#96 Improve database work claiming, numeric handling and JWT configuration

Upstream Updates

• Rebuild JWT signing configuration on first use after boot-time settings change. Setting an algorithm before its keys now works, while invalid configuration remains a configuration error. Preserve parsed-key reuse, custom constraints and verification-only providers.
• Document AI stopping middleware, classification model selection and the sub-agent approval limitation, retaining Hypervel's batched streaming updates.
• Explain MCP OAuth registration and Hypervel's automatic rate limiting, and warn against user-selected upload filenames and embedded code in otherwise valid images.
• Document initial Inertia page preloading and limiting Link headers, with Hypervel middleware and reverse-proxy examples.

Additional Hypervel Fixes

• Add fluent skipLocked() support and connection-owned capability detection. Queue and outbox workers can skip locked rows on supported databases without duplicating version checks.
• Apply supported index hints to writes and retain outbox ownership and eligibility conditions when claiming or deleting records. Keep claims bounded instead of broadening the locked selection.
• Preserve coroutine cancellation through transaction callbacks, pruning and pooled-connection cleanup, including cancellation carried by a cleanup exception.
• Restore cached in-memory SQLite databases through the physical test pool before installing refresh hooks. Document the single-session limit of in-memory SQLite pools.
• Preserve exact numeric tokens when decoding JSON. Bound scientific-notation exponent expansion in decimal casts and numeric validation while retaining ordinary decimal precision and consistent compiled-validation behavior.
• Add configurable releasePadding() to rate-limited queue jobs, preserving explicit retry delays.
• Clear stale Eloquent cast caches when raw attributes are replaced, preserve immutable date return types, and correct model-specific builder, collection and paginator types.
• Record the separate cancellation audit and dependency follow-ups, and document the new database and queue behavior.

Affected tests, source and type-fixture analysis, skeleton analysis and formatting pass. The JWT setter regression fails before the correction and passes afterward. The full suite and database matrix run in CI.

---

Summary by cubic

Syncs upstream changes and fixes database work claiming, numeric handling, pooled SQLite testing, and JWT configuration.

Database, queue, and numeric fixes

• Adds fluent skipLocked() plus connection-owned supportsSkipLocked(), replacing the retired lock-for-popping helper.
• Rewrites outbox claims to lock only candidate IDs, keep eligibility and ownership conditions bounded, apply index hints to writes, and retry InnoDB transactions up to three attempts.
• Carries coroutine cancellation through pool teardown, connection acquisition, transaction callbacks, pruning, and cleanup failures, while preserving secondary cleanup errors.
• Restores pooled in-memory SQLite databases before refresh hooks register, and rejects restoration while a pooled session is still borrowed.
• Preserves exact JSON number tokens and bounds scientific-notation exponents to ±1000 in decimal casts and validation.
• Adds configurable retry padding to rate-limited queue jobs.
• Clears stale cast caches on raw attribute replacement and corrects Eloquent builder, collection, and paginator types.

JWT and docs

• Rebuilds JWT signing configuration lazily on first use so setting an algorithm before its keys works; invalid configuration still errors.
• Documents AI stopping middleware, classifier model selection, MCP OAuth rate limiting, Inertia page preloading, and upload filename risks.

[!NOTE]

Improve database work claiming, numeric handling, and JWT configuration

• Reworks outbox and database queue claiming to use a connection-level supportsSkipLocked() capability check plus ID-restricted claim queries in DatabaseOutboxRepository.php and DatabaseQueue.php; adds a skipLocked() query builder API and SKIP LOCKED SQL compilation for MySQL and PostgreSQL grammars
• Adds index-hint compilation for MySQL and SQLite delete queries, so forced indexes now appear on delete targets
• Guards numeric validation and decimal casting against scientific-notation exponents outside the -1000 to 1000 range; out-of-range inputs throw MathException or fail validation rather than propagating brick/math errors
• Makes the JWT Lcobucci provider build its configuration lazily, invalidating the cached config on setting changes; adds a releasePadding option (default 3 seconds) to the queue RateLimited middleware
• Replaces direct CanceledException checks with Coroutine::causedByCancellation() across database, pool, and transaction code, so cancellation wrapped inside cleanup exceptions propagates correctly
• Adds Json.decodeNumbersAsStrings() and pooled in-memory SQLite PDO restoration for testing traits (RefreshDatabase, LazilyRefreshDatabase, DatabaseTruncation)
• Behavioral Change: size-message validation returns the trimmed input when getSize() throws MathException; MySQL-family ID-restricted queries now apply a PRIMARY index hint; setting a string lock clause after skipLocked() (or vice versa) throws InvalidArgumentException; queue retry delays gain 3 seconds of padding by default

^{Macroscope summarized f32b84a.}

Summary by CodeRabbit

• New Features

  • Added support for skipping locked rows in database queries and applying index hints to supported write queries.
  • Added configurable padding to rate-limited queue retry delays; explicit retry delays still take precedence.
  • Added JSON decoding that preserves numeric tokens as strings. JWT configuration changes now take effect on subsequent use.

• Bug Fixes

  • Improved cancellation handling during database operations and queue processing, including wrapped cancellation errors.
  • Decimal casts now reject scientific-notation exponents outside ±1000, and numeric validation handles these values more consistently.
  • Improved restoration of pooled in-memory SQLite databases during tests.

• Documentation

  • Expanded guidance for page-asset preloading, AI agent controls, database locking, and safe file uploads.