diff --git a/AGENTS.md b/AGENTS.md
index 1cad704..529469d 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -2325,6 +2325,9 @@ Rules:
   `book_new`/`aoa_to_sheet`/`writeFile`, no `read`, so the parse CVEs don't
   apply). `zapstore.yaml` license was `custom` (the listing showed "custom");
   now **`AGPL-3.0-only`** (re-published in 1.6.8, verified on the 32267 tag).
+  On **failure** the job restores the lockfile and schedules a retry in **~3 days**
+  (a failed run no longer burns the whole 20-day window); every notification now
+  includes the **OSV total** ("N packages affected by M known vulnerabilities").
 
 ### Community relay — self-hosted Newlay (2026-10-12)
 
diff --git a/scripts/update-deps.sh b/scripts/update-deps.sh
index c44e76d..b4707a5 100755
--- a/scripts/update-deps.sh
+++ b/scripts/update-deps.sh
@@ -76,8 +76,14 @@ fi
   fi
 } | tee "$REPORT"
 
+# The OSV summary line (e.g. "Total 27 packages affected by 59 known ...") is the
+# number worth surfacing in notifications; npm audit's counts are narrower.
+OSV_SUMMARY="$(grep -E '^Total [0-9]+ packages affected' "$REPORT" | tail -1)"
+[ -n "$OSV_SUMMARY" ] || OSV_SUMMARY="OSV scan: no summary (scanner missing?)"
+
 if [ "$SCAN_ONLY" -eq 1 ]; then
   log "scan-only; report: $REPORT"
+  echo "$OSV_SUMMARY"
   exit 0
 fi
 
@@ -113,18 +119,18 @@ if npm test >"$STATE_DIR/test.log" 2>&1 && node scripts/smoke-test.mjs >"$STATE_
       # Bound the push: the git remote signs via the remote signer and can stall.
       if timeout 180 git push origin main >"$STATE_DIR/push.log" 2>&1; then
         log "pushed dependency update"
-        notify "Dependency update applied, tests pass, pushed."
+        notify "Dependency update applied, tests pass, pushed. ${OSV_SUMMARY}"
       else
         log "push failed/skipped (see $STATE_DIR/push.log)"
-        notify "Dependency update committed locally but the push failed."
+        notify "Dependency update committed locally but the push failed. ${OSV_SUMMARY}"
       fi
     else
       log "committed locally (--no-push)"
-      notify "Dependency update applied and committed locally."
+      notify "Dependency update applied and committed locally. ${OSV_SUMMARY}"
     fi
   else
     log "no dependency changes to commit"
-    notify "Dependency scan complete: nothing to update."
+    notify "Dependency scan complete: nothing to update. ${OSV_SUMMARY}"
   fi
   finish_timer
   log "done"
@@ -133,7 +139,9 @@ else
   cp "$STATE_DIR/package.json.bak" package.json 2>/dev/null || true
   cp "$STATE_DIR/package-lock.json.bak" package-lock.json 2>/dev/null || true
   npm i --silent >/dev/null 2>&1 || true
-  notify "Dependency update REVERTED — tests failed (see $STATE_DIR/test.log)."
-  finish_timer
+  # A failed run must NOT consume the whole interval: retry in ~3 days instead.
+  RETRY_DAYS=3; [ "$INTERVAL_DAYS" -gt 4 ] || RETRY_DAYS=1
+  echo $(( $(date +%s) - (INTERVAL_DAYS - RETRY_DAYS) * 86400 )) > "$LAST"
+  notify "Dependency update REVERTED — tests failed (see $STATE_DIR/test.log). ${OSV_SUMMARY}"
   exit 1
 fi