From a90946a45d0ca95e0f818e98737f50c578085ca3 Mon Sep 17 00:00:00 2001
From: Dmitry Demin <dmitry@qed-it.com>
Date: Mon, 1 Jun 2026 21:26:10 +0000
Subject: [PATCH 01/28] ci: allow lint workflow on v4.2.0-dev

---
 .github/workflows/lint.yml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index c579b190529..af072c56279 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -2,7 +2,11 @@ name: Lint
 
 on:
   pull_request:
-    branches: [main]
+    # Temporarily allow CI on the QEDIT integration branch.
+    # TODO: Remove v4.2.0-dev before merging upstream.
+    branches:
+      - main
+      - v4.2.0-dev
     paths:
       - "**/*.rs"
       - "**/Cargo.toml"
@@ -12,7 +16,11 @@ on:
       - .github/workflows/lint.yml
 
   push:
-    branches: [main]
+    # Temporarily allow CI on the QEDIT integration branch.
+    # TODO: Remove v4.2.0-dev before merging upstream.
+    branches:
+      - main
+      - v4.2.0-dev
     paths:
       - "**/*.rs"
       - "**/Cargo.toml"

From 1fa93ac760c4d463ec99e835c6ef13bdc0bb38d6 Mon Sep 17 00:00:00 2001
From: ronkq <arseni@qed-it.com>
Date: Wed, 3 Jun 2026 20:20:25 +0200
Subject: [PATCH 02/28] Add ECR and ECS pipelines to zsa1 branch (#131)

* Add ECR and ECS pipelines to zsa1 branch

* Create stop-ecs.yaml

* Moce stop ECS to correct directory (rename)

* Deploy ECS fixes

* Deploy push ECR fixes

* Add stop ecs fixes

* Change to any tag

---------

Co-authored-by: ronkq <ronkq@users.noreply.github.com>
Co-authored-by: a <github@github.com>
---
 .github/workflows/deploy-ecs.yaml |  82 ++++++++++++++++++
 .github/workflows/push-ecr.yaml   | 139 ++++++++++++++++++++++++++++++
 .github/workflows/stop-ecs.yaml   |  73 ++++++++++++++++
 3 files changed, 294 insertions(+)
 create mode 100644 .github/workflows/deploy-ecs.yaml
 create mode 100644 .github/workflows/push-ecr.yaml
 create mode 100644 .github/workflows/stop-ecs.yaml

diff --git a/.github/workflows/deploy-ecs.yaml b/.github/workflows/deploy-ecs.yaml
new file mode 100644
index 00000000000..32a5bd297cd
--- /dev/null
+++ b/.github/workflows/deploy-ecs.yaml
@@ -0,0 +1,82 @@
+# This GitHub Actions workflow automates deploying the Zebra Server to Amazon ECS.
+# It allows manual triggering with the ability to choose which image tag to deploy.
+# The ECS deploy action registers a new task definition and waits for service stability.
+name: Deploy to Amazon ECS
+on:
+  workflow_dispatch:
+    inputs:
+      image_tag:
+        description: 'Docker image tag to deploy (e.g., latest, v1.0.0, commit-hash)'
+        required: true
+        type: string
+        default: 'latest'
+jobs:
+  deploy-to-ecs:
+    name: Deploy to ECS
+    runs-on: ubuntu-latest
+    environment: dev
+    env:
+      AWS_REGION: ${{ vars.AWS_REGION }}
+      ECR_REPOSITORY: ${{ vars.ECR_REPOSITORY }}
+      ECS_SERVICE: ${{ vars.ECS_SERVICE }}
+      ECS_CLUSTER: ${{ vars.ECS_CLUSTER }}
+      TASK_DEFINITION: ${{ vars.TASK_DEFINITION }}
+      CONTAINER_NAME: ${{ vars.CONTAINER_NAME }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ env.AWS_REGION }}
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v2
+      - name: Download task definition
+        env:
+          IMAGE_TAG: ${{ github.event.inputs.image_tag }}
+        run: |
+          echo "Deploying image: ${{ steps.login-ecr.outputs.registry }}/$ECR_REPOSITORY:$IMAGE_TAG"
+          echo "ECS Service: $ECS_SERVICE"
+          echo "ECS Cluster: $ECS_CLUSTER"
+          echo "Task Definition: $TASK_DEFINITION"
+          echo "Container Name: $CONTAINER_NAME"
+          
+          aws ecs describe-task-definition \
+            --task-definition "$TASK_DEFINITION" \
+            --query 'taskDefinition' > task-definition.json
+
+      - name: Render Amazon ECS task definition
+        id: render-task-definition
+        uses: aws-actions/amazon-ecs-render-task-definition@v1
+        with:
+          task-definition: task-definition.json
+          container-name: ${{ env.CONTAINER_NAME }}
+          image: ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:${{ github.event.inputs.image_tag }}
+
+      - name: Deploy Amazon ECS task definition
+        id: deploy-ecs
+        uses: aws-actions/amazon-ecs-deploy-task-definition@v2
+        with:
+          task-definition: ${{ steps.render-task-definition.outputs.task-definition }}
+          service: ${{ env.ECS_SERVICE }}
+          cluster: ${{ env.ECS_CLUSTER }}
+          wait-for-service-stability: true
+      - name: Get deployment status
+        run: |
+          echo "Deployment Status:"
+          aws ecs describe-services \
+            --cluster $ECS_CLUSTER \
+            --services $ECS_SERVICE \
+            --query 'services[0].{ServiceName:serviceName,Status:status,DesiredCount:desiredCount,RunningCount:runningCount,PendingCount:pendingCount,TaskDefinition:taskDefinition}' \
+            --output table
+          
+          echo ""
+          echo "Current running tasks:"
+          aws ecs list-tasks \
+            --cluster $ECS_CLUSTER \
+            --service-name $ECS_SERVICE \
+            --query 'taskArns' \
+            --output table
diff --git a/.github/workflows/push-ecr.yaml b/.github/workflows/push-ecr.yaml
new file mode 100644
index 00000000000..1c645d1fd6e
--- /dev/null
+++ b/.github/workflows/push-ecr.yaml
@@ -0,0 +1,139 @@
+# This GitHub Actions workflow automates pushing the Zebra Server Docker image to Amazon ECR.
+# It triggers on any tag push or manual dispatch, builds a Docker image, and pushes it to Amazon Elastic Container Registry (ECR).
+name: Push to Amazon ECR
+
+on:
+  push:
+    tags:
+      - '*'
+  workflow_dispatch:
+    inputs:
+      image_tag_version:
+        description: 'Version to tag the Docker image (e.g., v1.0.0-ZSA)'
+        required: true
+        type: string
+
+jobs:
+  push-to-ecr:
+    name: Push to ECR
+    runs-on: ubuntu-latest
+    environment: dev
+    env:
+      AWS_REGION: ${{ vars.AWS_REGION }}
+      ECR_REPOSITORY: ${{ vars.ECR_REPOSITORY }}
+      DOCKERFILE_PATH: docker/Dockerfile
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v2
+
+      - name: Get Git tags and set image tags
+        id: vars
+        run: |
+          git fetch --tags
+          
+          # Get exact match tag if it exists (will be empty if the current commit doesn't have a tag)
+          GIT_TAG=$(git describe --exact-match --tags 2>/dev/null || echo "")
+          IMAGE_TAG_VERSION="${{ github.event.inputs.image_tag_version }}"
+          
+          # Set environment variables and echo results
+          if [ -n "$GIT_TAG" ]; then
+            echo "GIT_TAG=$GIT_TAG" >> "$GITHUB_ENV"
+            echo "Git Tag Discovery:"
+            echo "  Found exact match Git tag: $GIT_TAG"
+          else
+            echo "Git Tag Discovery:"
+            echo "  No exact match Git tag found for current commit"
+          fi
+          
+          # Set the input IMAGE_TAG_VERSION
+          echo "IMAGE_TAG_VERSION=$IMAGE_TAG_VERSION" >> "$GITHUB_ENV"
+          echo "  User-provided IMAGE_TAG_VERSION: $IMAGE_TAG_VERSION"
+
+      - name: Build, tag, and push image to Amazon ECR
+        id: build-image
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          IMAGE_TAG_LATEST: latest
+        run: |
+          # Get Git information for build args
+          GIT_COMMIT=$(git rev-parse HEAD)
+          GIT_TAG_BUILD=$(git describe --exact-match --tags 2>/dev/null || echo "none")
+          
+          echo "Git information for build:"
+          echo "  Commit: $GIT_COMMIT"
+          echo "  Tag: $GIT_TAG_BUILD"
+          
+          # Build docker container with multiple tags
+          DOCKER_BUILD_ARGS=()
+          DOCKER_BUILD_ARGS+=("-t" "$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG_LATEST")
+          
+          # Only add IMAGE_TAG_VERSION if it's not empty
+          if [ -n "$IMAGE_TAG_VERSION" ]; then
+            DOCKER_BUILD_ARGS+=("-t" "$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG_VERSION")
+          fi
+          
+          # Add exact tag if it exists
+          if [ -n "$GIT_TAG" ]; then
+            DOCKER_BUILD_ARGS+=("-t" "$ECR_REGISTRY/$ECR_REPOSITORY:$GIT_TAG")
+          fi
+          
+          # Echo final tags that will be pushed
+          echo "Docker Image Tags to be pushed:"
+          for arg in "${DOCKER_BUILD_ARGS[@]}"; do
+            if [[ "$arg" != "-t" ]]; then
+              echo "  $arg"
+            fi
+          done
+          echo ""
+          
+          # Build with all tags and Git build args
+          echo "Building Docker image..."
+          docker build "${DOCKER_BUILD_ARGS[@]}" \
+            --build-arg GIT_COMMIT="$GIT_COMMIT" \
+            --build-arg GIT_TAG="$GIT_TAG_BUILD" \
+            -f $DOCKERFILE_PATH .
+          
+          # Push all tags with error handling
+          for tag in "$IMAGE_TAG_LATEST" "$IMAGE_TAG_VERSION" "$GIT_TAG"; do
+            # Skip empty tags (e.g., if IMAGE_TAG_VERSION or GIT_TAG is unset)
+            [ -z "$tag" ] && continue
+            image="$ECR_REGISTRY/$ECR_REPOSITORY:$tag"
+            echo "Pushing $image…"
+            if ! docker push "$image"; then
+              echo "Failed to push $image"
+              exit 1
+            fi
+          done
+          
+          # Output the image URIs
+          echo "image_latest=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG_LATEST" >> $GITHUB_OUTPUT
+          
+          if [ -n "$IMAGE_TAG_VERSION" ]; then
+            echo "image_version=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG_VERSION" >> $GITHUB_OUTPUT
+          fi
+          
+          if [ -n "$GIT_TAG" ]; then
+            echo "image_exact_tag=$ECR_REGISTRY/$ECR_REPOSITORY:$GIT_TAG" >> $GITHUB_OUTPUT
+          fi
+          
+          echo ""
+          echo "====================================="
+          echo "Successfully pushed to ECR:"
+          echo "  Registry:   $ECR_REGISTRY"
+          echo "  Repository: $ECR_REPOSITORY"
+          echo "  Tags:       $IMAGE_TAG_LATEST ${IMAGE_TAG_VERSION:+$IMAGE_TAG_VERSION }${GIT_TAG:+$GIT_TAG}"
+          echo "====================================="
diff --git a/.github/workflows/stop-ecs.yaml b/.github/workflows/stop-ecs.yaml
new file mode 100644
index 00000000000..97e85f5f0aa
--- /dev/null
+++ b/.github/workflows/stop-ecs.yaml
@@ -0,0 +1,73 @@
+name: Stop All ECS Tasks
+
+on:
+  workflow_dispatch:
+
+jobs:
+  stop-tasks:
+    name: Stop All ECS Tasks
+    runs-on: ubuntu-latest
+    environment: dev
+    env:
+      AWS_REGION: ${{ vars.AWS_REGION }}
+      ECS_SERVICE: ${{ vars.ECS_SERVICE }}
+      ECS_CLUSTER: ${{ vars.ECS_CLUSTER }}
+    steps:
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Stop all running tasks
+        id: stop-tasks
+        run: |
+          echo "Fetching running tasks for service: $ECS_SERVICE in cluster: $ECS_CLUSTER"
+          
+          TASK_ARNS=$(aws ecs list-tasks \
+            --cluster "$ECS_CLUSTER" \
+            --service-name "$ECS_SERVICE" \
+            --query 'taskArns[]' \
+            --output text)
+          echo "task_arns=$TASK_ARNS" >> "$GITHUB_OUTPUT"
+          
+          if [ -z "$TASK_ARNS" ]; then
+            echo "No running tasks found."
+            exit 0
+          fi
+          
+          echo "Found tasks: $TASK_ARNS"
+          
+          for TASK_ARN in $TASK_ARNS; do
+            echo "Stopping task: $TASK_ARN"
+            aws ecs stop-task \
+              --cluster "$ECS_CLUSTER" \
+              --task "$TASK_ARN" \
+              --reason "Manually stopped via GitHub Actions"
+          done
+          
+          echo "Stop requests submitted for all running tasks."
+
+      - name: Wait for tasks to stop
+        run: |
+          TASK_ARNS="${{ steps.stop-tasks.outputs.task_arns }}"
+          
+          if [ -z "$TASK_ARNS" ]; then
+            echo "No tasks were stopped."
+            exit 0
+          fi
+          
+          echo "Waiting for stopped tasks..."
+          aws ecs wait tasks-stopped \
+            --cluster "$ECS_CLUSTER" \
+            --tasks $TASK_ARNS
+          
+          echo "All tasks stopped."
+          
+          echo "Stopped task status:"
+          aws ecs describe-tasks \
+            --cluster "$ECS_CLUSTER" \
+            --tasks $TASK_ARNS \
+            --query 'tasks[].{Task:taskArn,LastStatus:lastStatus,StoppedReason:stoppedReason}' \
+            --output table

