Writing for a cold reader, because the valuable part of this session is the
DEAD hypotheses and those live only in context.

POST /tracks -> 400 {"errors":[]} has now survived three explanations and each
one cost a real experiment: it is not fingerprinting (identical from curl_cffi
and from the page's own fetch), not the envelope ({"track":{…}} is the only
shape that parses at all — flat, track[…] form and asset_data are rejected with
"Failed to parse track create request"), and not the missing web session
(retested after PLN logged in for real; session_ok() True, still 400). Anyone
resuming would try those three first, so the board says not to.

The one lead left is the consent dialog covering the upload form — session_ok()
is True while input[type=file] count is 0 — so probe_upload_ui.py moves out of
the scratchpad and into the repo. It attaches a 1s probe to the REAL form and
logs every non-GET api-v2 request, which is how we stop reconstructing a shape
from publish.py's older API and start copying one that demonstrably works.

Also recorded: the multi-platform architecture PLN asked for (one manifest, many
adapters, one state file), with the research behind it — Bandcamp has no upload
API or CLI at all, RouteNote has no open API but ships a desktop tool, YouTube
has a real one and gets chapters free from segments_v4. And the gig-list audit:
38 gigs published, 2026 has four, opal-festival-2026.md still has empty
audio/video/archive fields waiting on the upload.