feat(诊断): 用真机复现解出 1ms 成功会话的 collect 明文 —— 归因改写为「cd 槽位序按会话随机」

结论 (已知 #29~#32, 推翻旧 #25/#27 与"collect 逐字节同构"这条否定实验):
  * 同一个 tdc.js URL 每次请求返回不同构建 (4/4 md5 + XTEA 密钥全不同)
  * 同会话同时抓 tdc.js + verify -> 解密出真机 collect 明文 (784B/38 槽, 可打印率 .991)
  * 5 份同日样本 (真机 cap2 / 签到成功-1 / 点选 / login_checkin / 仓库模板) 全部 38 槽、
    同一批取值、同一个 sd, 但槽位序 5/5 互不相同
  * 仓库在用的模板槽位序 == 签到成功-1 那一次; generate_collect_success() 只回填
    轨迹/时间戳/entry_url, 槽位序仍是那一次的

=> 头号可证伪假设 H-LAYOUT: 服务端按"本次会话构建"的槽位表解释 cd, 用别的会话的槽位序
   会被读成自相矛盾的环境 -> 12 (答案错理应是 50/9)。这也解释了为何换 IP / 换遥测后端 /
   换传输指纹 / 换 cookie / 长静默全都无效 —— 它们都不动槽位序。

新增:
  * scripts/analyze_collect_layout.py —— collect 槽位序对比 (复现 #31)
  * tcaptcha/slider_solver.py + test —— 滑块缺口求解 (ZNCC, 真机首轮命中 ret=0)
  * tcaptcha/icon_click_solver.py + test —— 图文点选形状模板求解
  * scripts/bridge_1ms_captcha.py —— 真机桥接三模式 (slider/icon/text) + --probe 题型侦察
  * tools/cdp_eval.js / cdp_click.js / cdp_shot.js / cdp_net_capture.js / cdp_capture.js
  * selftest 纳入 icon_click / slider 两个套件

账本: §一 修正 #25/#27、新增 #29~#32; §三 标注"collect 逐字节同构"否定实验有缺陷;
      §五 重写 12 的归因与下一步 (决定性实验 A + 取槽位表两条路)

tcaptcha/tests/test_icon_click_solver.py

@@ -0,0 +1,73 @@
+# -*- coding: utf-8 -*-
+"""
+图标/图文点选求解器 回归测试 (AGENTS.md §5.9)
+
+固化的性质:
+  1. 提示条(目标原图) -> 背景图 的**形状模板匹配**在真机样本上给出正确、有序的点击点;
+  2. 能处理**旋转**目标 (样本里"图表"图标被倾斜 ~-30°);
+  3. 能排除干扰图标 (样本里的笑脸/银行).
+
+样本: tcaptcha/tests/fixtures/1ms_icon_click_1_{prompt,bg}.jpg
+      取自 1ms.run (aid=195672344) 真机页面上弹出的验证码 (2026-10-11),
+      题面 = "0" + 图表图标 + "7", 期望点击顺序与坐标见 EXPECTED。
+
+运行:
+    .venv/bin/python -m tcaptcha.tests.test_icon_click_solver
+"""
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import cv2
+
+ROOT = Path(__file__).resolve().parents[2]
+if str(ROOT) not in sys.path:
+    sys.path.insert(0, str(ROOT))
+
+from tcaptcha.icon_click_solver import IconClickSolver  # noqa: E402
+
+FIX = ROOT / "tcaptcha" / "tests" / "fixtures"
+# 期望点击顺序: ("0" 右下) -> (倾斜的图表图标 左上) -> ("7" 中上)，坐标是 672x480 原图口径
+EXPECTED = [(520, 440), (200, 40), (360, 120)]
+TOL = 12          # 允许的像素误差 (连通域中心 vs 目视中心)
+
+_fails: list = []
+
+
+def check(name: str, cond: bool, detail: str = "") -> None:
+    print(f"  [{'PASS' if cond else 'FAIL'}] {name}" + (f"  {detail}" if detail else ""))
+    if not cond:
+        _fails.append(name)
+
+
+def main() -> int:
+    pr = cv2.imread(str(FIX / "1ms_icon_click_1_prompt.jpg"))
+    bg = cv2.imread(str(FIX / "1ms_icon_click_1_bg.jpg"))
+    check("fixture 可读", pr is not None and bg is not None)
+
+    print("1) 求解")
+    res = IconClickSolver().solve(bg, pr)
+    check("目标数=3", res.target_count == 3, str(res.target_count))
+    check("求解成功", res.ok, res.describe())
+
+    print("2) 点击顺序与坐标")
+    for i, (exp, got) in enumerate(zip(EXPECTED, res.points)):
+        dx, dy = abs(exp[0] - got[0]), abs(exp[1] - got[1])
+        check(f"第{i+1}个点 ~{exp}", dx <= TOL and dy <= TOL,
+              f"got={got} (Δ={dx},{dy}) score={res.scores[i]:.3f}")
+
+    print("3) 旋转与干扰项")
+    check("命中倾斜图标 (角度非 0)", any(abs(a) >= 10 for a in res.angles), str(res.angles))
+    check("所有匹配分数 > 0.45", res.min_score > 0.45, f"min={res.min_score:.3f}")
+
+    print()
+    if _fails:
+        print(f"❌ test_icon_click_solver 失败 {len(_fails)} 项: {_fails}")
+        return 1
+    print("✅ test_icon_click_solver 全部通过")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

