feat: pos network download restart + smart retry + systemd healer — outage-resilient downloads

restart <gid>: re-queue from history — torrents via rebuilt magnet
(urn:btih: + &tr= trackers), HTTP via original URIs keeping dir/out;
--continue=true resumes partials, complete files verify instantly.

retry <gid|all>: waits out internet outages (NET_PROBE seam,
--interval/--max-wait), re-queues and re-verifies; aria2 error 3 = real
problem → diagnosed + marked permanent (url:/bt: ids in download.retry,
skipped by retry all, manual restart overrides); --once/--quiet for the
healer timer.

Healer: pos-aria2-retry.{service,timer} user units — arms on download
start (add/torrent/metalink/restart), disables when nothing left.
watch <gid> auto-restarts after an outage.

Fixes from stub-suite review: ensure_healer missing from submit paths;
RESTART_NAME lost across do_restart subshell (download_name helper);
restart exited 1 (tmux test as last statement).

Stub harness (/tmp/opencode/dl-test) 119/119 green; make gen && make check green.
Docs: POS.md rows, howto/network.md outage recipe, SYSTEMD.md user units.

DOC/SYSTEMD.md

@@ -6,6 +6,7 @@ The units installed and enabled by `postinstall.sh`, plus the `pos` bash complet
   - [`autostart.service`](#autostartservice)
   - [`ssh-agent.service`](#ssh-agentservice)
   - [`pos-health.service`](#pos-healthservice)
+- [Per-user units (`pos network download`)](#per-user-units-pos-network-download)
 - [Feature-flag gating](#feature-flag-gating)
 - [Bash completion](#bash-completion)
 
@@ -88,6 +89,31 @@ The service is `Type=oneshot` and is driven **only** by its companion `pos-healt
 
 ---
 
+## Per-user units (`pos network download`)
+
+The aria2 download tool installs **user-scope** units (not by postinstall):
+written to `~/.config/systemd/user/` and enabled with `systemctl --user` on
+first use, so they need no sudo.
+
+- `pos-aria2.service` — the daemon (`Type=simple`, `Restart=on-failure`,
+  `WantedBy=default.target`): runs `aria2c --enable-rpc
+  --rpc-listen-port=6800 --rpc-secret=… --dir=$HOME/Downloads --continue=true
+  --max-connection-per-server=16 --split=16 --seed-time=0`. `pos network
+  download start` generates the `RPC_SECRET` into
+  `~/.config/linux_post_install/download.env` (chmod 600).
+- `pos-aria2-retry.service` — `Type=oneshot`; `ExecStart=<pos> network download
+  retry all --once --quiet` (runner = `/usr/local/bin/pos-network-download`,
+  repo-path fallback with a warning). Driven only by its companion timer.
+- `pos-aria2-retry.timer` — `OnUnitActiveSec=2min` + `OnBootSec=2min`,
+  `AccuracySec=30s`, `Persistent=true`, `WantedBy=timers.target`. Arms itself
+  when a download starts (`add`/`torrent`/`metalink`/`restart`) and disables
+  itself when no active, waiting, or errored downloads remain.
+
+On headless boxes `pos network download start` prints a `loginctl
+enable-linger` warning so the user units survive logout.
+
+---
+
 ## Feature-flag gating
 
 The systemd loop in `postinstall.sh` special-cases two units: