darkfi/openspec/changes/evgr-resume-bug/tasks.md

1. Lib: repair primitive (src/event_graph/mod.rs)

• 1.1 Add EventGraph::dag_repair(dag_ts) reusing sync_impl's peer-query/body-fetch machinery but skipping the missing-tips early return (always issue HeaderReq(our_tips) to all peers, insert returned headers via header_dag_insert, then run fetch_missing_events). Verify with a unit test in src/event_graph/tests.rs: node A and B hold a DAG where B is missing a mid-history branch (not an ancestor of B's tips) but holds all tips; dag_repair commits the branch on B.
• 1.2 Make per-event commit failures in the repair body-fetch phase lenient (log + skip + count, return Ok with counts) instead of the strict DagSyncFailed used by initial sync. Verify with a unit test: one peer serves a header but no blob for one event; repair commits the rest and reports the skip.
• 1.3 Run make test (proofs + contracts must be prebuilt) and confirm the full event_graph test suite passes, including existing dag_sync/fetch_missing_events strict-path tests (behavior of initial sync unchanged).

2. App: repair task and triggers (bin/app/src/plugin/darkirc.rs)

• 2.1 Add a repair_sync task mirroring catch_up_sync's shape: waits on an in-flight guard + trigger latch, requires event_graph.is_synced(), calls dag_repair for current_genesis, never touches the synced flag. Verify by code review against design D3 and by a desktop debug run (make compile-dev) showing the repair start/complete log lines.
• 2.2 Wire triggers: screen_changed(screen_on=true), darkirc_start slot, a subscribe_channel watcher firing on peers 0→≥1, and a periodic timer (REPAIR_INTERVAL, 15 min constant). Triggers during an in-flight round are latched, not dropped. Verify with a debug build log showing coalescing (one round despite three simultaneous triggers) and periodic rounds firing idle.
• 2.3 Emit observability per spec: round start (slot id + trigger source) and completion (headers gained, bodies committed, skipped count). Verify the log lines appear in a debug run.

3. End-to-end verification

• 3.1 Reproduce the incident shape locally (models both mobile screen-off and laptop lid-close resume): run two desktop nodes + seed, suspend node B's connections entirely (stop outbound), generate traffic on a branch B will not receive via gossip, resume B, and verify B's history converges to A's within one repair round (diff the two nodes' order_events() output). Repeat with B's process itself frozen (SIGSTOP) across the gap to model OS suspend with no wake signal, verifying the peer-recovery/periodic triggers fire the repair.
• 3.2 Verify no regression on resume cost: with no gap (B current), a repair round issues only the header exchange and fetches zero bodies (log shows 0 committed), and live EventPut ingestion is never blocked during a round (send traffic through B while a round runs; messages relay to the UI).
• 3.3 Compile checks: make compile-dev (desktop) and make compile-apk (android) both succeed; make clippy clean.