[TheSentinel454]

Summary

In roster-free communities, every AUTH runs list_never_joined_auto_join_channels to join the caller to the community's default (auto_join) channels. Two changes make that read cheap, plus one recheck that keeps a stale read from joining an unflagged channel.

1. Partial index idx_channels_auto_join on channels (community_id) WHERE auto_join AND channel_type = 'stream' AND visibility = 'open' AND archived_at IS NULL AND deleted_at IS NULL. Without it, the query plans through idx_channels_community_visibility, reads every open channel in the community, and filters nearly all of them away, because default channels are a handful out of thousands. With it, the planner probes only the flagged rows.
2. Read from the bounded replica. Db::list_never_joined_auto_join_channels_routed routes through route_read(.., RoutePredicate::Bounded, ReaderOperation::Authorization), the same as pending_default_channel_join_routed. A replica error falls back to the writer, and a cancelled statement propagates. The only production caller, join_never_joined_channels in side_effects.rs, uses it. With no replica budget configured, it reads the writer as before.

Why a stale read is safe

put_first_member decides on the writer, under the channel's membership lock, so a stale candidate list cannot cause a wrong join:

• A channel the replica still lists as unjoined is skipped when a membership row already exists.
• A channel unflagged within the replica budget is skipped. put_first_member now rechecks auto_join under the lock. Both of its callers are default-channel joins.
• A channel archived or made private within the budget is refused by put_member and counted in buzz_auto_join_failures_total, as today.
• A channel flagged within the budget is joined on the next admission.

Database review checklist (docs/database.md)

• Phase: expand only. Nothing comes before it. Nothing needs to follow: the deployed relay's query uses the index as soon as it exists.

• No trigger, function, procedure, rule, or foreign key is added.

• No migration mutates existing rows, and there is no backfill.

• Not a contract migration.

• Rule 4 locations: migrations/0087_channels_auto_join_index.sql and schema/tables/public/channels.sql. admin_schema_parity_between_desired_state_and_migrations now compares idx_channels_auto_join alongside idx_channels_listed_name, between the desired-state and migrated catalogs. No new files, so schema/schema.sql is unchanged. A partial btree index needs no reconcile-schema-after-pgschema.sql step.

• Deployed relay: the index is additive and the SQL text is unchanged. The running relay ignores it or uses it. Its plan was checked with EXPLAIN on a migrated database (below).

• Locks and build: SET LOCAL lock_timeout = '1s' and statement_timeout = '5s'. The migration builds the index inline only when to_regclass finds none, then verifies pg_get_indexdef and indisvalid/indisready/indislive, and stops if the definition differs. Prebuild for deployments that apply migrations out of band (in the migration header):

  CREATE INDEX CONCURRENTLY idx_channels_auto_join ON public.channels (community_id)
    WHERE auto_join AND channel_type = 'stream' AND visibility = 'open'
      AND archived_at IS NULL AND deleted_at IS NULL;

Migration number

0087. Main is at 0086. #9108 (#9108) also needs new numbers. Whichever PR merges second renumbers.

Tests

• never_joined_auto_join_channels_routed_reads_the_bounded_replica (buzz-db, postgres_tests) seeds a writer and a replica with different default channels. It asserts the writer's channel with no budget, the replica's with a 5 s budget, and the writer's again when the replica fence is stale. A mutant that always reads the writer fails it.
• embedded_migrator_contains_consolidated_initial_schema pins the migration count, the timeouts, and the absence of CONCURRENTLY.
• The parity test covers the new index.
• first_member_put_joins_once_and_never_undoes_a_leave now also asserts that put_first_member writes nothing for a channel that is not, or is no longer, auto_join.
• auto_join_index_migration_accepts_a_prebuild_without_waiting_for_writers runs 0087 over a concurrent prebuild while a channel writer holds its lock: it neither waits nor replaces the index. migration_schema_listed_name_index_validates_a_prebuild now stops at 0083, since later migrations that build their own index inline need the lock it holds.
• On a fully migrated scratch database, re-running 0087 against an existing index succeeds, and running it against a wrong-definition index stops. EXPLAIN of the query, as both a custom and a generic (prepared) plan, uses idx_channels_auto_join.

What got simpler

Nothing was removed, but the concept count stays flat. The routed method replaces the writer-only Db method instead of sitting beside it. Both arms share one connection-level helper, so the SQL lives in one place.

🤖 Generated with Claude Code

[github-actions]

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

• Exact PR diff: 96af488d968a1ae9d961c2132bea27822735f8da...99c07da83aee4d72cf97199b2363923e93f29ca4
• Model: gpt-6.1-sol

💡 Click "edited" above to see earlier reviews for this PR.

---

Review Summary

Overall Risk: NONE

No concrete findings in the authorized PR range. Replica routing preserves community scoping, and writer-side locks and validation protect default-channel membership changes.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

• Review used read-only source and history inspection. Builds, tests, and database execution were not performed.

---

_{Generated by Codex Security Review |
Requested by: @TheSentinel454 |
Workflow run}