tcaptcha/tests/test_slider_solver.py

@@ -0,0 +1,115 @@
+# -*- coding: utf-8 -*-
+"""
+滑块拼图求解器 回归测试 (AGENTS.md §5.9)
+
+固化的性质 (样本取自 1ms.run aid=195672344 真机页面 2026-10-11 的滑块验证码):
+  1. `sprite_region` 能把 CSS 的 background-position/size 正确换算成精灵图像素区域;
+  2. ZNCC 峰值落在**真缺口**上, 而不是干扰缺口, 也不是拼图块当前位置;
+  3. 通过 y 方向小抖动吸收取整误差, 结果稳定;
+  4. `ok` 的判定 (分数 + 与次峰间距) 在该样本上成立。
+
+样本: tcaptcha/tests/fixtures/1ms_slider_1_{bg.jpg,sprite.png}
+      bg     = 页面 `img_index=1` 的背景图 (672x390, 含真缺口 + 干扰缺口)
+      sprite = 页面 `img_index=0` 的精灵图 (682x620, 含拖动柄 + 拼图块)
+
+DOM 实测口径 (drag_ele.html iframe 内):
+      slideBg       rect=(10, 68.78)  显示 340 x 242.857  -> scale = 340/672 = 0.50595238
+      拼图块元素     rect=(35.2976, 133.53)  显示 60.7143 x 60.7143
+                    background-position: -70.8333px -247.917px
+                    background-size:     345.06px 313.69px
+      => 拼图块裁剪图在背景图坐标系里的左上角 = (50.0, 127.97)
+
+运行:
+    .venv/bin/python -m tcaptcha.tests.test_slider_solver
+"""
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import cv2
+
+ROOT = Path(__file__).resolve().parents[2]
+if str(ROOT) not in sys.path:
+    sys.path.insert(0, str(ROOT))
+
+from tcaptcha.slider_solver import SliderSolver, piece_mask, sprite_region  # noqa: E402
+
+FIX = ROOT / "tcaptcha" / "tests" / "fixtures"
+
+# 真机 DOM 口径
+BG_POS = (-70.8333, -247.917)
+BG_SIZE = (345.06, 313.69)
+ELEM_SIZE = (60.7143, 60.7143)
+SLIDE_W = 340.0
+BG_NATURAL_W = 672.0
+SCALE = SLIDE_W / BG_NATURAL_W          # 0.50595238
+PIECE_X_IMAGE = 50.0
+PIECE_Y_IMAGE = 128.0
+
+EXPECTED_DX_IMAGE = 293.0               # 真缺口 x - 拼图块 x
+EXPECTED_DECOY_X = 489                  # 干扰缺口在背景图坐标里的 x
+
+_fails: list = []
+
+
+def check(name: str, cond: bool, detail: str = "") -> None:
+    print(f"  [{'PASS' if cond else 'FAIL'}] {name}" + (f"  {detail}" if detail else ""))
+    if not cond:
+        _fails.append(name)
+
+
+def main() -> int:
+    bg = cv2.imread(str(FIX / "1ms_slider_1_bg.jpg"))
+    sprite = cv2.imread(str(FIX / "1ms_slider_1_sprite.png"), cv2.IMREAD_UNCHANGED)
+    if bg is None or sprite is None:
