@vellumai/assistant 0.6.4 → 0.6.5

package/src/daemon/watch-handler.ts

@@ -113,7 +113,7 @@ export async function handleWatchObservation(
 
 async function generateCommentary(session: WatchSession): Promise<void> {
   try {
-    const provider = await getConfiguredProvider();
+    const provider = await getConfiguredProvider("watchCommentary");
     if (!provider) {
       log.warn(
         { watchId: session.watchId },
@@ -164,7 +164,7 @@ async function generateCommentary(session: WatchSession): Promise<void> {
       systemPrompt,
       {
         config: {
-          modelIntent: "latency-optimized",
+          callSite: "watchCommentary",
           max_tokens: 200,
         },
       },
@@ -225,7 +225,7 @@ export async function generateSummary(session: WatchSession): Promise<void> {
       },
       "generateSummary starting — calling LLM",
     );
-    const provider = await getConfiguredProvider();
+    const provider = await getConfiguredProvider("watchSummary");
     if (!provider) {
       log.warn(
         { watchId: session.watchId },
@@ -329,7 +329,7 @@ export async function generateSummary(session: WatchSession): Promise<void> {
       systemPrompt,
       {
         config: {
-          modelIntent: "quality-optimized",
+          callSite: "watchSummary",
           max_tokens: 2000,
         },
       },

package/src/daemon/web-search-history.ts

@@ -0,0 +1,126 @@
+import type {
+  ContentBlock,
+  Message,
+  ServerToolUseContent,
+  TextContent,
+  WebSearchToolResultContent,
+} from "../providers/types.js";
+
+export interface StripStats {
+  blocksStripped: number;
+  serverToolUsesDropped: number;
+  messagesModified: number;
+}
+
+export interface StripResult {
+  messages: Message[];
+  stats: StripStats;
+}
+
+/**
+ * Replaces every `web_search_tool_result` block in the message list with a
+ * plain `text` summary of its results, and drops the paired `server_tool_use`
+ * that produced it.
+ *
+ * Anthropic's `encrypted_content` tokens attached to each `web_search_result`
+ * are opaque server tokens with bounded validity (they expire and/or are
+ * route-scoped). Replaying a stale token produces
+ * `messages.N.content.M: Invalid encrypted_content in search_result block`.
+ * For historical turns the model does not need the opaque token to re-read
+ * the body — a title+url summary is sufficient to preserve context.
+ *
+ * Intended to run on `runMessages` immediately before the agent loop starts a
+ * new turn, at which point every `web_search_tool_result` in the list is by
+ * definition from a prior turn.
+ */
+export function stripHistoricalWebSearchResults(
+  messages: Message[],
+): StripResult {
+  const stats: StripStats = {
+    blocksStripped: 0,
+    serverToolUsesDropped: 0,
+    messagesModified: 0,
+  };
+
+  const next: Message[] = messages.map((msg) => {
+    const droppedServerToolUseIds = new Set<string>();
+    const transformed: ContentBlock[] = [];
+
+    for (const block of msg.content) {
+      if (block.type !== "web_search_tool_result") continue;
+      const wsr = block as WebSearchToolResultContent;
+      const query = findQueryForToolUseId(msg.content, wsr.tool_use_id);
+      transformed.push(formatAsText(wsr, query));
+      droppedServerToolUseIds.add(wsr.tool_use_id);
+      stats.blocksStripped++;
+    }
+
+    if (droppedServerToolUseIds.size === 0) return msg;
+
+    const rewritten: ContentBlock[] = [];
+    let wsrIndex = 0;
+    for (const block of msg.content) {
+      if (block.type === "server_tool_use") {
+        const stu = block as ServerToolUseContent;
+        if (droppedServerToolUseIds.has(stu.id)) {
+          stats.serverToolUsesDropped++;
+          continue;
+        }
+        rewritten.push(block);
+      } else if (block.type === "web_search_tool_result") {
+        rewritten.push(transformed[wsrIndex++]);
+      } else {
+        rewritten.push(block);
+      }
+    }
+
+    stats.messagesModified++;
+    return { ...msg, content: rewritten };
+  });
+
+  return { messages: next, stats };
+}
+
+function findQueryForToolUseId(
+  blocks: ContentBlock[],
+  toolUseId: string,
+): string | null {
+  for (const b of blocks) {
+    if (b.type !== "server_tool_use") continue;
+    const stu = b as ServerToolUseContent;
+    if (stu.id !== toolUseId) continue;
+    const q = stu.input?.query;
+    return typeof q === "string" ? q : null;
+  }
+  return null;
+}
+
+function formatAsText(
+  block: WebSearchToolResultContent,
+  query: string | null,
+): TextContent {
+  const header = query
+    ? `[Prior web_search results for "${query}":`
+    : "[Prior web_search results:";
+
+  const content = block.content;
+  if (!Array.isArray(content)) {
+    return { type: "text", text: `${header} (results unavailable)]` };
+  }
+
+  const entries = content
+    .filter(
+      (r): r is { type: string; title?: unknown; url?: unknown } =>
+        typeof r === "object" &&
+        r != null &&
+        (r as { type?: string }).type === "web_search_result",
+    )
+    .map((r, i) => {
+      const title = typeof r.title === "string" ? r.title : "(untitled)";
+      const url = typeof r.url === "string" ? r.url : "";
+      return url ? `${i + 1}. ${title}\n   ${url}` : `${i + 1}. ${title}`;
+    });
+
+  const body = entries.length > 0 ? entries.join("\n") : "(no results)";
+  return { type: "text", text: `${header}\n${body}]` };
+}

