openai_api_key: required_text.("OPENAI_API_KEY"),

    openrouter_api_key: optional_text.("OPENROUTER_API_KEY"),

    gemini_api_key: optional_text.("GEMINI_API_KEY"),

    # The gateway lane the model catalog's default routes through. It was

    # wired in the dev branch only, so in production the credential stayed nil

    # and the catalog's first entry — what a caller naming no model gets —

    # refused every call with `model_unavailable`. That is the published CLI's

    # default path, so the omission took the default lane down rather than a

    # corner of it.

    vercel_gateway_api_key: optional_text.("AI_GATEWAY_API_KEY"),

    box_api_key: optional_text.("BOX_API_KEY"),

    inference_proxy_url: optional_text.("OPENAGENTS_INFERENCE_PROXY_URL"),

    forge_enabled: forge_enabled,

    {"forge_assignments", "forge_assignments_machine_id_fkey"},

    {"inference_grants", "inference_grants_machine_id_fkey"},

    {"machine_pairings", "machine_pairings_machine_id_fkey"},

    # The owner column is gone from the schema and unread by any code, but the

    # column and this key survive one more release: dropping them during a

    # rolling replacement would break this table for the nodes still running

    # the release that declares `belongs_to :user`. The contract migration

    # removes both once that release is off every node.

    {"machine_pairings", "machine_pairings_user_id_fkey"},

    {"machine_pairings", "machine_pairings_pkey"},

    {"machine_pairings", "machine_pairings_status_check"},

    {"machine_pairings", "machine_pairings_tier_check"},

  use Ecto.Migration

  @moduledoc """

  `machine_pairings.user_id` was written by `do_approve_pairing/4` and read by

  nothing. It is also strictly derivable: approval sets `user_id` and

  `machine_id` in one changeset, nothing sets either alone, and

  `machines.user_id` is the same account. See issue #184 and CANON-002.

  `machine_pairings.user_id` is no longer written or read, and the drop is

  deferred to the release after the one that stops writing it.

  This is the expand half of expand-and-contract, and the reason is the roll

  rather than the column. A rolling replacement runs migrations on the first

  node while the other two still serve the previous release, and that release

  declares `belongs_to :user` on `OpenAgents.Machines.Pairing` — which puts

  `user_id` into every generated `SELECT`. Dropping the column here would make

  every read and write of `machine_pairings` fail on the un-replaced nodes, so

  CLI device pairing would break for two thirds of traffic, then one third,

  for the length of the roll.

  The column is dead weight and nothing else: the current release neither

  writes nor reads it, and the owner it named is reachable through

  `machines.user_id` (issue #184, CANON-002). Carrying it for one release

  costs a nullable column; dropping it during a roll costs pairing.

  The contract half — the actual `remove` — belongs in a later migration, once

  the release that stopped writing it is live on every node.

  """

  def up do

    alter table(:machine_pairings) do

      remove :user_id

    end

    :ok

  end

  def down do

    alter table(:machine_pairings) do

      add :user_id, references(:users, type: :binary_id, on_delete: :delete_all)

    end

    # The owner was never lost: it is the computer's owner, which is where the

    # column's only writer read it from in the first place.

    execute("""

    UPDATE machine_pairings AS p

       SET user_id = m.user_id

      FROM machines AS m

     WHERE m.id = p.machine_id

    """)

    :ok

  end

end

  def up do

    alter table(:inference_grants) do

      modify :max_total_tokens, :integer, null: true

      # The declared type must match what the table already holds. Ecto's

      # Postgres adapter always emits the type clause on `modify`, so naming

      # `:integer` here would issue `ALTER COLUMN TYPE integer` against columns

      # created as `:bigint` — a full table rewrite that also caps a grant at

      # ~2.1 billion tokens and ~$2,147 forever, and that aborts the migration

      # outright on any row already above it. Only nullability is changing.

      modify :max_total_tokens, :bigint, null: true

      modify :max_calls, :integer, null: true

      modify :max_cost_microusd, :integer, null: true

      modify :max_cost_microusd, :bigint, null: true

    end

    execute("""

    """)

    alter table(:inference_grants) do

      modify :max_total_tokens, :integer, null: false

      modify :max_total_tokens, :bigint, null: false

      modify :max_calls, :integer, null: false

      modify :max_cost_microusd, :integer, null: false

      modify :max_cost_microusd, :bigint, null: false

    end

    execute(guard("<>"))

    drop constraint(:threads, :threads_terminal_shape_check)

    # `report_type` is required by the application, not yet by the database,

    # and the gap is the rolling replacement. Migrations run on the first

    # replaced node while the other two still serve the previous release, and

    # that release sets only `status`, `report`, `report_digest`, and

    # `completed_at` when a thread finishes. Requiring `report_type` here would

    # stop those nodes closing, cancelling, or expiring any thread for the

    # length of the roll — every session that finished on an old node would

    # fail at the last step.

    #

    # So this release admits a terminal thread with no report type, and

    # `OpenAgents.Threads` supplies one on every path it owns (THREAD-003).

    # The column is tightened to NOT NULL in a later migration, once the

    # release that always writes it is live on every node. Expand first,

    # contract after.

    create constraint(:threads, :threads_terminal_shape_check,

             check: """

             (status = 'open' AND completed_at IS NULL AND report IS NULL AND report_type IS NULL)

             OR (status <> 'open' AND completed_at IS NOT NULL AND report IS NOT NULL AND report_type IS NOT NULL)

             OR (status <> 'open' AND completed_at IS NOT NULL AND report IS NOT NULL)

             """

           )

    assert Repo.get!(OpenAgents.Machines.Machine, stored.machine_id).user_id == owner.id

  end

  test "the pairing row no longer carries an owner column" do

  test "the pairing schema no longer carries an owner, whatever the column does" do

    columns =

      Repo.query!(

        """

      ).rows

      |> Enum.map(&hd/1)

    refute "user_id" in columns

    # The column is still there, and deliberately: dropping it during a rolling

    # replacement would break every read and write of this table on the nodes

    # still running the previous release, which declares `belongs_to :user`.

    # The drop is deferred to the release after that one (see the migration).

    #

    # What this contract is really about is that the owner is not stored here

    # any more, so the assertion is on the schema rather than on the column:

    # nothing reads or writes it, and the owner is reached through the

    # computer.

    refute :user_id in OpenAgents.Machines.Pairing.__schema__(:fields)

    assert "machine_id" in columns

    constraints =

      ).rows

      |> Enum.map(&hd/1)

    refute "machine_pairings_user_id_fkey" in constraints

    # Nothing in the current release can write it, so the foreign key it once

    # needed is not load-bearing either way; it goes with the column.

    assert is_list(constraints)

  end

  test "approve then claim hands the token over exactly once" do