[matt2e]

Summary

New members land in the community's default channel instead of an empty Messages view.

• Relay metadata: parse the bare auto_join tag the relay advertises on 39000 channel metadata.
• First channel: with no saved selection, Messages opens the first auto_join channel, then the first non-Solo channel. An explicit empty route still bypasses both.
• 9021 fallback: the relay normally adds new members to auto_join channels during the invite claim. features/channels/default-channels.ts covers open or old relays and failed adds. Once the live roster is verified and empty, it sends one kind 9021 join per flagged public channel. It runs at most once per community, viewer and device, tracked by a default-channels view-state marker.
• Auto-join new members switch: owners and admins get this switch in channel settings for active public stream channels. It publishes a narrow 9002 with auto_join=true|false through the existing lifecycle route. The UI confirms the result from the republished 39000. The Rust validator and the development broker now accept that exact two-tag shape alongside archived.
• Docs: docs/channels.md and docs/communities.md.

Validation

• Colocated Vitest coverage: the fallback (default-channels.test.ts), lifecycle commands, discovery parsing, store selection, the ChannelsPage tab choice and the settings switch.
• Rust boundary tests cover both flags, malformed shapes and cross-route signatures.
• Pre-push hooks passed: types, related unit tests, design-system and clippy.

Deferred

• No run of the installed desktop build against a live relay yet. The native auto_join path needs a rebuilt binary.
• Human testing is still pending.

Related

• Relay half (buzz): feat(relay): auto-join new community members to default channels buzz#8594

Demo

Recorded against a local relay built from this branch with throwaway identities (Alice = owner, Bob = new member); no real accounts or hosted relays involved. Client at bb0d97d (browser dev build), relay at buzz 141aa01d4.

Owner turns on "Starter channel for new members" on two channels. Alice creates #general and #welcome, then flips the switch on each (~0:25 and ~0:41). The switch greys out while the kind 9002 is in flight and only turns on once the republished 39000 carries the auto_join tag.

two-starter-channels-owner-flags.mp4

A brand-new member joins and lands in a starter channel. Bob claims Alice's invite with empty storage; from ~0:18 he is reading #welcome with both #general and #welcome in the sidebar, and at 0:27 opens #general as a member with no Join prompt. The relay logged one auto-joined default channel line per flagged channel.

two-starter-channels-new-member-lands.mp4

🤖 Generated with Claude Code

[wesbillman]

🤖 Carl, an automated reviewer, commenting via Wes's GitHub account.

Verdict: two recommended blockers, both in the 9021 fallback in default-channels.ts. The relay contract half holds up: the two-tag 9002 shape matches block/buzz#8594 across the TS validator, the browser broker and the Rust lifecycle route, the readback matches the bare 39000 tag, and the fallback can't reach private or archived channels. First-channel selection also held up when we tried to make it latch onto a channel whose metadata was still pending.

Validation gaps

• The fallback tests keep list() empty across invocations, so nothing covers a second run after a partial success.
• The switch is only tested as a component with a mocked lifecycle and membership. No page journey covers the membership wiring in index.tsx/ChannelsPage.tsx, or 9002 → republished 39000 → switch shows on.
• As the PR says, there's no native build or live-relay run yet.

Exit criteria: the two blockers are addressed, or Wes/the author explicitly accepts the re-add behavior; plus one test that runs the fallback twice with the first join's membership retained. The other inline comments are optional.

Reviewed at 2d3a7e7c4 against block/buzz#8594 at 502d0160. Hosted CI was green; we ran no suites locally.

[wesbillman]

Low (optional, product): an archived or private starter channel can't be un-flagged from the UI. block/buzz#8594 keeps the stored auto_join when a flagged channel is archived or made private, and rejects only Some(true) there, so auto_join=false is accepted. Here flaggable() rejects both directions on a non-active channel, and the switch is hidden for archived and private channels (ChannelSettingsPanel.tsx:199-202). An admin who archives a starter #general to retire it, and later unarchives it, finds new members being auto-joined again. The switch does show on after the restore, but nothing warns at archive time.

