
+
+    Only a coordinate-bearing action does. ``done`` means "nothing left to
+    click", which is exactly the answer a vendor that closes on success will be
+    showing no widget for.
+
+    An ALLOW-LIST of what needs nothing, not a list of what does: a coordinate
+    action added later and forgotten here must default to needing the box,
+    because that direction raises instead of clicking at the origin. Twin of
+    `answerNeedsElementBox` in the JS port (rule 1c) — if one moves, move both.
+    """
+    return any((a or {}).get("action") != "done" for a in actions)
+
+
 @dataclass
 class SolveResult:
     """Mirror of the TS `SolveResult`."""
@@ -163,6 +179,14 @@ class SolveResult:
     is_solved: bool
     final_mouse_position: Tuple[float, float]
     token_usage: List[Dict[str, Any]] = field(default_factory=list)
+    #: Where this solve's wall-clock went, in milliseconds per phase — the same
+    #: partition `CAPTCHA_TIMINGS=1` prints, handed to the caller instead of to
+    #: stderr. `{}` when the result was built outside a solve.
+    #:
+    #: Returned rather than only logged because "the solve took 12s" is not
+    #: actionable and "the settle monitor spent 4s of it" is, and a caller
+    #: measuring a fleet cannot scrape stderr from inside its own process.
+    phases: Dict[str, float] = field(default_factory=dict)
 
 
 @dataclass
@@ -202,6 +226,40 @@ def settle_verdict(samples, *, settle_frames: int, animated_after_ms: int) -> st
     return "timeout"
 
 
+def burst_hang_deadline_ms(cfg) -> float:
+    """How long a keyframe burst may run before it is called HUNG.
+
+    A hang detector, not a budget: `overall_solve_timeout_ms` is what bounds
+    real time. This only has to notice a screenshot that never returns, so it
+    is deliberately slack.
+
+    Sized off the CEILING, because that is what sizes the loop —
+    `_record_keyframes` plans `video_burst_max_ms` worth of frames, not
+    `video_burst_duration_ms` worth. Deriving it from the floor gave a
+    120-frame burst 17s, i.e. 141ms per frame against a 100ms interval, and a
+    burst that simply ran to its ceiling killed the attempt. Must match
+    `burstHangDeadlineMs` in the JS port.
+    """
+    return 3.0 * float(cfg.video_burst_max_ms) + 5_000.0
+
+
+#: How unlike the chosen keyframe the widget must look before the gate calls it
+#: a different board, and over how many polls. Measured on GeeTest svg: two
+#: SCREENS of one board differ by 0.0056, a different board by 0.77 — two orders
+#: of magnitude, so this is a plateau rather than a knife edge. Several polls
+#: because a frame caught mid-swap can read high for a moment. Must match
+#: NOT_THIS_BOARD_DIFF / _POLLS in the JS port.
+#: How much the widget must change during inference to count as MOVING. A far
+#: tighter number than `stale_frame_diff_threshold` (0.02) because it answers a
+#: different question: 0.02 asks "did this answer go stale", this asks "is this
+#: the same picture", which is the noise floor. Using the stale threshold for
+#: both made the guard blind to GeeTest svg, whose screens differ by 0.0056.
+#: Must match MOVED_DURING_INFERENCE_DIFF in the JS port.
+_MOVED_DURING_INFERENCE_DIFF = 0.002
+_NOT_THIS_BOARD_DIFF = 0.5
+_NOT_THIS_BOARD_POLLS = 3
+
+
 @dataclass
 class PageSolverConfig:
     """
@@ -209,6 +267,48 @@ class PageSolverConfig:
     value tuned on one driver can be found on the other.
     """
 
+    # ── how the driver moves ───────────────────────────────────────────────
+    #: "mouse" (default), "mobile" or "none". See `humanize.py`.
+    #:
+    #: Not a realism dial — a choice of INPUT DEVICE. "mobile" dispatches touch
+    #: events with finger kinematics, and on a touch-only widget that is the
+    #: difference between the page's handlers firing and not. "none" is the
+    #: shortest legal path to the same DOM effect, for fixtures and for callers
+    #: who humanise somewhere else in their stack.
+    #:
+    #: None means unset: `CAPTCHA_HUMANIZATION`, else "mouse".
+    humanization: Optional[str] = None
+    #: Your own `humanize.Humanizer`. Overrides `humanization` entirely — the
+    #: driver then makes no decisions about pointer motion at all.
+    humanizer: Optional[Humanizer] = None
+    #: mobile only. The thing that is actually TOUCHED, when it is not the page
+    #: object — an Appium/Selenium WebDriver on a real handset. Left None, the
+    #: mode dispatches CDP touch events at the page it was given.
+    touch_driver: Optional[Any] = None
+    #: mobile only. CSS-pixel -> device-pixel transform for `touch_driver`,
+    #: e.g. `{"scale": 3.0, "origin": (0, 132)}`. See AppiumTouchBackend; the
+    #: default identity is right for browser emulation.
+    touch_transform: Optional[Dict[str, Any]] = None
+    #: Where the pointer starts. Setting it stops the first gesture of a solve
+    #: crossing the whole window from the origin.
+    starting_mouse_position: Optional[Tuple[float, float]] = None
+
+    # ── which model answers ────────────────────────────────────────────────
+    #: Force ONE expert of a routed model — "pixel", "grid", "video" or "text".
+    #:
+    #: A routed model (Abyss) is four adapters behind one endpoint, and the
+    #: router is the prompt family the request is about to send, so the default
+    #: (None) already reaches the right one with no help from the caller. This
+    #: is the override: serve one arm, drive only the puzzles it owns, which is
+    #: what a per-arm benchmark needs and what a licence holder pinning a single
+    #: expert wants.
+    #:
+    #: Refused at construction against a model that serves one adapter — every
+    #: model published so far — because a run that quietly measured the
+    #: generalist and reported it as the expert is a number nobody can catch.
+    #: None means unset: `CAPTCHA_EXPERT`, else route by family.
+    expert: Optional[str] = None
+
     # 45s, and the loop count that fits inside it rather than one that needs
     # policing by the clock. A round costs ~4-7s once the waits below are paid,
     # so six rounds is the budget; ten never fitted and only ever expressed
@@ -225,7 +325,7 @@ class PageSolverConfig:
     #: is EXECUTED, so the previous one already ran and moved nothing. Repeating
     #: it cannot do better; it just spends a round.
     #:
-    #: Measured on recaptcha_grid_4x4 (fixture seed 20260730): the model answers
+    #: Measured on a reCAPTCHA 4x4 grid (the fixture): the model answers
     #: `[2,6,7,9,10]` on round 1 and then `[2,6,7,10]` on rounds 2 THROUGH 10 —
     #: nine identical click sets, each one clicked, each one rejected, ending in
     #: "still detected after 10 solve loops" at 66.1s. Of that, 39.0s was pure
@@ -235,6 +335,7 @@ class PageSolverConfig:
     #: the one recovery worth trying (a cycling board reads as a still and
     #: answers the same way every round). One more round buys that chance.
     max_no_progress_rounds: int = 2
+
     post_solve_delay_ms: int = 1_200
     # How long to keep watching for a SUCCESS after submitting.
     #
@@ -255,7 +356,7 @@ class PageSolverConfig:
     # 1000ms is therefore the measured worst case (528ms, ~264ms once the poll
     # below is halved) plus deliberate headroom for a vendor round-trip nobody
     # has measured yet. Down from 2500ms, which was spent in full on every
-    # unsuccessful round — 25.5s of one 66.1s recaptcha_grid_4x4 solve.
+    # unsuccessful round — 25.5s of one 66.1s a reCAPTCHA 4x4 grid solve.
     #
     # To replace the headroom with a number: drive the real vendor pages via
     # `tests/live-solve/src/demo-targets.ts` and re-read this distribution.
@@ -305,17 +406,55 @@ class PageSolverConfig:
     # still than spend `video_burst_duration_ms` finding out.
     animated_probe_enabled: bool = True
     # Burst geometry. Deliberately identical to the collector's
-    # (`_collect_common.BURST_DURATION_MS` / `BURST_FPS` in the finetune repo), so a
+    # (`_collect_common.BURST_DURATION_MS` / `BURST_FPS` in the training repo), so a
     # challenge recorded here is the same shape of artifact the model trained on —
     # same clip length, same frame rate, therefore the same keyframe slicing.
     video_burst_duration_ms: int = 4_000
+    #: Hard ceiling on a burst that never repeats a screen. The burst normally
+    #: ends when the board's cycle closes; this bounds a continuous animation,
+    #: which never closes one. Must match `videoBurstMaxMs` in the JS port.
+    video_burst_max_ms: int = 12_000
+    #: Record while the still screenshot is being read, so a cycling board is
+    #: known before its answer is acted on. Must match `speculativeBurstEnabled`
+    #: in the JS port.
+    #:
+    #: OFF since 2026-09-09, because it cost the most on exactly the boards it
+    #: had nothing to say about. `_speculate` calls a board MOVING when two
+    #: frames hash differently — an exact SHA-1 of the PNG bytes — so one pixel
+    #: of render noise reads as a second screen, `cycle_closed` never fires
+    #: (noise does not repeat), and the burst runs to `video_burst_max_ms`.
+    #:
+    #: Measured over the 6 Sep full Tier 3 (260 attempts), and the numbers are
+    #: the wrong way round: the genuinely ANIMATED families closed their cycle
+    #: at the 4s floor — tile_flip 3.96s, odd_animal 3.98s, highest_jumper
+    #: 3.95s — while STILL boards ran to the 12s ceiling. tower_stack 12.03s,
+    #: click_blocked_by_lines 11.93s, missing_piece 11.89s, silhouette_match
+    #: 11.76s, tetris_fit 9.96s, connect_path 9.94s. Those are click and drag
+    #: archetypes with no animation in them, and three of them scored 0%: they
+    #: were not answered wrongly, they ran out of budget being filmed.
+    #:
+    #: Worse than the wall clock, `len(order) >= 2` also DISCARDS the still
+    #: answer and escalates to the keyframe path, so a correct reading of a
+    #: static board was being thrown away because the render jittered.
+    #:
+    #: An animated board is still solved: `animated_probe_enabled` escalates on
+    #: the repeated-answer signal and `_record_keyframes` films a bounded 4s.
+    #: That costs a genuinely animated board one extra round and saves every
+    #: still board 4-12s. Turn this back on only with the digest replaced by a
+    #: comparison that has a noise floor.
+    speculative_burst_enabled: bool = False
     video_burst_fps: int = 10
     # How long to wait for the widget to return to the keyframe the model chose,
     # before clicking anyway. Bounded because the alternative is worse: these
     # puzzles cycle, so the state DOES come back — but if the recording caught a
     # one-off transition it never will, and a click on the model's coordinates is
     # still a better use of the remaining budget than a timeout.
-    keyframe_wait_timeout_ms: int = 6_000
+    # 9000, not 6000. A GeeTest svg board dwells p50 1.5s / p75 2.0s / max 2.7s
+    # per screen, so a 3-screen cycle runs 4.5s median and 8.1s worst case — a
+    # 6s budget could not catch the worst case however well aimed. Must match
+    # SOLVE_DEFAULTS.keyframeWaitTimeoutMs in the JS port: `video_budget_ms` is
+    # derived from it on both sides and the two must not disagree.
+    keyframe_wait_timeout_ms: int = 9_000
     keyframe_wait_poll_ms: int = 120
     #: Extra wall clock granted ONCE, the first time a solve escalates to a
     #: recording. NOT a looser `overall_solve_timeout_ms`.
@@ -329,9 +468,9 @@ class PageSolverConfig:
     #: reported a TIMEOUT — which reads as a slow model rather than as a budget
     #: with no room for the thing the solver had just decided to do.
     #:
-    #: Measured 2026-08-22, Tier 3 run 32596340560: EVERY python-port failure on
-    #: hcaptcha_fish_swim_different, hcaptcha_number_with_highest_value_video and
-    #: hcaptcha_tile_flip_video was "exceeded overall_solve_timeout_ms during
+    #: Measured 2026-08-22, a full driver-gate run: EVERY python-port failure on
+    #: an hCaptcha odd-one-out animation, an hCaptcha highest-value animation and
+    #: an hCaptcha tile-flip animation was "exceeded overall_solve_timeout_ms during
     #: recording the animated challenge", at 45.7-52.7s elapsed. The same three
     #: fixtures solve in 11-20s on the rounds where the still path happens to
     #: answer them, so it is the escalation that does not fit, not the puzzle.
@@ -347,7 +486,7 @@ class PageSolverConfig:
         DERIVED, so a longer burst or a longer keyframe wait carries its own
         budget instead of quietly reintroducing the timeout this exists to fix.
         """
-        return (self.video_burst_duration_ms + self.keyframe_wait_timeout_ms
+        return (self.video_burst_max_ms + self.keyframe_wait_timeout_ms
                 + self.video_extra_inference_ms)
 
