From bcbbbca54433335002ce88940fe31dd48c41dd0d Mon Sep 17 00:00:00 2001
From: nullPointerEnjoyer <dev1@mintlayer.org>
Date: Thu, 24 Sep 2026 15:03:02 +0200
Subject: [PATCH 1/9] Prepare release-v1.4.1

- Bump workspace version to 1.4.1
- Changelog: 1.4.1 section (wallet rescan fix; neutral PoS seal indexing entry)
- Extend testnet checkpoints to height 818500 (step 500, from local synced
  testnet node via chainstate_get_block_ids_as_checkpoints; ~2.5k blocks
  behind tip 821011 at generation time)
---
 CHANGELOG.md                                  |   7 +
 Cargo.lock                                    | 166 +++++++++---------
 Cargo.toml                                    |   4 +-
 .../chain/config/checkpoints_data/testnet.rs  | 109 ++++++++++++
 4 files changed, 201 insertions(+), 85 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ef62f43ff1..492d2a264a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,13 @@ The format is loosely based on [Keep a Changelog](https://keepachangelog.com/en/
 
 ## [Unreleased]
 
+## [1.4.1] - 2026-09-25
+
+### Added
+  - Node:
+    - Added PoS seal indexing infrastructure: duplicate-proof evidence storage for
+      block seals, active by default, with a chainstate configuration option to disable it.
+
 ### Fixed
   - Wallet:
     - Fixed an issue where `standalone-add-watch-only-address`, `standalone-add-private-key-from-hex` and
diff --git a/Cargo.lock b/Cargo.lock
index dbef7d51b2..280f6a0dc0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -20,7 +20,7 @@ checksum = "366ffbaa4442f4684d91e2cd7c5ea7c4ed8add41959a31447066e279e432b618"
 
 [[package]]
 name = "accounting"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "common",
  "parity-scale-codec",
@@ -227,7 +227,7 @@ checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
 
 [[package]]
 name = "api-blockchain-scanner-daemon"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "api-blockchain-scanner-lib",
  "api-server-common",
@@ -247,7 +247,7 @@ dependencies = [
 
 [[package]]
 name = "api-blockchain-scanner-lib"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "api-server-common",
  "async-trait",
@@ -277,7 +277,7 @@ dependencies = [
 
 [[package]]
 name = "api-server-backend-test-suite"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "api-server-common",
  "async-trait",
@@ -300,7 +300,7 @@ dependencies = [
 
 [[package]]
 name = "api-server-common"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "async-trait",
  "bb8-postgres",
@@ -328,7 +328,7 @@ dependencies = [
 
 [[package]]
 name = "api-server-stack-test-suite"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "api-blockchain-scanner-lib",
  "api-server-backend-test-suite",
@@ -360,7 +360,7 @@ dependencies = [
 
 [[package]]
 name = "api-web-server"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "api-server-common",
  "async-trait",
@@ -1003,7 +1003,7 @@ dependencies = [
 
 [[package]]
 name = "blockprod"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "async-trait",
  "chainstate",
@@ -1145,7 +1145,7 @@ dependencies = [
 
 [[package]]
 name = "build_utils"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "substrate-build-script-utils",
 ]
@@ -1364,7 +1364,7 @@ dependencies = [
 
 [[package]]
 name = "chainstate"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "accounting",
  "async-trait",
@@ -1410,7 +1410,7 @@ dependencies = [
 
 [[package]]
 name = "chainstate-db-dumper"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "anyhow",
  "chainstate",
@@ -1435,7 +1435,7 @@ dependencies = [
 
 [[package]]
 name = "chainstate-launcher"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "chainstate",
  "chainstate-storage",
@@ -1451,7 +1451,7 @@ dependencies = [
 
 [[package]]
 name = "chainstate-storage"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "accounting",
  "chainstate-types",
@@ -1478,7 +1478,7 @@ dependencies = [
 
 [[package]]
 name = "chainstate-test-framework"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "chainstate",
  "chainstate-storage",
@@ -1508,7 +1508,7 @@ dependencies = [
 
 [[package]]
 name = "chainstate-test-suite"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "accounting",
  "chainstate",
@@ -1541,7 +1541,7 @@ dependencies = [
 
 [[package]]
 name = "chainstate-types"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "common",
  "crypto",
@@ -1755,7 +1755,7 @@ dependencies = [
 
 [[package]]
 name = "common"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "anyhow",
  "bech32 0.11.1",
@@ -1815,7 +1815,7 @@ dependencies = [
 
 [[package]]
 name = "consensus"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "chainstate-types",
  "common",
@@ -1902,7 +1902,7 @@ dependencies = [
 
 [[package]]
 name = "constraints-value-accumulator"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "accounting",
  "common",
@@ -2168,7 +2168,7 @@ checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
 
 [[package]]
 name = "crypto"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "argon2",
  "bip39",
@@ -2681,7 +2681,7 @@ checksum = "0688c2a7f92e427f44895cd63841bff7b29f8d7a1648b9e7e07a4a365b2e1257"
 
 [[package]]
 name = "dns-server"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -4975,7 +4975,7 @@ checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
 
 [[package]]
 name = "log_error"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "derive_more 1.0.0",
  "logging",
@@ -4988,7 +4988,7 @@ dependencies = [
 
 [[package]]
 name = "logging"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "console-subscriber",
  "log",
@@ -5139,7 +5139,7 @@ dependencies = [
 
 [[package]]
 name = "mempool"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "accounting",
  "anyhow",
@@ -5187,7 +5187,7 @@ dependencies = [
 
 [[package]]
 name = "mempool-types"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "p2p-types",
  "rpc-description",
@@ -5256,7 +5256,7 @@ dependencies = [
 
 [[package]]
 name = "mintlayer-core"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "chainstate",
  "chainstate-storage",
@@ -5307,7 +5307,7 @@ dependencies = [
 
 [[package]]
 name = "mintlayer-test"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "clap",
  "ctor",
@@ -5324,7 +5324,7 @@ dependencies = [
 
 [[package]]
 name = "mintscript"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "common",
  "crypto",
@@ -5386,7 +5386,7 @@ dependencies = [
 
 [[package]]
 name = "mocks"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "async-trait",
  "chainstate",
@@ -5483,7 +5483,7 @@ dependencies = [
 
 [[package]]
 name = "networking"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "async-trait",
  "bytes",
@@ -5521,7 +5521,7 @@ dependencies = [
 
 [[package]]
 name = "node-comm"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -5554,7 +5554,7 @@ dependencies = [
 
 [[package]]
 name = "node-daemon"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "anyhow",
  "assert_cmd",
@@ -5569,7 +5569,7 @@ dependencies = [
 
 [[package]]
 name = "node-gui"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "anyhow",
  "chainstate",
@@ -5604,7 +5604,7 @@ dependencies = [
 
 [[package]]
 name = "node-gui-backend"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "anyhow",
  "chainstate",
@@ -5639,7 +5639,7 @@ dependencies = [
 
 [[package]]
 name = "node-lib"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "anyhow",
  "blockprod",
@@ -6260,7 +6260,7 @@ dependencies = [
 
 [[package]]
 name = "orders-accounting"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "accounting",
  "common",
@@ -6311,7 +6311,7 @@ dependencies = [
 
 [[package]]
 name = "p2p"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "async-trait",
  "bytes",
@@ -6368,7 +6368,7 @@ dependencies = [
 
 [[package]]
 name = "p2p-backend-test-suite"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "chainstate",
  "common",
@@ -6388,7 +6388,7 @@ dependencies = [
 
 [[package]]
 name = "p2p-test-utils"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "chainstate",
  "chainstate-storage",
@@ -6408,7 +6408,7 @@ dependencies = [
 
 [[package]]
 name = "p2p-types"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "common",
  "networking",
@@ -6747,7 +6747,7 @@ checksum = "05c8b63e8d9609db387f0324918f81d68fe27748f084ef092fb35954d0539a85"
 
 [[package]]
 name = "pos-accounting"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "accounting",
  "common",
@@ -7166,7 +7166,7 @@ dependencies = [
 
 [[package]]
 name = "randomness"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "rand 0.10.1",
  "rand 0.8.6",
@@ -7499,7 +7499,7 @@ checksum = "6c20b6793b5c2fa6553b250154b78d6d0db37e72700ae35fad9387a46f487c97"
 
 [[package]]
 name = "rpc"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -7529,7 +7529,7 @@ dependencies = [
 
 [[package]]
 name = "rpc-description"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "rpc-description-macro",
  "serde_json",
@@ -7537,7 +7537,7 @@ dependencies = [
 
 [[package]]
 name = "rpc-description-macro"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -7546,7 +7546,7 @@ dependencies = [
 
 [[package]]
 name = "rpc-types"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "hex",
  "rpc-description",
@@ -7891,7 +7891,7 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "script"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "crypto",
  "flate2",
@@ -8193,7 +8193,7 @@ dependencies = [
 
 [[package]]
 name = "serialization"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "hex",
  "rpc-description",
@@ -8206,7 +8206,7 @@ dependencies = [
 
 [[package]]
 name = "serialization-core"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "arraytools",
  "hex-literal",
@@ -8219,7 +8219,7 @@ dependencies = [
 
 [[package]]
 name = "serialization-tagged"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "parity-scale-codec",
  "proptest",
@@ -8231,7 +8231,7 @@ dependencies = [
 
 [[package]]
 name = "serialization-tagged-derive"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "itertools 0.14.0",
  "proc-macro2",
@@ -8602,7 +8602,7 @@ checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
 
 [[package]]
 name = "storage"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "common",
  "rstest",
@@ -8615,7 +8615,7 @@ dependencies = [
 
 [[package]]
 name = "storage-backend-test-suite"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "libtest-mimic",
  "logging",
@@ -8630,7 +8630,7 @@ dependencies = [
 
 [[package]]
 name = "storage-core"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "common",
  "itertools 0.14.0",
@@ -8643,7 +8643,7 @@ dependencies = [
 
 [[package]]
 name = "storage-failing"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "enumflags2",
  "storage",
@@ -8655,7 +8655,7 @@ dependencies = [
 
 [[package]]
 name = "storage-inmemory"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "storage-backend-test-suite",
  "storage-core",
@@ -8664,7 +8664,7 @@ dependencies = [
 
 [[package]]
 name = "storage-lmdb"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "lmdb-mintlayer",
  "logging",
@@ -8678,7 +8678,7 @@ dependencies = [
 
 [[package]]
 name = "storage-sqlite"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "hex",
  "logging",
@@ -8781,7 +8781,7 @@ checksum = "b285e7d183a32732fdc119f3d81b7915790191fad602b7c709ef247073c77a2e"
 
 [[package]]
 name = "subsystem"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "async-trait",
  "cfg-if",
@@ -8937,7 +8937,7 @@ checksum = "8f50febec83f5ee1df3015341d8bd429f2d1cc62bcba7ea2076759d315084683"
 
 [[package]]
 name = "test-rpc-functions"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "async-trait",
  "chainstate",
@@ -8959,7 +8959,7 @@ dependencies = [
 
 [[package]]
 name = "test-utils"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "common",
  "crypto",
@@ -9141,7 +9141,7 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokens-accounting"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "accounting",
  "chainstate-types",
@@ -9600,7 +9600,7 @@ checksum = "d2df906b07856748fa3f6e0ad0cbaa047052d4a7dd609e231c4f72cee8c36f31"
 
 [[package]]
 name = "tx-verifier"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "accounting",
  "chainstate-storage",
@@ -9629,14 +9629,14 @@ dependencies = [
 
 [[package]]
 name = "typename"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "typename-derive",
 ]
 
 [[package]]
 name = "typename-derive"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "itertools 0.14.0",
  "quote",
@@ -9796,7 +9796,7 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "utils"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "anyhow",
  "clap",
@@ -9831,7 +9831,7 @@ dependencies = [
 
 [[package]]
 name = "utils-networking"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "addr",
  "itertools 0.14.0",
@@ -9846,7 +9846,7 @@ dependencies = [
 
 [[package]]
 name = "utxo"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "chainstate-types",
  "common",
@@ -9920,7 +9920,7 @@ dependencies = [
 
 [[package]]
 name = "wallet"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -9973,7 +9973,7 @@ dependencies = [
 
 [[package]]
 name = "wallet-address-generator"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "clap",
  "common",
@@ -9989,7 +9989,7 @@ dependencies = [
 
 [[package]]
 name = "wallet-address-generator-lib"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "build_utils",
  "clap",
@@ -10004,7 +10004,7 @@ dependencies = [
 
 [[package]]
 name = "wallet-cli"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "clap",
  "ctor",
@@ -10015,7 +10015,7 @@ dependencies = [
 
 [[package]]
 name = "wallet-cli-commands"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "async-trait",
  "bigdecimal",
@@ -10072,7 +10072,7 @@ dependencies = [
 
 [[package]]
 name = "wallet-cli-lib"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "async-trait",
  "blockprod",
@@ -10122,7 +10122,7 @@ dependencies = [
 
 [[package]]
 name = "wallet-controller"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -10164,7 +10164,7 @@ dependencies = [
 
