enum variants

_database/sql/migrations/2026-09-25-120000-0000_create_user_login_challenges/up.sql

@@ -28,7 +28,8 @@ CREATE TABLE user_login_challenges (
   -- UserLoginChallengeStatus: pending, approved, redeemed, failed.
   -- Only pending may be approved/declined. Only approved may mint a session.
   -- Expiry is checked independently of status on EVERY approval/redemption request.
-  status VARCHAR(16) NOT NULL DEFAULT 'pending',
+  -- Application inserts explicitly bind UserLoginChallengeStatus::Pending.
+  status VARCHAR(16) NOT NULL,
 
   -- The authenticated web user who approved OR declined. NULL until a decision.
   -- On approval this becomes the immutable owner of the session to be minted.

_database/sql/migrations/AGENTS.md

@@ -24,6 +24,11 @@ These are created with the `diesel` tool, and in particular:
 
 - Primary key `id` columns must be `BIGINT(20) UNSIGNED NOT NULL AUTO_INCREMENT`. Do not use signed IDs.
 - Always create tables with `ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin`.
+- Application-owned state/status/type columns must not have schema defaults. Use
+  `NOT NULL` without `DEFAULT` when required, and have application inserts explicitly
+  supply the value. Document the corresponding Rust enum; application queries bind its
+  variants instead of hardcoding enum strings in SQL. See
+  `crates/schema/database/mysql_queries/AGENTS.md` for the query rules.
 - All SQL files should start with the standard IntelliJ noinspection comments:
   ```sql
   -- noinspection SqlDialectInspectionForFile

_database/sql/migrations_squashed/AGENTS.md

@@ -13,6 +13,9 @@ Update the corresponding squashed file whenever a migration changes a table's sc
 
 - Primary key `id` columns must be `BIGINT(20) UNSIGNED NOT NULL AUTO_INCREMENT`. Do not use signed IDs.
 - Always create tables with `ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin`.
+- Application-owned state/status/type columns must not have schema defaults. Required
+  values stay `NOT NULL` and are supplied explicitly by application code using the
+  corresponding Rust enum. Keep these definitions consistent with the applied migrations.
 - All SQL files should start with the standard IntelliJ noinspection comments:
   ```sql
   -- noinspection SqlDialectInspectionForFile

_database/sql/migrations_squashed/user_tables/user_login_challenges.sql

@@ -28,7 +28,8 @@ CREATE TABLE user_login_challenges (
   -- UserLoginChallengeStatus: pending, approved, redeemed, failed.
   -- Only pending may be approved/declined. Only approved may mint a session.
   -- Expiry is checked independently of status on EVERY approval/redemption request.
-  status VARCHAR(16) NOT NULL DEFAULT 'pending',
+  -- Application inserts explicitly bind UserLoginChallengeStatus::Pending.
+  status VARCHAR(16) NOT NULL,
 
   -- The authenticated web user who approved OR declined. NULL until a decision.
   -- On approval this becomes the immutable owner of the session to be minted.

_database/sql/user_login_challenges.md

@@ -17,7 +17,8 @@ It is an ArtCraft session bridge, not an OAuth token endpoint implementation.
 
 1. `2026-09-25-120000-0000_create_user_login_challenges` creates the challenge and
    its terminal outcome audit record together. A separate failure table is not
-   needed for one immutable outcome per attempt.
+   needed for one immutable outcome per attempt. Status is `NOT NULL` without a
+   default; inserts explicitly bind `UserLoginChallengeStatus::Pending`.
 2. `2026-09-25-120000-0001_alter_user_sessions_add_maybe_creation_type` adds nullable
    provenance to cookie sessions. Existing rows and older writers retain NULL.