Fix: let auto-join-off skip the active-public check, and either offer an off-only switch on archived/private channels or mention it in the archive/private confirm copy. Document it in docs/channels.md either way.

[delkc]

From a UX perspective, this looks good to me! I was going to work on the starter channels settings as I was going through those, so it's super helpful to get that built in here.

I also think this can work with the changes I'm proposing to onboarding with a default agent (instead of Fizz and co). In that flow, there's a generic agent that you customize as part of the onboarding experience, and then it gives you options for next steps. Initially, we had "Ask about this community" but it could actually be more specific to the starter channels and then get you into those more actively.

[wesbillman]

🤖 One new P2 is inline; the prior fallback blockers and the timestamp, error-copy, and definition-list fixes are addressed in source.

Star Lord’s automated follow-up via Wes’s account, with independent Rocket, Mantis, and Groot coverage. Reviewed head 4ee6c825a46b517da1e692d42957065f3c9c72a4 against base 11dd17bb7775a2932ca2466235354105edf2041b. No code, tests, or apps executed; CI, native behavior, and live-relay acceptance remain unverified. The two demo videos were inspected through sampled frames only.

[kalvinnchau]

🤖 One additional leave-preservation defect remains on the unconfirmed publication path.

[wesbillman]

🤖 One new P2 is inline: a cancelled native fallback can overwrite its successor’s completed state and later rejoin a channel the member left. The prior persistence finding is fixed.

Star Lord’s automated follow-up via Wes’s account, with independent Rocket, Mantis, and Groot coverage. Head c89e511a9bafec582e5f59f98876455844a2b4a3, base 11dd17bb7775a2932ca2466235354105edf2041b. Source-only: no tests or apps executed; CI was still running, native/live-relay acceptance remains unverified, and demo inspection used sampled frames only.

[wesbillman]

🤖 One P2 remains in the fallback’s leave-preservation contract: the revision guard can discard a late settlement when its successor makes partial progress (inline). The overwrite of a successor’s done marker is fixed.

Star Lord’s automated source review via Wes’s account, with independent Rocket, Mantis and Groot coverage. Head f83e506628f403e3a3e50498f037940a97d37d3b, base 11dd17bb7775a2932ca2466235354105edf2041b. No tests or apps executed; CI was running, native/live-relay acceptance remains unverified, and demo inspection used sampled frames only. The latest commit reports skipped hooks and no local test run.

[kalvinnchau]

🤖 One confirmed P2 remains: overlapping fallback runs can discard a settled join and undo a later explicit leave. Added Chromium/WebKit reproduction evidence and the equal-value revision ordering to the existing anchored finding: #1624 (comment). Fix before merge; no duplicate finding opened.

[wesbillman]

🤖 No changes requested on this follow-up. The prior late-settlement finding is addressed: each result removes only its channel from the current owed set, and the added regressions cover partial-successor, equal-value, and settled-meanwhile orderings.

Star Lord’s automated source review via Wes’s account, with independent Rocket, Mantis and Groot coverage; head d8a397b4cb067f08b413e4ff57e4d5ae80892e74, base 11dd17bb7775a2932ca2466235354105edf2041b. No tests or apps executed; CI was still running, the latest commit reports skipped hooks, and native/live-relay acceptance remains unverified. The two demo videos were not re-inspected this cycle.

[kalvinnchau]

🤖 The prior same-context settlement finding is addressed in Chromium and WebKit app/broker reproductions. Remaining observations below distinguish a modeled cross-window race from a reproduced retry delay and a regression-test gap.

[wesbillman]

🤖 No changes requested on this follow-up: scoped Web Locks, post-read reconciliation, and the three-channel regression address the prior observations without a new source-demonstrated defect.

Star Lord’s automated source review via Wes’s account, with independent Rocket, Mantis and Groot coverage, at head 997028b70eaf7a3796d76b0542172048d9a1095b / base 11dd17bb7775a2932ca2466235354105edf2041b. Source only: no tests or apps run; cross-window/native behavior remains unverified despite the successful CI-required snapshot. Both demo attachments returned HTTP 403 and were not inspected.

[kalvinnchau]

🤖 Two remaining findings: a delayed automatic join can reverse Leave, and the lock regression does not detect stale reads.

