UI automation is necessary for accessibility

No, complicating. You don't need end-to-end wihtelisting. You don't need perfection: you just need to make working around the attestations more annoying than paying a human in some third-world country to do the same thing.

An attested, channel-bound input-delivery path exist in the context of an otherwise open OS. All I have to do as a client is present recent proof of human interaction performed locally. If that interaction comes from voice input and I send keystrokes, I can nevertheless staple the voice-produced proof of recent human interaction. Tons of ways to cryptographically frustrate replay attacks, proxying, and so on.

You've asserted a few times now that you can rate limit people or rate limit devices. You can do these things. There are other things you can do too, and if you insist that only your two options exist, you're going to lock us into a low-openness, low-privacy internet in which actions are linkable, because that's how you enforce rate limits.

Sure, you could create some kind of zcash-like interaction-token system to prevent double-"spending" network-request tokens without linking individual "transactions", but who's going to bootstrap it the system? Who gets to decide how many unlinkable request tokens each person gets per hour or day? How are they distributed?

Do I just buy interaction tokens at market price? How do I, a person, out-compete some scraping outfit with infinity venture capital? If I get some subsidy, what prevents my selling my tokens to scrapers?

There are answers to all these questions. It's a fascinating and emerging field. But now you're talking about a whole ecosystem someone has to bootstrap and maintain. So, in practice, once CAPTCHAs fail (as they have), and once PoW fails (as it has), then what's left is a "papers, please" internet of long-term linkable identities. I do not want this internet.

I'd rather use a damn mouse someone certified about not lying about rough input timestamps.