Ecto 3.9

Apply the Elixir 1.20 and Erlang/OTP 29 prompts first. These rules cover Ecto 3.9 with Ecto SQL 3.9 and Postgrex: changesets, queries, repositories, transactions, tenancy, database connections, and migrations.

Changesets

• Spell out the permitted fields of each cast/4 call as a literal list, with one changeset per role or form. Don't take the list from params keys, __schema__(:fields), or other request data.
• Keep tenant, owner, role, price, balance, and approval fields out of user-facing cast/4 lists and set them from the authenticated context. Ecto 3.9 has no read-only field option, so test that forged values in an update don't stick.
• Use change/2, put_change/3, force_change/3, and put_assoc/4 only with server-built data, because they don't cast or filter fields.
• Set redact: true on secret-bearing fields so struct and changeset inspection hides them; SQL logs and telemetry still carry the raw values.
• Cast children with cast_assoc/3 or cast_embed/3 and an explicit :with changeset, after preloading only children the current user may edit. With on_replace: :delete or :delete_if_exists, any preloaded child missing from the params is deleted, so use those modes only where the user may delete every child in the set.
• Back unsafe_validate_unique/4 with a unique index and unique_constraint/3, because the pre-check races. Give it a tenant-scoped :query when uniqueness is per tenant, or it matches other tenants' rows.
• Bound numeric input with validate_number/3; integers already decoded from JSON reach casting at any size. On Ecto