@evomap/evolver 1.89.10 → 1.89.12

package/src/proxy/lifecycle/manager.js

@@ -5,7 +5,14 @@ const path = require('path');
 const { PROXY_PROTOCOL_VERSION } = require('../mailbox/store');
 const { buildEnvelope } = require('../envelope');
 const crypto = require('crypto');
-const { hubFetch } = require('../../gep/hubFetch');
+const {
+  hubFetch,
+  hubUnreachableBackoffMs,
+  isHubUnreachableError,
+  readHubResponseJson,
+  readHubResponseText,
+  throwIfHubUnreachableResponse,
+} = require('../../gep/hubFetch');
 const { getEvomapPath } = require('../../gep/paths');
 // last_update transit (PR #188): proxy heartbeat ferries a pending
 // force_update outcome to the hub, then clears the state file on 2xx.
@@ -372,6 +379,8 @@ class LifecycleManager {
     this._consecutiveReauthFailures = 0;
     this._driftInterval = null;
     this._lastDriftCheckAt = 0;
+    this._hubUnreachableFailures = 0;
+    this._hubUnreachableUntil = 0;
 
     // H4 fix: persist the legacy node_id file as soon as the in-memory
     // node_id is known, NOT only after a successful hello(). The original
@@ -508,6 +517,26 @@ class LifecycleManager {
     return headers;
   }
 
+  _hubUnreachableWaitMs() {
+    return Math.max(0, this._hubUnreachableUntil - Date.now());
+  }
+
+  _recordHubReachable() {
+    this._hubUnreachableFailures = 0;
+    this._hubUnreachableUntil = 0;
+  }
+
+  _recordHubUnreachable(err) {
+    this._hubUnreachableFailures += 1;
+    const retryAfterMs = hubUnreachableBackoffMs(this._hubUnreachableFailures);
+    this._hubUnreachableUntil = Date.now() + retryAfterMs;
+    this.logger.warn?.(
+      `[lifecycle] Hub unreachable; backing off for ${Math.ceil(retryAfterMs / 1000)}s: ` +
+        `${err && err.message || err}`
+    );
+    return retryAfterMs;
+  }
+
   async hello({ rotateSecret = false } = {}) {
     if (!this.hubUrl) return { ok: false, error: 'no_hub_url' };
 
@@ -517,6 +546,15 @@ class LifecycleManager {
       return { ok: false, error: 'hello_rate_limit_active', waitSec };
     }
 
+    const waitMs = this._hubUnreachableWaitMs();
+    if (waitMs > 0) {
+      return {
+        ok: false,
+        error: 'hub_unreachable_backoff',
+        retryAfterMs: waitMs,
+      };
+    }
+
     const endpoint = `${this.hubUrl}/a2a/hello`;
     const nodeId = this.store.getState('node_id')
       || _readLegacyNodeId()
@@ -539,8 +577,10 @@ class LifecycleManager {
         body: JSON.stringify(body),
         signal: AbortSignal.timeout(HELLO_TIMEOUT),
       });
+      await throwIfHubUnreachableResponse(res, 'lifecycle hello');
+      this._recordHubReachable();
       if (!res.ok) {
-        const errData = await res.json().catch(() => ({}));
+        const errData = await readHubResponseJson(res).catch(() => ({}));
         const errMsg = errData?.error || `http_${res.status}`;
         if (res.status === 429) {
           const retryAfter = parseInt(res.headers.get('retry-after') || '3600', 10);
@@ -552,7 +592,7 @@ class LifecycleManager {
         return { ok: false, error: errMsg, statusCode: res.status };
       }
 
