release(v1.7.22-alpha): honest anchor status + Reconnect works on all nodes

- fips::service::active_unit() picks whichever fips unit is running
  (archipelago-fips.service vs upstream fips.service) so
  handle_fips_restart and handle_fips_reconnect don't silently no-op
  on hosts where the archipelago-managed unit was never created.
- peer_connectivity_summary(anchor_candidates) replaces the old
  identity-cache check. anchor_connected is now true when at least
  one authenticated peer's npub matches the public anchor OR any
  entry in seed-anchors.json, which matches what the user actually
  cares about ("am I in the mesh?") rather than what the card used
  to claim ("is this one specific public anchor reachable?").
- FipsStatus::query takes data_dir now (so it can read seed-anchors)
  rather than identity_dir. All call-sites updated.
- handle_fips_reconnect re-pushes seed anchors after restart so the
  new daemon gets dialed without waiting for the 5-min apply loop.
- FipsNetworkCard label drops "(fips.v0l.io)" — misleading now that
  multiple anchors may be configured.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-iso-dev.yml

@@ -74,12 +74,38 @@ jobs:
 
       - name: Include AIUI if available
         run: |
-          if [ -d "/opt/archipelago/web-ui/aiui" ] && [ -f "/opt/archipelago/web-ui/aiui/index.html" ]; then
-            mkdir -p web/dist/neode-ui/aiui
-            cp -r /opt/archipelago/web-ui/aiui/* web/dist/neode-ui/aiui/
-            echo "AIUI included from /opt/archipelago/web-ui/aiui/"
+          # AIUI (the Claude chat sidebar) lives outside the Vue build
+          # and must be copied into the frontend dist BEFORE packaging,
+          # otherwise OTA-tarball upgrades silently strip it from nodes
+          # in the field. Try in order: cached on runner, then the
+          # newest release tarball in this repo's releases/ dir as a
+          # fallback so a freshly-provisioned runner still gets AIUI.
+          AIUI_SRC=""
+          if [ -f "/opt/archipelago/web-ui/aiui/index.html" ]; then
+            AIUI_SRC="/opt/archipelago/web-ui/aiui"
+          elif [ -f "$HOME/archy/web/dist/neode-ui/aiui/index.html" ]; then
+            AIUI_SRC="$HOME/archy/web/dist/neode-ui/aiui"
           else
-            echo "WARNING: AIUI not found on build server — ISO will not include AIUI"
+            LATEST_FRONTEND=$(ls -t releases/v*/archipelago-frontend-*.tar.gz 2>/dev/null | head -1)
+            if [ -n "$LATEST_FRONTEND" ]; then
+              echo "Extracting AIUI from $LATEST_FRONTEND (runner cache miss)"
+              TMP=$(mktemp -d)
+              tar xzf "$LATEST_FRONTEND" -C "$TMP" ./aiui 2>/dev/null || true
+              if [ -f "$TMP/aiui/index.html" ]; then
+                AIUI_SRC="$TMP/aiui"
+              fi
+            fi
+          fi
+          if [ -n "$AIUI_SRC" ]; then
+            mkdir -p web/dist/neode-ui/aiui
+            cp -r "$AIUI_SRC/"* web/dist/neode-ui/aiui/
+            echo "AIUI included from $AIUI_SRC ($(du -sh web/dist/neode-ui/aiui | cut -f1))"
+          else
+            echo "FAIL: AIUI not found anywhere (runner cache + release tarballs)"
+            echo "  checked: /opt/archipelago/web-ui/aiui"
+            echo "           \$HOME/archy/web/dist/neode-ui/aiui"
+            echo "           releases/v*/archipelago-frontend-*.tar.gz"
+            exit 1
           fi
 
       - name: Configure root podman for insecure registry
@@ -93,7 +119,15 @@ jobs:
         run: |
           cd image-recipe
           export ARCHIPELAGO_BIN="$(pwd)/../core/target/release/archipelago"
-          ls -la "$ARCHIPELAGO_BIN" || echo "WARNING: binary not found"
+          if [ ! -x "$ARCHIPELAGO_BIN" ]; then
+            echo "FAIL: backend binary missing or not executable at $ARCHIPELAGO_BIN"
+            exit 1
+          fi
+          BIN_VERSION=$(strings "$ARCHIPELAGO_BIN" | grep -oE 'archipelago [0-9]+\.[0-9]+\.[0-9]+(-[a-z]+)?' | head -1 || true)
+          EXPECTED=$(grep '^version' ../core/archipelago/Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
+          echo "Binary: $ARCHIPELAGO_BIN ($(du -h "$ARCHIPELAGO_BIN" | cut -f1))"
+          echo "Embedded version string: ${BIN_VERSION:-unknown}"
+          echo "Expected version (Cargo.toml): $EXPECTED"
           sudo -E UNBUNDLED=1 DEV_SERVER=localhost BUILD_FROM_SOURCE=0 \
             ARCHIPELAGO_BIN="$ARCHIPELAGO_BIN" \
             ./build-auto-installer-iso.sh

core/Cargo.lock

@@ -80,7 +80,7 @@ checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
 
 [[package]]
 name = "archipelago"
-version = "1.7.16-alpha"
+version = "1.7.22-alpha"
 dependencies = [
  "anyhow",
  "archipelago-container",

core/archipelago/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "archipelago"
-version = "1.7.16-alpha"
+version = "1.7.22-alpha"
 edition = "2021"
 description = "Archipelago Bitcoin Node OS - Native backend"
 authors = ["Archipelago Team"]

core/archipelago/src/api/rpc/dispatcher.rs

@@ -414,12 +414,23 @@ impl RpcHandler {
             "fips.install" => self.handle_fips_install().await,
             "fips.restart" => self.handle_fips_restart().await,
             "fips.reconnect" => self.handle_fips_reconnect().await,
+            "fips.list-seed-anchors" => self.handle_fips_list_seed_anchors().await,
+            "fips.add-seed-anchor" => {
+                let p = params.unwrap_or(serde_json::json!({}));
+                self.handle_fips_add_seed_anchor(&p).await
+            }
+            "fips.remove-seed-anchor" => {
+                let p = params.unwrap_or(serde_json::json!({}));
+                self.handle_fips_remove_seed_anchor(&p).await
+            }
+            "fips.apply-seed-anchors" => self.handle_fips_apply_seed_anchors().await,
 
             // System updates
             "update.check" => self.handle_update_check().await,
             "update.status" => self.handle_update_status().await,
             "update.dismiss" => self.handle_update_dismiss().await,
             "update.download" => self.handle_update_download().await,
+            "update.cancel-download" => self.handle_update_cancel_download().await,
             "update.apply" => self.handle_update_apply().await,
             "update.git-apply" => self.handle_update_git_apply().await,
             "update.rollback" => self.handle_update_rollback().await,

core/archipelago/src/api/rpc/fips.rs

@@ -12,8 +12,7 @@ use anyhow::Result;
 
 impl RpcHandler {
     pub(super) async fn handle_fips_status(&self) -> Result<serde_json::Value> {
-        let identity_dir = fips::identity_dir_from(&self.config.data_dir);
-        let status = fips::FipsStatus::query(&identity_dir).await;
+        let status = fips::FipsStatus::query(&self.config.data_dir).await;
         Ok(serde_json::to_value(status)?)
     }
 
@@ -36,13 +35,19 @@ impl RpcHandler {
         let identity_dir = fips::identity_dir_from(&self.config.data_dir);
         fips::config::install(&identity_dir).await?;
         fips::service::activate(fips::SERVICE_UNIT).await?;
-        let status = fips::FipsStatus::query(&identity_dir).await;
+        let status = fips::FipsStatus::query(&self.config.data_dir).await;
         Ok(serde_json::to_value(status)?)
     }
 
+    /// Restart whichever fips unit is supervising the daemon on this host.
+    /// Nodes installed from the archipelago ISO use `archipelago-fips.service`;
+    /// nodes that had the upstream debian package set up first may only have
+    /// `fips.service`. We resolve the active one via `service::active_unit()`
+    /// so the UI button is never a no-op.
     pub(super) async fn handle_fips_restart(&self) -> Result<serde_json::Value> {
-        fips::service::restart(fips::SERVICE_UNIT).await?;
-        Ok(serde_json::json!({ "restarted": true }))
+        let unit = fips::service::active_unit().await;
+        fips::service::restart(unit).await?;
+        Ok(serde_json::json!({ "restarted": true, "unit": unit }))
     }
 
     /// Full reconnect: stop the daemon, bring it back, wait for the DHT
@@ -53,7 +58,7 @@ impl RpcHandler {
     /// Runtime: ~20s. Needs an RPC timeout ≥ 45s on the client.
     pub(super) async fn handle_fips_reconnect(&self) -> Result<serde_json::Value> {
         let identity_dir = fips::identity_dir_from(&self.config.data_dir);
-        let before = fips::FipsStatus::query(&identity_dir).await;
+        let before = fips::FipsStatus::query(&self.config.data_dir).await;
 
         // Heal the pre-fix bech32-text fips_key.pub → 32-raw-bytes
         // mismatch. The daemon silently authenticates with a garbage
@@ -70,12 +75,26 @@ impl RpcHandler {
             let _ = fips::config::install(&identity_dir).await;
         }
 
-        // Clean stop+start rather than `restart`, so a daemon that
-        // fails to come back up surfaces as service_active=false
-        // instead of quietly sticking with the old process.
-        let _ = fips::service::stop(fips::SERVICE_UNIT).await;
+        // Operate on whichever fips unit is actually up — nodes that
+        // have the upstream `fips.service` rather than the
+        // archipelago-managed `archipelago-fips.service` used to see
+        // Reconnect silently fail because we stopped a unit that
+        // didn't exist. Clean stop+start rather than `restart` so a
+        // daemon that fails to come back up surfaces as
+        // service_active=false instead of quietly sticking with the
+        // old process.
+        let unit = fips::service::active_unit().await;
+        let _ = fips::service::stop(unit).await;
         tokio::time::sleep(std::time::Duration::from_millis(800)).await;
-        fips::service::activate(fips::SERVICE_UNIT).await?;
+        fips::service::activate(unit).await?;
+
+        // Re-push seed anchors after restart so freshly-bound daemons
+        // don't have to wait 5 min for the periodic apply loop.
+        if let Ok(list) = fips::anchors::load(&self.config.data_dir).await {
+            if !list.is_empty() {
+                let _ = fips::anchors::apply(&list).await;
+            }
+        }
 