From 443544a3dd376406ae6c529a447d4d6eda6c1b5d Mon Sep 17 00:00:00 2001
From: ronkq <arseni@qed-it.com>
Date: Thu, 4 Jun 2026 09:18:32 +0200
Subject: [PATCH 03/28] Update push-ecr.yaml (#137)

---
 .github/workflows/push-ecr.yaml | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/push-ecr.yaml b/.github/workflows/push-ecr.yaml
index 1c645d1fd6e..890f444cedd 100644
--- a/.github/workflows/push-ecr.yaml
+++ b/.github/workflows/push-ecr.yaml
@@ -1,7 +1,6 @@
 # This GitHub Actions workflow automates pushing the Zebra Server Docker image to Amazon ECR.
 # It triggers on any tag push or manual dispatch, builds a Docker image, and pushes it to Amazon Elastic Container Registry (ECR).
 name: Push to Amazon ECR
-
 on:
   push:
     tags:
@@ -12,7 +11,10 @@ on:
         description: 'Version to tag the Docker image (e.g., v1.0.0-ZSA)'
         required: true
         type: string
-
+      source_ref:
+        description: 'Branch or tag to build from (leave empty to use the current ref)'
+        required: false
+        type: string
 jobs:
   push-to-ecr:
     name: Push to ECR
@@ -22,24 +24,21 @@ jobs:
       AWS_REGION: ${{ vars.AWS_REGION }}
       ECR_REPOSITORY: ${{ vars.ECR_REPOSITORY }}
       DOCKERFILE_PATH: docker/Dockerfile
-
     steps:
       - name: Checkout
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-
+          ref: ${{ github.event.inputs.source_ref }}
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v4
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws-region: ${{ env.AWS_REGION }}
-
       - name: Login to Amazon ECR
         id: login-ecr
         uses: aws-actions/amazon-ecr-login@v2
-
       - name: Get Git tags and set image tags
         id: vars
         run: |
@@ -62,7 +61,6 @@ jobs:
           # Set the input IMAGE_TAG_VERSION
           echo "IMAGE_TAG_VERSION=$IMAGE_TAG_VERSION" >> "$GITHUB_ENV"
           echo "  User-provided IMAGE_TAG_VERSION: $IMAGE_TAG_VERSION"
-
       - name: Build, tag, and push image to Amazon ECR
         id: build-image
         env:

From 6fdbb1f9ca125f81caa19db2da7fc352b6200379 Mon Sep 17 00:00:00 2001
From: Dmitry <dmidem@users.noreply.github.com>
Date: Thu, 4 Jun 2026 13:18:01 +0200
Subject: [PATCH 04/28] ci: skip trusted_chain_sync_handles_forks_correctly
 test (#138)

---
 .github/workflows/ci-basic.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci-basic.yml b/.github/workflows/ci-basic.yml
index ff00f174da2..e703882dfd8 100644
--- a/.github/workflows/ci-basic.yml
+++ b/.github/workflows/ci-basic.yml
@@ -48,7 +48,12 @@ jobs:
           sed -i 's|.*"--cfg", "zcash_unstable=\\"nu7\\"".*|# &|' .cargo/config.toml
 
       - name: Run tests
-        run: timeout --preserve-status 1h cargo test --verbose --locked
+        run: |
+          # FIXME: Restore the full test run later.
+          # Temporarily skip this acceptance test in QEDIT CI because it starts a Mainnet zebrad
+          # and can be flaky due to external network/Mainnet conditions.
+          timeout --preserve-status 1h cargo test --verbose --locked -- \
+            --skip trusted_chain_sync_handles_forks_correctly
       - name: Run doc check
         run: cargo doc --workspace --no-deps --all-features --document-private-items --locked
       - name: Run format check

From 15494e559836de79e548799ae20ffe4965841170 Mon Sep 17 00:00:00 2001
From: Paul <3682187+PaulLaux@users.noreply.github.com>
Date: Thu, 4 Jun 2026 15:10:18 +0300
Subject: [PATCH 05/28] split run attempts

---
 .github/workflows/ci-basic.yml | 44 +++++++++++++++++++++++++++-------
 1 file changed, 36 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci-basic.yml b/.github/workflows/ci-basic.yml
index 8bbf3366dda..0867379c704 100644
--- a/.github/workflows/ci-basic.yml
+++ b/.github/workflows/ci-basic.yml
@@ -59,19 +59,47 @@ jobs:
           SKIP_NETWORK_TESTS: "1"
         run: timeout --preserve-status 1h cargo test --verbose --locked
 
-      - name: Run network-sensitive tests
+      # Build the network-sensitive test binaries outside the retry loops so
+      # compile failures fail once instead of being retried, and retry
+      # attempts below contain only test runtime.
+      - name: Build network-sensitive tests
+        run: |
+          cargo test -p zebra-network --lib --verbose --locked --no-run
+          cargo test -p zebrad --test acceptance --verbose --locked --no-run
+
+      # The two network-sensitive suites are retried independently so a flaky
+      # failure in one does not re-run the other. Per-attempt timeouts are
+      # sized from measured serial test runtimes (~15m and ~19m) plus headroom.
+      - name: Run zebra-network tests
+        run: |
+          for attempt in 1 2 3; do
+            echo "zebra-network tests attempt ${attempt}"
+
+            timeout --preserve-status 25m \
+              cargo test -p zebra-network --lib --verbose --locked -- --test-threads=1 \
+              && exit 0
+
+            status=$?
+            echo "zebra-network tests attempt ${attempt} failed with status ${status}"
+
+            if [ "${attempt}" = "3" ]; then
+              exit "${status}"
+            fi
+
+            sleep 30
+          done
+
+      - name: Run zebrad acceptance tests
         run: |
           for attempt in 1 2 3; do
-            echo "network-sensitive tests attempt ${attempt}"
+            echo "zebrad acceptance tests attempt ${attempt}"
 
-            timeout --preserve-status 45m bash -c '
-              set -euo pipefail
-              cargo test -p zebra-network --lib --verbose --locked -- --test-threads=1
-              cargo test -p zebrad --test acceptance --verbose --locked -- --test-threads=1
-            ' && exit 0
+            timeout --preserve-status 30m \
+              cargo test -p zebrad --test acceptance --verbose --locked -- --test-threads=1 \
+              && exit 0
 
             status=$?
-            echo "network-sensitive tests attempt ${attempt} failed with status ${status}"
+            echo "zebrad acceptance tests attempt ${attempt} failed with status ${status}"
 
             if [ "${attempt}" = "3" ]; then
               exit "${status}"

From 83c653e8869051fd9e056c25b1443f798daa6092 Mon Sep 17 00:00:00 2001
From: ronkq <arseni@qed-it.com>
Date: Wed, 10 Jun 2026 11:09:17 +0200
Subject: [PATCH 06/28] fix(ci): use regtest dockerfile for ECR push (#141)

push-ecr.yaml was pointing at docker/Dockerfile (the upstream mainnet
image) instead of testnet-single-node-deploy/dockerfile (the regtest
image used by tx-tool). The ECS node was syncing mainnet from genesis,
causing tx-tool to fail with exit code 101.

Co-authored-by: ronkq <github@github.com>
---
 .github/workflows/push-ecr.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/push-ecr.yaml b/.github/workflows/push-ecr.yaml
index 890f444cedd..f4466ebd937 100644
--- a/.github/workflows/push-ecr.yaml
+++ b/.github/workflows/push-ecr.yaml
@@ -23,7 +23,7 @@ jobs:
     env:
       AWS_REGION: ${{ vars.AWS_REGION }}
       ECR_REPOSITORY: ${{ vars.ECR_REPOSITORY }}
-      DOCKERFILE_PATH: docker/Dockerfile
+      DOCKERFILE_PATH: testnet-single-node-deploy/dockerfile
     steps:
       - name: Checkout
         uses: actions/checkout@v4

From 285e13eddb69f0c94ba48ab08770dd8741cdbb8b Mon Sep 17 00:00:00 2001
From: Dmitry Demin <dmitry@qed-it.com>
Date: Thu, 11 Jun 2026 18:21:12 +0000
Subject: [PATCH 07/28] ci: use cargo nextest in ci-basic.yml

---
 .github/workflows/ci-basic.yml | 59 ++++++++++------------------------
 1 file changed, 17 insertions(+), 42 deletions(-)

diff --git a/.github/workflows/ci-basic.yml b/.github/workflows/ci-basic.yml
index 0867379c704..a522a48c0ce 100644
--- a/.github/workflows/ci-basic.yml
+++ b/.github/workflows/ci-basic.yml
@@ -57,56 +57,31 @@ jobs:
       - name: Run non-network tests
         env:
           SKIP_NETWORK_TESTS: "1"
-        run: timeout --preserve-status 1h cargo test --verbose --locked
+        run: |
+          timeout --preserve-status 1h cargo test --verbose --locked -- \
+            --skip trusted_chain_sync_handles_forks_correctly
+
+      - name: Install cargo-nextest
+        uses: taiki-e/install-action@nextest
 
-      # Build the network-sensitive test binaries outside the retry loops so
-      # compile failures fail once instead of being retried, and retry
-      # attempts below contain only test runtime.
-      - name: Build network-sensitive tests
+      - name: Run regular tests
         run: |
-          cargo test -p zebra-network --lib --verbose --locked --no-run
-          cargo test -p zebrad --test acceptance --verbose --locked --no-run
+          timeout --preserve-status 1h \
+            cargo nextest run --workspace --locked \
+              -E 'not package(zebra-network) and not binary(acceptance)'
 
-      # The two network-sensitive suites are retried independently so a flaky
-      # failure in one does not re-run the other. Per-attempt timeouts are
-      # sized from measured serial test runtimes (~15m and ~19m) plus headroom.
       - name: Run zebra-network tests
         run: |
-          for attempt in 1 2 3; do
-            echo "zebra-network tests attempt ${attempt}"
-
-            timeout --preserve-status 25m \
-              cargo test -p zebra-network --lib --verbose --locked -- --test-threads=1 \
-              && exit 0
-
-            status=$?
-            echo "zebra-network tests attempt ${attempt} failed with status ${status}"
-
-            if [ "${attempt}" = "3" ]; then
-              exit "${status}"
-            fi
-
-            sleep 30
-          done
+          timeout --preserve-status 30m \
+            cargo nextest run -p zebra-network --locked \
+              --retries 3
 