package/src/events/domain-events.ts

@@ -22,7 +22,6 @@ export interface ToolDomainEvents {
       | "allow_10m"
       | "allow_conversation"
       | "always_allow"
-      | "always_allow_high_risk"
       | "deny"
       | "always_deny"
       | "temporary_override";

package/src/filing/filing-service.ts

@@ -2,7 +2,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 
 import { getConfig } from "../config/loader.js";
-import type { Speed } from "../config/schemas/inference.js";
+import type { LLMCallSite } from "../config/schemas/llm.js";
 import { bootstrapConversation } from "../memory/conversation-bootstrap.js";
 import { getLogger } from "../util/logger.js";
 import { getWorkspaceDir } from "../util/platform.js";
@@ -17,23 +17,24 @@ const FILING_PROMPT_TEMPLATE = `You are running a periodic knowledge base filing
 ## Part 1: File the buffer
 
 Read \`pkb/buffer.md\`. For each item in the buffer:
-1. Determine which topic file it belongs in. Check \`pkb/INDEX.md\` to see what topic files exist.
-2. Read the target topic file, then append or integrate the new fact.
+1. Determine which topic file(s) it belongs in. Check \`pkb/INDEX.md\` to see what topic files exist.
+2. Read the target topic file(s), then integrate the new fact.
 3. If the fact is important enough to always be in context, add it to \`pkb/essentials.md\` instead.
 4. If the fact is a commitment, follow-up, or active project, add it to \`pkb/threads.md\`.
 5. If no existing topic file fits, create a new one and update \`pkb/INDEX.md\`.
+6. If the topic file is getting too long (>1500 tokens), compress it or split it into multiple topic files.
 
 After all items are filed, clear the processed items from \`pkb/buffer.md\` (leave the file empty, don't delete it).
 
-## Part 2: Nest
+## Part 2: Review
 
-Pick 1-2 topic files from your knowledge base and review them:
+Pick 3 random topic files from your knowledge base and review them:
 - Is the information still accurate and up to date?
 - Are there duplicates that should be consolidated?
 - Is anything important enough to promote to \`pkb/essentials.md\`?
 - Is anything in \`pkb/essentials.md\` that's no longer essential? Demote it to a topic file.
 - Are any threads in \`pkb/threads.md\` completed or stale? Remove them.
-- Is any file getting too long? Consider splitting it.
+- Is any file getting too long (>1500 tokens)? Strongly consider compressing it or splitting it into multiple topic files.
 - Should any topic file be restructured for clarity?
 