         // Anchor bootstrap window: poll the status every ~3s for up to
         // 20s. Bail as soon as the anchor is connected.
@@ -83,7 +102,7 @@ impl RpcHandler {
         let deadline = std::time::Instant::now() + std::time::Duration::from_secs(20);
         loop {
             tokio::time::sleep(std::time::Duration::from_secs(3)).await;
-            let s = fips::FipsStatus::query(&identity_dir).await;
+            let s = fips::FipsStatus::query(&self.config.data_dir).await;
             if s.anchor_connected {
                 last_status = Some(s);
                 break;
@@ -111,13 +130,13 @@ impl RpcHandler {
             "peers_but_no_anchor"
         };
         let hint = match likely_cause {
-            "connected" => "Anchor is reachable.",
-            "daemon_down" => "The FIPS daemon didn't come back up — check archipelago-fips.service.",
+            "connected" => "An anchor is reachable.",
+            "daemon_down" => "The FIPS daemon didn't come back up — check the FIPS service on this host.",
             "no_seed_key" => "No seed-derived FIPS key on disk. Re-run the onboarding unlock step.",
             "no_outbound_udp_or_anchor_down" =>
-                "Daemon is running but no peers handshook. Your router / ISP might be blocking outbound UDP 8668, or the anchor (fips.v0l.io) could be down.",
+                "Daemon is running but no peers handshook. Your router / ISP might be blocking outbound UDP 8668, or every configured anchor could be down. Add a reachable peer in Seed Anchors.",
             "peers_but_no_anchor" =>
-                "Mesh has peers but the anchor hasn't been seen yet. Give it a minute and re-check.",
+                "Mesh has peers but none of them are anchors we recognise. Add your cluster's anchor in Seed Anchors.",
             _ => "",
         };
 
@@ -129,4 +148,66 @@ impl RpcHandler {
             "after": after,
         }))
     }
+
+    /// List the seed-anchor entries configured on this node.
+    pub(super) async fn handle_fips_list_seed_anchors(&self) -> Result<serde_json::Value> {
+        let list = fips::anchors::load(&self.config.data_dir).await?;
+        Ok(serde_json::json!({ "seed_anchors": list }))
+    }
+
+    /// Add (or update) a seed anchor and immediately push it into the
+    /// running daemon. Params: `{ npub, address, transport?, label? }`.
+    pub(super) async fn handle_fips_add_seed_anchor(
+        &self,
+        params: &serde_json::Value,
+    ) -> Result<serde_json::Value> {
+        let anchor: fips::anchors::SeedAnchor = serde_json::from_value(params.clone())
+            .map_err(|e| anyhow::anyhow!("bad seed anchor payload: {}", e))?;
+        if !anchor.npub.starts_with("npub1") {
+            anyhow::bail!("npub must be bech32 (npub1...)");
+        }
+        if !anchor.address.contains(':') {
+            anyhow::bail!("address must be host:port (e.g. 192.168.1.116:8668)");
+        }
+        let list =
+            fips::anchors::add(&self.config.data_dir, anchor.clone()).await?;
+        // Push just the newly-added anchor into the running daemon so
+        // the user sees effect without waiting for the periodic apply.
+        let results = fips::anchors::apply(&[anchor]).await;
+        Ok(serde_json::json!({
+            "seed_anchors": list,
+            "apply": results.iter().map(|r| {
+                serde_json::json!({ "npub": r.npub, "ok": r.ok, "message": r.message })
+            }).collect::<Vec<_>>(),
+        }))
+    }
+
+    /// Remove a seed anchor by npub. Params: `{ npub }`. Does NOT tear
+    /// down an already-authenticated peer connection — it only stops
+    /// us from re-dialing the anchor on the next apply cycle.
+    pub(super) async fn handle_fips_remove_seed_anchor(
+        &self,
+        params: &serde_json::Value,
+    ) -> Result<serde_json::Value> {
+        let npub = params
+            .get("npub")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("missing npub"))?;
+        let list = fips::anchors::remove(&self.config.data_dir, npub).await?;
+        Ok(serde_json::json!({ "seed_anchors": list }))
+    }
+
+    /// Re-apply all seed anchors to the running daemon. Useful after a
+    /// FIPS restart or when the user wants to force a reconnection
+    /// attempt without waiting for the periodic apply loop.
+    pub(super) async fn handle_fips_apply_seed_anchors(&self) -> Result<serde_json::Value> {
+        let list = fips::anchors::load(&self.config.data_dir).await?;
+        let results = fips::anchors::apply(&list).await;
+        Ok(serde_json::json!({
+            "applied": results.len(),
+            "results": results.iter().map(|r| {
+                serde_json::json!({ "npub": r.npub, "ok": r.ok, "message": r.message })
+            }).collect::<Vec<_>>(),
+        }))
+    }
 }

core/archipelago/src/api/rpc/update.rs

@@ -168,6 +168,27 @@ impl RpcHandler {
         let active = total > 0 && downloaded < total;
         let completed = total > 0 && downloaded >= total;
 
+        // Stall detection: if the progress-at timestamp hasn't advanced
+        // for 30+ seconds while active, the download is wedged (usually
+        // HTTP stream silently dropped and reqwest is waiting out its
+        // read timeout). The UI uses this to surface a Cancel button
+        // with explanatory copy.
+        let stalled = if active {
+            let last_at = update::DOWNLOAD_PROGRESS_AT
+                .load(std::sync::atomic::Ordering::Relaxed);
+            if last_at > 0 {
+                let now = std::time::SystemTime::now()
+                    .duration_since(std::time::UNIX_EPOCH)
+                    .map(|d| d.as_millis() as u64)
+                    .unwrap_or(0);
+                now.saturating_sub(last_at) > 30_000
+            } else {
+                false
+            }
+        } else {
+            false
+        };
+
         Ok(serde_json::json!({
             "current_version": state.current_version,
             "last_check": state.last_check,
@@ -179,6 +200,7 @@ impl RpcHandler {
                     "bytes_downloaded": downloaded,
                     "total_bytes": total,
                     "active": active,
+                    "stalled": stalled,
                 }))
             } else { None },
         }))
@@ -200,6 +222,13 @@ impl RpcHandler {
         }))
     }
 
+    /// Cancel an in-flight or stuck download. Clears the live counters
+    /// and staging dir so the UI returns to the "Download Update" state.
+    pub(super) async fn handle_update_cancel_download(&self) -> Result<serde_json::Value> {
+        update::cancel_download(&self.config.data_dir).await?;
+        Ok(serde_json::json!({ "canceled": true }))
+    }
+
     /// Apply the staged update.
     pub(super) async fn handle_update_apply(&self) -> Result<serde_json::Value> {
         update::apply_update(&self.config.data_dir).await?;

core/archipelago/src/federation/invites.rs

@@ -342,6 +342,7 @@ mod tests {
             "local.onion",
             "localpub",
             None,
+            None,
             |_| "test-sig".to_string(),
         )
         .await
@@ -376,6 +377,7 @@ mod tests {
             "local.onion",
             "localpub",
             None,
+            None,
             |_| "test-sig".to_string(),
         )
         .await
@@ -409,6 +411,7 @@ mod tests {
             "local.onion",
             "localpub",
             None,
+            None,
             |_| "test-sig".to_string(),
         )
         .await
@@ -421,6 +424,7 @@ mod tests {
             "local.onion",
             "localpub",
             None,
+            None,
             |_| "test-sig".to_string(),
         )
         .await

core/archipelago/src/federation/sync.rs

@@ -107,8 +107,10 @@ pub async fn sync_with_peer_by_did(
 }
 
 /// Merge peers advertised by a Trusted federated node into our own
-/// federation list. New peers are added at `Observer` trust (not
-/// Trusted — that requires a direct invite). Existing peers get their
+/// federation list. New peers are added at `Trusted` — hints only
+/// arrive from peers we already trust, and `build_local_state` only
+/// re-exports our Trusted list, so transitive membership carries the
+/// same trust the direct-invite path gives. Existing peers get their
 /// `fips_npub` refreshed if we hadn't learned it yet.
 ///
 /// Peers we are (us) or that we already track by DID are skipped.
@@ -142,7 +144,7 @@ async fn merge_transitive_peers(
             pubkey: hint.pubkey.clone(),
             onion: hint.onion.clone(),
             name: hint.name.clone(),
-            trust_level: TrustLevel::Observer,
+            trust_level: TrustLevel::Trusted,
             added_at: chrono::Utc::now().to_rfc3339(),
             last_seen: None,
             last_state: None,