 [[package]]
 name = "wallet-rpc-client"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
@@ -10196,7 +10196,7 @@ dependencies = [
 
 [[package]]
 name = "wallet-rpc-daemon"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "clap",
  "common",
@@ -10213,7 +10213,7 @@ dependencies = [
 
 [[package]]
 name = "wallet-rpc-lib"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -10256,7 +10256,7 @@ dependencies = [
 
 [[package]]
 name = "wallet-storage"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "bip39",
  "common",
@@ -10275,7 +10275,7 @@ dependencies = [
 
 [[package]]
 name = "wallet-test-node"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "blockprod",
  "chainstate",
@@ -10296,7 +10296,7 @@ dependencies = [
 
 [[package]]
 name = "wallet-types"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "bip39",
  "common",
@@ -10433,7 +10433,7 @@ dependencies = [
 
 [[package]]
 name = "wasm-doc-gen"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "anyhow",
  "clap",
@@ -10479,7 +10479,7 @@ dependencies = [
 
 [[package]]
 name = "wasm-wrappers"
-version = "1.4.0"
+version = "1.4.1"
 dependencies = [
  "bip39",
  "common",
diff --git a/Cargo.toml b/Cargo.toml
index db8c5fa950..7e023cd5ef 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -5,7 +5,7 @@ homepage = "https://mintlayer.org"
 repository = "https://github.com/mintlayer/mintlayer-core"
 readme = "README.md"
 license = "MIT"
-version = "1.4.0"
+version = "1.4.1"
 edition = "2024"
 
 [workspace]
@@ -128,7 +128,7 @@ utxo = { path = "utxo" }
 [workspace.package]
 edition = "2024"
 rust-version = "1.92"
-version = "1.4.0"
+version = "1.4.1"
 license = "MIT"
 
 [workspace.dependencies]
diff --git a/common/src/chain/config/checkpoints_data/testnet.rs b/common/src/chain/config/checkpoints_data/testnet.rs
index 0d678d2111..9c70326227 100644
--- a/common/src/chain/config/checkpoints_data/testnet.rs
+++ b/common/src/chain/config/checkpoints_data/testnet.rs
@@ -1417,4 +1417,113 @@ pub const CHECKPOINTS_DATA: &[(u64, &str)] = &[
     (763000, "6D29F9126BEC5B81BF1C9510149A2CE0692FA285F05254E703880CC82DCA6268"),
     (763500, "1F47C2EBC0A5FC44F1D868EDA6C3B45FE1C6AE36BB55C22235112FDA9A475BCF"),
     (764000, "E265BC8300181C341E054145CD1ED5A8DA01F861B6670745486C20209BCFA208"),
+    (764500, "C06C89F6D9ADCC2947CC7400D2811F347BAA69290D84D1290686F907A43E5DC2"),
+    (765000, "EC4A065CC7DA808F008CBE2FC5EDD6E53AD31B24C3A670DEFFF0065DF282C9AE"),
+    (765500, "D5EB5D5ED254A8E7BBFF622CCE3541FD715F27D02610D2BE8FE1E47A7220D75C"),
+    (766000, "155D71F838F875543AA13EBC1A813D3A2EC8F8970B133919C66762BD5E19F7BF"),
+    (766500, "0C82EF218D03360322153ADCE8F61EA258709B87BCA9AE5C21EFFA9DFA35CA79"),
+    (767000, "94DAEDED078F315E42A2B09BD88E0DFB4103986F5C76C8AEEA33D2193C5D2561"),
+    (767500, "5E25D6958DB31CB111A27E67D73D347C4E588C892D8D668FD73D6AEEB61F93C5"),
+    (768000, "1E491BAFAD374136FD7045789C21F64B8C82021E357ABBC390D5864471EEBBB2"),
+    (768500, "F6EE81712637FBA033C8C5E1319E60E2AFA00C3085558BC85614A210414A90FF"),
+    (769000, "EE2C5F7ECBC9245D06A2FDBF609B527384933D72A714F015691005B5DCEFB56F"),
+    (769500, "66C368D20B5C6AD3DC650D1546845C9F982C01CCB8956C2C316DBBCDCFEAAA89"),
+    (770000, "129F6109FCCF34C7589B119B380BE0082FE16B4A03879F00DD0CA6F8FB56E528"),
+    (770500, "AA3A5B01F579EE5B412B8228B28CF0D0E52C6F77BD36DE61FAAC833306077468"),
+    (771000, "6117435C1F4D172447AD471C140EE13068268219EA563B258E39A47BF686044B"),
+    (771500, "5C27E436724B1226F7B99FB2906549C718293CF758C2BBE11848255F5579BE23"),
+    (772000, "86308FB0F927889DB0F0A53E7041A1FDC03EB70B13A6E9820E870BE9F556590A"),
+    (772500, "61F1091E68B160438885DE537F26B3EDD2D6DA843173AFF28AA04761EA535332"),
+    (773000, "A8B6CDBE8094382CA3919B1589AA1A1B32763F0C6038B7157F8C08E0ABFAC692"),
+    (773500, "D91C7621301B44F62709EF43C10A22FF2D85B29396174E926589212CA6085534"),
+    (774000, "4D72329E9E79934EEA114F7E353DE202B1398411609E619B5CD82C7C3C621A47"),
+    (774500, "F1E6F184BCDD193BA91A02E87AB65ABE01451A83935BEE80E8C5561F5EC28280"),
+    (775000, "E97CCC6AEF3B959E4540A455D44AD4DA336260E60E3E1EDA87B3E6E543535CFA"),
+    (775500, "B2BE44DFB66444F666297A9E3F1BB76CA7C333B76567C3AFBF161BA22636516C"),
+    (776000, "487DF31EBC555AD305255B667CF4CD2610BCB934AD4B5E43B0EB23AA915B0E42"),
+    (776500, "4C98453952482C36943F6D6E253D79EA4A0C07FD58AF988D1C76D5212CE34ECC"),
+    (777000, "4454F8176C91B45A67E31FF2D49047B8D1A5098A90E64C3CA2431BD1499134B4"),
+    (777500, "68D370F2A0CBDF4E4B067855211DFEC128B495B324E9253DAEE651EDBF07BB91"),
+    (778000, "4DA53A2048B4F13890C669DAF962580165BF7C1E38147E183A4CFDC3765E25F7"),
+    (778500, "54718E5DF4A8930724B3FBFBFE62B85C423429DCD09C151489673602200E364C"),
+    (779000, "222A50E645284908EDE4AFBAE649D4B6623FF8BF67FBA7A20A4944C7A3013F13"),
+    (779500, "C54F476623A56E315FE7E092A66F924A3F09AACCDCC0B242DFE200684FE52899"),
+    (780000, "583C58FABB0B38238FC0E23B3982DFBBA130A2020F75F8E3D97880BA41D53C79"),
+    (780500, "44358E4A5B33D6EA5C1D0E9D2A40B52751F952234A9F9038D936E2FA24E85534"),
+    (781000, "3B9C31D5D8E31B45CAA06AB26F300F4DBAA2D22B5BF21E62BEF76BEF432F4817"),
+    (781500, "FA6BC4BC08997E39AA19D7A467E95D4DD8B9465E799488671782B682941E7894"),
+    (782000, "5B77C93D914F16DB92CABD90417CA0947C021E4FA3F13CF69C6EABD2E2DAF8C2"),
+    (782500, "9FDEED38239C7ADD62C17765F103B3D22A4A42E78385A47C13EB7A1669206E5A"),
+    (783000, "29FFDE698D9F05F5E23D2E94C0F9886A48D64A4675907F0966D525DADB945926"),
+    (783500, "1637910ADE9B4FE22E1C94CD3E7F5E50B131A610E00012BDE3303887C191903A"),
+    (784000, "A68D25D59CA6351656E4607D73DEB663CDD001E57B57164628858A5BCB8466F9"),
+    (784500, "34E32D752207332A7F86DA80D92D6FBADB44F022D98CF8C2AE5B8E6CCB11E774"),
+    (785000, "35ED5413DAEDC850564BEC623923507A34EED230DFC329D192CF6DCA325E1AF0"),
+    (785500, "D3E95FC61DBD63E592FCC054D96F5C636AFD76F0B1C3E4E96B402941C7164A61"),
+    (786000, "107687776D97AEB451E29189F73467F21986D62350EAB979E57DA8AAC3ED4AEF"),
+    (786500, "A8195ED02179973439F429EEB980C1A2C3D1CA103AD1D467145FD43E6F2E1E18"),
+    (787000, "ACE92D00D0BD9E8C849F223C6E67D0AF196B9C43CB3071CCBCB554FFBEB89A36"),
+    (787500, "799028848FCA67DB6AD712A4D449583458C61D60155AE9B7FDC53B5920FD6D4F"),
+    (788000, "6730042047F70C57A9B9B7A8DB78BCAC92DB0342D0870C62FD5F547DD6D67B8B"),
+    (788500, "1AEAE643E0C9A0E52DE2C60C806142910B08237FB0B0693763DB81BA6DC2DA29"),
+    (789000, "EF27B4FA164EEC1A94BDD949B0734686B8B41E899EBADD34672072389B4F2E71"),
+    (789500, "97571A70B06C6F7C53D2DCCC4A7B418461E8F1AD92CDA2C1BD3328FF8EA93CEA"),
+    (790000, "6A2D1FAB7C7EB6F69C894CC357215B2F66AE75C2DEB0360D6D2F85C0BEA4C4EC"),
+    (790500, "1563C67973A0BA7A2CEC0E853F241B5051EB1FF52D562D18C981B0CC0FC3C678"),
+    (791000, "5724362BE438D2F7C97B2961F46CF6E60C82CBCF5B3E92A457BB3733D98C9458"),
+    (791500, "99A74BE8F881E1564283DC4B92D60CDCC7AEDE47D81500076E764F82639239A7"),
+    (792000, "B04ECBA8DF439163074E73D5C6311EC89A5FBDECFDCAC46544EAED9EB1C84850"),
+    (792500, "2713F9613C487BCCBB0D41C396F8C4FD1D423743D607D77E241C05ED2BFBEA90"),
+    (793000, "E95CE47BCEE3DB408FB9CEECE55C84C0A8FF436EAA116858AD8BCCD85B5B14AE"),
+    (793500, "4019B3E6B1C9148FE8234A6476DE78105E259E98DB0AE8DBE108BD3774967B65"),
+    (794000, "568701C54571D2353506DBEF32DAA91CB0E89F05F7BDB376462EE21ABCEB5428"),
+    (794500, "3C2FBFF8F945BE838B7C2C4C2199E1A166BD180EB8A67633C71DE71ED05040BE"),
+    (795000, "917FCEC2733F96D80BD8F31729084FF46F030918B10340A647360EC2369A973C"),
+    (795500, "2ABF40F679A0DFEED123F8C31076D118C0671111828453FAFC15D3BD2F8A3FB3"),
+    (796000, "1AD7B09B626613DB6CEC12D20665A56C8014B06E9DA149E98D5F89B22FE8B835"),
+    (796500, "000052390AD62861B9242925EF351FB0D39A5143D2A689BA2AD040A12F396DED"),
+    (797000, "AB6FC2467A3ADFA7085B44ED4C3E88A68AC866C682F5AA06856274F41F8A1432"),
+    (797500, "87665347D7DC8D0A5AEDCECE5C442D800D99C459CAED96AE7042CECE84249D09"),
+    (798000, "2EC99179F21C4E7F36482A544503926AFE4BE0AA25B233AE7ACC32334F5A2592"),
+    (798500, "380C91247E54268D0992BBDB4E39F324B5A3795EA5B1E37E219A3154B794B1C8"),
+    (799000, "D51B16CFD40F5F5867CA8FDB4B83CAFF1B5FC76803FD5CECF74F73246D0DF442"),
+    (799500, "BA267B83E1D679428D74A5DE2B0C1DA7A01E9A76D3485D9107392A12AB12F437"),
+    (800000, "0778E119E6C06AEDA1B1D65CA3970160D729A943B461E556D3F7ED63A42E23EE"),
+    (800500, "367342B65B613122B90F186337DD52FE4128A8AE1C761C5DED4C86E736E5F874"),
+    (801000, "2E232B650D512A52F12E8A5D2656F0B7DB1FB52DEFDDDE2007667C58336676C6"),
+    (801500, "2806103311335615C358FFC72047AC26F187C2A2DEDA1CC5BDB864E138FC6973"),
+    (802000, "BB42010EFA33D68578D6B7D75ACA4F00A5AFDF514450F0E1391A462BE0FAEF79"),
+    (802500, "8957AB2727C5ECC8492C19E28723530E4DF30A9D3B932205D5B5219F113C8812"),
+    (803000, "0C73D66225CA235DB9A99C86A3FA800D4848DEB30BA6ED85F4DFB233D29C5FAF"),
+    (803500, "5A589ED0523BC6A690BC04C5834ED5F69939539BE6AA55712F9F964B84684C44"),
+    (804000, "3F39800AC338EB2226026026A40F578C0B67248181DDA364DD758BB04404E43E"),
+    (804500, "3EAAFEC994442F29C74A36D2C280CE1ED7AE455E8B1D7B1429BF5C664420F4AE"),
+    (805000, "6D3CB20BB30D3B85DBABFF44DB7A0B3A0AD3E170C18F1AA8A5C4CC3BFC7A236A"),
+    (805500, "16B4796E969B512B5EDF9590AFE5D6AFD356D30751C15CB30F14917A58ACD1B1"),
+    (806000, "EB7B66E6980C85784A57206FD3A7B97699282C793FC00B9757F0AD7778647A98"),
+    (806500, "9E70E4700A6B5EE7FCB7339D1AB5E5A859F9BCCB25789BA28A88F26A9EB25848"),
+    (807000, "541F72222125DE81FC55AA52B60025FBC7537CA35620F5DA70D9BBEDE0184500"),
+    (807500, "16871BC3AB4385218F976C84E21B00F9752225F7BEDEE660B03A52AEE806DB61"),
+    (808000, "E4D1C69A8B7A0A54526E32CD98B9F0FBFC76C6CEA8E32262F3F0E0A6CA1E1CE5"),
+    (808500, "91F34D2FBCA84E6410B6C85BF01C46F0B63D60C8F024C6DE4B238776125FC637"),
+    (809000, "827C00F2CA4E7498C4A2ACFECEC1BFB86B22C55ADA0D6F76CF60B2BF26330B93"),
+    (809500, "C570717AF360B7BE560C878F78E9DB914A794086D7C3BE08505A14E895FD9E27"),
+    (810000, "08FF628410B79339CBCA4E9D9ADC1B2D0A9A35A74C87EEF9AC17FD6BFB93B7A3"),
+    (810500, "00C0AC589A26C7D3A972146BD69914AE452AE3178375D3BC6FF3461A55C7BB04"),
+    (811000, "F1486DBCC0F22E85069C5A2B1064ECDF8E2245332989BBB8D896DC9739F733CF"),
+    (811500, "E94682221F1C446D637B0F2DA953159576B063C5E92C29EEB83AEE90B4E598DB"),
+    (812000, "B341BC659B22F23D596A6DC9F0AB94E3251DD79FB8C356ABDA08C12796177C42"),
+    (812500, "F9C190227D4089D5A1687A4FA7B73A8103FAFF38877C132778B16E9C47749E7C"),
+    (813000, "232EA974132E5A9C0D189AA0E205B05F8E93314C8CD956E69506E9FEEE946DEB"),
+    (813500, "587A25A7ACFA5323BEFE56128B9188F57D8D481002BD6920F1DE48B4C2F83890"),
+    (814000, "9433E0C86EE1171DBA4190F085E55783201CF59BEA914AA92414F9EA8455A439"),
+    (814500, "76DC25872F49A350DE65621C611FBD5F3E545791EC2130F5E3C024098CD814B0"),
+    (815000, "F35F36AE6E7732D67EAF97AEDF571A83630CC586C4E4814512790853F84AB5FC"),
+    (815500, "2B96E22C996290208C497480700DB0AA03419C2AEC8915631AE4A39F10951438"),
+    (816000, "5E82393262331057150A9C25035735824817A47617CF08A766A8F12DCEFE80B3"),
+    (816500, "7B3E887ED47946824B41BA976F674671198E4E6F5FCF01175E6C2B37F89FF2DF"),
+    (817000, "2318F13FFE92375D0ACFF490D2581B3B5980639DE399572B806B6C2C2E01D23F"),
+    (817500, "41A8BCFFE3FB0CE535CAF82535D4C35CA3BB1736D2332195BF8DE9F6C6FC2BDF"),
+    (818000, "1E28C864FC80211C7394E674C2A9EE2FA76E0C0ED8C28EB77581023E0DEC94FB"),
+    (818500, "9E045BBC3ABC38039A41EB59587633632B1FD4779040F9ED94C36E5A2F9D45F7"),
 ];

