The way I feel it, and maybe I've got this wrong is that federation works in an outbound fashion. Every instance sends to all its federation "hey, this thing just happened on my side".

But if an instance goes down and it becomes "incompatible" like what happened to us for the past week or so, I feel that everything that happened in the meantime got irremediably lost.

I think there should be a contingency plan if one instance goes down. Something proactive along the way of "hey, I was down, I haven't heard from you since xxxx seconds, could you send me an update?" Depending on the activity and the timespan the could trigger massive amounts of data being sent and has the potential to be abused so safeguards should be put in place, but maybe that could be a solution. Keep the real-time exchanges as the primary method but have a full sync once in a while.