feat(fips): resilience — connectivity watcher with immediate anchor re-apply, rebindable peer listener, cached service probe, warm-path union

Phase A3 of docs/FIPS-UPTIME-AND-UI-STATE-PLAN.md (RC5), measured against
the A2 dial_stats baseline:

- 25s connectivity watcher in the fips supervisor: re-applies seed anchors
  immediately on an anchor-link drop, on startup-disconnected, AND on
  silent data-path death (connect_fails growing with zero fips_ok — the
  live .198 failure where the daemon reported "connected" while every
  dial blackholed and the 300s tick never healed it). Bounded to one
  re-apply per 60s.
- anchors::apply is now concurrent with a 15s per-connect cap — the old
  serial loop waited unbounded on each `sudo fipsctl connect`, so one
  hung subprocess stalled the whole periodic tick.
- rebindable peer listener: the accept loop returns after persistent
  accept errors (was: continue forever = inbound-dead until restart) and
  peer_late_bind_loop rebinds — also on fips0 ULA change.
- is_service_active gets a 10s TTL cache (was up to 2 systemctl spawns
  per dial attempt and per warm-tick peer).
- the warm tick now warms the union of federation peers + configured
  seed anchors (direct anchor links used to go cold between 300s ticks),
  skipping the redundant per-peer service check.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core/archipelago/src/fips/mod.rs

@@ -80,25 +80,73 @@ pub async fn ensure_activated(data_dir: &std::path::Path) {
 pub fn spawn_fips_supervisor(data_dir: std::path::PathBuf) {
     tokio::spawn(async move {
         let mut tick = tokio::time::interval(std::time::Duration::from_secs(25));
+        // Connectivity watcher state: re-apply seed anchors the moment the
+        // anchor link drops (edge) or the data path degrades (dials keep
+        // failing with zero successes), instead of waiting for the 300s
+        // anchor tick. Bounded: at most one re-apply per RE_APPLY_BACKOFF.
+        const RE_APPLY_BACKOFF: std::time::Duration = std::time::Duration::from_secs(60);
+        let mut prev_connected: Option<bool> = None;
+        let mut prev_totals = telemetry::totals();
+        let mut last_apply: Option<std::time::Instant> = None;
         loop {
             tick.tick().await;
             // Bring FIPS up on its own once onboarding has materialised the key.
             ensure_activated(&data_dir).await;
             if !dial::is_service_active().await {
+                prev_connected = None; // daemon restart = fresh edge detection
                 continue;
             }
+
+            // ── Warm the union of federation peers + configured seed
+            // anchors. Warming only federation npubs left the direct
+            // anchors (vps2, LAN peers) to go cold between 300s ticks.
             let nodes = crate::federation::load_nodes(&data_dir)
                 .await
                 .unwrap_or_default();
+            let seed = anchors::load(&data_dir).await.unwrap_or_default();
+            let mut warm_npubs: std::collections::BTreeSet<String> = nodes
+                .iter()
+                .filter_map(|n| n.fips_npub.clone())
+                .collect();
+            warm_npubs.extend(seed.iter().map(|a| a.npub.clone()));
             let mut handles = Vec::new();
-            for node in nodes {
-                if let Some(npub) = node.fips_npub.clone() {
-                    handles.push(tokio::spawn(async move { dial::warm_path(&npub).await }));
-                }
+            for npub in warm_npubs {
+                // Service-active was checked once above for the whole batch.
+                handles.push(tokio::spawn(
+                    async move { dial::warm_path_unchecked(&npub).await },
+                ));
             }
             for h in handles {
                 let _ = h.await;
             }
+
+            // ── Connectivity watcher: detect anchor-link loss AND silent
+            // data-path death (daemon reports "connected" but every dial
+            // connect-fails — observed live on .198, 2026-07-27, where the
+            // 300s tick never healed it).
+            let mut anchor_npubs = vec![service::PUBLIC_ANCHOR_NPUB.to_string()];
+            anchor_npubs.extend(seed.iter().map(|a| a.npub.clone()));
+            let (_, connected) = service::peer_connectivity_summary(&anchor_npubs).await;
+            let totals = telemetry::totals();
+            let link_dropped = prev_connected == Some(true) && !connected;
+            let never_connected = prev_connected.is_none() && !connected;
+            let data_path_dead =
+                totals.1.saturating_sub(prev_totals.1) >= 5 && totals.0 == prev_totals.0;
+            prev_connected = Some(connected);
+            prev_totals = totals;
+
+            let backoff_ok = last_apply.is_none_or(|t| t.elapsed() >= RE_APPLY_BACKOFF);
+            if (link_dropped || never_connected || data_path_dead) && backoff_ok && !seed.is_empty()
+            {
+                tracing::info!(
+                    link_dropped,
+                    never_connected,
+                    data_path_dead,
+                    "FIPS connectivity degraded — re-applying seed anchors now"
+                );
+                last_apply = Some(std::time::Instant::now());
+                let _ = anchors::apply(&seed).await;
+            }
         }
     });
 }