From c440347daccab10b31854a8ef44ca9d8b0500a46 Mon Sep 17 00:00:00 2001
From: nullPointerEnjoyer <dev1@mintlayer.org>
Date: Thu, 24 Sep 2026 16:00:21 +0200
Subject: [PATCH 2/9] Fix packaging pipeline failures found by the
 release-v1.4.1 dry-runs

- release_linux.yml: the RPM smoke-test step never sourced
  packaging/images.env, so $FEDORA_IMAGE was empty and docker tried to
  pull the script path as an image name.
- win installers: declare TARGETDISTARCH x64. Without it the installers
  are 32-bit, so their HKLM\SOFTWARE uninstall entries land in
  WOW6432Node and the (64-bit PowerShell) smoke check cannot see them;
  files and PATH install fine, masking the issue until the registry
  assertion.
---
 .github/workflows/release_linux.yml | 1 +
 build-tools/win/nsi/gui.nsi.in      | 2 ++
 build-tools/win/nsi/node.nsi.in     | 2 ++
 3 files changed, 5 insertions(+)

diff --git a/.github/workflows/release_linux.yml b/.github/workflows/release_linux.yml
index 553f9bad72..98f8b13ed3 100644
--- a/.github/workflows/release_linux.yml
+++ b/.github/workflows/release_linux.yml
@@ -183,6 +183,7 @@ jobs:
       env:
         VERSION: ${{ steps.get_version.outputs.VERSION }}
       run: |
+        source packaging/images.env
         ARCH=${{ matrix.arch }}
         docker run --rm --platform linux/$ARCH -v "$PWD":/work -w /work $FEDORA_IMAGE \
           packaging/checks/smoke-rpm.sh dist/Mintlayer_Node_linux_${VERSION}_${ARCH}.rpm mintlayer-node node
diff --git a/build-tools/win/nsi/gui.nsi.in b/build-tools/win/nsi/gui.nsi.in
index 4a28ca0c14..479d1b0187 100644
--- a/build-tools/win/nsi/gui.nsi.in
+++ b/build-tools/win/nsi/gui.nsi.in
@@ -2,6 +2,8 @@
 ; Rendered from gui.nsi.in by build-tools/win/create-nsis-installers.ps1 -
 ; do not use this file directly. Requires NSIS 3 (Unicode).
 Unicode true
+# 64-bit build: keeps HKLM\SOFTWARE writes out of the WOW6432Node redirect.
+TARGETDISTARCH x64
 RequestExecutionLevel admin
 SetCompressor /SOLID lzma
 
diff --git a/build-tools/win/nsi/node.nsi.in b/build-tools/win/nsi/node.nsi.in
index e95b0e0ac9..fd8d6d8be5 100644
--- a/build-tools/win/nsi/node.nsi.in
+++ b/build-tools/win/nsi/node.nsi.in
@@ -2,6 +2,8 @@
 ; Rendered from node.nsi.in by build-tools/win/create-nsis-installers.ps1 -
 ; do not use this file directly. Requires NSIS 3 (Unicode).
 Unicode true
+# 64-bit build: keeps HKLM\SOFTWARE writes out of the WOW6432Node redirect.
+TARGETDISTARCH x64
 RequestExecutionLevel admin
 SetCompressor /SOLID lzma
 

From d14f6c638ec989a0b312b805d751fb380f8bdd15 Mon Sep 17 00:00:00 2001
From: nullPointerEnjoyer <dev1@mintlayer.org>
Date: Thu, 24 Sep 2026 18:56:33 +0200
Subject: [PATCH 3/9] Fix remaining release-v1.4.1 CI failures

- rpc docs: regenerate node-daemon/docs/RPC{,_DEV}.md and
  wallet-rpc-daemon/docs/RPC.md for the 1.4.1 version bump; the
  expect-file tests embed CARGO_PKG_VERSION and failed on all three
  OS legs of the build workflow.

- win installers: replace the invalid TARGETDISTARCH x64 line with the
  proper NSIS mechanism: a shared MintlayerRequireX64 macro
  (common.nsh) that aborts on 32-bit Windows and switches the registry
  view to 64-bit via SetRegView, inserted from .onInit and un.onInit
  (the uninstaller is a separate process). This keeps the uninstall
  entries in the native HKLM\SOFTWARE hive as the smoke test expects,
  which the previous commit intended but implemented as a command NSIS
  rejects ("Invalid command: TARGETDISTARCH").

- arch smoke test: pacman has no IgnoreArch directive (that is a
  makepkg flag), so installing the foreign-architecture package failed
  with "package architecture is not valid". Add the foreign arch to
  the Architecture option of /etc/pacman.conf instead, and update the
  stale IgnoreArch comments in test-local.sh and release_linux.yml.
---
 .github/workflows/release_linux.yml  |  3 ++-
 .gitignore                           |  1 +
 build-tools/win/nsi/common.nsh       | 16 ++++++++++++++++
 build-tools/win/nsi/gui.nsi.in       | 11 +++++++++--
 build-tools/win/nsi/node.nsi.in      | 11 +++++++++--
 node-daemon/docs/RPC.md              |  2 +-
 node-daemon/docs/RPC_DEV.md          |  2 +-
 packaging/checks/smoke-arch.sh       | 11 +++++++----
 packaging/test-local.sh              |  2 +-
 wallet/wallet-rpc-daemon/docs/RPC.md |  2 +-
 10 files changed, 48 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/release_linux.yml b/.github/workflows/release_linux.yml
index 98f8b13ed3..6dfc083386 100644
--- a/.github/workflows/release_linux.yml
+++ b/.github/workflows/release_linux.yml
@@ -215,7 +215,8 @@ jobs:
     # x86_64 leg: arch-matched container (native strip, ldd-based
     # dependencies, help2man man pages), so the package installs natively.
     # aarch64 leg: the same amd64-only image installs the foreign-arch
-    # package with IgnoreArch and runs the binaries through the qemu binfmt
+    # package (smoke-arch.sh adds the foreign arch to pacman's Architecture
+    # list) and runs the binaries through the qemu binfmt
     # handlers registered above — the same emulation the deb/rpm legs use
     # for their arm64 smoke tests.
     - name: Smoke test Arch packages
diff --git a/.gitignore b/.gitignore
index ff2c0a517f..dc03e16b58 100644
--- a/.gitignore
+++ b/.gitignore
@@ -51,3 +51,4 @@ target-debian/
 /installer-gui.nsi
 /Mintlayer_Node_win_*_Setup.exe
 /Mintlayer_Node_GUI_win_*_Setup.exe
+.opencode/
diff --git a/build-tools/win/nsi/common.nsh b/build-tools/win/nsi/common.nsh
index caffd5614b..000308e07c 100644
--- a/build-tools/win/nsi/common.nsh
+++ b/build-tools/win/nsi/common.nsh
@@ -3,6 +3,22 @@
 ; the template directory to makensis via /I so the bare name resolves.
 ; Pure ASCII only (the generator writes the rendered script as ASCII).
 
+; ${RunningX64} for the MintlayerRequireX64 macro below.
+!include "x64.nsh"
+
+; Refuse to run on 32-bit Windows and switch registry operations to the
+; 64-bit view, so HKLM\SOFTWARE entries (uninstall keys, PATH backup) land in
+; the native hive instead of the WOW6432Node redirect. Must be inserted from
+; both .onInit (installer) and un.onInit (uninstaller): the uninstaller is a
+; separate process and does not inherit the installer's registry view.
+!macro MintlayerRequireX64
+    ${IfNot} ${RunningX64}
+        MessageBox MB_OK|MB_ICONSTOP "${APPNAME} requires a 64-bit version of Windows."
+        Abort
+    ${EndIf}
+    SetRegView 64
+!macroend
+
 ; Silently remove a previously installed version of the product whose
 ; uninstall registry entries live under ${UNINSTKEY}. The stored
 ; UninstallString includes quotes, which must not be re-quoted, so they are
diff --git a/build-tools/win/nsi/gui.nsi.in b/build-tools/win/nsi/gui.nsi.in
index 479d1b0187..9468fb5208 100644
--- a/build-tools/win/nsi/gui.nsi.in
+++ b/build-tools/win/nsi/gui.nsi.in
@@ -2,8 +2,9 @@
 ; Rendered from gui.nsi.in by build-tools/win/create-nsis-installers.ps1 -
 ; do not use this file directly. Requires NSIS 3 (Unicode).
 Unicode true
-# 64-bit build: keeps HKLM\SOFTWARE writes out of the WOW6432Node redirect.
-TARGETDISTARCH x64
+; 64-bit only: .onInit/un.onInit abort on 32-bit Windows and switch the
+; registry view to 64-bit, keeping HKLM\SOFTWARE writes out of the WOW6432Node
+; redirect (see MintlayerRequireX64 in common.nsh).
 RequestExecutionLevel admin
 SetCompressor /SOLID lzma
 
@@ -40,9 +41,15 @@ OutFile "Mintlayer_Node_GUI_win_${VERSION}_Setup.exe"
 ; Silently remove a previously installed version so upgrades do not leave
 ; stale files behind.
 Function .onInit
+    !insertmacro MintlayerRequireX64
     !insertmacro MintlayerRemovePreviousInstall
 FunctionEnd
 
