docs(log): 026 — the door was never locked

Captain's log for the SoundCloud uploader landing. Written for the documentary
rather than the board: the story beat is that I spent a session and a half
picking a window on `POST /tracks` — killing three hypotheses one at a time,
each death feeling like progress — while a real, logged-in, past-the-wall
browser sat open with the actual upload form in it.

Also records the two catches that were PLN's, not mine: the chip-input tags, and
the MUI Select whose Private option my four probes all reported as absent.

armada/tasks/026-the-door-was-never-locked.md

+# 026 — The door was never locked
+
+**Landed 2026-08-18.** SoundCloud uploads work. The first track this tooling has ever put
+on the account is `soundcloud.com/parvagues/ghosts-in-the-toilets` — 21 MB, stored
+`private`, verified by reading it back from the API rather than by trusting a banner.
+
+## What was actually built
+
+`master sc form-album` (tidal-ears `66bacc5`) — it fills SoundCloud's real upload form.
+Reads the same platform-neutral release plan the YouTube adapter reads, so the catalog
+does not fork per platform. Idempotent by permalink, so an interrupted album costs only
+the file it was in the middle of. `--go` is required to upload; the default prints what
+would happen.
+
+By the end of the session: **8 of 15 up, all private**, including the 790 MB continuous
+mix at 72:41.
+
+## The shareable bit
+
+I spent a session and a half trying to make `POST /tracks` work. It answered **400 with an
+empty error list** — no field named, no reason given — against two transports and every
+body shape I could think of. I killed three hypotheses one at a time: it wasn't TLS
+fingerprinting, it wasn't the JSON envelope, it wasn't the web session. Each death felt
+like progress.
+
+None of it mattered. SoundCloud renders a perfectly good upload form, in a browser we were
+already driving, already logged in, already past the DataDome wall. The whole premise of
+this transport was *"be a real browser, don't imitate one"* — and I had spent two days
+imitating one anyway, at the exact moment I had a real one open.
+
+The door was never locked. I was picking a window.
+
+## Three DOM facts, each of which cost a session
+
+**The form is in a nested iframe.** `/n/upload?…&v2_layout=true`, inside a `webiIframe`.
+`page.locator('input[type=file]').count()` returns **zero** on a perfectly healthy session.
+So does a JS walk of `document`, because `querySelectorAll` does not cross into
+`contentDocument`. I read that zero as "the form does not render", built a consent-dialog
+hypothesis on top of an unrelated analytics ping, and wrote a whole consent-handling module
+to solve a problem that did not exist. (The module is good and PLN wanted it anyway. That
+is luck, not vindication.)
+
+**Sharing is a MUI Select.** I swept every `input[type=radio]`, `input[type=checkbox]` and
+`select` in the frame, grepped its text for "private", found the geo group
+(`worldwide`/`exclusiveRegions`/`blockedRegions`) and the licensing group
+(`all-rights-reserved`/`commons`), and reported to PLN that **the new uploader is
+public-only** — and started planning an upload-public-then-flip-private workaround for
+material whose sample rights are not cleared.
+
+PLN said *"thrr is a private fo sure let me point tot you"* and pasted the markup:
+
+```html
+<li role="option" aria-label="Private" data-value="Private" class="MuiMenuItem-root …">
+```
+
+A MUI Select's options are **portal-rendered only after the trigger is clicked**. An
+unmounted menu and an absent feature are *identical* to a DOM sweep. One pasted `<li>`
+settled what four probes could not, and it drove first try: Public → Private, verified by
+reading the trigger back.
+
+**Tags are a chip input.** PLN caught this watching the first real upload happen:
+*"tags error filled as one tag with spaces, needs press enter aftger each"*. Typing the
+list produced one tag containing commas — `'"livecoding, festival, opal, …"'` — which is a
+sentence, not tags.
+
+## The verification was wrong in two directions at once
+
+`GET /me/tracks` **404s** on api-v2. So the success check polled for an hour and would have
+reported a timeout on a track that had uploaded perfectly. And the endpoint that *does*
+work omits private tracks unless you pass `access=playable,preview,blocked` — so every
+private upload would have looked like a failure for a second, independent reason.
+
+Two ways to be wrong about the same success. The fix reports the sharing SoundCloud
+actually **stored**, not the one requested: a private release that silently went public is
+the one outcome a re-run cannot undo. And it now checks **duration** too — because
+`/take-five-drops` went up 24 seconds short while every other track matched to the second.
+Existence is not integrity.
+
+## What it cost, and the rule that comes out of it
+
+Three confident wrong conclusions in one session — *the form doesn't render*, *headless
+can't reach the GPU*, *the uploader is public-only* — and all three were the same failure:
+**a blind instrument reports absence with exactly the same confidence as a real absence.**
+Each one spawned real work to route around a restriction that did not exist.
+
+So: before reporting that something is missing, answer *could this search have found it if
+it were there?* Enumerate frames. Open the collapsed thing. Exhaust the option space
+instead of stopping at the first success. Ask the system what it resolved to rather than
+inferring it from a downstream number.
+
+And when the person who uses the tool every day offers to look — take the offer.
+
+**Deps:** unblocks A6 (the www gig page's empty `audio`/`video`/`archive`) and the
+Bandcamp/RouteNote adapters, which reuse this exact form-driving pattern. Blocked on
+nothing. Rights (A4) still gate anything going *public*.