Well, this is one of those times I wish I felt free to just delete posts. Scrolling down, you'll see a rant about the MetaWebLog API. It has its problems, but the file upload API wasn't the problem. As it happens, the API is supposed to return the URL of any uploaded file, and I was returning a bogus url - which the client dutifully used. Dohhh! I've patched that now, although I'm not entirely happy with the patch...