       - name: Run zebrad acceptance tests
         run: |
-          for attempt in 1 2 3; do
-            echo "zebrad acceptance tests attempt ${attempt}"
-
-            timeout --preserve-status 30m \
-              cargo test -p zebrad --test acceptance --verbose --locked -- --test-threads=1 \
-              && exit 0
-
-            status=$?
-            echo "zebrad acceptance tests attempt ${attempt} failed with status ${status}"
-
-            if [ "${attempt}" = "3" ]; then
-              exit "${status}"
-            fi
-
-            sleep 30
-          done
+          timeout --preserve-status 1h \
+            cargo nextest run -p zebrad --test acceptance --locked \
+              --retries 3 \
+              --test-threads 4
 
       - name: Run doc check
         run: cargo doc --workspace --no-deps --all-features --document-private-items --locked

From b40f5250fe9000106e6c51a70939fe44445813aa Mon Sep 17 00:00:00 2001
From: Dmitry Demin <dmitry@qed-it.com>
Date: Thu, 11 Jun 2026 18:22:49 +0000
Subject: [PATCH 08/28] ci: update the upstream YAML files to trigger on PRs to
 zsa1

---
 .github/workflows/lint.yml        | 12 +++---------
 .github/workflows/test-crates.yml |  4 +++-
 .github/workflows/test-docker.yml |  4 +++-
 .github/workflows/tests-unit.yml  |  4 +++-
 4 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index af072c56279..600c847d78e 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -2,11 +2,9 @@ name: Lint
 
 on:
   pull_request:
-    # Temporarily allow CI on the QEDIT integration branch.
-    # TODO: Remove v4.2.0-dev before merging upstream.
     branches:
-      - main
-      - v4.2.0-dev
+      main
+      zsa1
     paths:
       - "**/*.rs"
       - "**/Cargo.toml"
@@ -16,11 +14,7 @@ on:
       - .github/workflows/lint.yml
 
   push:
-    # Temporarily allow CI on the QEDIT integration branch.
-    # TODO: Remove v4.2.0-dev before merging upstream.
-    branches:
-      - main
-      - v4.2.0-dev
+    branches: [main]
     paths:
       - "**/*.rs"
       - "**/Cargo.toml"
diff --git a/.github/workflows/test-crates.yml b/.github/workflows/test-crates.yml
index d1dc95c4020..2274be2c4cf 100644
--- a/.github/workflows/test-crates.yml
+++ b/.github/workflows/test-crates.yml
@@ -2,7 +2,9 @@ name: Test Crate Build
 
 on:
   pull_request:
-    branches: [main]
+    branches:
+      main
+      zsa1
     paths:
       - "**/*.rs"
       - "**/Cargo.toml"
diff --git a/.github/workflows/test-docker.yml b/.github/workflows/test-docker.yml
index 4de0acd2544..19423198882 100644
--- a/.github/workflows/test-docker.yml
+++ b/.github/workflows/test-docker.yml
@@ -2,7 +2,9 @@ name: Test Docker Config
 
 on:
   pull_request:
-    branches: [main]
+    branches:
+      main
+      zsa1
     paths:
       - "**/*.rs"
       - "**/Cargo.toml"
diff --git a/.github/workflows/tests-unit.yml b/.github/workflows/tests-unit.yml
index 0ced5e4230a..34764e12cca 100644
--- a/.github/workflows/tests-unit.yml
+++ b/.github/workflows/tests-unit.yml
@@ -2,7 +2,9 @@ name: Unit Tests
 
 on:
   pull_request:
-    branches: [main]
+    branches:
+      main
+      zsa1
     paths:
       - "**/*.rs"
       - "**/Cargo.toml"

From 6b2ff2a2053aa93a1b2fc6073c718884d8e9c698 Mon Sep 17 00:00:00 2001
From: Dmitry Demin <dmitry@qed-it.com>
Date: Thu, 11 Jun 2026 18:36:23 +0000
Subject: [PATCH 09/28] ci: update the upstream YAML files to trigger on PRs to
 zsa1 (fixed)

---
 .github/workflows/lint.yml        | 4 ++--
 .github/workflows/test-crates.yml | 5 ++---
 .github/workflows/test-docker.yml | 4 ++--
 .github/workflows/tests-unit.yml  | 4 ++--
 4 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 600c847d78e..962f759c797 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -3,8 +3,8 @@ name: Lint
 on:
   pull_request:
     branches:
-      main
-      zsa1
+      - main
+      - zsa1
     paths:
       - "**/*.rs"
       - "**/Cargo.toml"
diff --git a/.github/workflows/test-crates.yml b/.github/workflows/test-crates.yml
index 2274be2c4cf..749be908d3e 100644
--- a/.github/workflows/test-crates.yml
+++ b/.github/workflows/test-crates.yml
@@ -3,8 +3,8 @@ name: Test Crate Build
 on:
   pull_request:
     branches:
-      main
-      zsa1
+      - main
+      - zsa1
     paths:
       - "**/*.rs"
       - "**/Cargo.toml"
@@ -186,7 +186,6 @@ jobs:
           cargo clippy --package ${{ matrix.crate }} --all-features --all-targets -- -D warnings
           cargo build --package ${{ matrix.crate }} --all-features --all-targets
 
-
   test-crate-build-success:
     name: test crate build success
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test-docker.yml b/.github/workflows/test-docker.yml
index 19423198882..084279b6146 100644
--- a/.github/workflows/test-docker.yml
+++ b/.github/workflows/test-docker.yml
@@ -3,8 +3,8 @@ name: Test Docker Config
 on:
   pull_request:
     branches:
-      main
-      zsa1
+      - main
+      - zsa1
     paths:
       - "**/*.rs"
       - "**/Cargo.toml"
diff --git a/.github/workflows/tests-unit.yml b/.github/workflows/tests-unit.yml
index 34764e12cca..d73086339ba 100644
--- a/.github/workflows/tests-unit.yml
+++ b/.github/workflows/tests-unit.yml
@@ -3,8 +3,8 @@ name: Unit Tests
 on:
   pull_request:
     branches:
-      main
-      zsa1
+      - main
+      - zsa1
     paths:
       - "**/*.rs"
       - "**/Cargo.toml"

From 3561641fd6806d9a002af806f4b26f4a7ded085f Mon Sep 17 00:00:00 2001
From: Dmitry Demin <dmitry@qed-it.com>
Date: Thu, 11 Jun 2026 19:08:09 +0000
Subject: [PATCH 10/28] Temporarily pin Rust toolchain to 1.85.1

---
 rust-toolchain.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index 292fe499e3b..b67e7d5348c 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,2 +1,2 @@
 [toolchain]
-channel = "stable"
+channel = "1.89.0"

From 50b2e3db5adeef0e1528a8f7cddaff4413ff5c17 Mon Sep 17 00:00:00 2001
From: Dmitry Demin <dmitry@qed-it.com>
Date: Thu, 11 Jun 2026 21:25:22 +0000
Subject: [PATCH 11/28] ci: pin lint workflow to Rust 1.94 temporarily

---
 .github/workflows/lint.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 962f759c797..5ce451703b5 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -48,7 +48,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        rust-version: [stable, beta]
+        # TODO: QED-it temporary Rust 1.94 pin: stable when testing Zebra v4.2.0 on upstream CI; remove before upstream merge.
+        rust-version: [1.94]
         type: [release, tests]
         include:
           - type: release
@@ -69,8 +70,7 @@ jobs:
           cache-on-failure: true
       - uses: ./.github/actions/setup-zebra-build
       - name: Run clippy
-        # TODO: Temporary QED-it fork exception for clippy::manual_option_zip; remove before merging this branch upstream.
-        run: cargo clippy ${{ matrix.args }} --features "${{ matrix.features }}" -- -A unknown-lints -A clippy::manual_option_zip
+        run: cargo clippy ${{ matrix.args }} --features "${{ matrix.features }}"
 
   crate-checks:
     permissions:

From 2161bb0827fedf21f3664d653a569e3e5b81bab1 Mon Sep 17 00:00:00 2001
From: Dmitry Demin <dmitry@qed-it.com>
Date: Thu, 11 Jun 2026 22:23:51 +0000
Subject: [PATCH 12/28] ci: pin unused-deps job to Rust 1.94 and cargo-udeps
 0.1.60

---
 .github/workflows/lint.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 5ce451703b5..2d7a1d6b435 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -164,11 +164,13 @@ jobs:
           persist-credentials: false
       - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c #v1.15.2
         with:
-          toolchain: nightly
+          # TODO: QED-it temp Rust 1.94 pin: stable for Zebra v4.2.0 CI; remove before upstream merge.
+          toolchain: "1.94"
           cache-on-failure: true
       - uses: taiki-e/install-action@305bebabd4457bed9b82541755f034994382465b #v2.68.10
         with:
-          tool: cargo-udeps
+          # TODO: QED-it temp cargo-udeps 0.1.60 pin: stable for Zebra v4.2.0 CI; remove before upstream merge.
+          tool: cargo-udeps@0.1.60
       - uses: ./.github/actions/setup-zebra-build
       - run: cargo udeps --workspace --all-targets --all-features --locked
 

From f2987d8bed83afb7dc9b6524a4b13db3554202aa Mon Sep 17 00:00:00 2001
From: Dmitry Demin <dmitry@qed-it.com>
Date: Fri, 12 Jun 2026 06:38:54 +0000
Subject: [PATCH 13/28] Try using a pinned nightly toolchain for unused-deps

---
 .github/workflows/lint.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 2d7a1d6b435..77e73f61dfc 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -164,8 +164,8 @@ jobs:
           persist-credentials: false
       - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c #v1.15.2
         with:
-          # TODO: QED-it temp Rust 1.94 pin: stable for Zebra v4.2.0 CI; remove before upstream merge.
-          toolchain: "1.94"
+          # TODO: QED-it temp nightly pin: matches Zebra v4.2.0 CI test period; remove before upstream merge.
+          toolchain: nightly-2026-03-06
           cache-on-failure: true
       - uses: taiki-e/install-action@305bebabd4457bed9b82541755f034994382465b #v2.68.10
         with:

From 4168a6410acd778a8652a202483784977961be14 Mon Sep 17 00:00:00 2001
From: Dmitry Demin <dmitry@qed-it.com>
Date: Fri, 12 Jun 2026 07:08:19 +0000
Subject: [PATCH 14/28] ci: pin test-crates matrix job to Rust 1.94

---
 .github/workflows/test-crates.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test-crates.yml b/.github/workflows/test-crates.yml
index 749be908d3e..d4821a33846 100644
--- a/.github/workflows/test-crates.yml
+++ b/.github/workflows/test-crates.yml
@@ -59,7 +59,8 @@ jobs:
 
       - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c #v1.15.2
         with:
-          toolchain: stable
+          # TODO: QED-it temp Rust 1.94 pin: stable for Zebra v4.2.0 CI; remove before upstream merge.
+          toolchain: "1.94"
           components: clippy
           cache-on-failure: true
       - uses: ./.github/actions/setup-zebra-build

From 56ecc8c67e624c4bae9d5e1764c7a2704c134e7d Mon Sep 17 00:00:00 2001
From: Dmitry Demin <dmitry@qed-it.com>
Date: Fri, 12 Jun 2026 07:22:25 +0000
Subject: [PATCH 15/28] ci: pin test-crates matrix job to Rust 1.94 (2)

---
 .github/workflows/test-crates.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test-crates.yml b/.github/workflows/test-crates.yml
index d4821a33846..0d2744120ef 100644
--- a/.github/workflows/test-crates.yml
+++ b/.github/workflows/test-crates.yml
@@ -112,7 +112,8 @@ jobs:
 
       - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c #v1.15.2
         with:
-          toolchain: stable
+          # TODO: QED-it temp Rust 1.94 pin: stable for Zebra v4.2.0 CI; remove before upstream merge.
+          toolchain: "1.94"
           components: clippy
           cache-key: crate-build-${{ matrix.crate }}
           cache-on-failure: true

From 11233e31f385a09bdcd10e61f434b9d8939d183c Mon Sep 17 00:00:00 2001
From: Dmitry Demin <dmitry@qed-it.com>
Date: Fri, 12 Jun 2026 09:29:56 +0000
Subject: [PATCH 16/28] ci: try to remove test-threads limit for cargo nextest
 in zebrad acceptance tests in ci-basic.yml

---
 .github/workflows/ci-basic.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/ci-basic.yml b/.github/workflows/ci-basic.yml
index a522a48c0ce..08841a5a60d 100644
--- a/.github/workflows/ci-basic.yml
+++ b/.github/workflows/ci-basic.yml
@@ -80,8 +80,7 @@ jobs:
         run: |
           timeout --preserve-status 1h \
             cargo nextest run -p zebrad --test acceptance --locked \
-              --retries 3 \
-              --test-threads 4
+              --retries 3
 
       - name: Run doc check
         run: cargo doc --workspace --no-deps --all-features --document-private-items --locked

From 2fad89f10b6a0f3b9d12665b24abd9ea598c82e1 Mon Sep 17 00:00:00 2001
From: Dmitry Demin <dmitry@qed-it.com>
Date: Mon, 15 Jun 2026 07:11:56 +0000
Subject: [PATCH 17/28] Remove duplicate cargo test step from basic CI

---
 .github/workflows/ci-basic.yml | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/.github/workflows/ci-basic.yml b/.github/workflows/ci-basic.yml
index 08841a5a60d..f4b6fa3721f 100644
--- a/.github/workflows/ci-basic.yml
+++ b/.github/workflows/ci-basic.yml
@@ -54,13 +54,6 @@ jobs:
           sed -i 's|.*"--cfg", .feature="tx_v6".*|# &|' .cargo/config.toml
           sed -i 's|.*"--cfg", "zcash_unstable=\\"nu7\\"".*|# &|' .cargo/config.toml
 
-      - name: Run non-network tests
-        env:
-          SKIP_NETWORK_TESTS: "1"
-        run: |
-          timeout --preserve-status 1h cargo test --verbose --locked -- \
-            --skip trusted_chain_sync_handles_forks_correctly
-
       - name: Install cargo-nextest
         uses: taiki-e/install-action@nextest
 

From 63ef2f297b09628bfac3c786e02b7ba18d50611d Mon Sep 17 00:00:00 2001
From: Dmitry Demin <dmitry@qed-it.com>
Date: Mon, 15 Jun 2026 08:55:38 +0000
Subject: [PATCH 18/28] ci: add retries for
 sync_large_checkpoints_mempool_mainnet in upstream tests-unit.yml

---
 .github/workflows/tests-unit.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/tests-unit.yml b/.github/workflows/tests-unit.yml
index d73086339ba..ef5cf923dd2 100644
--- a/.github/workflows/tests-unit.yml
+++ b/.github/workflows/tests-unit.yml
@@ -97,7 +97,8 @@ jobs:
           echo "PROPTEST_MAX_SHRINK_ITERS=1024" >> $GITHUB_ENV
 
       - name: Run unit tests
-        run: cargo nextest run --profile all-tests --locked --release --features "${{ matrix.features }}" --run-ignored=all
+        # TODO: Remove retries after investigating periodic random failures of sync_large_checkpoints_mempool_mainnet, found on QEDIT CI.
+        run: cargo nextest run --profile all-tests --locked --release --features "${{ matrix.features }}" --run-ignored=all --retries 3
         env:
           TEST_LARGE_CHECKPOINTS: 1
 

From a99696b30a67992336b74158aab4e1fdd4b40ffe Mon Sep 17 00:00:00 2001
From: Dmitry Demin <dmitry@qed-it.com>
Date: Mon, 15 Jun 2026 12:57:17 +0000
Subject: [PATCH 19/28] Pin Rust toolchain to Rust 1.94.0 used as stable for
 upstream v4.2.0

---
 rust-toolchain.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index b67e7d5348c..76a06e6b881 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,2 +1,2 @@
 [toolchain]
-channel = "1.89.0"
+channel = "1.94.0"

From 9642f91004a4461f5e1112f1a2e82f070016f1de Mon Sep 17 00:00:00 2001
From: Dmitry Demin <dmitry@qed-it.com>
Date: Mon, 15 Jun 2026 13:00:02 +0000
Subject: [PATCH 20/28] Pin cargo-nextest install action to commit used in
 upstream CI

---
 .github/workflows/ci-basic.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci-basic.yml b/.github/workflows/ci-basic.yml
index f4b6fa3721f..49eeaa240ca 100644
--- a/.github/workflows/ci-basic.yml
+++ b/.github/workflows/ci-basic.yml
@@ -55,7 +55,7 @@ jobs:
           sed -i 's|.*"--cfg", "zcash_unstable=\\"nu7\\"".*|# &|' .cargo/config.toml
 
