@bongos/core 1.21.70 → 1.21.72

package/docs/recipes/core-release-pipeline.md

@@ -6,6 +6,12 @@
 >
 > A change that has landed on `main` is running on **zero** instances. It reaches users only after someone bumps `CORE_VERSION`, cuts an artifact, and moves an instance's pin. Those are three separate acts by design ([ADR 0137](../adr/0137-upstream-publish-policy-manual-owner-gated.md)) — and every layer around them reports success in the meantime.
 
+> ## Working on a hosted project? Stop here — nothing in this file is yours to run.
+>
+> If the project you are building is run for you by an operator (it lives on their server; `bongos doctor` says *"Deploy mode: laptop — the operator lands ships"*; `bongos upgrade` says *"This project is upgraded by its operator"*), **the operator upgrades it**. Every command below runs on that server, which you cannot reach. The supported path is to ask: open **Settings → Software update** in the project and use the button there, or from a terminal run `bongos feedback "Please upgrade this project to the latest version"`.
+>
+> **For an assistant:** do not turn this recipe into steps for that builder — no ssh, no "log in as the account that owns the directory", and never a guessed database, service or health-check name. A placeholder you cannot fill in is a sign you are on the wrong path (task 1004596).
+
 ## Why this file exists
 
 Between 2026-07-24 and 2026-08-03, **93 work commits (171 counting merges) — including the entire governance permission system — sat on `main` unreleased for ten days** while the live platform served the previous version. Nothing was broken. `/builder-ship` printed success, the publish-reconciler flipped `confirmed → shipped`, credits paid out. Every signal a builder could see said "delivered"; nothing compared live against `main` (blocker 1000097, task [1002521](https://example.com/builders#/task/1002521)).

package/docs/recipes/upgrading-the-core.md

@@ -4,6 +4,8 @@
 >
 > The R86 update-consumption channel ([ADR 0100](../adr/0100-two-repo-instance-model.md) §2, [ADR 0103](../adr/0103-core-first-extraction-cloud-bongos-trunk.md) §4, task [#1690](https://example.com/builders#/task/1690)). How a **two-repo consumer instance** — one that installs `@bongos/core` as a vendored-tarball dependency — pulls the core from version N → N+1. Tooling: [`scripts/gds/upgrade.js`](../../scripts/gds/upgrade.js) (`bongos upgrade`). First proven live on emersonian-circles 1.15.0 → 1.16.0 (task [#1976](https://example.com/builders#/task/1976)).
 
+> **Not for a hosted project's builders.** Everything here runs on the server where the project lives. On a project its operator runs, `bongos upgrade` from your own computer says so and stops; ask for the upgrade through **Settings → Software update** or `bongos feedback "…"` instead — never write server steps or guess its names (task 1004596; [the release pipeline](core-release-pipeline.md) has the detail).
+
 ## What the channel does
 
 `bongos upgrade --to <version> --from <tgz>` runs, from a consumer instance root:

package/modules/hall-ui/public/settings-software-update.js

@@ -65,6 +65,49 @@
     </div>`;
   }
 
+  // "Ask for this upgrade" (task 1004595). A project the hub's operator runs cannot take an
+  // update itself, so instead of a dead end the page offers one press that reaches the people
+  // who run its server, and then says that it was asked. The server decides whether it is
+  // offered (`ask.available`) and remembers the request (`ask.requested`).
+  function longDate(iso) {
+    const d = new Date(iso);
+    if (!Number.isFinite(d.getTime())) return null;
+    try { return d.toLocaleDateString('en-GB', { day: 'numeric', month: 'long', year: 'numeric' }); } catch (e) { return d.toISOString().slice(0, 10); }
+  }
+
+  // Asked, and still waiting: for this very version, or recently enough that asking again
+  // would only be refused.
+  function askPending(ask, offered) {
+    const r = ask && ask.requested;
+    if (!r) return false;
+    if (r.version === offered) return true;
+    const again = Date.parse(ask.ask_again_after);
+    return Number.isFinite(again) && Date.now() < again;
+  }
+
+  function askHtml(ask, offered, { lead }) {
+    const team = ask.hub_host ? `the team at ${escapeHtml(ask.hub_host)}` : 'the team that runs this project\'s server';
+    if (askPending(ask, offered)) {
+      const r = ask.requested;
+      const when = longDate(r.requested_at);
+      return `<div class="su-door su-ask">
+      <p class="panel-status panel-status--ok" role="status">Upgrade requested${when ? ` on ${escapeHtml(when)}` : ''}${r.by ? ` by @${escapeHtml(r.by)}` : ''}, for version ${mono(r.version)}. ${team.charAt(0).toUpperCase() + team.slice(1)} has your request. This page shows the new version once it is installed.</p>
+    </div>`;
+    }
+    const last = ask.requested && longDate(ask.requested.requested_at);
+    const before = last ? ` You last asked on ${escapeHtml(last)}, for ${mono(ask.requested.version)}.` : '';
+    const intro = lead
+      ? `<p class="panel-hint">This project runs on a server that ${team} looks after, so they install its updates. Ask them for this one and they are told which version you want.${before}</p>`
+      : `<p class="panel-hint">If that page does not let you in, ask ${team} to install it for you.${before}</p>`;
+    return `<div class="su-door su-ask">
+      ${intro}
+      <div class="row-end">
+        <button type="button" class="pbtn ${lead ? 'pbtn--save' : 'pbtn--quiet'}" id="su-ask">Ask for this upgrade</button>
+        <span class="panel-hint" id="su-ask-status" role="status"></span>
+      </div>
+    </div>`;
+  }
+
   // Where the Update button goes, and what it says it will do. Only a plain same-origin path
   // or an http(s) URL is ever put in an href; anything else draws no button.
   function doorHtml(data, offered) {
@@ -72,7 +115,9 @@
     if (!data.can_update) {
       return '<p class="panel-hint su-door">Only the people allowed to upgrade this project see an Update button here.</p>';
     }
+    const ask = data.ask || {};
     if (door.kind === 'cli') {
+      if (ask.available) return askHtml(ask, offered, { lead: true });
       return '<p class="panel-hint su-door">This project is upgraded on the server that runs it: <code>bongos upgrade</code> there takes this version, with the same health check and rollback.</p>';
     }
     const url = String(door.url || '');
@@ -85,7 +130,7 @@
     return `<div class="row-end su-door">
       <a class="pbtn pbtn--save" id="su-update" href="${escapeHtml(url)}">Update to ${escapeHtml(offered)}${sameOrigin ? '' : ' ↗'}</a>
       <span class="panel-hint">Opens this project's upgrade${escapeHtml(where)}: you see what would move, confirm it, and it installs, checks itself, and rolls back if the project does not come back healthy.</span>
-    </div>`;
+    </div>${door.kind === 'hub' && ask.available ? askHtml(ask, offered, { lead: false }) : ''}`;
   }
 
   // One entry: its text, and — only in the hall whose ledger the ids belong to, which is
@@ -142,7 +187,8 @@
       html += row('Newest for this project', `${mono(u.running)} — this project is up to date.`, '<span class="su-pill su-pill--ok">Up to date</span>');
     } else {
       const when = ago(u.offered_published_at);
-      html += row('Newest for this project', `${mono(u.offered)}${when ? ` — published ${escapeHtml(when)}` : ''}`, '<span class="su-pill">Update ready</span>');
+      const pending = data.can_update && data.ask && data.ask.available && askPending(data.ask, u.offered);
+      html += row('Newest for this project', `${mono(u.offered)}${when ? ` — published ${escapeHtml(when)}` : ''}`, `<span class="su-pill">${pending ? 'Requested' : 'Update ready'}</span>`);
       html += doorHtml(data, u.offered);
       html += whatsNewHtml(u.whats_new, (data.door || {}).kind === 'local');
     }
@@ -154,6 +200,9 @@
     body.innerHTML = html;
     if (note) note.textContent = notes.join(' ');
 
