This needs Design and PM input on what to do. This is because:

• We cannot just execute hCaptcha automatically, because as described in T406335: hCaptcha VisualEditor plugin: Display hCaptcha before first "Save changes" button press if possible we may only know that hCaptcha is needed after the user presses "Save changes" once. Therefore, we need some kind of UI flow to indicate to the user that hCaptcha needs to be completed and that this requires pressing "Save changes" again

To clarify the above:

• We currently handle all captchas in VisualEditor by attempting to make the edit and then if this fails showing a captcha
  • We will fix that through T406335: hCaptcha VisualEditor plugin: Display hCaptcha before first "Save changes" button press if possible, however, as described there we still need the existing handling for when we don't know a captcha is needed until the edit is actually being made
• The AbuseFilter extension (or any other code) could force the showing of a captcha to the user depending on the content of the edit
  • In this case, we will only know if a captcha is needed once the user has pressed "Save changes" at least once because they need to submit the edit first

This means that:

• In the case of "normal" hCaptcha, this will cause a checkbox to appear that makes it clear what the user needs to do
  • The user can press the checkbox, which will become ticked when the captcha has passed, and then can press "Save changes" again based on context clues
• When in invisible mode, this will mean that only the hCaptcha privacy policy text could be shown to the user
  • This text doesn't make it clear that the user needs to re-attempt their submission. Additionally, any text is likely to not be that visible to the user (because text isn't some kind of input they can use to perform an action)
  • Therefore, a user will have to guess that they need to press "Save changes".
    • We could solve this by adding something like "Press 'Save changes' again to complete your edit", but as I mentioned above, I don't know if this will be clear enough to a user who is making an edit

Therefore, we need some kind of Design review to know what to show in this situation. Do we show one or some of:

• Some kind of textual notice to resubmit the form
• Show some kind of custom input that does the same as the hCaptcha widget (we may be unable to make the hCaptcha widget itself visible due to our use of secure enclave mode)

We'll likely use FancyCaptcha in T405595.