A single scan and deployment will install patches detect missing and can be installed at the time of the scan. A subsequent scan and deployment may be needed to clean up patches that required perquisite patches to be installed. You would need to initiate (or schedule) a follow-up scan and deployment to clean up patches. If you schedule a follow-up scan and deployment, I would suggest allowing 1-2 hours between the jobs to allow processing time. The scenario you describe is less frequent once you get your systems caught up with patching. One of the reasons why we don't allow automatic re-scan and re-deployment is it could cause machines to be stuck in a loop if there are issues installing specific patches on the target machine.