 Make improvements as you see fit. This is your knowledge base — keep it sharp.`;
@@ -42,7 +43,7 @@ export interface FilingDeps {
   processMessage: (
     conversationId: string,
     content: string,
-    options?: { speed?: Speed },
+    options?: { callSite?: LLMCallSite },
   ) => Promise<{ messageId: string }>;
   onConversationCreated?: (info: {
     conversationId: string;
@@ -190,8 +191,6 @@ export class FilingService {
     log.info("Running filing job");
 
     try {
-      const config = getConfig().filing;
-
       const conversation = bootstrapConversation({
         conversationType: "background",
         source: "filing",
@@ -206,7 +205,7 @@ export class FilingService {
       });
 
       await this.deps.processMessage(conversation.id, FILING_PROMPT_TEMPLATE, {
-        speed: config.speed,
+        callSite: "filingAgent",
       });
 
       log.info({ conversationId: conversation.id }, "Filing job completed");

package/src/heartbeat/heartbeat-service.ts

@@ -2,7 +2,7 @@ import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 
 import { getConfig } from "../config/loader.js";
-import type { Speed } from "../config/schemas/inference.js";
+import type { LLMCallSite } from "../config/schemas/llm.js";
 import type { HeartbeatAlert } from "../daemon/message-protocol.js";
 import { bootstrapConversation } from "../memory/conversation-bootstrap.js";
 import {
@@ -39,7 +39,8 @@ export function isShallowProfile(): boolean {
   try {
     const identityPath = getWorkspacePromptPath("IDENTITY.md");
     const rawIdentity = readTextFileSync(identityPath);
-    const identity = rawIdentity != null ? stripCommentLines(rawIdentity) : null;
+    const identity =
+      rawIdentity != null ? stripCommentLines(rawIdentity) : null;
     // `resolveGuardianPersona` returns already-stripped, trimmed content
     // (or null for missing/empty files).
     const user = resolveGuardianPersona();
@@ -81,7 +82,7 @@ export interface HeartbeatDeps {
   processMessage: (
     conversationId: string,
     content: string,
-    options?: { speed?: Speed },
+    options?: { callSite?: LLMCallSite },
   ) => Promise<{ messageId: string }>;
   alerter: (alert: HeartbeatAlert) => void;
   onConversationCreated?: (info: {
@@ -222,11 +223,13 @@ export class HeartbeatService {
     // permanently blocked. The .finally() handler still serves as the
     // normal-completion cleanup path and uses an identity guard to avoid
     // clearing a different run's activeRun.
-    run.finally(() => {
-      if (this.activeRun === run) {
-        this.activeRun = null;
-      }
-    }).catch(() => {}); // Suppress unhandled rejection if executeRun rejects
+    run
+      .finally(() => {
+        if (this.activeRun === run) {
+          this.activeRun = null;
+        }
+      })
+      .catch(() => {}); // Suppress unhandled rejection if executeRun rejects
 
     let timerId: ReturnType<typeof setTimeout> | undefined;
     try {
@@ -255,18 +258,47 @@ export class HeartbeatService {
     this._nextRunAt = Date.now() + intervalMs;
   }
 