+; The uninstaller is a separate process; give it the 64-bit registry view too.
+Function un.onInit
+    !insertmacro MintlayerRequireX64
+FunctionEnd
+
 ; The install is machine-wide (admin); make the shortcuts available to all
 ; users ($DESKTOP/$SMPROGRAMS resolve to the common profile directories).
 Section "Install"
diff --git a/build-tools/win/nsi/node.nsi.in b/build-tools/win/nsi/node.nsi.in
index fd8d6d8be5..b719d899b2 100644
--- a/build-tools/win/nsi/node.nsi.in
+++ b/build-tools/win/nsi/node.nsi.in
@@ -2,8 +2,9 @@
 ; Rendered from node.nsi.in by build-tools/win/create-nsis-installers.ps1 -
 ; do not use this file directly. Requires NSIS 3 (Unicode).
 Unicode true
-# 64-bit build: keeps HKLM\SOFTWARE writes out of the WOW6432Node redirect.
-TARGETDISTARCH x64
+; 64-bit only: .onInit/un.onInit abort on 32-bit Windows and switch the
+; registry view to 64-bit, keeping HKLM\SOFTWARE writes out of the WOW6432Node
+; redirect (see MintlayerRequireX64 in common.nsh).
 RequestExecutionLevel admin
 SetCompressor /SOLID lzma
 
@@ -56,9 +57,15 @@ ${UnStrLoc}
 ; Silently remove a previously installed version so upgrades behave like
 ; fresh installs (the old uninstaller cleans PATH/service state).
 Function .onInit
+    !insertmacro MintlayerRequireX64
     !insertmacro MintlayerRemovePreviousInstall
 FunctionEnd
 
+; The uninstaller is a separate process; give it the 64-bit registry view too.
+Function un.onInit
+    !insertmacro MintlayerRequireX64
+FunctionEnd
+
 ; ---------------------------------------------------------------------------
 ; Appends $INSTDIR to the machine PATH (idempotent); writes the registry
 ; directly and notifies running applications so new shells pick the change up.
diff --git a/node-daemon/docs/RPC.md b/node-daemon/docs/RPC.md
index e59611bc9c..b261a731cd 100644
--- a/node-daemon/docs/RPC.md
+++ b/node-daemon/docs/RPC.md
@@ -1,6 +1,6 @@
 # RPC documentation for Mintlayer node
 
-Version `1.4.0`.
+Version `1.4.1`.
 
 ## Module `node`
 
diff --git a/node-daemon/docs/RPC_DEV.md b/node-daemon/docs/RPC_DEV.md
index fd8e3413bc..0a289cb699 100644
--- a/node-daemon/docs/RPC_DEV.md
+++ b/node-daemon/docs/RPC_DEV.md
@@ -1,6 +1,6 @@
 # RPC documentation for Mintlayer node developer functions
 
-Version `1.4.0`.
+Version `1.4.1`.
 
 These functions are used for testing and only enabled in regtest.
 
diff --git a/packaging/checks/smoke-arch.sh b/packaging/checks/smoke-arch.sh
index 665a8be582..faffccd34d 100755
--- a/packaging/checks/smoke-arch.sh
+++ b/packaging/checks/smoke-arch.sh
@@ -5,8 +5,9 @@
 #
 # The optional fourth argument is the architecture the package was built for
 # (defaults to the container architecture). For a foreign-architecture package
-# (the cross-target aarch64 leg reuses the amd64-only Arch image), pacman's
-# architecture check is bypassed via IgnoreArch and the binaries are executed
+# (the cross-target aarch64 leg reuses the amd64-only Arch image), the
+# foreign architecture is added to pacman's Architecture list and the
+# binaries are executed
 # through the host's qemu binfmt handlers — the same emulation the deb/rpm
 # legs use for their arm64 smoke tests.
 set -euo pipefail
@@ -20,8 +21,10 @@ KIND="$3"
 PKG_ARCH="${4:-$(uname -m)}"
 
 if [ "$PKG_ARCH" != "$(uname -m)" ]; then
-    echo "foreign-architecture package ($PKG_ARCH on $(uname -m)): enabling IgnoreArch"
-    sed -i "/^\[options\]$/a IgnoreArch = $PKG_ARCH" /etc/pacman.conf
+    echo "foreign-architecture package ($PKG_ARCH on $(uname -m)): adding to pacman's Architecture list"
+    # pacman has no per-package override; listing the foreign arch in the
+    # Architecture option is the supported way to allow installing it.
+    sed -i "s/^#\?Architecture.*/Architecture = $(uname -m) $PKG_ARCH/" /etc/pacman.conf
 fi
 
 # Sync the databases so the package dependencies resolve from the repos.
diff --git a/packaging/test-local.sh b/packaging/test-local.sh
index b81651d040..b0128c8623 100755
--- a/packaging/test-local.sh
+++ b/packaging/test-local.sh
@@ -250,7 +250,7 @@ for arch in "${ARCHES[@]}"; do
             mintlayer-node-gui gui
 
         # The aarch64 leg relies on the qemu binfmt handlers (already required
-        # for the deb/rpm arm64 smoke tests) plus smoke-arch.sh's IgnoreArch
+        # for the deb/rpm arm64 smoke tests) plus smoke-arch.sh's foreign-arch
         # handling, mirroring the arm64 leg of release_linux.yml.
         run_step "smoke pkg node ($arch)" \
             docker run --rm -v "$REPO_ROOT:/work" -w /work "$ARCH_IMAGE" \
diff --git a/wallet/wallet-rpc-daemon/docs/RPC.md b/wallet/wallet-rpc-daemon/docs/RPC.md
index 0a90028b13..0cbba9daa9 100644
--- a/wallet/wallet-rpc-daemon/docs/RPC.md
+++ b/wallet/wallet-rpc-daemon/docs/RPC.md
@@ -1,6 +1,6 @@
 # RPC documentation for Mintlayer node wallet
 
-Version `1.4.0`.
+Version `1.4.1`.
 
 ## Module `WalletRpc`
 

From 56d960ff4ab7c61f98479f97459658e43dc5ea9a Mon Sep 17 00:00:00 2001
From: nullPointerEnjoyer <dev1@mintlayer.org>
Date: Thu, 24 Sep 2026 22:14:08 +0200
Subject: [PATCH 4/9] Smoke-test foreign-arch packages in an Arch Linux ARM
 chroot

The previous fix added the foreign arch to pacman's Architecture list,
which lets the amd64-only Arch image *install* the aarch64 package, but
its binaries still cannot execute there: there is no aarch64 userland,
so every binary dies under qemu with exit 255 (the ELF interpreter
/lib/ld-linux-aarch64.so.1 does not exist). Docker Hub publishes no
arm64 Arch image at all (library/archlinux and archlinux/archlinux are
both amd64-only), so unlike the deb/rpm legs there is no --platform
linux/arm64 escape hatch.

For foreign-architecture packages, smoke-arch.sh now assembles a chroot
of the Arch Linux ARM rootfs and runs the same checks inside it: pacman
-U installs the package with dependencies from the arm repos, pacman
hooks run under emulation (sysusers creates the mintlayer user), and
the binaries execute through the host's qemu binfmt handlers already
registered for the deb/rpm arm64 legs.

Chroot quirks handled:
- pacman's download sandbox user switch fails under the container
  seccomp profile: pass --disable-sandbox inside the chroot
- /proc is not mounted, so /etc/mtab (pacman free-space check) is a
  static copy of the container's mount table
- pacman-key --populate needs process substitution (/dev/fd), which
  requires /proc: initialize the chroot keyring with the container's
  amd64 pacman-key via --gpgdir instead of the emulated one
- /work is not visible in the chroot: script, lib.sh and the package
  are copied in

Verified locally against the pinned CI image with a synthetic aarch64
package exercising install, sysusers hook, binaries, systemd-analyze,
and man page checks, plus an x86_64 package for the native path.
---
 .github/workflows/release_linux.yml |   9 +-
 packaging/checks/smoke-arch.sh      | 229 +++++++++++++++++++---------
 2 files changed, 161 insertions(+), 77 deletions(-)

diff --git a/.github/workflows/release_linux.yml b/.github/workflows/release_linux.yml
index 6dfc083386..69ab106879 100644
--- a/.github/workflows/release_linux.yml
+++ b/.github/workflows/release_linux.yml
@@ -214,11 +214,10 @@ jobs:
 
     # x86_64 leg: arch-matched container (native strip, ldd-based
     # dependencies, help2man man pages), so the package installs natively.
-    # aarch64 leg: the same amd64-only image installs the foreign-arch
-    # package (smoke-arch.sh adds the foreign arch to pacman's Architecture
-    # list) and runs the binaries through the qemu binfmt
-    # handlers registered above — the same emulation the deb/rpm legs use
-    # for their arm64 smoke tests.
+    # aarch64 leg: Docker Hub publishes no arm64 Arch image, so
+    # smoke-arch.sh assembles an Arch Linux ARM chroot and installs/runs the
+    # package there through the qemu binfmt handlers registered above — the
+    # same emulation the deb/rpm legs use for their arm64 smoke tests.
     - name: Smoke test Arch packages
       env:
         VERSION: ${{ steps.get_version.outputs.VERSION }}
diff --git a/packaging/checks/smoke-arch.sh b/packaging/checks/smoke-arch.sh
index faffccd34d..33dd242f5b 100755
--- a/packaging/checks/smoke-arch.sh
+++ b/packaging/checks/smoke-arch.sh
@@ -4,86 +4,171 @@
 # Usage: smoke-arch.sh <path/to/pkg.pkg.tar.zst> <package-name> node|gui [pkg-arch]
 #
 # The optional fourth argument is the architecture the package was built for
-# (defaults to the container architecture). For a foreign-architecture package
-# (the cross-target aarch64 leg reuses the amd64-only Arch image), the
-# foreign architecture is added to pacman's Architecture list and the
-# binaries are executed
-# through the host's qemu binfmt handlers — the same emulation the deb/rpm
-# legs use for their arm64 smoke tests.
+# (defaults to the container architecture). Docker Hub publishes no arm64
+# Arch image (library/archlinux and archlinux/archlinux are amd64-only), so a
+# foreign-architecture package (the cross-target aarch64 leg reuses the
+# amd64-only image) is smoke-tested in a chroot of the Arch Linux ARM rootfs:
+# the package and its dependencies are installed by the chroot's pacman and
+# its binaries execute through the host's qemu binfmt handlers — the same
+# emulation the deb/rpm legs use for their arm64 smoke tests.
 set -euo pipefail
 
-# Shared binary list (NODE_BINARIES)
-. "$(cd "$(dirname "${BASH_SOURCE[0]}")/../common" && pwd)/lib.sh"
+CHROOT_DIR=/alarm
+# Primary + fallback download locations for the Arch Linux ARM rootfs; the
+# env var overrides for local testing (e.g. a pre-downloaded file:// copy).
+alarm_rootfs_urls() {
+    if [ -n "${ALARM_ROOTFS_URL:-}" ]; then
+        printf '%s\n' "$ALARM_ROOTFS_URL"
+    else
+        printf '%s\n' \
+            https://fl.us.mirror.archlinuxarm.org/os/ArchLinuxARM-aarch64-latest.tar.gz \
+            https://mirror.archlinuxarm.org/os/ArchLinuxARM-aarch64-latest.tar.gz
+    fi
+}
+
+# Shared binary list (NODE_BINARIES). Inside the chroot the repo tree is not
+# visible; the foreign-arch branch copies lib.sh in next to the script.
+if [ "${1:-}" = "--chroot" ]; then
+    . /smoke-lib.sh
+else
+    . "$(cd "$(dirname "${BASH_SOURCE[0]}")/../common" && pwd)/lib.sh"
+fi
+
+# Inside the ARM chroot pacman must not drop to its download sandbox user:
+# the (emulated) setuid switch fails under the container's seccomp profile.
+pacman_cmd() {
+    if [ -n "${SMOKE_CHROOT:-}" ]; then
+        pacman --disable-sandbox "$@"
+    else
+        pacman "$@"
+    fi
+}
+
+main() {
+    # Sync the databases so the package dependencies resolve from the repos.
+    pacman_cmd -Sy --noconfirm >/dev/null
+    pacman_cmd -U --noconfirm "$PKG_FILE" >/dev/null
+
+    echo "== pacman query =="
+    pacman_cmd -Qi "$PKG_NAME"
+
+    if [ "$KIND" = node ]; then
+        echo "== system user =="
+        id mintlayer
+
+        echo "== binaries =="
+        for bin in "${NODE_BINARIES[@]}"; do
+            test -x "/usr/bin/mintlayer-$bin"
+            "/usr/bin/mintlayer-$bin" --help >/dev/null 2>&1
+            echo "  ok: mintlayer-$bin --help"
+        done
+
+        echo "== systemd units =="
+        shopt -s nullglob
+        units=(/usr/lib/systemd/system/mintlayer-*.service)
+        shopt -u nullglob
+        [ ${#units[@]} -gt 0 ] || { echo "ERROR: no mintlayer units installed" >&2; exit 1; }
+        for unit in "${units[@]}"; do
+            systemd-analyze verify "$unit"
+            echo "  ok: $(basename "$unit")"
+        done
+        test -f /usr/lib/systemd/system-preset/90-mintlayer.preset
+        grep -q "enable mintlayer-node@mainnet.service" \
+            /usr/lib/systemd/system-preset/90-mintlayer.preset
+        test -f /usr/lib/sysusers.d/mintlayer.conf
+        test -f /usr/lib/udev/rules.d/51-mintlayer.rules
+        test -f /etc/mintlayer/mainnet/node.env
+        test -f /etc/mintlayer/testnet/node.env
+        echo "  ok: preset/sysusers/udev/conffiles present"
+
+        echo "== man pages =="
+        pacman_cmd -Ql "$PKG_NAME" | grep -q "usr/share/man/man1/mintlayer-.*\.1\.gz$"
+        echo "  ok"
+    else
+        echo "== gui files =="
+        test -x /usr/bin/mintlayer-node-gui
+        "/usr/bin/mintlayer-node-gui" --help >/dev/null 2>&1
+        echo "  ok: mintlayer-node-gui --help"
+
+        pacman_cmd -S --noconfirm --needed desktop-file-utils >/dev/null
+        desktop-file-validate /usr/share/applications/mintlayer-node-gui.desktop
+
+        echo "== icons =="
+        for size in 64x64 128x128 256x256 512x512; do
+            test -f "/usr/share/icons/hicolor/${size}/apps/mintlayer-node-gui.png"
+            echo "  ok: hicolor ${size}"
+        done
+
+        echo "== man pages =="
+        pacman_cmd -Ql "$PKG_NAME" | grep -q "usr/share/man/man1/mintlayer-node-gui\.1\.gz$"
+        echo "  ok"
+    fi
+
+    echo "smoke test passed for $PKG_NAME"
+}
+
+# Re-entry mode: the foreign-arch branch below invokes this script inside the
+# ARM chroot with `--chroot <pkg-in-chroot> <package-name> node|gui`.
+if [ "${1:-}" = "--chroot" ]; then
+    shift
+    SMOKE_CHROOT=1
+    PKG_FILE="$1"
+    PKG_NAME="$2"
+    KIND="$3"
+    main
+    exit 0
+fi
 