     # Grid load / dynamic-refresh timing.
@@ -388,16 +527,93 @@ class PageSolverConfig:
 # solver.ts — keep both in the same order with the same selectors.
 VENDOR_WIDGET_LOCATORS = [
     {"puzzle_source": "geetest", "selectors": [".geetest_box", ".geetest_panel_box", ".geetest_popup_window", ".geetest_widget"]},
-    {"puzzle_source": "tencent", "selectors": ['iframe#tcaptcha_iframe_dy', 'iframe[id*="tcaptcha"]', 'iframe[src*="captcha.gtimg.com"]', 'iframe[src*="captcha.qq.com"]']},
+    # Tencent renders IN THE HOST DOCUMENT since 2026-08-11; before that it was
+    # `iframe#tcaptcha_iframe_dy`. Both shapes are listed, in-page first,
+    # because the iframe build is still deployed on sites pinning an older
+    # widget and costs nothing to keep. Dropping the in-page selectors is what
+    # made the client blind to every live Tencent captcha for twelve days.
+    #
+    # `iframe[id^="tcaptcha"]`, NOT `[id*=...]`. The substring form also matched
+    # MTCaptcha's `mtcaptcha-iframe-1` — "mtcaptcha" contains "tcaptcha" — so
+    # Tencent's entry was silently the only thing detecting MTCaptcha at all,
+    # which is why `.mtcap` matching nothing went unnoticed. Anchored, it still
+    # matches the real `tcaptcha_iframe_dy` and claims nobody else's widget.
+    {"puzzle_source": "tencent", "selectors": ['#tcaptcha_transform_dy', '#tCaptchaDyContent', '.tencent-captcha-dy__content', 'iframe#tcaptcha_iframe_dy', 'iframe[id^="tcaptcha"]', 'iframe[src*="captcha.gtimg.com"]', 'iframe[src*="captcha.qq.com"]']},
     {"puzzle_source": "yidun", "selectors": [".yidun_panel", ".yidun"]},
-    {"puzzle_source": "yandex", "selectors": [".CheckboxCaptcha"]},
+    # Yandex SmartCaptcha is IFRAMED, and `.CheckboxCaptcha` is a class inside
+    # that frame's document — `query_selector` does not cross a frame boundary,
+    # so the host page never carried it and this entry matched nothing, ever.
+    # Challenge frame first, anchor second, exactly like reCAPTCHA above.
+    # `.CheckboxCaptcha` stays for an inline embed that renders it directly.
+    {"puzzle_source": "yandex", "selectors": ['iframe[src*="smartcaptcha.yandexcloud.net/advanced"]', 'iframe[src*="smartcaptcha.yandexcloud.net"]', ".CheckboxCaptcha"]},
     {"puzzle_source": "lemin", "selectors": ["#lemin-cropped-captcha", ".lemin-captcha-popup"]},
     {"puzzle_source": "prosopo", "selectors": [".prosopo-modalInner", ".procaptcha-checkbox"]},
-    {"puzzle_source": "mtcaptcha", "selectors": [".mtcap"]},
+    # MTCaptcha is IFRAMED too: `<div class="mtcaptcha"><iframe
+    # id="mtcaptcha-iframe-1" src="https://service.mtcaptcha.com/...">`. `.mtcap`
+    # is the class prefix used INSIDE that frame (`mtcap-inputtext`), and a CSS
+    # class selector matches whole tokens, so it never matched the host page's
+    # `class="mtcaptcha"` either. Kept last for an inline embed.
+    {"puzzle_source": "mtcaptcha", "selectors": ['iframe[src*="service.mtcaptcha.com"]', 'iframe[id^="mtcaptcha-iframe"]', ".mtcaptcha", ".mtcap"]},
     {"puzzle_source": "botdetect", "selectors": [".BDC_CaptchaDiv"]},
 ]
 
 
+# ── which vendor's code the page LOADED, as opposed to what it rendered ─────
+#
+# A selector is a claim about markup, and markup is the half of a captcha the
+# vendor is free to rewrite overnight — it is an anti-bot surface, so churn is
+# the point. The REQUEST is far more stable: Tencent moved its widget out of an
+# iframe and renamed every class on 2026-08-11, and went on fetching from
+# `turing.captcha.gtimg.com` and `turing.captcha.qcloud.com` throughout. The
+# substring `captcha.gtimg.com` — already in the table above, on a selector that
+# stopped matching — never left the wire.
+#
+# This is a TRIPWIRE, not a detection path. A URL says which vendor is on the
+# page; it cannot say where the widget is, and the solver needs an ELEMENT to
+# screenshot, to scope its controls against, and to drag. What it buys is the
+# difference between the two things a null detection can mean:
+#
+#   · no captcha here (reCAPTCHA v3 / invisible / not triggered yet) — fine, and
+#     what the message used to guess unconditionally;
+#   · the vendor's code is loaded and running and NOTHING WE LOOK FOR MATCHES —
+#     i.e. the DOM moved under us. That is a bug report, and it took twelve days
+#     to notice the last time because the client said the first thing while
+#     meaning the second.
+#
+# Hosts measured 2026-08-24 by loading each vendor's demo page and recording
+# every third-party request (see scripts/check_vendor_selectors.py --hosts).
+#: The two vendors with bespoke handling in this file. EVERYTHING else shares the
+#: generic path, and the two behaviours below are gated on "not one of these" —
+#: spelled as this set rather than as `== "unknown"`, which is what they used to
+#: say. The two were identical only while `unknown` was the sole third value, so
+#: the day anyone reports a vendor by name — to constrain which grid shapes it may
+#: be solved as, say — `== "unknown"` silently turns OFF typed-challenge detection
+#: for MTCaptcha, Yandex and BotDetect (all three ARE typed captchas) and the
+#: animated settle probe for GeeTest and Tencent. Neither failure raises; the text
+#: captcha just becomes unsolvable and the animated board gets answered from one
+#: arbitrary frame.
+VENDORS_WITH_BESPOKE_HANDLING = frozenset({"hcaptcha", "recaptcha"})
+
+VENDOR_URL_MARKERS = [
+    {"puzzle_source": "hcaptcha", "hosts": ["hcaptcha.com"]},
+    {"puzzle_source": "recaptcha", "hosts": ["google.com/recaptcha", "recaptcha.net"]},
+    {"puzzle_source": "turnstile", "hosts": ["challenges.cloudflare.com"]},
+    {"puzzle_source": "geetest", "hosts": ["geetest.com"]},
+    {"puzzle_source": "tencent", "hosts": ["captcha.gtimg.com", "captcha.qcloud.com"]},
+    {"puzzle_source": "yidun", "hosts": ["dun.163.com", "cstaticdun.126.net",
+                                         "necaptcha.nosdn.127.net"]},
+    {"puzzle_source": "yandex", "hosts": ["smartcaptcha.yandexcloud.net"]},
+    {"puzzle_source": "lemin", "hosts": ["leminnow.com"]},
+    {"puzzle_source": "prosopo", "hosts": ["prosopo.io"]},
+    {"puzzle_source": "mtcaptcha", "hosts": ["mtcaptcha.com"]},
+    # BotDetect is deliberately absent and must stay absent. It is a SELF-HOSTED
+    # library — the image comes from the application's own origin
+    # (`BotDetectCaptcha.ashx`), so there is no vendor host to see and a URL
+    # tripwire cannot cover it. Recording that is the point: an empty result for
+    # a BotDetect page means "this check does not apply", not "no captcha".
+]
+
+
 # ── where the answer goes, when it is not a click ───────────────────────────
 #
 # Both tables are ordered VENDOR-FIRST, GENERIC-LAST, and the driver takes the
@@ -414,7 +630,13 @@ VENDOR_WIDGET_LOCATORS = [
 
 # A distorted-text captcha's answer box. The three vendor entries are the three
 # types in instructions.py::TEXT_TYPES.
-TEXT_INPUT_SELECTORS = [
+#
+# Split in two because the two halves are safe in different places. The NAMED
+# half identifies a captcha's answer box wherever it sits; the GENERIC half only
+# means "the text box in this widget" and is trustworthy only when the scope
+# already is the widget. `_answer_box` widens past the widget for BotDetect and
+# may take the named half with it, never the generic one.
+TEXT_INPUT_VENDOR_SELECTORS = [
     # BotDetect — the input is application-defined, so match the id fragment its
     # own docs and samples use. These three are what the nightly collector
     # already drives (src/captchaCollection/sources.py).
@@ -429,6 +651,9 @@ TEXT_INPUT_SELECTORS = [
     ".AdvancedCaptcha-Input input",
     "input.Textinput-Control",
     'input[name="rep"]',
+]
+
+TEXT_INPUT_GENERIC_SELECTORS = [
     # Generic — an input the page itself labels as the captcha answer.
     'input[name*="captcha" i]',
     'input[id*="captcha" i]',
@@ -443,6 +668,8 @@ TEXT_INPUT_SELECTORS = [
     "textarea",
 ]
 
+TEXT_INPUT_SELECTORS = TEXT_INPUT_VENDOR_SELECTORS + TEXT_INPUT_GENERIC_SELECTORS
+
 # The handle you drag on a puzzle-piece slider. NOT the piece: on every one of
 # these vendors the piece is inert decoration that the handle carries, so a
 # drag starting on the piece moves nothing at all.
@@ -451,7 +678,10 @@ SLIDER_HANDLE_SELECTORS = [
     ".geetest_slider_button",
     ".geetest_btn",
     ".geetest_slider .geetest_arrow",
-    # Tencent
+    # Tencent. The post-2026-08-11 knob is a bare div — no id, no role=slider,
+    # no aria-valuenow — so every generic fallback below misses it and it has to
+    # be named. The three after it are the pre-redesign widget.
+    ".tencent-captcha-dy__slider-block",
     "#tcaptcha_drag_thumb",
     ".tc-slider-normal",
     "[id*=slideBlock]",
@@ -508,17 +738,24 @@ class PageSolver:
         self.config = config or PageSolverConfig()
         # One CaptchaSolver for the whole driver: it owns the planner, which
         # accumulates token usage and holds the HTTP session to vLLM.
+        #
+        # `expert` reaches the solver from the config, so the knob is in the
+        # same object as every other tunable and matches the TS port's
+        # `CaptchaKrakenConfig.expert`. An explicit kwarg still wins — a caller
+        # who built the argument list themselves has said the more specific
+        # thing — and a caller who passed their OWN solver has already made
+        # this decision inside it.
+        if self.config.expert is not None:
+            solver_kwargs.setdefault("expert", self.config.expert)
         self._solver = solver or CaptchaSolver(**solver_kwargs)
-        self._last_mouse: Tuple[float, float] = (0.0, 0.0)
-        # See _seed_cursor: the (0, 0) origin wedges camoufox's humanised
-        # mouse, so the first move of each solve must step off it plainly.
-        self._cursor_seeded = False
+        #: Every gesture goes through here, and it owns the pointer position.
+        #: See humanize.py — the driver names gestures, this decides what
+        #: events they are and how long they take.
+        self._human: Humanizer = resolve_humanizer(self.config)
         self._last_submit_frame_hash: Optional[str] = None
         # Absolute deadline for the current solve, in the same clock as
         # time.monotonic() * 1000. None outside a solve.
         self._deadline_ms: Optional[float] = None
-        # Window size for clamping, resolved once per solve. See _viewport.
-        self._viewport_cache: Optional[Dict[str, float]] = None
         # Animation detection, all reset per solve by `_reset_animated_state`.
         # `_known_animated` latches: once a widget has been SEEN to animate,
         # every later round takes the keyframe path without re-probing.
@@ -528,13 +765,40 @@ class PageSolver:
         # One-shot: the recording path buys its own budget the first time it is
         # entered, and never again in the same solve. See video_budget_ms.
         self._video_budget_granted = False
+        # THE ONE recording and THE ONE answer for the animated board on screen.
+        # A cycling board needs a single inference: the burst shows the model
+        # every screen, the answer names the cell and the screen it is on, and
+        # the gate holds the click until that screen is back. None of that
+        # changes between rounds, so asking again buys nothing and costs a burst
+        # plus a multi-image inference. Mirrors `animatedPlan` in the JS port.
+        self._animated_plan: Optional[Tuple[List[str], str, List[CaptchaAction],
+                                            List[Dict[str, Any]]]] = None
         self._keyframe_mode: Optional[str] = None
+        # How many distinct steady screens the current clip sits on; 0 if it is
+        # not that kind of clip. THE GATE KEYS ON THIS, NOT ON `_keyframe_mode`
+        # — see the JS twin's `keyframeSteadyScreens` and `steady_screens()` in
+        # keyframes.py. `even` means the slicer could not PROVE recurrence, not
+        # that the board has nothing to come back to.
+        self._keyframe_steady_screens: int = 0
         # Repeat detection; see `max_no_progress_rounds`.
         self._last_answer_sig: Optional[str] = None
         self._no_progress_rounds = 0
+        #: How many times THIS board has been re-asked. Indexes
+        #: `planner.RESAMPLE_TEMPERATURES`; reset by `_fresh_board`.
+        self._resample_level = 0
         # Per-solve phase accounting; see `_phase`.
         self._budget: Optional[PhaseBudget] = None
 
+    @property
+    def _last_mouse(self) -> Tuple[float, float]:
+        """Where the pointer is. Owned by the humanizer, because a mode that
+        dispatches no motion (mobile, between taps) still has to answer this."""
+        return self._human.at
+
+    @_last_mouse.setter
+    def _last_mouse(self, at: Tuple[float, float]) -> None:
+        self._human.at = (float(at[0]), float(at[1]))
+
     @contextmanager
     def _phase(self, name: str):
         """Attribute the enclosed wall-clock to `name` for this solve's budget.
@@ -585,7 +849,19 @@ class PageSolver:
             _log(f"[no-progress] the model returned the same answer again "
                  f"({self._no_progress_rounds}/{self.config.max_no_progress_rounds}) — "
                  f"the previous one already ran and changed nothing")
-            # A board that reads the same every round is the signature of a
+            # THE SAME ANSWER IS NOT NEWS — IT IS ARITHMETIC. `planner` sends
+            # `temperature: 0`, so re-reading an unchanged board returns the
+            # identical answer by construction, and counting that to a limit
+            # measures nothing but the limit. Ask for a different SAMPLE before
+            # spending the next round on a reply already known.
+            self._resample_level += 1
+            self._apply_sampling()
+            # …and make sure there is something to re-ask. On the animated path
+            # the answer is cached for the life of the board, so without this
+            # the new sampling never reaches a request and the identical
+            # coordinates go back up the wire.
+            self._invalidate_animated_answer()
+            # A board that reads the same every round is ALSO the signature of a
             # CYCLING challenge answered as a still. Give the recording path a
             # chance before giving up on the solve entirely.
             self._arm_animated_probe()
@@ -593,14 +869,49 @@ class PageSolver:
             self._no_progress_rounds = 0
             self._last_answer_sig = sig
 
+    def _apply_sampling(self) -> None:
+        """Point the planner at this board's re-ask level.
+
+        Level 0 is greedy and is what every first look gets, so this is a no-op
+        on the path that already works. Past that it hands the model a
+        temperature and a fresh seed, because a board the vendor refused is one
+        where the greedy answer has been TESTED and rejected — re-running it is
+        the one thing guaranteed not to help.
+        """
+        target = getattr(self._solver, "planner", None)
+        if target is None:
+            return
+        # `planner.sampling_for_level` is the ONE copy of the schedule, and the
+        # JS port reaches the same function through CAPTCHA_RESAMPLE_LEVEL.
+        # Deliberately NOT a `PageSolverConfig` field: the contract pins the two
+        # ports to the same solver options, and a knob on one side only is the
+        # parity gap CLAUDE.md says may only shrink. It is a tuning constant,
+        # not something a caller has any way to choose well.
+        sampling = planner.sampling_for_level(self._resample_level)
+        target.sampling = sampling
+        if sampling:
+            _log(f"[resample] re-asking this board at temperature "
+                 f"{sampling['temperature']}, seed {sampling['seed']}")
+
+    def _fresh_board(self) -> None:
+        """A different puzzle is up: go back to the greedy read."""
+        if self._resample_level:
+            _log("[resample] fresh board — back to greedy")
+        self._resample_level = 0
+        self._apply_sampling()
+
     def _reset_animated_state(self) -> None:
         self._known_animated = False
         self._animated_probe_armed = False
         self._animated_probe_done = False
         self._video_budget_granted = False
+        self._discard_animated_plan()
         self._keyframe_mode = None
+        self._keyframe_steady_screens = 0
         self._last_answer_sig: Optional[str] = None
         self._no_progress_rounds = 0
+        self._resample_level = 0
+        self._apply_sampling()
 
     def _check_deadline(self, where: str) -> None:
         """
@@ -713,132 +1024,12 @@ class PageSolver:
     # Mouse
     # ------------------------------------------------------------------
 
-    def _viewport(self, page: Any) -> Optional[Dict[str, float]]:
-        """
-        The window we must keep the cursor inside, cached per solve.
-
-        MUST NOT be skipped and MUST NOT be guessed, because a mouse move to a
-        coordinate outside the window WEDGES camoufox. Its juggler humanises
-        each move into a trajectory, guards the intermediate points against the
-        bounds, and then dispatches the requested destination unguarded
-        ("Always finish exactly on the requested destination"). An out-of-window
-        destination fires as an exit event instead of eMouseMove, so no
-        hit-renderer ack comes back; dispatch is serialised on a process-global
-        activation chain, so that one missing ack hangs every later input event
-        forever. Symptom: `page.mouse.move()` never returns, 0% CPU, solve
-        appears dead. Same failure family as camoufox #225.
-
-        `page.viewport_size` is None under camoufox (it uses the real window
-        rather than a spoofed viewport), which is why this falls back to asking
-        the page itself instead of assuming a size.
-        """
-        if self._viewport_cache is not None:
-            return self._viewport_cache
-        try:
-            vp = page.viewport_size
-            if callable(vp):  # some adapters expose it as a method
-                vp = vp()
-            if vp and vp.get("width") and vp.get("height"):
-                self._viewport_cache = {"width": float(vp["width"]), "height": float(vp["height"])}
-                return self._viewport_cache
-        except Exception:
-            pass
-        try:
-            inner = page.evaluate("() => ({width: window.innerWidth, height: window.innerHeight})")
-            if inner and inner.get("width") and inner.get("height"):
-                self._viewport_cache = {
-                    "width": float(inner["width"]),
-                    "height": float(inner["height"]),
-                }
-                return self._viewport_cache
-        except Exception:
-            pass
-        return None
-
-    def _trace_path(self, page: Any, points: Sequence[Tuple[float, float]], timings: Sequence[float]) -> None:
-        # Clamp ONLY when the viewport is actually known.
-        #
-        # camoufox reports `viewport_size is None` (it uses the real window
-        # rather than a spoofed viewport). The obvious fallback — assume
-        # 1920x1080 — is actively harmful: it clamps coordinates to the edge of
-        # a viewport that is not the real one, and a coordinate sitting EXACTLY
-        # on the boundary is the input that deadlocks camoufox's humanised-mouse
-        # juggler patch (upstream #225, "humanize edge deadlock"). The symptom is
-        # a `page.mouse.move()` that never returns: the process sits at 0% CPU
-        # with no in-flight work and the solve appears hung, which is precisely
-        # what this driver did against camoufox until this was found.
-        #
-        # A guessed clamp buys nothing anyway — the points come from a
-        # trajectory between two on-screen elements, so they are already in
-        # range. When we do clamp, we inset by a pixel so a legitimately
-        # off-screen point lands just inside the edge instead of exactly on it.
-        viewport = self._viewport(page)
-
-        start = time.monotonic() * 1000.0
-        for i, (x, y) in enumerate(points):
-            try:
-                if viewport is None:
-                    cx, cy = float(x), float(y)
-                else:
-                    cx = max(1.0, min(float(x), float(viewport["width"]) - 1.0))
-                    cy = max(1.0, min(float(y), float(viewport["height"]) - 1.0))
-                page.mouse.move(cx, cy)
-                self._last_mouse = (cx, cy)
-                if i < len(timings):
-                    target = start + timings[i]
-                    _delay(target - time.monotonic() * 1000.0)
-            except Exception as exc:
-                msg = str(exc)
-                if "Target closed" in msg or "Session closed" in msg:
-                    _log("could not move mouse; page or session closed")
-                    return
-                # Any other per-sample failure is skipped rather than fatal —
-                # losing one mousemove must not lose the solve.
-
-    def _seed_cursor(self, page: Any) -> None:
-        """Move the cursor off its (0, 0) origin once per solve, in ONE plain
-        move, before any humanised trajectory runs.
-
-        Without this, the first trajectory of a solve begins at (0, 0) — the
-        exact window corner, because that is where the pointer starts and
-        nothing has moved it. Under camoufox's `humanize` juggler a short move
-        from that origin never returns: `page.mouse.move()` blocks forever at 0%
-        CPU, and since dispatch is serialised on a process-global activation
-        chain, every later input event blocks behind it too. The solve looks
-        hung with no error anywhere and the Tier 3 fixture run times out on all
-        three attempts.
-
-        Reduced to four lines against camoufox directly:
-
-            with Camoufox(headless=True, humanize=True) as b:
-                p = b.new_page(); p.goto("about:blank")
-                p.mouse.move(1.0, 1.0)      # never returns
-
-        The same move after ANY interior move completes in ~1.1s, which is what
-        makes this the fix rather than a workaround: it is the ORIGIN that is
-        poisoned, not the destination. Same failure family as camoufox #225.
-
-        Deliberately not routed through `_smooth_move`: that would generate a
-        trajectory from (0, 0) and reintroduce exactly the move being avoided.
-        """
-        if self._cursor_seeded:
-            return
-        self._cursor_seeded = True
-        vp = self._viewport(page)
-        # Centre when the window is known, else a modest interior point — any
-        # coordinate comfortably off the corner will do.
-        cx, cy = (vp["width"] / 2, vp["height"] / 2) if vp else (200.0, 200.0)
-        try:
-            page.mouse.move(cx, cy)
-            self._last_mouse = (cx, cy)
-        except Exception:  # noqa: BLE001 — an adapter without a mouse must not fail the solve
-            pass
-
     def _smooth_move(self, page: Any, x: float, y: float) -> None:
-        self._seed_cursor(page)
-        points, timings = generate_trajectory(self._last_mouse, (x, y), 60)
+        """Travel to a point. What that MEANS is the humanizer's business — on
+        a touchscreen with no finger down it is a bookkeeping update and emits
+        nothing at all."""
         with self._phase("mouse"):
-            self._trace_path(page, points, timings)
+            self._human.move(page, (x, y))
 
     def _move_to_element(self, page: Any, element: Any, padding_percentage: float = 25.0) -> None:
         # BOUNDED. Playwright's default timeout is 30s, and this is called once
@@ -870,9 +1061,66 @@ class PageSolver:
 
     def _move_and_click(self, page: Any, element: Any) -> None:
         self._move_to_element(page, element)
-        page.mouse.down()
-        _delay(random.random() * 20 + 20)
-        page.mouse.up()
+        with self._phase("mouse"):
+            self._human.click(page, self._last_mouse)
+
+    def _click_point_for(
+        self, action: Dict[str, Any], element_box: Dict[str, float]
+    ) -> Optional[Tuple[float, float]]:
+        """Where in the element this click lands, in element-relative pixels.
+
+        Split out of `_execute_click` because on an animated board the point has
+        to be chosen ONCE and used three times — to park the pointer, to ask
+        about the right neighbourhood, and to press. Choosing it inside the
+        click (it is randomised within the target) meant the gate watched the
+        bbox centre while the press landed somewhere else.
+        """
+        bbox = action.get("target_bounding_box")
+        coords = action.get("target_coordinates")
+        if bbox:
+            min_x, min_y, max_x, max_y = (float(v) for v in bbox)
+            px_min_x = min_x * element_box["width"]
+            px_max_x = max_x * element_box["width"]
+            px_min_y = min_y * element_box["height"]
+            px_max_y = max_y * element_box["height"]
+            pad_x = (px_max_x - px_min_x) * 0.1
+            pad_y = (px_max_y - px_min_y) * 0.1
+            return (
+                (px_min_x + pad_x) + random.random() * ((px_max_x - pad_x) - (px_min_x + pad_x)),
+                (px_min_y + pad_y) + random.random() * ((px_max_y - pad_y) - (px_min_y + pad_y)),
+            )
+        if coords:
+            return (float(coords[0]) * element_box["width"],
+                    float(coords[1]) * element_box["height"])
+        return None
+
+    def _click_when_frame_matches(
+        self, page: Any, element: Any, action: Dict[str, Any],
+        element_box: Dict[str, float], await_keyframe: str,
+    ) -> None:
+        """Click one target on an ANIMATED board, at the moment its screen is up.
+
+        The ORDER is the point of it: park on the target, open the gate, press
+        in place — so the only thing between "the right screen is showing" and
+        the click is a mouse-down. It used to wait and then click, and the click
+        begins with a humanised move of 274-647ms against a 1500ms median dwell,
+        so the gate could succeed and the press still land on the next screen.
+        Moving to a point the pointer already occupies is a no-op, so parking
+        early costs nothing.
+        """
+        rel = self._click_point_for(action, element_box)
+        if rel is None:
+            _log("click action without coordinates or bounding box; skipping")
+            return
+        at = (element_box["x"] + rel[0], element_box["y"] + rel[1])
+        with self._phase("mouse"):
+            self._human.move(page, at)
+        self._wait_for_keyframe(
+            element, await_keyframe,
+            (rel[0] / element_box["width"], rel[1] / element_box["height"]),
+        )
+        with self._phase("mouse"):
+            self._human.click(page, at)
 
     def _execute_click(
         self, page: Any, action: Dict[str, Any], element_box: Dict[str, float]
@@ -897,10 +1145,8 @@ class PageSolver:
             _log("click action without coordinates or bounding box; skipping")
             return
 
-        self._smooth_move(page, element_box["x"] + rel_x, element_box["y"] + rel_y)
-        page.mouse.down()
-        _delay(random.random() * 30 + 20)
-        page.mouse.up()
+        with self._phase("mouse"):
+            self._human.click(page, (element_box["x"] + rel_x, element_box["y"] + rel_y))
 
     def _execute_drag(
         self, page: Any, action: Dict[str, Any], element_box: Dict[str, float]
@@ -913,12 +1159,8 @@ class PageSolver:
 
         src = center(action["source_bounding_box"])
         dst = center(action["target_bounding_box"])
-        self._smooth_move(page, *src)
-        page.mouse.down()
-        _delay(random.random() * 50 + 50)
-        self._smooth_move(page, *dst)
-        _delay(random.random() * 50 + 50)
-        page.mouse.up()
+        with self._phase("mouse"):
+            self._human.drag(page, src, dst)
 
     # ------------------------------------------------------------------
     # Typing and sliding
@@ -942,33 +1184,67 @@ class PageSolver:
                 return element
         return None
 
-    def _execute_type(self, page: Any, scope: Any, action: Dict[str, Any]) -> bool:
+    def _answer_box(self, scope: Any, element: Any = None) -> Optional[Any]:
+        """Where a distorted-text captcha's answer goes.
+
+        Inside the widget first. If the widget holds no text box at all, widen
+        ONCE to its enclosing <fieldset>/<form> and look again for a
+        VENDOR-NAMED box only.
+
+        BotDetect is why, and nothing else needs it. BotDetect is a self-hosted
+        LIBRARY, so the host application owns the layout: measured on
+        captcha.com 2026-08-24, `.BDC_CaptchaDiv` — the element `detect_captcha`
+        returns — is 280x50 and holds the image alone, while `#captchaCode` sits
+        in a sibling `<div class="validationDiv">` under the enclosing
+        <fieldset>. Scoped to the widget the solver found no box, `text_mode`
+        stayed False, and it read the code correctly and never typed it. A clean
+        solve thrown away, and indistinguishable in any report from a model that
+        cannot read warped text.
+
+        The widened pass is restricted to TEXT_INPUT_VENDOR_SELECTORS on
+        purpose. The generic tail (`input[type=text]`, `textarea`,
+        `input:not([type])`) is what makes the in-widget lookup work for every
+        other vendor, and OUTSIDE the widget it is exactly how a captcha's
+        answer ends up in a login form's username box — the failure
+        `_find_control`'s docstring already warns about. One level, named
+        selectors, and never the page.
+        """
+        inside = self._find_control(scope, TEXT_INPUT_SELECTORS)
+        if inside is not None or element is None:
+            return inside
+        # Nearest first: a <fieldset> inside a <form> is the tighter box, and
+        # `query_selector` on a union would hand back whichever comes first in
+        # document order — the outer one.
+        for axis in ("ancestor::fieldset[1]", "ancestor::form[1]"):
+            try:
+                host = element.query_selector(f"xpath={axis}")
+            except Exception:
+                continue
+            if host is None:
+                continue
+            found = self._find_control(host, TEXT_INPUT_VENDOR_SELECTORS)
+            if found is not None:
+                _log("widget holds no answer box; using the vendor-named one "
+                     "in its enclosing form")
+                return found
+        return None
+
+    def _execute_type(self, page: Any, scope: Any, action: Dict[str, Any],
+                      element: Any = None) -> bool:
         """Put the model's reading of a distorted-text captcha into its box."""
         text = str(action.get("text") or "")
         if not text:
             return False
-        field = self._find_control(scope, TEXT_INPUT_SELECTORS)
+        field = self._answer_box(scope, element)
         if field is None:
             _log("type action, but no text box in the widget; skipping")
             return False
 
-        self._move_and_click(page, field)  # travel there, then press to focus
-        # A retry round arrives with the previous attempt still in the box, and
-        # typing would APPEND to it — submitting a string the model never read.
-        try:
-            page.keyboard.press("Control+A")
-        except Exception:
-            pass
-        # Per character rather than one `type(text, delay=…)` call: a constant
-        # inter-key delay is itself a signal, and these are the vendors that
-        # score typing cadence.
-        for ch in text:
-            try:
-                page.keyboard.type(ch)
-            except Exception as exc:
-                _log(f"could not type into the captcha field: {exc}")
-                return False
-            _delay(random.random() * 90 + 45)
+        # Tapping the box is what focuses it — and on a phone it is also what
+        # raises the keyboard, so this is not decoration on either device.
+        self._move_and_click(page, field)
+        if not self._human.type_text(page, field, text):
+            return False
         _log(f"typed {len(text)} character(s) into the captcha field")
         return True
 
@@ -985,6 +1261,17 @@ class PageSolver:
             _debug(f"track_piece failed: {exc}")
             return None
 
+    @staticmethod
+    def _shot_scale(shot: str, css_width: float) -> float:
+        """Device pixels per CSS pixel, read off the shot we are about to
+        measure. 1.0 when the image cannot be read — an unreadable shot is
+        already the `_track_piece` returns-None path, and guessing a ratio
+        would steer the handle by it."""
+        dims = _read_png_dimensions(shot)
+        if not dims or css_width <= 0:
+            return 1.0
+        return dims[0] / css_width
+
     def _execute_slide(
         self,
         page: Any,
@@ -1043,12 +1330,12 @@ class PageSolver:
                  + float(action["target_bounding_box"][3])) / 2
             ) * element_box["height"]
             _log("no slider track; dragging the piece to the slot directly")
-            self._smooth_move(page, box["x"] + box["width"] / 2, box["y"] + box["height"] / 2)
-            page.mouse.down()
-            _delay(random.random() * 50 + 50)
-            self._smooth_move(page, element_box["x"] + target_x, element_box["y"] + target_y)
-            _delay(random.random() * 50 + 50)
-            page.mouse.up()
+            with self._phase("mouse"):
+                self._human.drag(
+                    page,
+                    (box["x"] + box["width"] / 2, box["y"] + box["height"] / 2),
+                    (element_box["x"] + target_x, element_box["y"] + target_y),
+                )
             return True
 
         hbox = handle.bounding_box()
@@ -1063,7 +1350,7 @@ class PageSolver:
         # moving thing in frame, and we would track the handle instead of the
         # piece.
         pad = max(4.0, hbox["height"] * 0.35)
-        exclude = [
+        band = [
             0.0,
             hbox["y"] - element_box["y"] - pad,
             element_box["width"],
@@ -1073,20 +1360,32 @@ class PageSolver:
         shots = [_tmp_png("slide") for _ in range(4)]
         try:
             self._move_to_element(page, handle, padding_percentage=30.0)
-            page.mouse.down()
-            _delay(random.random() * 60 + 60)
+            self._human.press(page)
+            self._human.pause("grab")
             self._screenshot(element, shots[0],
                              timeout_ms=self.config.element_screenshot_timeout_ms)
 
+            # CSS pixels out here, DEVICE pixels inside the shots. The same
+            # number on a 1x desktop and 2.625x apart on a phone, which is why
+            # this loop measured a slider correctly for a year and then missed
+            # every attempt the moment Tier 3 grew a mobile arm: the mask landed
+            # above the handle, the widths came back 2.6x too wide, and
+            # `_solve_slide_geometry` threw them out as wider than the widget.
+            # Measured from the shot rather than asked of the page, for the same
+            # reason the grid path does it (`_GridSession.scale_x`): what the CV
+            # reads is the image, whatever the window thinks its ratio is.
+            scale = self._shot_scale(shots[0], element_box["width"])
+            exclude = [v * scale for v in band]
+
             probes = self.config.slide_probe_offsets_px
             widths: List[Tuple[float, float]] = []
             last_box = None
             for offset, shot in zip(probes, shots[1:]):
                 self._smooth_move(page, start_x + offset, hold_y)
-                _delay(random.random() * 40 + 40)
+                self._human.pause("probe")
                 box = self._track_piece(element, shots[0], shot, exclude)
                 if box is not None:
-                    widths.append((float(offset), float(box[2] - box[0])))
+                    widths.append((float(offset), float(box[2] - box[0]) / scale))
                     last_box = box
 
             piece_w, ratio = self._solve_slide_geometry(widths, element_box["width"])
@@ -1107,27 +1406,28 @@ class PageSolver:
                 # asked for.
                 offset = float(widths[-1][0])
                 for _ in range(self.config.slide_max_corrections):
-                    piece_center = (last_box[2] - piece_w / 2.0)
+                    piece_center = (last_box[2] / scale - piece_w / 2.0)
                     error = target_x - piece_center
                     if abs(error) <= self.config.slide_tolerance_px:
                         break
                     offset += error / ratio
                     self._smooth_move(page, start_x + offset, hold_y)
-                    _delay(random.random() * 40 + 40)
+                    self._human.pause("probe")
                     box = self._track_piece(element, shots[0], shots[3], exclude)
                     if box is None:
                         break  # ran out of track; release where we are
                     last_box = box
-                _debug(f"slider: piece_w={piece_w:.1f} ratio={ratio:.3f} "
-                       f"final_center={last_box[2] - piece_w / 2.0:.1f} target={target_x:.1f}")
+                _debug(f"slider: piece_w={piece_w:.1f} ratio={ratio:.3f} scale={scale:.3f} "
+                       f"final_center={last_box[2] / scale - piece_w / 2.0:.1f} "
+                       f"target={target_x:.1f}")
 
