Summary

• connectionHandlerHook awaited getThreadCount() , an unbounded select+dedupe across crm_email_events/crm_events , on every Google sign-in (not just first-time connections), blocking the /api/auth/callback/google response.
• When that query ran slow (chronic 20-118s spikes over the last 2+ weeks per Axiom), the response blew past the client's connection patience (~60s). The browser silently retried the identical callback URL, and the retry replayed an already-consumed OAuth state/code , failing as a confusing state_mismatch for real users (cedarcopilot.com, warp.co, greptile.com) on 2026-09-18.
• Confirmed at the network layer via ALB access logs: elb_status_code=460 (client closed the connection) followed, in the same instant, by an identical-URL retry that got a real 302 state_mismatch response 242ms later.

Changes

• Extract the initial-sync-trigger logic into auth-initial-sync.ts and call it fire-and-forget (void, never await) from connectionHandlerHook, so nothing in this path can block the callback response regardless of query latency.
• Replace getThreadCount (unbounded select + JS Set dedupe) with hasSyncedThreads (LIMIT 1 existence check) in services/mail/threads/get.ts , its one caller only ever checked === 0.
• Reword the state_mismatch login error copy , it blamed the browser for dropping a cookie, which is rarely the actual cause.

Full investigation (Axiom traces/logs + ALB access logs, code walkthrough, decision points) in apps/server/src/lib/BUGREPORT-oauth-callback-getthreadcount-timeout.md.

Test plan

• New tests: apps/server/src/services/mail/threads/__tests__/get.test.ts, apps/server/src/lib/__tests__/auth-initial-sync.test.ts , both fail against the pre-fix code (missing export / unbounded query), pass after the fix.
• apps/server/src/lib/__tests__/auth-connection-cleanup.test.ts and auth-callback-logging.test.ts (neighboring auth-hook tests) still pass.
• pnpm --filter @zero/server run types clean.
• Verify in prod after deploy: no further state_mismatch failures correlating with slow crm_email_events queries in Axiom.

🤖 Generated with Claude Code

Confidence Score: 4/5

The behavioral fix appears sound, but the explicit repository requirement against TypeScript assertions must be satisfied before merging.

Findings

1.  Production Hook Remains Untested ▶
2.  Tests Suppress Type Checking ▶

### Issue 1
apps/server/src/lib/__tests__/auth-initial-sync.test.ts:54
This test calls the helper with `void` itself instead of exercising `connectionHandlerHook`. It would therefore still pass if the production call at `auth.ts:289` changed back to `await`, reintroducing the slow OAuth callback without any test failure. Add coverage around the production hook, or extract its invocation into a directly testable function whose settlement can be checked while `hasSyncedThreads` remains pending.

Note: If this suggesti