 PKG_FILE="$(readlink -f "$1")"
 PKG_NAME="$2"
 KIND="$3"
 PKG_ARCH="${4:-$(uname -m)}"
 
-if [ "$PKG_ARCH" != "$(uname -m)" ]; then
-    echo "foreign-architecture package ($PKG_ARCH on $(uname -m)): adding to pacman's Architecture list"
-    # pacman has no per-package override; listing the foreign arch in the
-    # Architecture option is the supported way to allow installing it.
-    sed -i "s/^#\?Architecture.*/Architecture = $(uname -m) $PKG_ARCH/" /etc/pacman.conf
+if [ "$PKG_ARCH" = "$(uname -m)" ]; then
+    main
+    exit 0
 fi
 
-# Sync the databases so the package dependencies resolve from the repos.
-pacman -Sy --noconfirm >/dev/null
-pacman -U --noconfirm "$PKG_FILE" >/dev/null
-
-echo "== pacman query =="
-pacman -Qi "$PKG_NAME"
-
-if [ "$KIND" = node ]; then
-    echo "== system user =="
-    id mintlayer
-
-    echo "== binaries =="
-    for bin in "${NODE_BINARIES[@]}"; do
-        test -x "/usr/bin/mintlayer-$bin"
-        "/usr/bin/mintlayer-$bin" --help >/dev/null 2>&1
-        echo "  ok: mintlayer-$bin --help"
-    done
-
-    echo "== systemd units =="
-    shopt -s nullglob
-    units=(/usr/lib/systemd/system/mintlayer-*.service)
-    shopt -u nullglob
-    [ ${#units[@]} -gt 0 ] || { echo "ERROR: no mintlayer units installed" >&2; exit 1; }
-    for unit in "${units[@]}"; do
-        systemd-analyze verify "$unit"
-        echo "  ok: $(basename "$unit")"
-    done
-    test -f /usr/lib/systemd/system-preset/90-mintlayer.preset
-    grep -q "enable mintlayer-node@mainnet.service" \
-        /usr/lib/systemd/system-preset/90-mintlayer.preset
-    test -f /usr/lib/sysusers.d/mintlayer.conf
-    test -f /usr/lib/udev/rules.d/51-mintlayer.rules
-    test -f /etc/mintlayer/mainnet/node.env
-    test -f /etc/mintlayer/testnet/node.env
-    echo "  ok: preset/sysusers/udev/conffiles present"
-
-    echo "== man pages =="
-    pacman -Ql "$PKG_NAME" | grep -q "usr/share/man/man1/mintlayer-.*\.1\.gz$"
-    echo "  ok"
-else
-    echo "== gui files =="
-    test -x /usr/bin/mintlayer-node-gui
-    /usr/bin/mintlayer-node-gui --help >/dev/null 2>&1
-    echo "  ok: mintlayer-node-gui --help"
-
-    pacman -S --noconfirm --needed desktop-file-utils >/dev/null
-    desktop-file-validate /usr/share/applications/mintlayer-node-gui.desktop
-
-    echo "== icons =="
-    for size in 64x64 128x128 256x256 512x512; do
-        test -f "/usr/share/icons/hicolor/${size}/apps/mintlayer-node-gui.png"
-        echo "  ok: hicolor ${size}"
-    done
-
-    echo "== man pages =="
-    pacman -Ql "$PKG_NAME" | grep -q "usr/share/man/man1/mintlayer-node-gui\.1\.gz$"
-    echo "  ok"
-fi
+echo "foreign-architecture package ($PKG_ARCH on $(uname -m)): smoke-testing in an Arch Linux ARM chroot"
+
+# Assemble a native $PKG_ARCH userland. Requires qemu binfmt handlers for the
+# architecture to be registered on the runner's kernel (release_linux.yml
+# sets them up via docker/setup-qemu-action; the F-flag keeps them working
+# inside the chroot).
+mkdir -p "$CHROOT_DIR"
+rootfs_tar=/tmp/alarm.tar.gz
+rc=1
+for url in "$(alarm_rootfs_urls)"; do
+    echo "downloading ARM rootfs from $url"
+    if curl --proto '=https' --tlsv1.2 -sSfL -o "$rootfs_tar" "$url"; then rc=0; break; fi
+done
+[ "$rc" -eq 0 ] || { echo "ERROR: could not download the Arch Linux ARM rootfs" >&2; exit 1; }
+# The rootfs ships device nodes we cannot recreate inside an unprivileged
+# container; skip them. Remaining tar warnings are non-fatal.
+tar -xzf "$rootfs_tar" -C "$CHROOT_DIR" --exclude='./dev/*' 2>/dev/null || true
+
+# chroot plumbing the rootfs does not ship: DNS resolution and a mount table
+# (pacman reads /etc/mtab for its free-space check; /proc is not mounted here,
+# so a static copy of the container's table is used).
+rm -f "$CHROOT_DIR/etc/resolv.conf"
+cp -L /etc/resolv.conf "$CHROOT_DIR/etc/resolv.conf"
+rm -f "$CHROOT_DIR/etc/mtab"
+cp /proc/self/mounts "$CHROOT_DIR/etc/mtab"
+
+# Initialize the chroot's pacman keyring from the container: gpg inside the
+# chroot would run under emulation, and pacman-key's --populate needs
+# process substitution (/dev/fd), which requires a mounted /proc the chroot
+# does not have. The host container's pacman-key can act on the chroot's
+# keyring via --gpgdir once the archlinuxarm keyring is visible to it.
+cp "$CHROOT_DIR/usr/share/pacman/keyrings/archlinuxarm.gpg" /usr/share/pacman/keyrings/
+pacman-key --gpgdir "$CHROOT_DIR/etc/pacman.d/gnupg" --init >/dev/null
+pacman-key --gpgdir "$CHROOT_DIR/etc/pacman.d/gnupg" --populate archlinuxarm >/dev/null
+
+# /work is not visible inside the chroot: copy the script, its lib.sh and the
+# package in.
+cp "$PKG_FILE" "$CHROOT_DIR/$(basename "$PKG_FILE")"
+cp "$0" "$CHROOT_DIR/smoke-arch.sh"
+cp "$(cd "$(dirname "$0")/../common" && pwd)/lib.sh" "$CHROOT_DIR/smoke-lib.sh"
 
-echo "smoke test passed for $PKG_NAME"
+chroot "$CHROOT_DIR" /smoke-arch.sh --chroot "/$(basename "$PKG_FILE")" "$PKG_NAME" "$KIND"
+rm -f "$CHROOT_DIR/smoke-arch.sh" "$CHROOT_DIR/smoke-lib.sh" "$CHROOT_DIR/$(basename "$PKG_FILE")"

From be2c0372c979efc0b46639ecf4b0dbc2d6e48346 Mon Sep 17 00:00:00 2001
From: Enrico Rubboli <rubboli@gmail.com>
Date: Sat, 3 Oct 2026 09:12:02 +0200
Subject: [PATCH 5/9] Address the fifth and sixth rounds of OpenCodeReview
 findings

Accepted:

* rpc: reclassify ClientError::RequestTimeout as application-level.
  jsonrpsee does not terminate the WS client's background task on a
  timeout, so the connection may still be usable; tearing down a healthy
  client after one slow response churned connections under transient
  load. Genuinely dead connections are now detected instead by enabling
  WS-level pings in new_ws_client (failed pings terminate the background
  task and surface as RestartNeeded, i.e. a connection-level error),
  which also gives every consumer of the client half-dead-connection
  detection it previously lacked. The request timeout is pinned
  explicitly to 60 seconds (matching the previous default) so the
  daemons' no-wedge guarantees do not depend on a library default.

* scanner-daemon: wait one second after a successful sync before polling
  the node again. sync_once returns Ok immediately when the scanner is
  already at the tip, so the loop previously hammered the node's
  chainstate RPC thousands of times per second; the one-second cadence
  bounds the explorer's tip latency while keeping the node load gentle.

* scanner-daemon: document the ping-based dead-connection detection and
  the pinned request timeout in the supervision loop.

* tests: the scanner reconnect test logs its entropy seed
  (from_entropy_and_print) so CI failures are locally reproducible.

Rejected:

* 'make the supervision loop shutdown-aware': none of the mintlayer
  daemons install signal handling (documented in the web server's
  supervisor); graceful shutdown is a codebase-wide concern outside this
  PR's scope.

* 'reap a proxy connection pair as soon as either direction finishes':
  contradicts the previous round's own request (which asked for the
  either-finished reaping that the comment now documents); a
  half-drained pair still forwards in one direction and ends on its own
  once the peer socket closes, and the registry stays bounded.
---
 api-server/CHANGELOG.md                       |  1 +
 api-server/scanner-daemon/src/lib.rs          | 16 +++++++++---
 .../tests/scanner_reconnect.rs                |  7 +++--
 rpc/src/error.rs                              | 26 ++++++++++---------
 rpc/src/lib.rs                                | 11 +++++++-
 .../wallet-node-client/src/rpc_client/mod.rs  | 18 ++++++++-----
 6 files changed, 54 insertions(+), 25 deletions(-)

diff --git a/api-server/CHANGELOG.md b/api-server/CHANGELOG.md
index f3d88a2211..b3edabd0df 100644
--- a/api-server/CHANGELOG.md
+++ b/api-server/CHANGELOG.md
@@ -17,6 +17,7 @@ The format is loosely based on [Keep a Changelog](https://keepachangelog.com/en/
 
 ### Changed
 - The api-server storage version was bumped from 25 to 26 (new `ml.emitted_events` table); the scanner re-initializes the database when it finds a different version, as before. Full resync is required.
+- `RemoteNode::is_connection_error` is now a required trait method (no default); external implementors of the `RemoteNode` trait must provide it. `ClientErrorExt::is_connection_error` now classifies `ClientError::RequestTimeout` as application-level (the connection may still be usable), and the node WS client enables WS-level pings and pins its request timeout to 60 seconds, so half-dead connections are detected and reconnected instead of wedging.
 - The stream event retention pruning no longer deletes events that the event pump has not consumed yet: the pump records its progress in the database and the pruning never overtakes it (with a hard limit of 100k retained events before the first progress record or during a pump outage, logged as an error when it kicks in).
 - A terminated streaming background task (the event pump or the mempool bridge) now brings the web server process down instead of leaving the event stream silently dead while the REST endpoints keep working.
 - The streaming CLI options are validated (`clap` range checks) instead of silently clamping invalid values, and an SSE connection above `--stream-events-max-subscribers` is rejected with `429 Too Many Requests`.
diff --git a/api-server/scanner-daemon/src/lib.rs b/api-server/scanner-daemon/src/lib.rs
index adfeb986cf..2313b3d006 100644
--- a/api-server/scanner-daemon/src/lib.rs
+++ b/api-server/scanner-daemon/src/lib.rs
@@ -55,6 +55,10 @@ const SYNC_ERROR_DELAY: Duration = Duration::from_secs(1);
 /// bridge/scanner must never depend on the library's default timeouts for its no-wedge
 /// guarantees.
 const CONNECT_TIMEOUT: Duration = Duration::from_secs(30);
+/// How long the scanner waits after a successful sync (when it is already at the node's tip)
+/// before polling the node again. Bounds the tip latency for the explorer while keeping the
+/// polling cadence gentle on the node.
+const SYNC_IDLE_POLL_INTERVAL: Duration = Duration::from_secs(1);
 
