[forgetso]

What changed
When someone asks the provider for an image challenge, it now checks "does this site key serve image captchas?" before "does the dataset you named exist?". #3409 (in 3.9.1) put the dataset check first.

Effect

• The answer people get: a site key that serves PoW, puzzle or frictionless now gets INCORRECT_CAPTCHA_TYPE again, whatever datasetId it sends. Since 3.9.1 it got "Unknown dataset" (INVALID_REQUEST:PROV-94).
• Why it matters: the demo monitor relies on that answer to work out which captcha type each demo key serves. Since the 3.9.1 deploy (2026-10-23 11:24 UTC) it has reported every demo as broken. The demos themselves are fine; real visitors have completed PoW, puzzle and image challenges throughout.
• Image keys are unaffected: a key that does serve image still gets the same 400 for an unknown dataset.

Tests

• New test in imageChallengeClientDatasetId.unit.test.ts: a wrong-type key that sends an unknown datasetId gets INCORRECT_CAPTCHA_TYPE, and the dataset is never looked up. It fails without this change.
• Existing tests: the six dataset tests still pass (7/7). Their stubs gained imgCaptchaManager, because the handler now gets to the type check before the dataset check.

🤖 Generated with Claude Code