core/archipelago/src/fips/anchors.rs

@@ -0,0 +1,241 @@
+//! Seed-anchor management for FIPS bootstrap.
+//!
+//! A freshly-installed node can't reach the global mesh via npub
+//! routing until it's connected to at least one peer that's already in
+//! the DHT. Upstream `fips` solves this by dialing a public anchor
+//! (e.g. `fips.v0l.io`) on first start. That's a single point of
+//! failure and doesn't help nodes behind restrictive firewalls or
+//! intermittent networks — archipelago operators reported fresh
+//! installs failing to reach any public anchor.
+//!
+//! This module adds a local, operator-editable seed-anchor list. Each
+//! entry is a `{npub, address, transport}` triple that archipelago
+//! pushes into the running daemon via `fipsctl connect` on startup and
+//! periodically thereafter. If one anchor falls over, the next one
+//! seeds the DHT instead. A well-configured cluster (e.g. a VPS
+//! running fips in anchor mode + a couple of home nodes) stops
+//! depending on the global anchor entirely.
+//!
+//! The list is persisted at `<data_dir>/seed-anchors.json`. The
+//! archipelago service user owns that directory, so no sudo is needed
+//! to read or write it.
+
+use anyhow::{Context, Result};
+use serde::{Deserialize, Serialize};
+use std::path::{Path, PathBuf};
+use tokio::process::Command;
+
+/// On-disk filename under `data_dir/`.
+const SEED_ANCHORS_FILE: &str = "seed-anchors.json";
+
+/// Public anchor (`fips.v0l.io`) carried as a default seed for fresh
+/// installs — the one the upstream daemon dials anyway. Operators can
+/// remove it from the UI once their own cluster has independent anchors.
+pub const DEFAULT_PUBLIC_ANCHOR_NPUB: &str =
+    "npub1zv58cn7v83mxvttl70w5fwjwuclfmntv9cnmv5wmz2nzz88u5urqvdx96n";
+pub const DEFAULT_PUBLIC_ANCHOR_ADDR: &str = "fips.v0l.io:8668";
+
+/// One seed-anchor entry. `address` must be directly dialable (IP or
+/// resolvable hostname + UDP port); `transport` is one of "udp", "tcp",
+/// "tor", "ethernet" (the values upstream `fipsctl connect` accepts).
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct SeedAnchor {
+    /// Bech32 `npub1...` of the anchor's FIPS identity.
+    pub npub: String,
+    /// Directly-dialable transport address, e.g. `192.168.1.116:8668`.
+    pub address: String,
+    /// Transport to use — almost always `"udp"`.
+    #[serde(default = "default_transport")]
+    pub transport: String,
+    /// Human-readable note shown in the UI (e.g. "Home anchor", "VPS").
+    #[serde(default)]
+    pub label: String,
+}
+
+fn default_transport() -> String {
+    "udp".to_string()
+}
+
+fn anchors_path(data_dir: &Path) -> PathBuf {
+    data_dir.join(SEED_ANCHORS_FILE)
+}
+
+/// Load the seed-anchor list. Returns an empty list if the file
+/// doesn't exist yet — a first-boot node with no operator config.
+pub async fn load(data_dir: &Path) -> Result<Vec<SeedAnchor>> {
+    let path = anchors_path(data_dir);
+    if !path.exists() {
+        return Ok(Vec::new());
+    }
+    let bytes = tokio::fs::read(&path)
+        .await
+        .with_context(|| format!("read {}", path.display()))?;
+    let anchors: Vec<SeedAnchor> = serde_json::from_slice(&bytes)
+        .with_context(|| format!("parse {}", path.display()))?;
+    Ok(anchors)
+}
+
+/// Persist the list. Overwrites atomically via write-then-rename so a
+/// crashed archipelago never leaves a half-written config.
+pub async fn save(data_dir: &Path, anchors: &[SeedAnchor]) -> Result<()> {
+    tokio::fs::create_dir_all(data_dir)
+        .await
+        .with_context(|| format!("mkdir -p {}", data_dir.display()))?;
+    let path = anchors_path(data_dir);
+    let tmp = path.with_extension("json.tmp");
+    let json = serde_json::to_vec_pretty(anchors).context("serialize seed anchors")?;
+    tokio::fs::write(&tmp, json)
+        .await
+        .with_context(|| format!("write {}", tmp.display()))?;
+    tokio::fs::rename(&tmp, &path)
+        .await
+        .with_context(|| format!("rename {} -> {}", tmp.display(), path.display()))?;
+    Ok(())
+}
+
+/// Add (or update) one anchor, keyed by npub. Returns the resulting list.
+pub async fn add(data_dir: &Path, anchor: SeedAnchor) -> Result<Vec<SeedAnchor>> {
+    let mut list = load(data_dir).await?;
+    if let Some(existing) = list.iter_mut().find(|a| a.npub == anchor.npub) {
+        *existing = anchor;
+    } else {
+        list.push(anchor);
+    }
+    save(data_dir, &list).await?;
+    Ok(list)
+}
+
+/// Remove an anchor by npub. Returns the resulting list.
+pub async fn remove(data_dir: &Path, npub: &str) -> Result<Vec<SeedAnchor>> {
+    let mut list = load(data_dir).await?;
+    list.retain(|a| a.npub != npub);
+    save(data_dir, &list).await?;
+    Ok(list)
+}
+
+/// Apply the seed anchors to the running FIPS daemon. For each entry,
+/// asks `fipsctl connect` to dial the peer. Errors are logged but don't
+/// fail the whole operation — a single unreachable anchor shouldn't
+/// block the others.
+///
+/// `fipsctl connect` is idempotent-ish: calling it for an already-
+/// connected peer is a no-op at the protocol layer, so re-applying on
+/// a timer is safe. Returns a list of per-anchor results for logging.
+pub async fn apply(anchors: &[SeedAnchor]) -> Vec<ApplyResult> {
+    let mut results = Vec::with_capacity(anchors.len());
+    for anchor in anchors {
+        let out = Command::new("fipsctl")
+            .args([
+                "connect",
+                &anchor.npub,
+                &anchor.address,
+                &anchor.transport,
+            ])
+            .output()
+            .await;
+        let result = match out {
+            Ok(o) if o.status.success() => ApplyResult {
+                npub: anchor.npub.clone(),
+                ok: true,
+                message: String::from_utf8_lossy(&o.stdout).trim().to_string(),
+            },
+            Ok(o) => ApplyResult {
+                npub: anchor.npub.clone(),
+                ok: false,
+                message: format!(
+                    "fipsctl exited {}: {}",
+                    o.status,
+                    String::from_utf8_lossy(&o.stderr).trim()
+                ),
+            },
+            Err(e) => ApplyResult {
+                npub: anchor.npub.clone(),
+                ok: false,
+                message: format!("fipsctl launch failed: {}", e),
+            },
+        };
+        if result.ok {
+            tracing::debug!(npub = %result.npub, "Seed anchor applied");
+        } else {
+            tracing::warn!(
+                npub = %result.npub,
+                message = %result.message,
+                "Seed anchor apply failed (non-fatal)"
+            );
+        }
+        results.push(result);
+    }
+    results
+}
+
+/// Outcome of a single `fipsctl connect` call.
+#[derive(Debug, Clone)]
+pub struct ApplyResult {
+    pub npub: String,
+    pub ok: bool,
+    pub message: String,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn mk(npub: &str) -> SeedAnchor {
+        SeedAnchor {
+            npub: npub.to_string(),
+            address: "example.test:8668".to_string(),
+            transport: "udp".to_string(),
+            label: "test".to_string(),
+        }
+    }
+
+    #[tokio::test]
+    async fn load_missing_returns_empty() {
+        let dir = tempfile::tempdir().unwrap();
+        let got = load(dir.path()).await.unwrap();
+        assert!(got.is_empty());
+    }
+
+    #[tokio::test]
+    async fn save_and_load_roundtrip() {
+        let dir = tempfile::tempdir().unwrap();
+        let a = mk("npub1aaa");
+        let b = mk("npub1bbb");
+        save(dir.path(), &[a.clone(), b.clone()]).await.unwrap();
+        let got = load(dir.path()).await.unwrap();
+        assert_eq!(got, vec![a, b]);
+    }
+
+    #[tokio::test]
+    async fn add_replaces_existing_by_npub() {
+        let dir = tempfile::tempdir().unwrap();
+        let mut a = mk("npub1aaa");
+        save(dir.path(), &[a.clone()]).await.unwrap();
+        a.address = "newhost:8668".to_string();
+        let list = add(dir.path(), a.clone()).await.unwrap();
+        assert_eq!(list.len(), 1);
+        assert_eq!(list[0].address, "newhost:8668");
+    }
+
+    #[tokio::test]
+    async fn remove_by_npub() {
+        let dir = tempfile::tempdir().unwrap();
+        save(
+            dir.path(),
+            &[mk("npub1aaa"), mk("npub1bbb"), mk("npub1ccc")],
+        )
+        .await
+        .unwrap();
+        let list = remove(dir.path(), "npub1bbb").await.unwrap();
+        assert_eq!(list.len(), 2);
+        assert!(list.iter().all(|a| a.npub != "npub1bbb"));
+    }
+
+    #[test]
+    fn seed_anchor_uses_udp_by_default() {
+        let json = r#"{"npub":"npub1x","address":"h:8668"}"#;
+        let a: SeedAnchor = serde_json::from_str(json).unwrap();
+        assert_eq!(a.transport, "udp");
+        assert_eq!(a.label, "");
+    }
+}

core/archipelago/src/fips/mod.rs

@@ -25,6 +25,7 @@
 // the module is deliberately API-ready ahead of those call-sites.
 #![allow(dead_code)]
 
+pub mod anchors;
 pub mod config;
 pub mod dial;
 pub mod iface;
@@ -98,7 +99,13 @@ pub struct FipsStatus {
 
 impl FipsStatus {
     /// Snapshot the current state across package, key, and service.
-    pub async fn query(identity_dir: &Path) -> Self {
+    ///
+    /// `data_dir` is the archipelago data-dir (used to load the
+    /// operator-configured seed-anchor list so "anchor_connected" means
+    /// "at least one authenticated peer matches a public or configured
+    /// seed anchor", not just "fips.v0l.io specifically").
+    pub async fn query(data_dir: &Path) -> Self {
+        let identity_dir = identity_dir_from(data_dir);
         let installed = service::package_installed().await;
         let version = if installed {
             service::daemon_version().await.ok()
@@ -109,17 +116,24 @@ impl FipsStatus {
         let upstream_service_state = service::unit_state(UPSTREAM_SERVICE_UNIT).await;
         let service_active =
             service_state == "active" || upstream_service_state == "active";
-        let key_present = crate::identity::fips_key_exists(identity_dir);
+        let key_present = crate::identity::fips_key_exists(&identity_dir);
 
         // Prefer the seed-derived npub; otherwise read the daemon's own
         // key file at /etc/fips/fips.pub (world-readable per debian pkg).
-        let npub = match crate::identity::fips_npub(identity_dir).await {
+        let npub = match crate::identity::fips_npub(&identity_dir).await {
             Ok(Some(n)) => Some(n),
             _ => service::read_upstream_npub().await.ok().flatten(),
         };
 
         let (authenticated_peer_count, anchor_connected) = if service_active {
-            service::peer_connectivity_summary().await
+            // Build the anchor-candidate list: hardcoded public anchor
+            // plus every entry in the operator's seed-anchors.json.
+            // The card lights up if any of them is authenticated.
+            let mut anchor_npubs = vec![service::PUBLIC_ANCHOR_NPUB.to_string()];
+            if let Ok(seed) = anchors::load(data_dir).await {
+                anchor_npubs.extend(seed.into_iter().map(|a| a.npub));
+            }
+            service::peer_connectivity_summary(&anchor_npubs).await
         } else {
             (0, false)
         };
@@ -152,10 +166,11 @@ mod tests {
     #[tokio::test]
     async fn test_status_reports_no_key_pre_onboarding() {
         let dir = tempfile::tempdir().unwrap();
-        let id_dir = dir.path().join("identity");
-        tokio::fs::create_dir_all(&id_dir).await.unwrap();
-
-        let status = FipsStatus::query(&id_dir).await;
+        // query() now takes a data_dir (parent) rather than identity_dir,
+        // since it also reads seed-anchors.json for the anchor check.
+        // No identity/ subdir → no key; no seed-anchors.json → public
+        // anchor is the only candidate.
+        let status = FipsStatus::query(dir.path()).await;
         assert!(!status.key_present, "no key before onboarding");
         assert!(status.npub.is_none());
         // `installed`, `service_state`, `version` depend on the host and are

core/archipelago/src/fips/service.rs

@@ -97,6 +97,27 @@ pub async fn restart(unit: &str) -> Result<()> {
     sudo_systemctl("restart", unit).await
 }
 
+/// Resolve which systemd unit is actually supervising the fips daemon
+/// on this host. Nodes installed from the archipelago ISO run
+/// `archipelago-fips.service`; nodes that were apt-installed (or had
+/// fips running before archipelago took over) may only have the
+/// upstream `fips.service`. Restart/Reconnect must operate on whichever
+/// one is running, otherwise the UI button is a silent no-op.
+///
+/// Returns the archipelago-managed unit name if it's active,
+/// else the upstream unit name if that's active,
+/// else the archipelago-managed name as a default (so activate() can
+/// bring it up).
+pub async fn active_unit() -> &'static str {
+    if unit_state(super::SERVICE_UNIT).await == "active" {
+        return super::SERVICE_UNIT;
+    }
+    if unit_state(super::UPSTREAM_SERVICE_UNIT).await == "active" {
+        return super::UPSTREAM_SERVICE_UNIT;
+    }
+    super::SERVICE_UNIT
+}
+
 pub async fn mask(unit: &str) -> Result<()> {
     let _ = sudo_systemctl("stop", unit).await;
     let _ = sudo_systemctl("disable", unit).await;
@@ -108,12 +129,19 @@ pub async fn mask(unit: &str) -> Result<()> {
 pub const PUBLIC_ANCHOR_NPUB: &str =
     "npub1zv58cn7v83mxvttl70w5fwjwuclfmntv9cnmv5wmz2nzz88u5urqvdx96n";
 
-/// Summarise peer connectivity from `fipsctl show peers` + `identity-cache`.
-/// Returns `(authenticated_peer_count, anchor_connected)`. Shells out rather
-/// than embedding a fips client because fipsctl is the daemon's own ground
-/// truth — the daemon can always rewrite its internal routing and we'd
-/// rather be consistent with `fipsctl` than snapshot it ourselves.
-pub async fn peer_connectivity_summary() -> (u32, bool) {
+/// Summarise peer connectivity from `fipsctl show peers`. Returns
+/// `(authenticated_peer_count, anchor_connected)`.
+///
+/// `anchor_candidates` is the operator-controlled list of npubs this
+/// node considers a valid mesh anchor — always includes the hard-coded
+/// public anchor, plus any entries from `seed-anchors.json`. A node is
+/// "anchor connected" when at least one currently-authenticated peer
+/// matches one of these npubs. We used to check the identity cache
+/// (which includes transient hearsay from other peers), but a cache
+/// hit on `fips.v0l.io` didn't mean we could actually route through
+/// it, and the card lied to users whose mesh was federated through
+/// their own seed anchors instead.
+pub async fn peer_connectivity_summary(anchor_candidates: &[String]) -> (u32, bool) {
     let peers_json = match Command::new("sudo")
         .args(["-n", "fipsctl", "show", "peers"])
         .output()
@@ -122,39 +150,26 @@ pub async fn peer_connectivity_summary() -> (u32, bool) {
         Ok(o) if o.status.success() => o.stdout,
         _ => return (0, false),
     };
-    let authenticated_peer_count =
-        match serde_json::from_slice::<serde_json::Value>(&peers_json) {
-            Ok(v) => v
-                .get("peers")
-                .and_then(|p| p.as_array())
-                .map(|a| a.len() as u32)
-                .unwrap_or(0),
-            Err(_) => 0,
+    let parsed: serde_json::Value =
+        match serde_json::from_slice(&peers_json) {
+            Ok(v) => v,
+            Err(_) => return (0, false),
         };
-
-    // Anchor check: look in identity-cache (known node pubkeys the daemon
-    // has heard about) rather than authenticated peers — the anchor may be
-    // in the cache but not currently at session depth.
-    let cache_json = match Command::new("sudo")
-        .args(["-n", "fipsctl", "show", "identity-cache"])
-        .output()
-        .await
-    {
-        Ok(o) if o.status.success() => o.stdout,
-        _ => return (authenticated_peer_count, false),
-    };
-    let anchor_connected = match serde_json::from_slice::<serde_json::Value>(&cache_json) {
-        Ok(v) => v
-            .get("entries")
-            .and_then(|e| e.as_array())
-            .map(|entries| {
-                entries
-                    .iter()
-                    .any(|e| e.get("npub").and_then(|n| n.as_str()) == Some(PUBLIC_ANCHOR_NPUB))
-            })
-            .unwrap_or(false),
-        Err(_) => false,
-    };
+    let peers = parsed
+        .get("peers")
+        .and_then(|p| p.as_array())
+        .cloned()
+        .unwrap_or_default();
+    let authenticated_peer_count = peers.len() as u32;
+    let anchor_connected = peers.iter().any(|p| {
+        let npub = p.get("npub").and_then(|n| n.as_str()).unwrap_or_default();
+        let connected = p
+            .get("connectivity")
+            .and_then(|c| c.as_str())
+            .map(|s| s == "connected")
+            .unwrap_or(true);
+        connected && anchor_candidates.iter().any(|a| a == npub)
+    });
     (authenticated_peer_count, anchor_connected)
 }
 

core/archipelago/src/server.rs

@@ -353,6 +353,34 @@ impl Server {
             });
         }
 
+        // FIPS seed-anchor apply loop — every 5 minutes we re-push the
+        // configured seed anchors into the running fips daemon via
+        // `fipsctl connect`. This keeps the mesh bootstrap resilient:
+        // operators add cluster-local anchors in the UI, and a daemon
+        // restart or a flaky public anchor can't strand the node.
+        // First run is delayed 30s so fips has time to come up after
+        // onboarding before we start dialing.
+        {
+            let data_dir = config.data_dir.clone();
+            tokio::spawn(async move {
+                tokio::time::sleep(Duration::from_secs(30)).await;
+                let mut interval = tokio::time::interval(Duration::from_secs(300));
+                loop {
+                    interval.tick().await;
+                    match crate::fips::anchors::load(&data_dir).await {
+                        Ok(list) if !list.is_empty() => {
+                            let _ = crate::fips::anchors::apply(&list).await;
+                        }
+                        Ok(_) => { /* no seed anchors configured yet */ }
+                        Err(e) => tracing::debug!(
+                            "Seed-anchor apply: load failed (non-fatal): {}",
+                            e
+                        ),
+                    }
+                }
+            });
+        }
+
         // did:dht auto-refresh — re-publish DHT records every 2 hours
         if config.nostr_discovery_enabled {
             let data_dir = config.data_dir.clone();

core/archipelago/src/update.rs

@@ -4,7 +4,7 @@ use anyhow::{Context, Result};
 use chrono::Timelike;
 use serde::{Deserialize, Serialize};
 use std::path::Path;
-use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
 use tokio::fs;
 use tracing::{debug, info};
 
@@ -14,6 +14,52 @@ use tracing::{debug, info};
 /// download runs in one place at a time; no need for per-handler state.
 pub static DOWNLOAD_BYTES: AtomicU64 = AtomicU64::new(0);
 pub static DOWNLOAD_TOTAL: AtomicU64 = AtomicU64::new(0);
+/// Set true to ask the in-flight download loop to bail out at the next
+/// chunk boundary. Read via `is_canceled`; reset at the start of every
+/// `download_update` run. Also flipped by the `cancel_download` RPC.
+pub static DOWNLOAD_CANCEL: AtomicBool = AtomicBool::new(false);
+/// Monotonic ms timestamp of the last time DOWNLOAD_BYTES advanced.
+/// Lets `update.status` flag a download as "stalled" when no bytes have
+/// arrived for a while, so the UI can offer a Cancel button with more
+/// confidence than "looks stuck at 0%".
+pub static DOWNLOAD_PROGRESS_AT: AtomicU64 = AtomicU64::new(0);
+
+fn now_ms() -> u64 {
+    use std::time::{SystemTime, UNIX_EPOCH};
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|d| d.as_millis() as u64)
+        .unwrap_or(0)
+}
+
+fn is_canceled() -> bool {
+    DOWNLOAD_CANCEL.load(Ordering::Relaxed)
+}
+
+/// Parse "MAJOR.MINOR.PATCH[-suffix]" into a tuple; suffix is ignored.
+/// Returns None if the numeric portion can't be parsed — callers should
+/// fall back to string comparison in that case so we don't silently
+/// mis-rank versions we don't understand.
+fn parse_version_triple(v: &str) -> Option<(u32, u32, u32)> {
+    let core = v.split('-').next().unwrap_or(v);
+    let mut parts = core.split('.');
+    let major: u32 = parts.next()?.parse().ok()?;
+    let minor: u32 = parts.next()?.parse().ok()?;
+    let patch: u32 = parts.next()?.parse().ok()?;
+    Some((major, minor, patch))
+}
+
+/// Is `candidate` strictly newer than `current`? Used to guard against
+/// the manifest offering a version we've already passed (e.g. a stale
+/// cached manifest or a node that sideloaded past the manifest's
+/// latest). Falls back to string inequality if either version doesn't
+/// parse, preserving the old behaviour for unusual version strings.
+fn is_newer(candidate: &str, current: &str) -> bool {
+    match (parse_version_triple(candidate), parse_version_triple(current)) {
+        (Some(a), Some(b)) => a > b,
+        _ => candidate != current,
+    }
+}
 
 const DEFAULT_UPDATE_MANIFEST_URL: &str =
     "https://git.tx1138.com/lfg2025/archy/raw/branch/main/releases/manifest.json";
@@ -96,13 +142,13 @@ pub async fn load_state(data_dir: &Path) -> Result<UpdateState> {
     let running = env!("CARGO_PKG_VERSION");
     if state.current_version != running {
         state.current_version = running.to_string();
-        // Clear any stale "available_update" that matched the old
-        // current_version — the new binary will re-check on its own.
-        if let Some(ref avail) = state.available_update {
-            if avail.version == running {
-                state.available_update = None;
-            }
-        }
+        // Binary version changed (sideload or apply). Any stored
+        // `available_update` is either redundant (points at the running
+        // version) or stale (points at a version we've already passed —
+        // which would surface as a "downgrade" offer in the UI). Clear
+        // it unconditionally; the next check_for_updates will repopulate
+        // if there's genuinely something newer.
+        state.available_update = None;
         save_state(data_dir, &state).await?;
     }
     Ok(state)
@@ -140,7 +186,7 @@ pub async fn check_for_updates(data_dir: &Path) -> Result<UpdateState> {
             Ok(resp) if resp.status().is_success() => {
                 match resp.json::<UpdateManifest>().await {
                     Ok(manifest) => {
-                        if manifest.version != state.current_version {
+                        if is_newer(&manifest.version, &state.current_version) {
                             info!(
                                 current = %state.current_version,
                                 available = %manifest.version,
@@ -148,7 +194,16 @@ pub async fn check_for_updates(data_dir: &Path) -> Result<UpdateState> {
                             );
                             state.available_update = Some(manifest);
                         } else {
-                            debug!("Already on latest version: {}", state.current_version);
+                            // Manifest version matches us or is behind
+                            // us — either we're current, or the remote
+                            // manifest is stale. Either way don't offer
+                            // it as an "update" (that would be a
+                            // downgrade prompt).
+                            debug!(
+                                current = %state.current_version,
+                                manifest = %manifest.version,
+                                "No newer version in manifest"
+                            );
                             state.available_update = None;
                         }
                         handled = true;
@@ -223,12 +278,28 @@ pub async fn download_update(data_dir: &Path) -> Result<DownloadProgress> {
     let mut downloaded = 0u64;
     let total_bytes: u64 = manifest.components.iter().map(|c| c.size_bytes).sum();
 
-    // Seed the live counters so polls during the handshake show the
-    // right denominator immediately instead of 0/0 → NaN%.
+    info!(
+        version = %manifest.version,
+        components = manifest.components.len(),
+        total_bytes,
+        staging = %staging_dir.display(),
+        "Starting update download"
+    );
+
+    // Clear any stale cancel flag from a prior aborted run, then seed
+    // the live counters so polls during the handshake show the right
+    // denominator immediately instead of 0/0 → NaN%.
+    DOWNLOAD_CANCEL.store(false, Ordering::Relaxed);
     DOWNLOAD_TOTAL.store(total_bytes, Ordering::Relaxed);
     DOWNLOAD_BYTES.store(0, Ordering::Relaxed);
+    DOWNLOAD_PROGRESS_AT.store(now_ms(), Ordering::Relaxed);
 
     for component in &manifest.components {
+        if is_canceled() {
+            DOWNLOAD_TOTAL.store(0, Ordering::Relaxed);
+            DOWNLOAD_BYTES.store(0, Ordering::Relaxed);
+            anyhow::bail!("Download canceled");
+        }
         info!(name = %component.name, url = %component.download_url, "Downloading component");
         let dest = staging_dir.join(&component.name);
         download_component_resumable(&client, component, &dest, downloaded).await?;
@@ -289,7 +360,18 @@ async fn download_component_resumable(
                 delay,
                 last_err.as_ref().map(|e| e.to_string()).unwrap_or_default()
             );
-            tokio::time::sleep(std::time::Duration::from_secs(delay)).await;
+            // Sleep in 500ms slices so a Cancel during backoff wakes
+            // promptly instead of waiting out the full exponential window.
+            let slices = delay * 2;
+            for _ in 0..slices {
+                if is_canceled() {
+                    anyhow::bail!("Download canceled");
+                }
+                tokio::time::sleep(std::time::Duration::from_millis(500)).await;
+            }
+        }
+        if is_canceled() {
+            anyhow::bail!("Download canceled");
         }
 
         let mut req = client.get(&component.download_url);
@@ -348,7 +430,12 @@ async fn download_component_resumable(
         let mut resp = resp;
         let mut stream_err = false;
         let mut on_disk = existing_len;
+        let mut canceled = false;
         loop {
+            if is_canceled() {
+                canceled = true;
+                break;
+            }
             match resp.chunk().await {
                 Ok(Some(bytes)) => {
                     if let Err(e) = file.write_all(&bytes).await {
@@ -361,6 +448,7 @@ async fn download_component_resumable(
                         prior_total + on_disk.min(component.size_bytes),
                         Ordering::Relaxed,
                     );
+                    DOWNLOAD_PROGRESS_AT.store(now_ms(), Ordering::Relaxed);
                 }
                 Ok(None) => break, // stream ended cleanly
                 Err(e) => {
@@ -370,6 +458,13 @@ async fn download_component_resumable(
                 }
             }
         }
+        if canceled {
+            let _ = file.flush().await;
+            drop(file);
+            DOWNLOAD_TOTAL.store(0, Ordering::Relaxed);
+            DOWNLOAD_BYTES.store(0, Ordering::Relaxed);
+            anyhow::bail!("Download canceled");
+        }
         let _ = file.flush().await;
         let _ = file.sync_all().await;
         drop(file);
@@ -414,6 +509,40 @@ async fn download_component_resumable(
     Err(last_err.unwrap_or_else(|| anyhow::anyhow!("download failed without a captured error")))
 }
 
+/// Cancel an in-flight download. Sets the cancellation flag so the
+/// download loop bails out at the next chunk or backoff boundary, then
+/// zeros the live counters and wipes the staging directory so the UI
+/// sees "no active download" immediately and the next attempt starts
+/// clean. Safe to call even when no download is running.
+pub async fn cancel_download(data_dir: &Path) -> Result<()> {
+    DOWNLOAD_CANCEL.store(true, Ordering::Relaxed);
+    DOWNLOAD_BYTES.store(0, Ordering::Relaxed);
+    DOWNLOAD_TOTAL.store(0, Ordering::Relaxed);
+    let staging = data_dir.join("update-staging");
+    let wiped = if staging.exists() {
+        tokio::fs::remove_dir_all(&staging).await.is_ok()
+    } else {
+        false
+    };
+    // Clear the "downloaded, ready to apply" marker too — a canceled
+    // download is not a staged update.
+    let mut cleared_marker = false;
+    if let Ok(mut state) = load_state(data_dir).await {
+        if state.update_in_progress {
+            state.update_in_progress = false;
+            let _ = save_state(data_dir, &state).await;
+            cleared_marker = true;
+        }
+    }
+    info!(
+        staging = %staging.display(),
+        wiped,
+        cleared_marker,
+        "Update download canceled"
+    );
+    Ok(())
+}
+
 /// Run a command as root, but *outside* the archipelago service's
 /// restricted mount namespace.
 ///
@@ -452,6 +581,12 @@ pub async fn apply_update(data_dir: &Path) -> Result<()> {
         .await
         .context("Failed to create backup dir")?;
 
+    info!(
+        staging = %staging_dir.display(),
+        backup = %backup_dir.display(),
+        "Applying staged update"
+    );
+
     // Back up current backend binary
     let current_binary = Path::new("/usr/local/bin/archipelago");
     if current_binary.exists() {
@@ -747,9 +882,15 @@ pub async fn run_update_scheduler(data_dir: std::path::PathBuf) {
                             debug!("Update scheduler: apply failed: {}", e);
                             continue;
                         }
-                        info!("Update scheduler: update applied, restart needed");
-                        // Signal for service restart (systemd will handle via exit code)
-                        std::process::exit(0);
+                        info!("Update scheduler: update applied, restart scheduled by apply_update");
+                        // apply_update has already spawned a 2s-delayed
+                        // `systemctl restart archipelago`. Don't call
+                        // std::process::exit here — that kills the runtime
+                        // before the spawned restart task runs, and since
+                        // the unit is Restart=on-failure a clean exit(0)
+                        // leaves the service dead. Fall through; the
+                        // scheduled restart will bring us back cleanly.
+                        return;
                     }
                     Ok(_) => {
                         debug!("Update scheduler: no update available");
@@ -825,6 +966,52 @@ mod tests {
         assert_eq!(state.schedule, UpdateSchedule::DailyCheck);
     }
 
+    #[test]
+    fn test_parse_version_triple() {
+        assert_eq!(parse_version_triple("1.7.18"), Some((1, 7, 18)));
+        assert_eq!(parse_version_triple("1.7.18-alpha"), Some((1, 7, 18)));
+        assert_eq!(parse_version_triple("0.0.1"), Some((0, 0, 1)));
+        assert_eq!(parse_version_triple("garbage"), None);
+        assert_eq!(parse_version_triple("1.2"), None);
+    }
+
+    #[test]
+    fn test_is_newer() {
+        assert!(is_newer("1.7.19-alpha", "1.7.18-alpha"));
+        assert!(is_newer("1.8.0-alpha", "1.7.99-alpha"));
+        assert!(is_newer("1.7.10-alpha", "1.7.9-alpha")); // numeric, not lexical
+        assert!(!is_newer("1.7.18-alpha", "1.7.18-alpha"));
+        assert!(!is_newer("1.7.17-alpha", "1.7.18-alpha")); // would-be downgrade
+        assert!(!is_newer("1.7.9-alpha", "1.7.10-alpha"));
+    }
+
+    #[tokio::test]
+    async fn test_load_state_clears_stale_available_on_version_bump() {
+        // Simulates a sideload: state file on disk says we're on
+        // 1.7.16-alpha with 1.7.17-alpha staged as the pending update,
+        // but the running binary is 1.7.18-alpha (skipped a version).
+        // load_state must drop the stale available_update so the UI
+        // doesn't offer a downgrade.
+        let dir = tempfile::tempdir().unwrap();
+        let stale = UpdateState {
+            current_version: "1.7.16-alpha".to_string(),
+            available_update: Some(UpdateManifest {
+                version: "1.7.17-alpha".to_string(),
+                release_date: "2026-04-20".to_string(),
+                changelog: vec![],
+                components: vec![],
+            }),
+            ..UpdateState::default()
+        };
+        save_state(dir.path(), &stale).await.unwrap();
+        let loaded = load_state(dir.path()).await.unwrap();
+        assert_eq!(loaded.current_version, env!("CARGO_PKG_VERSION"));
+        assert!(
+            loaded.available_update.is_none(),
+            "stale available_update must be cleared after version bump"
+        );
+    }
+
     #[tokio::test]
     async fn test_load_state_creates_default_when_missing() {
         let dir = tempfile::tempdir().unwrap();
@@ -860,13 +1047,14 @@ mod tests {
         };
         save_state(dir.path(), &state).await.unwrap();
         let loaded = load_state(dir.path()).await.unwrap();
-        assert_eq!(loaded.current_version, "1.0.0");
+        // load_state rewrites current_version to match the running
+        // binary (sideload self-heal), so don't assert on the saved
+        // value. The migration also clears available_update when the
+        // version changes — check the other fields survived.
+        assert_eq!(loaded.current_version, env!("CARGO_PKG_VERSION"));
         assert!(loaded.update_in_progress);
         assert_eq!(loaded.schedule, UpdateSchedule::Manual);
-        let manifest = loaded.available_update.unwrap();
-        assert_eq!(manifest.version, "1.1.0");
-        assert_eq!(manifest.components.len(), 1);
-        assert_eq!(manifest.components[0].size_bytes, 5000);
+        assert!(loaded.available_update.is_none());
     }
 
     #[tokio::test]
@@ -916,7 +1104,9 @@ mod tests {
         };
         save_state(dir.path(), &state).await.unwrap();
         let status = get_status(dir.path()).await.unwrap();
-        assert_eq!(status.current_version, "3.0.0");
+        // get_status → load_state, which rewrites current_version to
+        // match the running binary (see the sideload-self-heal path).
+        assert_eq!(status.current_version, env!("CARGO_PKG_VERSION"));
         assert!(status.rollback_available);
     }
 }

neode-ui/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "neode-ui",
-  "version": "1.3.5",
+  "version": "1.6.0-alpha",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "neode-ui",
-      "version": "1.3.5",
+      "version": "1.6.0-alpha",
       "dependencies": {
         "@types/dompurify": "^3.0.5",
         "@vue-leaflet/vue-leaflet": "^0.10.1",

neode-ui/src/locales/en.json

@@ -696,7 +696,15 @@
     "gitMethodHint": "This node builds from source. Update will git-pull, rebuild the backend and UI, then restart — takes a few minutes.",
     "gitApplyTitle": "Pull & Rebuild?",
     "gitApplyMessage": "Archipelago will pull the latest code, rebuild, and restart. This can take several minutes and the UI will be briefly unavailable.",
-    "gitApplyStarted": "Update started. The backend will rebuild and restart — this can take a few minutes."
+    "gitApplyStarted": "Update started. The backend will rebuild and restart — this can take a few minutes.",
+    "cancelDownload": "Cancel Download",
+    "cancelingDownload": "Canceling…",
+    "cancelDownloadTitle": "Cancel Download?",
+    "cancelDownloadConfirm": "This will stop the current download and discard the partial file. You can start again from scratch afterwards.",
+    "cancelDownloadButton": "Cancel Download",
+    "cancelDownloadSuccess": "Download canceled. You can try again.",
+    "cancelDownloadFailed": "Failed to cancel download.",
+    "downloadStalled": "Download appears stuck — try Cancel and start again."
   },
   "kiosk": {
     "pressEsc": "Press ESC to exit",

neode-ui/src/locales/es.json

@@ -684,18 +684,26 @@
     "rollbackSuccess": "Se revirti\u00f3 a la versi\u00f3n anterior. El servicio se reiniciar\u00e1.",
     "rollbackFailed": "Error al revertir.",
     "pullAndRebuild": "Pull y Recompilar",
-    "finishingDownload": "Terminando descarga — verificando checksum…",
-    "overlayApplying": "Instalando actualizaci\u00f3n…",
-    "overlayRestarting": "Reiniciando servidor…",
-    "overlayReconnecting": "Reconectando a la nueva versi\u00f3n…",
-    "overlayReady": "Actualizaci\u00f3n instalada — recargando…",
+    "finishingDownload": "Terminando descarga \u2014 verificando checksum\u2026",
+    "overlayApplying": "Instalando actualizaci\u00f3n\u2026",
+    "overlayRestarting": "Reiniciando servidor\u2026",
+    "overlayReconnecting": "Reconectando a la nueva versi\u00f3n\u2026",
+    "overlayReady": "Actualizaci\u00f3n instalada \u2014 recargando\u2026",
     "overlayStalled": "Tardando m\u00e1s de lo esperado",
     "overlayTarget": "Instalando v{version}",
     "overlayReloadNow": "Recargar ahora",
-    "gitMethodHint": "Este nodo compila desde el c\u00f3digo fuente. La actualizaci\u00f3n har\u00e1 git-pull, recompilar\u00e1 y reiniciar\u00e1 — tarda unos minutos.",
+    "gitMethodHint": "Este nodo compila desde el c\u00f3digo fuente. La actualizaci\u00f3n har\u00e1 git-pull, recompilar\u00e1 y reiniciar\u00e1 \u2014 tarda unos minutos.",
     "gitApplyTitle": "\u00bfPull y Recompilar?",
     "gitApplyMessage": "Archipelago descargar\u00e1 el c\u00f3digo m\u00e1s reciente, lo compilar\u00e1 y reiniciar\u00e1. Puede tardar varios minutos y la UI estar\u00e1 brevemente no disponible.",
-    "gitApplyStarted": "Actualizaci\u00f3n iniciada. El backend se recompilar\u00e1 y reiniciar\u00e1 — puede tardar unos minutos."
+    "gitApplyStarted": "Actualizaci\u00f3n iniciada. El backend se recompilar\u00e1 y reiniciar\u00e1 \u2014 puede tardar unos minutos.",
+    "cancelDownload": "Cancelar descarga",
+    "cancelingDownload": "Cancelando\u2026",
+    "cancelDownloadTitle": "\u00bfCancelar descarga?",
+    "cancelDownloadConfirm": "Esto detendr\u00e1 la descarga actual y descartar\u00e1 el archivo parcial. Podr\u00e1s volver a empezar desde cero.",
+    "cancelDownloadButton": "Cancelar descarga",
+    "cancelDownloadSuccess": "Descarga cancelada. Puedes intentarlo de nuevo.",
+    "cancelDownloadFailed": "No se pudo cancelar la descarga.",
+    "downloadStalled": "La descarga parece atascada \u2014 prueba a cancelar y volver a empezar."
   },
   "kiosk": {
     "pressEsc": "Presione ESC para salir",

neode-ui/src/views/SystemUpdate.vue

@@ -109,17 +109,30 @@
       <h2 class="text-lg font-semibold text-white mb-4">{{ t('systemUpdate.downloading') }}</h2>
       <div class="w-full h-3 bg-white/10 rounded-full overflow-hidden mb-2">
         <div
-          class="h-full bg-orange-400 rounded-full transition-all duration-500"
+          class="h-full rounded-full transition-all duration-500"
+          :class="downloadStalled ? 'bg-amber-400' : 'bg-orange-400'"
           :style="{ width: downloadPercentFormatted + '%' }"
         ></div>
       </div>
-      <div class="flex items-center gap-2">
-        <div v-if="downloadFinishing" class="w-3 h-3 border-2 border-orange-400 border-t-transparent rounded-full animate-spin shrink-0"></div>
-        <p class="text-xs text-white/60">
-          {{ downloadFinishing
-             ? t('systemUpdate.finishingDownload')
-             : t('systemUpdate.percentComplete', { percent: downloadPercentFormatted }) }}
-        </p>
+      <div class="flex items-center justify-between gap-3 flex-wrap">
+        <div class="flex items-center gap-2 min-w-0">
+          <div v-if="downloadFinishing && !downloadStalled" class="w-3 h-3 border-2 border-orange-400 border-t-transparent rounded-full animate-spin shrink-0"></div>
+          <p class="text-xs" :class="downloadStalled ? 'text-amber-300' : 'text-white/60'">
+            {{ downloadStalled
+               ? t('systemUpdate.downloadStalled')
+               : downloadFinishing
+                 ? t('systemUpdate.finishingDownload')
+                 : t('systemUpdate.percentComplete', { percent: downloadPercentFormatted }) }}
+          </p>
+        </div>
+        <button
+          @click="requestCancelDownload"
+          :disabled="cancelingDownload"
+          class="glass-button rounded-lg px-4 py-1.5 text-xs font-medium disabled:opacity-40 shrink-0"
+          :class="downloadStalled ? 'bg-amber-500/20 border-amber-400/40 text-amber-200' : ''"
+        >
+          {{ cancelingDownload ? t('systemUpdate.cancelingDownload') : t('systemUpdate.cancelDownload') }}
+        </button>
       </div>
     </div>
 