-      const data = await res.json();
+      const data = await readHubResponseJson(res);
 
       if (data?.payload?.status === 'rejected') {
         this.logger.error(`[lifecycle] hello rejected: ${data.payload.reason || 'unknown'}`);
@@ -604,6 +644,15 @@ class LifecycleManager {
       this.logger.log(`[lifecycle] hello OK, node_id=${nodeId}${rotateSecret ? ' (secret rotated)' : ''}`);
       return { ok: true, nodeId, response: data };
     } catch (err) {
+      if (isHubUnreachableError(err)) {
+        const retryAfterMs = this._recordHubUnreachable(err);
+        return {
+          ok: false,
+          error: 'hub_unreachable',
+          detail: err.message,
+          retryAfterMs,
+        };
+      }
       this.logger.error(`[lifecycle] hello failed: ${err.message}`);
       return { ok: false, error: err.message };
     }
@@ -630,6 +679,7 @@ class LifecycleManager {
     }
     this._reauthInProgress = true;
     let manualResetRequired = false;
+    let hubUnreachable = false;
     try {
       for (let attempt = 1; attempt <= MAX_REAUTH_ATTEMPTS; attempt++) {
         this.logger.warn(`[lifecycle] re-auth attempt ${attempt}/${MAX_REAUTH_ATTEMPTS}: rotating secret via hello...`);
@@ -637,6 +687,17 @@ class LifecycleManager {
         if (!helloResult.ok) {
           this.logger.error(`[lifecycle] re-auth hello failed: ${helloResult.error}`);
           if (helloResult.error === 'hello_rate_limited' || helloResult.error === 'hello_rate_limit_active') break;
+          // Hub link is down (WAF HTML, network error, timeout) -- NOT an auth
+          // failure. Bail without arming the re-auth backoff: otherwise a
+          // transient outage that arrives mid-rotate would burn both attempts
+          // (attempt 2's hello short-circuits on the hub-unreachable window)
+          // and suppress genuine auth recovery for up to REAUTH_BACKOFF_MAX_MS,
+          // even though a JSON 401/403 retry would succeed once the hub is
+          // reachable again. The hub-unreachable window already gates re-entry.
+          if (helloResult.error === 'hub_unreachable' || helloResult.error === 'hub_unreachable_backoff') {
+            hubUnreachable = true;
+            break;
+          }
           if (typeof helloResult.error === 'string' && helloResult.error.startsWith('node_id_already_claimed')) {
             // Hub does not believe we own this nodeId. Our locally cached
             // secret(s) are useless. Drop them so attempt 2 retries WITHOUT
@@ -667,8 +728,19 @@ class LifecycleManager {
           // fire a second time anyway. Resetting the flag was misleading.
           return true;
         }
+        // Same as the hello path: if the verification heartbeat fails because
+        // the hub link dropped (not an auth rejection), defer without arming
+        // the re-auth backoff.
+        if (hbResult.error === 'hub_unreachable' || hbResult.error === 'hub_unreachable_backoff') {
+          hubUnreachable = true;
+          break;
+        }
         this.logger.warn(`[lifecycle] re-auth attempt ${attempt}: heartbeat still failing after rotate`);
       }
+      if (hubUnreachable) {
+        this.logger.warn('[lifecycle] re-auth deferred: hub unreachable (no re-auth backoff armed)');
+        return false;
+      }
       if (manualResetRequired) {
         this._emitManualResetNeeded();
       }
@@ -734,6 +806,15 @@ class LifecycleManager {
     // unchanged; only the boundary moved earlier.
     if (!this.hubUrl) return { ok: false, error: 'no_hub_url' };
     try {
+      const waitMs = this._hubUnreachableWaitMs();
+      if (waitMs > 0) {
+        return {
+          ok: false,
+          error: 'hub_unreachable_backoff',
+          retryAfterMs: waitMs,
+        };
+      }
+
       const nodeId = this.nodeId;
       if (!nodeId) {
         const helloResult = await this.hello();
@@ -798,9 +879,12 @@ class LifecycleManager {
         signal: AbortSignal.timeout(HEARTBEAT_TIMEOUT),
       });
 
+      await throwIfHubUnreachableResponse(res, 'lifecycle heartbeat');
+      this._recordHubReachable();
+
       if (res.status === 403 || res.status === 401) {
         this._consecutiveFailures++;
-        const errText = await res.text().catch(() => '');
+        const errText = await readHubResponseText(res).catch(() => '');
         this.logger.error(`[lifecycle] heartbeat auth failed (${res.status}): ${errText}`);
         if (!_skipReauth) {
           const recovered = await this.reAuthenticate();
@@ -813,7 +897,7 @@ class LifecycleManager {
       }
 
       if (!res.ok) {
-        const errText = await res.text().catch(() => '');
+        const errText = await readHubResponseText(res).catch(() => '');
         // 426 Upgrade Required: hub emits this when our evolver_version is
         // below the minimum version it requires. The body is JSON of shape
         // `{ error: 'evolver_min_version_required', force_update: {...} }`
@@ -881,7 +965,7 @@ class LifecycleManager {
         return { ok: false, error: `http_${res.status}`, statusCode: res.status };
       }
 
-      const data = await res.json();
+      const data = await readHubResponseJson(res);
 
       this._consecutiveFailures = 0;
       this.store.setState('last_heartbeat_at', new Date().toISOString());
@@ -981,6 +1065,16 @@ class LifecycleManager {
 
       return { ok: true, response: data };
     } catch (err) {
+      if (isHubUnreachableError(err)) {
+        this._consecutiveFailures++;
+        const retryAfterMs = this._recordHubUnreachable(err);
+        return {
+          ok: false,
+          error: 'hub_unreachable',
+          detail: err.message,
+          retryAfterMs,
+        };
+      }
       this._consecutiveFailures++;
       this.logger.error(`[lifecycle] heartbeat failed (${this._consecutiveFailures}): ${err.message}`);
       return { ok: false, error: err.message };
@@ -1074,7 +1168,14 @@ class LifecycleManager {
     // `DEFAULT_HEARTBEAT_INTERVAL` (6min) or the exponential branch
     // retries faster than the success branch (Bugbot #147 finding).
     const interval = this._heartbeatInterval || DEFAULT_HEARTBEAT_INTERVAL;
-    const backoff = this._consecutiveFailures > 0
+    const hubWaitMs = this._hubUnreachableWaitMs();
+    // While a hub-unreachable window is active, wake exactly when it elapses
+    // (1s floor to avoid a busy 0ms reschedule), mirroring SyncEngine's
+    // `Math.max(1_000, retryAfterMs)`. A 30s floor over-waited up to ~30s past
+    // the window's end, delaying recovery once the hub was reachable again.
+    const backoff = hubWaitMs > 0
+      ? Math.max(1_000, hubWaitMs)
+      : this._consecutiveFailures > 0
       ? Math.min(interval * Math.pow(2, this._consecutiveFailures), HEARTBEAT_BACKOFF_CAP_MS)
       : interval;
     const armedGen = this._heartbeatGen;

package/src/proxy/server/routes.js

@@ -86,17 +86,43 @@ function buildRoutes(store, proxyHandlers, taskMonitor, extensions) {
     },
 
     'POST /asset/submit': async ({ body }) => {
-      if (!body.assets && !body.asset_id) {
-        throw Object.assign(new Error('assets or asset_id is required'), { statusCode: 400 });
+      // The publish path builds a bundle from full asset objects; a bare
+      // asset_id is not a valid input here (Bugbot #256 Medium — route used to
+      // accept asset_id the handler then ignored).
+      if (!body.assets && !body.asset) {
+        throw Object.assign(new Error('assets (array) or asset (single object) is required'), { statusCode: 400 });
       }
-      const result = store.send({
-        type: 'asset_submit',
-        payload: body,
-        priority: body.priority || 'normal',
-      });
+      // Publish synchronously via the signed Gene+Capsule bundle path
+      // (POST /a2a/publish). The old `asset_submit` mailbox dispatch is gated
+      // off at the Hub (A2A_MAILBOX_ASSET_SUBMIT_ENABLED), so it silently
+      // failed; the Hub now enforces bundles. Returns the per-asset Hub result.
+      const result = await proxyHandlers.assetPublish(body);
       return { body: result };
     },
 
+    'POST /conversation/distill': async ({ body }) => {
+      const { distillConversation } = require('../../gep/conversationDistiller');
+      const input = body || {};
+      const distill = distillConversation(input, { persist: input.persist !== false });
+      if (!distill.ok) return { body: distill };
+
+      let publishResult = null;
+      if (input.publish !== false) {
+        publishResult = await proxyHandlers.assetPublish({
+          assets: [distill.gene, distill.capsule].filter(Boolean),
+        });
+      }
+
+      return {
+        body: {
+          ...distill,
+          queued: false,
+          published: Boolean(publishResult),
+          publish_result: publishResult,
+        },
+      };
+    },
+
     'GET /asset/submissions': async ({ query }) => {
       const submissions = store.list({
         type: 'asset_submit',
@@ -375,6 +401,10 @@ function buildRoutes(store, proxyHandlers, taskMonitor, extensions) {
       const inPending = store.countPending({ direction: 'inbound' });
       const nodeId = store.getState('node_id');
       const lastSync = store.getState('last_sync_at');
+      const lastSyncError = store.getState('last_sync_error');
+      const hubAuthStatus = store.getState('hub_auth_status');
+      const reauthBackoffUntil = store.getState('reauth_backoff_until');
+      const helloRateLimitUntil = store.getState('hello_rate_limit_until');
       return {
         body: {
           status: 'running',
@@ -384,6 +414,10 @@ function buildRoutes(store, proxyHandlers, taskMonitor, extensions) {
           outbound_pending: outPending,
           inbound_pending: inPending,
           last_sync_at: lastSync,
+          last_sync_error: lastSyncError || null,
+          hub_auth_status: hubAuthStatus || null,
+          reauth_backoff_until: reauthBackoffUntil || null,
+          hello_rate_limit_until: helloRateLimitUntil || null,
         },
       };
     },

package/src/proxy/server/settings.js

@@ -47,15 +47,19 @@ function writeSettings(data) {
   return merged;
 }
 
-function clearSettings() {
+function clearSettings(opts = {}) {
   try {
     const file = getSettingsFile();
     if (fs.existsSync(file)) {
       const current = readSettings();
+      const proxyPid = current.proxy?.pid;
+      if (!opts.force && proxyPid && proxyPid !== process.pid) return false;
       delete current.proxy;
       fs.writeFileSync(file, JSON.stringify(current, null, 2), 'utf8');
+      return true;
     }
   } catch {}
+  return false;
 }
 
 function isStaleProxy() {
@@ -82,7 +86,7 @@ function isStaleProxy() {
 
 function clearIfStale() {
   if (isStaleProxy()) {
-    clearSettings();
+    clearSettings({ force: true });
     return true;
   }
   return false;

