Ecto 3.11

Apply the Elixir 1.20 and Erlang/OTP 29 prompts first. These rules cover Ecto 3.11 with Ecto SQL 3.11 and Postgrex: changesets, queries, repositories, transactions, tenancy, database connections, and migrations.

Changesets

• List the permitted fields in each cast/4 call explicitly, one changeset per form or role. Don't derive the list from params keys, __schema__(:fields), or other request input.
• Keep tenant, owner, role, price, balance, and approval fields out of every user-facing cast/4 list. Ecto 3.11 has no read-only field option, so set them from the authenticated context and check in tests that an update with forged values leaves them unchanged.
• Use change/2, put_change/3, force_change/3, and put_assoc/4 only for server-built data; they neither filter nor cast.
• Set redact: true on secret-bearing fields so inspected structs and changesets hide them. SQL logs and telemetry still carry the raw parameter values.
• Cast associations and embeds through cast_assoc/3 or cast_embed/3 with an explicit :with changeset, after preloading only children the current user may edit. on_replace: :delete or :delete_if_exists deletes any child the params omit, :drop_param lets the request pick children to delete, and :sort_param creates entries for unknown indexes; enable each only where the user may make those changes.
• Back unsafe_validate_unique/4 with a unique index and unique_constraint/3, since the pre-check races. For per-tenant uniqueness, give it a tenant-scoped :query so it doesn't match other tenants' rows.
• Bound numeric input