[kh0pper]

Audit N4-3.

Auto-update checks every 6 hours by default, and the CI gate skips a check while CI on the newest commit of main is still running. On a day of frequent merges every regular check landed mid-CI, so a paired box went a whole day without updating.

Change. After a scheduled check that skips with ci-pending, one retry is scheduled about 30 minutes later, plus a small per-machine offset (CI_RETRY_DELAY_MS, instanceJitterMs).

• It keeps retrying while CI is still running, at most ceil(interval / 30 min) - 1 times, so a retry never runs past the next regular check.
• It stops as soon as any other result comes back.
• There is at most one retry timer at a time. A regular check cancels a pending retry, and stopAutoUpdate clears it.
• A retry goes through tickCheck, so the disabled and collection-install guards still apply, and it catches its own rejection.

Only ci-pending retries. A red result, a commit without the required checks, and GitHub being unreachable (ci-unavailable) all wait for the regular interval. Each unreadable check counts toward the three-in-a-row "updates paused" bell, so retrying an outage every 30 minutes would ring that bell after about an hour instead of after several regular checks.

The auto-update guide (en and es) describes the retry.

Tests (tests/auto-update-ci-retry.test.js, through the real scheduler with the retry delay and check stubbed):

• one retry per ci-pending, stopping on success;
• no retry for ci-red, ci-unavailable, ci-gate-unavailable, no-ci or not-on-main;
• the bound holds for 1 h and 6 h intervals;
• never two timers at once, and a regular tick cancels a pending retry;
• stopAutoUpdate clears it;
• a rejecting retry doesn't break scheduling;
• the disabled guard still applies.

Host: 690 pass, 0 fail across the auto-update, update, CI-gate, satellite, docs and public-hygiene files.

https://claude.ai/code/session_015Vve3soBJ9qTcyeCCLyYyh