Distilled, timeless technique for driving the GWR claim form (delayrepay), grouped by area. Dated narratives — what happened in a specific session, which host, which bugs recurred — live in delayrepay/lessons/sessions instead; this note stays a reference, not a log. Ansible/infrastructure role bugs are tracked to closure in ansible/todo, not here.
The browser host / controller are 2-vCPU (t4g.large / kelp). Full-frame tesseract LSTM OCR on a 1920×1080 frame is 10–30s per call; PSM 6 is ~3.7s; the legacy engine (--oem 0) is not installed. That is far too slow to sit in a click loop, and it (not tesseract per se) is what lost an early manual run to the session timeout.
Below OCR sits a template-patch match. Cache a small patch of each control at its expected coordinate; at runtime matchTemplate it in a small window there.
Filling the MUI journey form is the single hardest UI interaction:
An image challenge gates the final Submit by design — a human must solve it. So 'minimum involvement' bottoms out at one Review approval plus one CAPTCHA solve per claim; everything else through Review is scriptable. Current automation status: delayrepay/toolkit (Current gaps).
Viewer connection, stunnel PKI, and which VNC client to use are documented in delayrepay/viewer-setup rather than duplicated here.
A few gotchas found while building this turned out not to be specific to GWR/VNC automation at all, so they now live where any project would find them, and are not repeated here: dual-uid SSH resolution, ssh-keyscan's banner line, the Ansible known_hosts module vs hashed files, --tags skipping untagged prerequisite plays, WebDAV MKCOL's one-level-at-a-time behaviour, and the Claude Code wildcard-permission fix are all in README/lessons. pkill's self-match hazard is in PROGRAMMING_RULES/shell-style. The IAM 'computer' vs 'computer2' profile distinction and awslaunch.py's security-group behaviour are in aws/workspace and aws/awslaunch.