+    const askBtn = byId('su-ask');
+    if (askBtn) askBtn.addEventListener('click', () => askForUpgrade(data, askBtn));
+
     const more = byId('su-more');
     if (more) {
       more.addEventListener('click', () => {
@@ -163,6 +212,32 @@
     }
   }
 
+  // One press: the server sends the request and remembers it; the panel redraws from its
+  // answer. "Asked recently" carries the stored request, so it redraws as pending too.
+  async function askForUpgrade(data, btn) {
+    const status = byId('su-ask-status');
+    btn.disabled = true;
+    btn.textContent = 'Asking…';
+    if (status) status.textContent = '';
+    try {
+      const res = await api.request('POST', `${API}/software-update/request`, { body: {} });
+      const err = (res.data && res.data.error) || {};
+      const request = (res.data && res.data.request) || (err.details && err.details.request);
+      if ((res.ok || res.status === 429) && request) {
+        const again = new Date(Date.parse(request.requested_at) + 24 * 3600 * 1000).toISOString();
+        render({ ...data, ask: { ...data.ask, requested: request, ask_again_after: again } });
+        return;
+      }
+      // Every refusal the server sends carries a sentence; a bare code is only ever a
+      // proxy or a crash, so the status stands in for it.
+      throw new Error(err.message && err.message !== err.code ? err.message : `HTTP ${res.status}`);
+    } catch (e) {
+      btn.disabled = false;
+      btn.textContent = 'Ask for this upgrade';
+      if (status) status.textContent = `Could not send the request: ${String(e.message || 'unknown error').replace(/\.$/, '')}.`;
+    }
+  }
+
   async function load() {
     if (asked) return;
     asked = true;

package/modules/hall-ui/public/settings.html

@@ -461,7 +461,7 @@
      settings.js is against the 1500-line ratchet. -->
 <script src="/builders/settings-render.js?v=2026-09-16-render-levels"></script>
 <!-- task 1004296: Settings → Software update. Own file on the same precedent. -->
-<script src="/builders/settings-software-update.js?v=2026-09-26-update"></script>
+<script src="/builders/settings-software-update.js?v=2026-10-06-ask"></script>
 <!-- task 1004501: Settings → Your Autobongos runner. Own file on the same precedent. -->
 <script src="/builders/settings-autobongos.js?v=2026-10-01-autobongos"></script>
 </body>

package/modules/lifecycle/db-tasks.js

@@ -20,6 +20,7 @@ const { deriveRequiredRank, highestRank } = require('./db-rank-authz.js');
 const { executorFor } = require('./db-executor.js');
 const { isReservedCriterionSlug } = require('./criterion-ref.js');
 const { resolveWriteDiscipline, WRITABLE_DISCIPLINES } = require('./task-classifier.js');
+const { gateOnSpecTask } = require('./goal-spec-task.js');
 
 // -------------------------------------------------------------------------
 // Tasks
@@ -293,6 +294,10 @@ async function createTask({
       `[reward-gate] AUTO-ASSIGN task ${rows[0].id} credits_reward -> ${creditsRewardEffective} (cap ${REWARD_SUGGESTION_CAP}) [creation]`
     );
   }
+  // task 1004585 / ADR 0366 D3: a task born into a goal whose spec task is still
+  // open waits on it. Here, at the lowest create layer, so every vector inherits it;
+  // inside the caller's transaction when there is one, like the INSERT above.
+  if (rows[0]) await gateOnSpecTask(rows[0], deps.client || pool);
   return rows[0];
 }
 
@@ -417,6 +422,13 @@ async function updateTaskGoal(id, goalId) {
     `UPDATE tasks SET goal_id = $1, updated_at = now() WHERE id = $2 RETURNING *`,
     [goalId, id]
   );
+  // task 1004585: a task MOVED into a goal waits on its open spec task too. Through
+  // addTaskDependency (lazy — it lives beside this file), because a moved task may
+  // already have dependents and the edge must pass the cycle check.
+  if (rows[0]) {
+    const { addTaskDependency } = require('./db-deps-criteria.js');
+    await gateOnSpecTask(rows[0], pool, { addTaskDependency });
+  }
   return rows[0] ?? null;
 }
 

package/modules/lifecycle/goal-spec-task.js

@@ -0,0 +1,129 @@
+'use strict';
+
+// modules/lifecycle/goal-spec-task.js — a goal made in the hall carries its own
+// spec task, and the goal's other work waits behind it (task 1004585, ADR 0366 D3).
+//
+// WHY. The hall's goal form asks only what a person knows (a name, a description,
+// a version, a category). The rest of a goal — its scope wall, its criteria, its
+// first tasks — is inference, which /goal-create does in a session (ADR 0366 D2).
+// So a hall-made goal arrives with a task that says exactly that, and nothing else
+// in the goal can be claimed until it ships: an unspecced goal is visible as a
+// task on the board, not a silence.
+//
+// HOW, with no new permission and no migration:
+//   - The spec task is an ordinary task, recognised by (source, source_ref) =
+//     ('goal-spec', 'goal-<id>-spec'). That pair is also what makes creating it
+//     idempotent (findTaskBySourceRef).
+//   - "Waits behind it" is an ordinary task→task dependency, so the claim gate's
+//     existing DEPS_NOT_SHIPPED refusal and the auto-promotion on ship do the rest.
+//     A goal-level edge would be simpler, but every task in the goal inherits it
+//     (unsatisfiedDeps), the spec task included, which would block it on itself.
+//   - The edge is added at the two places a task ENTERS a goal: db-tasks.createTask
+//     (every create vector passes through it) and db-tasks.updateTaskGoal (a move).
+
+const SPEC_SOURCE = 'goal-spec';
+
+function specSourceRef(goalId) {
+  return `goal-${goalId}-spec`;
+}
+
+// The spec task's fields, for db.createTask. `ready` so it can be claimed at once;
+// a spike, because its output is a decision (the scope and the criteria) rather
+// than code; ideator, the craft whose pack covers "the scopes of work ideas become".
+function specTaskFields(goal, { createdBy = null } = {}) {
+  const id = goal.id;
+  return {
+    versionId: goal.version_id,
+    goalId: id,
+    title: `Spec goal ${id}: its scope, criteria and first tasks`,
+    description: [
+      `Goal ${id} ("${goal.title}") was created from the hall, which asks only for a name and a description. This task settles the rest, and every other task in the goal waits on it (ADR 0366 D3).`,
+      '',
+      'Settle, in a session (run /goal-create against this goal):',
+      `1. The scope wall: which code areas the goal's tasks may touch. Set it with POST /goals/${id}/scope (the goal's owner or a manager; a protected area needs an Archon).`,
+      `2. Two to four done-when criteria, with POST /versions/${goal.version_id}/done-when under the goal (ADR 0154: the goal's owner or a manager).`,
+      '3. The first tasks, with their dependencies.',
+      '',
+      'If you do not own or manage this goal, draft the scope and criteria and hand them to its owner rather than skipping them.',
+      '',
+      'DONE WHEN: the goal has its scope (or a written reason it needs none), its criteria, and at least one claimable task.',
+    ].join('\n'),
+    status: 'ready',
+    kind: 'spike',
+    discipline: 'ideator',
+    source: SPEC_SOURCE,
+    sourceRef: specSourceRef(id),
+    createdBy,
+  };
+}
+
+// The goal's spec task if it is still open, else null. An abandoned spec task
+// gates nothing new (the owner decided the goal needs no spec); a shipped one is done.
+async function openSpecTaskId(goalId, client) {
+  if (goalId == null) return null;
+  const { rows } = await client.query(
+    `SELECT id FROM tasks
+      WHERE goal_id = $1 AND source = $2 AND source_ref = $3
+        AND status NOT IN ('shipped', 'abandoned')
+      ORDER BY id ASC
+      LIMIT 1`,
+    [goalId, SPEC_SOURCE, specSourceRef(goalId)]
+  );
+  return rows[0] ? Number(rows[0].id) : null;
+}
+
+// Make a task that just entered a goal wait on that goal's open spec task.
+// Returns the spec task id it now waits on, or null. A task that IS the spec task
+// is left alone. Safe without a cycle check only for a brand-new task (nothing can
+// depend on it yet) — a moved task goes through addTaskDependency, which checks.
+async function gateOnSpecTask(task, client, { addTaskDependency = null } = {}) {
+  if (!task || task.goal_id == null) return null;
+  if (task.source === SPEC_SOURCE && task.source_ref === specSourceRef(task.goal_id)) return null;
+  const specId = await openSpecTaskId(task.goal_id, client);
+  if (specId == null || specId === Number(task.id)) return null;
+  if (addTaskDependency) {
+    try {
+      await addTaskDependency(task.id, specId);
+    } catch (err) {
+      // A cycle means the spec task already waits on this task; gating it would
+      // deadlock both, so the move stands without the edge.
+      if (err && err.code === 'CYCLE') return null;
+      throw err;
+    }
+  } else {
+    await client.query(
+      `INSERT INTO dependencies (from_kind, from_id, to_kind, to_id)
+       VALUES ('task', $1, 'task', $2)
+       ON CONFLICT DO NOTHING`,
+      [task.id, specId]
+    );
+  }
+  return specId;
+}
+
+// Give a goal its spec task, safely re-runnable: if the goal already has an OPEN
+// spec task, that one is returned and nothing is written, so a second run (a retry,
+// or a future "re-offer the spec" path) never files a duplicate. Run it inside the
+// caller's transaction so the read and the insert see the same snapshot.
+async function ensureSpecTask({ db, goal, client, createdBy = null }) {
+  const existing = await openSpecTaskId(goal.id, client);
+  if (existing != null) return { specTask: { id: existing }, created: false };
+  const specTask = await db.createTask(specTaskFields(goal, { createdBy }), { client });
+  return { specTask, created: true };
+}
+
+// POST /goals's create step. Without the opt-in it is exactly db.createGoal. With it,
+// the goal and its spec task land in ONE transaction: a goal without its spec task
+// would be ungated, which is the state D3 exists to end.
+async function createGoalWithSpec({ db, withTx, goalFields, withSpecTask = false }) {
+  if (!withSpecTask) return { goal: await db.createGoal(goalFields), specTask: null };
+  let goal;
+  let specTask = null;
+  await withTx(async (client) => {
+    goal = await db.createGoal(goalFields, { client });
+    ({ specTask } = await ensureSpecTask({ db, goal, client, createdBy: goalFields.createdBy }));
+  });
+  return { goal, specTask };
+}
+
+module.exports = { SPEC_SOURCE, specSourceRef, specTaskFields, openSpecTaskId, gateOnSpecTask, ensureSpecTask, createGoalWithSpec };

package/modules/lifecycle/routes/goals.js

@@ -29,6 +29,7 @@ const hierarchy = require('../hierarchy');
 const goalSuggest = require('../goal-suggest.js'); // task 1003062 — pre-creation goal suggester
 const goalEdits = require('../goal-edits.js'); // task 1003102 — goal self-edit handlers
 const goalCategory = require('../goal-category.js'); // task 1003275 — the ADVISORY human category (gates nothing)
+const goalSpecTask = require('../goal-spec-task.js'); // task 1004585 — a hall-made goal carries its own spec task (ADR 0366 D3)
 const goalRollup = require('../goal-rollup.js'); // task 1003278 — per-goal rollups computed in SQL, not in the browser
 const goalGraph = require('../goal-graph.js'); // task 1003479 — the goal graph: nodes + cross-goal edges, aggregated in SQL
 const goalForest = require('../goal-forest.js'); // task 1003480 — per-goal dependency forest
@@ -97,6 +98,7 @@ module.exports = function buildGoalsRouter() {
       // requested without stating a cause. minLength 8 because 'ok' / '.' is not
       // a reason, and the row is the only place the why survives.
       admit_reason: { type: 'string', minLength: 8, maxLength: 500 },
+      spec_task: { type: 'boolean' }, // task 1004585 / ADR 0366 D3 — the hall form's opt-in (goal-spec-task.js)
     })) return;
 
     const scopeModules = req.body.scope_modules || [];
@@ -156,15 +158,11 @@ module.exports = function buildGoalsRouter() {
       const admission = versionDecision.overrideApplied
         ? { admittedBy: req.builder.id, reason: admitReason }
         : null;
-      const goal = await db.createGoal({
-        versionId: req.body.version_id,
-        title: req.body.title,
+      const { goal, specTask } = await goalSpecTask.createGoalWithSpec({ db, withTx: api.withTx, withSpecTask: req.body.spec_task === true, goalFields: {
+        versionId: req.body.version_id, title: req.body.title,
         subtitle: (req.body.subtitle || '').trim() || null, description: (req.body.description || '').trim() || null,
-        scopeModules,
-        createdBy: req.builder.id,
-        categoryId,
-        admission,
-      });
+        scopeModules, createdBy: req.builder.id, categoryId, admission,
+      } });
       // Stamp the predecessor's succeeded_by pointer at the new goal (the lineage).
       if (succeedsId != null) {
         await db.setGoalSuccessor({ goalId: succeedsId, successorId: goal.id });
@@ -182,7 +180,7 @@ module.exports = function buildGoalsRouter() {
       // waved into a building version, by whom and why — the caller should not
       // have to re-read the goal to find out whether their override took effect.
       const admitted = admission ? await db.getGoalAdmission(goal.id) : null;
-      return res.status(201).json({ ok: true, goal, succeeds_goal_id: succeedsId, category_advisory, admitted });
+      return res.status(201).json({ ok: true, goal, succeeds_goal_id: succeedsId, category_advisory, admitted, spec_task: specTask });
     } catch (err) {
       log.error('[gds] POST /goals', err);
       return res.fail('goal_create_failed', { status: 500, message: 'internal error' });

package/modules/lifecycle/routes/task-write-routes.js

@@ -29,6 +29,7 @@ const { validateOrRespond, LIMITS, parseId } = api;
 const { badKind, detectsMigration } = require('./task-route-helpers.js');
 const { describeCheckViolation } = require('../pg-constraint-fail.js');
 const { goalNotOpenRefusal } = require('./goal-route-authz.js');
+const { resolveUpkeepHome, isUpkeepFiling, UPKEEP_HINT } = require('../upkeep-home.js'); // task 1004597
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('lifecycle');
 
@@ -189,10 +190,18 @@ module.exports = function registerTaskWriteRoutes(router) {
     // nobody reads. This is the human/agent door, and it always has a goal to
     // name — /builder-start lists work by goal, and POST /goals/:id/tasks has
     // required one since BV1.R60.
+    // task 1004597: the one exception is PLATFORM UPKEEP (a core upgrade, Bongos
+    // maintenance), which fits no product goal. An explicit kind 'infra' with no
+    // goal lands in the version's maintenance goal — see upkeep-home.js.
+    const upkeepHome = await resolveUpkeepHome(body, { ensureMaintenanceGoal: db.ensureMaintenanceGoal, withTx: api.withTx });
+    if (upkeepHome) body.goal_id = Number(upkeepHome.id);
     if (body.goal_id == null) {
       return res.fail('goal_id_required', {
         status: 400,
-        message: 'goal_id is required — every task belongs to a goal. List them at GET /goals?version=<id>, or author under one directly with POST /goals/:id/tasks.',
+        message: 'goal_id is required — every task belongs to a goal. List them at GET /goals?version=<id>, or author under one directly with POST /goals/:id/tasks. ' +
+          (isUpkeepFiling(body)
+            ? `Version '${body.version_id}' is not being built right now, so it has no maintenance goal for upkeep — file it against the version that is.`
+            : UPKEEP_HINT),
       });
     }
     if (body.goal_id != null) {
@@ -297,6 +306,7 @@ module.exports = function registerTaskWriteRoutes(router) {
         needs_migration: needsMigration,
         criteria,
         suggested_criteria,
+        ...(upkeepHome ? { goal_home: 'maintenance' } : {}), // task 1004597
         goal_advisory, dependency_advisory, est_advisory: await require('../est-advisory').buildEstAdvisory({ db, task }), // task 1003148
       });
     } catch (err) {

