Summary

Fixes the 5 Greptile findings surfaced on #2838 (staging→main), per Isabelle's request to fix them in their own PR while #2838 itself merges.

🔴 P1 , Account unlink removes records

CrmAgentBadge.tsx/crm.ts: unlinking the account on a conversation that also had a real recordId link (a Lead/Partnership, which , like an account-only placeholder , has no dealId) silently deleted that record link too. Fixed on both sides:

• Frontend: the account row's unlink button now hides whenever hasRecord is true, mirroring the existing hasDeal rule.
• Server: the filter logic (extracted into filterIntegrationMetadataForUnlink, now directly unit-tested) requires neither dealId nor recordId before removing an entry as a "placeholder."

🔴 P1 , Backfill cannot pass caps

backfill-crm-object-records.ts: the repeat-until-exhausted loop's fetch is a fixed-size, sorted-newest-first, since-bounded query with no upper-bound cursor. Once the true total exceeds one fetch's cap, older records are permanently unreachable , every repeated pass returns the identical top-N and the script declared success.

• Added possiblyCapped to DiscoverNewDealsResult: true when records were found but all were already linked (not proof of exhaustion).
• Added two real, safe levers: maxPages (HubSpot's getAllDeals already supports this , just never threaded through) and unclampedMaxDeals (the 500-per-pass ceiling exists to protect the on-demand chat tool from an unbounded burst, not a deliberate backfill run).
• The script now exits non-zero and tells the operator exactly what to do (raise --fetch-max-pages for HubSpot, or re-run with an earlier --since for Salesforce/Attio, which have no page-count lever) instead of silently claiming victory.

🔴 P1 , Conversions include non-Deals

deal-metrics.ts's aop_conversion classifier collapsed "AOP resolved with no object binding" (Spam, Vendor, any unbound AOP) and "deleted/unresolvable AOP id" into the same value as the true Deals AOP , so a Lead-bound conversation moved to Spam counted as a 100% conversion. classifyAopForConversion now only returns 'deal' for an explicit Opportunity binding or the implicit default (no binding, named literally "Deals"); everything else is 'unknown', never a conversion target.

🟡 P2 , Validate metadata at boundary

process-external-crm-sync.ts cast connectionMetadata: unknown directly. Added a real isRecord type guard.

🟡 P2 , Use shared form controls

crm-integration-card.tsx's new AOP picker manually composed Label + Select instead of the shared form-kit. Rebuilt with SelectField/FieldRows.

Test plan

• pnpm --filter @zero/server run types clean
• pnpm --filter @zero/mail run types clean (touched files)
• pnpm dlx oxlint --deny-warnings clean
• pnpm deps:check clean
• 3207 tests passing across crm/cron/trpc/aop/integrations, including 17 new tests directly pinning findings 1-3 (filter logic, possiblyCapped/maxPages/unclampedMaxDeals, and the Spam/Vendor/deleted-AOP conversion regression)

🤖 Generated with Claude Code

Confidence Score: 3/5

The PR is not safe to merge until the backfill can distinguish successful exhaustion from a capped response and provides recovery controls that actually advance every supported provider path; the explicit fixture-typing rule must also be satisfied.

Findings

1. <img alt="P1" src="h