-  private async runCredentialHealthCheck(): Promise<void> {
+  /**
+   * Run credential health checks and notify about unhealthy credentials.
+   * Returns a list of unhealthy provider names so callers can gate tool usage.
+   */
+  private async runCredentialHealthCheck(): Promise<string[]> {
     try {
-      const { checkAllCredentials } = await import(
-        "../credential-health/credential-health-service.js"
-      );
+      const { checkAllCredentials } =
+        await import("../credential-health/credential-health-service.js");
       const report = await checkAllCredentials();
       if (report.unhealthy.length > 0) {
         await this.notifyUnhealthyCredentials(report.unhealthy);
+        // Only block providers for hard-failure statuses — expiring and ping_failed
+        // are transient/still-usable and should not disable provider tools.
+        // missing_scopes is a hard failure because required scopes are absent and
+        // provider tools will predictably fail.
+        const hardFailureStatuses = new Set([
+          "revoked",
+          "missing_token",
+          "expired",
+          "missing_scopes",
+        ]);
+        const hardFailures = report.unhealthy.filter((r) =>
+          hardFailureStatuses.has(r.status),
+        );
+        return [...new Set(hardFailures.map((r) => r.provider))];
       }
     } catch (err) {
-      log.warn({ err }, "Credential health check failed (non-fatal)");
+      log.error({ err }, "Credential health check failed");
+      try {
+        this.deps.alerter({
+          type: "heartbeat_alert",
+          title: "Credential Health Check Failed",
+          body:
+            "Could not verify OAuth credential health. " +
+            (err instanceof Error ? err.message : String(err)),
+        });
+      } catch {
+        // Last resort — alerter itself failed. Already logged above.
+      }
     }
+    return [];
   }
 
   private async notifyUnhealthyCredentials(
@@ -281,11 +313,13 @@ export class HeartbeatService {
   ): Promise<void> {
     let emitNotificationSignal: typeof import("../notifications/emit-signal.js").emitNotificationSignal;
     try {
-      ({ emitNotificationSignal } = await import(
-        "../notifications/emit-signal.js"
-      ));
-    } catch {
-      log.warn("Failed to import notification signal emitter");
+      ({ emitNotificationSignal } =
+        await import("../notifications/emit-signal.js"));
+    } catch (importErr) {
+      log.error(
+        { err: importErr },
+        "Failed to import notification signal emitter",
+      );
       return;
     }
 
@@ -317,7 +351,7 @@ export class HeartbeatService {
           routingIntent: "single_channel",
         });
       } catch (err) {
-        log.warn(
+        log.error(
           { err, provider: result.provider, connectionId: result.connectionId },
           "Failed to emit credential health notification",
         );
@@ -329,13 +363,16 @@ export class HeartbeatService {
     log.info("Running heartbeat");
 
     // Credential health check — surface broken credentials proactively
-    // before the LLM heartbeat prompt runs.
-    await this.runCredentialHealthCheck();
+    // before the LLM heartbeat prompt runs. Returns unhealthy provider
+    // names so the prompt can instruct the LLM to skip those providers.
+    const unhealthyProviders = await this.runCredentialHealthCheck();
 
     try {
-      const config = getConfig().heartbeat;
       const checklist = this.readChecklist();
-      const { prompt, includedReengagement } = this.buildPrompt(checklist);
+      const { prompt, includedReengagement } = this.buildPrompt(
+        checklist,
+        unhealthyProviders,
+      );
 
       const conversation = bootstrapConversation({
         conversationType: "background",
@@ -351,7 +388,7 @@ export class HeartbeatService {
       });
 
       await this.deps.processMessage(conversation.id, prompt, {
-        speed: config.speed,
+        callSite: "heartbeatAgent",
       });
 
       if (includedReengagement) {
@@ -368,7 +405,7 @@ export class HeartbeatService {
           body: err instanceof Error ? err.message : String(err),
         });
       } catch (alertErr) {
-        log.warn({ alertErr }, "Failed to broadcast heartbeat alert");
+        log.error({ alertErr }, "Failed to broadcast heartbeat alert");
       }
     }
   }
@@ -381,14 +418,25 @@ export class HeartbeatService {
   }
 
   /** @internal Exposed for testing. */
-  buildPrompt(checklist: string): { prompt: string; includedReengagement: boolean } {
+  buildPrompt(
+    checklist: string,
+    unhealthyProviders: string[] = [],
+  ): { prompt: string; includedReengagement: boolean } {
     let prompt = `You are running a periodic heartbeat check. Review the following checklist and take any necessary actions.
 
