mint at all. `test/openagents/threads/credit_race_test.exs` proves the

  serialized figures, the exhausted refusal under race, and the unchanged

  serial ceilings.

- **Expiry revokes without being asked.** `OpenAgents.Threads.reap_expired/1`

  runs at admission and on every read of a thread: an active grant past

  `expires_at` becomes `expired`, and an open thread that has minted authority

  and holds none becomes `failed` with `authority_expired`. An abandoned thread

  therefore cannot hold an account's admission slot, and a lapsed token is not

  merely refused on presentation — it stops being live in the ledger.

- **A thread's authority has no clock, and spent authority releases the slot

  without being asked.** `inference_grants.expires_at` is nullable and a

  thread's grant is minted without one: a thread is bounded by its budget

  (calls, tokens, cost) and by revocation, and by nothing else. It used to

  carry `thread_grant_ttl_seconds`, and the reaper closed the open thread it

  fenced as `authority_expired` — which ended a coding session mid-work

  because an hour had passed, with nothing wrong and nothing finished. The

  ceiling still clears itself: `OpenAgents.Threads.reap_expired/1` runs at

  admission and on every read of a thread, and an open thread that has minted

  authority and holds none — its budget spent, or its grant revoked — becomes

  `failed` with `authority_spent`, so it cannot hold an account's admission

  slot forever. A grant that *does* carry a deadline, where the deadline is a

  security bound rather than a convenience, is still retired past it, and a

  lapsed token stops being live in the ledger rather than merely being refused

  on presentation.

- **Authority reaches only the account that opened the thread.**

  `OpenAgents.Threads.get_for_user/2` joins through the owner visitor, so

  another account's thread id resolves to `nil` and the route refuses it with

  thread_grant_max_total_tokens: 1_000_000,

  thread_grant_max_calls: 256,

  thread_grant_max_cost_microusd: 2_000_000,

  thread_grant_ttl_seconds: 3_600,

  # No clock on a thread's authority. It expiring on a wall clock ended a

  # coding session mid-sentence and told the reader to start a new one, when

  # nothing had gone wrong except that an hour had passed. Budget and

  # revocation bound a thread; time does not.

  thread_grant_ttl_seconds: nil,

  # The inference credit an account draws its threads against. Signing in is

  # what raises it: a visitor holding only a browser key gets the same figure a

  # single thread used to get, and an account with a user behind it gets $100 to

          required(:max_total_tokens) => pos_integer(),

          required(:max_calls) => pos_integer(),

          required(:max_cost_microusd) => pos_integer(),

          required(:ttl_seconds) => pos_integer()

          # nil is a grant with no clock: budget and revocation bound it, time

          # does not.

          required(:ttl_seconds) => pos_integer() | nil

        }

  @type mint_input :: %{

      max_total_tokens: ceilings.max_total_tokens,

      max_calls: ceilings.max_calls,

      max_cost_microusd: ceilings.max_cost_microusd,

      expires_at: DateTime.add(now(), ceilings.ttl_seconds, :second)

      expires_at: deadline(ceilings)

    }

    changeset = Grant.mint_changeset(attrs)

      %Grant{status: "active"} = grant ->

        cond do

          DateTime.compare(now(), grant.expires_at) != :lt ->

          # A grant with no clock cannot elapse. `DateTime.compare/2` would

          # raise on nil rather than answer, so the absence is read first.

          not is_nil(grant.expires_at) and DateTime.compare(now(), grant.expires_at) != :lt ->

            _ = expire(grant)

            {:error, :grant_expired}

    Grant

    |> where([g], g.owner_visitor_id == ^owner_visitor_id)

    |> where([g], g.status == "active" and g.expires_at <= ^stamp)

    |> where([g], g.status == "active" and not is_nil(g.expires_at) and g.expires_at <= ^stamp)

    |> Repo.update_all(set: [status: "expired", exhausted_at: stamp, updated_at: stamp])

  end

  defp grant_ttl_seconds, do: Application.get_env(:openagents, :inference_grant_ttl_seconds, 900)

  # nil ttl means no deadline at all, rather than one computed from nil.

  defp deadline(%{ttl_seconds: nil}), do: nil

  defp deadline(%{ttl_seconds: seconds}), do: DateTime.add(now(), seconds, :second)

  defp input_price_microusd,

    do: Application.get_env(:openagents, :inference_input_price_microusd_per_ktoken, 1_250)

    ])

    # machine_id is nil for Sarah-internal grants (a coding job metering its

    # own runtime, #122); computer-bound probe delegations always set it.

    # `expires_at` is cast but not required: nil is a grant with no clock. A

    # thread's authority is bounded by budget and revocation, not by how long

    # the reader has been working. A computer-bound delegation still sets one,

    # where the deadline is a security bound rather than a convenience.

    |> validate_required([

      :owner_visitor_id,

      :model_id,

      :token_digest,

      :max_total_tokens,

      :max_calls,

      :max_cost_microusd,

      :expires_at

      :max_cost_microusd

    ])

    |> validate_number(:max_total_tokens, greater_than: 0)

    |> validate_number(:max_calls, greater_than: 0)

     that inserts, so two simultaneous opens at the boundary admit one thread,

     not two — the cap is what makes the account's joint credit exposure a

     bounded figure, so it has to hold under concurrency (issue #195).

  5. **The ceiling is self-clearing.** `reap_expired/1` runs at admission and

     on every read: an active grant whose clock has run out becomes `expired`,

     and the open thread it fenced becomes `failed` with `authority_expired`.

  5. **The ceiling is self-clearing, but not on a clock.** `reap_expired/1`

     runs at admission and on every read: a thread that has minted authority

     and holds none becomes `failed` with `authority_spent`. A thread's grant

     carries no deadline, so waiting alone never reaches it.

     Expiry therefore releases both the thread's active-grant slot and the

     account's admission slot without anyone asking, so an abandoned thread

     cannot lock an account out of its own ceiling.

      max_total_tokens: setting(:thread_grant_max_total_tokens, 1_000_000),

      max_calls: setting(:thread_grant_max_calls, 256),

      max_cost_microusd: setting(:thread_grant_max_cost_microusd, 2_000_000),

      ttl_seconds: setting(:thread_grant_ttl_seconds, 3_600)

      # No clock. A thread is bounded by the three ceilings above and by

      # revocation; how long the reader has been working is not a bound.

      ttl_seconds: setting(:thread_grant_ttl_seconds, nil)

    }

  end

  end

  @doc """

  Retire the account's elapsed authority, and the threads it fenced.

  Retire authority that has ended, and the threads left holding none.

  Expiry is a fact about a clock, not a request: a grant past `expires_at` is

  no longer authority whether or not anyone presents it. This transitions those

  grants to `expired`, and closes every open thread that has minted authority

  and no longer holds any, with `authority_expired`. Returns

  `{expired_grants, closed_threads}`.

  Two halves, and only one of them used to be about a clock.

  A grant that carries a deadline and is past it is retired. A thread's grant

  carries no deadline — time is not one of a thread's bounds — so this half

  reaches only the grants that still set one.

  A thread that has minted authority and holds none is finished whether or not

  anyone says so: the only route that mints for a caller mints once, at open,

  so nothing is coming to renew it, and leaving it open holds a slot against

  the account's ceiling forever. It is closed as `authority_spent`, which is

  what has actually happened — the budget ran out, or the grant was revoked.

  Returns `{retired_grants, closed_threads}`.

  """

  @spec reap_expired(User.t() | Visitor.t()) :: {non_neg_integer(), non_neg_integer()}

  def reap_expired(%User{} = user),

      visitor_id

      |> abandoned_thread_ids()

      |> Enum.count(fn thread_id ->

        match?({:ok, _closed}, terminate(%Thread{id: thread_id}, expired_attributes()))

        match?({:ok, _closed}, terminate(%Thread{id: thread_id}, spent_attributes()))

      end)

    {expired, closed}

    end)

  end

  defp expired_attributes do

    report = "The thread's model authority expired before it reported."

    %{

      status: "failed",

      report: report,

      report_digest: digest(report),

      error_code: "authority_expired",

      completed_at: DateTime.utc_now()

    }

  end

  # An open thread that has minted authority and holds none is abandoned: the

  # An open thread that has minted authority and holds none is finished: the

  # only route that mints for a caller mints once, at open, so nothing is

  # coming to renew it.

  defp abandoned_thread_ids(visitor_id) do

    )

  end

  defp spent_attributes do

    report = "The thread's model authority was spent before it reported."

    %{

      status: "failed",

      report: report,

      report_digest: digest(report),

      error_code: "authority_spent",

      completed_at: DateTime.utc_now()

    }

  end

  defp setting(key, default), do: Application.get_env(:openagents, key, default)

  defp locked(thread_id) do

    20260824184030,

    20260824203139,

    20260824204740,

    20260824210500

    20260824210500,

    20260824230007

  ],

  "required_tables": [

    "users",

defmodule OpenAgents.Repo.Migrations.AllowUnexpiringInferenceGrants do

  use Ecto.Migration

  @moduledoc """

  Let a grant have no clock.

  A thread's authority expiring on a wall clock ended a coding session

  mid-sentence and told the reader to start a new one. The work was not

  finished, nothing had gone wrong, and the only thing that had happened was

  that an hour had passed. Budget still bounds a grant — calls, tokens, and

  cost — and revocation still ends one immediately. Time no longer does.

  `expires_at` becomes nullable and nil means "no clock". Grants that still

  carry one — a computer-bound delegation, whose deadline is a security bound

  rather than a convenience — are unaffected.

  The update guard has to change with it. `NEW.expires_at <> OLD.expires_at`

  is NULL when either side is NULL, and a NULL predicate is not true, so the

  column would have become quietly mutable for exactly the rows that now use

  it. `IS DISTINCT FROM` is the null-safe comparison the other nullable

  columns in this guard already use.

  """

  def up do

    alter table(:inference_grants) do

      modify :expires_at, :utc_datetime_usec, null: true

    end

    execute(guard("IS DISTINCT FROM"))

  end

  def down do

    execute("UPDATE inference_grants SET expires_at = now() WHERE expires_at IS NULL")

    alter table(:inference_grants) do

      modify :expires_at, :utc_datetime_usec, null: false

    end

    execute(guard("<>"))

  end

  defp guard(expires_at_comparison) do

    """

    CREATE OR REPLACE FUNCTION sarah_guard_inference_grant_update()

    RETURNS trigger AS $$

    BEGIN

      IF OLD.status <> 'active' THEN

        RAISE EXCEPTION 'inference_grants row % is terminal (%), no update permitted', OLD.id, OLD.status;

      END IF;

      IF NEW.id <> OLD.id

         OR NEW.owner_visitor_id <> OLD.owner_visitor_id

         OR NEW.conversation_id IS DISTINCT FROM OLD.conversation_id

         OR NEW.thread_id IS DISTINCT FROM OLD.thread_id

         OR NEW.machine_id IS DISTINCT FROM OLD.machine_id

         OR NEW.model_id <> OLD.model_id

         OR NEW.token_digest <> OLD.token_digest

         OR NEW.max_total_tokens <> OLD.max_total_tokens

         OR NEW.max_calls <> OLD.max_calls

         OR NEW.max_cost_microusd <> OLD.max_cost_microusd

         OR NEW.expires_at #{expires_at_comparison} OLD.expires_at THEN

        RAISE EXCEPTION 'inference_grants row % has immutable identity/budget fields', OLD.id;

      END IF;

      IF NEW.call_count < OLD.call_count THEN

        RAISE EXCEPTION 'inference_grants row % call_count cannot decrease', OLD.id;

      END IF;

      RETURN NEW;

    END;

    $$ LANGUAGE plpgsql;

    """

  end

end

  end

  describe "reap_expired/1" do

    test "elapsed authority is expired and the thread it fenced is closed" do

      user = owner("reaped")

      {:ok, live} = Threads.open(user, "Still working")

      {:ok, live, _live_grant, _live_token} = Threads.mint_grant(live)

    test "a thread's authority has no clock, so waiting does not end it" do

      # The behaviour this replaces: an hour passed, the grant expired, the

      # open thread it fenced was closed as `authority_expired`, and a coding

      # session that was mid-sentence was told to start a new one.

      user = owner("no-clock")

      {:ok, thread} = Threads.open(user, "Still working")

      {:ok, thread, grant, token} = Threads.mint_grant(thread)

      elapsed_ttl()

      {:ok, lapsed} = Threads.open(user, "Abandoned")

      {:ok, lapsed, lapsed_grant, lapsed_token} = Threads.mint_grant(lapsed)

      assert is_nil(Repo.get!(Grant, grant.id).expires_at)

      assert {1, 1} = Threads.reap_expired(user)

      # However long the reaper is run, and whenever.

      assert {0, 0} = Threads.reap_expired(user)

      assert {0, 0} = Threads.reap_expired(user)

      assert Repo.get!(Grant, lapsed_grant.id).status == "expired"

      assert {:error, :grant_expired} = Inference.resolve(lapsed_token)

      assert Repo.get!(Grant, grant.id).status == "active"

      assert Repo.get!(Thread, thread.id).status == "open"

      assert {:ok, _resolved} = Inference.resolve(token)

    end

      reaped = Repo.get!(Thread, lapsed.id)

      assert reaped.status == "failed"

      assert reaped.error_code == "authority_expired"

      assert reaped.report_digest =~ ~r/\Asha256:[0-9a-f]{64}\z/

    test "a grant that does carry a deadline is still retired when it passes" do

      # Not every grant is a thread's. A computer-bound delegation keeps its

      # clock, where the deadline is a security bound rather than a

      # convenience, and this is the reader that enforces it.

      user = owner("reaped")

      elapsed_ttl()

      {:ok, thread} = Threads.open(user, "Deadline")

      {:ok, _thread, grant, token} = Threads.mint_grant(thread)

      # A thread whose clock has not run out is untouched.

      assert Repo.get!(Thread, live.id).status == "open"

      assert {1, 1} = Threads.reap_expired(user)

      assert Repo.get!(Grant, grant.id).status == "expired"

      assert {:error, :grant_expired} = Inference.resolve(token)

    end

    test "a thread that has never minted authority is not reaped" do

      user = owner("never-minted")

      {:ok, thread} = Threads.open(user, "No authority yet")

    test "a thread left holding no authority is closed as spent, never as expired" do

      # The slot has to come back: nothing is coming to renew a grant, and an

      # open thread that can never work again would hold the ceiling forever.

      # What changed is the reason it is closed for — the budget ran out, which

      # is true, rather than a clock, which no longer exists.

      user = owner("left-open")

      elapsed_ttl()

      {:ok, thread} = Threads.open(user, "Deadline")

      {:ok, thread, _grant, _token} = Threads.mint_grant(thread)

      assert {0, 0} = Threads.reap_expired(user)

      assert Repo.get!(Thread, thread.id).status == "open"

      assert {1, 1} = Threads.reap_expired(user)

      reaped = Repo.get!(Thread, thread.id)

      assert reaped.status == "failed"

      assert reaped.error_code == "authority_spent"

      refute reaped.report =~ "expired"

    end

    test "reaping is idempotent" do

      user = owner("reap-twice")

      elapsed_ttl()

      {:ok, thread} = Threads.open(user, "Abandoned")

      {:ok, thread} = Threads.open(user, "Deadline")

      {:ok, _thread, _grant, _token} = Threads.mint_grant(thread)

      assert {1, 1} = Threads.reap_expired(user)

      assert Map.drop(theirs, ["request_id"]) == Map.drop(absent, ["request_id"])

    end

    test "an expired grant is reported as expired without anyone revoking it", %{conn: conn} do

    test "a thread's authority carries no deadline, so time alone does not end it", %{

      conn: conn

    } do

      # What this replaces: the grant expired on a wall clock, the thread was

      # closed as `authority_expired`, and a coding session that was mid-work

      # was told to start a new one because an hour had passed.

      authenticated = put_chat_api_token(conn, "thread-no-clock")

      created =

        authenticated

        |> post(~p"/api/v3/threads", %{"objective" => "Outlive me."})

        |> json_response(201)

      body =

        authenticated

        |> get(~p"/api/v3/threads/#{created["thread"]["id"]}")

        |> json_response(200)

      assert body["grant"]["status"] == "active"

      assert body["thread"]["status"] == "open"

      assert is_nil(body["thread"]["error_code"])

      assert {:ok, _resolved} = Inference.resolve(created["grant"]["token"])

    end

    test "a thread left holding no authority reports it as spent, never as expired", %{

      conn: conn

    } do

      # The slot still has to come back — an open thread that can never work

      # again would hold the account's ceiling forever. What a reader is told

      # is that the authority was spent, which is true, rather than that it

      # expired, which is a concept this no longer has.

      authenticated = put_chat_api_token(conn, "thread-expiry-read")

      elapsed_ttl()

      assert body["grant"]["status"] == "expired"

      assert body["thread"]["status"] == "failed"

      assert body["thread"]["error_code"] == "authority_expired"

      assert {:error, :grant_expired} = Inference.resolve(created["grant"]["token"])

      assert body["thread"]["error_code"] == "authority_spent"

      refute body["thread"]["report"] =~ "expired"

    end

    test "an expired thread releases the slot the cap counts", %{conn: conn} do

    test "the slot is released by revoking, not by waiting", %{conn: conn} do

      cap(1)

      restore_ttl = elapsed_ttl()

      authenticated = put_chat_api_token(conn, "thread-expiry-cap")

      # This thread's authority has already elapsed, but the row is open and

      # nobody has said anything about it.

      first =

        authenticated

        |> post(~p"/api/v3/threads", %{"objective" => "First."})

      assert Threads.open_count(github_user("api-token-thread-expiry-cap")) == 1

      restore_ttl.()

      second =

      # Waiting does not free it. There is no clock to wait out.

      refused =

        authenticated

        |> post(~p"/api/v3/threads", %{"objective" => "Second."})

        |> json_response(201)

        |> json_response(429)

      retired =

        authenticated

        |> get(~p"/api/v3/threads/#{first["thread"]["id"]}")

        |> json_response(200)

      assert refused["code"] == "thread_quota_reached"

      assert retired["thread"]["status"] == "failed"

      assert retired["thread"]["error_code"] == "authority_expired"

      # Saying so does.

      _deleted = authenticated |> delete(~p"/api/v3/threads/#{first["thread"]["id"]}")

      # The second thread's authority has not elapsed, so it still holds the

      # only slot and the cap still bites.

      refused =

      second =

        authenticated

        |> post(~p"/api/v3/threads", %{"objective" => "Third."})

        |> json_response(429)

        |> post(~p"/api/v3/threads", %{"objective" => "Second."})

        |> json_response(201)

      assert refused["code"] == "thread_quota_reached"

      assert second["grant"]["token"] != first["grant"]["token"]

    end

  end