Dunno about CBP, but I know the Canadian border agents are restricted to searching the phone only.

So anything in the cloud (e.g. webmail) is off limits unless you download to your phone.

Do they put it in airplane mode to enforce that?

I think officially that’s supposed to be step 1. Makes sense so you can’t remote wipe it.

Legally they are only allowed to inspect what you are bringing into the country, so stuff in the cloud is out-of-scope.

It’s an open question about whether they can compel you to decrypt anything or get you to unlock. They could always seize to inspect later though.

Worse they might flag and track you meticulously.