Okay, going to try to kick this federation out the door tomorrow.
The robustness I wanted isn't worth setting things back as much as it's going to. Essentially, it'll mean some statuses won't be retried if an instance isn't available to receive them. But all data will be there, messages will be verified, etc.