`npm audit` exits 1 both for a real advisory and for a registry that refuses to answer, so a 503 from the audit endpoint reddened PRs that changed no dependency at all — as it did on #409. Retry up to three times, but only when the output names a transport or availability failure. An advisory at or above high severity still fails on the first attempt, unretried. ha-relevant: no