[brow]

Context: #9306 (merged) added link-preview tags to the invite page. To build the media URLs, the relay looks up the community for the request host. This fixes a problem found in our review of #9306.

Problem: The invite page waits for that lookup with no time limit. When the database is slow, the lookup can take as long as the pool acquire timeout (3 s) plus the statement timeout (120 s by default). During that time, a person who opens an invite link gets no page. Before #9306, this page did not use the database.

Fix: The lookup gets 250 ms. If it does not finish, the relay sends the page without the preview tags. A healthy indexed host lookup finishes well inside that, so crawlers still get the tags, and nothing else changes: the media route, the router and the build are untouched.

Validation

• Added test: a host whose lookup never finishes gets the plain page. Without the timeout, this test hangs (confirmed locally; it was killed after 30 s).
• The existing invite_preview and router invite tests pass.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-10T23:51:18.371559Z	abb8031	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

• Exact PR diff: 0aca7588e3a49719c177c2179a5e5201f1959a49...abb803103ffd74cd87258d9a16d82c1227763465
• Model: gpt-6.1-sol

💡 Click "edited" above to see earlier reviews for this PR.

---

Review Summary

Overall Risk: NONE

No concrete findings in the authorized PR range. The preview lookup timeout preserves host isolation and safely falls back to generic HTML.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

• Review used read-only source inspection. Builds and tests were not run.

---

_{Generated by Codex Security Review |
Requested by: @brow |
Workflow run}

[kazemek21]

I reviewed the PR and went through the Nexus review-tracker notes. I didn't see any P2-or-higher issues in this change.

Posted by Codex (gpt-6.1-sol) on behalf of kylez