 <heartbeat-checklist>
 ${checklist}
-</heartbeat-checklist>
+</heartbeat-checklist>`;
+
+    if (unhealthyProviders.length > 0) {
+      const providers = unhealthyProviders.join(", ");
+      prompt += `\n\n<credential-status>
+The following providers have broken or expired OAuth credentials: ${providers}.
+Do NOT attempt to use tools for these providers — they will fail. Skip any checklist items that depend on them and note the outage in your summary.
+</credential-status>`;
+    }
 
-<heartbeat-disposition>
+    prompt += `\n\n<heartbeat-disposition>
 After completing your review, end your response with one of:
 - HEARTBEAT_OK — if everything looks good, no action needed
 - HEARTBEAT_ALERT — if you found issues that need attention (describe them before this marker)

package/src/home/__tests__/feed-scheduler.test.ts

@@ -70,28 +70,36 @@ describe("startFeedScheduler", () => {
     expect(summary2.gmailDigestRan).toBe(true);
   });
 
-  test("rollup only re-runs every 30 minutes", async () => {
+  test("rollup only re-runs every 2 hours as the safety-net cadence", async () => {
+    // The scheduler is the safety net; the primary trigger is the
+    // on-visit refresh in home-feed-routes.ts. Long cadence is
+    // intentional so the scheduler doesn't fight the route.
     handle = startFeedScheduler(defaultOptions());
 
     const t0 = new Date("2026-04-14T12:00:00.000Z");
     await handle.runOnce(t0);
 
-    // 5 min later — below the 30-min reflection gate.
-    const t1 = new Date("2026-04-14T12:05:00.000Z");
+    // 30 min later — below the 2-hour gate.
+    const t1 = new Date("2026-04-14T12:30:00.000Z");
     const summary1 = await handle.runOnce(t1);
     expect(summary1.rollupRan).toBe(false);
 
-    // 31 min later — past the 30-min gate, should re-run.
-    const t2 = new Date("2026-04-14T12:31:00.000Z");
+    // 1h later — still below the 2-hour gate.
+    const t2 = new Date("2026-04-14T13:00:00.000Z");
     const summary2 = await handle.runOnce(t2);
-    expect(summary2.rollupRan).toBe(true);
+    expect(summary2.rollupRan).toBe(false);
+
+    // 2h 1m later — past the gate, should re-run.
+    const t3 = new Date("2026-04-14T14:01:00.000Z");
+    const summary3 = await handle.runOnce(t3);
+    expect(summary3.rollupRan).toBe(true);
   });
 
   test("rollup cooldown is NOT advanced on no_provider so the next tick retries", async () => {
     // Mimic the daemon startup ordering: the scheduler boots before
     // the provider registry is ready. The first tick gets no_provider;
     // the next tick (even one second later) must still run the rollup
-    // instead of waiting 30 minutes.
+    // instead of waiting 2 hours.
     rollupRunner.mockImplementationOnce(async () => ({
       wroteCount: 0,
       skippedReason: "no_provider",
@@ -110,10 +118,30 @@ describe("startFeedScheduler", () => {
     expect(rollupRunner).toHaveBeenCalledTimes(2);
   });
 
+  test("rollup cooldown is NOT advanced on in_flight so the next tick retries", async () => {
+    // in_flight means another caller (on-visit refresh, usually) is
+    // already running the producer. Advancing the gate here would
+    // force the NEXT tick to wait out the full cadence window even
+    // though nothing broken happened — the other caller's result is
+    // effectively this tick's run.
+    rollupRunner.mockImplementationOnce(async () => ({
+      wroteCount: 0,
+      skippedReason: "in_flight",
+    }));
+
+    handle = startFeedScheduler(defaultOptions());
+    await handle.runOnce(new Date("2026-04-14T12:00:00.000Z"));
+    expect(rollupRunner).toHaveBeenCalledTimes(1);
+
+    const summary = await handle.runOnce(new Date("2026-04-14T12:00:01.000Z"));
+    expect(summary.rollupRan).toBe(true);
+    expect(rollupRunner).toHaveBeenCalledTimes(2);
+  });
+
   test("rollup cooldown is NOT advanced on no_actions so the next tick retries", async () => {
     // no_actions means the activity log was empty — no LLM call was
     // made. A subsequent tick should retry as soon as new actions
-    // land, not wait the full 30-minute window.
+    // land, not wait the full 2-hour window.
     rollupRunner.mockImplementationOnce(async () => ({
       wroteCount: 0,
       skippedReason: "no_actions",
@@ -131,7 +159,7 @@ describe("startFeedScheduler", () => {
 