package/src/proxy/sync/engine.js

@@ -77,12 +77,14 @@ class SyncEngine {
       // the whole tick, schedule the next iteration in `finally` so a
       // surprise throw cannot park the loop.
       let nextDelay = DEFAULT_OUTBOUND_INTERVAL;
+      let hubRetryAfterMs = 0;
       try {
         if (!this._running) return;
         this._outPending = true;
         try {
           const result = await this.outbound.flush();
           if (result.sent > 0) this._lastActivity = Date.now();
+          if (result.retryAfterMs > 0) hubRetryAfterMs = result.retryAfterMs;
           if ((result.sent > 0 || result.dropped > 0) && typeof this.onOutboundFlushed === 'function') {
             try { this.onOutboundFlushed(result); } catch (e) {
               this.logger.warn?.('[sync] onOutboundFlushed callback failed:', e.message);
@@ -96,13 +98,17 @@ class SyncEngine {
           }
         }
         this._outPending = false;
-        try {
-          const pending = this.store.countPending({ direction: 'outbound' });
-          if (pending > 0) nextDelay = 1_000;
-        } catch (err) {
-          // countPending threw (corrupt store, FS hiccup): keep the
-          // default cadence rather than parking the loop.
-          this.logger.error(`[sync] countPending threw (non-fatal): ${err && err.message}`);
+        if (hubRetryAfterMs > 0) {
+          nextDelay = Math.max(1_000, hubRetryAfterMs);
+        } else {
+          try {
+            const pending = this.store.countPending({ direction: 'outbound' });
+            if (pending > 0) nextDelay = 1_000;
+          } catch (err) {
+            // countPending threw (corrupt store, FS hiccup): keep the
+            // default cadence rather than parking the loop.
+            this.logger.error(`[sync] countPending threw (non-fatal): ${err && err.message}`);
+          }
         }
       } catch (err) {
         // Anything that escaped the inner blocks above. Log and let
@@ -123,11 +129,14 @@ class SyncEngine {
       // from inbound.pull / ackDelivered / _isIdle used to escape the
       // setTimeout callback and silently park the inbound loop.
       let nextDelay = DEFAULT_POLL_INTERVAL_ACTIVE;
+      let hubRetryAfterMs = 0;
       try {
         if (!this._running) return;
         try {
           const result = await this.inbound.pull();
-          if (result.received > 0) {
+          if (result.retryAfterMs > 0) {
+            hubRetryAfterMs = result.retryAfterMs;
+          } else if (result.received > 0) {
             this._lastActivity = Date.now();
             if (typeof this.onInboundReceived === 'function') {
               try { this.onInboundReceived(result.received); } catch (e) {
@@ -135,7 +144,10 @@ class SyncEngine {
               }
             }
           }
-          await this.inbound.ackDelivered();
+          if (!hubRetryAfterMs) {
+            const ack = await this.inbound.ackDelivered();
+            if (ack.retryAfterMs > 0) hubRetryAfterMs = ack.retryAfterMs;
+          }
         } catch (err) {
           if (err instanceof AuthError) {
             await this._handleAuthError('inbound');
@@ -143,12 +155,16 @@ class SyncEngine {
             this.logger.error(`[sync] inbound error: ${err.message}`);
           }
         }
-        try {
-          nextDelay = this._isIdle()
-            ? DEFAULT_POLL_INTERVAL_IDLE
-            : DEFAULT_POLL_INTERVAL_ACTIVE;
-        } catch (err) {
-          this.logger.error(`[sync] _isIdle threw (non-fatal): ${err && err.message}`);
+        if (hubRetryAfterMs > 0) {
+          nextDelay = Math.max(1_000, hubRetryAfterMs);
+        } else {
+          try {
+            nextDelay = this._isIdle()
+              ? DEFAULT_POLL_INTERVAL_IDLE
+              : DEFAULT_POLL_INTERVAL_ACTIVE;
+          } catch (err) {
+            this.logger.error(`[sync] _isIdle threw (non-fatal): ${err && err.message}`);
+          }
         }
       } catch (err) {
         this.logger.error(`[sync] inbound tick threw (non-fatal): ${err && err.message}`);

package/src/proxy/sync/inbound.js

@@ -2,7 +2,15 @@
 
 const { PROXY_PROTOCOL_VERSION } = require('../mailbox/store');
 const { AuthError } = require('../lifecycle/manager');
-const { hubFetch } = require('../../gep/hubFetch');
+const {
+  drainHubResponse,
+  hubFetch,
+  hubUnreachableBackoffMs,
+  isHubUnreachableError,
+  readHubResponseJson,
+  readHubResponseText,
+  throwIfHubUnreachableResponse,
+} = require('../../gep/hubFetch');
 
 const DEFAULT_POLL_INTERVAL_ACTIVE = 10_000;
 const DEFAULT_POLL_INTERVAL_IDLE = 60_000;
@@ -13,9 +21,41 @@ class InboundSync {
     this.hubUrl = hubUrl;
     this.logger = logger || console;
     this.getHeaders = getHeaders;
+    this._hubUnreachableFailures = 0;
+    this._hubUnreachableUntil = 0;
+  }
+
+  _hubUnreachableWaitMs() {
+    return Math.max(0, this._hubUnreachableUntil - Date.now());
+  }
+
+  _recordHubReachable() {
+    this._hubUnreachableFailures = 0;
+    this._hubUnreachableUntil = 0;
+  }
+
+  _recordHubUnreachable(err) {
+    this._hubUnreachableFailures += 1;
+    const retryAfterMs = hubUnreachableBackoffMs(this._hubUnreachableFailures);
+    this._hubUnreachableUntil = Date.now() + retryAfterMs;
+    this.logger.warn?.(
+      `[inbound] Hub unreachable; backing off for ${Math.ceil(retryAfterMs / 1000)}s: ` +
+        `${err && err.message || err}`
+    );
+    return retryAfterMs;
   }
 
   async pull(channel = 'evomap-hub', limit = 50) {
+    const waitMs = this._hubUnreachableWaitMs();
+    if (waitMs > 0) {
+      return {
+        received: 0,
+        error: 'hub_unreachable_backoff',
+        hubUnreachable: true,
+        retryAfterMs: waitMs,
+      };
+    }
+
     const cursorKey = `${channel}:inbound_cursor`;
     const cursor = this.store.getCursor(cursorKey);
 
@@ -30,17 +70,20 @@ class InboundSync {
         signal: AbortSignal.timeout(35_000),
       });
 
+      await throwIfHubUnreachableResponse(res, 'inbound pull');
+      this._recordHubReachable();
+
       if (res.status === 403 || res.status === 401) {
-        const errText = await res.text().catch(() => 'unknown');
+        const errText = await readHubResponseText(res).catch(() => 'unknown');
         throw new AuthError(`Hub ${res.status}: ${errText}`, res.status);
       }
 
       if (!res.ok) {
-        const errText = await res.text().catch(() => 'unknown');
+        const errText = await readHubResponseText(res).catch(() => 'unknown');
         throw new Error(`Hub returned ${res.status}: ${errText}`);
       }
 
-      const data = await res.json();
+      const data = await readHubResponseJson(res);
       const messages = data.messages || [];
 
       if (messages.length > 0) {
@@ -64,12 +107,31 @@ class InboundSync {
       return { received: messages.length, cursor: data.next_cursor || cursor };
     } catch (err) {
       if (err instanceof AuthError) throw err;
+      if (isHubUnreachableError(err)) {
+        const retryAfterMs = this._recordHubUnreachable(err);
+        return {
+          received: 0,
+          error: 'hub_unreachable',
+          hubUnreachable: true,
+          retryAfterMs,
+        };
+      }
       this.logger.error(`[inbound] pull failed: ${err.message}`);
       return { received: 0, error: err.message };
     }
   }
 
   async ackDelivered(channel = 'evomap-hub') {
+    const waitMs = this._hubUnreachableWaitMs();
+    if (waitMs > 0) {
+      return {
+        acked: 0,
+        error: 'hub_unreachable_backoff',
+        hubUnreachable: true,
+        retryAfterMs: waitMs,
+      };
+    }
+
     const delivered = this.store.list({
       type: '%',
       direction: 'inbound',
@@ -97,13 +159,29 @@ class InboundSync {
         body: JSON.stringify({ sender_id: senderId, message_ids: delivered.map(m => m.id) }),
         signal: AbortSignal.timeout(10_000),
       });
-      try {
-        if (res && res.body && typeof res.body.cancel === 'function') {
-          await res.body.cancel().catch(() => {});
-        }
-      } catch (_) { /* never escape the drain helper */ }
+      await throwIfHubUnreachableResponse(res, 'inbound ack');
+      this._recordHubReachable();
+      if (res.status === 403 || res.status === 401) {
+        const errText = await readHubResponseText(res).catch(() => 'unknown');
+        throw new AuthError(`Hub ${res.status}: ${errText}`, res.status);
+      }
+      if (!res.ok) {
+        const errText = await readHubResponseText(res).catch(() => 'unknown');
+        throw new Error(`Hub returned ${res.status}: ${errText}`);
+      }
+      await drainHubResponse(res);
       return { acked: delivered.length };
     } catch (err) {
+      if (err instanceof AuthError) throw err;
+      if (isHubUnreachableError(err)) {
+        const retryAfterMs = this._recordHubUnreachable(err);
+        return {
+          acked: 0,
+          error: 'hub_unreachable',
+          hubUnreachable: true,
+          retryAfterMs,
+        };
+      }
       this.logger.error(`[inbound] ack failed: ${err.message}`);
       return { acked: 0, error: err.message };
     }

package/src/proxy/sync/outbound.js

@@ -3,7 +3,14 @@
 const { PROXY_PROTOCOL_VERSION } = require('../mailbox/store');
 const { AuthError } = require('../lifecycle/manager');
 const { isProxyTraceUploadPayloadAllowed, resolveTraceMode } = require('../trace/extractor');
-const { hubFetch } = require('../../gep/hubFetch');
+const {
+  hubFetch,
+  hubUnreachableBackoffMs,
+  isHubUnreachableError,
+  readHubResponseJson,
+  readHubResponseText,
+  throwIfHubUnreachableResponse,
+} = require('../../gep/hubFetch');
 
 const MAX_BATCH = 50;
 const MAX_RETRIES = 10;
@@ -14,9 +21,41 @@ class OutboundSync {
     this.hubUrl = hubUrl;
     this.logger = logger || console;
     this.getHeaders = getHeaders;
+    this._hubUnreachableFailures = 0;
+    this._hubUnreachableUntil = 0;
+  }
+
+  _hubUnreachableWaitMs() {
+    return Math.max(0, this._hubUnreachableUntil - Date.now());
+  }
+
+  _recordHubReachable() {
+    this._hubUnreachableFailures = 0;
+    this._hubUnreachableUntil = 0;
+  }
+
+  _recordHubUnreachable(err) {
+    this._hubUnreachableFailures += 1;
+    const retryAfterMs = hubUnreachableBackoffMs(this._hubUnreachableFailures);
+    this._hubUnreachableUntil = Date.now() + retryAfterMs;
+    this.logger.warn?.(
+      `[outbound] Hub unreachable; backing off for ${Math.ceil(retryAfterMs / 1000)}s: ` +
+        `${err && err.message || err}`
+    );
+    return retryAfterMs;
   }
 
   async flush(channel = 'evomap-hub') {
+    const waitMs = this._hubUnreachableWaitMs();
+    if (waitMs > 0) {
+      return {
+        sent: 0,
+        error: 'hub_unreachable_backoff',
+        hubUnreachable: true,
+        retryAfterMs: waitMs,
+      };
+    }
+
     const pendingBatch = this.store.pollOutbound({ channel, limit: MAX_BATCH });
     if (pendingBatch.length === 0) return { sent: 0 };
 
@@ -65,17 +104,20 @@ class OutboundSync {
         signal: AbortSignal.timeout(30_000),
       });
 
+      await throwIfHubUnreachableResponse(res, 'outbound flush');
+      this._recordHubReachable();
+
       if (res.status === 403 || res.status === 401) {
-        const errText = await res.text().catch(() => 'unknown');
+        const errText = await readHubResponseText(res).catch(() => 'unknown');
         throw new AuthError(`Hub ${res.status}: ${errText}`, res.status);
       }
 
       if (!res.ok) {
-        const errText = await res.text().catch(() => 'unknown');
+        const errText = await readHubResponseText(res).catch(() => 'unknown');
         throw new Error(`Hub returned ${res.status}: ${errText}`);
       }
 
-      const data = await res.json();
+      const data = await readHubResponseJson(res);
       const results = data.results || [];
 
       const updates = [];
@@ -112,6 +154,17 @@ class OutboundSync {
       return result;
     } catch (err) {
       if (err instanceof AuthError) throw err;
+      if (isHubUnreachableError(err)) {
+        const retryAfterMs = this._recordHubUnreachable(err);
+        const result = {
+          sent: 0,
+          error: 'hub_unreachable',
+          hubUnreachable: true,
+          retryAfterMs,
+        };
+        if (dropped > 0) result.dropped = dropped;
+        return result;
+      }
       this.logger.error(`[outbound] flush failed: ${err.message}`);
       for (const m of pending) {
         this.store.incrementRetry(m.id, err.message);