v1.28.1

Fixes a false positive that blocked real visitors.

Fixed

A failed proof of work no longer floors the score.

v1.23.0 made the proof of work a precondition — correct — but also marked its failure dispositive, which floors the score at 0.9. That turned every benign cause of a PoW failure into a hard block on a real person:

• the challenge expires after five minutes, which a tab left open exceeds
• challenges live only in memory, so every server restart invalidates the outstanding ones
• a double-click replays a solution

An observed verdict had a weighted sum of 0.2324 — an entirely ordinary human — reported as 0.9, blocked.

The security requirement is carried by the gate, not the floor: a token is withheld whenever there is no valid proof of work, whatever the score. The floor added nothing to that and only mislabelled the visitor. It is removed from all three PoW failures; the gate is untouched.

Measured after, on all three servers:

human-shaped, challenge expired   0.155  allow   token withheld
bare curl, no PoW, no signals     0.600  block   token withheld
honest full handshake             0.044  allow   token ISSUED

A bare curl is still caught — on its own behavioural evidence rather than on the floor. The honest flow is unaffected.

Upgrade if you are running v1.23.0 or later. Any deployment that restarts, or any visitor who leaves a tab open for five minutes, is affected.