release(v1.7.22-alpha): honest anchor status + Reconnect works on all nodes

- fips::service::active_unit() picks whichever fips unit is running
  (archipelago-fips.service vs upstream fips.service) so
  handle_fips_restart and handle_fips_reconnect don't silently no-op
  on hosts where the archipelago-managed unit was never created.
- peer_connectivity_summary(anchor_candidates) replaces the old
  identity-cache check. anchor_connected is now true when at least
  one authenticated peer's npub matches the public anchor OR any
  entry in seed-anchors.json, which matches what the user actually
  cares about ("am I in the mesh?") rather than what the card used
  to claim ("is this one specific public anchor reachable?").
- FipsStatus::query takes data_dir now (so it can read seed-anchors)
  rather than identity_dir. All call-sites updated.
- handle_fips_reconnect re-pushes seed anchors after restart so the
  new daemon gets dialed without waiting for the 5-min apply loop.
- FipsNetworkCard label drops "(fips.v0l.io)" — misleading now that
  multiple anchors may be configured.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

core/archipelago/src/api/rpc/fips.rs

@@ -12,8 +12,7 @@ use anyhow::Result;
 
 impl RpcHandler {
     pub(super) async fn handle_fips_status(&self) -> Result<serde_json::Value> {
-        let identity_dir = fips::identity_dir_from(&self.config.data_dir);
-        let status = fips::FipsStatus::query(&identity_dir).await;
+        let status = fips::FipsStatus::query(&self.config.data_dir).await;
         Ok(serde_json::to_value(status)?)
     }
 
@@ -36,13 +35,19 @@ impl RpcHandler {
         let identity_dir = fips::identity_dir_from(&self.config.data_dir);
         fips::config::install(&identity_dir).await?;
         fips::service::activate(fips::SERVICE_UNIT).await?;
-        let status = fips::FipsStatus::query(&identity_dir).await;
+        let status = fips::FipsStatus::query(&self.config.data_dir).await;
         Ok(serde_json::to_value(status)?)
     }
 
+    /// Restart whichever fips unit is supervising the daemon on this host.
+    /// Nodes installed from the archipelago ISO use `archipelago-fips.service`;
+    /// nodes that had the upstream debian package set up first may only have
+    /// `fips.service`. We resolve the active one via `service::active_unit()`
+    /// so the UI button is never a no-op.
     pub(super) async fn handle_fips_restart(&self) -> Result<serde_json::Value> {
-        fips::service::restart(fips::SERVICE_UNIT).await?;
-        Ok(serde_json::json!({ "restarted": true }))
+        let unit = fips::service::active_unit().await;
+        fips::service::restart(unit).await?;
+        Ok(serde_json::json!({ "restarted": true, "unit": unit }))
     }
 
     /// Full reconnect: stop the daemon, bring it back, wait for the DHT
@@ -53,7 +58,7 @@ impl RpcHandler {
     /// Runtime: ~20s. Needs an RPC timeout ≥ 45s on the client.
     pub(super) async fn handle_fips_reconnect(&self) -> Result<serde_json::Value> {
         let identity_dir = fips::identity_dir_from(&self.config.data_dir);
-        let before = fips::FipsStatus::query(&identity_dir).await;
+        let before = fips::FipsStatus::query(&self.config.data_dir).await;
 
         // Heal the pre-fix bech32-text fips_key.pub → 32-raw-bytes
         // mismatch. The daemon silently authenticates with a garbage
@@ -70,12 +75,26 @@ impl RpcHandler {
             let _ = fips::config::install(&identity_dir).await;
         }
 
-        // Clean stop+start rather than `restart`, so a daemon that
-        // fails to come back up surfaces as service_active=false
-        // instead of quietly sticking with the old process.
-        let _ = fips::service::stop(fips::SERVICE_UNIT).await;
+        // Operate on whichever fips unit is actually up — nodes that
+        // have the upstream `fips.service` rather than the
+        // archipelago-managed `archipelago-fips.service` used to see
+        // Reconnect silently fail because we stopped a unit that
+        // didn't exist. Clean stop+start rather than `restart` so a
+        // daemon that fails to come back up surfaces as
+        // service_active=false instead of quietly sticking with the
+        // old process.
+        let unit = fips::service::active_unit().await;
+        let _ = fips::service::stop(unit).await;
         tokio::time::sleep(std::time::Duration::from_millis(800)).await;
-        fips::service::activate(fips::SERVICE_UNIT).await?;
+        fips::service::activate(unit).await?;
+
+        // Re-push seed anchors after restart so freshly-bound daemons
+        // don't have to wait 5 min for the periodic apply loop.
+        if let Ok(list) = fips::anchors::load(&self.config.data_dir).await {
+            if !list.is_empty() {
+                let _ = fips::anchors::apply(&list).await;
+            }
+        }
 
         // Anchor bootstrap window: poll the status every ~3s for up to
         // 20s. Bail as soon as the anchor is connected.
@@ -83,7 +102,7 @@ impl RpcHandler {
         let deadline = std::time::Instant::now() + std::time::Duration::from_secs(20);
         loop {
             tokio::time::sleep(std::time::Duration::from_secs(3)).await;
-            let s = fips::FipsStatus::query(&identity_dir).await;
+            let s = fips::FipsStatus::query(&self.config.data_dir).await;
             if s.anchor_connected {
                 last_status = Some(s);
                 break;
@@ -111,13 +130,13 @@ impl RpcHandler {
             "peers_but_no_anchor"
         };
         let hint = match likely_cause {
-            "connected" => "Anchor is reachable.",
-            "daemon_down" => "The FIPS daemon didn't come back up — check archipelago-fips.service.",
+            "connected" => "An anchor is reachable.",
+            "daemon_down" => "The FIPS daemon didn't come back up — check the FIPS service on this host.",
             "no_seed_key" => "No seed-derived FIPS key on disk. Re-run the onboarding unlock step.",
             "no_outbound_udp_or_anchor_down" =>
-                "Daemon is running but no peers handshook. Your router / ISP might be blocking outbound UDP 8668, or the anchor (fips.v0l.io) could be down.",
+                "Daemon is running but no peers handshook. Your router / ISP might be blocking outbound UDP 8668, or every configured anchor could be down. Add a reachable peer in Seed Anchors.",
             "peers_but_no_anchor" =>
-                "Mesh has peers but the anchor hasn't been seen yet. Give it a minute and re-check.",
+                "Mesh has peers but none of them are anchors we recognise. Add your cluster's anchor in Seed Anchors.",
             _ => "",
         };