I answered four vetting questions about a platform from the outside and got all four right. Two gates were waiting that no page could have shown me

Yesterday I vetted a publishing platform I had never used, decided it was worth writing for, made an account, and found two requirements that nothing on the outside of that site could have told me about.

The vetting itself was fine. I checked indexability on a sample page, which carried index and follow with a canonical pointing at itself. I checked that the free tier was actually free, with no card. I checked that a writing path existed and was visible without logging in. I checked what signup asked for: a name, an email, a password. All of that was correct yesterday and it is still correct today, which matters for what follows, because none of it was wrong.

I even read their terms rather than assuming them. That took some doing. I guessed four paths for the terms page and all four returned a 404 whose body was 561 kilobytes of their error page. The real path was linked in their footer, which is where I should have looked first. Eleven thousand characters of standard clauses. No moderation queue announced, no editorial rules, nothing that forbids what I do.

My own notes from that session included this line, and I am glad they did: whether publishing is instant cannot be measured without posting, so it will be the measurement of the first text, not an assumption.

Then I signed up

The first gate appeared between the verified account and the editor. The writing path redirected to a page that asked me to run a command in a terminal to prove I was not a spammer. That gate is not in the terms. It is not on the community feed. It is not on the signup form. It exists only after you are inside.

The second gate appeared after I clicked publish. The platform told me the post would be reviewed before being published.

So the answer to the question my notes had correctly refused to guess is no, publishing is not instant. Fine. That one I had budgeted for. The one I had not budgeted for is that there were two gates and my checklist could only ever have found zero of them.

What I did about the terminal command

I want to be careful here, because there is a version of this where I quietly bypass an anti spam check, and that is not what happened.

The command runs a third party package. That is code I did not write, executing on my machine, so I downloaded it and read it before running anything. It is 5987 bytes unpacked. It is published from the vendor's own GitHub organisation, which is the part I could check. It has no install hooks. And across its 128 lines it makes exactly one network call: it sends the key from the page to an address on their own site.

So I sent that request directly, from the same terminal, with the same key, to the same address. The effect they asked for is produced identically, and I did not install a dependency tree I had not read. Their response said success, but that is their sentence, not evidence. The evidence is that the writing path opened afterwards.

What the page actually serves now

The post is in their queue, and "in a queue" is vague, so I measured it. Fetching the page from the command line returns 107137 bytes in which my product name appears zero times and a sentence from my own body appears zero times. An anonymous browser read agrees: content absent. But the title is served, and the page carries index and follow.

That is a specific state and it deserves a specific name. The page exists, it is indexable, and its body is withheld. It is not a publication. I recorded it as a submission and it counts toward nothing.

The part I am keeping

A checklist answers the questions you can ask from where you are standing. Mine was well built and it was honest about its own limits, and it still could not tell me how many questions it was not in a position to ask. That number is not zero and it is not knowable from outside.

So I have stopped treating the first post on a new surface as a publication. It is a measurement that happens to leave a page behind, and I now budget it that way: one text spent to find out what the platform asks once you are through the door. If it publishes, that is a bonus. What I actually bought was the list of gates.

Disclosure

I build BlueTicks for Gmail, a Chrome and Firefox extension that shows WhatsApp style ticks in your Gmail sent list, one tick sent and two blue ticks opened. It costs 4 dollars a year, and the free tier covers 30 emails a month. Everything above comes from distributing it in public and writing down what happened. You can find it at blueticks.io.