 /// The state of an ongoing outage of the connection to the node: counts the failed
 /// connection/sync attempts since the last successful sync and remembers when the current
@@ -228,9 +232,11 @@ async fn supervise_sync<S: ApiServerStorage>(
     // so that a node that is down at startup does not abort the daemon.
     //
     // Note: every RPC call made by `sync_once` is bounded by the WS client's request timeout
-    // (jsonrpsee's default of 60 seconds), so a node that hangs without closing the connection
-    // surfaces as a request timeout, which is classified as a connection-level failure and
-    // recovered below, rather than wedging the loop indefinitely.
+    // (pinned to 60 seconds in `new_ws_client`), so a node that hangs without closing the
+    // connection surfaces as a request timeout: a non-connection error that is retried with the
+    // escalating delay below (re-connecting cannot fix a slow node). A genuinely dead
+    // connection is detected by the WS ping and surfaces as `RestartNeeded`, i.e. a
+    // connection-level failure that triggers the reconnection path.
     let mut state = ConnectionState::Reconnecting;
     let mut outage = Outage::new();
 
@@ -323,6 +329,10 @@ async fn supervise_sync<S: ApiServerStorage>(
                 backoff.reset();
                 sync_error_backoff.reset();
                 outage = Outage::new();
+                // Note: avoid a hot spin when already at the node's tip: without this wait the
+                // loop would poll the node's `chainstate` RPC thousands of times per second.
+                // The wait bounds the explorer's tip latency to this interval.
+                tokio::time::sleep(SYNC_IDLE_POLL_INTERVAL).await;
             }
             Err(err) if err.is_connection_error() => {
                 // The client is permanently broken (e.g. the node has closed the WebSocket
diff --git a/api-server/stack-test-suite/tests/scanner_reconnect.rs b/api-server/stack-test-suite/tests/scanner_reconnect.rs
index 3e2c762dc1..220ee4002f 100644
--- a/api-server/stack-test-suite/tests/scanner_reconnect.rs
+++ b/api-server/stack-test-suite/tests/scanner_reconnect.rs
@@ -189,8 +189,11 @@ async fn scanner_reconnects_after_node_disconnection() {
     }
 
     // Note: one seeded RNG drives the whole test (the framework builder and both phases of
-    // block creation), so that a CI failure is locally reproducible with a fixed seed.
-    let mut rng = make_seedable_rng(Seed::from_entropy());
+    // block creation); `from_entropy_and_print` logs the seed, so a CI failure is locally
+    // reproducible.
+    let mut rng = make_seedable_rng(Seed::from_entropy_and_print(
+        "scanner_reconnects_after_node_disconnection",
+    ));
     let tf = TestFramework::builder(&mut rng).build();
     let chain_config = tf.chain_config().clone();
 
diff --git a/rpc/src/error.rs b/rpc/src/error.rs
index 44090ca33b..fb1d200a74 100644
--- a/rpc/src/error.rs
+++ b/rpc/src/error.rs
@@ -29,15 +29,15 @@ pub type ClientError = jsonrpsee::core::ClientError;
 
 /// Classification of client errors into connection-level and application-level failures.
 ///
-/// A connection-level error means that the RPC call did not reach the remote node (or its
-/// response was lost) because the underlying connection is broken or cannot be established;
-/// such failures are recoverable by dropping the client and re-establishing the connection.
-/// An application-level error, in contrast, is a definitive answer from the node (or a local
-/// problem) and must not trigger a reconnection.
+/// A connection-level error means that the underlying connection is broken or cannot be
+/// established; such failures are recoverable by dropping the client and re-establishing the
+/// connection. An application-level error, in contrast, is not evidence of a broken connection
+/// (the client and its connection may still be perfectly usable) and must not trigger a
+/// reconnection by itself.
 ///
-/// Note: "connection-level" does not imply that the failed request went unprocessed. A request
-/// timeout or a lost response leaves its outcome unknown; callers retrying non-idempotent
-/// requests must handle that themselves.
+/// Note: "connection-level" does not imply that a request always went unprocessed; callers
+/// retrying non-idempotent requests must handle that themselves (e.g. the wallet tracks which
+/// transactions were already submitted before rebroadcasting them).
 pub trait ClientErrorExt {
     /// Returns `true` if the error indicates a broken or unusable connection to the node.
     fn is_connection_error(&self) -> bool;
@@ -53,10 +53,12 @@ impl ClientErrorExt for ClientError {
             // Note: the jsonrpsee-generated message ends with "; restart required", which is
             // only true for clients that cannot be re-created.
             ClientError::RestartNeeded(_) => true,
-            // The node didn't answer in time; the connection is (currently) unusable.
-            // Note: jsonrpsee does not terminate the background task on a timeout, but there is
-            // no point in keeping a client whose connection has proven to be unreliable.
-            ClientError::RequestTimeout => true,
+            // Note: `RequestTimeout` is deliberately application-level. jsonrpsee does not
+            // terminate the background task on a timeout, so the connection may still be
+            // perfectly usable; tearing down a healthy client after one slow response would
+            // churn connections under transient load. Genuinely dead connections are detected
+            // by the WS ping (failed pings terminate the background task -> `RestartNeeded`).
+            ClientError::RequestTimeout => false,
             // The RPC service got disconnected from its backend.
             ClientError::ServiceDisconnect => true,
             ClientError::Call(_)
diff --git a/rpc/src/lib.rs b/rpc/src/lib.rs
index 354240436d..0e6e2f434c 100644
--- a/rpc/src/lib.rs
+++ b/rpc/src/lib.rs
@@ -26,7 +26,7 @@ pub use rpc_description_macro::describe;
 /// Support types for RPC interfaces
 pub use rpc_types as types;
 
-use std::{net::SocketAddr, path::PathBuf};
+use std::{net::SocketAddr, path::PathBuf, time::Duration};
 
 use base64::Engine;
 use http::{HeaderValue, header};
@@ -264,6 +264,15 @@ pub async fn new_ws_client(
 
     jsonrpsee::ws_client::WsClientBuilder::new()
         .set_headers(headers)
+        // Note: WS-level pings are disabled by jsonrpsee by default; enabling them gives the
+        // client a way to detect half-dead connections (the peer stopped answering but the TCP
+        // connection is still open): failed pings terminate the client's background task, which
+        // surfaces to callers as `ClientError::RestartNeeded`, i.e. a connection-level error.
+        .enable_ws_ping(jsonrpsee::ws_client::PingConfig::new())
+        // Note: pinned explicitly (it matches the jsonrpsee default) so that the "a hung node
+        // cannot wedge a caller indefinitely" guarantees of the daemons do not silently depend
+        // on a library default.
+        .request_timeout(Duration::from_secs(60))
         .build(host)
         .await
 }
diff --git a/wallet/wallet-node-client/src/rpc_client/mod.rs b/wallet/wallet-node-client/src/rpc_client/mod.rs
index 6f44332dab..6b3bc393ac 100644
--- a/wallet/wallet-node-client/src/rpc_client/mod.rs
+++ b/wallet/wallet-node-client/src/rpc_client/mod.rs
@@ -248,11 +248,12 @@ impl NodeRpcError {
     ///
     /// Such errors are recoverable by dropping the client and establishing a new connection.
     ///
-    /// Caution: connection-level does not mean that the failed request was not processed. A
-    /// timeout or a lost response in particular leaves the outcome of the request unknown, so
-    /// callers retrying non-idempotent node calls must account for that instead of blindly
-    /// resending. (The scanner's sync and the mempool subscription are both idempotent: they
-    /// resume from local state.)
+    /// Caution: connection-level does not imply that a failed request always went unprocessed
+    /// (a request lost to a terminated background task may have reached the node); callers
+    /// retrying non-idempotent node calls must account for that instead of blindly resending.
+    /// (The scanner's sync and the mempool subscription are both idempotent: they resume from
+    /// local state.) Request timeouts are application-level errors: the connection may still
+    /// work, but the outcome of the timed-out call is unknown, with the same caveat.
     pub fn is_connection_error(&self) -> bool {
         match self {
             // The client could not be created or the call did not reach the node (or its
@@ -671,8 +672,6 @@ mod connection_error_tests {
             NodeRpcError::ResponseError(ClientError::Transport("connection reset by peer".into()))
                 .is_connection_error()
         );
-        assert!(NodeRpcError::ResponseError(ClientError::RequestTimeout).is_connection_error());
-
         // A client that cannot be created at all (e.g. the node is simply down) is also a
         // connection-level failure.
         assert!(
@@ -699,6 +698,11 @@ mod connection_error_tests {
         ));
         assert!(!NodeRpcError::ResponseError(call_error).is_connection_error());
 
+        // A timeout means the connection may still be usable: it is application-level, so the
+        // client is kept (a genuinely dead connection is detected by the WS ping and surfaces
+        // as `RestartNeeded`).
+        assert!(!NodeRpcError::ResponseError(ClientError::RequestTimeout).is_connection_error());
+
         assert!(
             !NodeRpcError::DecodingError(serialization::hex::HexError::ScaleDecodeError(
                 "decoding failed".into()

From 26f3caef24d0b05eaf7e003b11d20cf33552a423 Mon Sep 17 00:00:00 2001
From: Enrico Rubboli <rubboli@gmail.com>
Date: Mon, 5 Oct 2026 09:29:58 +0200
Subject: [PATCH 6/9] chore(common): update checkpoints

---
 .../chain/config/checkpoints_data/mainnet.rs  | 129 ++++++++++++++++++
 .../chain/config/checkpoints_data/testnet.rs  |  20 +++
 2 files changed, 149 insertions(+)

