The frozen-manifest job read ETIMEDOUT from the registry installing the client deps, after it had already cloned core at the pin and proved core's own manifest regenerates — a red X that meant nothing about this PR. There are five `npm ci` calls across the three jobs and the runner is shared, so this will recur. npm's own retry, turned up at the workflow level so every install gets it. Co-Authored-By: Claude <noreply@anthropic.com>