Downlink v0.5.0: the steps stop lying
A fan wrote on SoundCloud, six days after following, liking and reposting the track: "Press download, this download is still locked". They had done nothing wrong: the page showed every step as done, the server said no, and nothing on the page could settle it.
The steps follow what the server still knows
Two memories shared the work. The browser kept the ticked checklist, forever. The server kept a signed cookie, the only thing that actually opens the file, and that one lasts a day. When the cookie expired the checklist stayed ticked: the download button lit up for a file the gate was about to refuse, and since every step read as done, there was no control left to redo them. A dead end, on a loop.
The page now asks the server what it still recognises, before it even paints. Whatever the cookie no longer covers goes back to to do and the SoundCloud button returns, one tap away. Steps taken on trust, Instagram and TikTok, rest on no cookie at all: they stay ticked.

The locked page says how long an unlock lasts
"Go through the steps on the track page" helps nobody when the page is showing that the steps have been gone through. It now says an unlock lasts a day, which explains why a link that worked yesterday asks for the gesture again today.

The "How it works" page says it too, where it describes the signed cookie.