Summary

Five independent changes, each small and independently tested.

The signup gate. Cedar is a work-mail product, but the gate enforcing that sat on hooks.before matching /sign-up , a route nobody reaches, because everyone signs in through the Google OAuth callback, which has no address until it has exchanged the code. The gate moves to databaseHooks.user.create.before, where every creation path converges. An org that has registered the domain still outranks the block, and CEDAR_SIGNUP_EMAIL_ALLOWLIST keeps Google's OAuth app-verification reviewers (who test from a gmail.com mailbox) able to register.

Verified it does not break adding a personal Gmail as a second inbox: both connect surfaces use authClient.linkSocial, which takes better-auth's link branch and never reaches createOAuthUser.

agent_tool_calls bounds + retention. The table is 22 GB of a 46 GB database, 18 GB of it TOAST, 4.85M rows, and nothing ever removed one. Payloads are now bounded at the write (4k chars / 50 items / 64 KB), and a dry-run-by-default pruner blanks reconstructable context-loading results at 30d and deletes at 90d. draft-email is exempt from both, because two admin routes render those payloads back as a user's complete draft history on an unbounded window.

CRM index usage. dealWasSyncedRecently and findOrCreateExternalCrmEvent filtered external_crm_data->>'dealId', which is opaque to the planner, so idx_ccu_user_object_deal_id was only usable to its first two columns. Measured in production: 42,169 heap rows fetched to return 2, at 27,874 ms, against 51 ms written against the promoted columns. Confirmed the columns are fully backfilled (migration 0003 + zero divergence in live data) before switching.

Excel export sets wrapText, so multi-line cells stop arriving looking flattened.

Agent avatar gains a working state , the face shrinks into the middle dot of a typing indicator rather than cross-fading to separate chrome , and replaces TabBotIcon in the chat tab strip.

Also includes three prior graph commits already on the branch.

Review

The findings worth naming:

• Truncation was clipping the rows retention exists to preserve. draft-email was exempt from pruning but not from the new write-time truncation , a body over 4k was clipped and a payload over 64 KB collapsed to a summary dropping subject and recipients. Unlike a delete, a clip at write time cannot be undone.
• Retention rewrote rows it was about to delete. The blank window is open-ended, so blanking first rewrote every row past the delete cutoff , TOAST and WAL included , moments before deleting it. Now runs delete-first.
• The allowlist never reached the deployed services, which is the one environment it exists for.
• The survey lied about what it would do, labelling blank-result for rows step 2 deletes. It now shares predicates with the steps, so it cannot disagree with them.

Declined, with reasons: relative imports in apps/server/scripts/ (every script in that directory does this; it sits outside the src alias root) and rounded-sm (302 uses against 2 for rounded-xs , it is the repo's normal utility).

Test plan

Every CI job run locally after merging origin/staging (55 commits):

• autofix , check-brand-assets ✅ · oxlint@1.78.0 --deny-warnings ✅ · deps:check ✅ (no violations, 10,177 deps)
• Typecheck (tsc) , turbo run types ✅, non-incremental (.tsbuildinfo cleared) after both generators
• Mail app tests (Jest) , 497 suites, 4,745 passed ✅ · test:tz 5 passed ✅
• Server tests (Vitest) , 1,093 files, 13,424 passed ✅
• Deploy scope (bash) , 16 passed ✅

Two flakes appeared when the mail and server sui