Live scans: the Scan-now button and the SSE stream
Waiting for the next scheduled tick to learn whether your fix worked is its own small misery. Scan now exists to shorten that loop, and the project page you pressed it on subscribes to the result as it happens.
What Scan-now does
The button posts to the project's scan-now endpoint, which enqueues a job through the same queue the schedule uses. Queueing rather than executing inline keeps the HTTP request fast and places the run where retries and scheduling already live. The worker picks it up and runs the identical engine, so a forced scan and a scheduled scan produce comparable results, capture warnings included.
Use it after applying fixes or shipping a migration; the schedule picks changes up anyway, and Scan-now simply declines to make you wait for the privilege of seeing that.
The stream
While the project page is open it holds a server-sent-events subscription to that project's stream endpoint, speaking the text/event-stream content type the browser's EventSource expects, so the client is a few lines and no library. Progress arrives as the scan advances, and when the run finishes the findings list and health score update without a refresh.
Server-sent events were chosen over websockets deliberately: one direction of traffic fits scan progress, reconnection is automatic, and an ordinary HTTP proxy chain handles it. Events are scoped to the project whose page subscribed, and closing the tab is harmless; results persist either way, and refreshing always agrees with the stream because the page renders stored records.
Retries stay quiet
If a run is retried after a partial failure, the retry re-reads finding history and emits no transition that was already recorded. Practically: a forced scan followed by a hiccup and a rerun updates the numbers without firing duplicate alerts, because alerting keys off transitions and transitions happen once.
That property matters more than it sounds. Retries cluster precisely when infrastructure is flaky, which is exactly when duplicate alerts would erode trust in the alert channel, and an alert channel nobody trusts is an alert channel nobody reads. The same guarantee covers a scheduled run and a forced run colliding: whichever completes first records the transitions, and the other confirms them silently.
Did this answer your question? If not, tell us what is missing — article corrections go straight to the person who maintains it.