       - name: Install cargo-nextest
-        uses: taiki-e/install-action@nextest
+        uses: taiki-e/install-action@305bebabd4457bed9b82541755f034994382465b #v2.68.10
 
       - name: Run regular tests
         run: |

From bf3dd4a3f0a14821d5a2df19cbe4c9ce239a3639 Mon Sep 17 00:00:00 2001
From: Dmitry Demin <dmitry@qed-it.com>
Date: Mon, 15 Jun 2026 13:01:47 +0000
Subject: [PATCH 21/28] Pin cargo-nextest install action to commit used in
 upstream CI

---
 .github/workflows/lint.yml        | 2 +-
 .github/workflows/test-crates.yml | 2 +-
 .github/workflows/test-docker.yml | 2 +-
 .github/workflows/tests-unit.yml  | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 77e73f61dfc..19a7511c40c 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -4,7 +4,7 @@ on:
   pull_request:
     branches:
       - main
-      - zsa1
+      - zsa-support
     paths:
       - "**/*.rs"
       - "**/Cargo.toml"
diff --git a/.github/workflows/test-crates.yml b/.github/workflows/test-crates.yml
index 0d2744120ef..4d481f50710 100644
--- a/.github/workflows/test-crates.yml
+++ b/.github/workflows/test-crates.yml
@@ -4,7 +4,7 @@ on:
   pull_request:
     branches:
       - main
-      - zsa1
+      - zsa-support
     paths:
       - "**/*.rs"
       - "**/Cargo.toml"
diff --git a/.github/workflows/test-docker.yml b/.github/workflows/test-docker.yml
index 084279b6146..1292e20b4f1 100644
--- a/.github/workflows/test-docker.yml
+++ b/.github/workflows/test-docker.yml
@@ -4,7 +4,7 @@ on:
   pull_request:
     branches:
       - main
-      - zsa1
+      - zsa-support
     paths:
       - "**/*.rs"
       - "**/Cargo.toml"
diff --git a/.github/workflows/tests-unit.yml b/.github/workflows/tests-unit.yml
index ef5cf923dd2..b8582f3797a 100644
--- a/.github/workflows/tests-unit.yml
+++ b/.github/workflows/tests-unit.yml
@@ -4,7 +4,7 @@ on:
   pull_request:
     branches:
       - main
-      - zsa1
+      - zsa-support
     paths:
       - "**/*.rs"
       - "**/Cargo.toml"

From 3cce12f14429623cbc7b5c1f9b3439e6ef7f4122 Mon Sep 17 00:00:00 2001
From: Dmitry Demin <dmitry@qed-it.com>
Date: Mon, 15 Jun 2026 13:02:45 +0000
Subject: [PATCH 22/28] Run doctests in basic CI

---
 .github/workflows/ci-basic.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/ci-basic.yml b/.github/workflows/ci-basic.yml
index 49eeaa240ca..9320bddd86d 100644
--- a/.github/workflows/ci-basic.yml
+++ b/.github/workflows/ci-basic.yml
@@ -75,6 +75,11 @@ jobs:
             cargo nextest run -p zebrad --test acceptance --locked \
               --retries 3
 
+      - name: Run doc tests
+        run: |
+          timeout --preserve-status 30m \
+            cargo test --doc --workspace --locked
+
       - name: Run doc check
         run: cargo doc --workspace --no-deps --all-features --document-private-items --locked
 

From 3ad942af4f6b52fd14ad74e07fc41c5c435e38d4 Mon Sep 17 00:00:00 2001
From: Dmitry Demin <dmitry@qed-it.com>
Date: Mon, 15 Jun 2026 13:36:11 +0000
Subject: [PATCH 23/28] Specify cargo-nextest tool for pinned install action

---
 .github/workflows/ci-basic.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci-basic.yml b/.github/workflows/ci-basic.yml
index 9320bddd86d..52b185e45c0 100644
--- a/.github/workflows/ci-basic.yml
+++ b/.github/workflows/ci-basic.yml
@@ -55,7 +55,9 @@ jobs:
           sed -i 's|.*"--cfg", "zcash_unstable=\\"nu7\\"".*|# &|' .cargo/config.toml
 
       - name: Install cargo-nextest
-        uses: taiki-e/install-action@305bebabd4457bed9b82541755f034994382465b #v2.68.10
+        uses: taiki-e/install-action@305bebabd4457bed9b82541755f034994382465b # v2.68.10
+        with:
+          tool: cargo-nextest
 
       - name: Run regular tests
         run: |

From 11a97a0faffe7a9fb191568a75356aa8e1fc58b4 Mon Sep 17 00:00:00 2001
From: Dmitry Demin <dmitry@qed-it.com>
Date: Mon, 15 Jun 2026 14:28:33 +0000
Subject: [PATCH 24/28] Retry only confirmed flaky tests via nextest config

---
 .config/nextest.toml             | 10 ++++++++++
 .github/workflows/ci-basic.yml   | 17 ++---------------
 .github/workflows/tests-unit.yml |  3 +--
 3 files changed, 13 insertions(+), 17 deletions(-)

diff --git a/.config/nextest.toml b/.config/nextest.toml
index f8b1b63abcf..3ba86e1bca6 100644
--- a/.config/nextest.toml
+++ b/.config/nextest.toml
@@ -130,3 +130,13 @@ default-filter = 'package(zebrad) and test(=lightwalletd_test_suite)'
 [profile.rpc-z-getsubtreesbyindex-snapshot]
 slow-timeout = { period = "30m", terminate-after = 2 }
 default-filter = 'package(zebrad) and test(=fully_synced_rpc_z_getsubtreesbyindex_snapshot_test)'
+
+# --- QEDIT temporary retries ---
+
+# TODO: Remove retries after investigating periodic random failures.
+# Add more tests here only after confirming similar intermittent failures.
+[[profile.default.overrides]]
+filter = '''
+test(=sync_large_checkpoints_mempool_mainnet)
+'''
+retries = 3
diff --git a/.github/workflows/ci-basic.yml b/.github/workflows/ci-basic.yml
index 52b185e45c0..42cdd2f8a86 100644
--- a/.github/workflows/ci-basic.yml
+++ b/.github/workflows/ci-basic.yml
@@ -59,23 +59,10 @@ jobs:
         with:
           tool: cargo-nextest
 
-      - name: Run regular tests
+      - name: Run tests
         run: |
           timeout --preserve-status 1h \
-            cargo nextest run --workspace --locked \
-              -E 'not package(zebra-network) and not binary(acceptance)'
-
-      - name: Run zebra-network tests
-        run: |
-          timeout --preserve-status 30m \
-            cargo nextest run -p zebra-network --locked \
-              --retries 3
-
-      - name: Run zebrad acceptance tests
-        run: |
-          timeout --preserve-status 1h \
-            cargo nextest run -p zebrad --test acceptance --locked \
-              --retries 3
+            cargo nextest run --workspace --locked
 
       - name: Run doc tests
         run: |
diff --git a/.github/workflows/tests-unit.yml b/.github/workflows/tests-unit.yml
index b8582f3797a..d208faee918 100644
--- a/.github/workflows/tests-unit.yml
+++ b/.github/workflows/tests-unit.yml
@@ -97,8 +97,7 @@ jobs:
           echo "PROPTEST_MAX_SHRINK_ITERS=1024" >> $GITHUB_ENV
 
       - name: Run unit tests
-        # TODO: Remove retries after investigating periodic random failures of sync_large_checkpoints_mempool_mainnet, found on QEDIT CI.
-        run: cargo nextest run --profile all-tests --locked --release --features "${{ matrix.features }}" --run-ignored=all --retries 3
+        run: cargo nextest run --profile all-tests --locked --release --features "${{ matrix.features }}" --run-ignored=all
         env:
           TEST_LARGE_CHECKPOINTS: 1
 

From ec27fc2d2df5b02fe0e3253979935331f82783fc Mon Sep 17 00:00:00 2001
From: Dmitry Demin <dmitry@qed-it.com>
Date: Mon, 15 Jun 2026 16:37:23 +0000
Subject: [PATCH 25/28] Refresh PR checks


