mint at all. `test/openagents/threads/credit_race_test.exs` proves the

  serialized figures, the exhausted refusal under race, and the unchanged

  serial ceilings.

- **A thread's authority has no clock, and spent authority releases the slot

  without being asked.** `inference_grants.expires_at` is nullable and a

  thread's grant is minted without one: a thread is bounded by its budget

  (calls, tokens, cost) and by revocation, and by nothing else. It used to

  carry `thread_grant_ttl_seconds`, and the reaper closed the open thread it

  fenced as `authority_expired` — which ended a coding session mid-work

  because an hour had passed, with nothing wrong and nothing finished. The

- **A thread's authority has no clock and no ceiling of its own, and spent

  authority releases the slot without being asked.**

  `inference_grants.expires_at`, `max_calls`, `max_total_tokens`, and

  `max_cost_microusd` are all nullable, and nil is unbounded on each. A

  thread's grant is minted with no deadline and no call or token ceiling: it is

  bounded by revocation and by the account's credit, which is what

  `max_cost_microusd` carries, and by nothing else. The database still refuses

  a ceiling that is present and non-positive

  (`inference_grant_positive_ceilings`), because a grant that could never buy a

  call is a different thing from a grant with no limit. It used to

  carry `thread_grant_ttl_seconds`, 256 calls, a million tokens, and two

  dollars, and the reaper closed the open thread it fenced as

  `authority_expired` — each of which ended a coding session mid-work in an

  afternoon, with nothing wrong and nothing finished. The

  ceiling still clears itself: `OpenAgents.Threads.reap_expired/1` runs at

  admission and on every read of a thread, and an open thread that has minted

  authority and holds none — its budget spent, or its grant revoked — becomes

  # most one live grant per open thread, so the account's concurrent

  # thread-scoped authority is bounded by eight of the ceilings below.

  maximum_open_threads_per_account: 8,

  thread_grant_max_total_tokens: 1_000_000,

  thread_grant_max_calls: 256,

  thread_grant_max_cost_microusd: 2_000_000,

  # Unbounded, all three. A coding session reached 256 calls, a million tokens,

  # and two dollars in an afternoon, and was told to start a new session — the

  # same interruption the clock below used to cause, by another route. A

  # thread is bounded by revocation and by the account's credit.

  thread_grant_max_total_tokens: nil,

  thread_grant_max_calls: nil,

  thread_grant_max_cost_microusd: nil,

  # No clock on a thread's authority. It expiring on a wall clock ended a

  # coding session mid-sentence and told the reader to start a new one, when

  # nothing had gone wrong except that an hour had passed. Budget and

# to bundle .js and .css sources.

config :openagents, OpenAgentsWeb.Endpoint,

  # Binding to loopback ipv4 address prevents access from other machines.

  # Change to `ip: {0, 0, 0, 0}` to allow access from other machines.

  # `PHX_LISTEN_ALL=true` widens it to every interface, like the PORT

  # override below and for the same reason: a Gym benchmark container

  # reaching the dev server through host.docker.internal needs a non-loopback

  # bind, and flipping it should not mean editing checked-in config.

  # 4000 unless `PORT` says otherwise. Another agent verifying a git-forge

  # receipt needs the canonical port free, and moving this server aside should

  # not mean editing checked-in config to do it.

  http: [ip: {127, 0, 0, 1}, port: String.to_integer(System.get_env("PORT") || "4000")],

  http: [

    ip: if(System.get_env("PHX_LISTEN_ALL") == "true", do: {0, 0, 0, 0}, else: {127, 0, 0, 1}),

    port: String.to_integer(System.get_env("PORT") || "4000")

  ],

  check_origin: false,

  code_reloader: true,

  debug_errors: true,

  @token_prefix "sig_"

  @type ceilings :: %{

          required(:max_total_tokens) => pos_integer(),

          required(:max_calls) => pos_integer(),

          required(:max_cost_microusd) => pos_integer(),

          # nil is a grant with no clock: budget and revocation bound it, time

          # does not.

          required(:max_total_tokens) => pos_integer() | nil,

          required(:max_calls) => pos_integer() | nil,

          required(:max_cost_microusd) => pos_integer() | nil,

          # nil is unbounded, on every one of these. A grant with no ceilings

          # and no clock is bounded by revocation alone, which is what a

          # thread's grant is.

          required(:ttl_seconds) => pos_integer() | nil

        }

    tokens = integer(grant.usage["total_tokens"])

    cost = integer(grant.usage["estimated_cost_microusd"])

    grant.call_count >= grant.max_calls or

      tokens >= grant.max_total_tokens or

      cost >= grant.max_cost_microusd

    reached?(grant.call_count, grant.max_calls) or

      reached?(tokens, grant.max_total_tokens) or

      reached?(cost, grant.max_cost_microusd)

  end

  defp would_exhaust?(%Grant{} = grant, merged) do

    tokens = integer(merged["total_tokens"])

