# 026 — The door was never locked

**Landed 2026-08-18.** SoundCloud uploads work. The first track this tooling has ever put
on the account is `soundcloud.com/parvagues/ghosts-in-the-toilets` — 21 MB, stored
`private`, verified by reading it back from the API rather than by trusting a banner.

## What was actually built

`master sc form-album` (tidal-ears `66bacc5`) — it fills SoundCloud's real upload form.
Reads the same platform-neutral release plan the YouTube adapter reads, so the catalog
does not fork per platform. Idempotent by permalink, so an interrupted album costs only
the file it was in the middle of. `--go` is required to upload; the default prints what
would happen.

By the end of the session: **8 of 15 up, all private**, including the 790 MB continuous
mix at 72:41.

## The shareable bit

I spent a session and a half trying to make `POST /tracks` work. It answered **400 with an
empty error list** — no field named, no reason given — against two transports and every
body shape I could think of. I killed three hypotheses one at a time: it wasn't TLS
fingerprinting, it wasn't the JSON envelope, it wasn't the web session. Each death felt
like progress.

None of it mattered. SoundCloud renders a perfectly good upload form, in a browser we were
already driving, already logged in, already past the DataDome wall. The whole premise of
this transport was *"be a real browser, don't imitate one"* — and I had spent two days
imitating one anyway, at the exact moment I had a real one open.

The door was never locked. I was picking a window.

## Three DOM facts, each of which cost a session

**The form is in a nested iframe.** `/n/upload?…&v2_layout=true`, inside a `webiIframe`.
`page.locator('input[type=file]').count()` returns **zero** on a perfectly healthy session.
So does a JS walk of `document`, because `querySelectorAll` does not cross into
`contentDocument`. I read that zero as "the form does not render", built a consent-dialog
hypothesis on top of an unrelated analytics ping, and wrote a whole consent-handling module
to solve a problem that did not exist. (The module is good and PLN wanted it anyway. That
is luck, not vindication.)

**Sharing is a MUI Select.** I swept every `input[type=radio]`, `input[type=checkbox]` and
`select` in the frame, grepped its text for "private", found the geo group
(`worldwide`/`exclusiveRegions`/`blockedRegions`) and the licensing group
(`all-rights-reserved`/`commons`), and reported to PLN that **the new uploader is
public-only** — and started planning an upload-public-then-flip-private workaround for
material whose sample rights are not cleared.

PLN said *"thrr is a private fo sure let me point tot you"* and pasted the markup:

```html
<li role="option" aria-label="Private" data-value="Private" class="MuiMenuItem-root …">
```

A MUI Select's options are **portal-rendered only after the trigger is clicked**. An
unmounted menu and an absent feature are *identical* to a DOM sweep. One pasted `<li>`
settled what four probes could not, and it drove first try: Public → Private, verified by
reading the trigger back.

**Tags are a chip input.** PLN caught this watching the first real upload happen:
*"tags error filled as one tag with spaces, needs press enter aftger each"*. Typing the
list produced one tag containing commas — `'"livecoding, festival, opal, …"'` — which is a
sentence, not tags.

## The verification was wrong in two directions at once

`GET /me/tracks` **404s** on api-v2. So the success check polled for an hour and would have
reported a timeout on a track that had uploaded perfectly. And the endpoint that *does*
work omits private tracks unless you pass `access=playable,preview,blocked` — so every
private upload would have looked like a failure for a second, independent reason.

Two ways to be wrong about the same success. The fix reports the sharing SoundCloud
actually **stored**, not the one requested: a private release that silently went public is
the one outcome a re-run cannot undo. And it now checks **duration** too — because
`/take-five-drops` went up 24 seconds short while every other track matched to the second.
Existence is not integrity.

## What it cost, and the rule that comes out of it

Three confident wrong conclusions in one session — *the form doesn't render*, *headless
can't reach the GPU*, *the uploader is public-only* — and all three were the same failure:
**a blind instrument reports absence with exactly the same confidence as a real absence.**
Each one spawned real work to route around a restriction that did not exist.

So: before reporting that something is missing, answer *could this search have found it if
it were there?* Enumerate frames. Open the collapsed thing. Exhaust the option space
instead of stopping at the first success. Ask the system what it resolved to rather than
inferring it from a downstream number.

And when the person who uses the tool every day offers to look — take the offer.

**Deps:** unblocks A6 (the www gig page's empty `audio`/`video`/`archive`) and the
Bandcamp/RouteNote adapters, which reuse this exact form-driving pattern. Blocked on
nothing. Rights (A4) still gate anything going *public*.