   test("rollup cooldown IS advanced on other skip reasons to preserve backoff", async () => {
     // empty_items / malformed_output / provider_error are real LLM
-    // attempts — the next tick should be gated by the full 30-minute
+    // attempts — the next tick should be gated by the full 2-hour
     // window so a broken producer doesn't get hammered every tick.
     rollupRunner.mockImplementationOnce(async () => ({
       wroteCount: 0,
@@ -142,8 +170,8 @@ describe("startFeedScheduler", () => {
     await handle.runOnce(new Date("2026-04-14T12:00:00.000Z"));
     expect(rollupRunner).toHaveBeenCalledTimes(1);
 
-    // Ten minutes later — below the 30-min gate, should NOT re-run.
-    const summary = await handle.runOnce(new Date("2026-04-14T12:10:00.000Z"));
+    // Thirty minutes later — below the 2-hour gate, should NOT re-run.
+    const summary = await handle.runOnce(new Date("2026-04-14T12:30:00.000Z"));
     expect(summary.rollupRan).toBe(false);
     expect(rollupRunner).toHaveBeenCalledTimes(1);
   });

package/src/home/__tests__/rollup-producer.test.ts

@@ -364,6 +364,50 @@ describe("runRollupProducer", () => {
     expect(result.wroteCount).toBe(0);
   });
 
+  test("concurrent calls short-circuit the second with in_flight", async () => {
+    // Gate the provider behind a manually-controlled deferred so we
+    // can observe state while the first call is still inside the
+    // producer body. Without this we'd race the runtime's microtask
+    // scheduler to check in-flightness.
+    let release: ((value: ContentBlock[]) => void) | null = null;
+    const gated = new Promise<ContentBlock[]>((resolve) => {
+      release = resolve;
+    });
+    const provider = makeProvider(async () => {
+      const content = await gated;
+      return {
+        content,
+        model: "mock-model",
+        usage: { inputTokens: 0, outputTokens: 0 },
+        stopReason: "tool_use",
+      };
+    });
+
+    const first = runRollupProducer(new Date(), {
+      writeItem,
+      loadRelationshipState: stubRelationshipState,
+      loadRecentActions: stubLoadRecentActions(oneAction),
+      resolveProvider: () => provider,
+    });
+
+    // Second call lands while `first` is blocked awaiting the gated
+    // provider response — the in-flight guard must short-circuit it.
+    const second = await runRollupProducer(new Date(), {
+      writeItem,
+      loadRelationshipState: stubRelationshipState,
+      loadRecentActions: stubLoadRecentActions(oneAction),
+      resolveProvider: () => provider,
+    });
+
+    expect(second.skippedReason).toBe("in_flight");
+    expect(second.wroteCount).toBe(0);
+
+    // Release the first call and let it finish.
+    release!([toolUseContent({ items: [] })]);
+    const firstResult = await first;
+    expect(firstResult.skippedReason).toBe("empty_items");
+  });
+
   test("clamps priority to the valid [0, 100] window", async () => {
     const provider = scriptedProvider([
       toolUseContent({

package/src/home/assistant-feed-authoring.ts

@@ -41,6 +41,7 @@ import {
   feedItemSchema,
   type FeedItemSource,
   type FeedItemType,
+  type FeedItemUrgency,
 } from "./feed-types.js";
 import { appendFeedItem } from "./feed-writer.js";
 
