5abe782bada3c851f1844c94b747cf7c769c71f9
max
  Fri Sep 4 09:12:46 2026 -0700
cart.c: gate the captcha session-id debug print behind hg.conf captchaDebug, refs #38247

Register captchaDebug in the hg.conf catalog as a permanent debugging
knob rather than a release gate.

diff --git src/hg/utils/hgConfCatalog/hgConfCatalog.py src/hg/utils/hgConfCatalog/hgConfCatalog.py
index 5956fbd2bda..3b4891ddf6b 100755
--- src/hg/utils/hgConfCatalog/hgConfCatalog.py
+++ src/hg/utils/hgConfCatalog/hgConfCatalog.py
@@ -1026,30 +1026,36 @@
         h("bottleneck.except", "internal", "hg/lib/botDelay.c",
           verified=True, family="bottleneck",
           note="IPs exempt from delay."),
         h("hguidIpTracking.maxIps", "limit", "hg/lib/botDelay.c",
           default='"10"', verified=True, family="hguidIpTracking"),
         h("hguidIpTracking.windowSeconds", "limit", "hg/lib/botDelay.c",
           default='"600"', verified=True, family="hguidIpTracking"),
         h("hguidIpTracking.table", "table", "hg/lib/botDelay.c",
           default='"hguidIpAccess"', verified=True, family="hguidIpTracking"),
         h("cloudFlareSiteKey", "credential", "hg/lib/cart.c",
           verified=True, required=True,
           note="Turnstile captcha site key.  Read with cfgVal, so a machine "
                "that enables the captcha path must set it."),
         h("cloudFlareSecretKey", "credential", "hg/lib/cart.c",
           verified=True, required=True),
+        h("captchaDebug", "flag", "hg/lib/cart.c", default="FALSE",
+          role="knob", verified=True,
+          note="Log the session id to stderr each time printCaptcha() shows "
+               "the captcha, as \"CAPTCHA_PRINT <hgsid>\".  A permanent "
+               "debugging aid for tracing why a given session is being "
+               "captcha-gated, not a feature being shipped dark."),
         h("noCaptchaAgent.", "internal", "hg/lib/botDelay.c",
           verified=True,
           note="A prefix family rather than one setting: every "
                "noCaptchaAgent.* value is a user-agent string exempt from the "
                "captcha.  Enumerated at runtime with cfgNamesWithPrefix()."),
     ],
 }
 
 
 # ---------------------------------------------------------------------------
 # logging and diagnostics
 # ---------------------------------------------------------------------------
 
 LOGGING = {
     "what": "Diagnostics.  Several of these are safe to leave on and a few "