             # Settle before letting go. A release in the same tick as the last
             # move reads as a machine, and some vendors sample the final
             # milliseconds of the gesture.
-            _delay(random.random() * 120 + 90)
+            self._human.pause("settle")
         finally:
             try:
-                page.mouse.up()
+                self._human.release(page)
             except Exception:
                 pass
             for shot in shots:
@@ -1288,6 +1588,54 @@ class PageSolver:
 
         return None
 
+    def vendors_on_the_wire(self, page: Any) -> List[str]:
+        """Which vendors' code this page actually loaded.
+
+        Read out of the page's own resource timing plus the `src`/`href` of
+        everything it linked, so it works whenever it is called — a request
+        listener would have to have been attached before navigation, and by the
+        time a solve fails that ship has sailed.
+
+        Best-effort by construction: the resource-timing buffer is finite and a
+        page may have cleared it. An empty answer is "nothing seen", never "no
+        captcha here".
+        """
+        try:
+            names = page.evaluate(
+                """() => {
+                  const out = [];
+                  try {
+                    for (const e of performance.getEntriesByType('resource')) out.push(e.name);
+                  } catch (err) {}
+                  for (const el of document.querySelectorAll('script[src],iframe[src],link[href],img[src]')) {
+                    out.push(el.getAttribute('src') || el.getAttribute('href') || '');
+                  }
+                  return out;
+                }"""
+            )
+        except Exception:
+            return []
+        blob = " ".join(str(n) for n in (names or []))
+        return [entry["puzzle_source"] for entry in VENDOR_URL_MARKERS
+                if any(host in blob for host in entry["hosts"])]
+
+    def _no_widget_message(self, page: Any) -> str:
+        """Why nothing was found — the two cases told apart.
+
+        The old text guessed "reCAPTCHA v3 / invisible" every time, including
+        the times a vendor had simply moved its DOM. See VENDOR_URL_MARKERS.
+        """
+        base = "no interactive captcha widget detected"
+        loaded = self.vendors_on_the_wire(page)
+        if not loaded:
+            return (f"{base} (no vendor captcha code loaded on this page — "
+                    "likely reCAPTCHA v3 / invisible, or a click-triggered "
+                    "challenge that has not been triggered)")
+        return (f"{base}, BUT {'/'.join(loaded)} code IS loaded and running on "
+                "this page. The vendor's markup no longer matches anything in "
+                "VENDOR_WIDGET_LOCATORS — re-measure with "
+                "scripts/check_vendor_selectors.py and update BOTH solver ports")
+
     def is_captcha_solved(self, page: Any) -> bool:
         """
         The vendor's definitive DONE signal — anchor checked or token populated.
@@ -1304,7 +1652,7 @@ class PageSolver:
             # overlay up for a couple of seconds after the winning submit.
             # Gating this on `_visible(anchor)` meant the one signal that was
             # already true went unread, and the loop ground on against a frame
-            # being torn down. See tests/test_solved_detection.py.
+            # being torn down. See the training repo's solved-detection tests.
             if self._has_non_empty_field_value(page, '[name="h-captcha-response"]'):
                 return True
             if self._has_non_empty_field_value(page, '[name="g-recaptcha-response"]'):
@@ -1371,28 +1719,55 @@ class PageSolver:
             pass
         return False
 
-    def _has_recaptcha_underselect_error(self, page: Any) -> bool:
-        """
-        reCAPTCHA's "select all matching images" banner, shown after Verify with
-        an incomplete selection.
+    #: Which of reCAPTCHA's bframe banners is showing, by selector.
+    #:
+    #: ONE ENTRY PER MEANING. They share a corner and a look and they are three
+    #: different facts; see `_recaptcha_banner_kind`.
+    _RECAPTCHA_BANNERS = (
+        (".rc-imageselect-error-select-more", "select-more"),
+        (".rc-imageselect-error-dynamic-more", "dynamic-more"),
+        (".rc-imageselect-incorrect-response", "rejected"),
+    )
 
-        Critically, the tiles do NOT refresh on this error: without special
-        handling the model sees the same image, answers `done` (to it, everything
-        matching IS selected), we click Verify again, and the solve loops until
-        it times out. Detecting it switches the next call into missed-tiles mode.
+    @staticmethod
+    def _banner_is_fatal_after_retry(kind: Optional[str]) -> bool:
+        """May a REPEAT of this banner end the solve?
+
+        Only where repeating means stuck. `dynamic-more` repeating is what a
+        dynamic board's normal progress looks like, and treating it as fatal is
+        the bug this split was made to fix.
+        """
+        return kind in ("select-more", "rejected")
+
+    def _recaptcha_banner_kind(self, page: Any) -> Optional[str]:
+        """WHICH of reCAPTCHA's three bframe banners is showing, if any.
+
+        `rejected`     "Please try again."  The answer was wrong; a fresh board
+                       follows, so the useful response is to solve that one.
+        `select-more`  "Please select all matching images."  Under-selected, and
+                       the tiles do NOT refresh — so a driver that re-submits
+                       the same answer loops until the session times out. The
+                       missed-tiles retry and the abort exist for this case.
+        `dynamic-more` "Please also check the new images."  NOT AN ERROR. It is
+                       the dynamic 3x3's normal flow: cleared tiles fade out,
+                       replacements fade in, and the widget says so — on
+                       essentially every round of that variant.
+
+        This used to be a boolean over all three, which made the third
+        indistinguishable from the two genuine errors and armed the one-retry
+        abort with the sentence that means "you are doing fine". Every dynamic
+        board therefore died at round two. Measured 2026-09-06: three of three
+        `recaptcha_3x3_fade` attempts stopped at exactly boards=2, while
+        `recaptcha_4x4` on the same run passed at 2, 3 and 5 boards.
         """
         try:
             bframe = page.query_selector('iframe[src*="recaptcha/api2/bframe"]')
             if not bframe:
-                return False
+                return None
             frame = bframe.content_frame()
             if not frame:
-                return False
-            for selector in (
-                ".rc-imageselect-error-select-more",
-                ".rc-imageselect-error-dynamic-more",
-                ".rc-imageselect-incorrect-response",
-            ):
+                return None
+            for selector, kind in self._RECAPTCHA_BANNERS:
                 element = frame.query_selector(selector)
                 if not element:
                     continue
@@ -1401,10 +1776,10 @@ class PageSolver:
                 if self._visible(element):
                     text = element.text_content() or ""
                     if text.strip():
-                        return True
+                        return kind
         except Exception:
             pass
-        return False
+        return None
 
     def _get_verify_button(self, frame: Any) -> Optional[Any]:
         # `.//` — RELATIVE. `scope` is an ElementHandle whenever the widget is
@@ -1612,6 +1987,160 @@ class PageSolver:
         if self.config.animated_probe_enabled and not self._animated_probe_done:
             self._animated_probe_armed = True
 
+    def _should_speculate(self, puzzle_source: str, text_mode: bool) -> bool:
+        """Should this round record while it asks?
+
+        reCAPTCHA is excluded for the same reason it is excluded from the
+        animated path at all: its dynamic 3x3 REPLACES tiles in place and has
+        its own fade gates, so a burst there would film a fade and call it a
+        cycle. A distorted-text round is excluded because the answer is a
+        string, not a place, and no recording helps read one.
+        """
+        cfg = self.config
+        if not cfg.video_solve_enabled:
+            return False
+        if not cfg.speculative_burst_enabled:
+            return False
+        if puzzle_source == "recaptcha":
+            return False
+        return not text_mode
+
+    def _speculate(
+        self, element: Any, shot: str, puzzle_source: str,
+        retry_mode: Optional[str], text_mode: bool,
+    ) -> Tuple[List[CaptchaAction], List[Dict[str, Any]], Optional[str]]:
+        """Read the still and film the widget at once.
+
+        Returns `(actions, usage, keyframe_dir)`. `keyframe_dir` is None when
+        the board turned out to be still — the caller then behaves exactly as
+        it always has.
+        """
+        from concurrent.futures import ThreadPoolExecutor
+
+        import cv2
+
+        from .keyframes import extract_keyframes, write_keyframes
+
+        cfg = self.config
+        fps = max(1, int(cfg.video_burst_fps))
+        floor_frames = max(1, round(cfg.video_burst_duration_ms / (1000.0 / fps)))
+        total = max(floor_frames, round(cfg.video_burst_max_ms / (1000.0 / fps)))
+        interval = 1.0 / fps
+
+        frames: List[Any] = []
+        order: List[str] = []
+        last_digest: Optional[str] = None
+        cycle_closed = False
+        probe = _tmp_png("spec")
+
+        pool = ThreadPoolExecutor(max_workers=1)
+        try:
+            # `_get_solution` DIRECTLY, not through the freshness guard.
+            #
+            # Two reasons, and the first is a hard constraint: the guard
+            # screenshots the element to decide whether the answer went stale,
+            # and a Playwright call from this worker would violate the sync
+            # API's thread affinity. Only the planner's HTTP request may cross.
+            #
+            # The second is that the guard is redundant here. It exists to ask
+            # "did the widget change while the model was reading it" — which is
+            # exactly what the burst on the main thread is answering, at the
+            # noise floor, from every frame rather than from one diff at the
+            # end.
+            fut = pool.submit(
+                self._get_solution, shot, puzzle_source, retry_mode, text_mode)
+            with self._phase("burst"):
+                for i in range(total):
+                    start = time.monotonic()
+                    try:
+                        self._screenshot(element, probe, animations="allow")
+                        img = cv2.imread(probe)
+                    except Exception as exc:  # noqa: BLE001 — a dropped frame is not fatal
+                        _debug(f"speculative frame {i} failed: {exc}")
+                        img = None
+                    if img is not None:
+                        frames.append(img)
+                        try:
+                            with open(probe, "rb") as fh:
+                                d = hashlib.sha1(fh.read()).hexdigest()
+                        except Exception:  # noqa: BLE001
+                            d = None
+                        if d is not None and d != last_digest:
+                            if d in order and len(order) >= 2:
+                                cycle_closed = True
+                            elif d not in order:
+                                order.append(d)
+                            last_digest = d
+                    moved = len(order) >= 2
+                    # Still, and the answer has landed: nothing more to film.
+                    if not moved and fut.done():
+                        break
+                    # Moving, and the cycle has closed: every screen is in hand.
+                    if moved and cycle_closed and len(frames) >= floor_frames:
+                        _log(f"[animated] cycle closed after {len(frames) * interval:.1f}s "
+                             f"({len(order)} screens); stopping the burst")
+                        break
+                    wait = interval - (time.monotonic() - start)
+                    if wait > 0:
+                        time.sleep(wait)
+
+            if len(order) < 2:
+                actions, usage = fut.result()
+                return actions, usage, None
+
+            _log("[animated] the widget moved while the model was reading it — "
+                 "dropping the still answer and finishing the recording.")
+            fut.result()          # drained, not used: it describes a screen that has gone
+            # THE ESCALATION BUYS ITS OWN BUDGET, once per solve — and only now,
+            # because a speculative burst that turned out to be unnecessary must
+            # not extend the deadline of a still solve.
+            if cfg.video_solve_enabled and not self._video_budget_granted:
+                self._video_budget_granted = True
+                if self._deadline_ms is not None:
+                    self._deadline_ms += cfg.video_budget_ms()
+                    _log(f"[animated] +{cfg.video_budget_ms()}ms for the recording path")
+            kfset = extract_keyframes(frames, fps=float(fps))
+            self._keyframe_mode = kfset.mode
+            self._keyframe_steady_screens = kfset.steady_screens
+            keyframe_dir = tempfile.mkdtemp(prefix="ckkf_")
+            paths = write_keyframes(kfset, keyframe_dir, stem="challenge")
+            with self._phase("inference"):
+                actions, usage = self._get_keyframe_solution(paths)
+            self._animated_plan = (paths, keyframe_dir, actions, usage)
+            return actions, usage, keyframe_dir
+        finally:
+            pool.shutdown(wait=True)
+            _unlink(probe)
+
+    def _invalidate_animated_answer(self) -> None:
+        """The recording is still good; the ANSWER it produced is not.
+
+        `_animated_plan` caches "one burst, one inference, for as long as this
+        board is up". For a cycling board whose answer merely landed on the
+        wrong screen that is right — the frames do not change, so re-recording
+        buys nothing. It is WRONG the moment the widget has refused the answer:
+        re-submitting the identical coordinates cannot succeed, and the driver
+        did exactly that until it ran out of rounds. Measured 2026-09-09 on
+        an hCaptcha line-pieces board, where every round logged "reusing the recorded
+        answer" and then "the model returned the same answer again" — the model
+        was never asked a second time.
+
+        Drops the ANSWER and keeps the FRAMES, so the retry costs one inference
+        rather than another `video_burst_max_ms` of filming.
+        """
+        plan = self._animated_plan
+        if plan is None or plan[2] is None:
+            return
+        keyframes, keyframe_dir, _actions, _usage = plan
+        self._animated_plan = (keyframes, keyframe_dir, None, None)
+
+    def _discard_animated_plan(self) -> None:
+        """Forget the recorded answer, and delete the frames it was holding."""
+        plan = self._animated_plan
+        self._animated_plan = None
+        if plan and plan[1]:
+            shutil.rmtree(plan[1], ignore_errors=True)
+
     def _record_keyframes(self, element: Any) -> Tuple[List[str], str]:
         """Record the widget and return `(keyframe_paths, temp_dir)`.
 