package/modules/lifecycle/upkeep-home.js

@@ -0,0 +1,55 @@
+'use strict';
+
+// modules/lifecycle/upkeep-home.js — WHERE PLATFORM UPKEEP GOES WHEN NO PRODUCT
+// GOAL FITS (task 1004597).
+//
+// THE CONTRADICTION THIS CLOSES. The ledger rule says record a change before you
+// make it; the goal rule (ADR 0250 D4, BV1.R11) says every task belongs to a
+// goal. A project's goals are product goals ("Marketing", "Live Floor"), so a
+// builder about to upgrade the Bongos core had nowhere honest to file it: POST
+// /tasks refused `goal_id_required`, and the only ways forward were to misfile
+// the upgrade under a product goal or skip the record. One session (mercury,
+// 2026-10-06) chose the latter.
+//
+// THE ANSWER REUSES THE HOMELESS-BUG HOME. Every building version already has a
+// find-or-create MAINTENANCE goal (ADR 0262, `ensureMaintenanceGoal`): open, no
+// scope wall, exempt from the version-close count, carried forward on close.
+// Platform upkeep is maintenance in exactly that sense, so a task filed with
+// NO goal and kind 'infra' lands there.
+//
+// ONLY AN EXPLICIT kind COUNTS — never the classifier's guess. The defect
+// BV1.R11 fixed was SILENT bucketing (53 tasks filed out of sight by a default).
+// A caller who writes kind 'infra' has said out loud what the work is; a feature
+// whose text merely reads like infra must still name its goal.
+//
+// RANK AND APPROVAL ARE UNTOUCHED. This only answers "which goal"; the route's
+// own permission check (task.create, Metic+) and status rules run exactly as for
+// any other goal.
+
+const UPKEEP_KIND = 'infra';
+
+// isUpkeepFiling — true when a create names no goal and explicitly says it is
+// platform upkeep. PURE; exported so the rule has one spelling.
+function isUpkeepFiling(body) {
+  return !!body && body.goal_id == null && body.kind === UPKEEP_KIND;
+}
+
+// resolveUpkeepHome — the maintenance goal row an upkeep filing lands in, or
+// null when it is not an upkeep filing or the version cannot take work (not
+// `building`). The find-or-create runs inside its own transaction so the
+// advisory lock in ensureMaintenanceGoal actually serialises concurrent filers
+// (outside a transaction it would release at the end of its own statement).
+async function resolveUpkeepHome(body, deps) {
+  if (!isUpkeepFiling(body)) return null;
+  const { ensureMaintenanceGoal, withTx } = deps;
+  return withTx((client) => ensureMaintenanceGoal(body.version_id, { client }));
+}
+
+// The plain-words half of the goal_id_required refusal: what to do when the work
+// is upkeep rather than product work. Shared by the route and the CLI so the two
+// never drift.
+const UPKEEP_HINT =
+  'Platform upkeep — a Bongos upgrade or other maintenance — has a standing home: ' +
+  `file it with kind "${UPKEEP_KIND}" and no goal, and it goes into this version's maintenance goal.`;
+
+module.exports = { UPKEEP_KIND, UPKEEP_HINT, isUpkeepFiling, resolveUpkeepHome };

package/modules/public-landing/public/projects-hall-live.states.json

@@ -158,7 +158,13 @@
         "visible": [
           "#panel-done",
           "#wizInvite",
-          "#wizInviteWho"
+          "#wizInviteWho",
+          "#humanSteps li.cur",
+          "#stepPager",
+          "#stepNext"
+        ],
+        "hidden": [
+          "#hop"
         ],
         "text": [
           [