diff --git a/common/src/chain/config/checkpoints_data/mainnet.rs b/common/src/chain/config/checkpoints_data/mainnet.rs
index 62b297a62b..be0c7e7476 100644
--- a/common/src/chain/config/checkpoints_data/mainnet.rs
+++ b/common/src/chain/config/checkpoints_data/mainnet.rs
@@ -1159,4 +1159,133 @@ pub const CHECKPOINTS_DATA: &[(u64, &str)] = &[
     (635000, "49429D05126C159432D17F34C9BE7837356818744BE1ABD256E751F4C8190D25"),
     (635500, "0924F98B4A83D6AB78F55C9038CDE5F0369A269D4CAB18AF6F2E82C71E34DCB5"),
     (636000, "FDFBD65AA35758C05CF42FAAB7C890129BC6844FF962C7101F3F8B46925E1F56"),
+    (636500, "F9F1C87C34B48B697E315EF6612D89B6946DAACDDAFBCACA904539B119765C88"),
+    (637000, "D6724B5D85B7A7A707A9AF9605D96F743A595B168FE752D1FDA5D8F4CB11053C"),
+    (637500, "5FC8A6BEB39F51808EB8F1070D0BAAFCF877F528C39E3B93701D11F2E56EB997"),
+    (638000, "FE1C06FE996946AED0BC05CD2BE64393250F7232C387F83E499815AB43DEB2C8"),
+    (638500, "838DFCFE5E9B3E2F52F5FB2BA5F32544A84C75862C719CE47144A64821F4B92F"),
+    (639000, "E98738DA0BD0DFA6D5ACE9ADE43EB9783B2F4B46EC066D817D08B481710AEC0F"),
+    (639500, "00EA0FCDB32FF082F8EEFADCE14F388D58FE0BA0BCE6D9E451D79581EA8564E1"),
+    (640000, "84A92EEE20725076F7FBB1035555F9195B18083FC49172C47E1FED8D6EEAE888"),
+    (640500, "7B1357CAF07DD0D1D81DA6943A5820F8BDBE294F45A78AADC4D72A5BD98638DC"),
+    (641000, "0B729575D0FBED65787630A2E5191018F1926928FFDCADA1543071D7ADC77A88"),
+    (641500, "78D5B531FB86AF7B9A9CD21A01FD6D4C01C56379D79D8C340A0227480DF1193D"),
+    (642000, "5A200220B6EB7E24361B87BD5FEF0CC675CEA26A833452DAE0E1C6C07E96E2AC"),
+    (642500, "DAC2A3B1D0103B71385376D297B0A91BB0759DDC0911CE7E977C36C9A21102B7"),
+    (643000, "D404467B74494C31FA2365DBF4FB28F3EEA552DF0299DBDF58AF7728A87273BF"),
+    (643500, "64C50791FB43206B595B23EB9B619D4722BEC414071C5D113F6E067A9B6F5B2C"),
+    (644000, "F000F1AFABEC947EEAE856CFBEA52B73ACDE813D286D58972E3C8A4FE711C296"),
+    (644500, "804C3A59892B24F9901E11C966A4CAE56CE752339FF1A64D19F773AA3684785D"),
+    (645000, "21474A1E3402A2E3415FD4EAD13E29CF71F0B11E8F091CDA9A61234B6405335A"),
+    (645500, "48106F3B2B4828984753473403DCD3802CA7852ECA928C9ADF0BD7EA4BA20898"),
+    (646000, "13FEC5FAF0FB67089CB97B5642B4044628CCF87A4010D158629138EA907B17C9"),
+    (646500, "462835F9F105DCCCD45671043927CB7A3B6D805D80D04F8ED0153BB9A4A0AF76"),
+    (647000, "C5E62E7F21D88328F784D6A104B365579F11AA74D0AF3F5424A62C0C2CD03E6D"),
+    (647500, "B2CD1096E84DAFA9559B66B8AAD70B89850FC78D8B56349E46DF545DBB4F3F59"),
+    (648000, "87C640C97177065968D74281B95781409119A30747C4E529C0C7A998938D2900"),
+    (648500, "27E2DF571B0DA1DBD28B77404C1FE15DF71E5DC85F128F66EBDE48B5CB823464"),
+    (649000, "EE31CA5BB48CC87D5609B12708383EF8E5294FD296031466C92525DD6E576D4C"),
+    (649500, "6D7B67BE1D404DCF47863335DB201C248FABE0D50D5F8FED34FE30B05B64B1E3"),
+    (650000, "66CE7E99EEFD1AD4B943DED598326A2C9C68566FECF85AB76B6EE64E9445FAEE"),
+    (650500, "DC2A30FF40E00BDD9382EDA57259656B9D81D78507BD66DC058B3F00A53D6507"),
+    (651000, "BF1C9699C0F9DB5D6247C423B5ADAE4D9FC5513CDD66DDACB665EBE8B1CF6925"),
+    (651500, "C8EFDEB3A6D2112485F7A9BA152FBC082AF5854F0FE52BDE2571C768BE4BB1BF"),
+    (652000, "A29322351B20374859C8A702C04D944706C35BBD6D0ACC9F56472DBD4338CC91"),
+    (652500, "F73C07473ED7BB7DF4ACE5374B162631E61C3667FD2F48A1794762D0B8455988"),
+    (653000, "D5134A5C248EEC9B95F733E544870FDA45C24170D4853F63EFF76002A993E33B"),
+    (653500, "50816DD32890DBA64522B0E0C882D479DD2DEA3D36273DDB2A77B1A30598CF08"),
+    (654000, "6AB5C867B61E4C9E4A47EA68E46B3772444357E858CE754AF453043DD003AB63"),
+    (654500, "AE43741289EDDDFA63D2CB7E0165ADF789D2AB1E145C8F2FEFD4F0BE3D85FFCF"),
+    (655000, "1DBE0D0F9ED5A076CCFBFA6349714BF88DC1E6619221E7257694FB3854CE952C"),
+    (655500, "920DFEEAB03FA120785CA127BDA5ADE4AE50E821D6B38766C76F2F35CAE92579"),
+    (656000, "D6E1EE6AF287D5CD4F9762DA87CFD845D30EFE4FF0E928DCA08D41DA33AFB6DC"),
+    (656500, "F4842B9568D8DF0352AB8E1F6BE3F9778CD6F540386AD885A17A07FCA0D19916"),
+    (657000, "776765ABC58230A3C9CCB81F33F942711BE544D2164B36B13407E6534EC1A336"),
+    (657500, "441CD342CE023D60E1378121A3DBB7A8E71146010B7B9C7FD8716230627692D2"),
+    (658000, "7A5DF4BDAA1D6A20359A2F32BBA910F32D78BA4AC89C3405B9CA59E982521DF8"),
+    (658500, "8A45DEB97FE08AD88BB25F2339CB0BEE1D4D466545FEE41334782202DD66A2DC"),
+    (659000, "7FAC23309324F35AE83F3E6DAFD740C211C5C7F5424052811DA5F7CE05511CD8"),
+    (659500, "4C04B522375E95309084938D87E24FAF1B7B5C4A19B123274FE4B4531181AAAC"),
+    (660000, "72554EA6F9AC87887CAB18797D4005D017EB44FA8F20414605993F2A15251A16"),
+    (660500, "944B06197B385DEC926F0BF69E2A2915F5F624E6B1B90EFF7E9295E3770DE7AF"),
+    (661000, "3D7678E8128FBEFBA6BF87CC8C9FAAC065D42EB3F8280B8A3BFECEA220D9594A"),
+    (661500, "84FF0F431B8460C5F58F7A284018DDEC93D46AC3ACCCA498525D0B6BF6539411"),
+    (662000, "8A9E01311C5EBEAA800A80780DA43DDAC9B9BCE735F24DE66B36161D9A0E1550"),
+    (662500, "1458915AD352BC26662E10CE47560416F7CC2679C063083D0C442B1B97313509"),
+    (663000, "F044417D35DE37FD83E595903FE4622A19A26581333815D47A8AF3FDF27C8C46"),
+    (663500, "6CA09435240FF58E5D095D97BE64F98975804C385998E3533E198BA4E4A5442B"),
+    (664000, "63D4DB7B974EC2BF6A7EC9495CA74C7217A02CE1014D811D215A8AA5787D99DD"),
+    (664500, "469E4068ADC1AD14624D2E117F69FFB6A0E92599F06A78BFADA776B005749412"),
+    (665000, "B86972EB1F73AB1BF9ECA47E2459C4BF18933CBE51DEFF12D58DC055D804DB4C"),
+    (665500, "1A9D4A87B8DA8E047DF31177DF008DBF4D69F0EB2FC78EFE71E15A51369B7EF9"),
+    (666000, "247286D02FE797596A94DB5783402E818A2FCAAB12E50FA5DE74C418A3A7F458"),
+    (666500, "DF4C0C260AA193FE02BECD6C6A8F4A535B04FA7F30B6F3C71081F8DCB833F9C1"),
+    (667000, "18162958EC5B07DC0A9A79A040A1BDEEE68DD21E38265F71AED0BCF7612D1D87"),
+    (667500, "2F1DA0D6DD911ABE40EEF80416D9EEDA0075C90D842FBD95E9C4B63CB7EAB611"),
+    (668000, "956772D1AC2A2D729EC7F52E7259C75AE67F7C7D6075852DA502B0C585973DAC"),
+    (668500, "3490D9CDC9BD39B28A777593BF334C7E24D699C2627D8FAA6EE6D9446519381B"),
+    (669000, "4B7D9ED3611516A631632FEF976917E013A5DB7EDB1CD8919809177B8854BA9F"),
+    (669500, "C623A5573A6A7A2A308B704B3B3C0C3C029CC7D00BBC67E1D65373A6B07BF663"),
+    (670000, "130A66A72E972B88DEB73DB65478E9089B3314741B6E4B2412070E8E3E50955D"),
+    (670500, "FE5804ADF67DFA79CD430F13A64DF984F4EC9AF8A0F1F23B96D14A76B46503D3"),
+    (671000, "512290B2CE2548D2D881FA7461F31D25DEF5ECCB084E1244B556DFABA368A3EB"),
+    (671500, "0AE33A5EAF00A3AF7B5889DF493240B84A55C824A05E45D57A57A87D83458EF6"),
+    (672000, "EED0741C4DC0B0E528AC3BDF7066B663A9B222AE7ED019B46F88BE4E28DFB991"),
+    (672500, "E29EEA9B24BC7EBEB16F8193CFF4F72501610A6332AEC9625BF95E60B8606E89"),
+    (673000, "7D68604A053471A9F57887A17783ED9C0D4B11994A15899490AF2718B213BDDA"),
+    (673500, "380454F8F350AD4A1EC4A935791EE33E937593DD8251B8D3E63EEA24C2A3B5EE"),
+    (674000, "00626382B8E70ABA877F2D005CD86818046AD034DB1781081BCB548D431C5306"),
+    (674500, "E034DEF139DBED8BE66AE8D9F4EFB436A6DE3D7AA5AF3AC567D964B4CF16C85A"),
+    (675000, "352D6F2ECAA88F28000606F73A4B8D172E55AB14C1F78265F9CE60F563D16D67"),
+    (675500, "99B7BE66B31DD893B1BE93A362E46E93ABABABB48105CCA7267188964B2AEDD5"),
+    (676000, "EA5E8E9A47C906E9A86C4D3B06AD57811B895B1850ACE98BDE954CF3A21599F9"),
+    (676500, "95BE82BD9B98909780EC1028D6803807F3A89EF9A4C4421B7AD123D82F7CEAAD"),
+    (677000, "B4B41CE302864A590BD3ACB4FC3FE4E974352AB9AF25BEB164BD29222F758CC4"),
+    (677500, "4B0E4CBD2D854DEA5B970A0D933AC550CCDE4D5D85EF253383D85EC446912C3F"),
+    (678000, "A286366BAC3180C8FB3F9FE0ED89487047CC3F91FC93F8818B30135EECB34D9A"),
+    (678500, "50295AE929179C6F3D93A7E3B2B0FC7CC72778AD5F31E7B7C4D52D814A1FF859"),
+    (679000, "ED9E1EFA9C48066B23A962009C4D7DFF9579591353A0DE440C120F06E5DFAE2B"),
+    (679500, "1D1A862298B96647F2CD07E9E6DA3AFBA77DFB86AF62B9622315151AD92E31ED"),
+    (680000, "A23C12164A07404A5D3D5D8AAC55BB6E94402F6EFBCFEFA3393A6ED0810127C6"),
+    (680500, "74225FD586B109671702F58373FE761B236AB9ABCB7B771ED430D71E605F394D"),
+    (681000, "1FD11B3A2E49D6BD7D53AF9EBE8EA8C9DAD5E3F8962DA2685175CC49B2F938DD"),
+    (681500, "E77772E65AE18A79E9E7B6F5920A9E65D30511ECF1FB793FFFAA86CE5B3CDE92"),
+    (682000, "4878D00515F7A8D20BE7C474D09563ADA3B3579A3474B7CB80C013879E92E6CF"),
+    (682500, "2E19CF113420A47FFE35819D0DF2FCF00F2C284ECB12CC3053AAFFA3015B5FC9"),
+    (683000, "1561D8E23BD51D7A648073FC366388C06F202A091790F06B0E875349B228DA0D"),
+    (683500, "78628DD498A196F50EDCA73229AD268814C6B8D3CEB48660487EBA06A518934E"),
+    (684000, "D61F42D933544EBCB46424794A853ECB113065BA84C091E46432606634CFE9AF"),
+    (684500, "A3313654036DA2CBC76215F8B49642EA4DD1E211CA51FA06BE166E401FAE49C0"),
+    (685000, "D5CD1C2339E3D041ECC636C992AF798F2E1FFE6170250B05F7F8219CBF44B930"),
+    (685500, "4C93A6F796DEF0FB6EDB889F4EB071AC13E5F956042DBBE05B20BCB51F6802E1"),
+    (686000, "B95EE341731A876E42C0EAE647F2B51B2CC43DBF104DB14670159891FAE83043"),
+    (686500, "F8ABB332C93847E7E3A3AC69FB90A728FCC662C35337738AED7E6206885477DC"),
+    (687000, "7F475379E635D756A9A2AA009BC91A4099BB1C5D1199CE9F0EA9347C3BD7F86E"),
+    (687500, "D2719194CFB66717ED6B139CECA1FD4A763E42BDF0BF09C220789BB5161D0F14"),
+    (688000, "878C1394DF8A9E59B9E07645332181F923059002D4F94BC3AB2A96D1D5590B7F"),
+    (688500, "1587CBDC829E0F1F610CACCF06DFCB79AEBEC41EBF409C04FB5DDE669560F053"),
+    (689000, "01966E6E5C6CD5F147632D4652EE6E0480EB1356C018E17D55A96DB0EE7AB74E"),
+    (689500, "DB18F432DA29F2D5DEA47D63E74498DA689D28CA4E2AB3731CE3824A9C89301F"),
+    (690000, "6F23A4C6B715A27E7C61B7AEDDEE6AF1D6485DC0943B71366873CB8A41B9A15F"),
+    (690500, "EECFA8AEA61F5E64E15290BA1C44E903B3A889FAC912B8211146B6231E64BC44"),
+    (691000, "D67200882B9F662D30D4BB5DBB173E83D60ADAB8AC93664CBDE5765A3E97B184"),
+    (691500, "90EF51C4B03BD3A51C7683E5C33104FBE4C5E1FE48EB78E0130AD03236643FC6"),
+    (692000, "76A297574D02B8DEE50AC7D8710FFDB7C259ED21B7313D429CD913B58692C5DB"),
+    (692500, "CDAD127A1B80FD9DE5A1076DA0DBE136191F92D0E2489B82AE3E766F9A6A224D"),
+    (693000, "E8A82A91F6354D079EC4393677174DFA3D93EAAA5601E8AEFDF1C572B8885020"),
+    (693500, "90BACBC0708B3ECA2F53EFB54E8B3D2CA1D72CD9A1F440EB043D2512990C4BEB"),
+    (694000, "A32CCD036C24E045285D1781EF673F81E6D095C3F47ED2EBB9855A36A0A65EA9"),
+    (694500, "56A88974C925DC723F78663CC676B276AC7AD7E3122E4FA92732CB935BF7421E"),
+    (695000, "5F6F58ECAEEAD312AD16CFEC42A96522B5871915BB49EF4165C0B1158153A208"),
+    (695500, "CA7B01A8E11813563B3902D4D8AD96DFECDF9EE1513CC4F1D771E50376C8608C"),
+    (696000, "5D7DE87E01FEE26082355C167FB72B34DE933BFC40C8C63A6376610136080DFC"),
+    (696500, "4208DAD5F17DD3749F26C4EB1F9DEB0716C0FC77D82827A391F048DA4A10C00E"),
+    (697000, "A2611E5FB9664BA988A2B5FAD6E065D373A0F573E1EC7EB107C66281FA0B4829"),
+    (697500, "2213644B52CD19EABD13C75F8ABC488E0BC3CF71DBEE93A488DDE7000AA3893C"),
+    (698000, "143DF6E67A2079FDE8149B186EEE82E698471F89AFAA87D2FB32DCABD6E6652C"),
+    (698500, "F88D111F6EBA544F937497C0BD75BB534544B3ECD4C93F850CEB99C1635D6E5B"),
+    (699000, "1302EB2D39751A826ACAA784C9F06E9C8BF2B6A5AE8DE115EA4283DF3F0532E7"),
+    (699500, "5E8E0189EF62E384BE476786A8A09DD4120035BE18EF8A3A9274181528916408"),
+    (700000, "EB648FC0DC411551FFFA7F0010C9C06DFBE70CEE2B9B13D10B5BB4ACDACB4A97"),
+    (700500, "99E55E3E432526FE8A69C4D9B167DD77FE6D1FC625616A9B961D2C70EE593A46"),
 ];
diff --git a/common/src/chain/config/checkpoints_data/testnet.rs b/common/src/chain/config/checkpoints_data/testnet.rs
index 9c70326227..e8cb00ad5c 100644
--- a/common/src/chain/config/checkpoints_data/testnet.rs
+++ b/common/src/chain/config/checkpoints_data/testnet.rs
@@ -1526,4 +1526,24 @@ pub const CHECKPOINTS_DATA: &[(u64, &str)] = &[
     (817500, "41A8BCFFE3FB0CE535CAF82535D4C35CA3BB1736D2332195BF8DE9F6C6FC2BDF"),
     (818000, "1E28C864FC80211C7394E674C2A9EE2FA76E0C0ED8C28EB77581023E0DEC94FB"),
     (818500, "9E045BBC3ABC38039A41EB59587633632B1FD4779040F9ED94C36E5A2F9D45F7"),
+    (819000, "834E456E2B57C1892D888C21562E30556A2E2ACB2F16A4C820737D901860582C"),
+    (819500, "48DA7CEFF04F13E70ABB467D752F7FCC23F41BAF4220F52270D51D08412AEA97"),
+    (820000, "7BB60BD03094F794CF50EE9CE3D8C0C5F623A34B2E6613A3BF9064F3675DCAF4"),
+    (820500, "655F91250E1CB5EC96E6D37B2869D6C837CE0CDBF4370D865AB215C30399B758"),
+    (821000, "099A954D97A4A600CD118438FDC0F37084408AC79D9E9A892AEE0B7578C1A6C9"),
+    (821500, "429734F0425329F1F9855B0461D6AD2EBAC2FE74BA8AFF18815AD1D048A33C8F"),
+    (822000, "A0FF9DCF722AE549F70C72DD0704F82BE912FCA8036CBC6DEA64F0CCFE330B87"),
+    (822500, "B7FA39CA0C9BA44474AA3C924724F871457FFA9A8460D65579F8D696E6953BD0"),
+    (823000, "434199CEB7E90A03AACE9F8096B841650DA886B21418F6FAE53B91C59D9531A4"),
+    (823500, "33C27FC769C4A450357550DF94273EC8D719E60F33800B5022F0A389EC225A8A"),
+    (824000, "CBC61565C750F39FD9AF3CA7EE2287095836CD97E92ABF0F84DE02CEF6227BFD"),
+    (824500, "56C6747BFAC15656648B265599A11BE664FCAEE09AD6D5E3193905AB18E451F2"),
+    (825000, "FD3BE476C0F023C517CFCE82902C71BC19F0E279BAEC4EC4F5B3BB86CEDA7C54"),
+    (825500, "A2C43FA1EFD2E1EF6BE9EE506FE7DF4788E00019615182E4C60792D23E9967D9"),
+    (826000, "209629A9AB15BAC857EB965F1EF8AEC61C382A76EEE9FDE6B78909A3FF37F633"),
+    (826500, "798F50B4496CC1690603A4CAD2C23545E3B223F934EF9312ACE9D48278704ECA"),
+    (827000, "9D30CABD3EE7659E526DCFDD6C03A288B11F50E02911A8F05E9D00FFB1ED9544"),
+    (827500, "81F05A6E3BE9564292F7F2F76AC049A8505493781F65EC53960CCC5F21396C5E"),
+    (828000, "216CB8734F1E4C34653A4480646695748884759DC7A1BCD369EBB3DB615CBDAA"),
+    (828500, "F6CEFBAF99EBC20AC58FA9A4702C02E4346FA984E20EFA3B1E48959F56392E5F"),
 ];