@@ -1636,7 +2165,24 @@ class PageSolver:
 
         cfg = self.config
         fps = max(1, int(cfg.video_burst_fps))
-        total = max(1, round(cfg.video_burst_duration_ms / (1000.0 / fps)))
+        # A BURST MUST OUTLAST ONE FULL CYCLE OR IT OMITS A SCREEN — and may
+        # omit the one the answer is on. CLAUDE.md states that rule; the
+        # COLLECTOR was fixed for it and the driver was not.
+        #
+        # Measured on the live GeeTest svg board, 2026-09-07: three screens
+        # holding 1.5-1.9s each, FULL PERIOD 5.3s, against a 4000ms window. So
+        # the model was shown two screens of three on about half of attempts,
+        # and when the target sat on the third it was being asked a question
+        # with the answer removed.
+        #
+        # Fixed by watching rather than by a bigger constant: the frames of one
+        # screen are byte-identical, so a digest per frame says exactly when the
+        # board returns to a screen already recorded — the cycle is closed and
+        # there is nothing left to capture. A continuous animation never
+        # repeats and stops at the floor, keeping today's behaviour.
+        floor_frames = max(1, round(cfg.video_burst_duration_ms / (1000.0 / fps)))
+        total = max(floor_frames,
+                    round(cfg.video_burst_max_ms / (1000.0 / fps)))
         interval = 1.0 / fps
 
         # THE ESCALATION BUYS ITS OWN BUDGET, once per solve.
@@ -1677,19 +2223,25 @@ class PageSolver:
                 )
 
         frames: List[Any] = []
+        order: List[str] = []          # distinct screens, in first-seen order
+        last_digest: Optional[str] = None
+        cycle_closed = False
+        #: Frame index at which the most recent NEW screen appeared. A board
+        #: that has shown nothing new for a whole floor-length window has
+        #: settled — see the exit below.
+        last_new_at = 0
 
         remaining = max(0, total - len(frames))
         shot = _tmp_png("burst")
         # A burst that runs far past its own length is a hung screenshot, not a
         # tight budget — bounded separately so the two cannot be confused.
-        burst_deadline = (time.monotonic() * 1000.0
-                          + 3 * cfg.video_burst_duration_ms + 5_000)
+        burst_deadline = time.monotonic() * 1000.0 + burst_hang_deadline_ms(cfg)
         try:
             for i in range(remaining):
                 if time.monotonic() * 1000.0 > burst_deadline:
                     raise CaptchaSolveError(
                         f"the animated recording stalled: {i} of {remaining} frames "
-                        f"in {3 * cfg.video_burst_duration_ms + 5000}ms. The widget "
+                        f"in {burst_hang_deadline_ms(cfg):.0f}ms. The widget "
                         f"is not screenshotting."
                     )
                 start = time.monotonic()
@@ -1707,6 +2259,63 @@ class PageSolver:
                     img = cv2.imread(shot)
                     if img is not None:
                         frames.append(img)
+                        try:
+                            with open(shot, "rb") as fh:
+                                d = hashlib.sha1(fh.read()).hexdigest()
+                        except Exception:  # noqa: BLE001 — no digest, no early stop
+                            d = None
+                        if d is not None and d != last_digest:
+                            # A screen already recorded, coming back after
+                            # another one: the loop has closed and every screen
+                            # is now in the clip.
+                            if d in order and len(order) >= 2:
+                                cycle_closed = True
+                            elif d not in order:
+                                order.append(d)
+                                last_new_at = len(frames)
+                            last_digest = d
+                # Past the floor with the cycle closed — more frames are the
+                # same screens again, paid for in budget the solve needs.
+                if cycle_closed and len(frames) >= floor_frames:
+                    _log(f"[animated] cycle closed after {len(frames) * interval:.1f}s "
+                         f"({len(order)} screens); stopping the burst")
+                    break
+                # NOTHING NEW FOR A WHOLE FLOOR-LENGTH WINDOW: the board has
+                # SETTLED, and a settled board can never close a cycle —
+                # `cycle_closed` needs a digest to come back AFTER a different
+                # one. Without this exit the only way out is `remaining`, so
+                # every escalation onto a widget that is not cycling filmed the
+                # full `video_burst_max_ms`.
+                #
+                # `_speculate` has always had this half (`not moved and
+                # fut.done()`); it could, because it has an inference to wait
+                # on. This path had nothing equivalent and so could not stop
+                # early at all.
+                #
+                # "Settled", not "one screen", because there are THREE shapes
+                # and only one of them is a cycle. Measured on the real fixtures
+                # through camoufox, one element screenshotted 25x at 10fps:
+                #
+                #   click_blocked_by_lines  1 distinct sha1  MAD  0.00  never moves
+                #   connect_path            1 distinct sha1  MAD  0.00  never moves
+                #   tower_stack             2 distinct sha1  MAD 32.51  moves ONCE
+                #   geetest_v4_svg          3 distinct sha1  MAD  8.29  really cycles
+                #
+                # `tower_stack` is why a one-screen test is not enough: it
+                # transitions once and then holds, so it has two screens, never
+                # repeats either, and ran the full 12s under a one-screen rule.
+                #
+                # The window is the burst FLOOR (4s), which is safely longer
+                # than the worst dwell a cycling board holds a screen for —
+                # measured p50 1.5s / p75 2.0s / max 2.7s on the geetest svg
+                # board — so a real cycle always produces a new screen inside
+                # the window and is never cut short here.
+                if (len(frames) >= floor_frames
+                        and len(frames) - last_new_at >= floor_frames):
+                    _log(f"[animated] no new screen for {floor_frames * interval:.1f}s "
+                         f"({len(order)} seen) — the board has settled; "
+                         f"stopping the burst")
+                    break
                 # Drift-corrected: a slow screenshot must not stretch the clip, or
                 # the recording covers more wall-clock than the model trained on and
                 # a cycle's period lands differently across the frames.
@@ -1729,6 +2338,7 @@ class PageSolver:
         # The wait gate consults this: `even` means the extractor found no state
         # that RECURS, so there is nothing for the page to come back to.
         self._keyframe_mode = kfset.mode
+        self._keyframe_steady_screens = kfset.steady_screens
         return [str(p) for p in paths], temp_dir
 
     def _wait_for_keyframe(self, element: Any, keyframe_path: str,
@@ -1757,12 +2367,12 @@ class PageSolver:
         cheap failure: the gate polls the full `keyframe_wait_timeout_ms` (6s)
         PER CLICK before giving up and clicking anyway.
         And `even` is not the rare case. All 116 real clips under
-        `cleanSamples/test/raw/**/keyframes/` are `even`; `cycle` has never once
+        `the sample corpus/**/keyframes/` are `even`; `cycle` has never once
         fired on real footage, which keyframes.py itself records ("real state
         separations top out around 0.007, well under this"). So on real traffic
         this gate was 6s of dead time on every animated click, always followed by
         the same click it would have made immediately. Measured on
-        `hcaptcha_rotating_obj_video`: 6.0s of a 28.8s solve, closest region diff
+        an hCaptcha rotating-object animation: 6.0s of a 28.8s solve, closest region diff
         0.0721 against a 0.05 tolerance, then it clicked and solved.
 
         The gate stays for `cycle`/`static`, where a state genuinely does recur
@@ -1773,9 +2383,17 @@ class PageSolver:
 
         from .keyframes import MATCH_REGION_TOLERANCE, region_box, region_diff_ratio
 
-        if self._keyframe_mode == "even":
-            _log("[animated] clip is mode=even (no state recurs); "
-                 "acting on the model's frame without waiting")
+        # NOT `mode == "even"`. A board that holds a few screens is worth
+        # waiting for whether or not one 4s burst was long enough to catch it
+        # repeating — and it never is, which is why every real animated capture
+        # slices `even` and this gate was off on all of them. What is genuinely
+        # not worth waiting for is a clip with NO steady screens: a rotation, a
+        # one-way fade, a sprite crossing. Measured: 0 steady screens for all
+        # five continuous hCaptcha video types, 2-3 for every real GeeTest svg.
+        if self._keyframe_steady_screens < 2:
+            _log(f"[animated] clip sits on {self._keyframe_steady_screens} steady "
+                 f"screen(s); nothing to come back to, acting on the model's "
+                 f"frame without waiting")
             return False
 
         ref = cv2.imread(keyframe_path)
@@ -1788,11 +2406,17 @@ class PageSolver:
         deadline = (time.monotonic() * 1000.0) + cfg.keyframe_wait_timeout_ms
         probe = _tmp_png("kfwait")
         best = 1.0
+        polls = 0
         try:
             while (time.monotonic() * 1000.0) < deadline:
                 self._check_deadline("waiting for the challenge keyframe")
                 try:
-                    self._screenshot(element, probe)
+                    # animations="allow": the motion is the thing being watched.
+                    # "disabled" FREEZES an infinite CSS animation, so the gate
+                    # would photograph one frozen screen on every poll and could
+                    # never see the board come round. The JS twin carries the
+                    # full note.
+                    self._screenshot(element, probe, animations="allow")
                     live = cv2.imread(probe)
                 except Exception as exc:  # noqa: BLE001
                     _debug(f"keyframe probe failed: {exc}")
@@ -1803,12 +2427,31 @@ class PageSolver:
                     if d <= MATCH_REGION_TOLERANCE:
                         _log(f"[animated] widget matched the chosen keyframe (diff={d:.4f})")
                         return True
+                    # NOT THIS BOARD AT ALL — stop waiting for a screen of it.
+                    # Two SCREENS of one board differ by 0.0056 (measured on
+                    # GeeTest svg); a different board reads 0.77. So a diff this
+                    # large means the puzzle we recorded is gone — solved,
+                    # refreshed or replaced — and the rest of the budget buys
+                    # nothing. See the JS twin for the full note.
+                    polls += 1
+                    if polls >= _NOT_THIS_BOARD_POLLS and best > _NOT_THIS_BOARD_DIFF:
+                        _log(f"[animated] the widget no longer resembles the recorded "
+                             f"board (best diff={best:.4f} over {polls} polls); not "
+                             f"waiting out the budget")
+                        self._discard_animated_plan()
+                        return False
                 _delay(cfg.keyframe_wait_poll_ms)
         finally:
             _unlink(probe)
+        # NEVER SAW IT. Either the board moved on to a different challenge or
+        # the answer was for a screen this widget does not show. Both mean the
+        # plan is spent, so the next round records afresh rather than
+        # re-clicking a cell chosen from pictures that are gone.
+        self._discard_animated_plan()
         _log(f"[animated] widget never matched the chosen keyframe within "
              f"{cfg.keyframe_wait_timeout_ms}ms (closest diff={best:.4f}); "
-             f"clicking on the model's coordinates anyway")
+             f"clicking on the model's coordinates anyway, and recording "
+             f"afresh next round")
         return False
 
     def _wait_for_change_since(self, element: Any, since_hash: str) -> bool:
@@ -1835,7 +2478,7 @@ class PageSolver:
         `return !!(example && ...)`, which is false when there is no example
         image — so a challenge with no tile grid, no canvas and no example
         polled until the timeout and then carried on regardless. Measured on
-        `hcaptcha_number_with_highest_value_video`: 24.0s of a 45.2s solve, the
+        an hCaptcha highest-value animation: 24.0s of a 45.2s solve, the
         full 8s three times over, more than half the budget spent asking a
         question about elements that were not on the page. A readiness gate can
         only report on what it can see; with nothing to check it has no opinion,
@@ -1972,9 +2615,42 @@ class PageSolver:
             if not cfg.stale_frame_resolve_enabled:
                 return actions, merged_usage
 