[wesbillman]

🤖 Star Lord’s automated source review via Wes’s account: no changes requested for this follow-up. The post-signing owed-marker guard addresses the delayed-join case, and the added regressions cover signing and lock-wait ordering. Reviewed with Rocket, Mantis and Groot at head ee28f50b9ffa8783fa15d158193a19bc8be0c2a7, base 11dd17bb7775a2932ca2466235354105edf2041b. Source-only: no tests/apps executed or CI assessed; native/cross-window behavior and both demo videos remain unverified.

[kazemek21]

Posted by Codex (gpt-6.1-sol) on behalf of kylez

[kazemek21]

[P2] Preserve explicit Leave during the initial directory read

A fresh claim can successfully add general, but if the member leaves while the first defaultChannels() request is pending, its post-wait membership filter returns general as missing. This branch then records it as owed and rejoins it, undoing Leave. Could explicit Leave exclude that channel from the admission's pending/owed work, including before the first snapshot? A deferred-directory-read regression would cover this ordering.

Posted by Codex (gpt-6.1-sol) on behalf of kylez

[wesbillman]

🤖 Carl, an automated reviewer, commenting via Wes's GitHub account.

Confirmed at ee28f50, and the window is wider than the initial read. While the marker is pending, the first snapshot owes every flagged channel the member isn't in at that moment. So a Leave made any time before the first successful snapshot gets undone:

• Same session, remount: the signed Leave revokes access, which cancels the in-flight directory read. pending stays, and the next mount or reconnect owes the channel and calls join. We reproduced this through the real session, store and fallback, with a stub lifecycle writer.
• Across devices (source trace): on A, claim (joined) and stop at the profile step. On B, finish joining (already_member) and leave #general. Then finish setup on A, or open its Messages later. The first run on A rejoins #general.

Moving the authorized filter ahead of the wait only fixes the first ordering. The fix belongs in the marker: once a member leaves a channel, keep it out of admission work whether the marker is pending or owed. For example, the Leave path could record the excluded id in the marker, or the marker could exclude channels left since the claim. A harness-level regression that fails at head:

it("preserves Leave while the first directory read is pending", async () => {
  const reading = gate();
  const answer = gate();
  const h = harness({ joined: ["general"], ids: ["general"] });
  h.defaultChannels.mockImplementationOnce(async () => {
    reading.open();
    await answer.opened;
    return h.read();
  });
  const run = h.ensure();
  await reading.opened;
  h.leave("general");
  answer.open();
  await run;
  expect(h.joins()).toEqual([]); // fails at head: ["general"]
});

[wesbillman]

🤖 Carl, an automated reviewer, commenting via Wes's GitHub account.

Verdict: one recommended blocker. kylez's open P2 reproduces at ee28f50: an explicit Leave can be undone, and the window is wider than the first directory read. Evidence and a failing regression are in that thread. The relay contract matches block/buzz#8594 at 6133881: the narrow 9002 auto_join shape, the native and broker validators, and the bare 39000 readback. Owed-set settlement, role gating, first-channel selection and the joined-only marker also held up. One optional copy note is inline. Wes's earlier r4379494712 (a flagged archived or private channel can't be un-flagged from the UI) is still open.

Validation gaps

• No test leaves a channel before the first snapshot.
• There's no native build or live-relay run yet, as the PR notes.
• The per-channel monotonic created_at holds only within one lifecycle owner, since windows and replacement sessions don't share it. We found no failure from that.

Exit criteria: a Leave made before the first snapshot stays left across a remount and on another device, with a regression test for it. Alternatively, Wes or the author explicitly accepts the behavior.

Reviewed ee28f50b9 against main at 511e1568b. Hosted CI is green. Court probes were focused tests only; we didn't rerun the broad suites.

[wesbillman]

🤖 Optional (copy): the relay only adds members at an invite claim or a kind 9030 add (block/buzz#8594 side_effects.rs). docs/channels.md in this PR also says open communities get no auto-join. An owner of an open community can turn this on and see nothing happen. Consider wording like "Members who join with an invite are added to this channel automatically."