+        print("缺少 fixture, 请确认 tcaptcha/tests/fixtures/1ms_slider_1_* 存在")
+        return 1
+    print(f"bg={bg.shape} sprite={sprite.shape}")
+
+    print("\n[1] 精灵图区域换算")
+    x, y, w, h = sprite_region(BG_POS, BG_SIZE, ELEM_SIZE, sprite.shape[:2])
+    check("sprite_region == (140, 490, 120, 120)", (x, y, w, h) == (140, 490, 120, 120), f"got={(x, y, w, h)}")
+
+    crop = sprite[y:y + h, x:x + w]
+    mask = piece_mask(crop)
+    check("拼图块掩膜非空且不过分满", 500 < int(mask.sum()) < w * h * 0.9,
+          f"mask={int(mask.sum())}/{w * h}")
+
+    print("\n[2] 缺口定位 (ZNCC)")
+    res = SliderSolver().solve(bg, crop, piece_x_image=PIECE_X_IMAGE, scale=SCALE,
+                               piece_y_image=PIECE_Y_IMAGE)
+    print(f"      {res.describe()}")
+    check("ok", res.ok)
+    check("分数 >= 0.65", res.score >= 0.65, f"score={res.score:.3f}")
+    check("与次峰间距 >= 0.15", res.margin >= 0.15, f"margin={res.margin:.3f}")
+    check("落在真缺口 (误差 <= 4 背景像素)", abs(res.target_x_image - (PIECE_X_IMAGE + EXPECTED_DX_IMAGE)) <= 4,
+          f"target_x={res.target_x_image}")
+
+    print("\n[3] 干扰缺口没有被选中")
+    decoy = [x0 for x0, _ in res.candidates if abs(x0 - EXPECTED_DECOY_X) <= 6]
+    check("次峰就是干扰缺口", bool(decoy), f"candidates={res.candidates}")
+    check("真缺口分数严格高于干扰缺口", res.score > res.runner_up + 0.1,
+          f"{res.score:.3f} vs {res.runner_up:.3f}")
+
+    print("\n[4] 显示坐标换算")
+    check("dx_display == dx_image * scale",
+          abs(res.dx_display - res.dx_image * SCALE) < 1e-6,
+          f"{res.dx_display:.2f} == {res.dx_image:.2f} * {SCALE:.6f}")
+    check("dx_display 落在 [140, 160]", 140 <= res.dx_display <= 160, f"{res.dx_display:.2f}")
+
+    print("\n[5] 拼图块当前位置不是答案 (那里没有洞)")
+    near_piece = [s for x0, s in res.candidates if abs(x0 - PIECE_X_IMAGE) <= 8]
+    check("拼图块自身位置的分数很低", all(s < 0.3 for s in near_piece),
+          f"{near_piece}")
+
+    print(f"\n{'=' * 62}")
+    if _fails:
+        print(f"❌ slider_solver 测试失败: {_fails}")
+        return 1
+    print("✅ slider_solver 测试全部通过")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())