+            # DID THE PICTURE MOVE WHILE THE MODEL READ IT? Asked once per
+            # round, at the noise floor rather than the staleness threshold. A
+            # still puzzle answers no for the price of one frame diff; a
+            # cycling one answers yes and stops being treated as a still a
+            # whole round earlier than "the same answer came back twice"
+            # allows. Acting on one observation is safe because the recording
+            # is self-checking — see `_settle_or_animated`.
+            if self._frame_changed_since(element, current,
+                                         _MOVED_DURING_INFERENCE_DIFF):
+                self._arm_animated_probe()
+                _log("[freshness] the widget moved while the model was reading "
+                     "it, with nothing clicked — recording it rather than "
+                     "answering another still.")
+
+            changed_during_inference = 0
             for attempt in range(cfg.max_stale_frame_resolves):
                 if not self._frame_changed_since(element, current, cfg.stale_frame_diff_threshold):
                     break  # frame held still through inference — answer is valid
+                # CHANGED AGAIN, having already re-solved once and touched
+                # nothing. One change is a board still developing — tiles
+                # fading in — which is what the re-solve below is for. A SECOND
+                # change in the same round is a board that does not stop, and
+                # re-solving it is futile: each answer is for a screen that will
+                # be gone before the click.
+                #
+                # This is the earliest the driver can know. Both ports otherwise
+                # wait for the same answer to come back twice, which costs a
+                # whole extra round and its inference — ~10s of a 40s solve
+                # spent rediscovering what the guard has just watched happen.
+                changed_during_inference += 1
+                if changed_during_inference >= 2:
+                    self._arm_animated_probe()
+                    _log("[freshness] the frame changed twice during inference with "
+                         "nothing clicked — this board cycles; recording it rather "
+                         "than re-solving a screen that has gone.")
+                    return actions, merged_usage
                 fresh = _tmp_png("freshsolve")
                 try:
                     self._screenshot(element, fresh)
@@ -2006,6 +2682,10 @@ class PageSolver:
         )
 
     def _hover_cell(self, page: Any, session: _GridSession, cell: int) -> None:
+        # A hover is mimicry of a resting CURSOR, so on a device that has none
+        # it is not weaker mimicry — it is a mousemove at a touch-only widget.
+        if not self._human.hovers:
+            return
         first = session.grid_boxes[0]
         cell_w = (first[2] - first[0]) * session.scale_x
         cell_h = (first[3] - first[1]) * session.scale_y
@@ -2217,19 +2897,29 @@ class PageSolver:
             # Each round can legitimately spend ~10s waiting on fades, so eight
             # of them plus the model calls can outlast the whole solve budget.
             self._check_deadline(f"recaptcha grid round {round_index}")
-            with self._phase("grid-load"):
-                self._wait_for_grid_cells_loaded(element)
+            # Round 1 skips it: `_solve_single` has just waited for these cells,
+            # read the grid boxes off the loaded board and handed over, and
+            # nothing has touched the widget in between. Rounds 2..N still wait,
+            # because by then THIS driver has clicked and the tiles really are
+            # reloading. Measured 2148ms x2 on one solve.
+            if round_index > 1:
+                with self._phase("grid-load"):
+                    self._wait_for_grid_cells_loaded(element)
             shot = _tmp_png("recap")
             action: Optional[Dict[str, Any]] = None
             try:
-                self._screenshot(element, shot, timeout_ms=cfg.element_screenshot_timeout_ms)
+                with self._phase("screenshot"):
+                    self._screenshot(element, shot,
+                                     timeout_ms=cfg.element_screenshot_timeout_ms)
                 retry_for_round = pending_retry
                 pending_retry = None  # only round 1 carries the inbound hint
-                actions, usage = self._solve_frame_freshness_guarded(
-                    element,
-                    shot,
-                    lambda image_path: self._get_solution(image_path, "recaptcha", retry_for_round),
-                )
+                with self._phase("inference"):
+                    actions, usage = self._solve_frame_freshness_guarded(
+                        element,
+                        shot,
+                        lambda image_path: self._get_solution(
+                            image_path, "recaptcha", retry_for_round),
+                    )
                 all_usage.extend(usage)
                 action = _as_dict(actions[0]) if actions else None
             finally:
@@ -2242,8 +2932,11 @@ class PageSolver:
 
             if action.get("action") == "wait":
                 _log(f"[recaptcha-grid] round {round_index}: waiting for tiles.")
-                loading, _ = self._watch_clicked_tiles(page, element, session, clicked_order)
-                self._wait_for_any_clicked_tile_loaded(page, element, session, loading)
+                with self._phase("fade-wait"):
+                    loading, _ = self._watch_clicked_tiles(
+                        page, element, session, clicked_order)
+                    self._wait_for_any_clicked_tile_loaded(
+                        page, element, session, loading)
                 continue
 
             if action.get("action") == "click":
@@ -2266,16 +2959,17 @@ class PageSolver:
                     if cell is not None:
                         clicked_order.append(cell)
                         clicked_this_round.append(cell)
-                    _delay(random.random() * 80 + 80)
+                    self._human.pause("between")
                 performed_action = True
                 _log(
                     f"[recaptcha-grid] round {round_index}: clicked {len(bboxes)} tile(s) "
                     f"-> cells {clicked_this_round}."
                 )
 
-                loading, chipped = self._watch_clicked_tiles(
-                    page, element, session, clicked_this_round
-                )
+                with self._phase("fade-wait"):
+                    loading, chipped = self._watch_clicked_tiles(
+                        page, element, session, clicked_this_round
+                    )
                 if chipped or not loading:
                     # Either the widget ticked our clicks and kept the photos
                     # (a board that does that is answered), or nothing faded
@@ -2287,7 +2981,9 @@ class PageSolver:
                     )
                     should_submit = True
                     break
-                self._wait_for_any_clicked_tile_loaded(page, element, session, loading)
+                with self._phase("fade-wait"):
+                    self._wait_for_any_clicked_tile_loaded(
+                        page, element, session, loading)
                 continue
 
             _log(f"[recaptcha-grid] round {round_index}: unexpected action; re-solving.")
@@ -2299,6 +2995,17 @@ class PageSolver:
                 if verify:
                     _log("[recaptcha-grid] clicking Verify to submit.")
                     self._move_and_click(page, verify)
+                    # The press IS an interaction, and saying so is load-bearing
+                    # — the same rule `_solve_single` learned on
+                    # a Prosopo 3x3 grid, in the other driver, on another day. A
+                    # `done` round clicks no tile, so without this the one
+                    # answer shape that submits and does nothing else reports
+                    # having done nothing: the caller then takes the
+                    # no-interaction wait instead of polling for the verdict
+                    # (~1s of dead time on every static reCAPTCHA), and raises
+                    # "performed no interactions" if the widget has not
+                    # finished tearing down — on an answer correctly sent.
+                    performed_action = True
 
         return performed_action, all_usage
 
@@ -2339,9 +3046,10 @@ class PageSolver:
         # and want opposite answers. Restricted to `unknown` because neither
         # hCaptcha nor reCAPTCHA has ever served a typed challenge, so a match
         # inside one of their frames would be a false positive by definition.
-        text_mode = puzzle_source == "unknown" and self._find_control(
-            scope, TEXT_INPUT_SELECTORS
-        ) is not None
+        text_mode = (
+            puzzle_source not in VENDORS_WITH_BESPOKE_HANDLING
+            and self._answer_box(scope, element) is not None
+        )
         if text_mode:
             _log("widget has a text box; solving as a distorted-text captcha")
 
@@ -2367,7 +3075,7 @@ class PageSolver:
             if self.is_captcha_solved(page):
                 _log("solved while waiting for the next round; skipping inference.")
                 return False, []
-        elif puzzle_source == "unknown":
+        elif puzzle_source not in VENDORS_WITH_BESPOKE_HANDLING:
             # Non-hCaptcha, non-reCAPTCHA widgets (GeeTest, Tencent, …). The settle
             # probe was never run for these, so an animated one — GeeTest's svg board
             # cycles its glyph set — was screenshotted mid-cycle and answered from
@@ -2413,8 +3121,22 @@ class PageSolver:
                 # whole re-solve budget would burn without ever acting. The frame
                 # number in the answer is the real guard: it names the state to act
                 # in, and `_execute_click` waits for it.
-                with self._phase("burst"):
-                    keyframes, keyframe_dir = self._record_keyframes(element)
+                if self._animated_plan is not None:
+                    # ONE burst for as long as this board is up — and, until
+                    # 2026-09-09, one INFERENCE too, which is what made a
+                    # refused answer immortal. `actions` is None once the
+                    # widget has rejected them (`_invalidate_animated_answer`),
+                    # so the frames are reused and the QUESTION is asked again.
+                    keyframes, keyframe_dir, actions, all_usage = self._animated_plan
+                    reused_plan = actions is not None
+                    _log("[animated] reusing the recorded answer — "
+                         "same board, same screens" if reused_plan else
+                         "[animated] same screens, but the last answer was "
+                         "refused — re-asking on the frames already recorded")
+                else:
+                    reused_plan = False
+                    with self._phase("burst"):
+                        keyframes, keyframe_dir = self._record_keyframes(element)
                 # THE RECORDING IS THE TEST. A burst of a widget that turns out
                 # not to move slices to a single keyframe (`mode=static`), and
                 # that frame is exactly the still this round would have taken
@@ -2437,16 +3159,50 @@ class PageSolver:
                     # another screenshot of the same motionless widget.
                     shutil.copyfile(keyframes[0], shot)
                     have_shot = True
+                    # Not a cycling board after all, so there is no plan to keep.
+                    self._discard_animated_plan()
                     shutil.rmtree(keyframe_dir, ignore_errors=True)
                     keyframe_dir = None
-                else:
+                elif not reused_plan:
                     with self._phase("inference"):
                         actions, all_usage = self._get_keyframe_solution(keyframes)
-
-            if not is_animated:
+                    self._animated_plan = (keyframes, keyframe_dir,
+                                           actions, all_usage)
+
+            if not is_animated and self._should_speculate(puzzle_source, text_mode):
+                # ASK AND WATCH AT THE SAME TIME. The JS twin carries the full
+                # note; in short, the burst is the only thing that can tell a
+                # cycling board from a still one AND is also the recording that
+                # answers it, so it runs while the screenshot is being read.
+                #
+                # A still board sees one picture, keeps its answer and drops the
+                # frames — identical behaviour and identical cost, because the
+                # recording happened inside a wait we were already making. A
+                # moving board's still answer is discarded UNREAD, because it
+                # describes a screen that has gone.
+                #
+                # THE MODEL CALL GOES TO A WORKER THREAD AND THE SCREENSHOTS DO
+                # NOT. Playwright's sync API is thread-affine, so every browser
+                # call stays on this thread; the planner's HTTP request touches
+                # no browser and is the only thing handed off. Exactly one model
+                # call is in flight at a time, so the shared planner sees no
+                # concurrency either.
                 if not have_shot:
-                    self._screenshot(element, shot,
-                                     timeout_ms=self.config.element_screenshot_timeout_ms)
+                    with self._phase("screenshot"):
+                        self._screenshot(
+                            element, shot,
+                            timeout_ms=self.config.element_screenshot_timeout_ms)
+                actions, all_usage, keyframe_dir = self._speculate(
+                    element, shot, puzzle_source, retry_mode, text_mode)
+                if keyframe_dir is not None:
+                    is_animated = True
+
+            elif not is_animated:
+                if not have_shot:
+                    with self._phase("screenshot"):
+                        self._screenshot(
+                            element, shot,
+                            timeout_ms=self.config.element_screenshot_timeout_ms)
                 with self._phase("inference"):
                     actions, all_usage = self._solve_frame_freshness_guarded(
                         element,
@@ -2456,8 +3212,17 @@ class PageSolver:
                         ),
                     )
 
+            # The box turns NORMALISED coordinates into page ones, so only an
+            # action that carries coordinates needs it. A "done" answer carries
+            # none — it means "nothing left to click" — and several vendors
+            # CLOSE the challenge the moment they accept it, so the widget is
+            # legitimately gone by the time that answer arrives. Demanding a box
+            # for it failed the solve at the moment it succeeded: measured
+            # 2026-09-07 on gt4.geetest.com, 22 of 22 live GeeTest attempts, each
+            # banked as the model being wrong. The JS port carries the identical
+            # rule (rule 1c) and `answer_needs_element_box` is its twin.
             element_box = element.bounding_box()
-            if not element_box:
+            if not element_box and answer_needs_element_box(actions):
                 raise CaptchaSolveError("could not get bounding box of captcha element")
 
             # Recorded at the moment of EXECUTION, which is what makes a repeat
@@ -2489,10 +3254,13 @@ class PageSolver:
                     await_kf = action.get("await_keyframe")
                     if bboxes:
                         for bbox in bboxes:
+                            one = {"target_bounding_box": bbox}
                             if await_kf:
-                                self._wait_for_keyframe(element, await_kf, _bbox_center(bbox))
-                            self._execute_click(page, {"target_bounding_box": bbox}, element_box)
-                            _delay(random.random() * 80 + 80)
+                                self._click_when_frame_matches(
+                                    page, element, one, element_box, await_kf)
+                            else:
+                                self._execute_click(page, one, element_box)
+                            self._human.pause("between")
                     else:
                         self._execute_click(page, action, element_box)
                     performed_action = True
@@ -2519,7 +3287,7 @@ class PageSolver:
                     performed_action = True
                     placed = True
                 elif kind == "type":
-                    if self._execute_type(page, scope, action):
+                    if self._execute_type(page, scope, action, element):
                         performed_action = True
                         typed = True
                 elif kind == "wait":
@@ -2554,11 +3322,16 @@ class PageSolver:
             # burning all ten solve loops on a puzzle they had answered on
             # the first one. The press itself is still bounded by
             # `should_submit` below, which is where the hazard belongs.
+            # RESOLVED, not travelled to. `_move_and_click` below moves to the
+            # button itself and picks its own random point inside it, so moving
+            # here first bought a second humanised trajectory that ended a few
+            # dozen pixels from where the first one stopped, plus a second
+            # bounded scroll-into-view. Two hops onto one button is slower AND
+            # is not something a hand does. A round that decides not to submit
+            # no longer walks to the control either.
             lookup = frame or (scope if not slid else None)
             if lookup is not None:
                 verify_button = self._get_verify_button(lookup)
-                if verify_button:
-                    self._move_to_element(page, verify_button)
 
             # Submit policy: press the widget's own submit control whenever we
             # have put an ANSWER into it — a selection, a placed piece, a typed
@@ -2586,7 +3359,7 @@ class PageSolver:
             # control at all, so `verify_button` is None and nothing is pressed
             # either way. What the exclusion actually bought was a whole extra
             # model call per puzzle, spent asking a board we had already answered
-            # correctly whether it was `done` — 6.2 s of prosopo_grid_3x3's 13.8 s,
+            # correctly whether it was `done` — 6.2 s of a Prosopo 3x3 grid's 13.8 s,
             # on a selection that scored 1.0 on the first call.
             answered = clicked or placed or typed
             should_submit = not slid and (answered or not performed_action)
@@ -2597,7 +3370,7 @@ class PageSolver:
                 # the caller aborts a round that reports none, so submitting a
                 # `done` answer and then returning False re-arms the very guard
                 # this satisfies — the puzzle is sent and the solve gives up on
-                # it one line later, which is what `prosopo_grid_3x3` did.
+                # it one line later, which is what a Prosopo 3x3 grid did.
                 performed_action = True
                 # Snapshot at submit time so the NEXT attempt waits for the real
                 # transition before treating whatever is on screen as fresh.
@@ -2606,7 +3379,11 @@ class PageSolver:
             _unlink(shot)
             # Only now: the wait gate re-reads the keyframe PNG on every poll, so
             # removing the directory any earlier would break the click it is gating.
-            if keyframe_dir:
+            # ...and not while the PLAN still holds them: the next round
+            # re-executes this same answer, and the gate reads these PNGs on
+            # every poll.
+            held = self._animated_plan[1] if self._animated_plan else None
+            if keyframe_dir and keyframe_dir != held:
                 shutil.rmtree(keyframe_dir, ignore_errors=True)
 
         return performed_action, all_usage
@@ -2648,8 +3425,7 @@ class PageSolver:
         cumulative_usage: List[Dict[str, Any]] = []
         self._last_submit_frame_hash = None
         self._deadline_ms = start + self.config.overall_solve_timeout_ms
-        self._viewport_cache = None
-        self._cursor_seeded = False
+        self._human.reset(page)
         self._reset_animated_state()
         self._budget = PhaseBudget()
 
@@ -2664,15 +3440,35 @@ class PageSolver:
         # would merge two separate captchas into one attempt — the opposite
         # error, and the one that under-bills.
         previous_session = os.environ.get(_SESSION_ENV)
-        os.environ[_SESSION_ENV] = str(uuid.uuid4())
+        session_id = str(uuid.uuid4())
+        os.environ[_SESSION_ENV] = session_id
+        # The verdict this driver reports back, and it starts FALSE. A solve
+        # that raises never sets it, which is the right default: the widget did
+        # not accept, and the boards that made it raise are exactly the ones
+        # worth keeping. See planner.report_outcome.
+        solved_for_report = False
         try:
-            return self._solve_impl(page, start, cumulative_usage)
+            result = self._solve_impl(page, start, cumulative_usage)
+            # Attached HERE rather than at each of the seven `return
+            # SolveResult(...)` sites, so a new early exit cannot forget it.
+            result.phases = dict(self._budget.totals)
+            result.phases["total"] = self._budget.elapsed_ms()
+            solved_for_report = bool(getattr(result, "is_solved", False))
+            return result
         finally:
             # Printed on the way out of every solve, success or failure — a
             # solve that FAILED is exactly the one whose time you want itemised.
             if timings_enabled() and self._budget is not None:
                 print(self._budget.report(), file=sys.stderr)
             self._deadline_ms = None
+            # BEFORE the env is restored, so the id reported is this solve's.
+            # Best-effort and never raised out of a `finally` — an exception
+            # here would replace the caller's real error, or their real result,
+            # with one about telemetry.
+            try:
+                self._solver.planner.report_outcome(session_id, solved_for_report)
+            except Exception as exc:  # noqa: BLE001
+                _log(f"[outcome] could not report: {exc}")
             if previous_session is None:
                 os.environ.pop(_SESSION_ENV, None)
             else:
@@ -2758,10 +3554,7 @@ class PageSolver:
                     )
                     _delay(800 + random.random() * 300)
                     continue
-                raise NoCaptchaFoundError(
-                    "no interactive captcha widget detected (likely reCAPTCHA v3 / "
-                    "invisible or a click-triggered challenge)"
-                )
+                raise NoCaptchaFoundError(self._no_widget_message(page))
 
             _log(f"--- captcha solve loop {attempt}/{cfg.max_solve_loops} ---")
             retry_mode_this_loop = pending_retry_mode
@@ -2873,62 +3666,80 @@ class PageSolver:
             render_waits = 0
             cumulative_usage.extend(usage)
 
-            if did_interact:
-                # Poll for the vendor's SOLVED signal before re-entering the
-                # pipeline. hCaptcha keeps the challenge visible for a couple of
-                # seconds while verifying; without this the loop re-solves that
-                # closing frame and burns ~18s. Only ever early-RETURNS on a
-                # definitive signal, so it cannot loop.
-                deadline = time.monotonic() * 1000.0 + cfg.post_solve_outcome_timeout_ms
-                solved = False
-                widget_gone = 0
-                _verdict_t0 = time.perf_counter()
-                while time.monotonic() * 1000.0 < deadline:
-                    if self.is_captcha_solved(page):
+            # ONE wait after a round, polled, whichever kind of round it was.
+            #
+            # There used to be two: this poll when the round interacted, and a
+            # flat `_delay(post_solve_delay_ms + jitter)` when it did not. The
+            # flat sleep observed NOTHING — it ran to the end and only then
+            # asked whether the widget was still there — so a round that had in
+            # fact finished the captcha paid 1200-1500ms to find that out. The
+            # poll below already asks exactly that question and answers it the
+            # moment it becomes true.
+            #
+            # The two windows keep different LENGTHS, because different things
+            # size them: `post_solve_outcome_timeout_ms` covers how late a
+            # vendor's success signal can arrive (measured — see the constant),
+            # while `post_solve_delay_ms` is the dwell a round that answered
+            # nothing takes before deciding the page has settled.
+            window_ms = (cfg.post_solve_outcome_timeout_ms if did_interact
+                         else cfg.post_solve_delay_ms + random.random() * 300)
+            # Poll for the vendor's SOLVED signal before re-entering the
+            # pipeline. hCaptcha keeps the challenge visible for a couple of
+            # seconds while verifying; without this the loop re-solves that
+            # closing frame and burns ~18s. Only ever early-RETURNS on a
+            # definitive signal, so it cannot loop.
+            deadline = time.monotonic() * 1000.0 + window_ms
+            solved = False
+            widget_gone = 0
+            _verdict_t0 = time.perf_counter()
+            while time.monotonic() * 1000.0 < deadline:
+                if self.is_captcha_solved(page):
+                    solved = True
+                    break
+                # The eight inline vendors have no response token, so
+                # `is_captcha_solved` — which reads only the hCaptcha and
+                # reCAPTCHA anchors — can never fire for them and this loop
+                # ran out its whole 2.5s budget on EVERY round, waiting for
+                # a signal that cannot arrive. Measured on a GeeTest v4 slider:
+                # 5.2s of a 12.3s solve, spent after the puzzle was already
+                # answered, with the widget sitting there visibly solved.
+                #
+                # "The widget is gone" is the completion signal for those
+                # vendors and is already the authority immediately after
+                # this loop, so this only reaches the same verdict sooner —
+                # confirmed over two polls so a frame caught mid-swap
+                # between rounds cannot read as a solve.
+                if self.detect_captcha(page) is None:
+                    widget_gone += 1
+                    if widget_gone >= 2:
                         solved = True
                         break
-                    # The eight inline vendors have no response token, so
-                    # `is_captcha_solved` — which reads only the hCaptcha and
-                    # reCAPTCHA anchors — can never fire for them and this loop
-                    # ran out its whole 2.5s budget on EVERY round, waiting for
-                    # a signal that cannot arrive. Measured on geetest_v4_slide:
-                    # 5.2s of a 12.3s solve, spent after the puzzle was already
-                    # answered, with the widget sitting there visibly solved.
-                    #
-                    # "The widget is gone" is the completion signal for those
-                    # vendors and is already the authority immediately after
-                    # this loop, so this only reaches the same verdict sooner —
-                    # confirmed over two polls so a frame caught mid-swap
-                    # between rounds cannot read as a solve.
-                    if self.detect_captcha(page) is None:
-                        widget_gone += 1
-                        if widget_gone >= 2:
-                            solved = True
-                            break
-                    else:
-                        widget_gone = 0
-                    if self._is_challenge_freshly_rendered(page):
-                        break  # next round is up; go solve it now
-                    _delay(cfg.post_solve_outcome_poll_ms)
-                _verdict_ms = (time.perf_counter() - _verdict_t0) * 1000.0
-                if self._budget is not None:
-                    self._budget.add("await-verdict", _verdict_ms)
-                # How long a SUCCESS actually took to show itself. This is the
-                # only number that can size `post_solve_outcome_timeout_ms`: the
-                # window exists to catch a late success, so it needs to cover
-                # the slowest real one and nothing beyond it. A round that ends
-                # any other way spends the whole window by construction — there
-                # is no signal on a wrong answer — so its duration says nothing
-                # about how long the window ought to be.
-                if solved:
-                    _log(f"[verdict] success signal arrived after {_verdict_ms:.0f}ms")
-                if solved:
-                    return SolveResult(True, self._last_mouse, _aggregate(cumulative_usage))
-            else:
-                with self._phase("post-submit-delay"):
-                    _delay(cfg.post_solve_delay_ms + random.random() * 300)
+                else:
+                    widget_gone = 0
+                if self._is_challenge_freshly_rendered(page):
+                    # A DIFFERENT puzzle, so the greedy answer has not been
+                    # tested against it and the escalation must not carry over.
+                    self._fresh_board()
+                    break  # next round is up; go solve it now
+                _delay(cfg.post_solve_outcome_poll_ms)
+            _verdict_ms = (time.perf_counter() - _verdict_t0) * 1000.0
+            if self._budget is not None:
+                self._budget.add(
+                    "await-verdict" if did_interact else "post-submit-delay",
+                    _verdict_ms)
+            # How long a SUCCESS actually took to show itself. This is the
+            # only number that can size `post_solve_outcome_timeout_ms`: the
+            # window exists to catch a late success, so it needs to cover
+            # the slowest real one and nothing beyond it. A round that ends
+            # any other way spends the whole window by construction — there
+            # is no signal on a wrong answer — so its duration says nothing
+            # about how long the window ought to be.
+            if solved:
+                _log(f"[verdict] success signal arrived after {_verdict_ms:.0f}ms")
+                return SolveResult(True, self._last_mouse, _aggregate(cumulative_usage))
 
-            if self._has_recaptcha_underselect_error(page):
+            _banner = self._recaptcha_banner_kind(page)
+            if self._banner_is_fatal_after_retry(_banner):
                 if already_retried_underselect:
                     raise CaptchaSolveError(
                         "reCAPTCHA still showing the under-selection error after retry; "