@@ -80,6 +81,8 @@ export interface WriteAssistantFeedItemParams {
   minTimeAway?: number;
   /** Absolute ISO-8601 expiry timestamp. */
   expiresAt?: string;
+  /** Visual urgency treatment — controls badge color independently of sort priority. */
+  urgency?: FeedItemUrgency;
 }
 
 /**
@@ -110,6 +113,7 @@ export async function writeAssistantFeedItem(
     timestamp: now,
     createdAt: now,
     actions: params.actions,
+    urgency: params.urgency,
     minTimeAway: params.minTimeAway,
     expiresAt: params.expiresAt,
   };

package/src/home/emit-feed-event.ts

@@ -43,6 +43,7 @@ import {
   type FeedItem,
   feedItemSchema,
   type FeedItemSource,
+  type FeedItemUrgency,
 } from "./feed-types.js";
 import { appendFeedItem } from "./feed-writer.js";
 
@@ -93,6 +94,8 @@ export interface EmitFeedEventParams {
    * until the user dismisses it (default for activity-log actions).
    */
   expiresAt?: string;
+  /** Visual urgency treatment — controls badge color independently of sort priority. */
+  urgency?: FeedItemUrgency;
 }
 
 /**
@@ -144,6 +147,7 @@ export async function emitFeedEvent(
     timestamp: now,
     createdAt: now,
     actions: params.actions,
+    urgency: params.urgency,
     minTimeAway: params.minTimeAway,
     expiresAt: params.expiresAt,
   };

package/src/home/feed-scheduler.ts

@@ -43,7 +43,15 @@ const TICK_INTERVAL_MS = 5 * 60 * 1000;
 
 /** Per-producer minimum gap between runs. */
 const GMAIL_DIGEST_INTERVAL_MS = 5 * 60 * 1000;
-const ROLLUP_INTERVAL_MS = 30 * 60 * 1000;
+/**
+ * Roll-up cadence is deliberately long — 120 minutes — because the
+ * scheduler is the *safety net*, not the primary trigger. Opening the
+ * Home page fires a debounced on-visit refresh in the HTTP route (see
+ * `runtime/routes/home-feed-routes.ts`), which is the path most users
+ * actually hit. The scheduler exists so the feed still stays fresh
+ * for long idle stretches where nobody opens the Home page.
+ */
+const ROLLUP_INTERVAL_MS = 2 * 60 * 60 * 1000;
 
 export interface FeedSchedulerHandle {
   /** Stops the interval. Safe to call multiple times. */
@@ -146,8 +154,9 @@ export function startFeedScheduler(
             "Rollup producer ran",
           );
           // Only advance the cooldown gate when the producer actually
-          // had a chance to run the LLM. Two skip reasons short-circuit
-          // before any provider call and should NOT burn the window:
+          // had a chance to run the LLM. Three skip reasons short-
+          // circuit before any provider call and should NOT burn the
+          // window:
           //   - `no_provider`: the provider registry wasn't ready yet
           //     (happens on the startup tick because the feed scheduler
           //     boots before the provider init pass in
@@ -155,12 +164,19 @@ export function startFeedScheduler(
           //   - `no_actions`: there was nothing to roll up. A subsequent
           //     tick should retry as soon as new actions land, not wait
           //     the full window.
+          //   - `in_flight`: another caller (usually the on-visit
+          //     refresh trigger in `home-feed-routes.ts`) is already
+          //     running the rollup. That caller's result effectively
+          //     counts as this scheduler tick's real run; bumping the
+          //     gate here would force the NEXT tick to also wait out
+          //     the full window even though nothing broken happened.
           // Every other outcome — success, empty items, malformed
           // output, provider error — is a real LLM attempt and does
           // advance the gate so a broken producer doesn't hammer us.
           if (
             result.skippedReason !== "no_provider" &&
-            result.skippedReason !== "no_actions"
+            result.skippedReason !== "no_actions" &&
+            result.skippedReason !== "in_flight"
           ) {
             lastRollupAt = nowMs;
           }