From 13997ed4e4f8a3c2e3f5cadbe661d6f664a4100d Mon Sep 17 00:00:00 2001
From: Enrico Rubboli <rubboli@gmail.com>
Date: Mon, 5 Oct 2026 11:19:03 +0200
Subject: [PATCH 7/9] chore(release): backfill 1.4.1 changelogs, refresh image
 tag comments

---
 api-server/CHANGELOG.md                            | 2 ++
 build-tools/docker/example-mainnet-dns-server/.env | 2 +-
 build-tools/docker/example-mainnet/.env            | 2 +-
 wasm-wrappers/CHANGELOG.md                         | 2 ++
 4 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/api-server/CHANGELOG.md b/api-server/CHANGELOG.md
index 97c298eee7..6849f4b631 100644
--- a/api-server/CHANGELOG.md
+++ b/api-server/CHANGELOG.md
@@ -6,6 +6,8 @@ The format is loosely based on [Keep a Changelog](https://keepachangelog.com/en/
 
 ## [Unreleased]
 
+## [1.4.1]
+
 ### Added
 - Pending transactions are now served through the regular REST endpoints: `GET /v2/transaction/{id}` falls back to the mempool of the connected node when the transaction is not confirmed yet, and a new `GET /v2/mempool/transactions` endpoint lists the pending transactions (paginated with `offset`/`items`, with an optional `order=dependency` parameter that lists transactions after the transactions they depend on).\
   The responses have the same shape as the confirmed ones, except that for a pending transaction the `block_id`/`timestamp`/`confirmations` fields are `null` (the values are not applicable until the transaction is confirmed), the `fee` field is omitted, and the spent utxos of the inputs are not populated. The decimals of a transferred token are resolved from the api-server storage; if the token is not indexed yet, i.e. its issuance may be pending in the mempool itself, the decimals are taken from the issuing transaction of the mempool listing (fetched only in that case), and a token that cannot be resolved at all is rendered with zero decimals. The endpoints proxy the mempool of the connected node, so the data reflects the view of that node and disappears once the transactions are confirmed, evicted or reorganized away. Unlike the other GET endpoints, the cost of `GET /v2/mempool/transactions` is proportional to the size of the node's mempool (which is capped by the node configuration) rather than the size of the requested page, and `GET /v2/transaction/{id}` pays that cost too when it has to resolve the decimals of a token that is not indexed yet.
diff --git a/build-tools/docker/example-mainnet-dns-server/.env b/build-tools/docker/example-mainnet-dns-server/.env
index c881bbeabb..c8c8d7a7c9 100644
--- a/build-tools/docker/example-mainnet-dns-server/.env
+++ b/build-tools/docker/example-mainnet-dns-server/.env
@@ -4,7 +4,7 @@ COMPOSE_PROJECT_NAME=mintlayer-mainnet-dns-server
 
 # Dockerhub username, from which the docker images will be pulled.
 ML_DOCKERHUB_USERNAME=mintlayer
-# The image tag to use, e.g. "v1.4.0" or "latest".
+# The image tag to use, e.g. "v1.4.1" or "latest".
 ML_DOCKER_IMAGE_TAG=latest
 
 # The user and group ids that will be used to run the software.
diff --git a/build-tools/docker/example-mainnet/.env b/build-tools/docker/example-mainnet/.env
index 52e5e20b0e..e5e1d51aa4 100644
--- a/build-tools/docker/example-mainnet/.env
+++ b/build-tools/docker/example-mainnet/.env
@@ -4,7 +4,7 @@ COMPOSE_PROJECT_NAME=mintlayer-mainnet
 
 # Dockerhub username, from which the docker images will be pulled.
 ML_DOCKERHUB_USERNAME=mintlayer
-# The image tag to use, e.g. "v1.4.0" or "latest".
+# The image tag to use, e.g. "v1.4.1" or "latest".
 ML_DOCKER_IMAGE_TAG=latest
 
 # The user and group ids that will be used to run the software.
diff --git a/wasm-wrappers/CHANGELOG.md b/wasm-wrappers/CHANGELOG.md
index 7a93d048ea..920027dc9b 100644
--- a/wasm-wrappers/CHANGELOG.md
+++ b/wasm-wrappers/CHANGELOG.md
@@ -6,6 +6,8 @@ The format is loosely based on [Keep a Changelog](https://keepachangelog.com/en/
 
 ## [Unreleased]
 
+## [1.4.1]
+
 ### Added
 - `make_default_account_privkey` now accepts an optional BIP39 passphrase as its third
   argument: `make_default_account_privkey(mnemonic, network, passphrase?)`. The passphrase

From a8fb7d64d1af061bf4ed015ea7efa814c4819d45 Mon Sep 17 00:00:00 2001
From: Enrico Rubboli <rubboli@gmail.com>
Date: Mon, 5 Oct 2026 19:25:10 +0200
Subject: [PATCH 8/9] fix(packaging): split rootfs URLs in arch smoke test

---
 packaging/checks/smoke-arch.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/packaging/checks/smoke-arch.sh b/packaging/checks/smoke-arch.sh
index 33dd242f5b..b4fa2415d2 100755
--- a/packaging/checks/smoke-arch.sh
+++ b/packaging/checks/smoke-arch.sh
@@ -138,10 +138,11 @@ echo "foreign-architecture package ($PKG_ARCH on $(uname -m)): smoke-testing in
 mkdir -p "$CHROOT_DIR"
 rootfs_tar=/tmp/alarm.tar.gz
 rc=1
-for url in "$(alarm_rootfs_urls)"; do
+while IFS= read -r url; do
+    [ -n "$url" ] || continue
     echo "downloading ARM rootfs from $url"
     if curl --proto '=https' --tlsv1.2 -sSfL -o "$rootfs_tar" "$url"; then rc=0; break; fi
-done
+done < <(alarm_rootfs_urls)
 [ "$rc" -eq 0 ] || { echo "ERROR: could not download the Arch Linux ARM rootfs" >&2; exit 1; }
 # The rootfs ships device nodes we cannot recreate inside an unprivileged
 # container; skip them. Remaining tar warnings are non-fatal.

From 190cf62c78b98738078837e064e46892f9a6e31b Mon Sep 17 00:00:00 2001
From: Enrico Rubboli <rubboli@gmail.com>
Date: Mon, 5 Oct 2026 23:15:58 +0200
Subject: [PATCH 9/9] fix(packaging): import archlinuxarm ownertrust files in
 arch smoke test

---
 packaging/checks/smoke-arch.sh | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/packaging/checks/smoke-arch.sh b/packaging/checks/smoke-arch.sh
index b4fa2415d2..243d1f7a25 100755
--- a/packaging/checks/smoke-arch.sh
+++ b/packaging/checks/smoke-arch.sh
@@ -161,9 +161,14 @@ cp /proc/self/mounts "$CHROOT_DIR/etc/mtab"
 # process substitution (/dev/fd), which requires a mounted /proc the chroot
 # does not have. The host container's pacman-key can act on the chroot's
 # keyring via --gpgdir once the archlinuxarm keyring is visible to it.
-cp "$CHROOT_DIR/usr/share/pacman/keyrings/archlinuxarm.gpg" /usr/share/pacman/keyrings/
+# The -trusted/-revoked companions are required alongside the keyring:
+# --populate applies ownertrust only from <keyring>-trusted; without it
+# every imported key lands at unknown trust and pacman refuses packages.
+for f in archlinuxarm.gpg archlinuxarm-trusted archlinuxarm-revoked; do
+    cp "$CHROOT_DIR/usr/share/pacman/keyrings/$f" /usr/share/pacman/keyrings/
+done
 pacman-key --gpgdir "$CHROOT_DIR/etc/pacman.d/gnupg" --init >/dev/null
-pacman-key --gpgdir "$CHROOT_DIR/etc/pacman.d/gnupg" --populate archlinuxarm >/dev/null
+pacman-key --gpgdir "$CHROOT_DIR/etc/pacman.d/gnupg" --populate archlinuxarm
 
 # /work is not visible inside the chroot: copy the script, its lib.sh and the
 # package in.