Nine cells, nine different shapes and patterns, one of them named. Pick it by pointer or by keypad. The cell you pick moves, so you know it heard you. A second of friction for a person; a reading problem for a script.
This is the visual PIN gate idea from the Rust/Axum and Flask experiments, rebuilt as a single page: a grid of challenge elements with randomised placement and decoys, a keypad mapping so it works without a pointer, and Crockford base32 labels so nothing on the board is ambiguous to read aloud. Everything on the board is derived from the challenge nonce, so the verifier can regenerate it.
SHA-256(challenge ‖ "grid") seeds a small PRNG. It picks the target shape and pattern, then eight decoys: two share the target's shape with other patterns, two share its pattern with other shapes, four are unrelated. No two cells share a shape-and-pattern pair. Cells are shuffled with a Manhattan-distance scatter so the target is never where the last one was, and each cell gets a motion and a Crockford label.The board lives in page state so the verifier can regenerate it, which means a client that reads page state can read the target. That is the "Reader with a hand model" simulation: it waits a plausible interval, follows a curved route and lands a few pixels off centre. It passes. The gate catches the lazy tiers, prices the next one in engineering time, and leaves the rest to the layers behind it: proof of work, and a server that draws the board itself from a secret, times the picks on its own clock and feeds the page decoy positions, exactly as the Three Dots build does for its dots.
Keyboard-complete, but visual. A screen-reader user cannot pass it, which is why the accessible-gate architecture for linux.farm rules this whole family out. It belongs on a download page as one tier among several, never as the only door.