From ee1a60bc3a506f744a0a802222c6127dcc79ca62 Mon Sep 17 00:00:00 2001
From: Dmitry Demin <dmitry@qed-it.com>
Date: Thu, 18 Jun 2026 12:52:06 +0000
Subject: [PATCH 26/28] fix(ci): enable ZSA PR checks on integration branches

---
 .github/workflows/lint.yml        | 8 +++-----
 .github/workflows/test-crates.yml | 2 ++
 .github/workflows/test-docker.yml | 2 ++
 .github/workflows/tests-unit.yml  | 2 ++
 4 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index f05125c536d..94174d2b21e 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -4,7 +4,9 @@ on:
   pull_request:
     branches:
       - main
+      # TODO: Temporary ZSA integration branches. Remove before merging to main.
       - zsa-support
+      - v4.2.0-dev
     paths:
       - "**/*.rs"
       - "**/Cargo.toml"
@@ -14,11 +16,7 @@ on:
       - .github/workflows/lint.yml
 
   push:
-    # Temporarily allow CI on the QEDIT integration branch.
-    # TODO: Remove v4.2.0-dev before merging upstream.
-    branches:
-      - main
-      - v4.2.0-dev
+    branches: [main]
     paths:
       - "**/*.rs"
       - "**/Cargo.toml"
diff --git a/.github/workflows/test-crates.yml b/.github/workflows/test-crates.yml
index 4d481f50710..e12a3be337d 100644
--- a/.github/workflows/test-crates.yml
+++ b/.github/workflows/test-crates.yml
@@ -4,7 +4,9 @@ on:
   pull_request:
     branches:
       - main
+      # TODO: Temporary ZSA integration branches. Remove before merging to main.
       - zsa-support
+      - v4.2.0-dev
     paths:
       - "**/*.rs"
       - "**/Cargo.toml"
diff --git a/.github/workflows/test-docker.yml b/.github/workflows/test-docker.yml
index 1292e20b4f1..717e56eff8a 100644
--- a/.github/workflows/test-docker.yml
+++ b/.github/workflows/test-docker.yml
@@ -4,7 +4,9 @@ on:
   pull_request:
     branches:
       - main
+      # TODO: Temporary ZSA integration branches. Remove before merging to main.
       - zsa-support
+      - v4.2.0-dev
     paths:
       - "**/*.rs"
       - "**/Cargo.toml"
diff --git a/.github/workflows/tests-unit.yml b/.github/workflows/tests-unit.yml
index d208faee918..6068670d25b 100644
--- a/.github/workflows/tests-unit.yml
+++ b/.github/workflows/tests-unit.yml
@@ -4,7 +4,9 @@ on:
   pull_request:
     branches:
       - main
+      # TODO: Temporary ZSA integration branches. Remove before merging to main.
       - zsa-support
+      - v4.2.0-dev
     paths:
       - "**/*.rs"
       - "**/Cargo.toml"

From 61eabdaad2e666f030d6f26737e0559fd4d015df Mon Sep 17 00:00:00 2001
From: Dmitry Demin <dmitry@qed-it.com>
Date: Thu, 18 Jun 2026 14:15:31 +0000
Subject: [PATCH 27/28] fix(ci): remove internal ECS workflows from ZSA PR

---
 .github/workflows/deploy-ecs.yaml |  82 ------------------
 .github/workflows/push-ecr.yaml   | 137 ------------------------------
 .github/workflows/stop-ecs.yaml   |  73 ----------------
 3 files changed, 292 deletions(-)
 delete mode 100644 .github/workflows/deploy-ecs.yaml
 delete mode 100644 .github/workflows/push-ecr.yaml
 delete mode 100644 .github/workflows/stop-ecs.yaml