@@ -253,14 +266,18 @@
               ? t('systemUpdate.rollbackTitle')
               : confirmAction === 'git-apply'
                 ? t('systemUpdate.gitApplyTitle')
-                : t('systemUpdate.applyTitle') }}
+                : confirmAction === 'cancel-download'
+                  ? t('systemUpdate.cancelDownloadTitle')
+                  : t('systemUpdate.applyTitle') }}
           </h3>
           <p class="text-sm text-white/70 mb-6">
             {{ confirmAction === 'rollback'
               ? t('systemUpdate.rollbackMessage')
               : confirmAction === 'git-apply'
                 ? t('systemUpdate.gitApplyMessage')
-                : t('systemUpdate.applyMessage') }}
+                : confirmAction === 'cancel-download'
+                  ? t('systemUpdate.cancelDownloadConfirm')
+                  : t('systemUpdate.applyMessage') }}
           </p>
           <div class="flex gap-3 justify-end">
             <button @click="cancelConfirm" class="glass-button rounded-lg px-4 py-2 text-sm font-medium">
@@ -269,13 +286,15 @@
             <button
               @click="executeConfirm"
               class="glass-button rounded-lg px-4 py-2 text-sm font-medium"
-              :class="confirmAction === 'rollback' ? 'bg-red-500/20 border-red-400/30' : 'bg-orange-500/20 border-orange-400/30'"
+              :class="(confirmAction === 'rollback' || confirmAction === 'cancel-download') ? 'bg-red-500/20 border-red-400/30' : 'bg-orange-500/20 border-orange-400/30'"
             >
               {{ confirmAction === 'rollback'
                 ? t('systemUpdate.rollbackButton')
                 : confirmAction === 'git-apply'
                   ? t('systemUpdate.pullAndRebuild')
-                  : t('systemUpdate.applyNow') }}
+                  : confirmAction === 'cancel-download'
+                    ? t('systemUpdate.cancelDownloadButton')
+                    : t('systemUpdate.applyNow') }}
             </button>
           </div>
         </div>
@@ -313,7 +332,9 @@ const loading = ref(false)
 const downloading = ref(false)
 const downloaded = ref(false)
 const applying = ref(false)
-const confirmAction = ref<'apply' | 'git-apply' | 'rollback' | null>(null)
+const cancelingDownload = ref(false)
+const downloadStalled = ref(false)
+const confirmAction = ref<'apply' | 'git-apply' | 'rollback' | 'cancel-download' | null>(null)
 const currentVersion = ref('0.0.0')
 const lastCheck = ref<string | null>(null)
 const updateInfo = ref<UpdateDetail | null>(null)
@@ -335,13 +356,16 @@ async function pollDownloadProgress(): Promise<boolean> {
         bytes_downloaded: number
         total_bytes: number
         active: boolean
+        stalled?: boolean
       } | null
     }>({ method: 'update.status' })
     const p = res.download_progress
     if (p && p.total_bytes > 0) {
       downloadPercent.value = Math.min(100, (p.bytes_downloaded / p.total_bytes) * 100)
+      downloadStalled.value = !!p.stalled
       return p.active
     }
+    downloadStalled.value = false
     return false
   } catch {
     return false
@@ -547,6 +571,10 @@ function requestRollback() {
   confirmAction.value = 'rollback'
 }
 
+function requestCancelDownload() {
+  confirmAction.value = 'cancel-download'
+}
+
 function cancelConfirm() {
   confirmAction.value = null
 }
@@ -560,6 +588,25 @@ async function executeConfirm() {
     await applyUpdateGitWithOverlay()
   } else if (action === 'rollback') {
     await rollbackUpdate()
+  } else if (action === 'cancel-download') {
+    await cancelDownload()
+  }
+}
+
+async function cancelDownload() {
+  cancelingDownload.value = true
+  try {
+    await rpcClient.call({ method: 'update.cancel-download' })
+    downloading.value = false
+    downloaded.value = false
+    downloadPercent.value = 0
+    downloadStalled.value = false
+    showStatus(t('systemUpdate.cancelDownloadSuccess'))
+  } catch (e) {
+    showStatus(t('systemUpdate.cancelDownloadFailed'), true)
+    if (import.meta.env.DEV) console.warn('Cancel download failed', e)
+  } finally {
+    cancelingDownload.value = false
   }
 }
 

neode-ui/src/views/server/FipsNetworkCard.vue

@@ -50,7 +50,7 @@
       <div class="flex items-center justify-between gap-3 flex-wrap">
         <div class="flex items-center gap-2 text-xs">
           <span class="w-2 h-2 rounded-full" :class="status.anchor_connected ? 'bg-cyan-400' : 'bg-orange-400'"></span>
-          <span class="text-white/70">Anchor (fips.v0l.io):</span>
+          <span class="text-white/70">Anchor:</span>
           <span :class="status.anchor_connected ? 'text-cyan-300' : 'text-orange-300'">
             {{ status.anchor_connected ? 'connected' : 'not reached' }}
           </span>
@@ -68,7 +68,7 @@
         </button>
       </div>
       <p v-if="!status.anchor_connected" class="mt-2 text-[11px] text-white/40 leading-snug">
-        Without the anchor, DHT routing to unknown npubs can't bootstrap; federation and messaging fall back to Tor until it reconnects. Reconnect restarts the FIPS daemon, which usually clears a stale identity cache.
+        No known anchor is currently an authenticated peer. DHT routing to unknown npubs can't bootstrap; federation and messaging fall back to Tor until one reconnects. Reconnect restarts the FIPS daemon, which usually clears a stale identity cache. Add a cluster-local anchor in Seed Anchors if the public one is unreachable.
       </p>
     </div>
 

neode-ui/src/views/server/FipsSeedAnchorsCard.vue

@@ -0,0 +1,169 @@
+<template>
+  <div data-controller-container tabindex="0" class="glass-card p-6 flex flex-col transition-all hover:-translate-y-1">
+    <div class="flex items-start gap-4 mb-4 shrink-0">
+      <div class="flex-shrink-0 w-12 h-12 rounded-lg bg-white/10 flex items-center justify-center">
+        <svg class="w-6 h-6 text-white/80" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+          <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 11c0 3.517-1.009 6.799-2.753 9.571m-3.44-2.04.054-.09A13.916 13.916 0 0 0 8 11a4 4 0 1 1 8 0c0 1.017-.07 2.019-.203 3M9.497 10.997 14 18m-9.41-3.41L4 18.5" />
+        </svg>
+      </div>
+      <div class="flex-1">
+        <div class="flex items-start justify-between gap-4 mb-2">
+          <h2 class="text-xl font-semibold text-white">FIPS Seed Anchors</h2>
+          <button
+            type="button"
+            class="text-xs px-3 py-1.5 rounded-md bg-white/5 hover:bg-white/10 text-white/70 hover:text-white transition-colors disabled:opacity-60"
+            :disabled="applying"
+            :title="applying ? 'Applying…' : 'Re-dial every anchor in the list'"
+            @click="applyAll"
+          >
+            {{ applying ? 'Applying…' : 'Apply now' }}
+          </button>
+        </div>
+        <p class="text-white/70 text-sm mb-4">
+          Peers this node dials to bootstrap the FIPS mesh. A cluster with its own anchors doesn't depend on the global public anchor — if one is down, the next seeds the DHT instead.
+        </p>
+      </div>
+    </div>
+
+    <div v-if="statusMessage" class="mb-3 p-3 rounded-lg text-xs" :class="statusIsError ? 'bg-red-400/10 text-red-300' : 'bg-green-400/10 text-green-300'">{{ statusMessage }}</div>
+
+    <div v-if="anchors.length === 0" class="p-4 rounded-lg bg-white/5 text-sm text-white/60 mb-3">
+      <p>No seed anchors configured. The daemon will fall back to whatever the upstream FIPS build dials on its own — usually the single public anchor, which is fine until it isn't.</p>
+      <p class="mt-2 text-white/50">Add at least one known-reachable peer (e.g. your VPS or a home node with port-forwarded UDP 8668) to make this cluster self-anchoring.</p>
+    </div>
+
+    <ul v-else class="space-y-2 mb-3">
+      <li v-for="a in anchors" :key="a.npub" class="p-3 bg-white/5 rounded-lg flex items-start gap-3">
+        <div class="flex-1 min-w-0">
+          <p class="text-sm font-medium text-white truncate">{{ a.label || 'Unlabeled anchor' }}</p>
+          <p class="text-xs text-white/60 font-mono break-all">{{ a.npub.slice(0, 20) }}…{{ a.npub.slice(-8) }}</p>
+          <p class="text-xs text-white/50 mt-0.5">{{ a.address }} · {{ a.transport }}</p>
+        </div>
+        <button
+          type="button"
+          class="shrink-0 text-xs px-2 py-1 rounded-md text-red-300 hover:bg-red-400/10 transition-colors"
+          :title="`Remove ${a.label || a.npub.slice(0, 12)}`"
+          @click="removeAnchor(a.npub)"
+        >Remove</button>
+      </li>
+    </ul>
+
+    <form class="grid grid-cols-1 sm:grid-cols-2 gap-2 mt-auto pt-3 border-t border-white/10 shrink-0" @submit.prevent="addAnchor">
+      <label class="flex flex-col gap-1 sm:col-span-2">
+        <span class="text-xs text-white/60">Anchor npub</span>
+        <input v-model="draft.npub" type="text" placeholder="npub1…" class="px-3 py-2 rounded-md bg-white/5 border border-white/10 text-sm text-white focus:border-white/30 focus:outline-none" />
+      </label>
+      <label class="flex flex-col gap-1">
+        <span class="text-xs text-white/60">Address (host:port)</span>
+        <input v-model="draft.address" type="text" placeholder="192.168.1.116:8668" class="px-3 py-2 rounded-md bg-white/5 border border-white/10 text-sm text-white focus:border-white/30 focus:outline-none" />
+      </label>
+      <label class="flex flex-col gap-1">
+        <span class="text-xs text-white/60">Label (optional)</span>
+        <input v-model="draft.label" type="text" placeholder="Home anchor" class="px-3 py-2 rounded-md bg-white/5 border border-white/10 text-sm text-white focus:border-white/30 focus:outline-none" />
+      </label>
+      <button type="submit" class="sm:col-span-2 min-h-[44px] glass-button rounded-lg text-sm font-medium disabled:opacity-60" :disabled="adding || !draft.npub || !draft.address">{{ adding ? 'Adding…' : 'Add anchor' }}</button>
+    </form>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { onMounted, reactive, ref } from 'vue'
+import { rpcClient } from '@/api/rpc-client'
+
+interface SeedAnchor {
+  npub: string
+  address: string
+  transport: string
+  label: string
+}
+
+interface ApplyResult {
+  npub: string
+  ok: boolean
+  message: string
+}
+
+const anchors = ref<SeedAnchor[]>([])
+const adding = ref(false)
+const applying = ref(false)
+const statusMessage = ref('')
+const statusIsError = ref(false)
+
+const draft = reactive<Pick<SeedAnchor, 'npub' | 'address' | 'label'>>({
+  npub: '',
+  address: '',
+  label: '',
+})
+
+function flash(msg: string, isError = false) {
+  statusMessage.value = msg
+  statusIsError.value = isError
+  setTimeout(() => { statusMessage.value = '' }, 6000)
+}
+
+async function load() {
+  try {
+    const res = await rpcClient.call<{ seed_anchors: SeedAnchor[] }>({ method: 'fips.list-seed-anchors' })
+    anchors.value = res.seed_anchors
+  } catch (e: unknown) {
+    if (import.meta.env.DEV) console.warn('fips.list-seed-anchors failed', e)
+  }
+}
+
+async function addAnchor() {
+  if (!draft.npub.trim() || !draft.address.trim()) return
+  adding.value = true
+  try {
+    const res = await rpcClient.call<{ seed_anchors: SeedAnchor[]; apply: ApplyResult[] }>({
+      method: 'fips.add-seed-anchor',
+      params: {
+        npub: draft.npub.trim(),
+        address: draft.address.trim(),
+        transport: 'udp',
+        label: draft.label.trim(),
+      },
+    })
+    anchors.value = res.seed_anchors
+    draft.npub = ''
+    draft.address = ''
+    draft.label = ''
+    const applied = res.apply.find(r => r.ok)
+    flash(applied ? 'Anchor added and dialed.' : 'Anchor saved — dial failed, will retry on the next apply cycle.', !applied)
+  } catch (e: unknown) {
+    const msg = e instanceof Error ? e.message : String(e)
+    flash(`Add failed: ${msg}`, true)
+  } finally {
+    adding.value = false
+  }
+}
+
+async function removeAnchor(npub: string) {
+  try {
+    const res = await rpcClient.call<{ seed_anchors: SeedAnchor[] }>({
+      method: 'fips.remove-seed-anchor',
+      params: { npub },
+    })
+    anchors.value = res.seed_anchors
+    flash('Anchor removed.')
+  } catch (e: unknown) {
+    const msg = e instanceof Error ? e.message : String(e)
+    flash(`Remove failed: ${msg}`, true)
+  }
+}
+
+async function applyAll() {
+  applying.value = true
+  try {
+    const res = await rpcClient.call<{ applied: number; results: ApplyResult[] }>({ method: 'fips.apply-seed-anchors' })
+    const ok = res.results.filter(r => r.ok).length
+    flash(`${ok} of ${res.applied} anchor${res.applied === 1 ? '' : 's'} dialed.`, ok === 0 && res.applied > 0)
+  } catch (e: unknown) {
+    const msg = e instanceof Error ? e.message : String(e)
+    flash(`Apply failed: ${msg}`, true)
+  } finally {
+    applying.value = false
+  }
+}
+
+onMounted(load)
+</script>

neode-ui/src/views/settings/AccountInfoSection.vue

@@ -180,6 +180,76 @@ init()
               </button>
             </div>
             <div class="overflow-y-auto flex-1 min-h-0 space-y-6 pr-1">
+              <!-- v1.7.22-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.22-alpha</span>
+                  <span class="text-xs text-white/40">Apr 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>The FIPS Reconnect and Restart buttons now work on every node, regardless of which systemd unit is actually supervising the daemon. Previously they targeted only the archipelago-managed unit — nodes that were running the upstream unit instead saw the buttons silently do nothing. Both paths now auto-detect which unit is up and act on that one.</p>
+                  <p>The FIPS anchor status no longer shows red just because one specific public anchor is unreachable. It now lights green whenever any authenticated peer is a recognised anchor — that's either the public anchor or something you added under Seed Anchors. A federated cluster that routes through its own seed anchor finally reports the truth.</p>
+                  <p>Reconnect also re-pushes your seed anchors after the restart, so you don't have to wait five minutes for the background apply loop to re-dial them.</p>
+                </div>
+              </div>
+              <!-- v1.7.21-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.21-alpha</span>
+                  <span class="text-xs text-white/40">Apr 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>FIPS bootstrap no longer depends on a single public anchor. You can now add your own anchors — other archipelago nodes or a VPS you control — and the node will dial every one of them to join the mesh on startup. If one anchor is down, the next one seeds the routing layer instead, so a flaky public anchor no longer strands a fresh install.</p>
+                  <p>Anchors persist across restarts and are re-applied every five minutes, so a daemon that got temporarily isolated reconnects on its own without anyone having to SSH in. Each anchor carries an operator-editable label so you can remember which is which.</p>
+                  <p>No behavior change if you don't configure any — the upstream daemon's own defaults keep working as before. This purely adds an operator-controlled list on top.</p>
+                </div>
+              </div>
+              <!-- v1.7.20-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.20-alpha</span>
+                  <span class="text-xs text-white/40">Apr 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>Fixed a critical bug where nodes on the automatic daily-update schedule could end up offline after their nightly update. The scheduler was killing the service a moment too early, before the built-in restart handler had a chance to bring the new version back up — leaving the node dead until someone SSH'd in and started it manually. The scheduler now hands off cleanly to the same restart path the 'Install Update' button uses, so auto-applied updates come back online on their own.</p>
+                  <p>Applies to any node configured for 'Check &amp; Apply Daily' — no change required on your end, the fix ships with this update.</p>
+                </div>
+              </div>
+              <!-- v1.7.19-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.19-alpha</span>
+                  <span class="text-xs text-white/40">Apr 21, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>Your node no longer offers a version you've already passed as an "available update". If you sideload or skip a release, any stored pointer to an earlier version is dropped on next restart, and the System Update page offers only the genuinely newer release — no more seeing an older version listed as something to install.</p>
+                  <p>Version comparison is now numeric, not alphabetic. 1.7.10 correctly outranks 1.7.9 (earlier naive string-order would have got this backwards once the patch number hits double digits), so update prompts and "up to date" checks stay accurate past the nines.</p>
+                  <p>A stale manifest from a slow cache or proxy can no longer downgrade your node. If the manifest reports a version equal to or behind what's running, your node treats that as "up to date" rather than offering the older version as an update.</p>
+                </div>
+              </div>
+              <!-- v1.7.18-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.18-alpha</span>
+                  <span class="text-xs text-white/40">Apr 20, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>Nodes discovered through a trusted peer now land as Trusted instead of Observer. When your federated peer shares its own peer list with you, those nodes get the same trust level as a direct invite — the link they came through is already one you vetted, so you no longer need to promote them by hand before they can be used normally.</p>
+                  <p>The update flow now writes clearer logs at every step. Start of download, cancel, and apply each emit a one-line entry to the system journal with the staging path and the affected files, so if a download misbehaves on your node it's easy to see exactly where it got to.</p>
+                </div>
+              </div>
+              <!-- v1.7.17-alpha -->
+              <div>
+                <div class="flex items-center gap-2 mb-3">
+                  <span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.17-alpha</span>
+                  <span class="text-xs text-white/40">Apr 20, 2026</span>
+                </div>
+                <div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
+                  <p>When a download gets stuck, you can now cancel it. A new Cancel Download button sits next to the progress bar — it stops the transfer, clears the partial file, and returns you to a clean state so you can retry. No more staring at a frozen bar with no way to recover.</p>
+                  <p>Downloads that stall for 30 seconds or more now say so. The progress bar turns amber and shows 'Download appears stuck — try Cancel and start again' instead of just sitting silently at whatever percent it reached.</p>
+                  <p>Canceling is fast. It no longer has to wait out the retry timer — the download bails within half a second, so you're not stuck watching a stuck screen while you wait to unstick it.</p>
+                </div>
+              </div>
               <!-- v1.7.16-alpha -->
               <div>
                 <div class="flex items-center gap-2 mb-3">