    cost = integer(merged["estimated_cost_microusd"])

    grant.call_count + 1 >= grant.max_calls or

      tokens >= grant.max_total_tokens or

      cost >= grant.max_cost_microusd

    reached?(grant.call_count + 1, grant.max_calls) or

      reached?(tokens, grant.max_total_tokens) or

      reached?(cost, grant.max_cost_microusd)

  end

  # A ceiling that was never set cannot be reached. Comparing against nil would

  # raise in Elixir's term order rather than answer — `1 >= nil` is false, which

  # would have read as "not reached" by accident rather than by decision.

  defp reached?(_spent, nil), do: false

  defp reached?(spent, ceiling), do: spent >= ceiling

  # ── usage accounting (voice Usage pattern) ──────────────────────────────

  @usage_schema "sarah.inference_grant_usage.v1"

    # thread's authority is bounded by budget and revocation, not by how long

    # the reader has been working. A computer-bound delegation still sets one,

    # where the deadline is a security bound rather than a convenience.

    |> validate_required([

      :owner_visitor_id,

      :model_id,

      :token_digest,

      :max_total_tokens,

      :max_calls,

      :max_cost_microusd

    ])

    |> validate_required([:owner_visitor_id, :model_id, :token_digest])

    # A ceiling is optional and nil is unbounded, but a ceiling that is present

    # and non-positive is a grant that could never buy a call.

    # `validate_number/3` does not run on a nil change, so these still hold

    # wherever a figure was given.

    |> validate_number(:max_total_tokens, greater_than: 0)

    |> validate_number(:max_calls, greater_than: 0)

    |> validate_number(:max_cost_microusd, greater_than: 0)

    |> check_constraint(:max_calls, name: :inference_grant_positive_ceilings)

    |> validate_exactly_one_fence()

    |> unique_constraint(:token_digest)

    |> unique_constraint(:thread_id, name: :inference_grants_one_active_thread_index)

  """

  @spec ceilings() :: Inference.ceilings()

  def ceilings do

    # All four unbounded. A thread is bounded by revocation and by the

    # account's credit, and by nothing else: 256 calls, a million tokens, two

    # dollars, and an hour were each reached in an afternoon's work, and each

    # ended a session that had nothing wrong with it.

    %{

      max_total_tokens: setting(:thread_grant_max_total_tokens, 1_000_000),

      max_calls: setting(:thread_grant_max_calls, 256),

      max_cost_microusd: setting(:thread_grant_max_cost_microusd, 2_000_000),

      # No clock. A thread is bounded by the three ceilings above and by

      # revocation; how long the reader has been working is not a bound.

      max_total_tokens: setting(:thread_grant_max_total_tokens, nil),

      max_calls: setting(:thread_grant_max_calls, nil),

      max_cost_microusd: setting(:thread_grant_max_cost_microusd, nil),

      ttl_seconds: setting(:thread_grant_ttl_seconds, nil)

    }

  end

  defp spent(_grant, _key), do: 0

  # An unbounded ceiling has no remainder to report. `null` is what the client

  # already reads for "no limit" in `limits`, and reporting a number here would

  # have meant inventing one.

  defp remaining(nil, _spent), do: nil

  defp remaining(ceiling, spent), do: max(ceiling - spent, 0)

  defp stamp(nil), do: nil

    20260824204740,

    20260824210500,

    20260824230007,

    20260824230730

    20260824230730,

    20260824231951

  ],

  "required_tables": [

    "users",

defmodule OpenAgents.Repo.Migrations.AllowUnboundedInferenceGrants do

  use Ecto.Migration

  @moduledoc """

  Let a grant have no ceiling.

  A thread was minted for 256 calls, a million tokens, and two dollars. A

  coding session reaches all three in an afternoon, and the reply it gets is

  that the thread spent its budget and a new session is needed — the same

  interruption the clock used to cause, arriving by a different route.

  Each of the three ceilings becomes nullable, and nil means unbounded. A grant

  that sets one is still held to it, which is what a computer-bound delegation

  needs: its budget is a security bound, not a convenience.

  The database still refuses a ceiling that is present and meaningless. The

  positivity checks become `IS NULL OR > 0` rather than being dropped, so a

  zero or negative ceiling — a grant that could never buy a single call — is

  as impossible as it was before.

  """

  def up do

    alter table(:inference_grants) do

      modify :max_total_tokens, :integer, null: true

      modify :max_calls, :integer, null: true

      modify :max_cost_microusd, :integer, null: true

    end

    execute("""

    ALTER TABLE inference_grants

      ADD CONSTRAINT inference_grant_positive_ceilings CHECK (

        (max_total_tokens IS NULL OR max_total_tokens > 0)

        AND (max_calls IS NULL OR max_calls > 0)

        AND (max_cost_microusd IS NULL OR max_cost_microusd > 0)

      )

    """)

    execute(guard("IS DISTINCT FROM"))

  end

  def down do

    execute("ALTER TABLE inference_grants DROP CONSTRAINT inference_grant_positive_ceilings")

    execute("""

    UPDATE inference_grants

       SET max_total_tokens = COALESCE(max_total_tokens, 1000000),

           max_calls = COALESCE(max_calls, 256),

           max_cost_microusd = COALESCE(max_cost_microusd, 2000000)

     WHERE max_total_tokens IS NULL

        OR max_calls IS NULL

        OR max_cost_microusd IS NULL

    """)

    alter table(:inference_grants) do

      modify :max_total_tokens, :integer, null: false

      modify :max_calls, :integer, null: false

      modify :max_cost_microusd, :integer, null: false

    end

    execute(guard("<>"))

  end

  # The update guard reads these three columns, and `<>` is NULL when either

  # side is NULL — a NULL predicate is not true, so an unbounded grant's

  # ceilings would have become quietly mutable. `IS DISTINCT FROM` is the

  # null-safe comparison, the same fix `expires_at` needed when it became

  # nullable.

  defp guard(ceiling_comparison) do

    """

    CREATE OR REPLACE FUNCTION sarah_guard_inference_grant_update()

    RETURNS trigger AS $$

    BEGIN

      IF OLD.status <> 'active' THEN

        RAISE EXCEPTION 'inference_grants row % is terminal (%), no update permitted', OLD.id, OLD.status;

      END IF;

      IF NEW.id <> OLD.id

         OR NEW.owner_visitor_id <> OLD.owner_visitor_id

         OR NEW.conversation_id IS DISTINCT FROM OLD.conversation_id

         OR NEW.thread_id IS DISTINCT FROM OLD.thread_id

         OR NEW.machine_id IS DISTINCT FROM OLD.machine_id

         OR NEW.model_id <> OLD.model_id

         OR NEW.token_digest <> OLD.token_digest

         OR NEW.max_total_tokens #{ceiling_comparison} OLD.max_total_tokens

         OR NEW.max_calls #{ceiling_comparison} OLD.max_calls

         OR NEW.max_cost_microusd #{ceiling_comparison} OLD.max_cost_microusd

         OR NEW.expires_at IS DISTINCT FROM OLD.expires_at THEN

        RAISE EXCEPTION 'inference_grants row % has immutable identity/budget fields', OLD.id;

      END IF;

      IF NEW.call_count < OLD.call_count THEN

        RAISE EXCEPTION 'inference_grants row % call_count cannot decrease', OLD.id;

      END IF;

      RETURN NEW;

    END;

    $$ LANGUAGE plpgsql;

    """

  end

end

    {:ok, remaining} = Threads.ceilings(owner.id)

    assert remaining.max_cost_microusd == Credit.remaining(owner.id)

    assert remaining.max_cost_microusd > Threads.ceilings().max_cost_microusd

    # The account's credit is the only ceiling a thread gets. The configured

    # per-thread cost cap was $2 and is now unset, so the cost ceiling is not a

    # cap being raised to the remainder — it is the remainder, and nothing else

    # bounds the thread.

    assert is_nil(Threads.ceilings().max_cost_microusd)

    assert is_nil(remaining.max_calls)

    assert is_nil(remaining.max_total_tokens)

    assert is_nil(remaining.ttl_seconds)

  end

  test "an account with nothing left is refused rather than minted a grant" do

  end

  describe "GET /api/v3/threads/:thread_id" do

    test "reports status and usage against the ceiling", %{conn: conn} do

    test "reports usage, and reports no remainder where there is no ceiling", %{conn: conn} do

      authenticated = put_chat_api_token(conn, "thread-read")

      created =

      assert body["grant"]["status"] == "active"

      assert body["grant"]["call_count"] == 1

      assert body["grant"]["usage"]["total_tokens"] == 15

      assert body["grant"]["limits"]["max_total_tokens"] == Threads.ceilings().max_total_tokens

      assert body["grant"]["remaining"]["calls"] == Threads.ceilings().max_calls - 1

      assert body["grant"]["remaining"]["total_tokens"] ==

               Threads.ceilings().max_total_tokens - 15

      # A thread's grant sets no call or token ceiling, so there is no

      # remainder to count down. `null` is what the client already reads as

      # "no limit"; a number here would have been invented.

      assert is_nil(Threads.ceilings().max_calls)

      assert is_nil(body["grant"]["limits"]["max_total_tokens"])

      assert is_nil(body["grant"]["remaining"]["calls"])

      assert is_nil(body["grant"]["remaining"]["total_tokens"])

      # Cost is still ceiled, at what the account's credit has left, and its

      # remainder is a real figure.

      assert body["grant"]["remaining"]["cost_microusd"] ==

               body["grant"]["limits"]["max_cost_microusd"] -

                 body["grant"]["usage"]["estimated_cost_microusd"]

      refute Map.has_key?(body["grant"], "token")

    end