Two changes to make the weekly pipeline review fast and non-destructive. Motivated by an on-demand pipeline-review run that (a) took minutes and (b) overwrote ~119 of a rep's deals' Cedar fields with sparser Salesforce values.

1. Windowed "recently modified" reconcile (the main fix)

Pipeline-review Step 1 called reconcile-deals-with-provider, whose by-id refresh re-pulled every linked deal from live Salesforce and re-applied field mappings , even for deals that hadn't changed. openStatuses (already on staging) narrowed that to the open pipeline, but that's still ~all open deals (~137 for a large book): slow, and it clobbers fresh Cedar values on unchanged deals.

• reconcileProviderDeals gains windowedRefreshOnly + windowDays. When windowedRefreshOnly is set, the by-id refresh is scoped to only the deals the provider returned in the fetch window (modified in the last windowDays), composing with openStatuses. New/changed opps are still gap-filled; account-only linking still runs.
• The tool now defaults recentOnly=true / windowDays=7, so a pipeline review refreshes just what changed since last week. Unchanged deals stay exactly as the hourly sync left them , no overwrite.
• The nightly full reconcile (service default, windowedRefreshOnly=false, no windowing) is unchanged , it still does whole-book orphan cleanup. Admin/workflow callers of the service are unaffected.
• Pipeline-review agent-default Step 1 prose updated to describe the windowed behavior.

2. Executable on-demand single-subagent run (cron)

admin.subagent.run --trigger cron --name <slug> --execute now actually runs just that one subagent (via runSingleSubagent, in-process so --no-send/--deliver-to hold) instead of returning plan-only; 'cron' added to EXECUTABLE_TRIGGERS. This is what lets an on-demand pipeline-review run server-side against a deployed environment rather than requiring a local server. (This code existed as uncommitted local WIP; this commits it cleanly off staging.)

Tests

• subagent-dispatch.test.ts: cron is now executable alongside before_meeting.
• New reconcileDealsWithProviderTool.test.ts: the tool defaults to windowedRefreshOnly:true / windowDays:7, and honors recentOnly:false + windowDays overrides while forwarding openStatuses.
• 12/12 pass; @zero/server typecheck + oxlint clean on changed files.

Notes

• Willem's already-deployed pipeline-review subagent doc will pick up the windowed behavior automatically via the tool default (it passes no recentOnly), no doc edit required.
• Follow-on: once merged + deployed, the on-demand cedar-cli subagent run --trigger cron --name pipeline-review --execute --no-send --deliver-to <you> path works without a local server.

🤖 Generated with Claude Code

Greptile Summary

The PR limits pipeline-review reconciliation to recently modified CRM deals by default and adds executable, isolated cron subagent runs with optional notification capture and relay.

• Adds configurable reconcile windowing while preserving the service’s full-reconcile default.
• Makes cron an executable trigger and introduces an in-process single-subagent runner.
• Extends the admin route to execute cron runs, capture notification output, and optionally relay it.
• Adds parameter-forwarding and trigger-executability tests.

Confidence Score: 4/5

The PR should not merge until isolated org-level execution resolves the linked org AOP ID; the relative-import cleanup is non-blocking.

The new level=org path deterministically searches the organization playbook under a user AOP identifier, causing valid org subagents to be reported as missing, while the reconcile windowing itself remains consistent with the documented nightly full-reconcile fallback.

Files Needing Attention: apps/server/src/services/playbook/run-single-subagent.ts and apps/server/src/trpc/routes/admi