diff --git a/.github/workflows/deploy-ecs.yaml b/.github/workflows/deploy-ecs.yaml
deleted file mode 100644
index 32a5bd297cd..00000000000
--- a/.github/workflows/deploy-ecs.yaml
+++ /dev/null
@@ -1,82 +0,0 @@
-# This GitHub Actions workflow automates deploying the Zebra Server to Amazon ECS.
-# It allows manual triggering with the ability to choose which image tag to deploy.
-# The ECS deploy action registers a new task definition and waits for service stability.
-name: Deploy to Amazon ECS
-on:
-  workflow_dispatch:
-    inputs:
-      image_tag:
-        description: 'Docker image tag to deploy (e.g., latest, v1.0.0, commit-hash)'
-        required: true
-        type: string
-        default: 'latest'
-jobs:
-  deploy-to-ecs:
-    name: Deploy to ECS
-    runs-on: ubuntu-latest
-    environment: dev
-    env:
-      AWS_REGION: ${{ vars.AWS_REGION }}
-      ECR_REPOSITORY: ${{ vars.ECR_REPOSITORY }}
-      ECS_SERVICE: ${{ vars.ECS_SERVICE }}
-      ECS_CLUSTER: ${{ vars.ECS_CLUSTER }}
-      TASK_DEFINITION: ${{ vars.TASK_DEFINITION }}
-      CONTAINER_NAME: ${{ vars.CONTAINER_NAME }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: ${{ env.AWS_REGION }}
-      - name: Login to Amazon ECR
-        id: login-ecr
-        uses: aws-actions/amazon-ecr-login@v2
-      - name: Download task definition
-        env:
-          IMAGE_TAG: ${{ github.event.inputs.image_tag }}
-        run: |
-          echo "Deploying image: ${{ steps.login-ecr.outputs.registry }}/$ECR_REPOSITORY:$IMAGE_TAG"
-          echo "ECS Service: $ECS_SERVICE"
-          echo "ECS Cluster: $ECS_CLUSTER"
-          echo "Task Definition: $TASK_DEFINITION"
-          echo "Container Name: $CONTAINER_NAME"
-          
-          aws ecs describe-task-definition \
-            --task-definition "$TASK_DEFINITION" \
-            --query 'taskDefinition' > task-definition.json
-
-      - name: Render Amazon ECS task definition
-        id: render-task-definition
-        uses: aws-actions/amazon-ecs-render-task-definition@v1
-        with:
-          task-definition: task-definition.json
-          container-name: ${{ env.CONTAINER_NAME }}
-          image: ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:${{ github.event.inputs.image_tag }}
-
-      - name: Deploy Amazon ECS task definition
-        id: deploy-ecs
-        uses: aws-actions/amazon-ecs-deploy-task-definition@v2
-        with:
-          task-definition: ${{ steps.render-task-definition.outputs.task-definition }}
-          service: ${{ env.ECS_SERVICE }}
-          cluster: ${{ env.ECS_CLUSTER }}
-          wait-for-service-stability: true
-      - name: Get deployment status
-        run: |
-          echo "Deployment Status:"
-          aws ecs describe-services \
-            --cluster $ECS_CLUSTER \
-            --services $ECS_SERVICE \
-            --query 'services[0].{ServiceName:serviceName,Status:status,DesiredCount:desiredCount,RunningCount:runningCount,PendingCount:pendingCount,TaskDefinition:taskDefinition}' \
-            --output table
-          
-          echo ""
-          echo "Current running tasks:"
-          aws ecs list-tasks \
-            --cluster $ECS_CLUSTER \
-            --service-name $ECS_SERVICE \
-            --query 'taskArns' \
-            --output table
diff --git a/.github/workflows/push-ecr.yaml b/.github/workflows/push-ecr.yaml
deleted file mode 100644
index f4466ebd937..00000000000
--- a/.github/workflows/push-ecr.yaml
+++ /dev/null
@@ -1,137 +0,0 @@
-# This GitHub Actions workflow automates pushing the Zebra Server Docker image to Amazon ECR.
-# It triggers on any tag push or manual dispatch, builds a Docker image, and pushes it to Amazon Elastic Container Registry (ECR).
-name: Push to Amazon ECR
-on:
-  push:
-    tags:
-      - '*'
-  workflow_dispatch:
-    inputs:
-      image_tag_version:
-        description: 'Version to tag the Docker image (e.g., v1.0.0-ZSA)'
-        required: true
-        type: string
-      source_ref:
-        description: 'Branch or tag to build from (leave empty to use the current ref)'
-        required: false
-        type: string
-jobs:
-  push-to-ecr:
-    name: Push to ECR
-    runs-on: ubuntu-latest
-    environment: dev
-    env:
-      AWS_REGION: ${{ vars.AWS_REGION }}
-      ECR_REPOSITORY: ${{ vars.ECR_REPOSITORY }}
-      DOCKERFILE_PATH: testnet-single-node-deploy/dockerfile
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          ref: ${{ github.event.inputs.source_ref }}
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: ${{ env.AWS_REGION }}
-      - name: Login to Amazon ECR
-        id: login-ecr
-        uses: aws-actions/amazon-ecr-login@v2
-      - name: Get Git tags and set image tags
-        id: vars
-        run: |
-          git fetch --tags
-          
-          # Get exact match tag if it exists (will be empty if the current commit doesn't have a tag)
-          GIT_TAG=$(git describe --exact-match --tags 2>/dev/null || echo "")
-          IMAGE_TAG_VERSION="${{ github.event.inputs.image_tag_version }}"
-          
-          # Set environment variables and echo results
-          if [ -n "$GIT_TAG" ]; then
-            echo "GIT_TAG=$GIT_TAG" >> "$GITHUB_ENV"
-            echo "Git Tag Discovery:"
-            echo "  Found exact match Git tag: $GIT_TAG"
-          else
-            echo "Git Tag Discovery:"
-            echo "  No exact match Git tag found for current commit"
-          fi
-          
-          # Set the input IMAGE_TAG_VERSION
-          echo "IMAGE_TAG_VERSION=$IMAGE_TAG_VERSION" >> "$GITHUB_ENV"
-          echo "  User-provided IMAGE_TAG_VERSION: $IMAGE_TAG_VERSION"
-      - name: Build, tag, and push image to Amazon ECR
-        id: build-image
-        env:
-          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
-          IMAGE_TAG_LATEST: latest
-        run: |
-          # Get Git information for build args
-          GIT_COMMIT=$(git rev-parse HEAD)
-          GIT_TAG_BUILD=$(git describe --exact-match --tags 2>/dev/null || echo "none")
-          
-          echo "Git information for build:"
-          echo "  Commit: $GIT_COMMIT"
-          echo "  Tag: $GIT_TAG_BUILD"
-          
-          # Build docker container with multiple tags
-          DOCKER_BUILD_ARGS=()
-          DOCKER_BUILD_ARGS+=("-t" "$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG_LATEST")
-          
-          # Only add IMAGE_TAG_VERSION if it's not empty
-          if [ -n "$IMAGE_TAG_VERSION" ]; then
-            DOCKER_BUILD_ARGS+=("-t" "$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG_VERSION")
-          fi
-          
-          # Add exact tag if it exists
-          if [ -n "$GIT_TAG" ]; then
-            DOCKER_BUILD_ARGS+=("-t" "$ECR_REGISTRY/$ECR_REPOSITORY:$GIT_TAG")
-          fi
-          
-          # Echo final tags that will be pushed
-          echo "Docker Image Tags to be pushed:"
-          for arg in "${DOCKER_BUILD_ARGS[@]}"; do
-            if [[ "$arg" != "-t" ]]; then
-              echo "  $arg"
-            fi
-          done
-          echo ""
-          
-          # Build with all tags and Git build args
-          echo "Building Docker image..."
-          docker build "${DOCKER_BUILD_ARGS[@]}" \
-            --build-arg GIT_COMMIT="$GIT_COMMIT" \
-            --build-arg GIT_TAG="$GIT_TAG_BUILD" \
-            -f $DOCKERFILE_PATH .
-          
-          # Push all tags with error handling
-          for tag in "$IMAGE_TAG_LATEST" "$IMAGE_TAG_VERSION" "$GIT_TAG"; do
-            # Skip empty tags (e.g., if IMAGE_TAG_VERSION or GIT_TAG is unset)
-            [ -z "$tag" ] && continue
-            image="$ECR_REGISTRY/$ECR_REPOSITORY:$tag"
-            echo "Pushing $image…"
-            if ! docker push "$image"; then
-              echo "Failed to push $image"
-              exit 1
-            fi
-          done
-          
-          # Output the image URIs
-          echo "image_latest=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG_LATEST" >> $GITHUB_OUTPUT
-          
-          if [ -n "$IMAGE_TAG_VERSION" ]; then
-            echo "image_version=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG_VERSION" >> $GITHUB_OUTPUT
-          fi
-          
-          if [ -n "$GIT_TAG" ]; then
-            echo "image_exact_tag=$ECR_REGISTRY/$ECR_REPOSITORY:$GIT_TAG" >> $GITHUB_OUTPUT
-          fi
-          
-          echo ""
-          echo "====================================="
-          echo "Successfully pushed to ECR:"
-          echo "  Registry:   $ECR_REGISTRY"
-          echo "  Repository: $ECR_REPOSITORY"
-          echo "  Tags:       $IMAGE_TAG_LATEST ${IMAGE_TAG_VERSION:+$IMAGE_TAG_VERSION }${GIT_TAG:+$GIT_TAG}"
-          echo "====================================="
diff --git a/.github/workflows/stop-ecs.yaml b/.github/workflows/stop-ecs.yaml
deleted file mode 100644
index 97e85f5f0aa..00000000000
--- a/.github/workflows/stop-ecs.yaml
+++ /dev/null
@@ -1,73 +0,0 @@
-name: Stop All ECS Tasks
-
-on:
-  workflow_dispatch:
-
-jobs:
-  stop-tasks:
-    name: Stop All ECS Tasks
-    runs-on: ubuntu-latest
-    environment: dev
-    env:
-      AWS_REGION: ${{ vars.AWS_REGION }}
-      ECS_SERVICE: ${{ vars.ECS_SERVICE }}
-      ECS_CLUSTER: ${{ vars.ECS_CLUSTER }}
-    steps:
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: ${{ env.AWS_REGION }}
-
-      - name: Stop all running tasks
-        id: stop-tasks
-        run: |
-          echo "Fetching running tasks for service: $ECS_SERVICE in cluster: $ECS_CLUSTER"
-          
-          TASK_ARNS=$(aws ecs list-tasks \
-            --cluster "$ECS_CLUSTER" \
-            --service-name "$ECS_SERVICE" \
-            --query 'taskArns[]' \
-            --output text)
-          echo "task_arns=$TASK_ARNS" >> "$GITHUB_OUTPUT"
-          
-          if [ -z "$TASK_ARNS" ]; then
-            echo "No running tasks found."
-            exit 0
-          fi
-          
-          echo "Found tasks: $TASK_ARNS"
-          
-          for TASK_ARN in $TASK_ARNS; do
-            echo "Stopping task: $TASK_ARN"
-            aws ecs stop-task \
-              --cluster "$ECS_CLUSTER" \
-              --task "$TASK_ARN" \
-              --reason "Manually stopped via GitHub Actions"
-          done
-          
-          echo "Stop requests submitted for all running tasks."
-
-      - name: Wait for tasks to stop
-        run: |
-          TASK_ARNS="${{ steps.stop-tasks.outputs.task_arns }}"
-          
-          if [ -z "$TASK_ARNS" ]; then
-            echo "No tasks were stopped."
-            exit 0
-          fi
-          
-          echo "Waiting for stopped tasks..."
-          aws ecs wait tasks-stopped \
-            --cluster "$ECS_CLUSTER" \
-            --tasks $TASK_ARNS
-          
-          echo "All tasks stopped."
-          
-          echo "Stopped task status:"
-          aws ecs describe-tasks \
-            --cluster "$ECS_CLUSTER" \
-            --tasks $TASK_ARNS \
-            --query 'tasks[].{Task:taskArn,LastStatus:lastStatus,StoppedReason:stoppedReason}' \
-            --output table

From 6493603d0b14a2d0fc226fb7184113a4149562af Mon Sep 17 00:00:00 2001
From: Dmitry Demin <dmitry@qed-it.com>
Date: Thu, 25 Jun 2026 08:50:19 +0000
Subject: [PATCH 28/28] Run basic CI only in QED-it/zebra

---
 .github/workflows/ci-basic.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci-basic.yml b/.github/workflows/ci-basic.yml
index 42cdd2f8a86..9608a7e1fd0 100644
--- a/.github/workflows/ci-basic.yml
+++ b/.github/workflows/ci-basic.yml
@@ -7,6 +7,7 @@ permissions:
 
 jobs:
   test:
+    if: ${{ github.repository == 'QED-it/zebra' }}
     runs-on: ubuntu-latest
 
     strategy: