diff --git a/contrib/devtools/verify-evalscript-copy.sh b/contrib/devtools/verify-evalscript-copy.sh
new file mode 100755
index 000000000000..b57f6536325d
--- /dev/null
+++ b/contrib/devtools/verify-evalscript-copy.sh
@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# Copyright (c) 2026 The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+# Verifies that a commit copies EvalScript() without modifying the function body.
+# Usage: ./contrib/devtools/verify-evalscript-copy.sh <commit_hash>
+
+export LC_ALL=C
+
+set -euo pipefail
+
+if [ "$#" -ne 1 ]; then
+    echo "Usage: $0 <commit_hash>"
+    exit 1
+fi
+
+readonly COMMIT="$1"
+readonly PARENT="${COMMIT}^"
+readonly FILE="src/script/interpreter.cpp"
+
+TEMP_DIR=$(mktemp -d "${TMPDIR:-/tmp}/verify-evalscript-copy.XXXXXX")
+readonly TEMP_DIR
+readonly ORIGINAL_BODY="${TEMP_DIR}/original_body"
+readonly COPIED_BODY="${TEMP_DIR}/copied_body"
+
+cleanup() {
+    rm -f "$ORIGINAL_BODY" "$COPIED_BODY"
+    rmdir "$TEMP_DIR"
+}
+trap cleanup EXIT
+
+extract_body() {
+    local revision="$1"
+    local signature_pattern="$2"
+    local output="$3"
+
+    git show "${revision}:${FILE}" | awk -v signature_pattern="$signature_pattern" '
+        complete { next }
+        !found && $0 ~ signature_pattern { found = 1; next }
+        found {
+            print
+            opens = gsub(/{/, "{")
+            closes = gsub(/}/, "}")
+            if (opens > 0) seen_open = 1
+            brace_count += opens - closes
+            if (seen_open && brace_count == 0) complete = 1
+        }
+        END {
+            if (!complete) exit 1
+        }
+    ' > "$output"
+}
+
+echo "=== Verifying EvalScript copy in commit $COMMIT ==="
+
+if ! extract_body "$PARENT" '^bool EvalScript.*ScriptExecutionData& execdata, ScriptError' "$ORIGINAL_BODY"; then
+    echo "ERROR: Could not extract original EvalScript from parent commit"
+    exit 1
+fi
+if ! extract_body "$COMMIT" '^bool EvalScript.*varops_budget' "$COPIED_BODY"; then
+    echo "ERROR: Could not extract copied EvalScript from commit"
+    exit 1
+fi
+
+echo "Original body: $(wc -l < "$ORIGINAL_BODY" | tr -d ' ') lines"
+echo "Copied body:   $(wc -l < "$COPIED_BODY" | tr -d ' ') lines"
+
+if BODY_DIFF=$(diff -u "$ORIGINAL_BODY" "$COPIED_BODY" 2>&1); then
+    echo "SUCCESS: Function bodies are identical"
+else
+    echo "FAILURE: Function bodies differ"
+    echo "$BODY_DIFF"
+    exit 1
+fi
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 865167bbced0..2724dea27dfa 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -120,6 +120,8 @@ add_library(bitcoin_consensus STATIC EXCLUDE_FROM_ALL
   script/interpreter.cpp
   script/script.cpp
   script/script_error.cpp
+  script/valtype_stack.cpp
+  script/val64.cpp
   uint256.cpp
 )
 target_link_libraries(bitcoin_consensus
diff --git a/src/bench/CMakeLists.txt b/src/bench/CMakeLists.txt
index 16eb29250f50..d5faaaa1332c 100644
--- a/src/bench/CMakeLists.txt
+++ b/src/bench/CMakeLists.txt
@@ -52,6 +52,20 @@ add_executable(bench_bitcoin
   xor.cpp
 )
 
+add_executable(bench_varops
+  bench_varops.cpp
+  bench.cpp
+  nanobench.cpp
+)
+
+target_link_libraries(bench_varops
+  core_interface
+  test_util
+  bitcoin_node
+  secp256k1
+  Boost::headers
+)
+
 include(TargetDataSources)
 target_raw_data_sources(bench_bitcoin NAMESPACE benchmark::data
   data/block413567.raw
@@ -82,4 +96,17 @@ add_test(NAME bench_sanity_check_high_priority
   COMMAND bench_bitcoin -sanity-check -priority-level=high
 )
 
+add_test(NAME bench_varops_rejects_unknown_opcode
+  COMMAND bench_varops --silent
+          --opcodes OP_NOP OP_DOES_NOT_EXIST
+)
+set_tests_properties(bench_varops_rejects_unknown_opcode PROPERTIES WILL_FAIL TRUE)
+
+add_test(NAME bench_varops_reports_output_failure
+  COMMAND bench_varops --silent --epochs 1
+          --opcodes OP_NOP
+          --file ${CMAKE_CURRENT_BINARY_DIR}/bench_varops_missing_directory/results.csv
+)
+set_tests_properties(bench_varops_reports_output_failure PROPERTIES WILL_FAIL TRUE)
+
 install_binary_component(bench_bitcoin)
diff --git a/src/bench/bench_varops.cpp b/src/bench/bench_varops.cpp
new file mode 100644
index 000000000000..70842f6da1bf
--- /dev/null
+++ b/src/bench/bench_varops.cpp
@@ -0,0 +1,2435 @@
+// Copyright (c) 2025-2026 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <bench/nanobench.h>
+#include <consensus/consensus.h>
+#include <crypto/sha256.h>
+#include <key.h>
+#include <pubkey.h>
+#include <script/interpreter.h>
+#include <script/script.h>
+#include <script/val64.h>
+#include <script/valtype_stack.h>
+#include <script/varops.h>
+#include <util/fs.h>
+#include <util/strencodings.h>
+#include <util/string.h>
+#include <util/translation.h>
+
+#include <algorithm>
+#include <array>
+#include <chrono>
+#include <cmath>
+#include <cstdio>
+#include <cstring>
+#include <fstream>
+#include <functional>
+#include <iostream>
+#include <limits>
+#include <map>
+#include <memory>
+#include <optional>
+#include <random>
+#include <set>
+#include <sstream>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+#include <tuple>
+#include <utility>
+#include <vector>
+
+#if defined(__APPLE__)
+#include <malloc/malloc.h>
+#elif defined(__GLIBC__)
+#include <malloc.h>
+#endif
+
+const TranslateFn G_TRANSLATION_FUN{nullptr};
+
+namespace {
+
+constexpr size_t SCRIPT_BYTES{MAX_BLOCK_WEIGHT};
+constexpr uint64_t TOTAL_VAROPS_BUDGET{uint64_t{MAX_BLOCK_WEIGHT} * varops::BUDGET_PER_WEIGHT_UNIT};
+constexpr uint64_t MAX_FIXTURE_POOL_BYTES{512U * 1024U * 1024U};
+constexpr size_t MAX_THREE_WAY_ELEMENT_SIZE{(MAX_TAPSCRIPT_V2_TOTAL_STACK_SIZE - 1) / 6};
+constexpr int SIGNATURES_PER_BLOCK{80'000};
+constexpr int SCHNORR_BASELINE_SAMPLES{7};
+constexpr double PROMOTION_THRESHOLD{0.40};
+constexpr uint64_t ROUND_SEED{0x475352};
+constexpr script_verify_flags BENCH_SCRIPT_VERIFY_FLAGS{
+    SCRIPT_VERIFY_CHECKLOCKTIMEVERIFY | SCRIPT_VERIFY_CHECKSEQUENCEVERIFY};
+
+enum class ExecutionDomain {
+    PRE_GSR_TAPSCRIPT,
+    GSR_TAPSCRIPT_V2,
+    RAW_SCHNORR,
+};
+
+enum class HeadlineRole {
+    PRE_BASELINE,
+    NEW_GSR,
+    COMMON_V2,
+    DIAGNOSTIC,
+};
+
+enum class RepeatMode {
+    MAX_SUCCESS,
+    VAROP_REJECTION,
+    FIXED,
+};
+
+enum class SaturationExpectation {
+    SCRIPT_BYTES,
+    VAROPS_BUDGET,
+};
+
+enum class TimingStage {
+    SCHNORR_BASELINE,
+    DISCOVERY,
+    STABLE,
+};
+
+using SaturationBoundary = std::pair<size_t, SaturationExpectation>;
+using SaturationBoundaries = std::array<SaturationBoundary, 2>;
+
+struct Options {
+    std::set<opcodetype> selected_opcodes;
+    int stable_rounds{7};
+    bool silent{false}, list_opcodes{false};
+    std::string output_file;
+};
+
+struct CryptoFixture {
+    ECC_Context ecc_context{};
+    uint256 message{uint256::ONE};
+    XOnlyPubKey pubkey;
+    valtype pubkey_bytes;
+    valtype signature;
+
+    CryptoFixture()
+    {
+        CKey key;
+        std::array<unsigned char, 32> secret{};
+        secret.back() = 1;
+        key.Set(secret.begin(), secret.end(), false);
+        if (!key.IsValid()) {
+            throw std::runtime_error("failed to construct benchmark private key");
+        }
+        pubkey = XOnlyPubKey{key.GetPubKey()};
+        pubkey_bytes.assign(pubkey.begin(), pubkey.end());
+        signature.resize(64);
+        if (!key.SignSchnorr(message, signature, nullptr, message)) {
+            throw std::runtime_error("failed to construct benchmark Schnorr signature");
+        }
+    }
+};
+
+class BenchSignatureChecker final : public BaseSignatureChecker
+{
+public:
+    explicit BenchSignatureChecker(const CryptoFixture& fixture) : m_fixture{fixture} {}
+
+    bool CheckSchnorrSignature(Span<const unsigned char> sig, KeyVersion keyversion,
+                               Span<const unsigned char> pubkey, SigVersion,
+                               ScriptExecutionData&, ScriptError* error) const override
+    {
+        const bool valid_key{keyversion == KeyVersion::TAPROOT &&
+                             pubkey.size() == m_fixture.pubkey_bytes.size() &&
+                             std::equal(pubkey.begin(), pubkey.end(), m_fixture.pubkey_bytes.begin())};
+        const bool valid{valid_key && m_fixture.pubkey.VerifySchnorr(m_fixture.message, sig)};
+        if (!valid && error) *error = SCRIPT_ERR_SCHNORR_SIG;
+        return valid;
+    }
+
+    bool CheckLockTime(const CScriptNum&) const override { return true; }
+    bool CheckSequence(const CScriptNum&) const override { return true; }
+
+private:
+    const CryptoFixture& m_fixture;
+};
+
+using StackFactory = std::function<std::vector<valtype>(const CryptoFixture&)>;
+
+struct CaseOptions {
+    ScriptError expected_error{SCRIPT_ERR_OK};
+    RepeatMode repeat_mode{RepeatMode::MAX_SUCCESS};
+    uint64_t fixed_repetitions{0}, max_repetitions{std::numeric_limits<uint64_t>::max()};
+    std::optional<size_t> cleanup_items;
+    std::string saturation_hint;
+    std::optional<uint64_t> expected_varops_per_repeat;
+    std::optional<SaturationExpectation> expected_saturation;
+};
+
+struct CaseSpec {
+    std::string name;
+    opcodetype opcode{OP_INVALIDOPCODE};
+    std::string opcode_name, sequence_opcodes, operand_shape, operand_pattern;
+    HeadlineRole role{HeadlineRole::DIAGNOSTIC};
+    ScriptError expected_error{SCRIPT_ERR_OK};
+    RepeatMode repeat_mode{RepeatMode::MAX_SUCCESS};
+    uint64_t fixed_repetitions{0}, max_repetitions{std::numeric_limits<uint64_t>::max()};
+    CScript sequence;
+    StackFactory stack_factory;
+    std::optional<size_t> cleanup_items;
+    std::string saturation_hint;
+    std::optional<uint64_t> expected_varops_per_repeat;
+    std::optional<SaturationExpectation> expected_saturation;
+};
+
+struct MaterializedCase {
+    const CaseSpec* spec{nullptr};
+    std::vector<valtype> initial_stack;
+    CScript script;
+    uint64_t repetitions{0}, varops_per_repeat{0};
+    std::string saturation;
+};
+
+struct EvalOutcome {
+    bool success{false};
+    ScriptError error{SCRIPT_ERR_UNKNOWN_ERROR};
+    uint64_t varops_consumed{0};
+};
+
+struct TimingSample {
+    TimingStage stage{TimingStage::DISCOVERY};
+    int round{0};
+    size_t order{0};
+    double wall_sec{0};
+};
+
+struct SampleStats {
+    double median{0}, minimum{0}, maximum{0}, mdape{0};
+};
+
+struct BenchResult {
+    std::string name;
+    double median_sec{0};
+    double mdape{0};
+    uint64_t varops_consumed{0};
+    ExecutionDomain domain{ExecutionDomain::GSR_TAPSCRIPT_V2};
+    HeadlineRole role{HeadlineRole::DIAGNOSTIC};
+    std::string opcode_name;
+    std::string sequence_opcodes;
+    std::string operand_shape;
+    std::string operand_pattern;
+    uint64_t script_bytes{0};
+    uint64_t initial_stack_items{0};
+    uint64_t initial_stack_bytes{0};
+    ScriptError expected_error{SCRIPT_ERR_OK};
+    ScriptError actual_error{SCRIPT_ERR_OK};
+    std::string saturation;
+    uint64_t repetitions{0};
+    uint64_t varops_per_repeat{0};
+    std::optional<TimingStage> aggregate_stage;
+    std::optional<double> discovery_wall_sec;
+    double wall_min_sec{0};
+    double wall_max_sec{0};
+    bool promoted{false};
+    std::vector<std::string> promotion_reasons;
+    std::vector<TimingSample> samples;
+};
+
+struct CorpusCounts {
+    size_t requested_opcodes{0}, generated_cases{0}, completed_cases{0};
+};
+
+struct PromotionSummary {
+    double promotion_cutoff_seconds{0};
+    size_t promoted_cases{0};
+};
+
+using ItemFactory = std::function<valtype()>;
+
+static std::string DomainName(ExecutionDomain domain)
+{
+    switch (domain) {
+    case ExecutionDomain::PRE_GSR_TAPSCRIPT: return "pre-gsr-tapscript-v1";
+    case ExecutionDomain::GSR_TAPSCRIPT_V2: return "gsr-tapscript-v2";
+    case ExecutionDomain::RAW_SCHNORR: return "raw-schnorr";
+    }
+    return "unknown";
+}
+
+static std::string RoleName(HeadlineRole role)
+{
+    switch (role) {
+    case HeadlineRole::PRE_BASELINE: return "pre-baseline";
+    case HeadlineRole::NEW_GSR: return "new-gsr";
+    case HeadlineRole::COMMON_V2: return "common-v2";
+    case HeadlineRole::DIAGNOSTIC: return "diagnostic";
+    }
+    return "unknown";
+}
+
+static ExecutionDomain DomainFor(HeadlineRole role) { return role == HeadlineRole::PRE_BASELINE ? ExecutionDomain::PRE_GSR_TAPSCRIPT : ExecutionDomain::GSR_TAPSCRIPT_V2; }
+
+static std::string FormatBytes(uint64_t bytes)
+{
+    if (bytes >= 1024 * 1024 && bytes % (1024 * 1024) == 0) {
+        return strprintf("%uMB", bytes / (1024 * 1024));
+    }
+    if (bytes >= 1024 && bytes % 1024 == 0) {
+        return strprintf("%uKB", bytes / 1024);
+    }
+    return strprintf("%uB", bytes);
+}
+
+static std::string OpcodeName(opcodetype opcode)
+{
+    return opcode == OP_0 ? "OP_0" : GetOpName(opcode);
+}
+
+static std::string SequenceOpcodeNames(const CScript& sequence)
+{
+    std::string names;
+    CScript::const_iterator pc{sequence.begin()};
+    while (pc != sequence.end()) {
+        opcodetype opcode;
+        valtype pushed_data;
+        if (!sequence.GetOp(pc, opcode, pushed_data)) {
+            throw std::runtime_error("invalid benchmark sequence");
+        }
+
+        if (!names.empty()) names += "+";
+        if (opcode == OP_0) {
+            names += "OP_0";
+        } else if (opcode > OP_0 && opcode < OP_PUSHDATA1) {
+            names += strprintf("OP_PUSHBYTES_%u", pushed_data.size());
+        } else if (opcode == OP_1NEGATE) {
+            names += "OP_1NEGATE";
+        } else if (opcode >= OP_1 && opcode <= OP_16) {
+            names += strprintf("OP_%u", CScript::DecodeOP_N(opcode));
+        } else {
+            names += GetOpName(opcode);
+        }
+    }
+    return names;
+}
+
+static valtype PaddedNumber(uint64_t value, size_t size)
+{
+    valtype bytes(std::max<size_t>(size, 1), 0);
+    for (size_t i{0}; i < std::min<size_t>(sizeof(value), bytes.size()); ++i) {
+        bytes[i] = static_cast<unsigned char>(value & 0xff);
+        value >>= 8;
+    }
+    if (size == 0) bytes.clear();
+    return bytes;
+}
+
+static valtype PatternBytes(size_t size, std::string_view pattern)
+{
+    if (pattern == "zero") return valtype(size, 0x00);
+    if (pattern == "one-low" || pattern == "padded-low") return PaddedNumber(1, size);
+    if (pattern == "late-nonzero") {
+        valtype out(size, 0x00);
+        if (!out.empty()) out.back() = 0x01;
+        return out;
+    }
+    if (pattern == "alternating") {
+        valtype out(size);
+        for (size_t i{0}; i < size; ++i)
+            out[i] = (i & 1) ? 0x55 : 0xaa;
+        return out;
+    }
+    return valtype(size, 0xff);
+}
+
+static uint64_t StackPayloadBytes(const std::vector<valtype>& stack)
+{
+    uint64_t total{0};
+    for (const valtype& item : stack)
+        total += item.size();
+    return total;
+}
+
+static uint64_t StackFixtureBytes(const std::vector<valtype>& stack) { return StackPayloadBytes(stack) + uint64_t{stack.size()} * sizeof(valtype); }
+
+static void ReleaseAllocatorCaches()
+{
+#if defined(__APPLE__)
+    malloc_zone_pressure_relief(nullptr, 0);
+#elif defined(__GLIBC__)
+    malloc_trim(0);
+#endif
+}
+
+static bool InitialStackAllowed(ExecutionDomain domain, const std::vector<valtype>& stack)
+{
+    if (domain == ExecutionDomain::RAW_SCHNORR) return stack.empty();
+    if (domain == ExecutionDomain::PRE_GSR_TAPSCRIPT) {
+        if (stack.size() > MAX_STACK_SIZE) return false;
+        return std::ranges::all_of(stack, [](const valtype& item) {
+            return item.size() <= MAX_SCRIPT_ELEMENT_SIZE;
+        });
+    }
+
+    if (stack.size() > MAX_TAPSCRIPT_V2_STACK_SIZE) return false;
+    uint64_t total{0};
+    for (const valtype& item : stack) {
+        if (item.size() > MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE) return false;
+        if (item.size() > MAX_TAPSCRIPT_V2_TOTAL_STACK_SIZE - total) return false;
+        total += item.size();
+    }
+    return true;
+}
+
+static bool NumericOperandAllowed(ExecutionDomain domain, size_t size, bool timelock)
+{
+    if (domain == ExecutionDomain::GSR_TAPSCRIPT_V2) {
+        return size <= MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE;
+    }
+    return size <= (timelock ? 5U : 4U);
+}
+
+static SaturationBoundaries FindCrossoverPair(size_t sequence_bytes, size_t cleanup_items, size_t maximum,
+                                              const std::function<uint64_t(size_t)>& sequence_cost)
+{
+    if (sequence_bytes == 0 || cleanup_items + 1 >= SCRIPT_BYTES || maximum < 2) {
+        throw std::runtime_error("invalid crossover search bounds");
+    }
+    const uint64_t script_limit{(SCRIPT_BYTES - cleanup_items - 1) / sequence_bytes};
+    const uint64_t available_budget{TOTAL_VAROPS_BUDGET - varops::CompareZeroCost(1)};
+    const auto script_limited = [&](size_t size) {
+        const uint64_t cost{sequence_cost(size)};
+        return cost == 0 || available_budget / cost >= script_limit;
+    };
+    if (!script_limited(1) || script_limited(maximum)) {
+        throw std::runtime_error("crossover search does not bracket a transition");
+    }
+
+    size_t low{1};
+    size_t high{maximum};
+    while (low < high) {
+        const size_t mid{low + (high - low) / 2};
+        if (script_limited(mid)) {
+            low = mid + 1;
+        } else {
+            high = mid;
+        }
+    }
+    return {{{low - 1, SaturationExpectation::SCRIPT_BYTES},
+             {low, SaturationExpectation::VAROPS_BUDGET}}};
+}
+
+static std::string_view SaturationName(SaturationExpectation expectation) { return expectation == SaturationExpectation::SCRIPT_BYTES ? "script-bytes" : "varops-budget"; }
+static void Check(bool condition, std::string_view error)
+{
+    if (!condition) throw std::runtime_error(std::string{error});
+}
+
+static void RunBoundarySelfChecks()
+{
+    const std::vector<valtype> pre_1000(MAX_STACK_SIZE, valtype{});
+    const std::vector<valtype> pre_1001(MAX_STACK_SIZE + 1, valtype{});
+    const std::vector<valtype> v2_32768(MAX_TAPSCRIPT_V2_STACK_SIZE, valtype{});
+    const std::vector<valtype> v2_32769(MAX_TAPSCRIPT_V2_STACK_SIZE + 1, valtype{});
+    Check(InitialStackAllowed(ExecutionDomain::PRE_GSR_TAPSCRIPT, pre_1000) &&
+              !InitialStackAllowed(ExecutionDomain::PRE_GSR_TAPSCRIPT, pre_1001) &&
+              InitialStackAllowed(ExecutionDomain::GSR_TAPSCRIPT_V2, v2_32768) &&
+              !InitialStackAllowed(ExecutionDomain::GSR_TAPSCRIPT_V2, v2_32769) &&
+              InitialStackAllowed(ExecutionDomain::PRE_GSR_TAPSCRIPT, {valtype(520)}) &&
+              !InitialStackAllowed(ExecutionDomain::PRE_GSR_TAPSCRIPT, {valtype(521)}) &&
+              InitialStackAllowed(ExecutionDomain::GSR_TAPSCRIPT_V2, {valtype(521)}),
+          "internal initial-stack boundary classification failed");
+    Check(NumericOperandAllowed(ExecutionDomain::PRE_GSR_TAPSCRIPT, 4, false) &&
+              !NumericOperandAllowed(ExecutionDomain::PRE_GSR_TAPSCRIPT, 5, false) &&
+              NumericOperandAllowed(ExecutionDomain::PRE_GSR_TAPSCRIPT, 5, true) &&
+              NumericOperandAllowed(ExecutionDomain::GSR_TAPSCRIPT_V2, 521, false),
+          "internal numeric boundary classification failed");
+    const auto crossover{FindCrossoverPair(1, 1, 10'000, [](size_t size) { return 2 * size; })};
+    Check(crossover[0].first == 5'000 && crossover[1].first == 5'001,
+          "internal crossover classification failed");
+    Check(6 * MAX_THREE_WAY_ELEMENT_SIZE + 1 <= MAX_TAPSCRIPT_V2_TOTAL_STACK_SIZE &&
+              6 * (MAX_THREE_WAY_ELEMENT_SIZE + 1) + 1 > MAX_TAPSCRIPT_V2_TOTAL_STACK_SIZE,
+          "internal three-way stack boundary classification failed");
+}
+
+struct PreparedExecution {
+    std::vector<valtype> legacy_stack;
+    std::optional<ValtypeStack> v2_stack;
+    ScriptExecutionData execdata;
+    std::unique_ptr<varops::Budget> budget;
+};
+
+static PreparedExecution PrepareExecution(const MaterializedCase& test_case, bool timed = false)
+{
+    PreparedExecution execution;
+    execution.execdata.m_internal_key = XOnlyPubKey::NUMS_H;
+    const bool legacy{DomainFor(test_case.spec->role) == ExecutionDomain::PRE_GSR_TAPSCRIPT};
+    if (legacy || timed) {
+        execution.execdata.m_validation_weight_left = MAX_BLOCK_WEIGHT;
+        execution.execdata.m_validation_weight_left_init = true;
+    }
+    if (legacy) {
+        execution.legacy_stack = test_case.initial_stack;
+    } else {
+        execution.v2_stack.emplace(test_case.initial_stack);
+        execution.budget = std::make_unique<varops::Budget>(TOTAL_VAROPS_BUDGET);
+    }
+    return execution;
+}
+
+static EvalOutcome ExecutePrepared(const MaterializedCase& test_case, const BenchSignatureChecker& checker,
+                                   PreparedExecution& execution)
+{
+    EvalOutcome outcome;
+    ScriptError error{SCRIPT_ERR_UNKNOWN_ERROR};
+    if (DomainFor(test_case.spec->role) == ExecutionDomain::PRE_GSR_TAPSCRIPT) {
+        bool success{EvalScript(execution.legacy_stack, test_case.script, BENCH_SCRIPT_VERIFY_FLAGS,
+                                checker, SigVersion::TAPSCRIPT, execution.execdata, &error)};
+        if (success && execution.legacy_stack.size() != 1) {
+            success = false;
+            error = SCRIPT_ERR_CLEANSTACK;
+        } else if (success && !CastToBool(execution.legacy_stack.back())) {
+            success = false;
+            error = SCRIPT_ERR_EVAL_FALSE;
+        }
+        outcome.success = success;
+        outcome.error = success ? SCRIPT_ERR_OK : error;
+        return outcome;
+    }
+
+    bool success{EvalTapscriptV2(*execution.v2_stack, test_case.script, BENCH_SCRIPT_VERIFY_FLAGS,
+                                 checker, execution.execdata, *execution.budget, &error)};
+    if (success) success = CheckTapscriptV2ScriptResult(*execution.v2_stack, *execution.budget, &error);
+    outcome.success = success;
+    outcome.error = error;
+    outcome.varops_consumed = TOTAL_VAROPS_BUDGET - *execution.budget->Remaining();
+    return outcome;
+}
+
+static EvalOutcome Evaluate(const MaterializedCase& test_case, const BenchSignatureChecker& checker)
+{
+    PreparedExecution execution{PrepareExecution(test_case)};
+    return ExecutePrepared(test_case, checker, execution);
+}
+
+static CScript BuildScript(const CScript& sequence, uint64_t repetitions, size_t cleanup_items)
+{
+    if (cleanup_items >= SCRIPT_BYTES) throw std::runtime_error("cleanup suffix exceeds script envelope");
+    const size_t suffix_size{cleanup_items + 1};
+    if (!sequence.empty() && repetitions > (SCRIPT_BYTES - suffix_size) / sequence.size()) {
+        throw std::runtime_error("sequence repetitions exceed script envelope");
+    }
+
+    CScript script;
+    script.reserve(SCRIPT_BYTES);
+    for (uint64_t i{0}; i < repetitions; ++i) {
+        script.insert(script.end(), sequence.begin(), sequence.end());
+    }
+    const size_t padding{SCRIPT_BYTES - script.size() - suffix_size};
+    script.insert(script.end(), padding, static_cast<unsigned char>(OP_NOP));
+    script.insert(script.end(), cleanup_items, static_cast<unsigned char>(OP_DROP));
+    script << OP_1;
+    if (script.size() != SCRIPT_BYTES) throw std::runtime_error("script envelope construction failed");
+    return script;
+}
+
+static uint64_t CalibrateRepeatVarops(const CaseSpec& spec, const std::vector<valtype>& stack,
+                                      const BenchSignatureChecker& checker)
+{
+    if (DomainFor(spec.role) != ExecutionDomain::GSR_TAPSCRIPT_V2 || spec.sequence.empty()) return 0;
+    MaterializedCase calibration;
+    calibration.spec = &spec;
+    calibration.initial_stack = stack;
+    calibration.repetitions = 1;
+    calibration.script = spec.sequence;
+    const size_t cleanup_items{spec.cleanup_items.value_or(stack.size())};
+    calibration.script.insert(calibration.script.end(), cleanup_items, static_cast<unsigned char>(OP_DROP));
+    calibration.script << OP_1;
+    const EvalOutcome outcome{Evaluate(calibration, checker)};
+    if (!outcome.success || outcome.error != SCRIPT_ERR_OK) {
+        throw std::runtime_error(strprintf("one-sequence calibration failed for %s: %s",
+                                           spec.name, ScriptErrorString(outcome.error)));
+    }
+    const uint64_t final_cost{varops::CompareZeroCost(1)};
+    if (outcome.varops_consumed < final_cost) {
+        throw std::runtime_error("calibration consumed less than the final-result cost");
+    }
+    return outcome.varops_consumed - final_cost;
+}
+
+static MaterializedCase Materialize(const CaseSpec& spec, const CryptoFixture& fixture)
+{
+    MaterializedCase materialized;
+    materialized.spec = &spec;
+    materialized.initial_stack = spec.stack_factory(fixture);
+    if (!InitialStackAllowed(DomainFor(spec.role), materialized.initial_stack)) {
+        throw std::runtime_error(strprintf("%s has an invalid initial stack for %s",
+                                           spec.name, DomainName(DomainFor(spec.role))));
+    }
+
+    const size_t cleanup_items{spec.cleanup_items.value_or(materialized.initial_stack.size())};
+    const size_t suffix_size{cleanup_items + 1};
+    const uint64_t script_limit{spec.sequence.empty() ? 0 : (SCRIPT_BYTES - suffix_size) / spec.sequence.size()};
+    BenchSignatureChecker checker{fixture};
+    if (spec.expected_error == SCRIPT_ERR_OK || spec.repeat_mode == RepeatMode::VAROP_REJECTION) {
+        materialized.varops_per_repeat = CalibrateRepeatVarops(spec, materialized.initial_stack, checker);
+    }
+    if (spec.expected_varops_per_repeat && materialized.varops_per_repeat != *spec.expected_varops_per_repeat) {
+        throw std::runtime_error(strprintf("sequence varops mismatch for %s: expected %u, got %u",
+                                           spec.name, *spec.expected_varops_per_repeat,
+                                           materialized.varops_per_repeat));
+    }
+
+    if (spec.repeat_mode == RepeatMode::FIXED) {
+        materialized.repetitions = spec.fixed_repetitions;
+        materialized.saturation = spec.saturation_hint;
+    } else if (spec.repeat_mode == RepeatMode::VAROP_REJECTION) {
+        if (materialized.varops_per_repeat == 0) {
+            throw std::runtime_error(strprintf("%s requests varops rejection with a zero-cost sequence", spec.name));
+        }
+        materialized.repetitions = TOTAL_VAROPS_BUDGET / materialized.varops_per_repeat + 1;
+        materialized.saturation = "varops-limit";
+    } else {
+        uint64_t budget_limit{std::numeric_limits<uint64_t>::max()};
+        if (DomainFor(spec.role) == ExecutionDomain::GSR_TAPSCRIPT_V2 && materialized.varops_per_repeat != 0) {
+            const uint64_t final_cost{varops::CompareZeroCost(1)};
+            budget_limit = (TOTAL_VAROPS_BUDGET - final_cost) / materialized.varops_per_repeat;
+        }
+        materialized.repetitions = std::min({script_limit, budget_limit, spec.max_repetitions});
+        if (materialized.repetitions == budget_limit && budget_limit < script_limit) {
+            materialized.saturation = "varops-budget";
+        } else if (materialized.repetitions == spec.max_repetitions && spec.max_repetitions < script_limit) {
+            materialized.saturation = spec.saturation_hint.empty() ? "explicit-limit" : spec.saturation_hint;
+        } else {
+            materialized.saturation = "script-bytes";
+        }
+    }
+
+    if (spec.expected_saturation && materialized.saturation != SaturationName(*spec.expected_saturation)) {
+        throw std::runtime_error(strprintf("saturation mismatch for %s: expected %s, got %s",
+                                           spec.name, SaturationName(*spec.expected_saturation),
+                                           materialized.saturation));
+    }
+
+    if (!spec.sequence.empty() && materialized.repetitions == 0) {
+        throw std::runtime_error(strprintf("%s cannot execute its target sequence", spec.name));
+    }
+    if (!spec.sequence.empty() && materialized.repetitions > script_limit) {
+        throw std::runtime_error(strprintf("%s cannot reach its requested termination inside 4MB", spec.name));
+    }
+    materialized.script = BuildScript(spec.sequence, materialized.repetitions, cleanup_items);
+    return materialized;
+}
+
+static bool IsResourceError(ScriptError error)
+{
+    switch (error) {
+    case SCRIPT_ERR_STACK_SIZE:
+    case SCRIPT_ERR_PUSH_SIZE:
+    case SCRIPT_ERR_TAPSCRIPT_VALIDATION_WEIGHT:
+    case SCRIPT_ERR_VAROP_COUNT:
+    case SCRIPT_ERR_TOTAL_STACK_SIZE:
+    case SCRIPT_ERR_STACK_ELEMENT_SIZE:
+    case SCRIPT_ERR_HASH_OPERAND_SIZE:
+        return true;
+    default:
+        return false;
+    }
+}
+
+static CScript Ops(std::initializer_list<opcodetype> opcodes)
+{
+    CScript script;
+    for (const opcodetype opcode : opcodes)
+        script << opcode;
+    return script;
+}
+
+static void AddCase(std::vector<CaseSpec>& specs, opcodetype opcode, HeadlineRole role,
+                    std::string case_label, std::string shape,
+                    std::string pattern, CScript sequence, StackFactory stack_factory,
+                    CaseOptions options = {})
+{
+    const std::string opcode_name{OpcodeName(opcode)};
+    const std::string sequence_opcodes{SequenceOpcodeNames(sequence)};
+    const std::string name{strprintf("%s/%s/%s/%s/%s/%s/%s", DomainName(DomainFor(role)), opcode_name,
+                                     sequence_opcodes, case_label, shape, pattern, ScriptErrorString(options.expected_error))};
+    specs.push_back({name, opcode, opcode_name, sequence_opcodes, std::move(shape), std::move(pattern),
+                     role, options.expected_error, options.repeat_mode,
+                     options.fixed_repetitions, options.max_repetitions, std::move(sequence),
+                     std::move(stack_factory), options.cleanup_items, std::move(options.saturation_hint),
+                     options.expected_varops_per_repeat, options.expected_saturation});
+}
+
+static CaseOptions FixedCase(ScriptError error, uint64_t repetitions, std::optional<size_t> cleanup_items,
+                             std::string saturation)
+{
+    CaseOptions options{};
+    options.expected_error = error;
+    options.repeat_mode = RepeatMode::FIXED;
+    options.fixed_repetitions = repetitions;
+    options.max_repetitions = repetitions;
+    options.cleanup_items = cleanup_items;
+    options.saturation_hint = std::move(saturation);
+    return options;
+}
+
+static CaseOptions VaropsRejection(std::optional<uint64_t> expected_cost = std::nullopt)
+{
+    CaseOptions options{};
+    options.expected_error = SCRIPT_ERR_VAROP_COUNT;
+    options.repeat_mode = RepeatMode::VAROP_REJECTION;
+    options.expected_varops_per_repeat = expected_cost;
+    return options;
+}
+
+static ItemFactory CompactItem(valtype item)
+{
+    const size_t size{item.size()};
+    if (item.size() <= 1024) {
+        return [item = std::move(item)] { return item; };
+    }
+
+    if (std::ranges::all_of(item, [&](unsigned char byte) { return byte == item.front(); })) {
+        const unsigned char fill{item.front()};
+        return [size, fill] { return valtype(size, fill); };
+    }
+
+    if (std::ranges::all_of(item, [index = size_t{0}](unsigned char byte) mutable {
+            return byte == ((index++ & 1) ? 0x55 : 0xaa);
+        })) {
+        return [size] {
+            valtype expanded(size);
+            for (size_t index{0}; index < size; ++index)
+                expanded[index] = (index & 1) ? 0x55 : 0xaa;
+            return expanded;
+        };
+    }
+
+    std::vector<std::pair<size_t, unsigned char>> exceptions;
+    for (size_t index{0}; index < size; ++index) {
+        if (item[index] != 0) exceptions.emplace_back(index, item[index]);
+        if (exceptions.size() > 64) {
+            return [item = std::move(item)] { return item; };
+        }
+    }
+    return [size, exceptions = std::move(exceptions)] {
+        valtype expanded(size, 0);
+        for (const auto& [index, byte] : exceptions) {
+            expanded[index] = byte;
+        }
+        return expanded;
+    };
+}
+
+static StackFactory FixedStack(std::vector<valtype> stack)
+{
+    const uint64_t expanded_bytes{StackPayloadBytes(stack)};
+    std::vector<ItemFactory> factories;
+    factories.reserve(stack.size());
+    for (valtype& item : stack)
+        factories.push_back(CompactItem(std::move(item)));
+    stack.clear();
+    stack.shrink_to_fit();
+    if (expanded_bytes >= 1024U * 1024U) ReleaseAllocatorCaches();
+    return [factories = std::move(factories)](const CryptoFixture&) {
+        std::vector<valtype> expanded;
+        expanded.reserve(factories.size());
+        for (const ItemFactory& factory : factories)
+            expanded.push_back(factory());
+        return expanded;
+    };
+}
+
+static void AddPreAndV2Cases(std::vector<CaseSpec>& specs, opcodetype opcode,
+                             std::string case_label, std::string shape, std::string pattern,
+                             const CScript& sequence, StackFactory factory)
+{
+    AddCase(specs, opcode, HeadlineRole::PRE_BASELINE,
+            case_label, shape, pattern, sequence, factory);
+    AddCase(specs, opcode, HeadlineRole::COMMON_V2,
+            std::move(case_label), std::move(shape), std::move(pattern), sequence, std::move(factory));
+}
+
+static void AddCostCase(std::vector<CaseSpec>& specs, opcodetype opcode, HeadlineRole role,
+                        std::string case_label, std::string shape, std::string pattern,
+                        const CScript& sequence, StackFactory factory, uint64_t expected_varops_per_repeat,
+                        std::optional<SaturationExpectation> expected_saturation = std::nullopt)
+{
+    CaseOptions options{};
+    options.expected_varops_per_repeat = expected_varops_per_repeat;
+    options.expected_saturation = expected_saturation;
+    AddCase(specs, opcode, role, std::move(case_label), std::move(shape), std::move(pattern),
+            sequence, std::move(factory), std::move(options));
+}
+
+template <typename Cost, typename Stack, typename Shape>
+static void AddCostCrossovers(std::vector<CaseSpec>& specs, opcodetype opcode,
+                              std::string_view label, std::string_view pattern,
+                              const CScript& sequence, size_t cleanup_items, size_t maximum,
+                              Cost cost, Stack stack, Shape shape)
+{
+    for (const auto& [size, saturation] :
+         FindCrossoverPair(sequence.size(), cleanup_items, maximum, cost)) {
+        AddCostCase(specs, opcode, HeadlineRole::NEW_GSR, std::string{label}, shape(size),
+                    std::string{pattern}, sequence, stack(size), cost(size), saturation);
+    }
+}
+
+static CScript OneToOneSequence(opcodetype opcode, bool three_way) { return three_way ? Ops({OP_3DUP, opcode, OP_DROP, opcode, OP_DROP, opcode, OP_DROP}) : Ops({OP_DUP, opcode, OP_DROP}); }
+
+static uint64_t OneToOneTargetCost(opcodetype opcode, size_t size)
+{
+    switch (opcode) {
+    case OP_1ADD: return varops::AddCost(size, 1);
+    case OP_1SUB: return varops::SubCost(size, 1);
+    case OP_NOT:
+    case OP_0NOTEQUAL: return varops::CompareZeroCost(size);
+    case OP_INVERT: return varops::InvertCost(size);
+    case OP_2MUL: return varops::TwoMulCost(size);
+    case OP_2DIV: return varops::TwoDivCost(size);
+    case OP_RIPEMD160:
+    case OP_SHA1: return 0;
+    case OP_SHA256:
+    case OP_HASH160:
+    case OP_HASH256: return size * varops::COST_HASH;
+    default: throw std::runtime_error("unsupported one-to-one opcode");
+    }
+}
+
+static uint64_t OneToOneSequenceCost(opcodetype opcode, size_t size, bool three_way)
+{
+    const uint64_t transforms{three_way ? 3U : 1U};
+    return transforms * size * varops::COST_COPYING +
+           transforms * OneToOneTargetCost(opcode, size);
+}
+
+static uint64_t TruthCopyCost(size_t size) { return size * varops::COST_COPYING + varops::CompareZeroCost(size); }
+static StackFactory OneToOneStack(size_t size, std::string_view pattern, bool three_way) { return FixedStack(std::vector<valtype>(three_way ? 3U : 1U, PatternBytes(size, pattern))); }
+
+static void AddOneToOneSpec(std::vector<CaseSpec>& specs, opcodetype opcode, HeadlineRole role,
+                            std::string_view family, size_t size, std::string pattern, bool three_way,
+                            std::optional<SaturationExpectation> expected_saturation = std::nullopt)
+{
+    const CScript sequence{OneToOneSequence(opcode, three_way)};
+    const std::string case_label{strprintf("%s-%s", family, three_way ? "3way" : "single")};
+    const std::optional<uint64_t> expected_varops_per_repeat{
+        DomainFor(role) == ExecutionDomain::GSR_TAPSCRIPT_V2 ? std::optional<uint64_t>{OneToOneSequenceCost(opcode, size, three_way)} : std::nullopt};
+    StackFactory factory{OneToOneStack(size, pattern, three_way)};
+    CaseOptions options{};
+    options.expected_varops_per_repeat = expected_varops_per_repeat;
+    options.expected_saturation = expected_saturation;
+    AddCase(specs, opcode, role, case_label, FormatBytes(size), std::move(pattern), sequence,
+            std::move(factory), std::move(options));
+}
+
+static void AddOneToOneCrossovers(std::vector<CaseSpec>& specs, opcodetype opcode,
+                                  HeadlineRole role, std::string_view label, std::string_view pattern,
+                                  size_t maximum, bool three_way,
+                                  std::optional<HeadlineRole> script_role = std::nullopt)
+{
+    const CScript sequence{OneToOneSequence(opcode, three_way)};
+    const auto cost{[=](size_t size) { return OneToOneSequenceCost(opcode, size, three_way); }};
+    for (const auto& [size, saturation] :
+         FindCrossoverPair(sequence.size(), three_way ? 3 : 1, maximum, cost)) {
+        if (script_role) {
+            AddOneToOneSpec(specs, opcode, *script_role, label, size, std::string{pattern},
+                            three_way, SaturationExpectation::SCRIPT_BYTES);
+        }
+        AddOneToOneSpec(specs, opcode, role, label, size, std::string{pattern}, three_way, saturation);
+    }
+}
+
+static std::vector<size_t> SelectSizes(std::initializer_list<size_t> full,
+                                       size_t maximum = std::numeric_limits<size_t>::max())
+{
+    std::vector<size_t> sizes{full};
+    std::erase_if(sizes, [maximum](size_t size) { return size > maximum; });
+    std::sort(sizes.begin(), sizes.end());
+    sizes.erase(std::unique(sizes.begin(), sizes.end()), sizes.end());
+    return sizes;
+}
+
+static std::vector<size_t> PreDataSizes() { return SelectSizes({0, 1, 3, 4, 5, 7, 8, 9, 15, 16, 17, 519, 520}); }
+static std::vector<size_t> PreNumericSizes() { return SelectSizes({1, 3, 4}); }
+static std::vector<size_t> PreCompareSizes() { return SelectSizes({0, 1, 3, 4, 5, 7, 8, 9, 16, 17, 519, 520}); }
+static std::vector<size_t> V2NumericSizes(size_t maximum) { return SelectSizes({5, 7, 8, 9, 15, 16, 17, 519, 520, 521, 1024, 4096, 65536, 262144, 1048576, 2000000, maximum}, maximum); }
+static std::vector<size_t> V2LargeSizes(size_t maximum) { return SelectSizes({521, 1024, 4096, 65536, 262144, 1048576, 2000000, maximum}, maximum); }
+
+static void AddUnaryDataCases(std::vector<CaseSpec>& specs, opcodetype opcode,
+                              bool restored, size_t maximum = MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE)
+{
+    if (!restored) {
+        for (size_t size : PreNumericSizes()) {
+            const std::string pattern{"padded-low"};
+            AddOneToOneSpec(specs, opcode, HeadlineRole::PRE_BASELINE,
+                            "unary-preserve", size, pattern, true);
+            AddOneToOneSpec(specs, opcode, HeadlineRole::COMMON_V2,
+                            "unary-preserve", size, pattern, true);
+        }
+    }
+    for (size_t size : V2NumericSizes(maximum)) {
+        const std::string pattern{size == maximum ? "late-nonzero" : "padded-low"};
+        AddOneToOneSpec(specs, opcode, HeadlineRole::NEW_GSR, "unary-preserve", size,
+                        pattern, size <= MAX_THREE_WAY_ELEMENT_SIZE);
+    }
+    if ((opcode == OP_2MUL || opcode == OP_2DIV)) {
+        AddOneToOneSpec(specs, opcode, HeadlineRole::NEW_GSR, "unary-preserve", maximum,
+                        "padded-low", false);
+    }
+    AddOneToOneCrossovers(specs, opcode, HeadlineRole::NEW_GSR, "unary-crossover",
+                          "padded-low", MAX_THREE_WAY_ELEMENT_SIZE, true);
+    AddOneToOneCrossovers(specs, opcode, HeadlineRole::NEW_GSR, "unary-crossover-control",
+                          "padded-low", MAX_THREE_WAY_ELEMENT_SIZE, false);
+
+    AddOneToOneSpec(specs, opcode, HeadlineRole::NEW_GSR, "unary-batch-boundary",
+                    MAX_THREE_WAY_ELEMENT_SIZE, "dense", true);
+}
+
+static void AddBinaryDataCases(std::vector<CaseSpec>& specs, opcodetype opcode,
+                               bool restored, size_t maximum = 2'000'000)
+{
+    const bool verify_opcode{opcode == OP_EQUALVERIFY || opcode == OP_NUMEQUALVERIFY};
+    const bool byte_compare{opcode == OP_EQUAL || opcode == OP_EQUALVERIFY};
+    const CScript sequence{verify_opcode ? Ops({OP_2DUP, opcode}) : Ops({OP_2DUP, opcode, OP_DROP})};
+    if (!restored) {
+        for (size_t size : byte_compare ? PreCompareSizes() : PreNumericSizes()) {
+            const std::string pattern{opcode == OP_EQUAL || opcode == OP_EQUALVERIFY ? "equal" : "padded-low"};
+            valtype first{PatternBytes(size, pattern == "equal" ? "alternating" : "padded-low")};
+            valtype second{first};
+            if (opcode == OP_SUB) first = PaddedNumber(3, size);
+            if (opcode == OP_SUB) second = PaddedNumber(1, size);
+            AddPreAndV2Cases(specs, opcode, "binary-preserve", FormatBytes(size) + "x" + FormatBytes(size),
+                             pattern, sequence, FixedStack({first, second}));
+        }
+    }
+    for (size_t size : byte_compare ? V2LargeSizes(maximum) : V2NumericSizes(maximum)) {
+        valtype first{PatternBytes(size, "alternating")};
+        valtype second{first};
+        if (opcode == OP_SUB) {
+            first = PaddedNumber(3, size);
+            second = PaddedNumber(1, size);
+        }
+        AddCase(specs, opcode, HeadlineRole::NEW_GSR,
+                "binary-preserve", FormatBytes(size) + "x" + FormatBytes(size), "equal-dense",
+                sequence, FixedStack({first, second}));
+    }
+    if ((opcode == OP_MIN || opcode == OP_MAX)) {
+        AddCase(specs, opcode, HeadlineRole::NEW_GSR,
+                "binary-preserve", FormatBytes(maximum) + "x" + FormatBytes(maximum), "equal-padded-low",
+                sequence, FixedStack({PaddedNumber(1, maximum), PaddedNumber(1, maximum)}));
+    }
+    if (maximum >= 65536 && opcode != OP_EQUALVERIFY) {
+        const bool numeric_verify{opcode == OP_NUMEQUALVERIFY};
+        const bool subtraction{opcode == OP_SUB};
+        AddCase(specs, opcode, HeadlineRole::NEW_GSR,
+                "binary-preserve", "64KBx1B", "asymmetric-long-short", sequence,
+                FixedStack({subtraction ? PaddedNumber(3, 65536) : (numeric_verify ? PaddedNumber(1, 65536) : PatternBytes(65536, "alternating")),
+                            subtraction ? PaddedNumber(1, 1) : PatternBytes(1, "one-low")}));
+        AddCase(specs, opcode, HeadlineRole::NEW_GSR,
+                "binary-preserve", "1Bx64KB", "asymmetric-short-long", sequence,
+                FixedStack({subtraction ? PaddedNumber(3, 1) : PatternBytes(1, "one-low"),
+                            subtraction ? PaddedNumber(1, 65536) : (numeric_verify ? PaddedNumber(1, 65536) : PatternBytes(65536, "alternating"))}));
+    }
+}
+
+static void AddStackOpcodeCases(std::vector<CaseSpec>& specs, opcodetype opcode)
+{
+    const auto add_shared_case = [&](std::string case_label, CScript sequence, std::vector<valtype> stack) {
+        AddPreAndV2Cases(specs, opcode, std::move(case_label), "32B", "dense", sequence,
+                         FixedStack(std::move(stack)));
+    };
+    switch (opcode) {
+    case OP_TOALTSTACK:
+    case OP_FROMALTSTACK:
+        add_shared_case("altstack-roundtrip", Ops({OP_TOALTSTACK, OP_FROMALTSTACK}), {PatternBytes(32, "dense")});
+        break;
+    case OP_DROP: add_shared_case("dup-drop", Ops({OP_DUP, OP_DROP}), {PatternBytes(32, "dense")}); break;
+    case OP_2DROP: add_shared_case("2dup-2drop", Ops({OP_2DUP, OP_2DROP}), {PatternBytes(32, "dense"), PatternBytes(32, "dense")}); break;
+    case OP_DUP: add_shared_case("dup-drop", Ops({OP_DUP, OP_DROP}), {PatternBytes(32, "dense")}); break;
+    case OP_2DUP: add_shared_case("2dup-2drop", Ops({OP_2DUP, OP_2DROP}), {PatternBytes(32, "dense"), PatternBytes(32, "dense")}); break;
+    case OP_3DUP: add_shared_case("3dup-cleanup", Ops({OP_3DUP, OP_2DROP, OP_DROP}), {PatternBytes(32, "dense"), PatternBytes(32, "dense"), PatternBytes(32, "dense")}); break;
+    case OP_OVER: add_shared_case("over-drop", Ops({OP_OVER, OP_DROP}), {PatternBytes(32, "dense"), PatternBytes(32, "dense")}); break;
+    case OP_2OVER: add_shared_case("2over-2drop", Ops({OP_2OVER, OP_2DROP}), std::vector<valtype>(4, PatternBytes(32, "dense"))); break;
+    case OP_IFDUP: {
+        const CScript true_sequence{Ops({OP_IFDUP, OP_DROP})};
+        AddPreAndV2Cases(specs, opcode, "ifdup-drop", "1B", "true", true_sequence,
+                         FixedStack({valtype{1}}));
+        const CScript false_sequence{Ops({OP_IFDUP})};
+        AddCase(specs, opcode, HeadlineRole::PRE_BASELINE,
+                "ifdup-true", "520B", "late-nonzero", true_sequence,
+                FixedStack({PatternBytes(520, "late-nonzero")}));
+        AddCostCase(specs, opcode, HeadlineRole::COMMON_V2,
+                    "ifdup-true", "520B", "late-nonzero", true_sequence,
+                    FixedStack({PatternBytes(520, "late-nonzero")}), TruthCopyCost(520));
+        AddCase(specs, opcode, HeadlineRole::PRE_BASELINE,
+                "ifdup-false", "520B", "zero", false_sequence,
+                FixedStack({PatternBytes(520, "zero")}));
+        AddCostCase(specs, opcode, HeadlineRole::COMMON_V2,
+                    "ifdup-false", "520B", "zero", false_sequence,
+                    FixedStack({PatternBytes(520, "zero")}), TruthCopyCost(520));
+
+        AddCostCrossovers(specs, opcode, "ifdup-true-crossover", "late-nonzero", true_sequence, 1, MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE, TruthCopyCost, [](size_t size) { return FixedStack({PatternBytes(size, "late-nonzero")}); }, FormatBytes);
+        AddCostCrossovers(specs, opcode, "ifdup-false-crossover", "zero", false_sequence, 1, MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE, TruthCopyCost, [](size_t size) { return FixedStack({PatternBytes(size, "zero")}); }, FormatBytes);
+        AddCostCase(specs, opcode, HeadlineRole::NEW_GSR,
+                    "ifdup-true-scale-tail", "4MB", "late-nonzero", true_sequence,
+                    FixedStack({PatternBytes(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE, "late-nonzero")}),
+                    TruthCopyCost(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE));
+        break;
+    }
+    case OP_NIP: add_shared_case("2dup-nip-drop", Ops({OP_2DUP, OP_NIP, OP_DROP}), {PatternBytes(32, "dense"), PatternBytes(32, "dense")}); break;
+    case OP_TUCK: add_shared_case("tuck-drop-swap", Ops({OP_TUCK, OP_DROP, OP_SWAP}), {PatternBytes(32, "dense"), PatternBytes(32, "dense")}); break;
+    case OP_SWAP: add_shared_case("swap-twice", Ops({OP_SWAP, OP_SWAP}), {PatternBytes(32, "dense"), PatternBytes(32, "dense")}); break;
+    case OP_2SWAP: add_shared_case("2swap-twice", Ops({OP_2SWAP, OP_2SWAP}), std::vector<valtype>(4, PatternBytes(32, "dense"))); break;
+    case OP_ROT: add_shared_case("rot-thrice", Ops({OP_ROT, OP_ROT, OP_ROT}), std::vector<valtype>(3, PatternBytes(32, "dense"))); break;
+    case OP_2ROT: add_shared_case("2rot-thrice", Ops({OP_2ROT, OP_2ROT, OP_2ROT}), std::vector<valtype>(6, PatternBytes(32, "dense"))); break;
+    case OP_DEPTH: add_shared_case("depth-drop", Ops({OP_DEPTH, OP_DROP}), {PatternBytes(32, "dense")}); break;
+    case OP_PICK: {
+        add_shared_case("pick-depth-1", Ops({OP_DUP, OP_PICK, OP_DROP}),
+                        {PatternBytes(32, "dense"), PatternBytes(32, "alternating"), Val64(1).MoveToValtype()});
+        AddCase(specs, opcode, HeadlineRole::NEW_GSR, "pick-max-depth-one-shot", "32768-items", "heterogeneous-buried", Ops({OP_PICK}), [](const CryptoFixture&) {
+                        std::vector<valtype> stack(MAX_TAPSCRIPT_V2_STACK_SIZE - 1, valtype{0x01});
+                        stack.front() = PatternBytes(520, "late-nonzero");
+                        stack.push_back(Val64(MAX_TAPSCRIPT_V2_STACK_SIZE - 2).MoveToValtype());
+                        return stack; }, FixedCase(SCRIPT_ERR_OK, 1, MAX_TAPSCRIPT_V2_STACK_SIZE, "stack-depth"));
+        break;
+    }
+    case OP_ROLL: {
+        CScript roll_one;
+        roll_one << OP_1 << OP_ROLL << OP_SWAP;
+        add_shared_case("roll-depth-1-neutral", roll_one, {PatternBytes(32, "dense"), PatternBytes(32, "alternating")});
+        CaseOptions deep_stack_options{};
+        deep_stack_options.expected_saturation = SaturationExpectation::VAROPS_BUDGET;
+        AddCase(specs, opcode, HeadlineRole::NEW_GSR, "deep-stack", "1000x4B", "dense",
+                Ops({OP_DEPTH, OP_1SUB, OP_ROLL}),
+                FixedStack(std::vector<valtype>(1000, PatternBytes(4, "dense"))),
+                std::move(deep_stack_options));
+        AddCase(specs, opcode, HeadlineRole::NEW_GSR, "roll-max-depth-one-shot", "32768-items", "heterogeneous-buried", Ops({OP_ROLL}), [](const CryptoFixture&) {
+                        std::vector<valtype> stack(MAX_TAPSCRIPT_V2_STACK_SIZE - 1, valtype{0x01});
+                        stack.front() = PatternBytes(520, "late-nonzero");
+                        stack.push_back(Val64(MAX_TAPSCRIPT_V2_STACK_SIZE - 2).MoveToValtype());
+                        return stack; }, FixedCase(SCRIPT_ERR_OK, 1, MAX_TAPSCRIPT_V2_STACK_SIZE - 1, "stack-depth"));
+        break;
+    }
+    default: throw std::runtime_error("unhandled stack opcode registry entry");
+    }
+
+    if ((opcode == OP_DUP || opcode == OP_2DUP || opcode == OP_OVER)) {
+        const CScript sequence{opcode == OP_DUP  ? Ops({OP_DUP, OP_DROP}) :
+                               opcode == OP_2DUP ? Ops({OP_2DUP, OP_2DROP}) :
+                                                   Ops({OP_OVER, OP_DROP})};
+        const size_t count{opcode == OP_DUP ? 1U : 2U};
+        AddCase(specs, opcode, HeadlineRole::NEW_GSR,
+                "large-copy", opcode == OP_DUP ? "4MB" : "2MBx2", "late-nonzero", sequence,
+                [count](const CryptoFixture&) { return std::vector<valtype>(count, PatternBytes(4'000'000 / count, "late-nonzero")); });
+        AddCase(specs, opcode, HeadlineRole::NEW_GSR, "large-copy-varops-reject", opcode == OP_DUP ? "4MB" : "2MBx2", "late-nonzero", sequence, [count](const CryptoFixture&) { return std::vector<valtype>(count, PatternBytes(4'000'000 / count, "late-nonzero")); }, VaropsRejection());
+    }
+}
+
+static void AddHashCases(std::vector<CaseSpec>& specs, opcodetype opcode)
+{
+    for (size_t size : PreDataSizes()) {
+        const std::string pattern{size == 0 ? "zero" : "late-nonzero"};
+        AddOneToOneSpec(specs, opcode, HeadlineRole::PRE_BASELINE,
+                        "hash-preserve", size, pattern, true);
+        AddOneToOneSpec(specs, opcode, HeadlineRole::COMMON_V2,
+                        "hash-preserve", size, pattern, true);
+    }
+    if (opcode == OP_RIPEMD160 || opcode == OP_SHA1) {
+        AddCase(specs, opcode, HeadlineRole::DIAGNOSTIC,
+                "hash-legacy-limit", "521B", "dense", Ops({opcode}), FixedStack({PatternBytes(521, "dense")}),
+                FixedCase(SCRIPT_ERR_HASH_OPERAND_SIZE, 1, 0, "hash-operand-limit"));
+        return;
+    }
+    for (size_t size : V2LargeSizes(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE)) {
+        AddOneToOneSpec(specs, opcode, HeadlineRole::NEW_GSR, "hash-preserve", size,
+                        "late-nonzero", size <= MAX_THREE_WAY_ELEMENT_SIZE);
+    }
+    AddOneToOneCrossovers(specs, opcode, HeadlineRole::COMMON_V2, "hash-crossover",
+                          "late-nonzero", MAX_SCRIPT_ELEMENT_SIZE, true,
+                          HeadlineRole::PRE_BASELINE);
+    AddOneToOneCrossovers(specs, opcode, HeadlineRole::NEW_GSR, "hash-crossover-control",
+                          "late-nonzero", MAX_THREE_WAY_ELEMENT_SIZE, false);
+    AddOneToOneSpec(specs, opcode, HeadlineRole::NEW_GSR, "hash-batch-boundary",
+                    MAX_THREE_WAY_ELEMENT_SIZE, "dense", true);
+
+    const CScript sequence{OneToOneSequence(opcode, false)};
+    AddCase(specs, opcode, HeadlineRole::NEW_GSR,
+            "hash-varops-reject-single", "4MB", "late-nonzero", sequence,
+            FixedStack({PatternBytes(4'000'000, "late-nonzero")}),
+            VaropsRejection(OneToOneSequenceCost(opcode, 4'000'000, false)));
+}
+
+static void AddSpliceCases(std::vector<CaseSpec>& specs, opcodetype opcode)
+{
+    if (opcode == OP_CAT) {
+        const CScript sequence{Ops({OP_2DUP, OP_CAT, OP_DROP})};
+        const std::vector<std::pair<size_t, size_t>> shapes{{0, 1}, {1, 1}, {520, 520}, {521, 521}, {65536, 1}, {1, 65536}, {1048576, 1048576}, {2000000, 2000000}};
+        for (const auto& [left, right] : shapes) {
+            AddCase(specs, opcode, HeadlineRole::NEW_GSR,
+                    "cat-preserve", FormatBytes(left) + "+" + FormatBytes(right), "asymmetric-dense", sequence,
+                    FixedStack({PatternBytes(left, "alternating"), PatternBytes(right, "late-nonzero")}));
+        }
+        AddCase(specs, opcode, HeadlineRole::NEW_GSR,
+                "cat-element-reject", "2000001B+2000001B", "dense", Ops({OP_CAT}),
+                FixedStack({PatternBytes(2'000'001, "dense"), PatternBytes(2'000'001, "dense")}),
+                FixedCase(SCRIPT_ERR_STACK_ELEMENT_SIZE, 1, 0, "stack-element-limit"));
+        return;
+    }
+
+    // Leave room for duplicated, heavily padded offset/length operands while
+    // keeping the data operand as close to the 4MB element limit as possible.
+    constexpr size_t data_size{3'998'900};
+    if (opcode == OP_SUBSTR) {
+        const CScript sequence{Ops({OP_3DUP, OP_SUBSTR, OP_DROP})};
+        const std::vector<std::tuple<uint64_t, uint64_t, std::string>> params{
+            {0, 1, "zero-one"},
+            {1, data_size / 2, "one-mid"},
+            {data_size / 2, data_size, "mid-past-end"},
+        };
+        for (const auto& [begin, length, pattern] : params) {
+            const size_t numeric_size{pattern == "mid-past-end" ? 521U : 8U};
+            AddCase(specs, opcode, HeadlineRole::NEW_GSR,
+                    "substr-preserve", FormatBytes(data_size) + ":" + pattern, numeric_size > 8 ? "padded-lengths" : "minimal-lengths",
+                    sequence, FixedStack({PatternBytes(data_size, "alternating"), PaddedNumber(begin, numeric_size), PaddedNumber(length, numeric_size)}));
+        }
+        return;
+    }
+
+    const CScript sequence{Ops({OP_2DUP, opcode, OP_DROP})};
+    for (const auto& [offset, label] : std::vector<std::pair<uint64_t, std::string>>{
+             {0, "zero"}, {1, "one"}, {data_size / 2, "mid"}, {data_size, "end"}, {data_size + 1, "past-end"}}) {
+        const size_t numeric_size{label == "past-end" ? 521U : 8U};
+        AddCase(specs, opcode, HeadlineRole::NEW_GSR,
+                "splice-preserve", FormatBytes(data_size) + ":" + label,
+                numeric_size > 8 ? "padded-offset" : "minimal-offset", sequence,
+                FixedStack({PatternBytes(data_size, "alternating"), PaddedNumber(offset, numeric_size)}));
+    }
+}
+
+static size_t LargestAffordable(const std::function<uint64_t(size_t)>& cost, size_t maximum)
+{
+    size_t low{1};
+    size_t high{maximum};
+    const uint64_t target{TOTAL_VAROPS_BUDGET * 9 / 10};
+    while (low < high) {
+        const size_t mid{low + (high - low + 1) / 2};
+        if (cost(mid) <= target)
+            low = mid;
+        else
+            high = mid - 1;
+    }
+    return low;
+}
+
+static uint64_t MulSequenceCost(size_t left, size_t right) { return (left + right) * varops::COST_COPYING + varops::MulCost(left, right); }
+
+static void AddMulCases(std::vector<CaseSpec>& specs, opcodetype opcode)
+{
+    const CScript sequence{Ops({OP_2DUP, opcode, OP_DROP})};
+    std::vector<std::pair<size_t, size_t>> shapes{{1, 1}, {109, 109}};
+    const size_t largest{LargestAffordable([](size_t size) { return varops::MulCost(size, size); }, 2'000'000)};
+    shapes.insert(shapes.end(), {{108, 108}, {110, 110}, {65536, 1}, {1, 65536}, {largest > 1 ? largest - 1 : largest, largest}, {largest, largest}, {largest + 1, largest + 1}});
+    for (const auto& [left, right] : shapes) {
+        AddCase(specs, opcode, HeadlineRole::NEW_GSR,
+                "mul-preserve", FormatBytes(left) + "x" + FormatBytes(right), "dense", sequence,
+                FixedStack({PatternBytes(left, "alternating"), PatternBytes(right, "late-nonzero")}));
+    }
+    for (unsigned int ratio : {1U, 4U, 16U, 0U}) {
+        const auto right_size{[ratio](size_t left) {
+            return ratio == 0 ? size_t{1} : std::max<size_t>(1, left / ratio);
+        }};
+        const auto sequence_cost{[&](size_t left) {
+            return MulSequenceCost(left, right_size(left));
+        }};
+        const std::string pattern{ratio == 1 ? "balanced-dense" :
+                                  ratio == 0 ? "asymmetric-one-byte" :
+                                               strprintf("asymmetric-%u-to-1", ratio)};
+        AddCostCrossovers(specs, opcode, "mul-crossover", pattern, sequence, 2, 2'000'000, sequence_cost, [&](size_t left) { return FixedStack({PatternBytes(left, "alternating"),
+                                                                                                                                                PatternBytes(right_size(left), "late-nonzero")}); }, [&](size_t left) { return FormatBytes(left) + "x" + FormatBytes(right_size(left)); });
+    }
+    constexpr size_t tail_left{2'000'000};
+    constexpr size_t tail_right{1};
+    AddCostCase(specs, opcode, HeadlineRole::NEW_GSR,
+                "mul-scale-tail", FormatBytes(tail_left) + "x1B", "asymmetric-long-short",
+                sequence, FixedStack({PatternBytes(tail_left, "alternating"), PatternBytes(tail_right, "late-nonzero")}),
+                MulSequenceCost(tail_left, tail_right));
+
+    const size_t rejected{LargestAffordable([](size_t size) { return varops::MulCost(size, size); }, 2'000'000)};
+    AddCase(specs, opcode, HeadlineRole::NEW_GSR,
+            "mul-varops-reject", FormatBytes(rejected), "dense", sequence,
+            FixedStack({PatternBytes(rejected, "alternating"), PatternBytes(rejected, "late-nonzero")}),
+            VaropsRejection());
+}
+
+static valtype DivisorTopClear(size_t size) { return valtype(size, 0x7f); }
+
+static valtype DivisorTopLimbOne(size_t size)
+{
+    valtype divisor(size, 0);
+    if (size == 0) return divisor;
+    divisor.front() = 0xff;
+    const size_t top_limb_start{(size - 1) / sizeof(uint64_t) * sizeof(uint64_t)};
+    divisor[top_limb_start] = 0x01;
+    return divisor;
+}
+
+static uint64_t DivModSequenceCost(opcodetype opcode, size_t dividend, size_t divisor)
+{
+    const uint64_t operation_cost{opcode == OP_DIV ? varops::DivCost(dividend, divisor) : varops::ModCost(dividend, divisor)};
+    return (dividend + divisor) * varops::COST_COPYING + operation_cost;
+}
+
+static void AddDivModCases(std::vector<CaseSpec>& specs, opcodetype opcode)
+{
+    const CScript sequence{Ops({OP_2DUP, opcode, OP_DROP})};
+    const auto add = [&](valtype dividend, valtype divisor, std::string shape, std::string pattern) {
+        AddCase(specs, opcode, HeadlineRole::NEW_GSR,
+                "divmod-preserve", std::move(shape), std::move(pattern), sequence,
+                FixedStack({std::move(dividend), std::move(divisor)}));
+    };
+    add(valtype{0x0a}, valtype{0x03}, "1Bx1B", "normalization-short");
+    add(PatternBytes(17, "dense"), DivisorTopClear(9), "17Bx9B", "normalization-top-clear");
+    add(PatternBytes(8, "one-low"), PatternBytes(16, "late-nonzero"), "8Bx16B", "dividend-smaller");
+    const valtype addback_dividend{
+        0x71, 0x0a, 0x7f, 0x30, 0x34, 0x4d, 0x13, 0x98, 0xb1, 0x15, 0xd5, 0x64, 0xac, 0xc8, 0x9d, 0x56,
+        0x5a, 0x64, 0xdc, 0x11, 0x21, 0xf7, 0x22, 0x7c, 0xf9, 0x7f, 0x16, 0xbc, 0xeb, 0xe8, 0x95, 0x85};
+    const valtype addback_divisor{
+        0xcd, 0x07, 0x2c, 0xd8, 0xbe, 0x6f, 0x9f, 0x62, 0xac, 0x4c, 0x09, 0xc2, 0x82, 0x06, 0xe7, 0xe3,
+        0x55, 0x94, 0xaa, 0x6b, 0x34, 0x2f, 0x5d, 0x8a};
+    add(addback_dividend, addback_divisor, "32Bx24B", "knuth-d6-add-back");
+    const valtype correction_dividend{
+        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x1d, 0x00, 0x00,
+        0x01, 0x00, 0x00, 0x00, 0x1d, 0x00, 0x00, 0x3b, 0x00};
+    const valtype correction_divisor{
+        0xe7, 0x26, 0xff, 0xff, 0xff, 0xff, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x1d, 0x00, 0x00, 0x3b, 0x00};
+    add(correction_dividend, correction_divisor, "25Bx17B", "knuth-d3-quotient-correction");
+
+    enum class DivisorPattern { DENSE,
+                                TOP_CLEAR,
+                                TOP_LIMB_ONE };
+    struct RectangularCase {
+        unsigned int ratio;
+        DivisorPattern pattern;
+        std::string_view name;
+    };
+    const std::array rectangular_cases{
+        RectangularCase{4, DivisorPattern::DENSE, "asymmetric-quarter-dense"},
+        RectangularCase{16, DivisorPattern::DENSE, "asymmetric-sixteenth-dense"},
+        RectangularCase{0, DivisorPattern::DENSE, "asymmetric-one-byte"},
+        RectangularCase{4, DivisorPattern::TOP_CLEAR, "asymmetric-quarter-top-clear"},
+        RectangularCase{16, DivisorPattern::TOP_LIMB_ONE, "asymmetric-sixteenth-top-limb-one"},
+    };
+    for (const RectangularCase& rectangular : rectangular_cases) {
+        const auto divisor_size{[&](size_t dividend) {
+            return rectangular.ratio == 0 ? size_t{1} : std::max<size_t>(1, dividend / rectangular.ratio);
+        }};
+        const auto sequence_cost{[&](size_t dividend) {
+            return DivModSequenceCost(opcode, dividend, divisor_size(dividend));
+        }};
+        AddCostCrossovers(specs, opcode, "divmod-crossover", rectangular.name, sequence, 2, 2'000'000, sequence_cost, [&](size_t dividend) {
+                              const size_t size{divisor_size(dividend)};
+                              valtype divisor{rectangular.pattern == DivisorPattern::TOP_CLEAR ? DivisorTopClear(size) :
+                                              rectangular.pattern == DivisorPattern::TOP_LIMB_ONE ? DivisorTopLimbOne(size) :
+                                                                                                   PatternBytes(size, "dense")};
+                              return FixedStack({PatternBytes(dividend, "dense"), std::move(divisor)}); }, [&](size_t dividend) { return FormatBytes(dividend) + "x" + FormatBytes(divisor_size(dividend)); });
+    }
+    constexpr size_t tail_dividend{65536};
+    constexpr size_t tail_divisor{16384};
+    AddCostCase(specs, opcode, HeadlineRole::NEW_GSR,
+                "divmod-scale-tail", "64KBx16KB", "asymmetric-quarter-top-clear", sequence,
+                FixedStack({PatternBytes(tail_dividend, "dense"), DivisorTopClear(tail_divisor)}),
+                DivModSequenceCost(opcode, tail_dividend, tail_divisor));
+
+    const size_t largest{LargestAffordable([opcode](size_t size) {
+        return opcode == OP_DIV ? varops::DivCost(size, size) : varops::ModCost(size, size);
+    },
+                                           2'000'000)};
+    for (size_t size : {largest > 1 ? largest - 1 : largest, largest, largest + 1}) {
+        add(PatternBytes(size, "dense"), DivisorTopLimbOne(size),
+            FormatBytes(size) + "x" + FormatBytes(size), "largest-normalized");
+    }
+    AddCase(specs, opcode, HeadlineRole::NEW_GSR,
+            "divmod-varops-reject", FormatBytes(largest), "largest-normalized", sequence,
+            FixedStack({PatternBytes(largest, "dense"), DivisorTopLimbOne(largest)}),
+            VaropsRejection());
+}
+
+static uint64_t ShiftSequenceCost(opcodetype opcode, size_t size, uint64_t shift)
+{
+    const size_t shift_size{Val64(shift).MoveToValtype().size()};
+    const uint64_t copy_cost{(size + shift_size) * varops::COST_COPYING};
+    const uint64_t prebytes{shift / 8};
+    if (opcode == OP_RSHIFT) {
+        return copy_cost + varops::LengthConversionCost(shift_size) +
+               (prebytes < size ? size - prebytes : 0) * varops::COST_COPYING;
+    }
+    if (opcode != OP_LSHIFT) throw std::runtime_error("unsupported shift opcode");
+    return copy_cost + varops::LengthConversionCost(shift_size) + prebytes * varops::COST_FAST +
+           size * varops::COST_COPYING +
+           (shift % 8 == 0 ? 0 : varops::UnalignedUpShiftCost(size, prebytes));
+}
+
+static void AddShiftCases(std::vector<CaseSpec>& specs, opcodetype opcode)
+{
+    const CScript sequence{Ops({OP_2DUP, opcode, OP_DROP})};
+    std::vector<std::pair<size_t, uint64_t>> shapes{{1, 1}, {17, 9}, {17, 56}, {17, 65}};
+    shapes.insert(shapes.end(), {{1024, 8}, {1024, 1032}, {1024, 1033}, {65536, 524288}, {1, uint64_t{MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE - 1} * 8}});
+    for (const auto& [size, shift] : shapes) {
+        AddCase(specs, opcode, HeadlineRole::NEW_GSR,
+                "shift-preserve", FormatBytes(size) + ":" + strprintf("%ubits", shift),
+                shift % 8 == 0 ? "byte-aligned" : "unaligned", sequence,
+                FixedStack({PatternBytes(size, "late-nonzero"), Val64(shift).MoveToValtype()}));
+    }
+    for (uint64_t shift : {8U, 65U}) {
+        const auto sequence_cost{[opcode, shift](size_t size) {
+            return ShiftSequenceCost(opcode, size, shift);
+        }};
+        AddCostCrossovers(specs, opcode, "shift-crossover", shift % 8 == 0 ? "byte-aligned" : "unaligned", sequence, 2, 2'000'000, sequence_cost, [=](size_t size) { return FixedStack({PatternBytes(size, "late-nonzero"),
+                                                                                                                                                                                        Val64(shift).MoveToValtype()}); }, [=](size_t size) { return FormatBytes(size) + ":" + strprintf("%ubits", shift); });
+    }
+    constexpr size_t tail_size{2'000'000};
+    constexpr uint64_t tail_shift{1};
+    AddCostCase(specs, opcode, HeadlineRole::NEW_GSR,
+                "shift-scale-tail", FormatBytes(tail_size) + ":1bit", "unaligned", sequence,
+                FixedStack({PatternBytes(tail_size, "late-nonzero"),
+                            Val64(tail_shift).MoveToValtype()}),
+                ShiftSequenceCost(opcode, tail_size, tail_shift));
+    if (opcode == OP_LSHIFT) {
+        AddCase(specs, opcode, HeadlineRole::NEW_GSR,
+                "shift-element-reject", "1B:past-4MB", "past-end", Ops({OP_LSHIFT}),
+                FixedStack({valtype{1}, Val64(uint64_t{MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE} * 8).MoveToValtype()}),
+                FixedCase(SCRIPT_ERR_STACK_ELEMENT_SIZE, 1, 0, "stack-element-limit"));
+    }
+}
+
+static void AddSignatureCases(std::vector<CaseSpec>& specs, opcodetype opcode)
+{
+    const CScript sequence{opcode == OP_CHECKSIG       ? Ops({OP_2DUP, OP_CHECKSIG, OP_DROP}) :
+                           opcode == OP_CHECKSIGVERIFY ? Ops({OP_2DUP, OP_CHECKSIGVERIFY}) :
+                                                         Ops({OP_3DUP, OP_CHECKSIGADD, OP_DROP})};
+    const auto valid_factory = [opcode](const CryptoFixture& fixture) {
+        if (opcode == OP_CHECKSIGADD) return std::vector<valtype>{fixture.signature, valtype{}, fixture.pubkey_bytes};
+        return std::vector<valtype>{fixture.signature, fixture.pubkey_bytes};
+    };
+    CaseOptions pre_baseline_options{};
+    pre_baseline_options.max_repetitions = SIGNATURES_PER_BLOCK;
+    pre_baseline_options.saturation_hint = "validation-weight";
+    AddCase(specs, opcode, HeadlineRole::PRE_BASELINE,
+            "signature-preserve", opcode == OP_CHECKSIGADD ? "64B+0B+32B" : "64B+32B",
+            "valid-fixed-message", sequence, valid_factory,
+            std::move(pre_baseline_options));
+    AddCase(specs, opcode, HeadlineRole::COMMON_V2,
+            "signature-preserve", opcode == OP_CHECKSIGADD ? "64B+0B+32B" : "64B+32B",
+            "valid-fixed-message", sequence, valid_factory);
+
+    AddCase(specs, opcode, HeadlineRole::PRE_BASELINE,
+            "signature-validation-weight-reject", opcode == OP_CHECKSIGADD ? "64B+0B+32B" : "64B+32B",
+            "valid-fixed-message", sequence, valid_factory,
+            FixedCase(SCRIPT_ERR_TAPSCRIPT_VALIDATION_WEIGHT, SIGNATURES_PER_BLOCK + 1,
+                      std::nullopt, "validation-weight-limit"));
+
+    const auto empty_factory = [opcode](const CryptoFixture& fixture) {
+        if (opcode == OP_CHECKSIGADD) return std::vector<valtype>{valtype{}, PaddedNumber(1, 521), fixture.pubkey_bytes};
+        return std::vector<valtype>{valtype{}, fixture.pubkey_bytes};
+    };
+    const bool empty_verify_failure{opcode == OP_CHECKSIGVERIFY};
+    CaseOptions empty_options{empty_verify_failure ? FixedCase(SCRIPT_ERR_CHECKSIGVERIFY, 1, 0, "semantic-failure") : CaseOptions{}};
+    AddCase(specs, opcode,
+            empty_verify_failure ? HeadlineRole::DIAGNOSTIC : (opcode == OP_CHECKSIGADD ? HeadlineRole::NEW_GSR : HeadlineRole::COMMON_V2),
+            "signature-empty", opcode == OP_CHECKSIGADD ? "0B+521B+32B" : "0B+32B",
+            "empty-signature", sequence, empty_factory, std::move(empty_options));
+
+    const auto invalid_factory = [opcode](const CryptoFixture& fixture) {
+        valtype invalid{fixture.signature};
+        invalid.front() ^= 1;
+        if (opcode == OP_CHECKSIGADD) return std::vector<valtype>{invalid, valtype{}, fixture.pubkey_bytes};
+        return std::vector<valtype>{invalid, fixture.pubkey_bytes};
+    };
+    AddCase(specs, opcode, HeadlineRole::DIAGNOSTIC,
+            "signature-invalid", opcode == OP_CHECKSIGADD ? "64B+0B+32B" : "64B+32B",
+            "invalid-fixed-message", sequence, invalid_factory,
+            FixedCase(SCRIPT_ERR_SCHNORR_SIG, 1, 0, "semantic-failure"));
+}
+
+static uint64_t TimelockSequenceCost(size_t size) { return varops::LengthConversionCost(size); }
+
+static void AddTimelockCases(std::vector<CaseSpec>& specs, opcodetype opcode)
+{
+    const CScript sequence{Ops({opcode})};
+    for (size_t size : std::array{4U, 5U}) {
+        AddPreAndV2Cases(specs, opcode, "timelock-preserve", FormatBytes(size), "padded-one", sequence,
+                         FixedStack({PaddedNumber(1, size)}));
+    }
+    for (size_t size : V2LargeSizes(65536)) {
+        AddCase(specs, opcode, HeadlineRole::NEW_GSR,
+                "timelock-preserve", FormatBytes(size), "padded-one", sequence,
+                FixedStack({PaddedNumber(1, size)}));
+    }
+    AddCostCrossovers(specs, opcode, "timelock-crossover", "padded-one", sequence, 1, MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE, TimelockSequenceCost, [](size_t size) { return FixedStack({PaddedNumber(1, size)}); }, FormatBytes);
+    AddCostCase(specs, opcode, HeadlineRole::NEW_GSR,
+                "timelock-scale-tail", "4MB", "padded-one", sequence,
+                FixedStack({PaddedNumber(1, MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE)}),
+                TimelockSequenceCost(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE));
+}
+
+static void AddControlAndFloorCases(std::vector<CaseSpec>& specs, opcodetype opcode)
+{
+    const auto forced_push = [](opcodetype push_opcode, size_t size) {
+        CScript sequence;
+        sequence.push_back(static_cast<unsigned char>(push_opcode));
+        if (push_opcode == OP_PUSHDATA1) {
+            sequence.push_back(static_cast<unsigned char>(size));
+        } else if (push_opcode == OP_PUSHDATA2) {
+            sequence.push_back(static_cast<unsigned char>(size & 0xff));
+            sequence.push_back(static_cast<unsigned char>((size >> 8) & 0xff));
+        } else {
+            for (unsigned int shift : {0U, 8U, 16U, 24U}) {
+                sequence.push_back(static_cast<unsigned char>((size >> shift) & 0xff));
+            }
+        }
+        sequence.insert(sequence.end(), size, 0x42);
+        sequence << OP_DROP;
+        return sequence;
+    };
+
+    switch (opcode) {
+    case OP_NOP:
+    case OP_CODESEPARATOR:
+        AddPreAndV2Cases(specs, opcode, "interpreter-floor", "no-operands", "executed", Ops({opcode}), FixedStack({}));
+        if (opcode == OP_NOP) {
+            AddCase(specs, opcode, HeadlineRole::PRE_BASELINE,
+                    "max-initial-stack", "1000-items", "empty-items", Ops({OP_NOP}),
+                    FixedStack(std::vector<valtype>(MAX_STACK_SIZE, valtype{})));
+            AddCase(specs, opcode, HeadlineRole::NEW_GSR,
+                    "max-initial-stack", "32768-items", "empty-items", Ops({OP_NOP}),
+                    FixedStack(std::vector<valtype>(MAX_TAPSCRIPT_V2_STACK_SIZE, valtype{})));
+        }
+        break;
+    case OP_0:
+        AddPreAndV2Cases(specs, opcode, "push-drop", "0B", "push-parse", Ops({OP_0, OP_DROP}), FixedStack({}));
+        AddCase(specs, opcode, HeadlineRole::PRE_BASELINE,
+                "push-stack-reject", "1001-pushes", "empty-items", Ops({OP_0}), FixedStack({}),
+                FixedCase(SCRIPT_ERR_STACK_SIZE, MAX_STACK_SIZE + 1, 0, "stack-count-limit"));
+        AddCase(specs, opcode, HeadlineRole::NEW_GSR,
+                "push-stack-reject", "32769-pushes", "empty-items", Ops({OP_0}), FixedStack({}),
+                FixedCase(SCRIPT_ERR_STACK_SIZE, MAX_TAPSCRIPT_V2_STACK_SIZE + 1, 0, "stack-count-limit"));
+        break;
+    case OP_PUSHDATA1:
+        AddPreAndV2Cases(specs, opcode, "pushdata1-drop", "76B", "forced-push-encoding",
+                         forced_push(OP_PUSHDATA1, 76), FixedStack({}));
+        break;
+    case OP_PUSHDATA2:
+        AddPreAndV2Cases(specs, opcode, "pushdata2-drop", "520B", "forced-push-encoding",
+                         forced_push(OP_PUSHDATA2, 520), FixedStack({}));
+        AddCase(specs, opcode, HeadlineRole::PRE_BASELINE,
+                "pushdata2-element-reject", "521B", "forced-push-encoding",
+                forced_push(OP_PUSHDATA2, 521), FixedStack({}),
+                FixedCase(SCRIPT_ERR_PUSH_SIZE, 1, 0, "push-element-limit"));
+        AddCase(specs, opcode, HeadlineRole::NEW_GSR,
+                "pushdata2-drop", "521B", "forced-push-encoding",
+                forced_push(OP_PUSHDATA2, 521), FixedStack({}));
+        break;
+    case OP_PUSHDATA4:
+        AddPreAndV2Cases(specs, opcode, "pushdata4-drop", "1B", "forced-nonminimal-encoding",
+                         forced_push(OP_PUSHDATA4, 1), FixedStack({}));
+        AddCase(specs, opcode, HeadlineRole::NEW_GSR,
+                "pushdata4-drop", "64KB", "forced-push-encoding",
+                forced_push(OP_PUSHDATA4, 65536), FixedStack({}));
+        break;
+    case OP_VERIFY: {
+        AddPreAndV2Cases(specs, opcode, "true-verify", "1B", "true", Ops({OP_1, OP_VERIFY}), FixedStack({}));
+        const CScript sequence{Ops({OP_DUP, OP_VERIFY})};
+        AddCase(specs, opcode, HeadlineRole::PRE_BASELINE,
+                "verify-preserve", "520B", "late-nonzero", sequence,
+                FixedStack({PatternBytes(520, "late-nonzero")}));
+        AddCostCase(specs, opcode, HeadlineRole::COMMON_V2,
+                    "verify-preserve", "520B", "late-nonzero", sequence,
+                    FixedStack({PatternBytes(520, "late-nonzero")}), TruthCopyCost(520));
+        AddCostCrossovers(specs, opcode, "verify-crossover", "late-nonzero", sequence, 1, MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE, TruthCopyCost, [](size_t size) { return FixedStack({PatternBytes(size, "late-nonzero")}); }, FormatBytes);
+        AddCostCase(specs, opcode, HeadlineRole::NEW_GSR,
+                    "verify-scale-tail", "4MB", "late-nonzero", sequence,
+                    FixedStack({PatternBytes(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE, "late-nonzero")}),
+                    TruthCopyCost(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE));
+        break;
+    }
+    case OP_IF:
+        AddPreAndV2Cases(specs, opcode, "executed-if", "1B", "true-branch", Ops({OP_1, OP_IF, OP_NOP, OP_ENDIF}), FixedStack({}));
+        AddPreAndV2Cases(specs, opcode, "skipped-if", "0B", "false-branch", Ops({OP_0, OP_IF, OP_NOP, OP_ENDIF}), FixedStack({}));
+        break;
+    default: throw std::runtime_error("unhandled control opcode registry entry");
+    }
+}
+
+static void AddSizeCases(std::vector<CaseSpec>& specs, opcodetype opcode)
+{
+    const CScript sequence{Ops({OP_SIZE, OP_DROP})};
+    for (size_t size : PreDataSizes()) {
+        AddPreAndV2Cases(specs, opcode, "size-preserve", FormatBytes(size), "late-nonzero", sequence,
+                         FixedStack({PatternBytes(size, "late-nonzero")}));
+    }
+    for (size_t size : V2LargeSizes(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE)) {
+        AddCase(specs, opcode, HeadlineRole::NEW_GSR,
+                "size-preserve", FormatBytes(size), "late-nonzero", sequence,
+                FixedStack({PatternBytes(size, "late-nonzero")}));
+    }
+}
+
+static uint64_t WithinSequenceCost(size_t size) { return 3 * size * varops::COST_COPYING + varops::WithinCost(size, size, size); }
+
+static void AddWithinCases(std::vector<CaseSpec>& specs, opcodetype opcode)
+{
+    const CScript sequence{Ops({OP_3DUP, OP_WITHIN, OP_DROP})};
+    AddPreAndV2Cases(specs, opcode, "within-preserve", "4Bx4Bx4B", "inside-range", sequence,
+                     FixedStack({PaddedNumber(2, 4), PaddedNumber(1, 4), PaddedNumber(3, 4)}));
+    AddCase(specs, opcode, HeadlineRole::NEW_GSR,
+            "within-preserve", "521Bx521Bx521B", "inside-range-padded", sequence,
+            FixedStack({PaddedNumber(2, 521), PaddedNumber(1, 521), PaddedNumber(3, 521)}));
+    AddCostCrossovers(specs, opcode, "within-crossover", "inside-range-padded", sequence, 3, MAX_THREE_WAY_ELEMENT_SIZE, WithinSequenceCost, [](size_t size) { return FixedStack({PaddedNumber(2, size), PaddedNumber(1, size),
+                                                                                                                                                                                  PaddedNumber(3, size)}); }, [](size_t size) { return FormatBytes(size) + "x" + FormatBytes(size) + "x" + FormatBytes(size); });
+    AddCostCase(specs, opcode, HeadlineRole::NEW_GSR,
+                "within-scale-tail",
+                FormatBytes(MAX_THREE_WAY_ELEMENT_SIZE) + "x" +
+                    FormatBytes(MAX_THREE_WAY_ELEMENT_SIZE) + "x" +
+                    FormatBytes(MAX_THREE_WAY_ELEMENT_SIZE),
+                "inside-range-padded", sequence,
+                FixedStack({PaddedNumber(2, MAX_THREE_WAY_ELEMENT_SIZE),
+                            PaddedNumber(1, MAX_THREE_WAY_ELEMENT_SIZE),
+                            PaddedNumber(3, MAX_THREE_WAY_ELEMENT_SIZE)}),
+                WithinSequenceCost(MAX_THREE_WAY_ELEMENT_SIZE));
+}
+
+using CaseGenerator = void (*)(std::vector<CaseSpec>&, opcodetype);
+
+struct OpcodeEntry {
+    opcodetype opcode;
+    CaseGenerator generate;
+};
+
+static const std::vector<OpcodeEntry>& OpcodeRegistry()
+{
+    static const std::vector<OpcodeEntry> registry{[] {
+        std::vector<OpcodeEntry> entries;
+        const auto add = [&](CaseGenerator generate, std::initializer_list<opcodetype> opcodes) {
+            for (opcodetype opcode : opcodes)
+                entries.push_back({opcode, generate});
+        };
+        const CaseGenerator unary_common{[](auto& out, auto op) { AddUnaryDataCases(out, op, false); }};
+        const CaseGenerator unary_restored{[](auto& out, auto op) { AddUnaryDataCases(out, op, true); }};
+        const CaseGenerator binary_common{[](auto& out, auto op) { AddBinaryDataCases(out, op, false); }};
+        const CaseGenerator binary_restored{[](auto& out, auto op) { AddBinaryDataCases(out, op, true); }};
+
+        add(AddControlAndFloorCases, {OP_0, OP_PUSHDATA1, OP_PUSHDATA2, OP_PUSHDATA4, OP_IF, OP_VERIFY, OP_NOP, OP_CODESEPARATOR});
+        add(AddStackOpcodeCases, {OP_TOALTSTACK, OP_FROMALTSTACK, OP_2DROP, OP_2DUP, OP_3DUP, OP_2OVER, OP_2ROT, OP_2SWAP,
+                                  OP_IFDUP, OP_DEPTH, OP_DROP, OP_DUP, OP_NIP, OP_OVER, OP_PICK, OP_ROLL, OP_ROT, OP_SWAP, OP_TUCK});
+        add(unary_common, {OP_1ADD, OP_1SUB, OP_NOT, OP_0NOTEQUAL});
+        add(unary_restored, {OP_INVERT, OP_2MUL, OP_2DIV});
+        add(binary_common, {OP_EQUAL, OP_EQUALVERIFY, OP_ADD, OP_SUB, OP_BOOLAND, OP_BOOLOR, OP_NUMEQUAL,
+                            OP_NUMEQUALVERIFY, OP_NUMNOTEQUAL, OP_LESSTHAN, OP_GREATERTHAN,
+                            OP_LESSTHANOREQUAL, OP_GREATERTHANOREQUAL, OP_MIN, OP_MAX});
+        add(binary_restored, {OP_AND, OP_OR, OP_XOR});
+        add(AddHashCases, {OP_RIPEMD160, OP_SHA1, OP_SHA256, OP_HASH160, OP_HASH256});
+        add(AddSpliceCases, {OP_CAT, OP_SUBSTR, OP_LEFT, OP_RIGHT});
+        add(AddMulCases, {OP_MUL});
+        add(AddDivModCases, {OP_DIV, OP_MOD});
+        add(AddShiftCases, {OP_LSHIFT, OP_RSHIFT});
+        add(AddSizeCases, {OP_SIZE});
+        add(AddWithinCases, {OP_WITHIN});
+        add(AddSignatureCases, {OP_CHECKSIG, OP_CHECKSIGVERIFY, OP_CHECKSIGADD});
+        add(AddTimelockCases, {OP_CHECKLOCKTIMEVERIFY, OP_CHECKSEQUENCEVERIFY});
+        return entries;
+    }()};
+    return registry;
+}
+
+static std::map<std::string, opcodetype> SupportedOpcodeMap()
+{
+    std::map<std::string, opcodetype> out;
+    for (const OpcodeEntry& entry : OpcodeRegistry())
+        out.emplace(OpcodeName(entry.opcode), entry.opcode);
+    return out;
+}
+
+static std::vector<CaseSpec> GenerateCaseSpecs(const Options& options)
+{
+    std::vector<CaseSpec> specs;
+    for (const OpcodeEntry& entry : OpcodeRegistry()) {
+        const opcodetype opcode{entry.opcode};
+        if (!options.selected_opcodes.empty() && !options.selected_opcodes.contains(opcode)) continue;
+        entry.generate(specs, opcode);
+    }
+
+    if (options.selected_opcodes.empty() || options.selected_opcodes.contains(OP_DUP)) {
+        AddCase(specs, OP_DUP, HeadlineRole::PRE_BASELINE,
+                "empty-dup-stack-reject", "1001-items", "empty-items", Ops({OP_DUP}),
+                FixedStack({valtype{}}), FixedCase(SCRIPT_ERR_STACK_SIZE, MAX_STACK_SIZE, 0, "stack-count-limit"));
+        AddCase(specs, OP_DUP, HeadlineRole::NEW_GSR,
+                "empty-dup-stack-reject", "32769-items", "empty-items", Ops({OP_DUP}),
+                FixedStack({valtype{}}),
+                FixedCase(SCRIPT_ERR_STACK_SIZE, MAX_TAPSCRIPT_V2_STACK_SIZE, 0, "stack-count-limit"));
+        AddCase(specs, OP_DUP, HeadlineRole::NEW_GSR,
+                "total-stack-reject", "4MB-item", "dense", Ops({OP_DUP, OP_DUP}),
+                FixedStack({PatternBytes(4'000'000, "dense")}),
+                FixedCase(SCRIPT_ERR_TOTAL_STACK_SIZE, 1, 0, "total-stack-limit"));
+    }
+
+    std::sort(specs.begin(), specs.end(), [](const CaseSpec& left, const CaseSpec& right) { return left.name < right.name; });
+    const std::vector<CaseSpec>::iterator duplicate{std::adjacent_find(specs.begin(), specs.end(), [](const CaseSpec& left, const CaseSpec& right) {
+        return left.name == right.name;
+    })};
+    if (duplicate != specs.end()) throw std::runtime_error("duplicate generated case name: " + duplicate->name);
+    return specs;
+}
+
+static ankerl::nanobench::Bench SetupBenchmark()
+{
+    ankerl::nanobench::Bench bench;
+    bench.output(nullptr).epochs(1).epochIterations(1);
+    return bench;
+}
+
+static std::string_view TimingStageName(TimingStage stage)
+{
+    switch (stage) {
+    case TimingStage::SCHNORR_BASELINE: return "schnorr-baseline";
+    case TimingStage::DISCOVERY: return "discovery";
+    case TimingStage::STABLE: return "stable";
+    }
+    return "unknown";
+}
+
+static SampleStats CalculateStats(std::vector<double> values)
+{
+    if (values.empty()) throw std::runtime_error("cannot aggregate an empty sample set");
+    std::sort(values.begin(), values.end());
+    const size_t middle{values.size() / 2};
+    const double median{values.size() % 2 == 0 ? (values[middle - 1] + values[middle]) / 2 : values[middle]};
+    std::vector<double> errors;
+    errors.reserve(values.size());
+    for (double value : values) {
+        if (value == 0) {
+            errors.push_back(median == 0 ? 0 : std::numeric_limits<double>::infinity());
+        } else {
+            errors.push_back(std::abs((value - median) / value));
+        }
+    }
+    std::sort(errors.begin(), errors.end());
+    const size_t error_middle{errors.size() / 2};
+    const double mdape{errors.size() % 2 == 0 ? (errors[error_middle - 1] + errors[error_middle]) / 2 : errors[error_middle]};
+    return {median, values.front(), values.back(), mdape};
+}
+
+static void AggregateSamples(BenchResult& result, TimingStage stage)
+{
+    std::vector<double> values;
+    for (const TimingSample& sample : result.samples) {
+        if (sample.stage == stage) values.push_back(sample.wall_sec);
+    }
+    const SampleStats stats{CalculateStats(std::move(values))};
+    result.median_sec = stats.median;
+    result.wall_min_sec = stats.minimum;
+    result.wall_max_sec = stats.maximum;
+    result.mdape = stats.mdape;
+    result.aggregate_stage = stage;
+}
+
+static void RunGlobalWarmup(const CryptoFixture& fixture)
+{
+    const CScript warmup_script{BuildScript(Ops({OP_NOP}), 1, 0)};
+    ValtypeStack warmup_stack;
+    BenchSignatureChecker checker{fixture};
+    ScriptExecutionData execdata;
+    execdata.m_internal_key = XOnlyPubKey::NUMS_H;
+    varops::Budget budget{TOTAL_VAROPS_BUDGET};
+    ScriptError error{SCRIPT_ERR_UNKNOWN_ERROR};
+    if (!EvalTapscriptV2(warmup_stack, warmup_script, BENCH_SCRIPT_VERIFY_FLAGS,
+                         checker, execdata, budget, &error)) {
+        throw std::runtime_error("global benchmark warmup failed: " + ScriptErrorString(error));
+    }
+}
+
+static BenchResult ResultMetadata(const MaterializedCase& test_case)
+{
+    const CaseSpec& spec{*test_case.spec};
+    BenchResult result;
+    result.name = spec.name;
+    result.domain = DomainFor(spec.role);
+    result.role = spec.role;
+    result.opcode_name = spec.opcode_name;
+    result.sequence_opcodes = spec.sequence_opcodes;
+    result.operand_shape = spec.operand_shape;
+    result.operand_pattern = spec.operand_pattern;
+    result.script_bytes = test_case.script.size();
+    result.initial_stack_items = test_case.initial_stack.size();
+    result.initial_stack_bytes = StackPayloadBytes(test_case.initial_stack);
+    result.expected_error = spec.expected_error;
+    result.actual_error = SCRIPT_ERR_UNKNOWN_ERROR;
+    result.saturation = test_case.saturation;
+    result.repetitions = test_case.repetitions;
+    result.varops_per_repeat = test_case.varops_per_repeat;
+    return result;
+}
+
+static void CheckDeclaredOutcome(const MaterializedCase& test_case, const EvalOutcome& outcome,
+                                 std::string_view stage)
+{
+    if (outcome.error != test_case.spec->expected_error || outcome.success != (test_case.spec->expected_error == SCRIPT_ERR_OK)) {
+        throw std::runtime_error(strprintf("%s mismatch for %s: expected %s, got %s",
+                                           stage, test_case.spec->name,
+                                           ScriptErrorString(test_case.spec->expected_error),
+                                           ScriptErrorString(outcome.error)));
+    }
+}
+
+static void CheckScriptEnvelope(const MaterializedCase& test_case)
+{
+    if (test_case.script.size() != SCRIPT_BYTES) {
+        throw std::runtime_error(test_case.spec->name + " is not exactly 4,000,000 script bytes");
+    }
+}
+
+static void CheckMeasuredOutcome(const MaterializedCase& test_case, const EvalOutcome& expected,
+                                 const EvalOutcome& actual, std::string_view stage)
+{
+    if (actual.error != expected.error || actual.success != expected.success ||
+        actual.varops_consumed != expected.varops_consumed) {
+        throw std::runtime_error(strprintf("%s changed outcome during %s", test_case.spec->name, stage));
+    }
+}
+
+static TimingSample MeasurePrepared(const MaterializedCase& test_case, const CryptoFixture& fixture,
+                                    PreparedExecution& execution, const EvalOutcome& expected,
+                                    TimingStage stage, int round, size_t order)
+{
+    BenchSignatureChecker checker{fixture};
+    ankerl::nanobench::Bench bench{SetupBenchmark()};
+    EvalOutcome outcome;
+    size_t executions{0};
+    bench.run(test_case.spec->name, [&] {
+        ++executions;
+        outcome = ExecutePrepared(test_case, checker, execution);
+    });
+    if (executions != 1 || bench.results().size() != 1 || bench.results().front().size() != 1) {
+        throw std::runtime_error("nanobench did not execute exactly one case sample");
+    }
+    CheckMeasuredOutcome(test_case, expected, outcome, TimingStageName(stage));
+    return {stage, round, order,
+            bench.results().front().get(0, ankerl::nanobench::Result::Measure::elapsed)};
+}
+
+static TimingSample RunTimedCaseSample(const MaterializedCase& test_case, const CryptoFixture& fixture,
+                                       const EvalOutcome& expected, TimingStage stage, int round,
+                                       size_t order, bool warmup)
+{
+    const uint64_t fixture_bytes{StackFixtureBytes(test_case.initial_stack)};
+    const uint64_t copies{warmup ? 2U : 1U};
+    if (fixture_bytes > MAX_FIXTURE_POOL_BYTES / copies) {
+        throw std::runtime_error(strprintf("%s sample fixtures would require %u bytes (limit %u)",
+                                           test_case.spec->name, fixture_bytes * copies,
+                                           MAX_FIXTURE_POOL_BYTES));
+    }
+
+    if (warmup) ReleaseAllocatorCaches();
+    TimingSample sample;
+    {
+        std::optional<PreparedExecution> warmup_execution;
+        if (warmup) warmup_execution.emplace(PrepareExecution(test_case, true));
+        PreparedExecution measured_execution{PrepareExecution(test_case, true)};
+        BenchSignatureChecker checker{fixture};
+        if (warmup_execution) {
+            const EvalOutcome warmup_outcome{ExecutePrepared(test_case, checker, *warmup_execution)};
+            CheckMeasuredOutcome(test_case, expected, warmup_outcome, "warmup");
+        }
+        sample = MeasurePrepared(test_case, fixture, measured_execution, expected, stage, round, order);
+    }
+    if (warmup) ReleaseAllocatorCaches();
+    return sample;
+}
+
+static TimingSample MeasureSchnorrBatch(const CryptoFixture& fixture, TimingStage stage,
+                                        int round, size_t order, uint64_t iterations)
+{
+    ankerl::nanobench::Bench bench{SetupBenchmark()};
+    uint64_t valid{0};
+    size_t executions{0};
+    bench.run("Schnorr signature validation", [&] {
+        ++executions;
+        for (uint64_t i{0}; i < iterations; ++i) {
+            valid += fixture.pubkey.VerifySchnorr(fixture.message, fixture.signature);
+        }
+        ankerl::nanobench::doNotOptimizeAway(valid);
+    });
+    if (executions != 1 || valid != iterations || bench.results().size() != 1 ||
+        bench.results().front().size() != 1) {
+        throw std::runtime_error("raw Schnorr anchor failed");
+    }
+    const double scale{static_cast<double>(SIGNATURES_PER_BLOCK) / iterations};
+    return {stage, round, order,
+            bench.results().front().get(0, ankerl::nanobench::Result::Measure::elapsed) * scale};
+}
+
+static BenchResult RunRawSchnorr(const CryptoFixture& fixture)
+{
+    BenchResult result;
+    result.name = "Schnorr signature validation";
+    result.domain = ExecutionDomain::RAW_SCHNORR;
+    result.role = HeadlineRole::PRE_BASELINE;
+    result.opcode_name = "RAW_SCHNORR_80000";
+    result.sequence_opcodes = "RAW_SCHNORR_VERIFY";
+    result.operand_shape = "64B+32B";
+    result.operand_pattern = "valid-fixed-message";
+    result.expected_error = SCRIPT_ERR_OK;
+    result.actual_error = SCRIPT_ERR_OK;
+    result.saturation = "80000-signature-anchor";
+    constexpr uint64_t iterations{1000};
+    MeasureSchnorrBatch(fixture, TimingStage::SCHNORR_BASELINE, 0, 0, iterations);
+    for (int sample{1}; sample <= SCHNORR_BASELINE_SAMPLES; ++sample) {
+        result.samples.push_back(MeasureSchnorrBatch(fixture, TimingStage::SCHNORR_BASELINE,
+                                                     sample, sample - 1, iterations));
+    }
+    AggregateSamples(result, TimingStage::SCHNORR_BASELINE);
+    result.repetitions = SIGNATURES_PER_BLOCK;
+    return result;
+}
+
+static BenchResult RunDiscoveryCase(const MaterializedCase& test_case, const CryptoFixture& fixture,
+                                    size_t order)
+{
+    CheckScriptEnvelope(test_case);
+    const uint64_t fixture_bytes{StackFixtureBytes(test_case.initial_stack)};
+    if (fixture_bytes > MAX_FIXTURE_POOL_BYTES / 2) {
+        throw std::runtime_error(strprintf("%s discovery fixtures would require %u bytes (limit %u)",
+                                           test_case.spec->name, fixture_bytes * 2,
+                                           MAX_FIXTURE_POOL_BYTES));
+    }
+
+    ReleaseAllocatorCaches();
+    PreparedExecution preflight_execution{PrepareExecution(test_case, true)};
+    PreparedExecution measured_execution{PrepareExecution(test_case, true)};
+    BenchSignatureChecker checker{fixture};
+    const EvalOutcome preflight{ExecutePrepared(test_case, checker, preflight_execution)};
+    CheckDeclaredOutcome(test_case, preflight, "discovery preflight/warmup");
+    TimingSample sample{MeasurePrepared(test_case, fixture, measured_execution, preflight,
+                                        TimingStage::DISCOVERY, 0, order)};
+    ReleaseAllocatorCaches();
+
+    BenchResult result{ResultMetadata(test_case)};
+    result.actual_error = preflight.error;
+    result.varops_consumed = preflight.varops_consumed;
+    result.discovery_wall_sec = sample.wall_sec;
+    result.samples.push_back(std::move(sample));
+    AggregateSamples(result, TimingStage::DISCOVERY);
+    return result;
+}
+
+static void AddPromotionReason(BenchResult& result, std::string reason)
+{
+    if (std::ranges::find(result.promotion_reasons, reason) == result.promotion_reasons.end()) {
+        result.promotion_reasons.push_back(std::move(reason));
+    }
+    result.promoted = true;
+}
+
+static void PromoteLeader(std::vector<BenchResult>& results,
+                          const std::function<bool(const BenchResult&)>& predicate)
+{
+    BenchResult* leader{nullptr};
+    for (BenchResult& result : results) {
+        if (result.domain == ExecutionDomain::RAW_SCHNORR || !predicate(result)) continue;
+        if (!leader || *result.discovery_wall_sec > *leader->discovery_wall_sec) leader = &result;
+    }
+    if (leader) AddPromotionReason(*leader, "category-leader");
+}
+
+static PromotionSummary PromoteDiscoveryResults(std::vector<BenchResult>& results,
+                                                const BenchResult& schnorr)
+{
+    PromotionSummary summary{schnorr.median_sec * PROMOTION_THRESHOLD, 0};
+    for (BenchResult& result : results) {
+        if (result.domain != ExecutionDomain::RAW_SCHNORR &&
+            *result.discovery_wall_sec >= summary.promotion_cutoff_seconds) {
+            AddPromotionReason(result, "wall-cutoff");
+        }
+    }
+
+    const std::array<std::function<bool(const BenchResult&)>, 7> categories{
+        [](const BenchResult& result) { return result.domain == ExecutionDomain::PRE_GSR_TAPSCRIPT; },
+        [](const BenchResult& result) { return result.role == HeadlineRole::NEW_GSR; },
+        [](const BenchResult& result) { return result.role == HeadlineRole::NEW_GSR && result.actual_error == SCRIPT_ERR_OK; },
+        [](const BenchResult& result) { return result.role == HeadlineRole::NEW_GSR && IsResourceError(result.actual_error); },
+        [](const BenchResult& result) { return result.domain == ExecutionDomain::GSR_TAPSCRIPT_V2; },
+        [](const BenchResult& result) {
+            return result.domain == ExecutionDomain::PRE_GSR_TAPSCRIPT ||
+                   result.domain == ExecutionDomain::GSR_TAPSCRIPT_V2;
+        },
+        [](const BenchResult& result) { return result.role == HeadlineRole::COMMON_V2; },
+    };
+    for (const auto& category : categories)
+        PromoteLeader(results, category);
+    summary.promoted_cases = std::ranges::count_if(results, [](const BenchResult& result) {
+        return result.promoted;
+    });
+    return summary;
+}
+
+static std::vector<std::vector<size_t>> BuildRoundSchedules(const std::vector<size_t>& indices,
+                                                            int rounds)
+{
+    std::mt19937_64 generator{ROUND_SEED};
+    std::vector<std::vector<size_t>> schedules;
+    schedules.reserve(rounds);
+    for (int round{0}; round < rounds; ++round) {
+        schedules.push_back(indices);
+        std::shuffle(schedules.back().begin(), schedules.back().end(), generator);
+    }
+    return schedules;
+}
+
+static void RunTimingSelfChecks()
+{
+    const SampleStats stats{CalculateStats({1, 2, 3, 4})};
+    Check(stats.median == 2.5 && stats.minimum == 1 && stats.maximum == 4 &&
+              std::abs(stats.mdape - 0.3125) <= 1e-12,
+          "internal timing aggregation failed");
+
+    const std::vector<size_t> indices{0, 1, 2, 3};
+    const auto first{BuildRoundSchedules(indices, 7)};
+    Check(first == BuildRoundSchedules(indices, 7) && first.size() == 7,
+          "internal round schedule determinism failed");
+    for (const auto& round : first) {
+        std::vector<size_t> sorted{round};
+        std::sort(sorted.begin(), sorted.end());
+        Check(sorted == indices, "internal round schedule coverage failed");
+    }
+
+    BenchResult lower;
+    lower.domain = ExecutionDomain::PRE_GSR_TAPSCRIPT;
+    lower.discovery_wall_sec = 1;
+    BenchResult higher;
+    higher.domain = ExecutionDomain::PRE_GSR_TAPSCRIPT;
+    higher.discovery_wall_sec = 2;
+    std::vector<BenchResult> category_results{lower, higher};
+    PromoteLeader(category_results, [](const BenchResult&) { return true; });
+    Check(!category_results[0].promoted && category_results[1].promoted,
+          "internal category leader promotion failed");
+}
+
+static const BenchResult* Slowest(const std::vector<BenchResult>& results,
+                                  const std::function<bool(const BenchResult&)>& predicate)
+{
+    const BenchResult* slowest{nullptr};
+    for (const BenchResult& result : results) {
+        if (predicate(result) && (!slowest || result.median_sec > slowest->median_sec)) slowest = &result;
+    }
+    return slowest;
+}
+
+static bool IsRankable(const BenchResult& result)
+{
+    return result.domain == ExecutionDomain::RAW_SCHNORR || result.promoted;
+}
+
+static std::optional<SampleStats> PairedRatioStats(const BenchResult& numerator,
+                                                   const BenchResult& denominator)
+{
+    std::map<int, double> denominator_by_round;
+    for (const TimingSample& sample : denominator.samples) {
+        if (sample.stage == TimingStage::STABLE) denominator_by_round.emplace(sample.round, sample.wall_sec);
+    }
+    std::vector<double> ratios;
+    for (const TimingSample& sample : numerator.samples) {
+        if (sample.stage != TimingStage::STABLE) continue;
+        const auto denominator_value{denominator_by_round.find(sample.round)};
+        if (denominator_value != denominator_by_round.end() && denominator_value->second > 0) {
+            ratios.push_back(sample.wall_sec / denominator_value->second);
+        }
+    }
+    return ratios.empty() ? std::nullopt : std::optional<SampleStats>{CalculateStats(std::move(ratios))};
+}
+
+static void PrintReport(const std::vector<BenchResult>& results, const CorpusCounts& counts,
+                        const Options& options, const PromotionSummary& promotion)
+{
+    const BenchResult* denominator{Slowest(results, [](const BenchResult& result) {
+        return IsRankable(result) && result.domain == ExecutionDomain::PRE_GSR_TAPSCRIPT;
+    })};
+    const BenchResult* numerator{Slowest(results, [](const BenchResult& result) {
+        return IsRankable(result) && result.role == HeadlineRole::NEW_GSR;
+    })};
+    const BenchResult* schnorr{Slowest(results, [](const BenchResult& result) {
+        return result.domain == ExecutionDomain::RAW_SCHNORR;
+    })};
+
+    std::cout << "\n================================================================================\n";
+    std::cout << "MAXIMUM OBSERVED IN THE GENERATED CORPUS\n";
+    std::cout << "================================================================================\n";
+    std::cout << strprintf("Corpus: %u requested opcodes, %u generated rows, %u completed rows\n",
+                           counts.requested_opcodes, counts.generated_cases, counts.completed_cases);
+    std::cout << strprintf("Promotion: %u/%u rows at wall >= %.3f sec (threshold %.0f%%)\n",
+                           promotion.promoted_cases, counts.generated_cases,
+                           promotion.promotion_cutoff_seconds, 100 * PROMOTION_THRESHOLD);
+    std::cout << strprintf("Stable measurement: %u rounds (seed 0x%x)\n",
+                           options.stable_rounds, static_cast<unsigned int>(ROUND_SEED));
+    if (denominator) {
+        std::cout << strprintf("Pre-GSR denominator: %s  %.3f sec (%.2f%% MdAPE)\n",
+                               denominator->name, denominator->median_sec, 100 * denominator->mdape);
+    }
+    if (numerator) {
+        std::cout << strprintf("New-GSR numerator:   %s  %.3f sec (%.2f%% MdAPE)\n",
+                               numerator->name, numerator->median_sec, 100 * numerator->mdape);
+    }
+    if (denominator && numerator && denominator->median_sec > 0) {
+        std::cout << strprintf("Headline quotient:   %.3f\n",
+                               numerator->median_sec / denominator->median_sec);
+        if (const auto paired{PairedRatioStats(*numerator, *denominator)}) {
+            std::cout << strprintf("Paired quotient:     %.3f median (%.2f%% MdAPE)\n",
+                                   paired->median, 100 * paired->mdape);
+        }
+    }
+    if (schnorr) {
+        std::cout << strprintf("Raw Schnorr (80,000): %.3f sec (%.2f%% MdAPE)\n",
+                               schnorr->median_sec, 100 * schnorr->mdape);
+    }
+    std::cout << "================================================================================\n";
+}
+
+static std::string GetBenchmarkSystemInfo()
+{
+    std::ostringstream info;
+    std::string cpu_name{"Unknown"};
+#if defined(__APPLE__)
+    if (FILE * fp{popen("sysctl -n machdep.cpu.brand_string", "r")}) {
+        char buffer[256];
+        if (fgets(buffer, sizeof(buffer), fp)) {
+            cpu_name = buffer;
+            if (!cpu_name.empty() && cpu_name.back() == '\n') cpu_name.pop_back();
+        }
+        pclose(fp);
+    }
+#elif defined(__linux__)
+    if (FILE * cpuinfo{fopen("/proc/cpuinfo", "r")}) {
+        char line[256];
+        while (fgets(line, sizeof(line), cpuinfo)) {
+            if (strncmp(line, "model name", 10) != 0) continue;
+            if (const char* separator{strchr(line, ':')}) {
+                cpu_name = separator + 2;
+                if (!cpu_name.empty() && cpu_name.back() == '\n') cpu_name.pop_back();
+                break;
+            }
+        }
+        fclose(cpuinfo);
+    }
+#endif
+
+    std::string architecture{"Unknown"};
+#if defined(__x86_64__) || defined(__amd64__) || defined(_M_X64)
+    architecture = "x86_64";
+#elif defined(__aarch64__) || defined(_M_ARM64)
+    architecture = "ARM64";
+#elif defined(__i386__) || defined(_M_IX86)
+    architecture = "x86";
+#elif defined(__arm__) || defined(_M_ARM)
+    architecture = "ARM";
+#endif
+
+    std::string compiler{"Unknown"};
+#if defined(__clang__)
+    compiler = strprintf("Clang %d.%d.%d", __clang_major__, __clang_minor__, __clang_patchlevel__);
+#elif defined(__GNUC__)
+    compiler = strprintf("GCC %d.%d.%d", __GNUC__, __GNUC_MINOR__, __GNUC_PATCHLEVEL__);
+#elif defined(_MSC_VER)
+    compiler = strprintf("MSVC %d", _MSC_VER);
+#endif
+
+    info << "# CPU: " << cpu_name << "\n";
+    info << "# Architecture: " << architecture << "\n";
+    info << "# Compiler: " << compiler << "\n";
+    info << "# SHA256 Implementation: " << SHA256AutoDetect() << "\n";
+    return info.str();
+}
+
+static std::string CsvEscape(std::string_view value)
+{
+    if (value.find_first_of(",\"\n\r") == std::string_view::npos) return std::string{value};
+    std::string escaped{"\""};
+    for (char ch : value) {
+        if (ch == '"') escaped += '"';
+        escaped += ch;
+    }
+    return escaped + '"';
+}
+
+static std::string JoinPromotionReasons(const std::vector<std::string>& reasons)
+{
+    std::string joined;
+    for (const std::string& reason : reasons) {
+        if (!joined.empty()) joined += ';';
+        joined += reason;
+    }
+    return joined;
+}
+
+static std::string CsvNumber(double value)
+{
+    return strprintf("%.17g", value);
+}
+
+template <typename T>
+static std::string CsvNumber(const T& value)
+{
+    std::ostringstream output;
+    output << value;
+    return output.str();
+}
+
+enum class CsvColumn : size_t {
+    RECORD_TYPE,
+    RANK,
+    NAME,
+    EXECUTION_DOMAIN,
+    HEADLINE_ROLE,
+    OPCODE,
+    SEQUENCE_OPCODES,
+    OPERAND_SHAPE,
+    OPERAND_PATTERN,
+    SCRIPT_BYTES,
+    INITIAL_STACK_ITEMS,
+    INITIAL_STACK_BYTES,
+    VAROPS_CONSUMED,
+    EXPECTED_TERMINATION,
+    ACTUAL_TERMINATION,
+    SATURATION,
+    REPETITIONS,
+    SEQUENCE_VAROPS,
+    PROMOTED,
+    PROMOTION_REASONS,
+    STAGE,
+    ROUND,
+    ORDER,
+    SAMPLES,
+    WALL_SECONDS,
+    WALL_MIN_SECONDS,
+    WALL_MAX_SECONDS,
+    MDAPE,
+    SCHNORR_EQUIVALENTS,
+    VAROPS_PERCENTAGE,
+    COUNT,
+};
+
+static constexpr size_t CsvIndex(CsvColumn column) { return static_cast<size_t>(column); }
+
+using CsvRow = std::array<std::string, CsvIndex(CsvColumn::COUNT)>;
+
+static constexpr std::string_view CSV_HEADER{
+    "Record_Type,Rank,Name,Domain,Headline_Role,Opcode,Sequence_Opcodes,Operand_Shape,"
+    "Operand_Pattern,Script_Bytes,Initial_Stack_Items,Initial_Stack_Bytes,Varops_Consumed,"
+    "Expected_Termination,Actual_Termination,Saturation,Repetitions,Sequence_Varops,Promoted,"
+    "Promotion_Reasons,Stage,Round,Order,Samples,Wall_Seconds,Wall_Min_Seconds,Wall_Max_Seconds,"
+    "MdAPE,Schnorr_Equivalents,Varops_Percentage"};
+static_assert(std::ranges::count(CSV_HEADER, ',') + 1 == CsvIndex(CsvColumn::COUNT));
+
+static std::string& CsvField(CsvRow& row, CsvColumn column) { return row[CsvIndex(column)]; }
+
+template <typename Fields>
+static void WriteCsvRow(std::ostream& output, const Fields& fields)
+{
+    for (size_t index{0}; index < fields.size(); ++index) {
+        if (index != 0) output << ',';
+        output << CsvEscape(fields[index]);
+    }
+    output << '\n';
+}
+
+static void SetResultIdentity(CsvRow& row, const BenchResult& result)
+{
+    CsvField(row, CsvColumn::NAME) = result.name;
+    CsvField(row, CsvColumn::EXECUTION_DOMAIN) = DomainName(result.domain);
+    CsvField(row, CsvColumn::HEADLINE_ROLE) = RoleName(result.role);
+    CsvField(row, CsvColumn::OPCODE) = result.opcode_name;
+    CsvField(row, CsvColumn::SEQUENCE_OPCODES) = result.sequence_opcodes;
+    CsvField(row, CsvColumn::OPERAND_SHAPE) = result.operand_shape;
+    CsvField(row, CsvColumn::OPERAND_PATTERN) = result.operand_pattern;
+    CsvField(row, CsvColumn::SCRIPT_BYTES) = CsvNumber(result.script_bytes);
+    CsvField(row, CsvColumn::INITIAL_STACK_ITEMS) = CsvNumber(result.initial_stack_items);
+    CsvField(row, CsvColumn::INITIAL_STACK_BYTES) = CsvNumber(result.initial_stack_bytes);
+    CsvField(row, CsvColumn::VAROPS_CONSUMED) = CsvNumber(result.varops_consumed);
+    CsvField(row, CsvColumn::EXPECTED_TERMINATION) = ScriptErrorString(result.expected_error);
+    CsvField(row, CsvColumn::ACTUAL_TERMINATION) = ScriptErrorString(result.actual_error);
+    CsvField(row, CsvColumn::SATURATION) = result.saturation;
+    CsvField(row, CsvColumn::REPETITIONS) = CsvNumber(result.repetitions);
+    CsvField(row, CsvColumn::SEQUENCE_VAROPS) = CsvNumber(result.varops_per_repeat);
+}
+
+static bool FlushAndClose(std::ofstream& file, const fs::path& path)
+{
+    file.flush();
+    if (!file.good()) {
+        std::cerr << "Error: failed while writing " << path << "\n";
+        file.close();
+        return false;
+    }
+    file.close();
+    if (file.fail()) {
+        std::cerr << "Error: failed while closing " << path << "\n";
+        return false;
+    }
+    return true;
+}
+
+static bool SaveResultsToFile(const std::vector<BenchResult>& results, const std::string& filepath,
+                              const CorpusCounts& counts, const Options& options,
+                              const PromotionSummary& promotion)
+{
+    const fs::path output_target{fs::PathFromString(filepath)};
+    fs::path output_temporary{output_target};
+    output_temporary += ".tmp." + util::ToString(std::chrono::steady_clock::now().time_since_epoch().count());
+    std::ofstream output_file(output_temporary, std::ios::out | std::ios::trunc);
+    if (!output_file.is_open()) {
+        std::cerr << "Error: could not open temporary output file " << output_temporary << "\n";
+        return false;
+    }
+
+    size_t raw_sample_count{0};
+    for (const BenchResult& result : results)
+        raw_sample_count += result.samples.size();
+
+    output_file << "# Schema: bench_varops-v2\n";
+    output_file << GetBenchmarkSystemInfo();
+    output_file << "# Record types: summary=aggregated row; sample=normalized wall-clock measurement.\n";
+    output_file << "# Wall_Seconds: summary median or sample value; Schnorr samples are normalized to 80,000 validations.\n";
+    output_file << strprintf("# Records: summary=%u sample=%u\n", results.size(), raw_sample_count);
+    output_file << "# Synthetic envelope: every script is exactly 4,000,000 bytes; initial stack preparation is untimed.\n";
+    output_file << "# Sequence opcodes exclude OP_NOP envelope padding and the final cleanup/result suffix.\n";
+    output_file << strprintf("# Corpus: requested_opcodes=%u generated=%u completed=%u profile=full\n",
+                             counts.requested_opcodes, counts.generated_cases, counts.completed_cases);
+    output_file << strprintf("# Protocol: schnorr_samples=%u threshold=%.2f round_seed=0x%x stable_rounds=%u promoted=%u wall_cutoff=%.9f\n",
+                             SCHNORR_BASELINE_SAMPLES, PROMOTION_THRESHOLD,
+                             static_cast<unsigned int>(ROUND_SEED),
+                             options.stable_rounds, promotion.promoted_cases, promotion.promotion_cutoff_seconds);
+    output_file << "#\n";
+    output_file << CSV_HEADER << '\n';
+
+    const BenchResult* schnorr{Slowest(results, [](const BenchResult& result) {
+        return result.domain == ExecutionDomain::RAW_SCHNORR;
+    })};
+    const double one_schnorr{!schnorr || schnorr->median_sec == 0 ? 0 : schnorr->median_sec / SIGNATURES_PER_BLOCK};
+    for (size_t index{0}; index < results.size(); ++index) {
+        const BenchResult& result{results[index]};
+        CsvRow row;
+        SetResultIdentity(row, result);
+        CsvField(row, CsvColumn::RECORD_TYPE) = "summary";
+        CsvField(row, CsvColumn::RANK) = CsvNumber(index + 1);
+        CsvField(row, CsvColumn::PROMOTED) = result.promoted ? "true" : "false";
+        CsvField(row, CsvColumn::PROMOTION_REASONS) = JoinPromotionReasons(result.promotion_reasons);
+        CsvField(row, CsvColumn::STAGE) =
+            result.aggregate_stage ? TimingStageName(*result.aggregate_stage) : "unmeasured";
+        CsvField(row, CsvColumn::SAMPLES) = CsvNumber(result.aggregate_stage ? std::ranges::count_if(
+                                                                                   result.samples, [&](const TimingSample& sample) { return sample.stage == *result.aggregate_stage; }) :
+                                                                               0);
+        CsvField(row, CsvColumn::WALL_SECONDS) = CsvNumber(result.median_sec);
+        CsvField(row, CsvColumn::WALL_MIN_SECONDS) = CsvNumber(result.wall_min_sec);
+        CsvField(row, CsvColumn::WALL_MAX_SECONDS) = CsvNumber(result.wall_max_sec);
+        CsvField(row, CsvColumn::MDAPE) = CsvNumber(result.mdape);
+        CsvField(row, CsvColumn::SCHNORR_EQUIVALENTS) =
+            CsvNumber(one_schnorr == 0 ? 0 : result.median_sec / one_schnorr);
+        CsvField(row, CsvColumn::VAROPS_PERCENTAGE) =
+            CsvNumber(100.0 * result.varops_consumed / TOTAL_VAROPS_BUDGET);
+        WriteCsvRow(output_file, row);
+    }
+
+    for (const BenchResult& result : results) {
+        for (const TimingSample& sample : result.samples) {
+            CsvRow row;
+            CsvField(row, CsvColumn::RECORD_TYPE) = "sample";
+            CsvField(row, CsvColumn::NAME) = result.name;
+            CsvField(row, CsvColumn::PROMOTED) = result.promoted ? "true" : "false";
+            CsvField(row, CsvColumn::PROMOTION_REASONS) = JoinPromotionReasons(result.promotion_reasons);
+            CsvField(row, CsvColumn::STAGE) = TimingStageName(sample.stage);
+            CsvField(row, CsvColumn::ROUND) = CsvNumber(sample.round);
+            CsvField(row, CsvColumn::ORDER) = CsvNumber(sample.order);
+            CsvField(row, CsvColumn::WALL_SECONDS) = CsvNumber(sample.wall_sec);
+            WriteCsvRow(output_file, row);
+        }
+    }
+
+    if (!FlushAndClose(output_file, output_temporary)) {
+        std::error_code ignored;
+        fs::remove(output_temporary, ignored);
+        return false;
+    }
+    std::error_code rename_error;
+    fs::rename(output_temporary, output_target, rename_error);
+    if (rename_error) {
+        std::cerr << "Error: could not atomically replace " << output_target << ": " << rename_error.message() << "\n";
+        std::error_code ignored;
+        fs::remove(output_temporary, ignored);
+        return false;
+    }
+    return true;
+}
+
+static void PrintUsage(const char* program)
+{
+    std::cout << "Usage: " << program << " [OPTIONS]\n\n"
+              << "Options:\n"
+              << "  --opcodes OP_NAME...    Benchmark only explicitly supported opcodes\n"
+              << "  --epochs N              Stable measurement rounds (default: 7)\n"
+              << "  --list-opcodes          List the declarative opcode inventory\n"
+              << "  --silent                Suppress per-row progress\n"
+              << "  --file PATH             Atomically write a v2 summary-and-sample CSV\n"
+              << "  --help, -h              Show this help\n\n"
+              << "Protocol constants: promotion threshold 0.40, round seed 0x475352.\n\n"
+              << "Examples:\n"
+              << "  " << program << " --opcodes OP_ROLL OP_SHA256\n"
+              << "  " << program << " --opcodes OP_NOP --epochs 1 --file results.csv\n";
+}
+
+static Options ParseArguments(int argc, char* argv[])
+{
+    Options options;
+    const std::map<std::string, opcodetype> supported{SupportedOpcodeMap()};
+    for (int i{1}; i < argc; ++i) {
+        const std::string arg{argv[i]};
+        if (arg == "--opcodes") {
+            const int first{i + 1};
+            while (i + 1 < argc && std::string_view{argv[i + 1]}.substr(0, 2) != "--") {
+                const std::string requested{argv[++i]};
+                std::string name{ToUpper(requested)};
+                if (!name.starts_with("OP_")) name = "OP_" + name;
+                const auto found{supported.find(name)};
+                if (found == supported.end()) {
+                    throw std::runtime_error("unknown or unsupported opcode '" + requested + "'");
+                }
+                options.selected_opcodes.insert(found->second);
+            }
+            if (i + 1 == first) throw std::runtime_error("--opcodes requires at least one opcode");
+        } else if (arg == "--epochs") {
+            if (++i >= argc) throw std::runtime_error("--epochs requires a positive integer");
+            const std::optional<int> stable_rounds{ToIntegral<int>(argv[i])};
+            if (!stable_rounds || *stable_rounds <= 0) {
+                throw std::runtime_error("invalid --epochs value '" + std::string{argv[i]} + "'");
+            }
+            options.stable_rounds = *stable_rounds;
+        } else if (arg == "--list-opcodes") {
+            options.list_opcodes = true;
+        } else if (arg == "--silent") {
+            options.silent = true;
+        } else if (arg == "--file") {
+            if (++i >= argc) throw std::runtime_error("--file requires a path");
+            options.output_file = argv[i];
+        } else if (arg == "--help" || arg == "-h") {
+            PrintUsage(argv[0]);
+            std::exit(0);
+        } else {
+            throw std::runtime_error("unknown option '" + arg + "'");
+        }
+    }
+    return options;
+}
+
+} // namespace
+
+int main(int argc, char* argv[])
+{
+    try {
+        const Options options{ParseArguments(argc, argv)};
+        if (options.list_opcodes) {
+            for (const auto& [name, opcode] : SupportedOpcodeMap()) {
+                std::cout << strprintf("%s (0x%02x)\n", name, static_cast<unsigned int>(opcode));
+            }
+            return 0;
+        }
+
+        RunBoundarySelfChecks();
+        RunTimingSelfChecks();
+        SHA256AutoDetect();
+        const CryptoFixture fixture;
+        const std::vector<CaseSpec> specs{GenerateCaseSpecs(options)};
+        if (specs.empty()) throw std::runtime_error("the requested opcode set generated no cases");
+        ReleaseAllocatorCaches();
+
+        std::set<opcodetype> completed_opcodes;
+        std::vector<BenchResult> results;
+        results.reserve(specs.size() + 1);
+        CorpusCounts counts{
+            options.selected_opcodes.empty() ? OpcodeRegistry().size() : options.selected_opcodes.size(),
+            specs.size(),
+            0,
+        };
+        PromotionSummary promotion;
+
+        RunGlobalWarmup(fixture);
+        results.push_back(RunRawSchnorr(fixture));
+        promotion.promotion_cutoff_seconds = results.front().median_sec * PROMOTION_THRESHOLD;
+
+        if (!options.silent) {
+            std::cout << strprintf("\nDISCOVERY: %u rows, one sample each; Schnorr %.3f sec; cutoff %.3f sec\n",
+                                   specs.size(), results.front().median_sec,
+                                   promotion.promotion_cutoff_seconds);
+        }
+
+        for (size_t index{0}; index < specs.size(); ++index) {
+            MaterializedCase test_case{Materialize(specs[index], fixture)};
+            BenchResult result{RunDiscoveryCase(test_case, fixture, index)};
+            completed_opcodes.insert(specs[index].opcode);
+            results.push_back(std::move(result));
+            ++counts.completed_cases;
+            if (!options.silent) {
+                const BenchResult& completed{results.back()};
+                std::cout << strprintf("discover %u/%u %s  %.3f sec  %s\n",
+                                       index + 1, specs.size(), completed.name,
+                                       completed.median_sec,
+                                       ScriptErrorString(completed.actual_error));
+            }
+            ReleaseAllocatorCaches();
+        }
+
+        promotion = PromoteDiscoveryResults(results, results.front());
+        std::vector<size_t> promoted_indices;
+        promoted_indices.reserve(promotion.promoted_cases);
+        for (size_t index{1}; index < results.size(); ++index) {
+            if (results[index].promoted) promoted_indices.push_back(index);
+        }
+        const auto schedules{BuildRoundSchedules(promoted_indices, options.stable_rounds)};
+        if (!options.silent) {
+            std::cout << strprintf("\nSTABLE: %u/%u promoted rows, %u rounds, seed 0x%x\n",
+                                   promotion.promoted_cases, specs.size(), options.stable_rounds,
+                                   static_cast<unsigned int>(ROUND_SEED));
+        }
+        for (size_t round{0}; round < schedules.size(); ++round) {
+            for (size_t order{0}; order < schedules[round].size(); ++order) {
+                const size_t result_index{schedules[round][order]};
+                MaterializedCase test_case{Materialize(specs[result_index - 1], fixture)};
+                const BenchResult& metadata{results[result_index]};
+                const EvalOutcome expected{metadata.actual_error == SCRIPT_ERR_OK,
+                                           metadata.actual_error, metadata.varops_consumed};
+                TimingSample sample{RunTimedCaseSample(test_case, fixture, expected,
+                                                       TimingStage::STABLE, round + 1,
+                                                       order, true)};
+                if (!options.silent) {
+                    std::cout << strprintf("stable %u/%u %u/%u %s  %.3f sec  %s\n",
+                                           round + 1, schedules.size(), order + 1,
+                                           schedules[round].size(), metadata.name,
+                                           sample.wall_sec,
+                                           ScriptErrorString(metadata.actual_error));
+                }
+                results[result_index].samples.push_back(std::move(sample));
+            }
+        }
+        for (size_t index : promoted_indices)
+            AggregateSamples(results[index], TimingStage::STABLE);
+
+        for (opcodetype requested : options.selected_opcodes) {
+            if (!completed_opcodes.contains(requested)) {
+                throw std::runtime_error("requested opcode produced no completed row: " + OpcodeName(requested));
+            }
+        }
+        std::sort(results.begin(), results.end(), [](const BenchResult& left, const BenchResult& right) {
+            return left.median_sec > right.median_sec;
+        });
+        PrintReport(results, counts, options, promotion);
+        if (!options.output_file.empty() &&
+            !SaveResultsToFile(results, options.output_file, counts, options, promotion)) {
+            return 1;
+        }
+        return 0;
+    } catch (const std::exception& exception) {
+        std::cerr << "bench_varops: " << exception.what() << "\n";
+        return 1;
+    }
+}
diff --git a/src/binana/script_restoration.json b/src/binana/script_restoration.json
new file mode 100644
index 000000000000..d908572da482
--- /dev/null
+++ b/src/binana/script_restoration.json
@@ -0,0 +1,6 @@
+{
+    "binana": [2026, 441, 0],
+    "deployment": "SCRIPT_RESTORATION",
+    "scriptverify": true,
+    "scriptverify_discourage": true
+}
diff --git a/src/bitcoin-util.cpp b/src/bitcoin-util.cpp
index 8a0c4531a9b9..769e84ef3579 100644
--- a/src/bitcoin-util.cpp
+++ b/src/bitcoin-util.cpp
@@ -179,6 +179,7 @@ static std::string sigver2str(SigVersion sigver)
     case SigVersion::WITNESS_V0: return "witness_v0";
     case SigVersion::TAPROOT: return "taproot";
     case SigVersion::TAPSCRIPT: return "tapscript";
+    case SigVersion::TAPSCRIPT_V2: return "tapscript_v2";
     }
     return "unknown";
 }
@@ -369,7 +370,7 @@ static int EvalScript(const ArgsManager& argsman, const std::vector<std::string>
 
     std::optional<bool> opsuccess_check;
     if (sigversion == SigVersion::TAPSCRIPT) {
-        opsuccess_check = CheckTapscriptOpSuccess(script, flags, &serror);
+        opsuccess_check = CheckTapscriptOpSuccess(script, flags, SigVersion::TAPSCRIPT, &serror);
     }
 
     bool success = (opsuccess_check.has_value() ? *opsuccess_check : EvalScript(stack, script, flags, *Assert(checker), sigversion, execdata, &serror));
diff --git a/src/kernel/CMakeLists.txt b/src/kernel/CMakeLists.txt
index fd0768b92f52..19931d9d3da9 100644
--- a/src/kernel/CMakeLists.txt
+++ b/src/kernel/CMakeLists.txt
@@ -53,6 +53,8 @@ add_library(bitcoinkernel
   ../script/script_error.cpp
   ../script/sigcache.cpp
   ../script/solver.cpp
+  ../script/val64.cpp
+  ../script/valtype_stack.cpp
   ../signet.cpp
   ../streams.cpp
   ../support/lockedpool.cpp
diff --git a/src/node/psbt.cpp b/src/node/psbt.cpp
index 51e252bffca5..1acefb862f48 100644
--- a/src/node/psbt.cpp
+++ b/src/node/psbt.cpp
@@ -10,6 +10,7 @@
 #include <policy/settings.h>
 #include <tinyformat.h>
 
+#include <algorithm>
 #include <numeric>
 
 namespace node {
@@ -25,6 +26,9 @@ PSBTAnalysis AnalyzePSBT(PartiallySignedTransaction psbtx)
     result.inputs.resize(psbtx.tx->vin.size());
 
     const PrecomputedTransactionData txdata = PrecomputePSBTData(psbtx);
+    const bool all_inputs_finalized{std::all_of(psbtx.inputs.begin(), psbtx.inputs.end(), [](const PSBTInput& input) {
+        return PSBTInputSigned(input);
+    })};
 
     for (unsigned int i = 0; i < psbtx.tx->vin.size(); ++i) {
         PSBTInput& input = psbtx.inputs[i];
@@ -59,7 +63,9 @@ PSBTAnalysis AnalyzePSBT(PartiallySignedTransaction psbtx)
         }
 
         // Check if it is final
-        if (!PSBTInputSignedAndVerified(psbtx, i, &txdata)) {
+        if (all_inputs_finalized && !utxo.IsNull()) {
+            input_analysis.is_final = true;
+        } else if (!PSBTInputSignedAndVerified(psbtx, i, &txdata)) {
             input_analysis.is_final = false;
 
             // Figure out what is missing
@@ -95,6 +101,11 @@ PSBTAnalysis AnalyzePSBT(PartiallySignedTransaction psbtx)
     }
     assert(result.next > PSBTRole::CREATOR);
 
+    if (result.next == PSBTRole::EXTRACTOR && !PSBTInputsSignedAndVerified(psbtx, txdata)) {
+        result.SetInvalid("PSBT is not valid. Finalized transaction failed script verification");
+        return result;
+    }
+
     if (calc_fee) {
         // Get the output amount
         CAmount out_amt = std::accumulate(psbtx.tx->vout.begin(), psbtx.tx->vout.end(), CAmount(0),
diff --git a/src/psbt.cpp b/src/psbt.cpp
index 19d855e4c78b..0dcc3b6c0141 100644
--- a/src/psbt.cpp
+++ b/src/psbt.cpp
@@ -4,9 +4,11 @@
 
 #include <psbt.h>
 
+#include <consensus/validation.h>
 #include <node/types.h>
 #include <policy/policy.h>
 #include <script/signingprovider.h>
+#include <script/varops.h>
 #include <util/check.h>
 #include <util/strencodings.h>
 
@@ -295,6 +297,18 @@ bool PSBTInputSigned(const PSBTInput& input)
     return !input.final_script_sig.empty() || !input.final_script_witness.IsNull();
 }
 
+// PSBT transactions omit final scriptSigs and witnesses.
+static CMutableTransaction GetFinalizedPSBTTransaction(const PartiallySignedTransaction& psbt)
+{
+    CMutableTransaction mtx{*psbt.tx};
+    for (unsigned int i = 0; i < mtx.vin.size(); ++i) {
+        const PSBTInput& input{psbt.inputs.at(i)};
+        mtx.vin[i].scriptSig = input.final_script_sig;
+        mtx.vin[i].scriptWitness = input.final_script_witness;
+    }
+    return mtx;
+}
+
 bool PSBTInputSignedAndVerified(const PartiallySignedTransaction psbt, unsigned int input_index, const PrecomputedTransactionData* txdata)
 {
     CTxOut utxo;
@@ -317,11 +331,39 @@ bool PSBTInputSignedAndVerified(const PartiallySignedTransaction psbt, unsigned
         return false;
     }
 
+    // An incomplete PSBT's finalized weight is a conservative lower bound on its eventual varops budget.
+    const CTransaction finalized_tx{GetFinalizedPSBTTransaction(psbt)};
+    varops::Budget varops_budget{varops::TxBudget(GetTransactionWeight(finalized_tx))};
     if (txdata) {
-        return VerifyScript(input.final_script_sig, utxo.scriptPubKey, &input.final_script_witness, STANDARD_SCRIPT_VERIFY_FLAGS, MutableTransactionSignatureChecker{&(*psbt.tx), input_index, utxo.nValue, *txdata, MissingDataBehavior::FAIL});
+        return VerifyScript(input.final_script_sig, utxo.scriptPubKey, &input.final_script_witness,
+                            STANDARD_SCRIPT_VERIFY_FLAGS,
+                            MutableTransactionSignatureChecker{&(*psbt.tx), input_index, utxo.nValue, *txdata, MissingDataBehavior::FAIL},
+                            nullptr, varops_budget);
     } else {
-        return VerifyScript(input.final_script_sig, utxo.scriptPubKey, &input.final_script_witness, STANDARD_SCRIPT_VERIFY_FLAGS, MutableTransactionSignatureChecker{&(*psbt.tx), input_index, utxo.nValue, MissingDataBehavior::FAIL});
+        return VerifyScript(input.final_script_sig, utxo.scriptPubKey, &input.final_script_witness,
+                            STANDARD_SCRIPT_VERIFY_FLAGS,
+                            MutableTransactionSignatureChecker{&(*psbt.tx), input_index, utxo.nValue, MissingDataBehavior::FAIL},
+                            nullptr, varops_budget);
+    }
+}
+
+bool PSBTInputsSignedAndVerified(const PartiallySignedTransaction& psbt, const PrecomputedTransactionData& psbt_txdata)
+{
+    const CTransaction tx{GetFinalizedPSBTTransaction(psbt)};
+    if (!psbt_txdata.m_spent_outputs_ready) return false;
+
+    PrecomputedTransactionData txdata;
+    txdata.Init(tx, std::vector<CTxOut>{psbt_txdata.m_spent_outputs}, true);
+    varops::Budget varops_budget{varops::TxBudget(GetTransactionWeight(tx))};
+
+    for (unsigned int i = 0; i < tx.vin.size(); ++i) {
+        const CTxOut& utxo{psbt_txdata.m_spent_outputs[i]};
+        if (!VerifyScript(tx.vin[i].scriptSig, utxo.scriptPubKey, &tx.vin[i].scriptWitness, STANDARD_SCRIPT_VERIFY_FLAGS, TransactionSignatureChecker{&tx, i, utxo.nValue, txdata, MissingDataBehavior::FAIL}, nullptr, varops_budget)) {
+            return false;
+        }
     }
+
+    return true;
 }
 
 size_t CountPSBTUnsignedInputs(const PartiallySignedTransaction& psbt) {
@@ -489,7 +531,7 @@ bool FinalizePSBT(PartiallySignedTransaction& psbtx)
         complete &= SignPSBTInput(DUMMY_SIGNING_PROVIDER, psbtx, i, &txdata, SIGHASH_ALL, nullptr, true);
     }
 
-    return complete;
+    return complete && PSBTInputsSignedAndVerified(psbtx, txdata);
 }
 
 bool FinalizeAndExtractPSBT(PartiallySignedTransaction& psbtx, CMutableTransaction& result)
@@ -500,11 +542,7 @@ bool FinalizeAndExtractPSBT(PartiallySignedTransaction& psbtx, CMutableTransacti
         return false;
     }
 
-    result = *psbtx.tx;
-    for (unsigned int i = 0; i < result.vin.size(); ++i) {
-        result.vin[i].scriptSig = psbtx.inputs[i].final_script_sig;
-        result.vin[i].scriptWitness = psbtx.inputs[i].final_script_witness;
-    }
+    result = GetFinalizedPSBTTransaction(psbtx);
     return true;
 }
 
diff --git a/src/psbt.h b/src/psbt.h
index 6d49864b3cdb..8a02b05e52a3 100644
--- a/src/psbt.h
+++ b/src/psbt.h
@@ -1231,6 +1231,9 @@ bool PSBTInputSigned(const PSBTInput& input);
 /** Checks whether a PSBTInput is already signed by doing script verification using final fields. */
 bool PSBTInputSignedAndVerified(const PartiallySignedTransaction psbt, unsigned int input_index, const PrecomputedTransactionData* txdata);
 
+/** Checks whether all PSBT inputs are signed under one transaction-wide varops budget. */
+bool PSBTInputsSignedAndVerified(const PartiallySignedTransaction& psbt, const PrecomputedTransactionData& txdata);
+
 /** Signs a PSBTInput, verifying that all provided data matches what is being signed.
  *
  * txdata should be the output of PrecomputePSBTData (which can be shared across
diff --git a/src/rpc/rawtransaction.cpp b/src/rpc/rawtransaction.cpp
index d6dd4f78a6aa..0d9fcf9ad2d7 100644
--- a/src/rpc/rawtransaction.cpp
+++ b/src/rpc/rawtransaction.cpp
@@ -555,7 +555,7 @@ static RPCHelpMan decodescript()
         for (CScript::const_iterator it{script.begin()}; it != script.end();) {
             opcodetype op;
             CHECK_NONFATAL(script.GetOp(it, op));
-            if (op == OP_CHECKSIGADD || IsOpSuccess(op)) {
+            if (op == OP_CHECKSIGADD || IsOpSuccess(op, SigVersion::TAPSCRIPT)) {
                 return false;
             }
         }
@@ -1977,6 +1977,12 @@ RPCHelpMan descriptorprocesspsbt()
         complete &= PSBTInputSigned(input);
     }
 
+    CMutableTransaction mtx;
+    if (complete) {
+        PartiallySignedTransaction psbtx_copy = psbtx;
+        complete = FinalizeAndExtractPSBT(psbtx_copy, mtx);
+    }
+
     DataStream ssTx{};
     ssTx << psbtx;
 
@@ -1985,9 +1991,6 @@ RPCHelpMan descriptorprocesspsbt()
     result.pushKV("psbt", EncodeBase64(ssTx));
     result.pushKV("complete", complete);
     if (complete) {
-        CMutableTransaction mtx;
-        PartiallySignedTransaction psbtx_copy = psbtx;
-        CHECK_NONFATAL(FinalizeAndExtractPSBT(psbtx_copy, mtx));
         DataStream ssTx_final;
         ssTx_final << TX_WITH_WITNESS(mtx);
         result.pushKV("hex", HexStr(ssTx_final));
diff --git a/src/script/interpreter.cpp b/src/script/interpreter.cpp
index be2eafc6f8a0..1b7168614e82 100644
--- a/src/script/interpreter.cpp
+++ b/src/script/interpreter.cpp
@@ -5,12 +5,16 @@
 
 #include <script/interpreter.h>
 
+#include <algorithm>
 #include <binana.h>
 #include <crypto/ripemd160.h>
 #include <crypto/sha1.h>
 #include <crypto/sha256.h>
 #include <pubkey.h>
 #include <script/script.h>
+#include <script/val64.h>
+#include <script/valtype_stack.h>
+#include <script/varops.h>
 #include <tinyformat.h>
 #include <uint256.h>
 
@@ -62,6 +66,17 @@ static inline void popstack(std::vector<valtype>& stack)
     stack.pop_back();
 }
 
+static inline void popstack(ValtypeStack& stack)
+{
+    stack.pop_back();
+}
+
+static void PushCosted(ValtypeStack& stack, const valtype& value, uint64_t& varcost)
+{
+    varcost += value.size() * varops::COST_COPYING;
+    stack.push_back(value);
+}
+
 bool static IsCompressedOrUncompressedPubKey(const valtype &vchPubKey) {
     if (vchPubKey.size() < CPubKey::COMPRESSED_SIZE) {
         //  Non-canonical public key: too short
@@ -347,7 +362,7 @@ static bool EvalChecksigPreTapscript(const valtype& vchSig, const valtype& vchPu
 
 static bool EvalChecksigTapscript(const valtype& sig, const valtype& pubkey, ScriptExecutionData& execdata, script_verify_flags flags, const BaseSignatureChecker& checker, SigVersion sigversion, ScriptError* serror, bool& success)
 {
-    assert(sigversion == SigVersion::TAPSCRIPT);
+    assert(IsTapscript(sigversion));
     assert(execdata.m_internal_key); // caller must provide the internal key
 
     /*
@@ -357,7 +372,7 @@ static bool EvalChecksigTapscript(const valtype& sig, const valtype& pubkey, Scr
      *    the script execution fails when using non-empty invalid signature.
      */
     success = !sig.empty();
-    if (success) {
+    if (success && sigversion == SigVersion::TAPSCRIPT) {
         // Implement the sigops/witnesssize ratio test.
         // Passing with an upgradable public key version is also counted.
         assert(execdata.m_validation_weight_left_init);
@@ -372,7 +387,9 @@ static bool EvalChecksigTapscript(const valtype& sig, const valtype& pubkey, Scr
         if (success && !checker.CheckSchnorrSignature(sig, KeyVersion::TAPROOT, pubkey, sigversion, execdata, serror)) {
             return false; // serror is set
         }
-    } else if ((pubkey.size() == 1 || pubkey.size() == 33) && pubkey[0] == BIP118_PUBKEY_PREFIX) {
+    } else if (sigversion == SigVersion::TAPSCRIPT &&
+               (pubkey.size() == 1 || pubkey.size() == 33) &&
+               pubkey[0] == BIP118_PUBKEY_PREFIX) {
         if ((flags & SCRIPT_VERIFY_DISCOURAGE_ANYPREVOUT) != 0) {
             return set_error(serror, SCRIPT_ERR_DISCOURAGE_ANYPREVOUT);
         } else if ((flags & SCRIPT_VERIFY_ANYPREVOUT) == 0) {
@@ -414,7 +431,8 @@ static bool EvalChecksig(const valtype& sig, const valtype& pubkey, CScript::con
     case SigVersion::TAPSCRIPT:
         return EvalChecksigTapscript(sig, pubkey, execdata, flags, checker, sigversion, serror, success);
     case SigVersion::TAPROOT:
-        // Key path spending in Taproot has no script, so this is unreachable.
+    case SigVersion::TAPSCRIPT_V2:
+        // Taproot has no script, and Tapscript v2 calls EvalChecksigTapscript directly.
         break;
     }
     assert(false);
@@ -471,6 +489,10 @@ static bool EvalChecksigFromStack(const valtype& sig, const valtype& msg, const
 
 bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript& script, script_verify_flags flags, const BaseSignatureChecker& checker, SigVersion sigversion, ScriptExecutionData& execdata, ScriptError* serror)
 {
+    if (sigversion == SigVersion::TAPSCRIPT_V2) {
+        return set_error(serror, SCRIPT_ERR_UNKNOWN_ERROR);
+    }
+
     static const CScriptNum bnZero(0);
     static const CScriptNum bnOne(1);
     // static const CScriptNum bnFalse(0);
@@ -1411,177 +1433,1113 @@ bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript&
     return set_success(serror);
 }
 
-bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript& script, script_verify_flags flags, const BaseSignatureChecker& checker, SigVersion sigversion, ScriptError* serror)
+bool EvalTapscriptV2(ValtypeStack& stack, const CScript& script, script_verify_flags flags, const BaseSignatureChecker& checker, ScriptExecutionData& execdata, varops::Budget& varops_budget, ScriptError* serror)
 {
-    ScriptExecutionData execdata;
-    return EvalScript(stack, script, flags, checker, sigversion, execdata, serror);
-}
-
-namespace {
+    static const valtype vchFalse(0);
+    static const valtype vchTrue(1, 1);
 
-/**
- * Wrapper that serializes like CTransaction, but with the modifications
- *  required for the signature hash done in-place
- */
-template <class T>
-class CTransactionSignatureSerializer
-{
-private:
-    const T& txTo;             //!< reference to the spending transaction (the one being serialized)
-    const CScript& scriptCode; //!< output script being consumed
-    const unsigned int nIn;    //!< input index of txTo being signed
-    const bool fAnyoneCanPay;  //!< whether the hashtype has the SIGHASH_ANYONECANPAY flag set
-    const bool fHashSingle;    //!< whether the hashtype is SIGHASH_SINGLE
-    const bool fHashNone;      //!< whether the hashtype is SIGHASH_NONE
+    CScript::const_iterator pc = script.begin();
+    CScript::const_iterator pend = script.end();
+    opcodetype opcode;
+    valtype vchPushValue;
+    ConditionStack vfExec;
+    ValtypeStack altstack;
+    set_error(serror, SCRIPT_ERR_UNKNOWN_ERROR);
+    bool fRequireMinimal = (flags & SCRIPT_VERIFY_MINIMALDATA) != 0;
+    uint32_t opcode_pos = 0;
+    execdata.m_codeseparator_pos = 0xFFFFFFFFUL;
+    execdata.m_codeseparator_pos_init = true;
 
-public:
-    CTransactionSignatureSerializer(const T& txToIn, const CScript& scriptCodeIn, unsigned int nInIn, int nHashTypeIn) :
-        txTo(txToIn), scriptCode(scriptCodeIn), nIn(nInIn),
-        fAnyoneCanPay(!!(nHashTypeIn & SIGHASH_ANYONECANPAY)),
-        fHashSingle((nHashTypeIn & 0x1f) == SIGHASH_SINGLE),
-        fHashNone((nHashTypeIn & 0x1f) == SIGHASH_NONE) {}
+    try
+    {
+        for (; pc < pend; ++opcode_pos) {
+            bool fExec = vfExec.all_true();
+            uint64_t varcost = 0;
 
-    /** Serialize the passed scriptCode, skipping OP_CODESEPARATORs */
-    template<typename S>
-    void SerializeScriptCode(S &s) const {
-        CScript::const_iterator it = scriptCode.begin();
-        CScript::const_iterator itBegin = it;
-        opcodetype opcode;
-        unsigned int nCodeSeparators = 0;
-        while (scriptCode.GetOp(it, opcode)) {
-            if (opcode == OP_CODESEPARATOR)
-                nCodeSeparators++;
-        }
-        ::WriteCompactSize(s, scriptCode.size() - nCodeSeparators);
-        it = itBegin;
-        while (scriptCode.GetOp(it, opcode)) {
-            if (opcode == OP_CODESEPARATOR) {
-                s.write(AsBytes(Span{&itBegin[0], size_t(it - itBegin - 1)}));
-                itBegin = it;
-            }
-        }
-        if (itBegin != scriptCode.end())
-            s.write(AsBytes(Span{&itBegin[0], size_t(it - itBegin)}));
-    }
+            // Linear operations accumulate varcost and spend it after stack/size
+            // checks at the end of the iteration. Superlinear operations, such
+            // as OP_MUL/OP_DIV/OP_MOD, and signature checks must spend before
+            // doing the DoS-sensitive work.
 
-    /** Serialize an input of txTo */
-    template<typename S>
-    void SerializeInput(S &s, unsigned int nInput) const {
-        // In case of SIGHASH_ANYONECANPAY, only the input being signed is serialized
-        if (fAnyoneCanPay)
-            nInput = nIn;
-        // Serialize the prevout
-        ::Serialize(s, txTo.vin[nInput].prevout);
-        // Serialize the script
-        if (nInput != nIn)
-            // Blank out other inputs' signatures
-            ::Serialize(s, CScript());
-        else
-            SerializeScriptCode(s);
-        // Serialize the nSequence
-        if (nInput != nIn && (fHashSingle || fHashNone))
-            // let the others update at will
-            ::Serialize(s, int32_t{0});
-        else
-            ::Serialize(s, txTo.vin[nInput].nSequence);
-    }
+            //
+            // Read instruction
+            //
+            if (!script.GetOp(pc, opcode, vchPushValue))
+                return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
+            if (vchPushValue.size() > MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE)
+                return set_error(serror, SCRIPT_ERR_PUSH_SIZE);
 
-    /** Serialize an output of txTo */
-    template<typename S>
-    void SerializeOutput(S &s, unsigned int nOutput) const {
-        if (fHashSingle && nOutput != nIn)
-            // Do not lock-in the txout payee at other indices as txin
-            ::Serialize(s, CTxOut());
-        else
-            ::Serialize(s, txTo.vout[nOutput]);
-    }
+            if (fExec && 0 <= opcode && opcode <= OP_PUSHDATA4) {
+                if (fRequireMinimal && !CheckMinimalPush(vchPushValue, opcode)) {
+                    return set_error(serror, SCRIPT_ERR_MINIMALDATA);
+                }
+                stack.push_back(std::move(vchPushValue));
+            } else if (fExec || (OP_IF <= opcode && opcode <= OP_ENDIF))
+            switch (opcode)
+            {
+                //
+                // Push value
+                //
+                case OP_1NEGATE:
+                case OP_1:
+                case OP_2:
+                case OP_3:
+                case OP_4:
+                case OP_5:
+                case OP_6:
+                case OP_7:
+                case OP_8:
+                case OP_9:
+                case OP_10:
+                case OP_11:
+                case OP_12:
+                case OP_13:
+                case OP_14:
+                case OP_15:
+                case OP_16:
+                {
+                    // ( -- value)
+                    CScriptNum bn((int)opcode - (int)(OP_1 - 1));
+                    stack.push_back(bn.getvch());
+                    // The result of these opcodes should always be the minimal way to push the data
+                    // they push, so no need for a CheckMinimalPush here.
+                }
+                break;
 
-    /** Serialize txTo */
-    template<typename S>
-    void Serialize(S &s) const {
-        // Serialize version
-        ::Serialize(s, txTo.version);
-        // Serialize vin
-        unsigned int nInputs = fAnyoneCanPay ? 1 : txTo.vin.size();
-        ::WriteCompactSize(s, nInputs);
-        for (unsigned int nInput = 0; nInput < nInputs; nInput++)
-             SerializeInput(s, nInput);
-        // Serialize vout
-        unsigned int nOutputs = fHashNone ? 0 : (fHashSingle ? nIn+1 : txTo.vout.size());
-        ::WriteCompactSize(s, nOutputs);
-        for (unsigned int nOutput = 0; nOutput < nOutputs; nOutput++)
-             SerializeOutput(s, nOutput);
-        // Serialize nLockTime
-        ::Serialize(s, txTo.nLockTime);
-    }
-};
 
-/** Compute the (single) SHA256 of the concatenation of all prevouts of a tx. */
-template <class T>
-uint256 GetPrevoutsSHA256(const T& txTo)
-{
-    HashWriter ss{};
-    for (const auto& txin : txTo.vin) {
-        ss << txin.prevout;
-    }
-    return ss.GetSHA256();
-}
+                //
+                // Control
+                //
+                case OP_NOP:
+                    break;
 
-/** Compute the (single) SHA256 of the concatenation of all nSequences of a tx. */
-template <class T>
-uint256 GetSequencesSHA256(const T& txTo)
-{
-    HashWriter ss{};
-    for (const auto& txin : txTo.vin) {
-        ss << txin.nSequence;
-    }
-    return ss.GetSHA256();
-}
+                case OP_CHECKLOCKTIMEVERIFY:
+                {
+                    if (!(flags & SCRIPT_VERIFY_CHECKLOCKTIMEVERIFY)) {
+                        // not enabled; treat as a NOP2
+                        break;
+                    }
 
-/** Compute the (single) SHA256 of the concatenation of all txouts of a tx. */
-template <class T>
-uint256 GetOutputsSHA256(const T& txTo)
-{
-    HashWriter ss{};
-    for (const auto& txout : txTo.vout) {
-        ss << txout;
-    }
-    return ss.GetSHA256();
-}
+                    Val64 v;
+                    if (!stack.PopVal64(v)) {
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    }
+                    // 32 bit limit: anything greater is an equivalent
+                    // "always fail", reported as UNSATISFIED_LOCKTIME for
+                    // lack of a more specific error code.
+                    const uint64_t nl{v.ToU64Ceil(UINT64_C(0x100000000), varcost)};
+                    if (nl == UINT64_C(0x100000000)) {
+                        return set_error(serror, SCRIPT_ERR_UNSATISFIED_LOCKTIME);
+                    }
+                    const CScriptNum lock_time{static_cast<int64_t>(nl)};
+                    stack.push_back(v.MoveToValtype());
 
-/** Compute the (single) SHA256 of the concatenation of all amounts spent by a tx. */
-uint256 GetSpentAmountsSHA256(const std::vector<CTxOut>& outputs_spent)
-{
-    HashWriter ss{};
-    for (const auto& txout : outputs_spent) {
-        ss << txout.nValue;
+                    // Actually compare the specified lock time with the transaction.
+                    if (!checker.CheckLockTime(lock_time))
+                        return set_error(serror, SCRIPT_ERR_UNSATISFIED_LOCKTIME);
 
-    }
-    return ss.GetSHA256();
-}
+                    break;
+                }
 
-/** Compute the (single) SHA256 of the concatenation of all scriptSigs in a tx. */
-template <class T>
-uint256 GetScriptSigsSHA256(const T& txTo)
-{
-    HashWriter ss{};
-    for (const auto& in : txTo.vin) {
-        ss << in.scriptSig;
-    }
-    return ss.GetSHA256();
-}
+                case OP_CHECKSEQUENCEVERIFY:
+                {
+                    if (!(flags & SCRIPT_VERIFY_CHECKSEQUENCEVERIFY)) {
+                        // not enabled; treat as a NOP3
+                        break;
+                    }
 
-/** Compute the (single) SHA256 of the concatenation of all scriptPubKeys spent by a tx. */
-uint256 GetSpentScriptsSHA256(const std::vector<CTxOut>& outputs_spent)
-{
-    HashWriter ss{};
-    for (const auto& txout : outputs_spent) {
-        ss << txout.scriptPubKey;
-    }
-    return ss.GetSHA256();
-}
+                    // nSequence, like nLockTime, is a 32-bit unsigned integer
+                    // field. See the comment in CHECKLOCKTIMEVERIFY regarding
+                    // 5-byte numeric operands.
+                    Val64 v;
+                    if (!stack.PopVal64(v)) {
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    }
+                    // 32 bit limit: anything greater is an equivalent
+                    // "always fail", reported as UNSATISFIED_LOCKTIME for
+                    // lack of a more specific error code. Check this before
+                    // the CSV disable flag and BIP68 mask can discard high
+                    // bits.
+                    const uint64_t ns{v.ToU64Ceil(UINT64_C(0x100000000), varcost)};
+                    if (ns == UINT64_C(0x100000000)) {
+                        return set_error(serror, SCRIPT_ERR_UNSATISFIED_LOCKTIME);
+                    }
+                    const CScriptNum sequence{static_cast<int64_t>(ns)};
+                    stack.push_back(v.MoveToValtype());
 
-/* Not Exported, just convenience */
+                    // To provide for future soft-fork extensibility, if the
+                    // operand has the disabled lock-time flag set,
+                    // CHECKSEQUENCEVERIFY behaves as a NOP.
+                    if ((sequence & CTxIn::SEQUENCE_LOCKTIME_DISABLE_FLAG) != 0)
+                        break;
+
+                    // Compare the specified sequence number with the input.
+                    if (!checker.CheckSequence(sequence))
+                        return set_error(serror, SCRIPT_ERR_UNSATISFIED_LOCKTIME);
+
+                    break;
+                }
+
+                case OP_NOP1: case OP_NOP4: case OP_NOP5:
+                case OP_NOP6: case OP_NOP7: case OP_NOP8: case OP_NOP9: case OP_NOP10:
+                {
+                    if (flags & SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_NOPS)
+                        return set_error(serror, SCRIPT_ERR_DISCOURAGE_UPGRADABLE_NOPS);
+                }
+                break;
+
+                case OP_IF:
+                case OP_NOTIF:
+                {
+                    // <expression> if [statements] [else [statements]] endif
+                    bool fValue = false;
+                    if (fExec)
+                    {
+                        if (stack.size() < 1)
+                            return set_error(serror, SCRIPT_ERR_UNBALANCED_CONDITIONAL);
+                        const valtype& vch = stacktop(-1);
+                        // Tapscript requires minimal IF/NOTIF inputs as a consensus rule.
+                        // The input argument to the OP_IF and OP_NOTIF opcodes must be either
+                        // exactly 0 (the empty vector) or exactly 1 (the one-byte vector with value 1).
+                        if (vch.size() > 1 || (vch.size() == 1 && vch[0] != 1)) {
+                            return set_error(serror, SCRIPT_ERR_TAPSCRIPT_MINIMALIF);
+                        }
+                        fValue = CastToBool(vch);
+                        if (opcode == OP_NOTIF)
+                            fValue = !fValue;
+                        popstack(stack);
+                    }
+                    vfExec.push_back(fValue);
+                }
+                break;
+
+                case OP_ELSE:
+                {
+                    if (vfExec.empty())
+                        return set_error(serror, SCRIPT_ERR_UNBALANCED_CONDITIONAL);
+                    vfExec.toggle_top();
+                }
+                break;
+
+                case OP_ENDIF:
+                {
+                    if (vfExec.empty())
+                        return set_error(serror, SCRIPT_ERR_UNBALANCED_CONDITIONAL);
+                    vfExec.pop_back();
+                }
+                break;
+
+                case OP_VERIFY:
+                {
+                    // (true -- ) or
+                    // (false -- false) and return
+                    if (stack.size() < 1)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    Val64 v;
+                    if (!stack.PopVal64(v)) {
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    }
+                    if (v.IsZero(varcost))
+                        return set_error(serror, SCRIPT_ERR_VERIFY);
+                }
+                break;
+
+                case OP_RETURN:
+                {
+                    return set_error(serror, SCRIPT_ERR_OP_RETURN);
+                }
+                break;
+
+
+                //
+                // Stack ops
+                //
+                case OP_TOALTSTACK:
+                {
+                    if (stack.size() < 1)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    altstack.push_back(stack.PopBackValue());
+                }
+                break;
+
+                case OP_FROMALTSTACK:
+                {
+                    if (altstack.size() < 1)
+                        return set_error(serror, SCRIPT_ERR_INVALID_ALTSTACK_OPERATION);
+                    stack.push_back(altstack.PopBackValue());
+                }
+                break;
+
+                case OP_2DROP:
+                {
+                    // (x1 x2 -- )
+                    if (stack.size() < 2)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    popstack(stack);
+                    popstack(stack);
+                }
+                break;
+
+                case OP_2DUP:
+                {
+                    // (x1 x2 -- x1 x2 x1 x2)
+                    if (stack.size() < 2)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    stack.reserve(stack.size() + 2);
+                    const valtype& vch1 = stacktop(-2);
+                    const valtype& vch2 = stacktop(-1);
+                    // BIP 440 cost: (length(A) + length(B)) * 3 (COPYING).
+                    PushCosted(stack, vch1, varcost);
+                    PushCosted(stack, vch2, varcost);
+                }
+                break;
+
+                case OP_3DUP:
+                {
+                    // (x1 x2 x3 -- x1 x2 x3 x1 x2 x3)
+                    if (stack.size() < 3)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    stack.reserve(stack.size() + 3);
+                    const valtype& vch1 = stacktop(-3);
+                    const valtype& vch2 = stacktop(-2);
+                    const valtype& vch3 = stacktop(-1);
+                    // BIP 440 cost: (length(A) + length(B) + length(C)) * 3 (COPYING).
+                    PushCosted(stack, vch1, varcost);
+                    PushCosted(stack, vch2, varcost);
+                    PushCosted(stack, vch3, varcost);
+                }
+                break;
+                case OP_2OVER:
+                {
+                    // (x1 x2 x3 x4 -- x1 x2 x3 x4 x1 x2)
+                    if (stack.size() < 4)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    stack.reserve(stack.size() + 2);
+                    const valtype& vch1 = stacktop(-4);
+                    const valtype& vch2 = stacktop(-3);
+                    // BIP 440 cost: (length(C) + length(D)) * 3 (COPYING).
+                    PushCosted(stack, vch1, varcost);
+                    PushCosted(stack, vch2, varcost);
+                }
+                break;
+
+                case OP_2ROT:
+                {
+                    // (x1 x2 x3 x4 x5 x6 -- x3 x4 x5 x6 x1 x2)
+                    if (stack.size() < 6)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    stack.Rotate(-6, -4);
+                }
+                break;
+
+                case OP_2SWAP:
+                {
+                    // (x1 x2 x3 x4 -- x3 x4 x1 x2)
+                    if (stack.size() < 4)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    stack.Swap(-4, -2);
+                    stack.Swap(-3, -1);
+                }
+                break;
+
+                case OP_IFDUP:
+                {
+                    // (x - 0 | x x)
+                    Val64 v64;
+                    if (!stack.PopVal64(v64))
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    const bool result{!v64.IsZero(varcost)};
+                    valtype vch{v64.MoveToValtype()};
+                    // BIP 440 cost: W(length(A)) * 2 + length(A) * 3 (COMPARINGZERO + COPYING).
+                    varcost += vch.size() * varops::COST_COPYING;
+                    if (result)
+                        stack.push_back(vch);
+                    stack.push_back(std::move(vch));
+                }
+                break;
+
+                case OP_DEPTH:
+                {
+                    // -- stacksize
+                    Val64 v(stack.size());
+                    valtype vch = v.MoveToValtype();
+                    stack.push_back(std::move(vch));
+                }
+                break;
+
+                case OP_DROP:
+                {
+                    // (x -- )
+                    if (stack.size() < 1)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    popstack(stack);
+                }
+                break;
+
+                case OP_DUP:
+                {
+                    // (x -- x x)
+                    if (stack.size() < 1)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    stack.reserve(stack.size() + 1);
+                    const valtype& vch = stacktop(-1);
+                    // BIP 440 cost: length(A) * 3 (COPYING).
+                    PushCosted(stack, vch, varcost);
+                }
+                break;
+
+                case OP_NIP:
+                {
+                    // (x1 x2 -- x2)
+                    if (stack.size() < 2)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    stack.erase(stack.size() - 2);
+                }
+                break;
+
+                case OP_OVER:
+                {
+                    // (x1 x2 -- x1 x2 x1)
+                    if (stack.size() < 2)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    stack.reserve(stack.size() + 1);
+                    const valtype& vch = stacktop(-2);
+                    // BIP 440 cost: length(B) * 3 (COPYING).
+                    PushCosted(stack, vch, varcost);
+                }
+                break;
+
+                case OP_PICK:
+                case OP_ROLL:
+                {
+                    // (xn ... x2 x1 x0 n - xn ... x2 x1 x0 xn)
+                    // (xn ... x2 x1 x0 n - ... x2 x1 x0 xn)
+                    if (stack.size() < 2)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    Val64 v;
+                    if (!stack.PopVal64(v)) {
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    }
+
+                    // BIP 440 OP_ROLL cost: W(length(A)) * 2 + 48 * Value of A (LENGTHCONV + ROLL).
+                    // BIP 440 OP_PICK cost: W(length(A)) * 2 + length(A-th-from-top) * 3
+                    // (LENGTHCONV + COPYING).
+                    const size_t depth{static_cast<size_t>(v.ToU64Ceil(stack.size(), varcost))};
+                    if (depth >= stack.size())
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    if (opcode == OP_ROLL) {
+                        stack.Roll(depth);
+                        varcost += depth * varops::COST_ROLL;
+                    } else {
+                        stack.reserve(stack.size() + 1);
+                        const valtype& vch = stack.at(stack.size() - depth - 1);
+                        PushCosted(stack, vch, varcost);
+                    }
+                }
+                break;
+
+                case OP_ROT:
+                {
+                    // (x1 x2 x3 -- x2 x3 x1)
+                    if (stack.size() < 3)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    stack.Rotate(-3, -2);
+                }
+                break;
+
+                case OP_SWAP:
+                {
+                    // (x1 x2 -- x2 x1)
+                    if (stack.size() < 2)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    stack.Swap(-2, -1);
+                }
+                break;
+
+                case OP_TUCK:
+                {
+                    // (x1 x2 -- x2 x1 x2)
+                    if (stack.size() < 2)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    stack.reserve(stack.size() + 1);
+                    const valtype& vch = stacktop(-1);
+                    // BIP 440 cost: length(A) * 3 (COPYING).
+                    PushCosted(stack, vch, varcost);
+                    stack.Swap(-2, -3);
+                }
+                break;
+
+
+                case OP_SIZE:
+                {
+                    // (in -- in size)
+                    if (stack.size() < 1)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    Val64 v(stacktop(-1).size());
+                    valtype vch = v.MoveToValtype();
+                    stack.push_back(std::move(vch));
+                }
+                break;
+
+
+                //
+                // Bitwise logic
+                //
+                case OP_EQUAL:
+                case OP_EQUALVERIFY:
+                //case OP_NOTEQUAL: // use OP_NUMNOTEQUAL
+                {
+                    // (x1 x2 - bool)
+                    if (stack.size() < 2)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    const valtype& vch1 = stacktop(-2);
+                    const valtype& vch2 = stacktop(-1);
+                    bool fEqual = (vch1 == vch2);
+                    // OP_NOTEQUAL is disabled because it would be too easy to say
+                    // something like n != 1 and have some wiseguy pass in 1 with extra
+                    // zero bytes after it (numerically, 0x01 == 0x0001 == 0x000001)
+                    //if (opcode == OP_NOTEQUAL)
+                    //    fEqual = !fEqual;
+                    if (vch1.size() == vch2.size()) {
+                        varcost += vch1.size() * varops::COST_FAST; // COMPARING
+                    }
+                    popstack(stack);
+                    popstack(stack);
+                    stack.push_back(fEqual ? vchTrue : vchFalse);
+                    if (opcode == OP_EQUALVERIFY)
+                    {
+                        if (fEqual)
+                            popstack(stack);
+                        else
+                            return set_error(serror, SCRIPT_ERR_EQUALVERIFY);
+                    }
+                }
+                break;
+
+
+                //
+                // Numeric
+                //
+                case OP_1ADD:
+                case OP_1SUB:
+                case OP_NOT:
+                case OP_0NOTEQUAL:
+                {
+                    Val64 v64;
+                    if (!stack.PopVal64(v64))
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    switch (opcode)
+                    {
+                    case OP_1ADD:
+                        Val64::Op1Add(v64, varcost);
+                        break;
+                    case OP_1SUB:
+                        if (!Val64::Op1Sub(v64, varcost))
+                            return set_error(serror, SCRIPT_ERR_SUB_UNDERFLOW);
+                        break;
+                    case OP_NOT:
+                        v64 = Val64{v64.IsZero(varcost)};
+                        break;
+                    case OP_0NOTEQUAL:
+                        v64 = Val64{!v64.IsZero(varcost)};
+                        break;
+                    default:
+                        assert(!"invalid opcode");
+                        break;
+                    }
+                    stack.push_back(v64.MoveToValtype());
+                }
+                break;
+
+                case OP_ADD:
+                case OP_SUB:
+                case OP_BOOLAND:
+                case OP_BOOLOR:
+                case OP_NUMEQUAL:
+                case OP_NUMEQUALVERIFY:
+                case OP_NUMNOTEQUAL:
+                case OP_LESSTHAN:
+                case OP_GREATERTHAN:
+                case OP_LESSTHANOREQUAL:
+                case OP_GREATERTHANOREQUAL:
+                case OP_MIN:
+                case OP_MAX:
+                {
+                    Val64 v1, v2;
+                    if (!stack.PopVal64(v2) || !stack.PopVal64(v1)) {
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    }
+                    switch (opcode) {
+                    case OP_ADD:
+                        Val64::OpAdd(v1, v2, varcost);
+                        break;
+
+                    case OP_SUB:
+                        if (!Val64::OpSub(v1, v2, varcost))
+                            return set_error(serror, SCRIPT_ERR_SUB_UNDERFLOW);
+                        break;
+                    case OP_BOOLAND:
+                        varcost += varops::BoolAndCost(v1.size(), v2.size());
+                        v1 = Val64{!v1.IsZero() && !v2.IsZero()};
+                        break;
+                    case OP_BOOLOR:
+                        varcost += varops::BoolOrCost(v1.size(), v2.size());
+                        v1 = Val64{!v1.IsZero() || !v2.IsZero()};
+                        break;
+                    case OP_NUMEQUAL:
+                        v1 = Val64{v1.Compare(v2, varcost) == 0};
+                        break;
+                    case OP_NUMEQUALVERIFY:
+                        if (v1.Compare(v2, varcost) != 0)
+                            return set_error(serror, SCRIPT_ERR_NUMEQUALVERIFY);
+                        v1 = Val64{1};
+                        break;
+                    case OP_NUMNOTEQUAL:
+                        v1 = Val64{v1.Compare(v2, varcost) != 0};
+                        break;
+                    case OP_LESSTHAN:
+                        v1 = Val64{v1.Compare(v2, varcost) < 0};
+                        break;
+                    case OP_GREATERTHAN:
+                        v1 = Val64{v1.Compare(v2, varcost) > 0};
+                        break;
+                    case OP_LESSTHANOREQUAL:
+                        v1 = Val64{v1.Compare(v2, varcost) <= 0};
+                        break;
+                    case OP_GREATERTHANOREQUAL:
+                        v1 = Val64{v1.Compare(v2, varcost) >= 0};
+                        break;
+                    case OP_MIN:
+                        Val64::OpMin(v1, v2, varcost);
+                        break;
+                    case OP_MAX:
+                        Val64::OpMax(v1, v2, varcost);
+                        break;
+                    default:
+                        assert(!"invalid opcode"); break;
+                    }
+                    if (opcode != OP_NUMEQUALVERIFY) {
+                        stack.push_back(v1.MoveToValtype());
+                    }
+                    break;
+                }
+                case OP_WITHIN: {
+                    Val64 v1, v2, v3;
+                    if (!stack.PopVal64(v3) ||
+                        !stack.PopVal64(v2) ||
+                        !stack.PopVal64(v1)) {
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    }
+                    varcost += varops::WithinCost(v1.size(), v2.size(), v3.size());
+                    Val64 result{v1.Compare(v2) >= 0 && v1.Compare(v3) < 0};
+                    stack.push_back(result.MoveToValtype());
+                } break;
+
+
+                //
+                // Crypto
+                //
+                case OP_RIPEMD160:
+                case OP_SHA1:
+                case OP_SHA256:
+                case OP_HASH160:
+                case OP_HASH256:
+                {
+                    // (in -- hash)
+                    if (stack.size() < 1)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    const valtype& vch = stacktop(-1);
+                    // BIP 441: OP_RIPEMD160 and OP_SHA1 fail if their operands exceed 520 bytes.
+                    if (opcode == OP_RIPEMD160 || opcode == OP_SHA1) {
+                        if (vch.size() > MAX_SCRIPT_ELEMENT_SIZE) {
+                            return set_error(serror, SCRIPT_ERR_HASH_OPERAND_SIZE);
+                        }
+                    } else {
+                        // BIP 440 OP_SHA256/OP_HASH160/OP_HASH256 cost:
+                        // (Length of the operand) * 50 (HASH).
+                        varcost += vch.size() * varops::COST_HASH;
+                    }
+                    valtype vchHash((opcode == OP_RIPEMD160 || opcode == OP_SHA1 || opcode == OP_HASH160) ? 20 : 32);
+                    if (opcode == OP_RIPEMD160)
+                        CRIPEMD160().Write(vch.data(), vch.size()).Finalize(vchHash.data());
+                    else if (opcode == OP_SHA1)
+                        CSHA1().Write(vch.data(), vch.size()).Finalize(vchHash.data());
+                    else if (opcode == OP_SHA256)
+                        CSHA256().Write(vch.data(), vch.size()).Finalize(vchHash.data());
+                    else if (opcode == OP_HASH160)
+                        CHash160().Write(vch).Finalize(vchHash);
+                    else if (opcode == OP_HASH256)
+                        CHash256().Write(vch).Finalize(vchHash);
+                    popstack(stack);
+                    stack.push_back(std::move(vchHash));
+                }
+                break;
+
+                case OP_CODESEPARATOR:
+                {
+                    // Tapscript signatures commit to the executed OP_CODESEPARATOR position.
+                    execdata.m_codeseparator_pos = opcode_pos;
+                }
+                break;
+
+                case OP_CHECKSIG:
+                case OP_CHECKSIGVERIFY:
+                {
+                    // (sig pubkey -- bool)
+                    if (stack.size() < 2)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+
+                    const valtype& vchSig    = stacktop(-2);
+                    const valtype& vchPubKey = stacktop(-1);
+
+                    // Match BIP342 by charging signature validation only for non-empty signatures.
+                    if (!vchSig.empty() && !varops_budget.Spend(varops::COST_PER_SIGOP)) return set_error(serror, SCRIPT_ERR_VAROP_COUNT);
+
+                    bool fSuccess = true;
+                    if (!EvalChecksigTapscript(vchSig, vchPubKey, execdata, flags, checker, SigVersion::TAPSCRIPT_V2, serror, fSuccess)) return false;
+
+                    popstack(stack);
+                    popstack(stack);
+                    stack.push_back(fSuccess ? vchTrue : vchFalse);
+                    if (opcode == OP_CHECKSIGVERIFY)
+                    {
+                        if (fSuccess)
+                            popstack(stack);
+                        else
+                            return set_error(serror, SCRIPT_ERR_CHECKSIGVERIFY);
+                    }
+                }
+                break;
+
+                case OP_CHECKSIGADD:
+                {
+                    // (sig num pubkey -- num)
+                    if (stack.size() < 3) return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+
+                    const valtype& sig = stacktop(-3);
+                    const valtype& pubkey = stacktop(-1);
+
+                    // Match BIP342 by charging signature validation only for non-empty signatures.
+                    // The numeric CHECKSIGADD increment is charged whether the signature succeeds or not.
+                    const uint64_t checksigadd_cost{
+                        (sig.empty() ? 0 : varops::COST_PER_SIGOP) +
+                        varops::ChecksigAddIncrementCost(stack.at(stack.size() - 2).size())};
+                    if (!varops_budget.Spend(checksigadd_cost)) return set_error(serror, SCRIPT_ERR_VAROP_COUNT);
+
+                    bool success = true;
+                    if (!EvalChecksigTapscript(sig, pubkey, execdata, flags, checker, SigVersion::TAPSCRIPT_V2, serror, success)) return false;
+
+                    popstack(stack); // pubkey
+                    Val64 num;
+                    if (!stack.PopVal64(num)) {
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    }
+                    popstack(stack); // sig
+
+                    if (success) {
+                        // The increment cost was already charged before signature validation.
+                        uint64_t ignored_cost{0};
+                        Val64::Op1Add(num, ignored_cost);
+                    }
+                    num.TrimTrailingZeros();
+
+                    stack.push_back(num.MoveToValtype());
+                }
+                break;
+
+                case OP_CHECKMULTISIG:
+                case OP_CHECKMULTISIGVERIFY:
+                {
+                    return set_error(serror, SCRIPT_ERR_TAPSCRIPT_CHECKMULTISIG);
+                }
+                break;
+
+                case OP_CAT:
+                {
+                    if (stack.size() < 2)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+
+                    // BIP 441 cost: (length(A) + length(B)) * 3 (COPYING).
+
+                    valtype vch2 = stack.PopBackValue();
+                    valtype vch1 = stack.PopBackValue();
+                    varcost += (vch1.size() + vch2.size()) * varops::COST_COPYING;
+
+                    vch1.insert(vch1.end(), vch2.begin(), vch2.end());
+                    stack.push_back(std::move(vch1));
+                }
+                break;
+
+                case OP_SUBSTR:
+                {
+                    // A BEGIN LEN -- A[BEGIN:BEGIN+LEN]
+                    Val64 begin_v64, len_v64;
+                    if (!stack.PopVal64(len_v64) ||
+                        !stack.PopVal64(begin_v64) ||
+                        stack.size() < 1) {
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    }
+                    valtype vch = stack.PopBackValue();
+
+                    // BIP 441 cost: (W(length(LEN)) + W(length(BEGIN))) * 2
+                    // + MIN(Value of LEN, MAX(length(A) - Value of BEGIN, 0)) * 3
+                    // (LENGTHCONV + COPYING).
+                    const uint64_t begin{begin_v64.ToU64Ceil(vch.size(), varcost)};
+                    const uint64_t len{len_v64.ToU64Ceil(vch.size() - begin, varcost)};
+
+                    // len is already capped to MIN(LEN, LEN(a) - BEGIN, 0) (COPYING)
+                    varcost += len * varops::COST_COPYING;
+
+                    valtype vch2(vch.begin() + begin, vch.begin() + begin + len);
+                    stack.push_back(std::move(vch2));
+                }
+                break;
+
+                case OP_LEFT:
+                {
+                    // A OFFSET -- A[:OFFSET]
+                    Val64 offset_v64;
+                    if (!stack.PopVal64(offset_v64) ||
+                        stack.size() < 1) {
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    }
+
+                    // BIP 441 cost: W(length(OFFSET)) * 2 (LENGTHCONV).
+                    const uint64_t offset{offset_v64.ToU64Ceil(stack.back().size(), varcost)};
+                    valtype vch = stack.PopBackValue();
+                    vch.erase(vch.begin() + offset, vch.end());
+                    stack.push_back(std::move(vch));
+                }
+                break;
+
+                case OP_RIGHT:
+                {
+                    // A OFFSET -- A[-OFFSET:]
+                    Val64 offset_v64;
+                    if (!stack.PopVal64(offset_v64) ||
+                        stack.size() < 1) {
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    }
+
+                    // BIP 441 cost: W(length(OFFSET)) * 2 + MIN(Value of OFFSET, length(A)) * 3
+                    // (LENGTHCONV + COPYING).
+                    const uint64_t offset{offset_v64.ToU64Ceil(stack.back().size(), varcost)};
+                    valtype vch = stack.PopBackValue();
+
+                    varcost += offset * varops::COST_COPYING;
+                    if (offset < vch.size()) {
+                        vch.erase(vch.begin(), vch.end() - offset);
+                    }
+                    stack.push_back(std::move(vch));
+                }
+                break;
+
+                case OP_INVERT:
+                case OP_2MUL:
+                case OP_2DIV:
+                {
+                    Val64 v64;
+                    if (!stack.PopVal64(v64)) {
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    }
+                    switch (opcode)
+                    {
+                    case OP_INVERT: Val64::OpInvert(v64, varcost); break;
+                    case OP_2MUL:   Val64::Op2Mul(v64, varcost); break;
+                    case OP_2DIV:   Val64::Op2Div(v64, varcost); break;
+                    default:        assert(!"invalid opcode");
+                    }
+                    stack.push_back(v64.MoveToValtype());
+                }
+                break;
+
+                case OP_AND:
+                case OP_OR:
+                case OP_XOR:
+                case OP_MUL:
+                case OP_DIV:
+                case OP_MOD:
+                case OP_LSHIFT:
+                case OP_RSHIFT:
+                {
+                    Val64 v64a, v64b;
+                    if (!stack.PopVal64(v64b) ||
+                        !stack.PopVal64(v64a)) {
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    }
+
+                    switch (opcode)
+                    {
+                    case OP_AND:
+                        Val64::OpAnd(v64a, v64b, varcost);
+                        break;
+
+                    case OP_OR:
+                        Val64::OpOr(v64a, v64b, varcost);
+                        break;
+
+                    case OP_XOR:
+                        Val64::OpXor(v64a, v64b, varcost);
+                        break;
+
+                    case OP_MUL:
+                    {
+                        // BIP 441 cost: (length(A) + length(B)) * 3
+                        // + W(length(A)) / 8 * W(length(B)) * 27.
+                        const uint64_t op_cost{varops::MulCost(v64a.size(), v64b.size())};
+                        if (!varops_budget.Spend(op_cost)) return set_error(serror, SCRIPT_ERR_VAROP_COUNT);
+                        v64a = Val64::OpMul(v64a, v64b);
+                        break;
+                    }
+
+                    case OP_DIV:
+                    {
+                        // BIP 441 cost: W(length(A)) * 18 + W(length(B)) * 4
+                        // + W(length(A))^2 * 2 / 3.
+                        const uint64_t op_cost{varops::DivCost(v64a.size(), v64b.size())};
+                        if (!varops_budget.Spend(op_cost)) return set_error(serror, SCRIPT_ERR_VAROP_COUNT);
+                        if (!Val64::OpDiv(v64a, v64b))
+                            return set_error(serror, SCRIPT_ERR_DIVIDE_BY_ZERO);
+                        break;
+                    }
+
+                    case OP_MOD:
+                    {
+                        // BIP 441 cost: W(length(A)) * 18 + W(length(B)) * 4
+                        // + W(length(A))^2 * 2 / 3.
+                        const uint64_t op_cost{varops::ModCost(v64a.size(), v64b.size())};
+                        if (!varops_budget.Spend(op_cost)) return set_error(serror, SCRIPT_ERR_VAROP_COUNT);
+                        if (!Val64::OpMod(v64a, v64b))
+                            return set_error(serror, SCRIPT_ERR_DIVIDE_BY_ZERO);
+                        break;
+                    }
+
+                    case OP_LSHIFT:
+                        if (!Val64::OpUpShift(v64a, v64b,
+                                              MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE,
+                                              varcost)) {
+                            return set_error(serror, SCRIPT_ERR_STACK_ELEMENT_SIZE);
+                        }
+                        break;
+
+                    case OP_RSHIFT:
+                        Val64::OpDownShift(v64a, v64b, varcost);
+                        break;
+
+                    default:
+                        assert(!"invalid opcode");
+                    }
+
+                    stack.push_back(v64a.MoveToValtype());
+                }
+                break;
+
+                default:
+                    return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
+            }
+
+            // Size limits
+            if (stack.size() + altstack.size() > MAX_TAPSCRIPT_V2_STACK_SIZE) {
+                return set_error(serror, SCRIPT_ERR_STACK_SIZE);
+            }
+
+            if (stack.GetTotalSize() + altstack.GetTotalSize() > MAX_TAPSCRIPT_V2_TOTAL_STACK_SIZE) {
+                return set_error(serror, SCRIPT_ERR_TOTAL_STACK_SIZE);
+            }
+
+            // GetMaxElementSize() is a high-water mark. This remains sound
+            // because v2 limits are checked after every opcode, so an oversized
+            // element cannot be shrunk by a later opcode before failing.
+            const size_t largest_element_size{std::max(stack.GetMaxElementSize(), altstack.GetMaxElementSize())};
+            if (largest_element_size > MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE) {
+                return set_error(serror, SCRIPT_ERR_STACK_ELEMENT_SIZE);
+            }
+
+            if (!varops_budget.Spend(varcost)) return set_error(serror, SCRIPT_ERR_VAROP_COUNT);
+        }
+    }
+    catch (...)
+    {
+        return set_error(serror, SCRIPT_ERR_UNKNOWN_ERROR);
+    }
+
+    if (!vfExec.empty())
+        return set_error(serror, SCRIPT_ERR_UNBALANCED_CONDITIONAL);
+
+    return set_success(serror);
+}
+
+bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript& script, script_verify_flags flags, const BaseSignatureChecker& checker, SigVersion sigversion, ScriptError* serror)
+{
+    ScriptExecutionData execdata;
+    return EvalScript(stack, script, flags, checker, sigversion, execdata, serror);
+}
+
+namespace {
+
+/**
+ * Wrapper that serializes like CTransaction, but with the modifications
+ *  required for the signature hash done in-place
+ */
+template <class T>
+class CTransactionSignatureSerializer
+{
+private:
+    const T& txTo;             //!< reference to the spending transaction (the one being serialized)
+    const CScript& scriptCode; //!< output script being consumed
+    const unsigned int nIn;    //!< input index of txTo being signed
+    const bool fAnyoneCanPay;  //!< whether the hashtype has the SIGHASH_ANYONECANPAY flag set
+    const bool fHashSingle;    //!< whether the hashtype is SIGHASH_SINGLE
+    const bool fHashNone;      //!< whether the hashtype is SIGHASH_NONE
+
+public:
+    CTransactionSignatureSerializer(const T& txToIn, const CScript& scriptCodeIn, unsigned int nInIn, int nHashTypeIn) :
+        txTo(txToIn), scriptCode(scriptCodeIn), nIn(nInIn),
+        fAnyoneCanPay(!!(nHashTypeIn & SIGHASH_ANYONECANPAY)),
+        fHashSingle((nHashTypeIn & 0x1f) == SIGHASH_SINGLE),
+        fHashNone((nHashTypeIn & 0x1f) == SIGHASH_NONE) {}
+
+    /** Serialize the passed scriptCode, skipping OP_CODESEPARATORs */
+    template<typename S>
+    void SerializeScriptCode(S &s) const {
+        CScript::const_iterator it = scriptCode.begin();
+        CScript::const_iterator itBegin = it;
+        opcodetype opcode;
+        unsigned int nCodeSeparators = 0;
+        while (scriptCode.GetOp(it, opcode)) {
+            if (opcode == OP_CODESEPARATOR)
+                nCodeSeparators++;
+        }
+        ::WriteCompactSize(s, scriptCode.size() - nCodeSeparators);
+        it = itBegin;
+        while (scriptCode.GetOp(it, opcode)) {
+            if (opcode == OP_CODESEPARATOR) {
+                s.write(AsBytes(Span{&itBegin[0], size_t(it - itBegin - 1)}));
+                itBegin = it;
+            }
+        }
+        if (itBegin != scriptCode.end())
+            s.write(AsBytes(Span{&itBegin[0], size_t(it - itBegin)}));
+    }
+
+    /** Serialize an input of txTo */
+    template<typename S>
+    void SerializeInput(S &s, unsigned int nInput) const {
+        // In case of SIGHASH_ANYONECANPAY, only the input being signed is serialized
+        if (fAnyoneCanPay)
+            nInput = nIn;
+        // Serialize the prevout
+        ::Serialize(s, txTo.vin[nInput].prevout);
+        // Serialize the script
+        if (nInput != nIn)
+            // Blank out other inputs' signatures
+            ::Serialize(s, CScript());
+        else
+            SerializeScriptCode(s);
+        // Serialize the nSequence
+        if (nInput != nIn && (fHashSingle || fHashNone))
+            // let the others update at will
+            ::Serialize(s, int32_t{0});
+        else
+            ::Serialize(s, txTo.vin[nInput].nSequence);
+    }
+
+    /** Serialize an output of txTo */
+    template<typename S>
+    void SerializeOutput(S &s, unsigned int nOutput) const {
+        if (fHashSingle && nOutput != nIn)
+            // Do not lock-in the txout payee at other indices as txin
+            ::Serialize(s, CTxOut());
+        else
+            ::Serialize(s, txTo.vout[nOutput]);
+    }
+
+    /** Serialize txTo */
+    template<typename S>
+    void Serialize(S &s) const {
+        // Serialize version
+        ::Serialize(s, txTo.version);
+        // Serialize vin
+        unsigned int nInputs = fAnyoneCanPay ? 1 : txTo.vin.size();
+        ::WriteCompactSize(s, nInputs);
+        for (unsigned int nInput = 0; nInput < nInputs; nInput++)
+             SerializeInput(s, nInput);
+        // Serialize vout
+        unsigned int nOutputs = fHashNone ? 0 : (fHashSingle ? nIn+1 : txTo.vout.size());
+        ::WriteCompactSize(s, nOutputs);
+        for (unsigned int nOutput = 0; nOutput < nOutputs; nOutput++)
+             SerializeOutput(s, nOutput);
+        // Serialize nLockTime
+        ::Serialize(s, txTo.nLockTime);
+    }
+};
+
+/** Compute the (single) SHA256 of the concatenation of all prevouts of a tx. */
+template <class T>
+uint256 GetPrevoutsSHA256(const T& txTo)
+{
+    HashWriter ss{};
+    for (const auto& txin : txTo.vin) {
+        ss << txin.prevout;
+    }
+    return ss.GetSHA256();
+}
+
+/** Compute the (single) SHA256 of the concatenation of all nSequences of a tx. */
+template <class T>
+uint256 GetSequencesSHA256(const T& txTo)
+{
+    HashWriter ss{};
+    for (const auto& txin : txTo.vin) {
+        ss << txin.nSequence;
+    }
+    return ss.GetSHA256();
+}
+
+/** Compute the (single) SHA256 of the concatenation of all txouts of a tx. */
+template <class T>
+uint256 GetOutputsSHA256(const T& txTo)
+{
+    HashWriter ss{};
+    for (const auto& txout : txTo.vout) {
+        ss << txout;
+    }
+    return ss.GetSHA256();
+}
+
+/** Compute the (single) SHA256 of the concatenation of all amounts spent by a tx. */
+uint256 GetSpentAmountsSHA256(const std::vector<CTxOut>& outputs_spent)
+{
+    HashWriter ss{};
+    for (const auto& txout : outputs_spent) {
+        ss << txout.nValue;
+
+    }
+    return ss.GetSHA256();
+}
+
+/** Compute the (single) SHA256 of the concatenation of all scriptSigs in a tx. */
+template <class T>
+uint256 GetScriptSigsSHA256(const T& txTo)
+{
+    HashWriter ss{};
+    for (const auto& in : txTo.vin) {
+        ss << in.scriptSig;
+    }
+    return ss.GetSHA256();
+}
+
+/** Compute the (single) SHA256 of the concatenation of all scriptPubKeys spent by a tx. */
+uint256 GetSpentScriptsSHA256(const std::vector<CTxOut>& outputs_spent)
+{
+    HashWriter ss{};
+    for (const auto& txout : outputs_spent) {
+        ss << txout.scriptPubKey;
+    }
+    return ss.GetSHA256();
+}
+
+/* Not Exported, just convenience */
 template<typename TxType>
 uint256 GetDefaultCheckTemplateVerifyHashWithScript(const TxType& tx, const uint256& outputs_hash, const uint256& sequences_hash,
                                 const uint256& scriptSig_hash, const uint32_t input_index) {
@@ -1730,6 +2688,7 @@ template<typename T>
 bool SignatureHashSchnorr(uint256& hash_out, ScriptExecutionData& execdata, const T& tx_to, uint32_t in_pos, uint8_t hash_type, SigVersion sigversion, KeyVersion keyversion, const PrecomputedTransactionData& cache, MissingDataBehavior mdb)
 {
     uint8_t ext_flag;
+    if (keyversion == KeyVersion::ANYPREVOUT && sigversion != SigVersion::TAPSCRIPT) return false;
     assert(
       (keyversion == KeyVersion::TAPROOT) ||
       (keyversion == KeyVersion::ANYPREVOUT && sigversion == SigVersion::TAPSCRIPT)
@@ -1740,6 +2699,7 @@ bool SignatureHashSchnorr(uint256& hash_out, ScriptExecutionData& execdata, cons
         // keyversion is not used.
         break;
     case SigVersion::TAPSCRIPT:
+    case SigVersion::TAPSCRIPT_V2:
         ext_flag = 1;
         break;
     default:
@@ -1824,7 +2784,7 @@ bool SignatureHashSchnorr(uint256& hash_out, ScriptExecutionData& execdata, cons
     }
 
     // Additional data for BIP 342 signatures
-    if (sigversion == SigVersion::TAPSCRIPT) {
+    if (IsTapscript(sigversion)) {
         assert(execdata.m_tapleaf_hash_init);
         if (input_type != SIGHASH_ANYPREVOUTANYSCRIPT) {
             ss << execdata.m_tapleaf_hash;
@@ -1987,7 +2947,7 @@ bool GenericTransactionSignatureChecker<T>::CheckECDSASignature(const std::vecto
 template <class T>
 bool GenericTransactionSignatureChecker<T>::CheckSchnorrSignature(Span<const unsigned char> sig, KeyVersion pubkeyver, Span<const unsigned char> pubkey, SigVersion sigversion, ScriptExecutionData& execdata, ScriptError* serror) const
 {
-    assert(sigversion == SigVersion::TAPROOT || sigversion == SigVersion::TAPSCRIPT);
+    assert(sigversion == SigVersion::TAPROOT || IsTapscript(sigversion));
     // Schnorr signatures have 32-byte public keys. The caller is responsible for enforcing this.
     assert(pubkey.size() == 32);
 
@@ -2146,8 +3106,9 @@ template class GenericTransactionSignatureChecker<CMutableTransaction>;
     return std::nullopt;
 }
 
-std::optional<bool> CheckTapscriptOpSuccess(const CScript& exec_script, script_verify_flags flags, ScriptError* serror)
+std::optional<bool> CheckTapscriptOpSuccess(const CScript& exec_script, script_verify_flags flags, SigVersion sigversion, ScriptError* serror)
 {
+    assert(sigversion == SigVersion::TAPSCRIPT || sigversion == SigVersion::TAPSCRIPT_V2);
     {
         // OP_SUCCESSx processing overrides everything, including stack element size limits
         CScript::const_iterator pc = exec_script.begin();
@@ -2158,7 +3119,14 @@ std::optional<bool> CheckTapscriptOpSuccess(const CScript& exec_script, script_v
                 return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
             }
             // New opcodes will be listed here. May use a different sigversion to modify existing opcodes.
-            if (IsOpSuccess(opcode)) {
+            if (IsOpSuccess(opcode, sigversion)) {
+                if (sigversion == SigVersion::TAPSCRIPT_V2) {
+                    if (flags & SCRIPT_VERIFY_DISCOURAGE_OP_SUCCESS) {
+                        return set_error(serror, SCRIPT_ERR_DISCOURAGE_OP_SUCCESS);
+                    }
+                    return set_success(serror);
+                }
+                assert(sigversion == SigVersion::TAPSCRIPT);
                 switch(opcode) {
                 INQ_SUCCESS_OPCODES
                 case OP_RESERVED:
@@ -2178,19 +3146,54 @@ std::optional<bool> CheckTapscriptOpSuccess(const CScript& exec_script, script_v
     return std::nullopt;
 }
 
-static bool ExecuteWitnessScript(const Span<const valtype>& stack_span, const CScript& exec_script, script_verify_flags flags, SigVersion sigversion, const BaseSignatureChecker& checker, ScriptExecutionData& execdata, ScriptError* serror)
+bool CheckTapscriptV2ScriptResult(ValtypeStack& stack, varops::Budget& varops_budget, ScriptError* serror)
 {
-    std::vector<valtype> stack{stack_span.begin(), stack_span.end()};
+    if (stack.size() != 1) return set_error(serror, SCRIPT_ERR_CLEANSTACK);
 
-    if (sigversion == SigVersion::TAPSCRIPT) {
+    valtype back_val = stack.PopBackValue();
+    if (!varops_budget.Spend(varops::CompareZeroCost(back_val.size()))) {
+        return set_error(serror, SCRIPT_ERR_VAROP_COUNT);
+    }
+    if (Val64{std::move(back_val)}.IsZero()) {
+        return set_error(serror, SCRIPT_ERR_EVAL_FALSE);
+    }
+    return set_success(serror);
+}
 
-        auto r = CheckTapscriptOpSuccess(exec_script, flags, serror);
-        if (r.has_value()) return *r;
+static bool ExecuteWitnessScript(const Span<const valtype>& stack_span, const CScript& exec_script, script_verify_flags flags, SigVersion sigversion, const BaseSignatureChecker& checker, ScriptExecutionData& execdata, ScriptError* serror, varops::Budget& varops_budget)
+{
+    if (IsTapscript(sigversion)) {
+        const auto result{CheckTapscriptOpSuccess(exec_script, flags, sigversion, serror)};
+        if (result.has_value()) return *result;
 
         // Tapscript enforces initial stack size limits (altstack is empty here)
-        if (stack.size() > MAX_STACK_SIZE) return set_error(serror, SCRIPT_ERR_STACK_SIZE);
+        if (sigversion == SigVersion::TAPSCRIPT) {
+            if (stack_span.size() > MAX_STACK_SIZE) return set_error(serror, SCRIPT_ERR_STACK_SIZE);
+        }
+    }
+
+    if (sigversion == SigVersion::TAPSCRIPT_V2) {
+        if (stack_span.size() > MAX_TAPSCRIPT_V2_STACK_SIZE) return set_error(serror, SCRIPT_ERR_STACK_SIZE);
+
+        size_t total_size{0};
+        size_t max_element_size{0};
+        for (const valtype& element : stack_span) {
+            if (element.size() > MAX_TAPSCRIPT_V2_TOTAL_STACK_SIZE - total_size) {
+                return set_error(serror, SCRIPT_ERR_TOTAL_STACK_SIZE);
+            }
+            total_size += element.size();
+            max_element_size = std::max(max_element_size, element.size());
+        }
+        if (max_element_size > MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE) return set_error(serror, SCRIPT_ERR_STACK_ELEMENT_SIZE);
+
+        ValtypeStack valtype_stack{stack_span};
+
+        if (!EvalTapscriptV2(valtype_stack, exec_script, flags, checker, execdata, varops_budget, serror)) return false;
+        return CheckTapscriptV2ScriptResult(valtype_stack, varops_budget, serror);
     }
 
+    std::vector<valtype> stack{stack_span.begin(), stack_span.end()};
+
     // Disallow stack item size > MAX_SCRIPT_ELEMENT_SIZE in witness stack
     for (const valtype& elem : stack) {
         if (elem.size() > MAX_SCRIPT_ELEMENT_SIZE) return set_error(serror, SCRIPT_ERR_PUSH_SIZE);
@@ -2251,7 +3254,7 @@ static bool VerifyTaprootCommitment(const std::vector<unsigned char>& control, c
     return q.CheckTapTweak(p, merkle_root, control[0] & 1);
 }
 
-static bool VerifyWitnessProgram(const CScriptWitness& witness, int witversion, const std::vector<unsigned char>& program, script_verify_flags flags, const BaseSignatureChecker& checker, ScriptError* serror, bool is_p2sh)
+static bool VerifyWitnessProgram(const CScriptWitness& witness, int witversion, const std::vector<unsigned char>& program, script_verify_flags flags, const BaseSignatureChecker& checker, ScriptError* serror, bool is_p2sh, varops::Budget& varops_budget)
 {
     CScript exec_script; //!< Actually executed script (last stack item in P2WSH; implied P2PKH script in P2WPKH; leaf script in P2TR)
     Span stack{witness.stack};
@@ -2270,14 +3273,14 @@ static bool VerifyWitnessProgram(const CScriptWitness& witness, int witversion,
             if (memcmp(hash_exec_script.begin(), program.data(), 32)) {
                 return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH);
             }
-            return ExecuteWitnessScript(stack, exec_script, flags, SigVersion::WITNESS_V0, checker, execdata, serror);
+            return ExecuteWitnessScript(stack, exec_script, flags, SigVersion::WITNESS_V0, checker, execdata, serror, varops_budget);
         } else if (program.size() == WITNESS_V0_KEYHASH_SIZE) {
             // BIP141 P2WPKH: 20-byte witness v0 program (which encodes Hash160(pubkey))
             if (stack.size() != 2) {
                 return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH); // 2 items in witness
             }
             exec_script << OP_DUP << OP_HASH160 << program << OP_EQUALVERIFY << OP_CHECKSIG;
-            return ExecuteWitnessScript(stack, exec_script, flags, SigVersion::WITNESS_V0, checker, execdata, serror);
+            return ExecuteWitnessScript(stack, exec_script, flags, SigVersion::WITNESS_V0, checker, execdata, serror, varops_budget);
         } else {
             return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_WRONG_LENGTH);
         }
@@ -2317,7 +3320,21 @@ static bool VerifyWitnessProgram(const CScriptWitness& witness, int witversion,
                 exec_script = CScript(script.begin(), script.end());
                 execdata.m_validation_weight_left = ::GetSerializeSize(witness.stack) + VALIDATION_WEIGHT_OFFSET;
                 execdata.m_validation_weight_left_init = true;
-                return ExecuteWitnessScript(stack, exec_script, flags, SigVersion::TAPSCRIPT, checker, execdata, serror);
+                return ExecuteWitnessScript(stack, exec_script, flags, SigVersion::TAPSCRIPT, checker, execdata, serror, varops_budget);
+            }
+            if ((control[0] & TAPROOT_LEAF_MASK) == TAPROOT_LEAF_TAPSCRIPT_V2) {
+                // Tapscript v2 (leaf version 0xc2)
+                if (flags & SCRIPT_VERIFY_DISCOURAGE_SCRIPT_RESTORATION) {
+                    return set_error(serror, SCRIPT_ERR_DISCOURAGE_SCRIPT_RESTORATION);
+                }
+                if (!(flags & SCRIPT_VERIFY_SCRIPT_RESTORATION)) {
+                    if (flags & SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_TAPROOT_VERSION) {
+                        return set_error(serror, SCRIPT_ERR_DISCOURAGE_UPGRADABLE_TAPROOT_VERSION);
+                    }
+                    return set_success(serror);
+                }
+                exec_script = CScript(script.begin(), script.end());
+                return ExecuteWitnessScript(stack, exec_script, flags, SigVersion::TAPSCRIPT_V2, checker, execdata, serror, varops_budget);
             }
             if (flags & SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_TAPROOT_VERSION) {
                 return set_error(serror, SCRIPT_ERR_DISCOURAGE_UPGRADABLE_TAPROOT_VERSION);
@@ -2337,6 +3354,12 @@ static bool VerifyWitnessProgram(const CScriptWitness& witness, int witversion,
 }
 
 bool VerifyScript(const CScript& scriptSig, const CScript& scriptPubKey, const CScriptWitness* witness, script_verify_flags flags, const BaseSignatureChecker& checker, ScriptError* serror)
+{
+    auto varops_budget{varops::Budget::Unmetered()};
+    return VerifyScript(scriptSig, scriptPubKey, witness, flags, checker, serror, varops_budget);
+}
+
+bool VerifyScript(const CScript& scriptSig, const CScript& scriptPubKey, const CScriptWitness* witness, script_verify_flags flags, const BaseSignatureChecker& checker, ScriptError* serror, varops::Budget& varops_budget)
 {
     static const CScriptWitness emptyWitness;
     if (witness == nullptr) {
@@ -2376,7 +3399,7 @@ bool VerifyScript(const CScript& scriptSig, const CScript& scriptPubKey, const C
                 // The scriptSig must be _exactly_ CScript(), otherwise we reintroduce malleability.
                 return set_error(serror, SCRIPT_ERR_WITNESS_MALLEATED);
             }
-            if (!VerifyWitnessProgram(*witness, witnessversion, witnessprogram, flags, checker, serror, /*is_p2sh=*/false)) {
+            if (!VerifyWitnessProgram(*witness, witnessversion, witnessprogram, flags, checker, serror, /*is_p2sh=*/false, varops_budget)) {
                 return false;
             }
             // Bypass the cleanstack check at the end. The actual stack is obviously not clean
@@ -2421,7 +3444,7 @@ bool VerifyScript(const CScript& scriptSig, const CScript& scriptPubKey, const C
                     // reintroduce malleability.
                     return set_error(serror, SCRIPT_ERR_WITNESS_MALLEATED_P2SH);
                 }
-                if (!VerifyWitnessProgram(*witness, witnessversion, witnessprogram, flags, checker, serror, /*is_p2sh=*/true)) {
+                if (!VerifyWitnessProgram(*witness, witnessversion, witnessprogram, flags, checker, serror, /*is_p2sh=*/true, varops_budget)) {
                     return false;
                 }
                 // Bypass the cleanstack check at the end. The actual stack is obviously not clean
diff --git a/src/script/interpreter.h b/src/script/interpreter.h
index 7b06316d4feb..b3e91d92d161 100644
--- a/src/script/interpreter.h
+++ b/src/script/interpreter.h
@@ -24,7 +24,11 @@
 
 class CScript;
 class CScriptNum;
+class ValtypeStack;
 struct CScriptWitness;
+namespace varops {
+class Budget;
+} // namespace varops
 
 /** Signature hash types/flags */
 enum
@@ -222,14 +226,6 @@ template<typename TxType>
 uint256 GetDefaultCheckTemplateVerifyHash(const TxType& tx, const uint256& outputs_hash, const uint256& sequences_hash,
                                 const uint32_t input_index);
 
-enum class SigVersion
-{
-    BASE = 0,        //!< Bare scripts and BIP16 P2SH-wrapped redeemscripts
-    WITNESS_V0 = 1,  //!< Witness v0 (P2WPKH and P2WSH); see BIP 141
-    TAPROOT = 2,     //!< Witness v1 with 32-byte program, not BIP16 P2SH-wrapped, key path spending; see BIP 341
-    TAPSCRIPT = 3,   //!< Witness v1 with 32-byte program, not BIP16 P2SH-wrapped, script path spending, leaf version 0xc0; see BIP 342
-};
-
 enum class KeyVersion
 {
     TAPROOT = 0,     //!< 32 byte public key
@@ -274,6 +270,7 @@ static constexpr size_t WITNESS_V1_TAPROOT_SIZE = 32;
 
 static constexpr uint8_t TAPROOT_LEAF_MASK = 0xfe;
 static constexpr uint8_t TAPROOT_LEAF_TAPSCRIPT = 0xc0;
+static constexpr uint8_t TAPROOT_LEAF_TAPSCRIPT_V2 = 0xc2;
 static constexpr size_t TAPROOT_CONTROL_BASE_SIZE = 33;
 static constexpr size_t TAPROOT_CONTROL_NODE_SIZE = 32;
 static constexpr size_t TAPROOT_CONTROL_MAX_NODE_COUNT = 128;
@@ -428,13 +425,18 @@ uint256 ComputeTaprootMerkleRoot(Span<const unsigned char> control, const uint25
 
 bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript& script, script_verify_flags flags, const BaseSignatureChecker& checker, SigVersion sigversion, ScriptExecutionData& execdata, ScriptError* error = nullptr);
 bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript& script, script_verify_flags flags, const BaseSignatureChecker& checker, SigVersion sigversion, ScriptError* error = nullptr);
+bool EvalTapscriptV2(ValtypeStack& stack, const CScript& script, script_verify_flags flags, const BaseSignatureChecker& checker, ScriptExecutionData& execdata, varops::Budget& varops_budget, ScriptError* error = nullptr);
+/** Check Tapscript v2 cleanstack and truthiness after execution. Consumes the final stack element. */
+bool CheckTapscriptV2ScriptResult(ValtypeStack& stack, varops::Budget& varops_budget, ScriptError* error = nullptr);
+/** Use only when transaction-wide varops budget context is unavailable. */
 bool VerifyScript(const CScript& scriptSig, const CScript& scriptPubKey, const CScriptWitness* witness, script_verify_flags flags, const BaseSignatureChecker& checker, ScriptError* serror = nullptr);
+bool VerifyScript(const CScript& scriptSig, const CScript& scriptPubKey, const CScriptWitness* witness, script_verify_flags flags, const BaseSignatureChecker& checker, ScriptError* serror, varops::Budget& varops_budget);
 
 size_t CountWitnessSigOps(const CScript& scriptSig, const CScript& scriptPubKey, const CScriptWitness* witness, script_verify_flags flags);
 
 int FindAndDelete(CScript& script, const CScript& b);
 
 bool CastToBool(const std::vector<unsigned char>& vch);
-std::optional<bool> CheckTapscriptOpSuccess(const CScript& exec_script, script_verify_flags flags, ScriptError* serror);
+std::optional<bool> CheckTapscriptOpSuccess(const CScript& exec_script, script_verify_flags flags, SigVersion sigversion, ScriptError* serror);
 
 #endif // BITCOIN_SCRIPT_INTERPRETER_H
diff --git a/src/script/script.cpp b/src/script/script.cpp
index 1bb0d4a07812..42826a8ce50f 100644
--- a/src/script/script.cpp
+++ b/src/script/script.cpp
@@ -365,8 +365,14 @@ bool GetScriptOp(CScriptBase::const_iterator& pc, CScriptBase::const_iterator en
     return true;
 }
 
-bool IsOpSuccess(const opcodetype& opcode)
+bool IsOpSuccess(const opcodetype& opcode, SigVersion sigversion)
 {
+    assert(IsTapscript(sigversion));
+    if (sigversion == SigVersion::TAPSCRIPT_V2) {
+        return opcode == OP_1NEGATE || opcode == OP_RESERVED || opcode == OP_VER ||
+            (opcode >= OP_RESERVED1 && opcode <= OP_RESERVED2) || opcode == OP_NEGATE || opcode == OP_ABS ||
+            (opcode >= 187 && opcode <= 254);
+    }
     return opcode == 80 || opcode == 98 || (opcode >= 126 && opcode <= 129) ||
            (opcode >= 131 && opcode <= 134) || (opcode >= 137 && opcode <= 138) ||
            (opcode >= 141 && opcode <= 142) || (opcode >= 149 && opcode <= 153) ||
diff --git a/src/script/script.h b/src/script/script.h
index 391fe23ddabb..b838d63e6028 100644
--- a/src/script/script.h
+++ b/src/script/script.h
@@ -43,6 +43,14 @@ static const int MAX_SCRIPT_SIZE = 10000;
 // Maximum number of values on script interpreter stack
 static const int MAX_STACK_SIZE = 1000;
 
+// Maximum number of values on script interpreter stack (Tapscript v2)
+static constexpr int MAX_TAPSCRIPT_V2_STACK_SIZE = 32'768;
+
+// BIP 441 increases the individual stack element limit to 4,000,000 bytes
+// and limits all stack and altstack elements to 8,000,000 bytes in total.
+static constexpr int MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE = 4'000'000;
+static constexpr int MAX_TAPSCRIPT_V2_TOTAL_STACK_SIZE = 2 * MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE;
+
 // Threshold for nLockTime: below this value it is interpreted as block number,
 // otherwise as UNIX timestamp.
 static const unsigned int LOCKTIME_THRESHOLD = 500000000; // Tue Nov  5 00:53:20 1985 UTC
@@ -220,6 +228,30 @@ static const unsigned int MAX_OPCODE = OP_NOP10;
 
 std::string GetOpName(opcodetype opcode);
 
+enum class SigVersion
+{
+    BASE = 0,        //!< Bare scripts and BIP16 P2SH-wrapped redeemscripts
+    WITNESS_V0 = 1,  //!< Witness v0 (P2WPKH and P2WSH); see BIP 141
+    TAPROOT = 2,     //!< Witness v1 with 32-byte program, not BIP16 P2SH-wrapped, key path spending; see BIP 341
+    TAPSCRIPT = 3,   //!< Witness v1 with 32-byte program, not BIP16 P2SH-wrapped, script path spending, leaf version 0xc0; see BIP 342
+    TAPSCRIPT_V2 = 4,   //!< Witness v1 with 32-byte program, not BIP16 P2SH-wrapped, script path spending, leaf version 0xc2; see BIP 441
+};
+
+/** Whether the signature version executes a Taproot script path. */
+constexpr bool IsTapscript(SigVersion sigversion)
+{
+    switch (sigversion) {
+    case SigVersion::BASE:
+    case SigVersion::WITNESS_V0:
+    case SigVersion::TAPROOT:
+        return false;
+    case SigVersion::TAPSCRIPT:
+    case SigVersion::TAPSCRIPT_V2:
+        return true;
+    }
+    assert(false);
+}
+
 class scriptnum_error : public std::runtime_error
 {
 public:
@@ -610,8 +642,8 @@ class CScriptID : public BaseHash<uint160>
     explicit CScriptID(const uint160& in) : BaseHash(in) {}
 };
 
-/** Test for OP_SUCCESSx opcodes as defined by BIP342. */
-bool IsOpSuccess(const opcodetype& opcode);
+/** Test for OP_SUCCESSx opcodes in the given Tapscript version. */
+bool IsOpSuccess(const opcodetype& opcode, SigVersion sigversion);
 
 bool CheckMinimalPush(const std::vector<unsigned char>& data, opcodetype opcode);
 
diff --git a/src/script/script_error.cpp b/src/script/script_error.cpp
index 8f49cd783c8a..444cc6c5532c 100644
--- a/src/script/script_error.cpp
+++ b/src/script/script_error.cpp
@@ -121,6 +121,18 @@ std::string ScriptErrorString(const ScriptError serror)
             return "Signature is found in scriptCode";
 
         INQ_SCRIPTERR_STRING
+        case SCRIPT_ERR_DIVIDE_BY_ZERO:
+            return "OP_DIV or OP_MOD by zero";
+        case SCRIPT_ERR_SUB_UNDERFLOW:
+            return "OP_SUB or OP_1SUB result would be negative";
+        case SCRIPT_ERR_VAROP_COUNT:
+            return "Varops budget exceeded";
+        case SCRIPT_ERR_TOTAL_STACK_SIZE:
+            return "Total stack size limit exceeded";
+        case SCRIPT_ERR_STACK_ELEMENT_SIZE:
+            return "Stack element size limit exceeded";
+        case SCRIPT_ERR_HASH_OPERAND_SIZE:
+            return "OP_RIPEMD160 or OP_SHA1 operand exceeds maximum permitted size";
 
         case SCRIPT_ERR_UNKNOWN_ERROR:
         case SCRIPT_ERR_ERROR_COUNT:
diff --git a/src/script/script_error.h b/src/script/script_error.h
index fd10bf91451b..fdc01b0289d0 100644
--- a/src/script/script_error.h
+++ b/src/script/script_error.h
@@ -88,6 +88,14 @@ typedef enum ScriptError_t
     /* Inquisition additions */
     INQ_SCRIPTERR
 
+    /* Tapscript v2 */
+    SCRIPT_ERR_DIVIDE_BY_ZERO,
+    SCRIPT_ERR_SUB_UNDERFLOW,
+    SCRIPT_ERR_VAROP_COUNT,
+    SCRIPT_ERR_TOTAL_STACK_SIZE,
+    SCRIPT_ERR_STACK_ELEMENT_SIZE,
+    SCRIPT_ERR_HASH_OPERAND_SIZE,
+
     SCRIPT_ERR_ERROR_COUNT
 } ScriptError;
 
diff --git a/src/script/sign.cpp b/src/script/sign.cpp
index 61f578769c13..519d0266e45b 100644
--- a/src/script/sign.cpp
+++ b/src/script/sign.cpp
@@ -6,6 +6,7 @@
 #include <script/sign.h>
 
 #include <consensus/amount.h>
+#include <consensus/validation.h>
 #include <key.h>
 #include <policy/policy.h>
 #include <primitives/transaction.h>
@@ -14,6 +15,7 @@
 #include <script/script.h>
 #include <script/signingprovider.h>
 #include <script/solver.h>
+#include <script/varops.h>
 #include <uint256.h>
 #include <util/translation.h>
 #include <util/vector.h>
@@ -61,7 +63,7 @@ bool MutableTransactionSignatureCreator::CreateSig(const SigningProvider& provid
 
 bool MutableTransactionSignatureCreator::CreateSchnorrSig(const SigningProvider& provider, std::vector<unsigned char>& sig, const XOnlyPubKey& pubkey, const uint256* leaf_hash, const uint256* merkle_root, SigVersion sigversion) const
 {
-    assert(sigversion == SigVersion::TAPROOT || sigversion == SigVersion::TAPSCRIPT);
+    assert(sigversion == SigVersion::TAPROOT || IsTapscript(sigversion));
 
     CKey key;
     if (!provider.GetKeyByXOnly(pubkey, key)) return false;
@@ -74,7 +76,7 @@ bool MutableTransactionSignatureCreator::CreateSchnorrSig(const SigningProvider&
     ScriptExecutionData execdata;
     execdata.m_annex_init = true;
     execdata.m_annex_present = false; // Only support annex-less signing for now.
-    if (sigversion == SigVersion::TAPSCRIPT) {
+    if (IsTapscript(sigversion)) {
         execdata.m_codeseparator_pos_init = true;
         execdata.m_codeseparator_pos = 0xFFFFFFFF; // Only support non-OP_CODESEPARATOR BIP342 signing for now.
         if (!leaf_hash) return false; // BIP342 signing needs leaf hash.
@@ -285,12 +287,16 @@ struct WshSatisfier: Satisfier<CPubKey> {
 /** Miniscript satisfier specific to Tapscript context. */
 struct TapSatisfier: Satisfier<XOnlyPubKey> {
     const uint256& m_leaf_hash;
+    const SigVersion m_sigversion;
 
     explicit TapSatisfier(const SigningProvider& provider LIFETIMEBOUND, SignatureData& sig_data LIFETIMEBOUND,
                           const BaseSignatureCreator& creator LIFETIMEBOUND, const CScript& script LIFETIMEBOUND,
-                          const uint256& leaf_hash LIFETIMEBOUND)
+                          const uint256& leaf_hash LIFETIMEBOUND, SigVersion sigversion)
                           : Satisfier(provider, sig_data, creator, script, miniscript::MiniscriptContext::TAPSCRIPT),
-                            m_leaf_hash(leaf_hash) {}
+                            m_leaf_hash(leaf_hash), m_sigversion(sigversion)
+    {
+        assert(IsTapscript(m_sigversion));
+    }
 
     //! Conversion from a raw xonly public key.
     template <typename I>
@@ -310,7 +316,7 @@ struct TapSatisfier: Satisfier<XOnlyPubKey> {
 
     //! Satisfy a BIP340 signature check.
     miniscript::Availability Sign(const XOnlyPubKey& key, std::vector<unsigned char>& sig) const {
-        if (CreateTaprootScriptSig(m_creator, m_sig_data, m_provider, sig, key, m_leaf_hash, SigVersion::TAPSCRIPT)) {
+        if (CreateTaprootScriptSig(m_creator, m_sig_data, m_provider, sig, key, m_leaf_hash, m_sigversion)) {
             return miniscript::Availability::YES;
         }
         return miniscript::Availability::NO;
@@ -319,13 +325,14 @@ struct TapSatisfier: Satisfier<XOnlyPubKey> {
 
 static bool SignTaprootScript(const SigningProvider& provider, const BaseSignatureCreator& creator, SignatureData& sigdata, int leaf_version, Span<const unsigned char> script_bytes, std::vector<valtype>& result)
 {
-    // Only BIP342 tapscript signing is supported for now.
-    if (leaf_version != TAPROOT_LEAF_TAPSCRIPT) return false;
+    // Only the supported tapscript leaf versions can be signed.
+    if (leaf_version != TAPROOT_LEAF_TAPSCRIPT && leaf_version != TAPROOT_LEAF_TAPSCRIPT_V2) return false;
 
     uint256 leaf_hash = ComputeTapleafHash(leaf_version, script_bytes);
     CScript script = CScript(script_bytes.begin(), script_bytes.end());
+    const SigVersion sigversion{leaf_version == TAPROOT_LEAF_TAPSCRIPT_V2 ? SigVersion::TAPSCRIPT_V2 : SigVersion::TAPSCRIPT};
 
-    TapSatisfier ms_satisfier{provider, sigdata, creator, script, leaf_hash};
+    TapSatisfier ms_satisfier{provider, sigdata, creator, script, leaf_hash, sigversion};
     const auto ms = miniscript::FromScript(script, ms_satisfier);
     return ms && ms->Satisfy(ms_satisfier, result) == miniscript::Availability::YES;
 }
@@ -784,7 +791,8 @@ bool SignTransaction(CMutableTransaction& mtx, const SigningProvider* keystore,
             spent_outputs.emplace_back(coin->second.out.nValue, coin->second.out.scriptPubKey);
         }
     }
-    if (spent_outputs.size() == mtx.vin.size()) {
+    const bool have_all_spent_outputs{spent_outputs.size() == mtx.vin.size()};
+    if (have_all_spent_outputs) {
         txdata.Init(txConst, std::move(spent_outputs), true);
     }
 
@@ -829,5 +837,23 @@ bool SignTransaction(CMutableTransaction& mtx, const SigningProvider* keystore,
             input_errors.erase(i);
         }
     }
+
+    if (input_errors.empty() && have_all_spent_outputs) {
+        const CTransaction signed_tx{mtx};
+        PrecomputedTransactionData signed_txdata;
+        auto finalized_spent_outputs{txdata.m_spent_outputs};
+        signed_txdata.Init(signed_tx, std::move(finalized_spent_outputs), true);
+        varops::Budget varops_budget{varops::TxBudget(GetTransactionWeight(signed_tx))};
+
+        for (unsigned int i = 0; i < mtx.vin.size(); ++i) {
+            const CTxOut& spent_output{signed_txdata.m_spent_outputs[i]};
+            ScriptError serror{SCRIPT_ERR_OK};
+            if (!VerifyScript(mtx.vin[i].scriptSig, spent_output.scriptPubKey, &mtx.vin[i].scriptWitness, STANDARD_SCRIPT_VERIFY_FLAGS, TransactionSignatureChecker(&signed_tx, i, spent_output.nValue, signed_txdata, MissingDataBehavior::FAIL), &serror, varops_budget)) {
+                input_errors[i] = Untranslated(ScriptErrorString(serror));
+                break;
+            }
+        }
+    }
+
     return input_errors.empty();
 }
diff --git a/src/script/val64.cpp b/src/script/val64.cpp
new file mode 100644
index 000000000000..89a4081c1e2a
--- /dev/null
+++ b/src/script/val64.cpp
@@ -0,0 +1,1140 @@
+// Copyright (c) 2024 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <script/val64.h>
+
+#include <compat/endian.h>
+#include <script/varops.h>
+
+#include <algorithm>
+#include <bit>
+#include <cassert>
+#include <cstring>
+#include <memory>
+#include <utility>
+
+// MSVC compatibility: use compiler intrinsics where __int128 is not available.
+#if defined(_MSC_VER) && (defined(_M_X64) || defined(_M_ARM64))
+#include <intrin.h>
+#if defined(_M_X64)
+#include <immintrin.h>
+#define VAL64_HAVE_MSVC_UMUL128 1
+#if _MSC_VER >= 1920
+#define VAL64_HAVE_MSVC_UDIV128 1
+#endif
+#elif defined(_M_ARM64)
+#define VAL64_HAVE_MSVC_UMULH 1
+#endif
+#endif
+
+
+// For testing.
+bool Val64::m_force_offset_span = false;
+bool Val64::m_force_portable_math = false;
+
+namespace {
+
+#ifdef __has_builtin
+#if __has_builtin(__builtin_add_overflow) && __has_builtin(__builtin_sub_overflow)
+#define VAL64_HAVE_BUILTIN_OVERFLOW 1
+#endif
+#endif
+
+bool AddOverflow(uint64_t lhs, uint64_t rhs, uint64_t& result)
+{
+#ifdef VAL64_HAVE_BUILTIN_OVERFLOW
+    return __builtin_add_overflow(lhs, rhs, &result);
+#else
+    const bool overflow{rhs > UINT64_MAX - lhs};
+    result = overflow ? rhs - (UINT64_MAX - lhs) - 1 : lhs + rhs;
+    return overflow;
+#endif
+}
+
+bool SubUnderflow(uint64_t lhs, uint64_t rhs, uint64_t& result)
+{
+#ifdef VAL64_HAVE_BUILTIN_OVERFLOW
+    return __builtin_sub_overflow(lhs, rhs, &result);
+#else
+    const bool underflow{lhs < rhs};
+    result = underflow ? UINT64_MAX - (rhs - lhs) + 1 : lhs - rhs;
+    return underflow;
+#endif
+}
+
+uint64_t ShiftLeftLow64(uint64_t value, size_t shift)
+{
+    assert(shift < 64);
+    if (shift == 0) return value;
+    return (value & (UINT64_MAX >> shift)) << shift;
+}
+
+struct Div64Result {
+    uint64_t quotient;
+    uint64_t remainder;
+    bool quotient_is_beta;
+};
+
+struct Uint128 {
+    uint64_t hi;
+    uint64_t lo;
+
+    static Uint128 Mul(uint64_t a, uint64_t b, bool force_portable_math)
+    {
+#if defined(__SIZEOF_INT128__)
+        if (!force_portable_math) {
+            const unsigned __int128 product{static_cast<unsigned __int128>(a) * b};
+            return {static_cast<uint64_t>(product >> 64), static_cast<uint64_t>(product)};
+        }
+#elif defined(VAL64_HAVE_MSVC_UMUL128)
+        if (!force_portable_math) {
+            uint64_t hi;
+            const uint64_t lo{_umul128(a, b, &hi)};
+            return {hi, lo};
+        }
+#elif defined(VAL64_HAVE_MSVC_UMULH)
+        if (!force_portable_math) {
+            return {__umulh(a, b), a * b};
+        }
+#endif
+
+        // Reconstruct a 64x64-to-128-bit product from four 32x32-bit
+        // partial products, carrying the middle terms into the high word.
+        const uint64_t a_lo{a & 0xFFFFFFFFULL};
+        const uint64_t a_hi{a >> 32};
+        const uint64_t b_lo{b & 0xFFFFFFFFULL};
+        const uint64_t b_hi{b >> 32};
+
+        const uint64_t p0{a_lo * b_lo};
+        const uint64_t p1{a_lo * b_hi};
+        const uint64_t p2{a_hi * b_lo};
+        const uint64_t p3{a_hi * b_hi};
+
+        const uint64_t carry{((p0 >> 32) + (p1 & 0xFFFFFFFFULL) + (p2 & 0xFFFFFFFFULL)) >> 32};
+        uint64_t lo;
+        AddOverflow(p0, ShiftLeftLow64(p1, 32), lo);
+        AddOverflow(lo, ShiftLeftLow64(p2, 32), lo);
+        const uint64_t hi{p3 + (p1 >> 32) + (p2 >> 32) + carry};
+        return {hi, lo};
+    }
+
+    Div64Result DivMod64(uint64_t divisor, bool force_portable_math) const
+    {
+        assert(divisor != 0);
+
+        if (hi >= divisor) {
+            // The trial quotient is beta. D3 represents the corrected beta - 1.
+            assert(hi == divisor);
+            return {UINT64_MAX, lo, true};
+        }
+
+#if defined(__SIZEOF_INT128__)
+        if (!force_portable_math) {
+            const unsigned __int128 dividend{(static_cast<unsigned __int128>(hi) << 64) | lo};
+            const unsigned __int128 quotient{dividend / divisor};
+            const unsigned __int128 remainder{dividend % divisor};
+
+            assert((quotient >> 64) == 0);
+            return {static_cast<uint64_t>(quotient), static_cast<uint64_t>(remainder), false};
+        }
+#elif defined(VAL64_HAVE_MSVC_UDIV128)
+        if (!force_portable_math) {
+            uint64_t remainder;
+            const uint64_t quotient{_udiv128(hi, lo, divisor, &remainder)};
+            return {quotient, remainder, false};
+        }
+#endif
+
+        // Portable 128-bit by 64-bit division using 32-bit digits.
+        // Based on Hacker's Delight divlu() and Knuth's Algorithm D.
+        // Computes (hi:lo) / divisor. When hi == divisor, Knuth's trial
+        // quotient is beta and gets corrected by D3 in the caller.
+        if (hi == 0) {
+            return {lo / divisor, lo % divisor, false};
+        }
+
+        // The divisor has its top bit set (normalized), so we can safely use
+        // 32-bit chunks without overflow in intermediate calculations.
+        constexpr uint64_t B = 1ULL << 32; // Base (2^32)
+
+        // Split divisor into two 32-bit digits.
+        const uint64_t d1{divisor >> 32};
+        const uint64_t d0{divisor & 0xFFFFFFFF};
+
+        // The dividend is (hi : lo), treated as four 32-bit digits:
+        // hi = (u3 : u2), lo = (u1 : u0). Compute one quotient digit at a time.
+        const uint64_t u32{hi};
+        const uint64_t u1{lo >> 32};
+        const uint64_t u0{lo & 0xFFFFFFFF};
+
+        // Estimate q1 = floor(u32 / d1). Since divisor is normalized and
+        // hi < divisor, the result fits in 32 bits.
+        uint64_t q1{u32 / d1};
+        uint64_t r1{u32 % d1};
+
+        // Refine: while q1 >= B or q1 * d0 > B * r1 + u1.
+        while (q1 >= B || q1 * d0 > ShiftLeftLow64(r1, 32) + u1) {
+            --q1;
+            r1 += d1;
+            if (r1 >= B) break;
+        }
+
+        // Update partial remainder for next digit:
+        // u21 = (u32 * B + u1) - q1 * divisor
+        //     = (r1 * B + u1) - q1 * d0.
+        uint64_t u21;
+        SubUnderflow(ShiftLeftLow64(r1, 32) + u1, q1 * d0, u21);
+
+        uint64_t q0{u21 / d1};
+        uint64_t r0{u21 % d1};
+
+        while (q0 >= B || q0 * d0 > ShiftLeftLow64(r0, 32) + u0) {
+            --q0;
+            r0 += d1;
+            if (r0 >= B) break;
+        }
+
+        assert(q1 < B);
+        assert(q0 < B);
+        const uint64_t quotient{(q1 << 32) + q0};
+        uint64_t remainder;
+        SubUnderflow(ShiftLeftLow64(r0, 32) + u0, q0 * d0, remainder);
+        return {quotient, remainder, false};
+    }
+};
+
+// Make the byte-backed words accessible as uint64_t objects before exposing
+// them through m_limbs.
+uint64_t* StartLimbLifetimes(void* aligned_ptr, size_t limb_count)
+{
+    uint64_t* limbs = static_cast<uint64_t*>(aligned_ptr);
+    unsigned char* bytes = static_cast<unsigned char*>(aligned_ptr);
+
+    for (size_t i = 0; i < limb_count; ++i) {
+        uint64_t value;
+        std::memcpy(&value, bytes + i * sizeof(uint64_t), sizeof(value));
+        std::construct_at(limbs + i, value);
+    }
+
+    return limbs;
+}
+
+#undef VAL64_HAVE_BUILTIN_OVERFLOW
+
+} // namespace
+
+Val64::Val64(std::vector<unsigned char>&& bytes) : m_bytes(std::move(bytes))
+{
+    SetSpan();
+}
+
+size_t Val64::LimbOffset() const
+{
+    if (m_size == 0) return 0;
+
+    const unsigned char* p{reinterpret_cast<const unsigned char*>(m_limbs.data())};
+
+    // Sanity check that the limb view is in bounds.
+    assert(p >= m_bytes.data());
+    assert(p + m_size <= m_bytes.data() + m_bytes.size());
+
+    return p - m_bytes.data();
+}
+
+#ifdef DEBUG
+void Val64::CheckInvariants() const
+{
+    assert(m_size <= m_bytes.size());
+
+    if (m_limbs.empty()) {
+        assert(m_size == 0);
+        return;
+    }
+
+    const unsigned char* const data{m_bytes.data()};
+    const unsigned char* const span_bytes{reinterpret_cast<const unsigned char*>(m_limbs.data())};
+    const size_t span_bytes_size{m_limbs.size_bytes()};
+
+    assert(span_bytes >= data);
+    assert(span_bytes + span_bytes_size <= data + m_bytes.size());
+
+    const size_t span_offset{static_cast<size_t>(span_bytes - data)};
+    assert(span_offset + m_size <= m_bytes.size());
+    assert(std::all_of(m_bytes.begin(), m_bytes.begin() + span_offset, [](unsigned char c) { return c == 0; }));
+    assert(std::all_of(m_bytes.begin() + span_offset + m_size, m_bytes.end(), [](unsigned char c) { return c == 0; }));
+}
+#endif
+
+// Only m_bytes is set: initialize other fields.
+void Val64::SetSpan()
+{
+    m_size = m_bytes.size();
+
+    // Round up to get number of u64s
+    const size_t limb_count{(m_size + sizeof(uint64_t) - 1) / sizeof(uint64_t)};
+    if (limb_count == 0) {
+        m_limbs = {};
+#ifdef DEBUG
+        CheckInvariants();
+#endif
+        return;
+    }
+
+    // Enlarge if necessary (trailing zeroes are harmless in little-endian)
+    if (m_bytes.size() < limb_count * sizeof(uint64_t)) {
+        m_bytes.insert(m_bytes.end(), limb_count * sizeof(uint64_t) - m_bytes.size(), 0);
+    }
+
+    // Val64 stores script values as bytes and creates live 64-bit limb objects
+    // in aligned byte storage so arithmetic can use word-sized spans.
+    size_t available_space = m_bytes.size();
+    void* aligned_ptr{m_bytes.data()};
+    if (std::align(alignof(uint64_t), limb_count * sizeof(uint64_t), aligned_ptr, available_space) == m_bytes.data() && aligned_ptr == m_bytes.data() && !m_force_offset_span) {
+        m_limbs = std::span<le64_t>(StartLimbLifetimes(m_bytes.data(), limb_count), limb_count);
+#ifdef DEBUG
+        CheckInvariants();
+#endif
+        return;
+    }
+
+    // Append zeroes so we can move values.  This might change alignment.
+    m_bytes.insert(m_bytes.end(), sizeof(uint64_t), 0);
+    available_space = m_bytes.size();
+    aligned_ptr = m_bytes.data();
+    std::align(alignof(uint64_t), limb_count * sizeof(uint64_t), aligned_ptr, available_space);
+
+    // Force an offset span in tests even when the vector is already aligned.
+    if (m_force_offset_span && aligned_ptr == m_bytes.data()) {
+        aligned_ptr = m_bytes.data() + sizeof(uint64_t);
+    }
+
+    // Figure out how much the offset now is, so we can move data.
+    const size_t span_offset{static_cast<size_t>(static_cast<unsigned char*>(aligned_ptr) - m_bytes.data())};
+    std::memmove(m_bytes.data() + span_offset, m_bytes.data(), limb_count * sizeof(uint64_t));
+    std::fill(m_bytes.begin(), m_bytes.begin() + span_offset, 0);
+    m_limbs = std::span<le64_t>(StartLimbLifetimes(aligned_ptr, limb_count), limb_count);
+#ifdef DEBUG
+    CheckInvariants();
+#endif
+}
+
+// Remove offset because we're changing m_bytes.
+void Val64::PrepareForByteMutation()
+{
+#ifdef DEBUG
+    CheckInvariants();
+#endif
+    const size_t span_offset{LimbOffset()};
+    if (span_offset != 0) {
+        m_bytes.erase(m_bytes.begin(), m_bytes.begin() + span_offset);
+    }
+
+    // Trim any added bytes.
+    assert(m_size <= m_bytes.size());
+    m_bytes.resize(m_size);
+}
+
+void Val64::RemoveFront(size_t bytes)
+{
+    assert(bytes <= m_size);
+
+    PrepareForByteMutation();
+    m_bytes.erase(m_bytes.begin(), m_bytes.begin() + bytes);
+    SetSpan();
+}
+
+void Val64::PrependZeros(size_t prebytes)
+{
+    PrepareForByteMutation();
+    m_bytes.insert(m_bytes.begin(), prebytes, 0);
+    SetSpan();
+}
+
+void Val64::Truncate(size_t new_size)
+{
+    assert(new_size <= m_bytes.size());
+
+    PrepareForByteMutation();
+    m_bytes.resize(new_size);
+    SetSpan();
+}
+
+void Val64::MoveFromValtype(std::vector<unsigned char>&& bytes)
+{
+    m_bytes = std::move(bytes);
+    SetSpan();
+}
+
+std::vector<unsigned char> Val64::MoveToValtype()
+{
+    std::vector<unsigned char> ret;
+
+    PrepareForByteMutation();
+    ret = std::move(m_bytes);
+    SetSpan();
+
+    return ret;
+}
+
+void Val64::TrimTrailingZeros()
+{
+    TrimTail();
+}
+
+Val64::Val64(const Val64& other)
+{
+    const size_t span_offset{other.LimbOffset()};
+    m_bytes.assign(other.m_bytes.begin() + span_offset, other.m_bytes.begin() + span_offset + other.m_size);
+    SetSpan();
+}
+
+// Faster "trim zeroes from end" function
+void Val64::TrimTail(size_t nonzero_len)
+{
+#ifdef DEBUG
+    // Check that the words after nonzero len are indeed all zero.
+    for (size_t i = nonzero_len; i < m_limbs.size(); ++i) {
+        assert(m_limbs[i] == 0);
+    }
+#endif
+
+    if (nonzero_len < m_limbs.size()) {
+        m_limbs = m_limbs.first(nonzero_len);
+    }
+
+    TrimTail();
+}
+
+void Val64::TrimTail()
+{
+    // Discard complete zero limbs before examining the remaining bytes.
+    size_t nonzero_words{m_limbs.size()};
+    while (nonzero_words > 0 && m_limbs[nonzero_words - 1] == 0) {
+        --nonzero_words;
+    }
+    if (nonzero_words < m_limbs.size()) {
+        m_limbs = m_limbs.first(nonzero_words);
+    }
+
+    m_size = m_limbs.size_bytes();
+
+    PrepareForByteMutation();
+    // At most the seven high zero bytes in the final non-zero limb remain.
+    while (!m_bytes.empty() && m_bytes.back() == 0) {
+        m_bytes.pop_back();
+    }
+    SetSpan();
+}
+
+Val64::Val64(uint64_t value) : m_bytes(sizeof(uint64_t))
+{
+    SetSpan();
+    Set(0, value);
+    TrimTail();
+}
+
+Val64::Val64(Val64&& other) noexcept
+{
+    other.PrepareForByteMutation();
+    m_bytes = std::move(other.m_bytes);
+    other.SetSpan();
+    SetSpan();
+}
+
+Val64& Val64::operator=(Val64&& other) noexcept
+{
+    if (this != &other) {
+        other.PrepareForByteMutation();
+        m_bytes = std::move(other.m_bytes);
+        other.SetSpan();
+        SetSpan();
+    }
+    return *this;
+}
+
+void Val64::Swap(Val64& other) noexcept
+{
+    std::swap(m_bytes, other.m_bytes);
+    std::swap(m_size, other.m_size);
+    std::swap(m_limbs, other.m_limbs);
+}
+
+uint64_t Val64::GetOrZero(size_t index) const
+{
+    if (index >= m_limbs.size()) return 0;
+    return Get(index);
+}
+
+// Append a 1 byte to the limb array.
+void Val64::AppendOne()
+{
+    PrepareForByteMutation();
+
+    // Make sure we have room to append.
+    m_bytes.resize(m_limbs.size() * sizeof(uint64_t) + 1);
+    m_bytes[m_limbs.size() * sizeof(uint64_t)] = 1;
+
+    // Re-evaluate with new m_bytes.
+    SetSpan();
+}
+
+uint64_t Val64::ToU64Ceil(uint64_t max, uint64_t& varcost) const
+{
+    // Worst case, we have to examine the padded word span (LENGTHCONV).
+    varcost += varops::LengthConversionCost(m_size);
+
+    // Little endian: get first word (zero-fills).
+    const uint64_t value{GetOrZero(0)};
+    if (value > max) return max;
+
+    // If any other bytes are non-zero, it's > UINT64_MAX.
+    if (m_limbs.size() > 1 && !SpanIsAllZero(m_limbs.last(m_limbs.size() - 1))) {
+        return max;
+    }
+
+    return value;
+}
+
+bool Val64::IsZero() const
+{
+    return SpanIsAllZero(m_limbs);
+}
+
+bool Val64::IsZero(uint64_t& varcost) const
+{
+    varcost += varops::CompareZeroCost(m_size);
+    return SpanIsAllZero(m_limbs);
+}
+
+bool Val64::SpanIsAllZero(std::span<const le64_t> span)
+{
+    if (span.empty()) return true;
+    if (span.front() != 0) return false;
+
+    // memcmp-with-self trick: see https://rusty.ozlabs.org/2015/10/20/ccanmems-memeqzero-iteration.html
+    return std::memcmp(span.data(), span.data() + 1, (span.size() - 1) * sizeof(le64_t)) == 0;
+}
+
+// If v1 > v2: 1. If v1 < v2: -1. Otherwise 0.
+int Val64::CompareSpans(std::span<const le64_t> v1, std::span<const le64_t> v2)
+{
+    const size_t max_length{std::max(v1.size(), v2.size())};
+    if (max_length == 0) return 0;
+
+    for (size_t i = max_length; i > 0;) {
+        --i;
+        const uint64_t value1{i < v1.size() ? le64toh_internal(v1[i]) : 0};
+        const uint64_t value2{i < v2.size() ? le64toh_internal(v2[i]) : 0};
+        if (value1 < value2) return -1;
+        if (value1 > value2) return 1;
+    }
+    return 0;
+}
+
+int Val64::Compare(const Val64& other) const
+{
+    return CompareSpans(m_limbs, other.m_limbs);
+}
+
+int Val64::Compare(const Val64& other, uint64_t& varcost) const
+{
+    varcost += varops::ComparisonCost(m_size, other.m_size);
+
+    return CompareSpans(m_limbs, other.m_limbs);
+}
+
+// v1 += v2 (size v2 <= v1).  Return true if carry overflowed.
+bool Val64::AddSpans(std::span<le64_t> v1, std::span<const le64_t> v2, size_t& nonzero_len)
+{
+    assert(v1.size() >= v2.size());
+
+    // Little endian, overflow forward.
+    bool carry = false;
+
+    size_t i;
+    nonzero_len = 0;
+    for (i = 0; i < v2.size(); ++i) {
+        uint64_t u1, u2, res;
+
+        u1 = le64toh_internal(v1[i]);
+        u2 = le64toh_internal(v2[i]);
+
+        const bool add_carry{AddOverflow(u1, u2, res)};
+        const bool carry_carry{AddOverflow(res, uint64_t{carry}, res)};
+        carry = add_carry || carry_carry;
+        if (res != 0) nonzero_len = i + 1;
+        v1[i] = htole64_internal(res);
+    }
+
+    /* Carry forwards if required (continue even if not overflowing,
+     * to set nonzero_len) */
+    while (i < v1.size()) {
+        uint64_t u1;
+        carry = AddOverflow(le64toh_internal(v1[i]), uint64_t{carry}, u1);
+        v1[i] = htole64_internal(u1);
+        if (u1 != 0) nonzero_len = i + 1;
+        ++i;
+    }
+
+    return carry;
+}
+
+void Val64::OpAdd(Val64& v1, Val64& v2, uint64_t& varcost)
+{
+    PutLongerFirst(v1, v2);
+
+    varcost += varops::AddCost(v1.m_size, v2.m_size);
+
+    size_t nonzero_len;
+    bool carry = AddSpans(v1.m_limbs, v2.m_limbs, nonzero_len);
+
+    if (carry) {
+        v1.AppendOne();
+        return;
+    }
+
+    v1.TrimTail(nonzero_len);
+}
+
+void Val64::Op1Add(Val64& v1, uint64_t& varcost)
+{
+    // Charge as ADD with a minimal one-byte operand.
+    varcost += varops::AddCost(v1.m_size, 1);
+    if (v1.m_limbs.empty()) {
+        v1.AppendOne();
+        return;
+    }
+
+    le64_t one{htole64_internal(1)};
+    size_t nonzero_len;
+    if (AddSpans(v1.m_limbs, std::span<le64_t>{&one, 1}, nonzero_len)) {
+        v1.AppendOne();
+    } else {
+        v1.TrimTail(nonzero_len);
+    }
+}
+
+// v1 -= v2
+bool Val64::SubtractSpans(std::span<le64_t> v1, std::span<const le64_t> v2, size_t& nonzero_len)
+{
+    const size_t common_len{std::min(v1.size(), v2.size())};
+
+    // Little endian, underflow forward.
+    bool underflow = false;
+
+    size_t i;
+    nonzero_len = 0;
+    for (i = 0; i < common_len; ++i) {
+        uint64_t u1, u2, res;
+
+        u1 = le64toh_internal(v1[i]);
+        u2 = le64toh_internal(v2[i]);
+
+        const bool sub_underflow{SubUnderflow(u1, u2, res)};
+        const bool borrow_underflow{SubUnderflow(res, uint64_t{underflow}, res)};
+        underflow = sub_underflow || borrow_underflow;
+        v1[i] = htole64_internal(res);
+        if (res != 0) nonzero_len = i + 1;
+    }
+
+    /* We have exhausted v1? */
+    if (i < v2.size()) {
+        if (underflow) return true;
+        while (i < v2.size()) {
+            if (v2[i] != 0) return true;
+            ++i;
+        }
+        return false;
+    }
+
+    /* We have exhausted v2.  Underflow forwards if required: we keep
+     * going even if we don't need to, to update nonzero_len. */
+    while (i < v1.size()) {
+        const uint64_t u1{le64toh_internal(v1[i])};
+        uint64_t res;
+        underflow = SubUnderflow(u1, uint64_t{underflow}, res);
+        v1[i] = htole64_internal(res);
+        if (res != 0) nonzero_len = i + 1;
+        ++i;
+    }
+
+    return underflow;
+}
+
+
+bool Val64::OpSub(Val64& v1, const Val64& v2, uint64_t& varcost)
+{
+    varcost += varops::SubCost(v1.m_size, v2.m_size);
+    size_t nonzero_len;
+
+    const bool underflow{SubtractSpans(v1.m_limbs, v2.m_limbs, nonzero_len)};
+    if (underflow) {
+        // SubtractSpans writes whole words, but padding bytes outside the logical value
+        // must remain zero even when the result is discarded for underflow.
+        if (v1.m_size < v1.m_limbs.size_bytes()) {
+            unsigned char* bytes{reinterpret_cast<unsigned char*>(v1.m_limbs.data())};
+            std::fill(bytes + v1.m_size, bytes + v1.m_limbs.size_bytes(), 0);
+        }
+        return false;
+    }
+
+    v1.TrimTail(nonzero_len);
+    return true;
+}
+
+bool Val64::Op1Sub(Val64& v1, uint64_t& varcost)
+{
+    varcost += varops::SubCost(v1.m_size, 1);
+    if (v1.m_limbs.empty()) return false;
+
+    le64_t one{htole64_internal(1)};
+    size_t nonzero_len;
+    if (SubtractSpans(v1.m_limbs, std::span<le64_t>{&one, 1}, nonzero_len)) return false;
+
+    v1.TrimTail(nonzero_len);
+    return true;
+}
+
+void Val64::ShiftDown(size_t words, size_t bits)
+{
+    assert(!m_limbs.empty());
+    assert(bits > 0);
+    assert(bits < 64);
+
+    // [B, A] rshift 1 => [B>>1 | A>>63, A << 1]
+    uint64_t previous_bits{Get(words) >> bits};
+    for (size_t i = words; i < m_limbs.size() - 1; ++i) {
+        const uint64_t next{Get(i + 1)};
+        Set(i - words, previous_bits | ShiftLeftLow64(next, 64 - bits));
+        previous_bits = next >> bits;
+    }
+    // Shift the last word.
+    Set(m_limbs.size() - 1 - words, previous_bits);
+}
+
+void Val64::OpDownShift(Val64& v1, const Val64& v2, uint64_t& varcost)
+{
+    const uint64_t bits{v2.ToU64Ceil(v1.m_size * 8, varcost)};
+    const size_t bytes{static_cast<size_t>(bits / 8)};
+
+    // ToU64Ceil charged conversion of BITS; charge copying below once the
+    // surviving operand length is known.
+
+    // Shift past end?  Empty.  Also covers empty array.
+    if (bytes >= v1.m_size) {
+        v1 = Val64{0};
+        return;
+    }
+
+    varcost += (v1.m_size - bytes) * varops::COST_COPYING;
+
+    // Bitwise shifts can't do 0 anyway, as << 64 undefined.
+    if (bits % 8 == 0) {
+        // Remove least-significant words.
+        v1.RemoveFront(bytes);
+        return;
+    }
+
+    // Size after this is at least 1!
+    assert(!v1.m_limbs.empty());
+
+    // We shift and move at the same time.
+    v1.ShiftDown(bits / 64, bits % 64);
+
+    // Truncate.
+    v1.Truncate(v1.m_size - bytes);
+}
+
+// Shift bits toward more-significant positions, increasing the value.
+bool Val64::OpUpShift(Val64& v1, const Val64& v2, size_t max_size, uint64_t& varcost)
+{
+    const uint64_t bits{v2.ToU64Ceil(max_size * 8 + 1, varcost)};
+
+    // Cannot overflow: m_size is (far) less than 32 bits, so is max_size.
+    if (bits + v1.m_size * 8 > max_size * 8) return false;
+
+    // How many whole bytes should we prepend?
+    const size_t prebytes{static_cast<size_t>(bits / 8)};
+
+    // Charge against the pre-mutation operand size.
+    varcost += prebytes * varops::COST_FAST + v1.m_size * varops::COST_COPYING;
+
+    if (bits % 8 == 0) {
+        // Simply insert bytes at the beginning.
+        v1.PrependZeros(prebytes);
+    } else {
+        varcost += varops::UnalignedUpShiftCost(v1.m_size, prebytes);
+        // There's no nice C++ "add this many bytes at the beginning,
+        // and one at the end" so it is better to prepend too many bytes
+        // (fast!) and shift backwards.
+        v1.PrependZeros(prebytes + 1);
+        v1.ShiftDown(0, 8 - (bits % 8));
+    }
+
+    return true;
+}
+
+bool Val64::ShiftLeftLessThanWord(size_t bits)
+{
+    assert(bits > 0);
+    assert(bits < 64);
+
+    uint64_t previous_bits{0};
+
+    // [B, A] lshift 1 => [B<<1, A<<1 | B >> 63]
+    for (size_t i = 0; i < m_limbs.size(); ++i) {
+        const uint64_t old_value{Get(i)};
+        const uint64_t new_value{ShiftLeftLow64(old_value, bits) | previous_bits};
+
+        Set(i, new_value);
+        previous_bits = old_value >> (64 - bits);
+    }
+    return previous_bits != 0;
+}
+
+void Val64::Op2Mul(Val64& v1, uint64_t& varcost)
+{
+    // Charge before trimming the operand.
+    varcost += varops::TwoMulCost(v1.m_size);
+
+    // Trim first: any bytes we trim here, we avoid shifting.
+    v1.TrimTail();
+
+    if (v1.ShiftLeftLessThanWord(1)) {
+        v1.AppendOne();
+    } else {
+        v1.TrimTail();
+    }
+}
+
+void Val64::Op2Div(Val64& v1, uint64_t& varcost)
+{
+    // Charge before trimming the operand.
+    varcost += varops::TwoDivCost(v1.m_size);
+
+    // Trim first: any bytes we trim here, we avoid shifting.
+    v1.TrimTail();
+
+    // ShiftDown assumes non-zero size.
+    if (v1.m_size == 0) return;
+
+    v1.ShiftDown(0, 1);
+    v1.TrimTail();
+}
+
+void Val64::OpInvert(Val64& v1, uint64_t& varcost)
+{
+    varcost += varops::InvertCost(v1.m_size);
+
+    // Endian doesn't matter, so access raw.
+    for (le64_t& v : v1.m_limbs) {
+        v ^= UINT64_MAX;
+    }
+
+    // Zero out padding bytes beyond m_size in the last u64 word,
+    // so subsequent Val64 operations don't see contaminated padding.
+    const size_t padding{v1.m_limbs.size() * sizeof(uint64_t) - v1.m_size};
+    if (padding > 0) {
+        unsigned char* bytes{reinterpret_cast<unsigned char*>(v1.m_limbs.data())};
+        std::memset(bytes + v1.m_size, 0, padding);
+    }
+}
+
+// Makes sure v1 is at least as long as v2.
+void Val64::PutLongerFirst(Val64& v1, Val64& v2)
+{
+    // Make sure v1 is the longer one.
+    if (v1.m_size < v2.m_size) v1.Swap(v2);
+}
+
+void Val64::OpAnd(Val64& v1, Val64& v2, uint64_t& varcost)
+{
+    PutLongerFirst(v1, v2);
+
+    varcost += varops::AndCost(v1.m_size, v2.m_size);
+
+    // Endian doesn't matter, so access raw.
+    for (size_t i = 0; i < v2.m_limbs.size(); ++i) {
+        v1.m_limbs[i] &= v2.m_limbs[i];
+    }
+
+    // Rest is 0.
+    std::fill(v1.m_limbs.begin() + v2.m_limbs.size(), v1.m_limbs.end(), 0);
+}
+
+void Val64::OpOr(Val64& v1, Val64& v2, uint64_t& varcost)
+{
+    PutLongerFirst(v1, v2);
+
+    varcost += varops::OrCost(v1.m_size, v2.m_size);
+
+    // Endian doesn't matter, so access raw.
+    for (size_t i = 0; i < v2.m_limbs.size(); ++i) {
+        v1.m_limbs[i] |= v2.m_limbs[i];
+    }
+}
+
+void Val64::OpXor(Val64& v1, Val64& v2, uint64_t& varcost)
+{
+    PutLongerFirst(v1, v2);
+
+    varcost += varops::XorCost(v1.m_size, v2.m_size);
+
+    // Endian doesn't matter, so access raw.
+    for (size_t i = 0; i < v2.m_limbs.size(); ++i) {
+        v1.m_limbs[i] ^= v2.m_limbs[i];
+    }
+}
+
+void Val64::OpMin(Val64& v1, Val64& v2, uint64_t& varcost)
+{
+    PutLongerFirst(v1, v2);
+
+    varcost += varops::MinMaxCost(v1.m_size, v2.m_size);
+
+    if (CompareSpans(v1.m_limbs, v2.m_limbs) > 0) {
+        v1 = std::move(v2);
+    }
+    v1.TrimTail();
+}
+
+void Val64::OpMax(Val64& v1, Val64& v2, uint64_t& varcost)
+{
+    PutLongerFirst(v1, v2);
+
+    varcost += varops::MinMaxCost(v1.m_size, v2.m_size);
+
+    if (CompareSpans(v1.m_limbs, v2.m_limbs) < 0) {
+        v1 = std::move(v2);
+    }
+    v1.TrimTail();
+}
+
+void Val64::MultiplySpan(std::span<le64_t> res,
+                         std::span<const le64_t> src,
+                         uint64_t mul)
+{
+    // Result must be (at least) 1 word larger, for carry.
+    assert(res.size() >= src.size() + 1);
+
+    // Calculate this * mul, into res.
+    res[0] = htole64_internal(0);
+    for (size_t i = 0; i < src.size(); ++i) {
+        const Uint128 product{Uint128::Mul(le64toh_internal(src[i]), mul, m_force_portable_math)};
+        uint64_t hi{product.hi};
+        uint64_t lo{product.lo};
+        const uint64_t oldhi{le64toh_internal(res[i])};
+        /* Note: hi cannot overflow since UINT64MAX * UINT64MAX
+         * gives an upper u64 which is < UINT64MAX. */
+        if (AddOverflow(lo, oldhi, lo)) ++hi;
+        res[i] = htole64_internal(lo);
+        res[i + 1] = htole64_internal(hi);
+    }
+}
+
+Val64 Val64::OpMul(Val64& v1, Val64& v2)
+{
+    // Slightly more optimal if v1 is the larger operand.
+    PutLongerFirst(v1, v2);
+
+    // Result (worst case is sum of operand lengths)
+    std::vector<unsigned char> retvec((v1.m_limbs.size() + v2.m_limbs.size()) * sizeof(uint64_t));
+    Val64 ret(std::move(retvec));
+
+    // Result of each v1[] * v2.
+    std::vector<le64_t> scratch(v2.m_limbs.size() + 1);
+
+    size_t ret_nonzero_len = 0;
+
+    for (size_t i = 0; i < v1.m_limbs.size(); ++i) {
+        size_t nonzero_len;
+        // Multiply v2 by v1[i] into scratch.
+        MultiplySpan(scratch, v2.m_limbs, v1.Get(i));
+
+        // Now add into result at offset i.
+        // Cannot overflow.  Worst case ret effectively adds 1 to v1[i],
+        // which *still* doesn't quite overflow.
+        const bool carry{AddSpans(ret.m_limbs.subspan(i, v2.m_limbs.size() + 1),
+                                  scratch, nonzero_len)};
+        assert(!carry);
+        if (nonzero_len != 0) ret_nonzero_len = i + nonzero_len;
+    }
+
+    ret.TrimTail(ret_nonzero_len);
+    return ret;
+}
+
+// False iff v2 is 0.
+bool Val64::DivMod(Val64& v1, Val64& v2, DivModOp op)
+{
+    // This is BasecaseDivRem from "Modern Computer Arithmetic" by Richard
+    // Brent and Paul Zimmerman.  I discovered later that this is the same as
+    // Knuth's TAOCP v2 (of course!) page 272, Algorithm D "Division of
+    // non-negative integers".
+
+    // For efficiency, the divisor (v2) needs to be *normalized*, i.e.
+    // the top bit is set.  We trim and shift both to ensure this is true.
+
+    // This does not add cost because any
+    // bytes trimmed here (cost == number of bytes trimmed + 1) saves
+    // costs below.
+    v1.TrimTail();
+    v2.TrimTail();
+
+    // Now there's only one canonical zero.
+    if (v2.m_size == 0) return false;
+
+    // How many bits do we have to shift to get top bit set?
+    const size_t k{static_cast<size_t>(std::countl_zero(v2.Get(v2.m_limbs.size() - 1)))};
+
+    if (v1.m_size < v2.m_size) {
+        // v2 > v1: v1 is remainder, quotient is 0.
+        if (op == DivModOp::DIV) v1 = Val64{0};
+        return true;
+    }
+
+    // These might have to reallocate, but by no more than 8 bytes.
+    // In theory, we could save this cost by doing shifting as we go.
+    // But this shift isn't really the main overhead, so keep it simple.
+    if (k != 0) {
+        uint64_t varcost{0};
+        // Val64(k) makes a one-limb temporary and varcost is discarded; both
+        // are fine: this runs once per division and OP_DIV/OP_MOD pre-charge
+        // their full cost.
+        // k is at most 63, and max_size reserves one extra limb for normalization.
+        const bool shifted{OpUpShift(v1, Val64(k), v1.m_size + sizeof(uint64_t), varcost)};
+        assert(shifted);
+        const bool overflow{v2.ShiftLeftLessThanWord(k)};
+        assert(!overflow);
+    }
+
+    // Shift can add a few zero bytes, re-normalize.
+    v1.TrimTail();
+    v2.TrimTail();
+
+    // v1 has n+m words, v2 has n words.  β is the base (2^64 here).
+    assert(v1.m_limbs.size() >= v2.m_limbs.size());
+    const size_t n{v2.m_limbs.size()};
+    const size_t m{v1.m_limbs.size() - n};
+
+    // If we need quotient, create empty q vec, worst-case len.
+    Val64 q;
+    if (op == DivModOp::DIV) {
+        std::vector<unsigned char> qvec((m + 1) * sizeof(uint64_t));
+        q.MoveFromValtype(std::move(qvec));
+    }
+
+    // 1: if v1 >= β^m x v2, then q_m = 1, v1 = v1 - β^m x v2 else q_m = 0
+    if (CompareSpans(v1.m_limbs.subspan(m), v2.m_limbs) > -1) {
+        size_t last_nonzero;
+        if (op == DivModOp::DIV) q.Set(m, 1);
+        const bool carry{SubtractSpans(v1.m_limbs.subspan(m), v2.m_limbs, last_nonzero)};
+        assert(!carry);
+    } else {
+        if (op == DivModOp::DIV) q.Set(m, 0);
+    }
+
+    // We need a temporary, but we overwrite it all, so create outside loop.
+    std::vector<le64_t> scratch(v2.m_limbs.size() + 1);
+
+    // 2: for j from m-1 downto 0 do:
+    for (size_t j = m; j > 0;) {
+        --j;
+
+        // 3: q* = floor((v1_n+j_ x β + v1_n+j-1_) / v2_n-1_)
+        const uint64_t v_hi{v1.Get(n + j)};
+        const uint64_t v_lo{v1.Get(n + j - 1)};
+        const uint64_t divisor{v2.Get(n - 1)};
+        const Div64Result div64{Uint128{v_hi, v_lo}.DivMod64(divisor, m_force_portable_math)};
+        uint64_t qstar{div64.quotient};
+        uint64_t rstar{div64.remainder};
+        bool qstar_is_beta{div64.quotient_is_beta};
+        bool rstar_overflow{false};
+        if (qstar_is_beta) assert(n > 1);
+
+        // Knuth suggests: test if q* == β, or
+        // q* x v2_n-2_ > βr* + v1_n+j-2_.  If so, decrease q* by 1,
+        // increase r* by v2_n-1_, and repeat if r* did not overflow β.
+        if (n > 1) {
+            const uint64_t v2_n2{v2.Get(n - 2)};
+            const uint64_t v1_nj2{v1.Get(n + j - 2)};
+            const uint64_t divisor{v2.Get(n - 1)};
+
+            auto product_greater_than_remainder = [&]() {
+                const Uint128 product{Uint128::Mul(qstar, v2_n2, m_force_portable_math)};
+                return product.hi > rstar || (product.hi == rstar && product.lo > v1_nj2);
+            };
+
+            while (qstar_is_beta || (!rstar_overflow && product_greater_than_remainder())) {
+                if (qstar_is_beta) {
+                    qstar_is_beta = false;
+                } else {
+                    --qstar;
+                }
+
+                rstar_overflow = AddOverflow(rstar, divisor, rstar);
+            }
+        }
+
+        // This is our (64-bit) guess.
+        uint64_t qj = qstar;
+
+        // D4: v1 = v1 - q_j_ x β^j x v2
+
+        // Assign scratch = q_j_ x v2
+        // Note: v2 doesn't change in this loop, so scratch gets fully
+        // overwritten each time, meaning we don't need to zero it.
+        MultiplySpan(scratch, v2.m_limbs, qj);
+
+        bool underflow;
+        size_t last_nonzero;
+        underflow = SubtractSpans(v1.m_limbs.subspan(j), scratch, last_nonzero);
+        // D5: Set q_j_ = q*.  If the result of D4 was negative, go to D6.
+        if (underflow) {
+            // D6: Decrease q_j_ by 1, and add β^j x v2 to v1
+
+            // Intuitively: we've got an estimate on v1/v2, using division on
+            // the high words, plus a compensation from the next-highest.  It
+            // could be an overestimate by one, however!  This path is covered
+            // by the val64_div_mod_knuth_d6_add_back regression test.
+            --qj;
+            size_t nonzero_len;
+            const bool carry{AddSpans(v1.m_limbs.subspan(j), v2.m_limbs, nonzero_len)};
+            assert(carry);
+        }
+
+        // Keep shrinking v1.  Note: we could use the sub/add_with_offset
+        // return to trim a bit faster if we wanted.
+        if (!v1.m_limbs.empty()) {
+            assert(v1.Get(v1.m_limbs.size() - 1) == 0);
+            v1.Truncate((v1.m_limbs.size() - 1) * sizeof(uint64_t));
+        }
+
+        if (op == DivModOp::DIV) q.Set(j, qj);
+    }
+
+    switch (op) {
+    case DivModOp::MOD:
+        // Remainder needs shifting back (quotient is unaffected, since
+        // (A * N) / (B * N) == A / B).
+        if (k != 0 && v1.m_size != 0) v1.ShiftDown(0, k);
+        v1.TrimTail();
+        return true;
+    case DivModOp::DIV:
+        v1 = std::move(q);
+        v1.TrimTail();
+        return true;
+    }
+    assert(!"Invalid op");
+}
+
+bool Val64::OpDiv(Val64& v1, Val64& v2)
+{
+    return DivMod(v1, v2, DivModOp::DIV);
+}
+
+bool Val64::OpMod(Val64& v1, Val64& v2)
+{
+    return DivMod(v1, v2, DivModOp::MOD);
+}
diff --git a/src/script/val64.h b/src/script/val64.h
new file mode 100644
index 000000000000..50ade8fcfc98
--- /dev/null
+++ b/src/script/val64.h
@@ -0,0 +1,199 @@
+// Copyright (c) 2025 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+#ifndef BITCOIN_SCRIPT_VAL64_H
+#define BITCOIN_SCRIPT_VAL64_H
+
+#include <compat/endian.h>
+
+#include <cstddef>
+#include <cstdint>
+#include <span>
+#include <vector>
+
+/**
+ * Arbitrary-length unsigned Script value for BIP 441 arithmetic and bit
+ * operations, backed by little-endian 64-bit limbs.
+ *
+ * Logical bytes start at LimbOffset() inside m_bytes. Bytes outside the
+ * logical range are representation padding and must remain zero.
+ */
+class Val64
+{
+protected:
+    // Convenience typedef for clarity, where dealing with little-endian.
+    typedef uint64_t le64_t;
+
+    // Byte storage for the value plus possible alignment padding.
+    std::vector<unsigned char> m_bytes;
+
+    // Number of logical value bytes starting at LimbOffset().
+    size_t m_size{0};
+
+    // Little-endian uint64_t span over the logical bytes and zero padding.
+    std::span<le64_t> m_limbs{};
+
+    // Rebuild the limb view after m_bytes changes.
+    void SetSpan();
+
+    // Remove alignment and trailing padding before changing m_bytes.
+    void PrepareForByteMutation();
+
+    // Byte offset of the first logical limb within m_bytes.
+    size_t LimbOffset() const;
+
+#ifdef DEBUG
+    void CheckInvariants() const;
+#endif
+
+    // Append a 1 byte to the value for carry.
+    void AppendOne();
+
+    // Remove this many bytes from the front.
+    void RemoveFront(size_t bytes);
+
+    // Prepend this many zero bytes to the front.
+    void PrependZeros(size_t prebytes);
+
+    // Trim to this length.
+    void Truncate(size_t new_size);
+
+public:
+    Val64() = default;
+    explicit Val64(std::vector<unsigned char>&& bytes);
+
+    // Make a minimal Val64 from a uint64_t.
+    explicit Val64(uint64_t value);
+
+    Val64(Val64&& other) noexcept;
+    Val64& operator=(Val64&& other) noexcept;
+
+    void MoveFromValtype(std::vector<unsigned char>&& bytes);
+
+    // Convert to a valtype and clear this value.
+    std::vector<unsigned char> MoveToValtype();
+
+    // Trim trailing zero bytes so serialization is minimal.
+    void TrimTrailingZeros();
+
+    // Byte size of the value.
+    size_t size() const { return m_size; }
+
+    // Unmetered helpers; consensus callers must charge separately.
+    bool IsZero() const;
+    int Compare(const Val64& other) const;
+
+    // Convert to uint64_t, returning max if the value is larger.
+    uint64_t ToU64Ceil(uint64_t max, uint64_t& varcost) const;
+
+    // Return whether this value is zero.
+    bool IsZero(uint64_t& varcost) const;
+
+    // Return -1 if this < other, 0 if equal, and 1 if this > other.
+    int Compare(const Val64& other, uint64_t& varcost) const;
+
+    // Explicit opcode names distinguish these consensus-constrained operations
+    // from generic arithmetic.
+    static void OpAdd(Val64& v1, Val64& v2, uint64_t& varcost);
+    static void Op1Add(Val64& v1, uint64_t& varcost);
+
+    // Return false and leave v1 unspecified if v1 < v2.
+    // Otherwise set v1 to v1 - v2 and return true.
+    static bool OpSub(Val64& v1, const Val64& v2, uint64_t& varcost);
+    static bool Op1Sub(Val64& v1, uint64_t& varcost);
+
+    // Returns false if v1 would exceed max_size.
+    static bool OpUpShift(Val64& v1, const Val64& v2, size_t max_size, uint64_t& varcost);
+    static void OpDownShift(Val64& v1, const Val64& v2, uint64_t& varcost);
+
+    // Shift by one bit and normalize the result.
+    static void Op2Mul(Val64& v1, uint64_t& varcost);
+    static void Op2Div(Val64& v1, uint64_t& varcost);
+
+    static void OpInvert(Val64& v1, uint64_t& varcost);
+
+    static void OpAnd(Val64& v1, Val64& v2, uint64_t& varcost);
+    static void OpOr(Val64& v1, Val64& v2, uint64_t& varcost);
+    static void OpXor(Val64& v1, Val64& v2, uint64_t& varcost);
+
+    static void OpMin(Val64& v1, Val64& v2, uint64_t& varcost);
+    static void OpMax(Val64& v1, Val64& v2, uint64_t& varcost);
+
+    // Operands may be swapped for efficiency.
+    static Val64 OpMul(Val64& v1, Val64& v2);
+
+    // Returns false if v2 is 0.
+    static bool OpDiv(Val64& v1, Val64& v2);
+    static bool OpMod(Val64& v1, Val64& v2);
+
+protected:
+    // Copy constructor, useful for tests.
+    Val64(const Val64&);
+
+    // Swap with the other value.
+    void Swap(Val64& other) noexcept;
+
+    // Endian conversion helpers.
+    void Set(size_t index, uint64_t value)
+    {
+        m_limbs[index] = htole64_internal(value);
+    }
+
+    uint64_t Get(size_t index) const
+    {
+        return le64toh_internal(m_limbs[index]);
+    }
+
+    // If it's past the end, return 0.
+    uint64_t GetOrZero(size_t index) const;
+
+    // We've treated this as a u64 array, now trim trailing zero bytes.
+    void TrimTail();
+
+    // Fast version, if we know some zeros already.
+    void TrimTail(size_t nonzero_len);
+
+    // Swap v1 and v2 so v1 is always longer or same size than v2.
+    static void PutLongerFirst(Val64& v1, Val64& v2);
+
+    // Right shift by this many words, and this many bits (1-63 incl).
+    void ShiftDown(size_t words, size_t bits);
+
+    // Left shift in place by less than one word (1-63 bits inclusive).
+    // Return true iff we had overflow.
+    bool ShiftLeftLessThanWord(size_t bits);
+
+    // False if any non-zero bytes in span.
+    static bool SpanIsAllZero(std::span<const le64_t> span);
+
+    static int CompareSpans(std::span<const le64_t> v1, std::span<const le64_t> v2);
+
+    // v1 += v2, return carry.  v1.size() >= v2.size().
+    // If returns false, nonzero_len is one past the last non-zero u64 in v1
+    // (which helps optimize TrimTail)
+    static bool AddSpans(std::span<le64_t> v1, std::span<const le64_t> v2, size_t& nonzero_len);
+
+    // v1 -= v2, returns underflow.
+    // If returns false, nonzero_len is one past the last non-zero u64 in v1
+    // (which helps optimize TrimTail)
+    static bool SubtractSpans(std::span<le64_t> v1, std::span<const le64_t> v2, size_t& nonzero_len);
+
+    // res = src * mul
+    static void MultiplySpan(std::span<le64_t> res,
+                             std::span<const le64_t> src,
+                             uint64_t mul);
+
+    enum class DivModOp {
+        DIV,
+        MOD,
+    };
+
+    // Div: v1 = v1 / v2.  Mod: v1 = v1 % v2.  False if v2 is zero.
+    static bool DivMod(Val64& v1, Val64& v2, DivModOp op);
+
+    // Test helpers
+    static bool m_force_offset_span;
+    static bool m_force_portable_math;
+};
+
+#endif // BITCOIN_SCRIPT_VAL64_H
diff --git a/src/script/valtype_stack.cpp b/src/script/valtype_stack.cpp
new file mode 100644
index 000000000000..c0b21266ca72
--- /dev/null
+++ b/src/script/valtype_stack.cpp
@@ -0,0 +1,148 @@
+// Copyright (c) 2025 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <script/valtype_stack.h>
+
+#include <algorithm>
+#include <cassert>
+#include <cstddef>
+#include <cstdint>
+#include <stdexcept>
+#include <utility>
+
+ValtypeStack::ValtypeStack(Span<const valtype> plain_stack) : m_stack(plain_stack.begin(), plain_stack.end())
+{
+    RecalculateSizeTracking();
+}
+
+ValtypeStack::ValtypeStack(ValtypeStack&& other) noexcept
+    : m_stack{std::move(other.m_stack)},
+      m_total_size{other.m_total_size},
+      m_max_element_size{other.m_max_element_size}
+{
+    other.m_stack.clear();
+    other.m_total_size = 0;
+    other.m_max_element_size = 0;
+}
+
+ValtypeStack& ValtypeStack::operator=(ValtypeStack&& other) noexcept
+{
+    if (this == &other) return *this;
+
+    m_stack = std::move(other.m_stack);
+    m_total_size = other.m_total_size;
+    m_max_element_size = other.m_max_element_size;
+
+    other.m_stack.clear();
+    other.m_total_size = 0;
+    other.m_max_element_size = 0;
+    return *this;
+}
+
+void ValtypeStack::push_back(const valtype& element)
+{
+    constexpr size_t WORD_BYTES{sizeof(uint64_t)};
+    const size_t capacity{element.size() + (WORD_BYTES - element.size() % WORD_BYTES) % WORD_BYTES};
+
+    // Reserve on the element in its final container so Val64's padding capacity
+    // is guaranteed to survive the copy.
+    m_stack.emplace_back();
+    m_stack.back().reserve(capacity);
+    m_stack.back().insert(m_stack.back().end(), element.begin(), element.end());
+    TrackAddedElement(m_stack.back());
+}
+
+void ValtypeStack::push_back(valtype&& element)
+{
+    m_stack.push_back(std::move(element));
+    TrackAddedElement(m_stack.back());
+}
+
+void ValtypeStack::pop_back()
+{
+    if (m_stack.empty()) {
+        throw std::runtime_error("ValtypeStack::pop_back(): stack empty");
+    }
+    TrackRemovedElement(m_stack.back());
+    m_stack.pop_back();
+}
+
+valtype ValtypeStack::PopBackValue()
+{
+    if (m_stack.empty()) {
+        throw std::runtime_error("ValtypeStack::PopBackValue(): stack empty");
+    }
+    TrackRemovedElement(m_stack.back());
+    valtype result{std::move(m_stack.back())};
+    m_stack.pop_back();
+    return result;
+}
+
+bool ValtypeStack::PopVal64(Val64& value)
+{
+    if (m_stack.empty()) return false;
+
+    TrackRemovedElement(m_stack.back());
+    value.MoveFromValtype(std::move(m_stack.back()));
+    m_stack.pop_back();
+    return true;
+}
+
+void ValtypeStack::erase(size_t n)
+{
+    assert(n < m_stack.size());
+    TrackRemovedElement(m_stack[n]);
+    m_stack.erase(m_stack.begin() + n);
+}
+
+void ValtypeStack::reserve(size_t n)
+{
+    m_stack.reserve(n);
+}
+
+void ValtypeStack::Rotate(int first, int middle)
+{
+    assert(first <= middle);
+    assert(middle <= 0);
+    assert(static_cast<size_t>(-static_cast<ptrdiff_t>(first)) <= m_stack.size());
+    std::rotate(m_stack.end() + first, m_stack.end() + middle, m_stack.end());
+}
+
+void ValtypeStack::Roll(size_t depth)
+{
+    assert(depth < m_stack.size());
+    const size_t index{m_stack.size() - depth - 1};
+    valtype element{std::move(m_stack[index])};
+    m_stack.erase(m_stack.begin() + index);
+    m_stack.push_back(std::move(element));
+}
+
+void ValtypeStack::Swap(int first, int second)
+{
+    const auto index_from_top{[this](int offset) {
+        return static_cast<size_t>(static_cast<ptrdiff_t>(m_stack.size()) + offset);
+    }};
+    std::swap(m_stack.at(index_from_top(first)), m_stack.at(index_from_top(second)));
+}
+
+void ValtypeStack::TrackAddedElement(const valtype& element)
+{
+    m_total_size += element.size();
+    m_max_element_size = std::max(m_max_element_size, element.size());
+}
+
+void ValtypeStack::TrackRemovedElement(const valtype& element)
+{
+    assert(m_total_size >= element.size());
+    m_total_size -= element.size();
+}
+
+void ValtypeStack::RecalculateSizeTracking()
+{
+    m_total_size = 0;
+    m_max_element_size = 0;
+    for (const valtype& element : m_stack) {
+        TrackAddedElement(element);
+    }
+}
diff --git a/src/script/valtype_stack.h b/src/script/valtype_stack.h
new file mode 100644
index 000000000000..a643805b4046
--- /dev/null
+++ b/src/script/valtype_stack.h
@@ -0,0 +1,65 @@
+// Copyright (c) 2025 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+#ifndef BITCOIN_SCRIPT_VALTYPE_STACK_H
+#define BITCOIN_SCRIPT_VALTYPE_STACK_H
+
+#include <script/val64.h>
+#include <span.h>
+
+#include <cstddef>
+#include <vector>
+
+using valtype = std::vector<unsigned char>;
+
+/**
+ * Script stack wrapper that tracks the current total element size and the
+ * largest element size seen during execution.
+ */
+class ValtypeStack
+{
+public:
+    ValtypeStack() = default;
+    explicit ValtypeStack(Span<const valtype> plain_stack);
+
+    ValtypeStack(const ValtypeStack&) = delete;
+    ValtypeStack& operator=(const ValtypeStack&) = delete;
+
+    ValtypeStack(ValtypeStack&& other) noexcept;
+    ValtypeStack& operator=(ValtypeStack&& other) noexcept;
+
+    // Element access is const-only so size tracking cannot be invalidated.
+    const valtype& at(size_t n) const { return m_stack.at(n); }
+    const valtype& back() const { return m_stack.back(); }
+    size_t size() const { return m_stack.size(); }
+
+    const std::vector<valtype>& GetStack() const { return m_stack; }
+    size_t GetTotalSize() const { return m_total_size; }
+    size_t GetMaxElementSize() const { return m_max_element_size; }
+
+    void push_back(const valtype& element);
+    void push_back(valtype&& element);
+    void pop_back();
+    valtype PopBackValue();
+    bool PopVal64(Val64& value);
+
+    void erase(size_t n);
+
+    void reserve(size_t n);
+
+    void Rotate(int first, int middle);
+    void Roll(size_t depth);
+    void Swap(int first, int second);
+
+private:
+    std::vector<valtype> m_stack;
+    size_t m_total_size{0};
+    // High-water mark; deliberately not reduced when elements are removed.
+    size_t m_max_element_size{0};
+
+    void TrackAddedElement(const valtype& element);
+    void TrackRemovedElement(const valtype& element);
+    void RecalculateSizeTracking();
+};
+
+#endif // BITCOIN_SCRIPT_VALTYPE_STACK_H
diff --git a/src/script/varops.h b/src/script/varops.h
new file mode 100644
index 000000000000..790c972e5728
--- /dev/null
+++ b/src/script/varops.h
@@ -0,0 +1,245 @@
+// Copyright (c) 2026 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or https://www.opensource.org/licenses/mit-license.php.
+#ifndef BITCOIN_SCRIPT_VAROPS_H
+#define BITCOIN_SCRIPT_VAROPS_H
+
+#include <script/script.h>
+#include <util/check.h>
+
+#include <algorithm>
+#include <atomic>
+#include <cstddef>
+#include <cstdint>
+#include <limits>
+#include <optional>
+
+namespace varops {
+
+/** Thread-safe varops budget shared by script checks for one transaction. */
+class Budget final
+{
+private:
+    /** std::nullopt represents evaluation without varops metering. */
+    std::optional<std::atomic<uint64_t>> m_remaining;
+
+    Budget() = default;
+
+public:
+    explicit Budget(uint64_t remaining) : m_remaining{std::in_place, remaining} {}
+
+    /** Use when standalone evaluation lacks transaction-wide budget context. */
+    static Budget Unmetered() { return {}; }
+
+    /** Return true if cost was charged; false if the bounded budget was exhausted. */
+    [[nodiscard]] bool Spend(uint64_t cost)
+    {
+        if (!m_remaining || cost == 0) return true;
+        // Only the counter value is synchronized; it does not publish other state.
+        uint64_t remaining{m_remaining->load(std::memory_order_relaxed)};
+        while (true) {
+            if (cost > remaining) return false;
+            if (m_remaining->compare_exchange_weak(remaining, remaining - cost,
+                                                   std::memory_order_relaxed,
+                                                   std::memory_order_relaxed)) {
+                return true;
+            }
+        }
+    }
+
+    std::optional<uint64_t> Remaining() const
+    {
+        if (!m_remaining) return std::nullopt;
+        return m_remaining->load(std::memory_order_relaxed);
+    }
+};
+
+// Varops cost categories per byte:
+// Fast operations: comparing bytes, comparing bytes against zero, and zeroing bytes
+static constexpr uint64_t COST_FAST = 2;
+// Copying bytes: slightly more expensive than fast operations due to memory allocation overhead
+static constexpr uint64_t COST_COPYING = 3;
+// Everything else
+static constexpr uint64_t COST_OTHER = 4;
+// Arithmetic operations (add/subtract inner loop)
+static constexpr uint64_t COST_ARITH = 6;
+// Multiplication quadratic term: inner loop cost with overhead multiplier
+static constexpr uint64_t COST_MUL_QUAD = 27;
+// OP_ROLL: per stack element moved (24 bytes per std::vector * COST_FAST)
+static constexpr uint64_t COST_ROLL = 48;
+// Hashing operations
+static constexpr uint64_t COST_HASH = 50;
+
+// A per-transaction budget is determined by multiplying the
+// total transaction weight by the fixed factor 10,000.
+static constexpr uint64_t BUDGET_PER_WEIGHT_UNIT = 10'000;
+
+inline constexpr uint64_t TxBudget(int64_t weight)
+{
+    Assume(weight >= 0);
+    return static_cast<uint64_t>(weight) * BUDGET_PER_WEIGHT_UNIT;
+}
+
+// BIP 440: Signature operations cost BUDGET_PER_WEIGHT_UNIT * VALIDATION_WEIGHT_PER_SIGOP_PASSED
+// (10,000 * 50 = 500,000 varops units).
+static constexpr uint64_t COST_PER_SIGOP = BUDGET_PER_WEIGHT_UNIT * VALIDATION_WEIGHT_PER_SIGOP_PASSED;
+
+namespace detail {
+
+constexpr uint64_t ToCostSize(size_t size)
+{
+    return static_cast<uint64_t>(size);
+}
+
+constexpr uint64_t WordSize(size_t size)
+{
+    const uint64_t s{ToCostSize(size)};
+    return (s + 7) / 8 * 8;
+}
+
+constexpr uint64_t MaxWordSize(size_t size1, size_t size2)
+{
+    return std::max(WordSize(size1), WordSize(size2));
+}
+
+constexpr uint64_t MinWordSize(size_t size1, size_t size2)
+{
+    return std::min(WordSize(size1), WordSize(size2));
+}
+
+// BIP 441 costs are maximal when every operand has the maximum permitted size.
+constexpr uint64_t MAX_COST_SIZE{MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE};
+constexpr uint64_t MAX_U64{std::numeric_limits<uint64_t>::max()};
+constexpr uint64_t MAX_COST_WORD_SIZE{WordSize(MAX_COST_SIZE)};
+constexpr uint64_t MAX_MUL_COPY_COST{2 * MAX_COST_SIZE * COST_COPYING};
+constexpr uint64_t MAX_DIV_SQUARE{MAX_COST_WORD_SIZE * MAX_COST_WORD_SIZE};
+constexpr uint64_t MAX_DIV_QUADRATIC{MAX_DIV_SQUARE * 2 / 3};
+
+// These bounds prove that every intermediate in the maximum-size BIP 441 cost
+// expressions fits in uint64_t, not merely each final result.
+static_assert(MAX_COST_SIZE <= MAX_U64 - 7);
+static_assert(MAX_COST_SIZE <= MAX_U64 / (2 * COST_COPYING));
+static_assert(MAX_COST_WORD_SIZE / 8 <=
+                  (MAX_U64 - MAX_MUL_COPY_COST) / COST_MUL_QUAD / MAX_COST_WORD_SIZE,
+              "maximum OP_MUL cost must fit in uint64_t");
+static_assert(MAX_COST_WORD_SIZE <= MAX_U64 / MAX_COST_WORD_SIZE);
+static_assert(MAX_DIV_SQUARE <= MAX_U64 / 2);
+static_assert(MAX_COST_WORD_SIZE <=
+                  (MAX_U64 - MAX_DIV_QUADRATIC) / (3 * COST_ARITH + COST_OTHER),
+              "maximum OP_DIV and OP_MOD cost must fit in uint64_t");
+
+} // namespace detail
+
+/** Pure cost calculations taking operand sizes in bytes. */
+constexpr uint64_t LengthConversionCost(size_t size)
+{
+    return detail::WordSize(size) * COST_FAST;
+}
+
+constexpr uint64_t CompareZeroCost(size_t size)
+{
+    return detail::WordSize(size) * COST_FAST;
+}
+
+constexpr uint64_t ComparisonCost(size_t size1, size_t size2)
+{
+    return detail::MaxWordSize(size1, size2) * COST_FAST;
+}
+
+constexpr uint64_t AddCost(size_t size1, size_t size2)
+{
+    return detail::MaxWordSize(size1, size2) * (COST_ARITH + COST_COPYING);
+}
+
+constexpr uint64_t SubCost(size_t size1, size_t size2)
+{
+    return detail::MaxWordSize(size1, size2) * COST_ARITH;
+}
+
+constexpr uint64_t MulCost(size_t size1, size_t size2)
+{
+    const uint64_t copy_cost{(detail::ToCostSize(size1) + detail::ToCostSize(size2)) * COST_COPYING};
+    const uint64_t quadratic_cost{detail::WordSize(size1) / 8 * detail::WordSize(size2) * COST_MUL_QUAD};
+    return copy_cost + quadratic_cost;
+}
+
+constexpr uint64_t DivCost(size_t size1, size_t size2)
+{
+    const uint64_t s1{detail::WordSize(size1)};
+    const uint64_t s2{detail::WordSize(size2)};
+    const uint64_t linear_cost{s1 * (3 * COST_ARITH) + s2 * COST_OTHER};
+    const uint64_t quadratic_cost{s1 * s1 * 2 / 3};
+    return linear_cost + quadratic_cost;
+}
+
+constexpr uint64_t ModCost(size_t size1, size_t size2)
+{
+    // OP_MOD uses the same division algorithm and cost model as OP_DIV.
+    return DivCost(size1, size2);
+}
+
+constexpr uint64_t BoolAndCost(size_t size1, size_t size2)
+{
+    return (detail::WordSize(size1) + detail::WordSize(size2)) * COST_FAST; // COMPARINGZERO both operands
+}
+
+constexpr uint64_t BoolOrCost(size_t size1, size_t size2)
+{
+    return (detail::WordSize(size1) + detail::WordSize(size2)) * COST_FAST; // COMPARINGZERO both operands
+}
+
+constexpr uint64_t WithinCost(size_t size1, size_t size2, size_t size3)
+{
+    // Two comparisons: v1 vs v2, v1 vs v3
+    return detail::MaxWordSize(size1, size2) * COST_FAST + detail::MaxWordSize(size1, size3) * COST_FAST;
+}
+
+constexpr uint64_t InvertCost(size_t size)
+{
+    return detail::WordSize(size) * COST_OTHER;
+}
+
+constexpr uint64_t AndCost(size_t size1, size_t size2)
+{
+    // min * COST_OTHER + (max - min) * COST_FAST simplifies to this expression.
+    return (detail::WordSize(size1) + detail::WordSize(size2)) * COST_FAST;
+}
+
+constexpr uint64_t OrCost(size_t size1, size_t size2)
+{
+    return detail::MinWordSize(size1, size2) * COST_OTHER;
+}
+
+constexpr uint64_t XorCost(size_t size1, size_t size2)
+{
+    return detail::MinWordSize(size1, size2) * COST_OTHER;
+}
+
+constexpr uint64_t MinMaxCost(size_t size1, size_t size2)
+{
+    return detail::MaxWordSize(size1, size2) * COST_OTHER;
+}
+
+constexpr uint64_t TwoMulCost(size_t size)
+{
+    return detail::WordSize(size) * (COST_COPYING + COST_OTHER);
+}
+
+constexpr uint64_t TwoDivCost(size_t size)
+{
+    return detail::WordSize(size) * COST_OTHER;
+}
+
+constexpr uint64_t UnalignedUpShiftCost(size_t size, size_t prepended_bytes)
+{
+    return detail::WordSize(detail::ToCostSize(size) + detail::ToCostSize(prepended_bytes)) * COST_OTHER;
+}
+
+constexpr uint64_t ChecksigAddIncrementCost(size_t number_size)
+{
+    return std::max(detail::WordSize(1), detail::WordSize(number_size)) * (COST_ARITH + COST_COPYING);
+}
+
+} // namespace varops
+
+#endif // BITCOIN_SCRIPT_VAROPS_H
diff --git a/src/test/CMakeLists.txt b/src/test/CMakeLists.txt
index 682e23fde873..a112f491b73f 100644
--- a/src/test/CMakeLists.txt
+++ b/src/test/CMakeLists.txt
@@ -101,6 +101,8 @@ add_executable(test_bitcoin
   streams_tests.cpp
   sync_tests.cpp
   system_tests.cpp
+  tapscript_v2_json_tests.cpp
+  tapscript_v2_tests.cpp
   timeoffsets_tests.cpp
   torcontrol_tests.cpp
   transaction_tests.cpp
@@ -117,12 +119,16 @@ add_executable(test_bitcoin
   util_tests.cpp
   util_threadnames_tests.cpp
   util_trace_tests.cpp
+  val64_internal_tests.cpp
+  val64_semantics_tests.cpp
   validation_block_tests.cpp
   validation_chainstate_tests.cpp
   validation_chainstatemanager_tests.cpp
   validation_flush_tests.cpp
   validation_tests.cpp
   validationinterface_tests.cpp
+  valtype_stack_tests.cpp
+  varops_tests.cpp
 )
 
 include(TargetDataSources)
@@ -137,8 +143,11 @@ target_json_data_sources(test_bitcoin
   data/key_io_valid.json
   data/script_tests.json
   data/sighash.json
+  data/tapscript_v2_restored_ops.json
+  data/tapscript_v2_varops.json
   data/tx_invalid.json
   data/tx_valid.json
+  data/val64_conversion.json
 )
 target_raw_data_sources(test_bitcoin NAMESPACE test::data
   data/asmap.raw
diff --git a/src/test/data/tapscript_v2_restored_ops.json b/src/test/data/tapscript_v2_restored_ops.json
new file mode 100644
index 000000000000..527dd364f626
--- /dev/null
+++ b/src/test/data/tapscript_v2_restored_ops.json
@@ -0,0 +1,216 @@
+[
+  {
+    "category": "OP_LEFT and OP_RIGHT tests",
+    "tests": [
+      {"name":"OP_LEFT - basic functionality","initial stack":["68656C6C6F","03"],"opcodes":["OP_LEFT"],"final stack":["68656C"],"varops cost":16,"description":"LENGTHCONV: W(len(OFFSET)=1)*2 = 8*2 = 16"},
+      {"name":"OP_RIGHT - basic functionality","initial stack":["68656C6C6F","02"],"opcodes":["OP_RIGHT"],"final stack":["6C6F"],"varops cost":22,"description":"LENGTHCONV + COPYING: W(len(OFFSET)=1)*2 + min(value(OFFSET)=2, len(A)=5)*3 = 8*2 + 2*3 = 22"},
+      {"name":"OP_LEFT with zero offset","initial stack":["74657374",""],"opcodes":["OP_LEFT"],"final stack":[""],"varops cost":0,"description":"LENGTHCONV: W(len(OFFSET)=0)*2 = 0*2 = 0"},
+      {"name":"OP_RIGHT with zero offset","initial stack":["74657374",""],"opcodes":["OP_RIGHT"],"final stack":[""],"varops cost":0,"description":"LENGTHCONV + COPYING: W(len(OFFSET)=0)*2 + min(value(OFFSET)=0, len(A)=4)*3 = 0*2 + 0*3 = 0"},
+      {"name":"OP_LEFT with offset equal to string length","initial stack":["616263","03"],"opcodes":["OP_LEFT"],"final stack":["616263"],"varops cost":16,"description":"LENGTHCONV: W(len(OFFSET)=1)*2 = 8*2 = 16"},
+      {"name":"OP_RIGHT with offset equal to string length","initial stack":["616263","03"],"opcodes":["OP_RIGHT"],"final stack":["616263"],"varops cost":25,"description":"LENGTHCONV + COPYING: W(len(OFFSET)=1)*2 + min(value(OFFSET)=3, len(A)=3)*3 = 8*2 + 3*3 = 25"},
+      {"name":"OP_LEFT with offset greater than string length","initial stack":["6869","0A"],"opcodes":["OP_LEFT"],"final stack":["6869"],"varops cost":16,"description":"LENGTHCONV: W(len(OFFSET)=1)*2 = 8*2 = 16"},
+      {"name":"OP_RIGHT with offset greater than string length","initial stack":["6869","0A"],"opcodes":["OP_RIGHT"],"final stack":["6869"],"varops cost":22,"description":"LENGTHCONV + COPYING: W(len(OFFSET)=1)*2 + min(value(OFFSET)=10, len(A)=2)*3 = 8*2 + 2*3 = 22"}
+    ]
+  },
+  {
+    "category": "OP_CAT tests",
+    "tests": [
+      {"name":"OP_CAT - basic concatenation","initial stack":["616263","646566"],"opcodes":["OP_CAT"],"final stack":["616263646566"],"varops cost":18,"description":"COPYING: len(A) + len(B) = 3 + 3 = 6"},
+      {"name":"OP_CAT with empty first operand","initial stack":["","68656C6C6F"],"opcodes":["OP_CAT"],"final stack":["68656C6C6F"],"varops cost":15,"description":"COPYING: len(A) + len(B) = 0 + 5 = 5"},
+      {"name":"OP_CAT with empty second operand","initial stack":["74657374",""],"opcodes":["OP_CAT"],"final stack":["74657374"],"varops cost":12,"description":"COPYING: len(A) + len(B) = 4 + 0 = 4"},
+      {"name":"OP_CAT with both operands empty","initial stack":["",""],"opcodes":["OP_CAT"],"final stack":[""],"varops cost":0,"description":"COPYING: len(A) + len(B) = 0 + 0 = 0"},
+      {"name":"OP_CAT at the size limit should succeed","initial stack":["CC{2000000}","DD{2000000}"],"opcodes":["OP_CAT"],"final stack":["CC{2000000}DD{2000000}"],"varops cost":12000000,"description":"COPYING: len(A) + len(B) = 2000000 + 2000000 = 4000000"}
+    ]
+  },
+  {
+    "category": "OP_SUBSTR tests",
+    "tests": [
+      {"name":"OP_SUBSTR - basic substring extraction","initial stack":["68656C6C6F","01","03"],"opcodes":["OP_SUBSTR"],"final stack":["656C6C"],"varops cost":41,"description":"LENGTHCONV + COPYING: (W(len(BEGIN)=1) + W(len(LEN)=1))*2 + min(value(LEN)=3, max(len(A)=5 - value(BEGIN)=1, 0))*3 = (8 + 8)*2 + 3*3 = 41"},
+      {"name":"OP_SUBSTR - extract from beginning","initial stack":["74657374","","02"],"opcodes":["OP_SUBSTR"],"final stack":["7465"],"varops cost":22,"description":"LENGTHCONV + COPYING: (W(len(BEGIN)=0) + W(len(LEN)=1))*2 + min(value(LEN)=2, max(len(A)=4 - value(BEGIN)=0, 0))*3 = (0 + 8)*2 + 2*3 = 22"},
+      {"name":"OP_SUBSTR - extract to end","initial stack":["626974636F696E","03","04"],"opcodes":["OP_SUBSTR"],"final stack":["636F696E"],"varops cost":44,"description":"LENGTHCONV + COPYING: (W(len(BEGIN)=1) + W(len(LEN)=1))*2 + min(value(LEN)=4, max(len(A)=7 - value(BEGIN)=3, 0))*3 = (8 + 8)*2 + 4*3 = 44"},
+      {"name":"OP_SUBSTR with zero length","initial stack":["68656C6C6F","02",""],"opcodes":["OP_SUBSTR"],"final stack":[""],"varops cost":16,"description":"LENGTHCONV + COPYING: (W(len(BEGIN)=1) + W(len(LEN)=0))*2 + min(value(LEN)=0, max(len(A)=5 - value(BEGIN)=2, 0))*3 = (8 + 0)*2 + 0*3 = 16"},
+      {"name":"OP_SUBSTR - begin at end of string","initial stack":["616263","03","01"],"opcodes":["OP_SUBSTR"],"final stack":[""],"varops cost":32,"description":"LENGTHCONV + COPYING: (W(len(BEGIN)=1) + W(len(LEN)=1))*2 + min(value(LEN)=1, max(len(A)=3 - value(BEGIN)=3, 0))*3 = (8 + 8)*2 + 0*3 = 32"},
+      {"name":"OP_SUBSTR - begin beyond string length","initial stack":["6869","0A","05"],"opcodes":["OP_SUBSTR"],"final stack":[""],"varops cost":32,"description":"LENGTHCONV + COPYING: (W(len(BEGIN)=1) + W(len(LEN)=1))*2 + min(value(LEN)=5, max(len(A)=2 - value(BEGIN)=10, 0))*3 = (8 + 8)*2 + 0*3 = 32"},
+      {"name":"OP_SUBSTR - length extends beyond string","initial stack":["74657374","02","0A"],"opcodes":["OP_SUBSTR"],"final stack":["7374"],"varops cost":38,"description":"LENGTHCONV + COPYING: (W(len(BEGIN)=1) + W(len(LEN)=1))*2 + min(value(LEN)=10, max(len(A)=4 - value(BEGIN)=2, 0))*3 = (8 + 8)*2 + 2*3 = 38"},
+      {"name":"OP_SUBSTR with empty string","initial stack":["","","01"],"opcodes":["OP_SUBSTR"],"final stack":[""],"varops cost":16,"description":"LENGTHCONV + COPYING: (W(len(BEGIN)=0) + W(len(LEN)=1))*2 + min(value(LEN)=1, max(len(A)=0 - value(BEGIN)=0, 0))*3 = (0 + 8)*2 + 0*3 = 16"}
+    ]
+  },
+  {
+    "category": "OP_INVERT tests",
+    "tests": [
+      {"name":"OP_INVERT - basic bitwise inversion","initial stack":["FF"],"opcodes":["OP_INVERT"],"final stack":["00"],"varops cost":32,"description":"OTHER: W(len(A)=1)*4 = 8*4 = 32"},
+      {"name":"OP_INVERT with empty element","initial stack":[""],"opcodes":["OP_INVERT"],"final stack":[""],"varops cost":0,"description":"OTHER: W(len(A)=0)*4 = 0*4 = 0"},
+      {"name":"OP_INVERT with multi-byte value","initial stack":["FF12"],"opcodes":["OP_INVERT"],"final stack":["00ED"],"varops cost":32,"description":"OTHER: W(len(A)=2)*4 = 8*4 = 32"},
+      {"name":"OP_INVERT with all ones","initial stack":["FFFFFFFFFFFFFFFF"],"opcodes":["OP_INVERT"],"final stack":["0000000000000000"],"varops cost":32,"description":"OTHER: W(len(A)=8)*4 = 8*4 = 32"},
+      {"name":"OP_INVERT with alternating bit pattern","initial stack":["AAAAAAAAAAAAAAAA"],"opcodes":["OP_INVERT"],"final stack":["5555555555555555"],"varops cost":32,"description":"OTHER: W(len(A)=8)*4 = 8*4 = 32"}
+    ]
+  },
+  {
+    "category": "Binary bitwise operations",
+    "tests": [
+      {"name":"OP_AND: 0xFF & 0xF0 = 0xF0","initial stack":["FF","F0"],"opcodes":["OP_AND"],"final stack":["F0"],"varops cost":32,"description":"OTHER + ZEROING: (W(len(A)=1) + W(len(B)=1))*2 = (8 + 8)*2 = 32"},
+      {"name":"OP_OR: 0x0F | 0xF0 = 0xFF","initial stack":["0F","F0"],"opcodes":["OP_OR"],"final stack":["FF"],"varops cost":32,"description":"OTHER: (min(len(A), len(B)) + 7) / 8 * 8 * 4 = (min(1,1)+7)/8*8*4 = 32 (word granularity)"},
+      {"name":"OP_XOR: 0xFF ^ 0x0F = 0xF0","initial stack":["FF","0F"],"opcodes":["OP_XOR"],"final stack":["F0"],"varops cost":32,"description":"OTHER: (min(len(A), len(B)) + 7) / 8 * 8 * 4 = (min(1,1)+7)/8*8*4 = 32 (word granularity)"}
+    ]
+  },
+  {
+    "category": "Stack Manipulation",
+    "tests": [
+      {"name":"OP_ROT: 0x01, 0x02, 0x03, 0x04","initial stack":["0x01","0x02","0x03","0x04"],"opcodes":["OP_ROT"],"final stack":["0x01","0x03","0x04","0x02"],"varops cost":0,"description":""},
+      {"name":"OP_SWAP 0x01, 0x02, 0x03","initial stack":["0x01","0x02","0x03"],"opcodes":["OP_SWAP"],"final stack":["0x01","0x03","0x02"],"varops cost":0},
+      {"name":"OP_SIZE 0x01, 0x02, 0x03","initial stack":["0x01","0x02","0x03"],"opcodes":["OP_SIZE"],"final stack":["0x01","0x02","0x03","0x01"],"varops cost":0,"description":"No variable-length operand processing is charged for this opcode; varops cost = 0"},
+      {"name":"OP_DEPTH 0x01, 0x02, 0x03, 0x04, 0x05","initial stack":["0x01","0x02","0x03","0x04","0x05"],"opcodes":["OP_DEPTH"],"final stack":["0x01","0x02","0x03","0x04","0x05","0x05"],"varops cost":0,"description":"No variable-length operand processing is charged for this opcode; varops cost = 0"}
+    ]
+  },
+  {
+    "category": "OP_DIV tests",
+    "tests": [
+      {"name":"OP_DIV: 10 / 3 = 3","initial stack":["0x0a","0x03"],"opcodes":["OP_DIV"],"final stack":["0x03"],"varops cost":218,"description":"DIV/MOD: W(len(A)=1)*18 + W(len(B)=1)*4 + W(len(A))^2*2/3 = 8*18 + 8*4 + 8^2*2/3 = 218"},
+      {"name":"OP_DIV: 256 / 2 = 128","initial stack":["0x0001","0x02"],"opcodes":["OP_DIV"],"final stack":["0x80"],"varops cost":218,"description":"DIV/MOD: W(len(A)=2)*18 + W(len(B)=1)*4 + W(len(A))^2*2/3 = 8*18 + 8*4 + 8^2*2/3 = 218"},
+      {"name":"OP_DIV: 0 / 1 = 0","initial stack":["0x","0x01"],"opcodes":["OP_DIV"],"final stack":["0x"],"varops cost":32,"description":"DIV/MOD: W(len(A)=0)*18 + W(len(B)=1)*4 + W(len(A))^2*2/3 = 0*18 + 8*4 + 0^2*2/3 = 32"},
+      {"name":"OP_DIV: 1 / 1 = 1","initial stack":["0x01","0x01"],"opcodes":["OP_DIV"],"final stack":["0x01"],"varops cost":218,"description":"DIV/MOD: W(len(A)=1)*18 + W(len(B)=1)*4 + W(len(A))^2*2/3 = 8*18 + 8*4 + 8^2*2/3 = 218"},
+      {"name":"OP_DIV: 1 / 2 = 0","initial stack":["0x01","0x02"],"opcodes":["OP_DIV"],"final stack":["0x"],"varops cost":218,"description":"DIV/MOD: W(len(A)=1)*18 + W(len(B)=1)*4 + W(len(A))^2*2/3 = 8*18 + 8*4 + 8^2*2/3 = 218"},
+      {"name":"OP_DIV: 4-byte / 2-byte (16777217 / 256 = 65536)","initial stack":["0x01000001","0x0001"],"opcodes":["OP_DIV"],"final stack":["0x000001"],"varops cost":218,"description":"DIV/MOD: W(len(A)=4)*18 + W(len(B)=2)*4 + W(len(A))^2*2/3 = 8*18 + 8*4 + 8^2*2/3 = 218"},
+      {"name":"OP_DIV: 8-byte / 1-byte","initial stack":["0x0100000000000001","0x02"],"opcodes":["OP_DIV"],"final stack":["0x00000000000080"],"varops cost":218,"description":"DIV/MOD: W(len(A)=8)*18 + W(len(B)=1)*4 + W(len(A))^2*2/3 = 8*18 + 8*4 + 8^2*2/3 = 218"},
+      {"name":"OP_DIV: Knuth D6 add-back correction","initial stack":["0x710a7f30344d1398b115d564acc89d565a64dc1121f7227cf97f16bcebe89585","0xcd072cd8be6f9f62ac4c09c28206e7e35594aa6b342f5d8a"],"opcodes":["OP_DIV"],"final stack":["0x395e4842fab428f7"],"varops cost":1354,"description":"DIV/MOD: W(len(A)=32)*18 + W(len(B)=24)*4 + W(len(A))^2*2/3 = 32*18 + 24*4 + 32^2*2/3 = 1354"}
+    ]
+  },
+  {
+    "category": "OP_MOD tests",
+    "tests": [
+      {"name":"OP_MOD: 10 % 3 = 1","initial stack":["0x0a","0x03"],"opcodes":["OP_MOD"],"final stack":["0x01"],"varops cost":218,"description":"DIV/MOD: W(len(A)=1)*18 + W(len(B)=1)*4 + W(len(A))^2*2/3 = 8*18 + 8*4 + 8^2*2/3 = 218"},
+      {"name":"OP_MOD: 7 % 7 = 0","initial stack":["0x07","0x07"],"opcodes":["OP_MOD"],"final stack":["0x"],"varops cost":218,"description":"DIV/MOD: W(len(A)=1)*18 + W(len(B)=1)*4 + W(len(A))^2*2/3 = 8*18 + 8*4 + 8^2*2/3 = 218"},
+      {"name":"OP_MOD: 256 % 10 = 6","initial stack":["0x0001","0x0a"],"opcodes":["OP_MOD"],"final stack":["0x06"],"varops cost":218,"description":"DIV/MOD: W(len(A)=2)*18 + W(len(B)=1)*4 + W(len(A))^2*2/3 = 8*18 + 8*4 + 8^2*2/3 = 218"},
+      {"name":"OP_MOD: 0 % 1 = 0","initial stack":["0x","0x01"],"opcodes":["OP_MOD"],"final stack":["0x"],"varops cost":32,"description":"DIV/MOD: W(len(A)=0)*18 + W(len(B)=1)*4 + W(len(A))^2*2/3 = 0*18 + 8*4 + 0^2*2/3 = 32"},
+      {"name":"OP_MOD: 1 % 2 = 1","initial stack":["0x01","0x02"],"opcodes":["OP_MOD"],"final stack":["0x01"],"varops cost":218,"description":"DIV/MOD: W(len(A)=1)*18 + W(len(B)=1)*4 + W(len(A))^2*2/3 = 8*18 + 8*4 + 8^2*2/3 = 218"},
+      {"name":"OP_MOD: 65535 % 256 = 255","initial stack":["0xffff","0x0001"],"opcodes":["OP_MOD"],"final stack":["0xff"],"varops cost":218,"description":"DIV/MOD: W(len(A)=2)*18 + W(len(B)=2)*4 + W(len(A))^2*2/3 = 8*18 + 8*4 + 8^2*2/3 = 218"},
+      {"name":"OP_MOD: 4-byte % 2-byte","initial stack":["0x05000001","0x0001"],"opcodes":["OP_MOD"],"final stack":["0x05"],"varops cost":218,"description":"DIV/MOD: W(len(A)=4)*18 + W(len(B)=2)*4 + W(len(A))^2*2/3 = 8*18 + 8*4 + 8^2*2/3 = 218"},
+      {"name":"OP_MOD: Knuth D6 add-back correction","initial stack":["0x710a7f30344d1398b115d564acc89d565a64dc1121f7227cf97f16bcebe89585","0xcd072cd8be6f9f62ac4c09c28206e7e35594aa6b342f5d8a"],"opcodes":["OP_MOD"],"final stack":["0xcc072cd8be6f9f62ac4c09c28206e7e35594aa6b342f5d8a"],"varops cost":1354,"description":"DIV/MOD: W(len(A)=32)*18 + W(len(B)=24)*4 + W(len(A))^2*2/3 = 32*18 + 24*4 + 32^2*2/3 = 1354"}
+    ]
+  },
+  {
+    "category": "OP_LSHIFT (UPSHIFT) tests",
+    "tests": [
+      {"name":"OP_LSHIFT: byte-aligned shift by 8 bits","initial stack":["0xFF","0x08"],"opcodes":["OP_LSHIFT"],"final stack":["0x00FF"],"varops cost":21,"description":"LENGTHCONV + ZEROING + COPYING: W(len(BITS)=1)*2 + floor(value(BITS)=8/8)*2 + len(A)*3 = 8*2 + 1*2 + 1*3 = 21"},
+      {"name":"OP_LSHIFT: non-aligned shift by 1 bit","initial stack":["0x01","0x01"],"opcodes":["OP_LSHIFT"],"final stack":["0x0200"],"varops cost":51,"description":"LENGTHCONV + ZEROING + COPYING: W(len(BITS)=1)*2 + floor(value(BITS)=1/8)*2 + len(A)*3 + W(len(A)+floor(value(BITS)/8)=1)*4 = 8*2 + 0*2 + 1*3 + 8*4 = 51"},
+      {"name":"OP_LSHIFT: shift by 0 bits (no-op)","initial stack":["0xABCD","0x"],"opcodes":["OP_LSHIFT"],"final stack":["0xABCD"],"varops cost":6,"description":"LENGTHCONV + ZEROING + COPYING: W(len(BITS)=0)*2 + floor(value(BITS)=0/8)*2 + len(A)*3 = 0*2 + 0*2 + 2*3 = 6"},
+      {"name":"OP_LSHIFT: shift empty element by 8","initial stack":["0x","0x08"],"opcodes":["OP_LSHIFT"],"final stack":["0x00"],"varops cost":18,"description":"LENGTHCONV + ZEROING + COPYING: W(len(BITS)=1)*2 + floor(value(BITS)=8/8)*2 + len(A)*3 = 8*2 + 1*2 + 0*3 = 18"},
+      {"name":"OP_LSHIFT: non-aligned shift by 9 bits","initial stack":["0x01","0x09"],"opcodes":["OP_LSHIFT"],"final stack":["0x000200"],"varops cost":53,"description":"LENGTHCONV + ZEROING + COPYING: W(len(BITS)=1)*2 + floor(value(BITS)=9/8)*2 + len(A)*3 + W(len(A)+floor(value(BITS)/8)=2)*4 = 8*2 + 1*2 + 1*3 + 8*4 = 53"},
+      {"name":"OP_LSHIFT: near-maximum non-aligned shift","initial stack":["0x01","0xF747E801"],"opcodes":["OP_LSHIFT"],"final stack":["0x00{3999998}8000"],"varops cost":24000015,"description":"LENGTHCONV + ZEROING + COPYING: W(len(BITS)=4)*2 + floor(value(BITS)=31999991/8)*2 + len(A)*3 + W(len(A)+floor(value(BITS)/8)=3999999)*4 = 8*2 + 3999998*2 + 1*3 + 4000000*4 = 24000015"},
+      {"name":"OP_LSHIFT: multi-byte BITS operand (shift by 256)","initial stack":["0x01","0x0001"],"opcodes":["OP_LSHIFT"],"final stack":["0x00{32}01"],"varops cost":83,"description":"LENGTHCONV + ZEROING + COPYING: W(len(BITS)=2)*2 + floor(value(BITS)=256/8)*2 + len(A)*3 = 8*2 + 32*2 + 1*3 = 83"}
+    ]
+  },
+  {
+    "category": "OP_RSHIFT (DOWNSHIFT) tests",
+    "tests": [
+      {"name":"OP_RSHIFT: byte-aligned shift by 8 bits","initial stack":["0x00FF","0x08"],"opcodes":["OP_RSHIFT"],"final stack":["0xFF"],"varops cost":19,"description":"LENGTHCONV + COPYING: W(len(BITS)=1)*2 + max(len(A)=2 - floor(value(BITS)=8/8), 0)*3 = 8*2 + 1*3 = 19. 2 bytes, remove 1"},
+      {"name":"OP_RSHIFT: non-aligned shift by 1 bit","initial stack":["0x02","0x01"],"opcodes":["OP_RSHIFT"],"final stack":["0x01"],"varops cost":19,"description":"LENGTHCONV + COPYING: W(len(BITS)=1)*2 + max(len(A)=1 - floor(value(BITS)=1/8), 0)*3 = 8*2 + 1*3 = 19. LE 2 >> 1 = 1"},
+      {"name":"OP_RSHIFT: shift by 0 bits (no-op)","initial stack":["0xABCD","0x"],"opcodes":["OP_RSHIFT"],"final stack":["0xABCD"],"varops cost":6,"description":"LENGTHCONV + COPYING: W(len(BITS)=0)*2 + max(len(A)=2 - floor(value(BITS)=0/8), 0)*3 = 0*2 + 2*3 = 6"},
+      {"name":"OP_RSHIFT: shift all bits out (result empty)","initial stack":["0xFF","0x08"],"opcodes":["OP_RSHIFT"],"final stack":["0x"],"varops cost":16,"description":"LENGTHCONV + COPYING: W(len(BITS)=1)*2 + max(len(A)=1 - floor(value(BITS)=8/8), 0)*3 = 8*2 + 0*3 = 16. bytes(1) >= m_realsize(1), result empty"},
+      {"name":"OP_RSHIFT: shift more than element size (result empty)","initial stack":["0xFF","0x40"],"opcodes":["OP_RSHIFT"],"final stack":["0x"],"varops cost":16,"description":"LENGTHCONV + COPYING: W(len(BITS)=1)*2 + max(len(A)=1 - floor(value(BITS)=64/8), 0)*3 = 8*2 + 0*3 = 16. bytes(8) >= m_realsize(1), result empty"},
+      {"name":"OP_RSHIFT: empty element shift","initial stack":["0x","0x08"],"opcodes":["OP_RSHIFT"],"final stack":["0x"],"varops cost":16,"description":"LENGTHCONV + COPYING: W(len(BITS)=1)*2 + max(len(A)=0 - floor(value(BITS)=8/8), 0)*3 = 8*2 + 0*3 = 16. m_realsize=0, bytes(1) >= 0, result empty"},
+      {"name":"OP_RSHIFT: non-aligned shift by 9 bits","initial stack":["0x000002","0x09"],"opcodes":["OP_RSHIFT"],"final stack":["0x0001"],"varops cost":22,"description":"LENGTHCONV + COPYING: W(len(BITS)=1)*2 + max(len(A)=3 - floor(value(BITS)=9/8), 0)*3 = 8*2 + 2*3 = 22. LE 0x020000=131072, >>9 = 256"},
+      {"name":"OP_RSHIFT: does NOT normalize trailing zeros","initial stack":["0x0100","0x08"],"opcodes":["OP_RSHIFT"],"final stack":["0x00"],"varops cost":19,"description":"LENGTHCONV + COPYING: W(len(BITS)=1)*2 + max(len(A)=2 - floor(value(BITS)=8/8), 0)*3 = 8*2 + 1*3 = 19. m_realsize=2, remove 1 byte, result [0x00] not empty"}
+    ]
+  },
+  {
+    "category": "OP_2MUL tests",
+    "tests": [
+      {"name":"OP_2MUL: 0x80 overflows to 2 bytes","initial stack":["0x80"],"opcodes":["OP_2MUL"],"final stack":["0x0001"],"varops cost":56,"description":"OTHER + COPYING: W(len(A)=1)*7 = 8*7 = 56. LE 0x80=128, *2=256, LE [0x00,0x01]"},
+      {"name":"OP_2MUL: 0x7F stays 1 byte","initial stack":["0x7F"],"opcodes":["OP_2MUL"],"final stack":["0xFE"],"varops cost":56,"description":"OTHER + COPYING: W(len(A)=1)*7 = 8*7 = 56. LE 0x7F=127, *2=254=0xFE"},
+      {"name":"OP_2MUL: 0xFF overflows","initial stack":["0xFF"],"opcodes":["OP_2MUL"],"final stack":["0xFE01"],"varops cost":56,"description":"OTHER + COPYING: W(len(A)=1)*7 = 8*7 = 56. LE 0xFF=255, *2=510, LE [0xFE,0x01]"},
+      {"name":"OP_2MUL: empty element stays empty","initial stack":["0x"],"opcodes":["OP_2MUL"],"final stack":["0x"],"varops cost":0,"description":"OTHER + COPYING: W(len(A)=0)*7 = 0*7 = 0. Zero stays zero"},
+      {"name":"OP_2MUL: multi-byte value 0x8001","initial stack":["0x8001"],"opcodes":["OP_2MUL"],"final stack":["0x0003"],"varops cost":56,"description":"OTHER + COPYING: W(len(A)=2)*7 = 8*7 = 56. LE 0x0180=384, *2=768, LE [0x00,0x03]"},
+      {"name":"OP_2MUL: overflow adds byte, result normalized","initial stack":["0x0080"],"opcodes":["OP_2MUL"],"final stack":["0x000001"],"varops cost":56,"description":"OTHER + COPYING: W(len(A)=2)*7 = 8*7 = 56. LE 0x8000=32768, *2=65536, LE [0x00,0x00,0x01]"}
+    ]
+  },
+  {
+    "category": "OP_2DIV tests",
+    "tests": [
+      {"name":"OP_2DIV: 6 / 2 = 3","initial stack":["0x06"],"opcodes":["OP_2DIV"],"final stack":["0x03"],"varops cost":32,"description":"OTHER: W(len(A)=1)*4 = 8*4 = 32"},
+      {"name":"OP_2DIV: 1 / 2 = 0 (normalized to empty)","initial stack":["0x01"],"opcodes":["OP_2DIV"],"final stack":["0x"],"varops cost":32,"description":"OTHER: W(len(A)=1)*4 = 8*4 = 32. Result 0 normalized to empty"},
+      {"name":"OP_2DIV: 0xFF / 2 = 0x7F","initial stack":["0xFF"],"opcodes":["OP_2DIV"],"final stack":["0x7F"],"varops cost":32,"description":"OTHER: W(len(A)=1)*4 = 8*4 = 32. LE 255/2 = 127"},
+      {"name":"OP_2DIV: empty element stays empty","initial stack":["0x"],"opcodes":["OP_2DIV"],"final stack":["0x"],"varops cost":0,"description":"OTHER: W(len(A)=0)*4 = 0*4 = 0"},
+      {"name":"OP_2DIV: 0x0001 (LE 256) / 2 = 0x80","initial stack":["0x0001"],"opcodes":["OP_2DIV"],"final stack":["0x80"],"varops cost":32,"description":"OTHER: W(len(A)=2)*4 = 8*4 = 32. LE 256/2 = 128 = 0x80, normalized to 1 byte"},
+      {"name":"OP_2DIV: 0x0002 (LE 512) / 2 = 0x0001","initial stack":["0x0002"],"opcodes":["OP_2DIV"],"final stack":["0x0001"],"varops cost":32,"description":"OTHER: W(len(A)=2)*4 = 8*4 = 32. LE 512/2 = 256, LE [0x00,0x01]"}
+    ]
+  },
+  {
+    "category": "OP_ADD tests",
+    "tests": [
+      {"name":"OP_ADD: 3 + 4 = 7","initial stack":["0x03","0x04"],"opcodes":["OP_ADD"],"final stack":["0x07"],"varops cost":72,"description":"ARITH + COPYING: max(W(len(A)=1), W(len(B)=1))*9 = max(8, 8)*9 = 72"},
+      {"name":"OP_ADD: 0xFF + 0x01 carry to 2 bytes","initial stack":["0xFF","0x01"],"opcodes":["OP_ADD"],"final stack":["0x0001"],"varops cost":72,"description":"ARITH + COPYING: max(W(len(A)=1), W(len(B)=1))*9 = max(8, 8)*9 = 72. LE 255+1=256, LE [0x00,0x01]"},
+      {"name":"OP_ADD: 0 + 0 = empty","initial stack":["0x","0x"],"opcodes":["OP_ADD"],"final stack":["0x"],"varops cost":0,"description":"ARITH + COPYING: max(W(len(A)=0), W(len(B)=0))*9 = max(0, 0)*9 = 0"},
+      {"name":"OP_ADD: 0 + 5 = 5","initial stack":["0x","0x05"],"opcodes":["OP_ADD"],"final stack":["0x05"],"varops cost":72,"description":"ARITH + COPYING: max(W(len(A)=0), W(len(B)=1))*9 = max(0, 8)*9 = 72"},
+      {"name":"OP_ADD: asymmetric lengths 1+2 bytes","initial stack":["0x01","0x0001"],"opcodes":["OP_ADD"],"final stack":["0x0101"],"varops cost":72,"description":"ARITH + COPYING: max(W(len(A)=1), W(len(B)=2))*9 = max(8, 8)*9 = 72. LE 1+256=257, LE [0x01,0x01]"},
+      {"name":"OP_ADD: large carry propagation","initial stack":["0xFFFF","0x01"],"opcodes":["OP_ADD"],"final stack":["0x000001"],"varops cost":72,"description":"ARITH + COPYING: max(W(len(A)=2), W(len(B)=1))*9 = max(8, 8)*9 = 72. LE 0xFFFF+1=0x10000, LE [0x00,0x00,0x01]"}
+    ]
+  },
+  {
+    "category": "OP_SUB tests",
+    "tests": [
+      {"name":"OP_SUB: 5 - 3 = 2","initial stack":["0x05","0x03"],"opcodes":["OP_SUB"],"final stack":["0x02"],"varops cost":48,"description":"ARITH: max(W(len(A)=1), W(len(B)=1))*6 = max(8, 8)*6 = 48"},
+      {"name":"OP_SUB: 5 - 5 = 0 (empty)","initial stack":["0x05","0x05"],"opcodes":["OP_SUB"],"final stack":["0x"],"varops cost":48,"description":"ARITH: max(W(len(A)=1), W(len(B)=1))*6 = max(8, 8)*6 = 48. Result 0 normalized to empty"},
+      {"name":"OP_SUB: 0x0001 (LE 256) - 0x01 = 0xFF","initial stack":["0x0001","0x01"],"opcodes":["OP_SUB"],"final stack":["0xFF"],"varops cost":48,"description":"ARITH: max(W(len(A)=2), W(len(B)=1))*6 = max(8, 8)*6 = 48. LE 256-1=255, normalized to 1 byte"},
+      {"name":"OP_SUB: 0 - 0 = empty","initial stack":["0x","0x"],"opcodes":["OP_SUB"],"final stack":["0x"],"varops cost":0,"description":"ARITH: max(W(len(A)=0), W(len(B)=0))*6 = max(0, 0)*6 = 0"},
+      {"name":"OP_SUB: borrow propagation normalizes","initial stack":["0x0201","0x0101"],"opcodes":["OP_SUB"],"final stack":["0x01"],"varops cost":48,"description":"ARITH: max(W(len(A)=2), W(len(B)=2))*6 = max(8, 8)*6 = 48. LE 258-257=1, normalized to 1 byte"}
+    ]
+  },
+  {
+    "category": "OP_1ADD tests",
+    "tests": [
+      {"name":"OP_1ADD: 5 + 1 = 6","initial stack":["0x05"],"opcodes":["OP_1ADD"],"final stack":["0x06"],"varops cost":72,"description":"ARITH + COPYING: max(W(1), W(len(A)=1))*9 = max(8, 8)*9 = 72"},
+      {"name":"OP_1ADD: 0xFF carry to 2 bytes","initial stack":["0xFF"],"opcodes":["OP_1ADD"],"final stack":["0x0001"],"varops cost":72,"description":"ARITH + COPYING: max(W(1), W(len(A)=1))*9 = max(8, 8)*9 = 72. LE 255+1=256"},
+      {"name":"OP_1ADD: 0 + 1 = 1","initial stack":["0x"],"opcodes":["OP_1ADD"],"final stack":["0x01"],"varops cost":72,"description":"ARITH + COPYING: max(W(1), W(len(A)=0))*9 = max(8, 0)*9 = 72"},
+      {"name":"OP_1ADD: 0xFFFF carry propagation","initial stack":["0xFFFF"],"opcodes":["OP_1ADD"],"final stack":["0x000001"],"varops cost":72,"description":"ARITH + COPYING: max(W(1), W(len(A)=2))*9 = max(8, 8)*9 = 72. LE 0xFFFF+1=0x10000"}
+    ]
+  },
+  {
+    "category": "OP_1SUB tests",
+    "tests": [
+      {"name":"OP_1SUB: 5 - 1 = 4","initial stack":["0x05"],"opcodes":["OP_1SUB"],"final stack":["0x04"],"varops cost":48,"description":"ARITH: max(W(1), W(len(A)=1))*6 = max(8, 8)*6 = 48"},
+      {"name":"OP_1SUB: 1 - 1 = 0 (empty)","initial stack":["0x01"],"opcodes":["OP_1SUB"],"final stack":["0x"],"varops cost":48,"description":"ARITH: max(W(1), W(len(A)=1))*6 = max(8, 8)*6 = 48. Normalized to empty"},
+      {"name":"OP_1SUB: 0x0001 (LE 256) - 1 = 0xFF","initial stack":["0x0001"],"opcodes":["OP_1SUB"],"final stack":["0xFF"],"varops cost":48,"description":"ARITH: max(W(1), W(len(A)=2))*6 = max(8, 8)*6 = 48. LE 256-1=255, normalized to 1 byte"}
+    ]
+  },
+  {
+    "category": "OP_MUL tests",
+    "tests": [
+      {"name":"OP_MUL: 3 * 4 = 12","initial stack":["0x03","0x04"],"opcodes":["OP_MUL"],"final stack":["0x0C"],"varops cost":222,"description":"(1+1)*3 + (1+7)/8*((1+7)/8*8)*27 = 6+1*8*27 = 6+216 = 222 (word granularity)"},
+      {"name":"OP_MUL: multiply by 0 = empty","initial stack":["0xFF","0x"],"opcodes":["OP_MUL"],"final stack":["0x"],"varops cost":3,"description":"(1+0)*3 + (1+7)/8*0*27 = 3+0 = 3"},
+      {"name":"OP_MUL: 0 * value = empty","initial stack":["0x","0xFF"],"opcodes":["OP_MUL"],"final stack":["0x"],"varops cost":3,"description":"(0+1)*3 + (0+7)/8*1*27 = 3+0 = 3. (0+7)/8=0"},
+      {"name":"OP_MUL: identity (multiply by 1)","initial stack":["0xABCD","0x01"],"opcodes":["OP_MUL"],"final stack":["0xABCD"],"varops cost":225,"description":"(2+1)*3 + (2+7)/8*((1+7)/8*8)*27 = 9+1*8*27 = 9+216 = 225 (word granularity)"},
+      {"name":"OP_MUL: 0xFF * 0xFF = 0x01FE","initial stack":["0xFF","0xFF"],"opcodes":["OP_MUL"],"final stack":["0x01FE"],"varops cost":222,"description":"(1+1)*3 + (1+7)/8*((1+7)/8*8)*27 = 6+1*8*27 = 222 (word granularity). LE 255*255=65025"},
+      {"name":"OP_MUL: 2-byte * 2-byte","initial stack":["0x0001","0x0001"],"opcodes":["OP_MUL"],"final stack":["0x000001"],"varops cost":228,"description":"(2+2)*3 + (2+7)/8*((2+7)/8*8)*27 = 12+1*8*27 = 228 (word granularity). LE 256*256=65536"}
+    ]
+  },
+  {
+    "category": "OP_AND/OR/XOR asymmetric length tests",
+    "tests": [
+      {"name":"OP_AND: 3-byte AND 1-byte zeros extended bytes","initial stack":["0xFF0102","0x0F"],"opcodes":["OP_AND"],"final stack":["0x0F0000"],"varops cost":32,"description":"OTHER + ZEROING: (W(len(A)=3) + W(len(B)=1))*2 = (8 + 8)*2 = 32"},
+      {"name":"OP_AND: 1-byte AND 3-byte (swapped internally)","initial stack":["0x0F","0xFF0102"],"opcodes":["OP_AND"],"final stack":["0x0F0000"],"varops cost":32,"description":"OTHER + ZEROING: (W(len(A)=1) + W(len(B)=3))*2 = (8 + 8)*2 = 32"},
+      {"name":"OP_AND: empty AND non-empty zeros all","initial stack":["0x","0xFFFF"],"opcodes":["OP_AND"],"final stack":["0x0000"],"varops cost":16,"description":"OTHER + ZEROING: (W(len(A)=0) + W(len(B)=2))*2 = (0 + 8)*2 = 16"},
+      {"name":"OP_AND: does NOT normalize trailing zeros","initial stack":["0xFF00","0xFF00"],"opcodes":["OP_AND"],"final stack":["0xFF00"],"varops cost":32,"description":"OTHER + ZEROING: (W(len(A)=2) + W(len(B)=2))*2 = (8 + 8)*2 = 32"},
+      {"name":"OP_OR: 3-byte OR 1-byte preserves longer","initial stack":["0x000102","0xFF"],"opcodes":["OP_OR"],"final stack":["0xFF0102"],"varops cost":32,"description":"(min(3,1)+7)/8*8*4 = 1*8*4 = 32 (word granularity)"},
+      {"name":"OP_OR: 1-byte OR 3-byte (swapped internally)","initial stack":["0xFF","0x000102"],"opcodes":["OP_OR"],"final stack":["0xFF0102"],"varops cost":32,"description":"(min(1,3)+7)/8*8*4 = 1*8*4 = 32 (word granularity)"},
+      {"name":"OP_OR: empty OR non-empty preserves value","initial stack":["0x","0xABCD"],"opcodes":["OP_OR"],"final stack":["0xABCD"],"varops cost":0,"description":"MIN(0,2)*4 = 0"},
+      {"name":"OP_OR: does NOT normalize trailing zeros","initial stack":["0x0100","0x0100"],"opcodes":["OP_OR"],"final stack":["0x0100"],"varops cost":32,"description":"(min(2,2)+7)/8*8*4 = 1*8*4 = 32 (word granularity). Trailing 0x00 preserved"},
+      {"name":"OP_XOR: 3-byte XOR 1-byte preserves longer","initial stack":["0xFF0102","0xFF"],"opcodes":["OP_XOR"],"final stack":["0x000102"],"varops cost":32,"description":"(min(3,1)+7)/8*8*4 = 1*8*4 = 32 (word granularity). Only first byte XORed"},
+      {"name":"OP_XOR: self-XOR produces zeros (not normalized)","initial stack":["0xAB0100","0xAB0100"],"opcodes":["OP_XOR"],"final stack":["0x000000"],"varops cost":32,"description":"(min(3,3)+7)/8*8*4 = 1*8*4 = 32 (word granularity). All zeros, trailing zeros NOT stripped"},
+      {"name":"OP_XOR: empty XOR non-empty preserves value","initial stack":["0x","0xABCD"],"opcodes":["OP_XOR"],"final stack":["0xABCD"],"varops cost":0,"description":"MIN(0,2)*4 = 0"}
+    ]
+  },
+  {
+    "category": "OP_RIPEMD160 and OP_SHA1 size limit tests",
+    "tests": [
+      {"name":"OP_RIPEMD160: 520 bytes succeeds","initial stack":["0xFF{520}"],"opcodes":["OP_RIPEMD160"],"final stack":["f90bcda0ef62ed3dea826da3cba407b27b3db90c"],"varops cost":0,"description":"RIPEMD160 has no varops cost because it is restricted to 520 bytes"},
+      {"name":"OP_SHA1: 520 bytes succeeds","initial stack":["0xFF{520}"],"opcodes":["OP_SHA1"],"final stack":["c3d314475a71b54360065881513fb599e26cf15d"],"varops cost":0,"description":"SHA1 has no varops cost because it is restricted to 520 bytes"}
+    ]
+  },
+  {
+    "category": "Size and budget limit tests",
+    "tests": [
+      {"name":"OP_LSHIFT: result exactly 4MB succeeds","initial stack":["0xFF{3999999}","0x08"],"opcodes":["OP_LSHIFT"],"final stack":["0x00FF{3999999}"],"varops cost":12000015,"description":"LENGTHCONV + ZEROING + COPYING: W(len(BITS)=1)*2 + floor(value(BITS)=8/8)*2 + len(A)*3 = 8*2 + 1*2 + 3999999*3 = 12000015"}
+    ]
+  }
+]
diff --git a/src/test/data/tapscript_v2_varops.json b/src/test/data/tapscript_v2_varops.json
new file mode 100644
index 000000000000..97173d4cc126
--- /dev/null
+++ b/src/test/data/tapscript_v2_varops.json
@@ -0,0 +1,271 @@
+[
+  {
+    "category": "OP_VERIFY tests",
+    "tests": [
+      {"name":"OP_VERIFY simple success (non-zero)","initial stack":["01"],"opcodes":["69"],"final stack":[],"varops cost":16,"description":"COMPARINGZERO: W(len(A)=1)*2 = 8*2 = 16"},
+      {"name":"OP_VERIFY success (only last byte non-zero)","initial stack":["00{3999999}01"],"opcodes":["69"],"final stack":[],"varops cost":8000000,"description":"COMPARINGZERO: W(len(A)=4000000)*2 = 4000000*2 = 8000000"},
+      {"name":"OP_VERIFY stack presence test (zero followed by 01)","initial stack":["00","01"],"opcodes":["69"],"final stack":["00"],"varops cost":16,"description":"COMPARINGZERO: W(len(A)=1)*2 = 8*2 = 16"}
+    ]
+  },
+  {
+    "category": "OP_NOT tests",
+    "tests": [
+      {"name":"OP_NOT success (non-zero becomes empty string)","initial stack":["01"],"opcodes":["91"],"final stack":[""],"varops cost":16,"description":"COMPARINGZERO: W(len(A)=1)*2 = 8*2 = 16"},
+      {"name":"OP_NOT success (single zero byte)","initial stack":["00"],"opcodes":["91"],"final stack":["01"],"varops cost":16,"description":"COMPARINGZERO: W(len(A)=1)*2 = 8*2 = 16"},
+      {"name":"OP_NOT success (multi-byte all zero)","initial stack":["00{4000000}"],"opcodes":["91"],"final stack":["01"],"varops cost":8000000,"description":"COMPARINGZERO: W(len(A)=4000000)*2 = 4000000*2 = 8000000"},
+      {"name":"OP_NOT success (explicit empty string)","initial stack":[""],"opcodes":["91"],"final stack":["01"],"varops cost":0,"description":"COMPARINGZERO: W(len(A)=0)*2 = 0*2 = 0"},
+      {"name":"OP_NOT success (only last byte non-zero)","initial stack":["00{3999999}01"],"opcodes":["91"],"final stack":[""],"varops cost":8000000,"description":"COMPARINGZERO: W(len(A)=4000000)*2 = 4000000*2 = 8000000"}
+    ]
+  },
+  {
+    "category": "OP_0NOTEQUAL tests",
+    "tests": [
+      {"name":"OP_0NOTEQUAL success (non-zero becomes 01)","initial stack":["01"],"opcodes":["92"],"final stack":["01"],"varops cost":16,"description":"COMPARINGZERO: W(len(A)=1)*2 = 8*2 = 16"},
+      {"name":"OP_0NOTEQUAL success (single zero becomes empty)","initial stack":["00"],"opcodes":["92"],"final stack":[""],"varops cost":16,"description":"COMPARINGZERO: W(len(A)=1)*2 = 8*2 = 16"},
+      {"name":"OP_0NOTEQUAL success (explicit empty string becomes empty)","initial stack":[""],"opcodes":["92"],"final stack":[""],"varops cost":0,"description":"COMPARINGZERO: W(len(A)=0)*2 = 0*2 = 0"},
+      {"name":"OP_0NOTEQUAL success (multi-byte zero becomes empty)","initial stack":["00{4000000}"],"opcodes":["92"],"final stack":[""],"varops cost":8000000,"description":"COMPARINGZERO: W(len(A)=4000000)*2 = 4000000*2 = 8000000"},
+      {"name":"OP_0NOTEQUAL success (only last byte non-zero becomes 01)","initial stack":["00{3999999}01"],"opcodes":["92"],"final stack":["01"],"varops cost":8000000,"description":"COMPARINGZERO: W(len(A)=4000000)*2 = 4000000*2 = 8000000"}
+    ]
+  },
+  {
+    "category": "OP_EQUAL tests",
+    "tests": [
+      {"name":"OP_EQUAL success (equal non-empty strings)","initial stack":["abcd","abcd"],"opcodes":["87"],"final stack":["01"],"varops cost":4,"description":"COMPARING: len(A) = 2 (same length, so compare)"},
+      {"name":"OP_EQUAL success (equal empty strings)","initial stack":["",""],"opcodes":["87"],"final stack":["01"],"varops cost":0,"description":"COMPARING: len(A) = 0 (both empty)"},
+      {"name":"OP_EQUAL fail (non-equal same length)","initial stack":["abcd","abce"],"opcodes":["87"],"final stack":[""],"varops cost":4,"description":"COMPARING: len(A) = 2 (same length, so compare)"},
+      {"name":"OP_EQUAL fail (different lengths)","initial stack":["abcd","ab"],"opcodes":["87"],"final stack":[""],"varops cost":0,"description":"COMPARING: 0 (different lengths, no comparison needed)"}
+    ]
+  },
+  {
+    "category": "OP_EQUALVERIFY tests",
+    "tests": [
+      {"name":"OP_EQUALVERIFY success (equal non-empty strings)","initial stack":["abcd","abcd"],"opcodes":["88"],"final stack":[],"varops cost":4,"description":"COMPARING: len(A) = 2 (same length, so compare)"},
+      {"name":"OP_EQUALVERIFY success (equal empty strings)","initial stack":["",""],"opcodes":["88"],"final stack":[],"varops cost":0,"description":"COMPARING: len(A) = 0 (both empty)"}
+    ]
+  },
+  {
+    "category": "OP_2DUP tests",
+    "tests": [
+      {"name":"OP_2DUP success (two small items)","initial stack":["01","02"],"opcodes":["6e"],"final stack":["01","02","01","02"],"varops cost":6,"description":"COPYING: len(A) + len(B) = 1 + 1 = 2"},
+      {"name":"OP_2DUP success (stack total size exactly 8000000)","initial stack":["aa","ff{3999999}"],"opcodes":["6e"],"final stack":["aa","ff{3999999}","aa","ff{3999999}"],"varops cost":12000000,"description":"COPYING: len(A) + len(B) = 1 + 3999999 = 4000000"},
+      {"name":"OP_2DUP success (stack total size exactly 8000000 including altstack)","initial stack":["aa","ff{3999998}","bbcc"],"opcodes":["6b","6e","6c"],"final stack":["aa","ff{3999998}","aa","ff{3999998}","bbcc"],"varops cost":11999997,"description":"COPYING: OP_2DUP (len(A) + len(B) = 1 + 3999998) = 3999999"}
+    ]
+  },
+  {
+    "category": "OP_3DUP tests",
+    "tests": [
+      {"name":"OP_3DUP success (three small items)","initial stack":["01","02","03"],"opcodes":["6f"],"final stack":["01","02","03","01","02","03"],"varops cost":9,"description":"COPYING: len(A) + len(B) + len(C) = 1 + 1 + 1 = 3"},
+      {"name":"OP_3DUP success (stack total size exactly 8000000)","initial stack":["aa","bb","ff{3999998}"],"opcodes":["6f"],"final stack":["aa","bb","ff{3999998}","aa","bb","ff{3999998}"],"varops cost":12000000,"description":"COPYING: len(A) + len(B) + len(C) = 1 + 1 + 3999998 = 4000000"},
+      {"name":"OP_3DUP success (stack total size exactly 8000000 including altstack)","initial stack":["aa","bb","ff{3999995}","ccdd"],"opcodes":["6b","6f","6c"],"final stack":["aa","bb","ff{3999995}","aa","bb","ff{3999995}","ccdd"],"varops cost":11999991,"description":"COPYING: OP_3DUP (1 + 1 + 3999995) = 3999997"}
+    ]
+  },
+  {
+    "category": "OP_2OVER tests",
+    "tests": [
+      {"name":"OP_2OVER success (four small items)","initial stack":["a1","b2","c3","d4"],"opcodes":["70"],"final stack":["a1","b2","c3","d4","a1","b2"],"varops cost":6,"description":"COPYING: len(C) + len(D) = 1 + 1 = 2"},
+      {"name":"OP_2OVER success (stack total size exactly 8000000)","initial stack":["aa","bb","ff{3999998}","00"],"opcodes":["70"],"final stack":["aa","bb","ff{3999998}","00","aa","bb"],"varops cost":6,"description":"COPYING: len(C) + len(D) = 1 + 1 = 2"},
+      {"name":"OP_2OVER success (stack+altstack exactly 8000000)","initial stack":["aa","bb","ff{3999997}","cc","dd"],"opcodes":["6b","70","6c"],"final stack":["aa","bb","ff{3999997}","cc","aa","bb","dd"],"varops cost":6,"description":"COPYING: OP_2OVER (1 + 1) = 2"}
+    ]
+  },
+  {
+    "category": "OP_IFDUP tests",
+    "tests": [
+      {"name":"OP_IFDUP success (non-zero one-byte)","initial stack":["01"],"opcodes":["73"],"final stack":["01","01"],"varops cost":19,"description":"COMPARINGZERO + COPYING: W(len(A)=1)*2 + len(A)*3 = 8*2 + 1*3 = 19"},
+      {"name":"OP_IFDUP success (non-zero multi-byte)","initial stack":["0001"],"opcodes":["73"],"final stack":["0001","0001"],"varops cost":22,"description":"COMPARINGZERO + COPYING: W(len(A)=2)*2 + len(A)*3 = 8*2 + 2*3 = 22"},
+      {"name":"OP_IFDUP success (empty string is zero)","initial stack":[""],"opcodes":["73"],"final stack":[""],"varops cost":0,"description":"COMPARINGZERO + COPYING: W(len(A)=0)*2 + len(A)*3 = 0*2 + 0*3 = 0"},
+      {"name":"OP_IFDUP success (all-zero multi-byte is zero)","initial stack":["00{4000000}"],"opcodes":["73"],"final stack":["00{4000000}"],"varops cost":20000000,"description":"COMPARINGZERO + COPYING: W(len(A)=4000000)*2 + len(A)*3 = 4000000*2 + 4000000*3 = 20000000"},
+      {"name":"OP_IFDUP success (last byte non-zero triggers duplication)","initial stack":["00{3999999}01"],"opcodes":["73"],"final stack":["00{3999999}01","00{3999999}01"],"varops cost":20000000,"description":"COMPARINGZERO + COPYING: W(len(A)=4000000)*2 + len(A)*3 = 4000000*2 + 4000000*3 = 20000000"},
+      {"name":"OP_IFDUP success (duplication puts stack+altstack exactly at 8000000)","initial stack":["aa","ff{3999998}"],"opcodes":["6b","73","6c"],"final stack":["aa","aa","ff{3999998}"],"varops cost":19,"description":"COMPARINGZERO + COPYING: W(len(A)=1)*2 + len(A)*3 = 8*2 + 1*3 = 19"}
+    ]
+  },
+  {
+    "category": "OP_DUP tests",
+    "tests": [
+      {"name":"OP_DUP success (one-byte item)","initial stack":["ff"],"opcodes":["76"],"final stack":["ff","ff"],"varops cost":3,"description":"COPYING: len(A) = 1"},
+      {"name":"OP_DUP success (multi-byte item)","initial stack":["abcd"],"opcodes":["76"],"final stack":["abcd","abcd"],"varops cost":6,"description":"COPYING: len(A) = 2"},
+      {"name":"OP_DUP success (empty string)","initial stack":[""],"opcodes":["76"],"final stack":["",""],"varops cost":0,"description":"COPYING: len(A) = 0"},
+      {"name":"OP_DUP success (stack+altstack exactly 8000000 after dup)","initial stack":["aa","ff{3999998}"],"opcodes":["6b","76","6c"],"final stack":["aa","aa","ff{3999998}"],"varops cost":3}
+    ]
+  },
+  {
+    "category": "OP_OVER tests",
+    "tests": [
+      {"name":"OP_OVER success (two small items)","initial stack":["01","02"],"opcodes":["78"],"final stack":["01","02","01"],"varops cost":3,"description":"COPYING: len(B) = 1"},
+      {"name":"OP_OVER success (multi-byte item copied)","initial stack":["abcd","ef"],"opcodes":["78"],"final stack":["abcd","ef","abcd"],"varops cost":6,"description":"COPYING: len(B) = 2"},
+      {"name":"OP_OVER success (empty string copied)","initial stack":["","ff"],"opcodes":["78"],"final stack":["","ff",""],"varops cost":0,"description":"COPYING: len(B) = 0"},
+      {"name":"OP_OVER success (stack+altstack exactly 8000000)","initial stack":["aa","bb","ff{3999998}"],"opcodes":["6b","78","6c"],"final stack":["aa","bb","aa","ff{3999998}"],"varops cost":3,"description":"COPYING: OP_OVER (len=1) = 1"}
+    ]
+  },
+  {
+    "category": "OP_TUCK tests",
+    "tests": [
+      {"name":"OP_TUCK success (two small items)","initial stack":["01","02"],"opcodes":["7d"],"final stack":["02","01","02"],"varops cost":3,"description":"COPYING: len(A) = 1"},
+      {"name":"OP_TUCK success (multi-byte duplication)","initial stack":["a1","abcd"],"opcodes":["7d"],"final stack":["abcd","a1","abcd"],"varops cost":6,"description":"COPYING: len(A) = 2"},
+      {"name":"OP_TUCK success (empty string duplicated)","initial stack":["a1",""],"opcodes":["7d"],"final stack":["","a1",""],"varops cost":0,"description":"COPYING: len(A) = 0"},
+      {"name":"OP_TUCK success (stack+altstack exactly 8000000)","initial stack":["aa","ff{3999999}","bb"],"opcodes":["6b","7d","6c"],"final stack":["ff{3999999}","aa","ff{3999999}","bb"],"varops cost":11999997,"description":"COPYING: OP_TUCK (len=3999999) = 3999999"}
+    ]
+  },
+  {
+    "category": "OP_PICK tests",
+    "tests": [
+      {"name":"OP_PICK success (pick index 0 = top)","initial stack":["aa",""],"opcodes":["79"],"final stack":["aa","aa"],"varops cost":3,"description":"LENGTHCONV + COPYING: W(len(index)=0)*2 + len(picked)*3 = 0*2 + 1*3 = 3"},
+      {"name":"OP_PICK success (pick index 1 = second)","initial stack":["aa","bb","01"],"opcodes":["79"],"final stack":["aa","bb","aa"],"varops cost":19,"description":"LENGTHCONV + COPYING: W(len(index)=1)*2 + len(picked)*3 = 8*2 + 1*3 = 19"},
+      {"name":"OP_PICK success (multi-byte target and index)","initial stack":["ff{100}","ee","0100"],"opcodes":["79"],"final stack":["ff{100}","ee","ff{100}"],"varops cost":316,"description":"LENGTHCONV + COPYING: W(len(index)=2)*2 + len(picked)*3 = 8*2 + 100*3 = 316"},
+      {"name":"OP_PICK success (zero-length target)","initial stack":["",""],"opcodes":["79"],"final stack":["",""],"varops cost":0,"description":"LENGTHCONV + COPYING: W(len(index)=0)*2 + len(picked)*3 = 0*2 + 0*3 = 0"},
+      {"name":"OP_PICK success (non-minimal encoding of 0)","initial stack":["aa","0000"],"opcodes":["79"],"final stack":["aa","aa"],"varops cost":19,"description":"LENGTHCONV + COPYING: W(len(index)=2)*2 + len(picked)*3 = 8*2 + 1*3 = 19"},
+      {"name":"OP_PICK success (stack+altstack exactly 8000000)","initial stack":["aa","eeee","01","ff{3999999}"],"opcodes":["6b","79","6c"],"final stack":["aa","eeee","aa","ff{3999999}"],"varops cost":19,"description":"LENGTHCONV + COPYING: W(len(index)=1)*2 + len(picked)*3 = 8*2 + 1*3 = 19"}
+    ]
+  },
+  {
+    "category": "OP_ROLL tests",
+    "tests": [
+      {"name":"OP_ROLL success (roll 0 = no change)","initial stack":["aa",""],"opcodes":["7a"],"final stack":["aa"],"varops cost":0,"description":"LENGTHCONV + ROLL: W(len(index)=0)*2 + 48*value(index=0) = 0*2 + 48*0 = 0"},
+      {"name":"OP_ROLL success (roll 1 = swap)","initial stack":["aa","bb","01"],"opcodes":["7a"],"final stack":["bb","aa"],"varops cost":64,"description":"LENGTHCONV + ROLL: W(len(index)=1)*2 + 48*value(index=1) = 8*2 + 48*1 = 64"},
+      {"name":"OP_ROLL success (roll from position 2)","initial stack":["a1","b2","c3","02"],"opcodes":["7a"],"final stack":["b2","c3","a1"],"varops cost":112,"description":"LENGTHCONV + ROLL: W(len(index)=1)*2 + 48*value(index=2) = 8*2 + 48*2 = 112"},
+      {"name":"OP_ROLL success (non-minimally encoded 0)","initial stack":["aa","0000"],"opcodes":["7a"],"final stack":["aa"],"varops cost":16,"description":"LENGTHCONV + ROLL: W(len(index)=2)*2 + 48*value(index=0) = 8*2 + 48*0 = 16"}
+    ]
+  },
+  {
+    "category": "OP_BOOLAND tests",
+    "tests": [
+      {"name":"OP_BOOLAND success (both one-byte non-zero)","initial stack":["01","02"],"opcodes":["9a"],"final stack":["01"],"varops cost":32,"description":"COMPARINGZERO: (W(len(A)=1) + W(len(B)=1))*2 = (8 + 8)*2 = 32"},
+      {"name":"OP_BOOLAND success (multi-byte non-zero + single byte)","initial stack":["00000001","01"],"opcodes":["9a"],"final stack":["01"],"varops cost":32,"description":"COMPARINGZERO: (W(len(A)=4) + W(len(B)=1))*2 = (8 + 8)*2 = 32"},
+      {"name":"OP_BOOLAND success (first zero)","initial stack":["00","01"],"opcodes":["9a"],"final stack":[""],"varops cost":32,"description":"COMPARINGZERO: (W(len(A)=1) + W(len(B)=1))*2 = (8 + 8)*2 = 32"},
+      {"name":"OP_BOOLAND success (both empty)","initial stack":["",""],"opcodes":["9a"],"final stack":[""],"varops cost":0,"description":"COMPARINGZERO: (W(len(A)=0) + W(len(B)=0))*2 = (0 + 0)*2 = 0"},
+      {"name":"OP_BOOLAND success (both multi-byte zero)","initial stack":["00{4000000}","00{4000000}"],"opcodes":["9a"],"final stack":[""],"varops cost":16000000,"description":"COMPARINGZERO: (W(len(A)=4000000) + W(len(B)=4000000))*2 = (4000000 + 4000000)*2 = 16000000"},
+      {"name":"OP_BOOLAND success (one non-zero at the end)","initial stack":["00{3999999}01","00{3999999}01"],"opcodes":["9a"],"final stack":["01"],"varops cost":16000000,"description":"COMPARINGZERO: (W(len(A)=4000000) + W(len(B)=4000000))*2 = (4000000 + 4000000)*2 = 16000000"}
+    ]
+  },
+  {
+    "category": "OP_BOOLOR tests",
+    "tests": [
+      {"name":"OP_BOOLOR success (both one-byte non-zero)","initial stack":["01","02"],"opcodes":["9b"],"final stack":["01"],"varops cost":32,"description":"COMPARINGZERO: (W(len(A)=1) + W(len(B)=1))*2 = (8 + 8)*2 = 32"},
+      {"name":"OP_BOOLOR success (one zero, one non-zero)","initial stack":["00","01"],"opcodes":["9b"],"final stack":["01"],"varops cost":32,"description":"COMPARINGZERO: (W(len(A)=1) + W(len(B)=1))*2 = (8 + 8)*2 = 32"},
+      {"name":"OP_BOOLOR success (one empty, one non-zero)","initial stack":["","01"],"opcodes":["9b"],"final stack":["01"],"varops cost":16,"description":"COMPARINGZERO: (W(len(A)=0) + W(len(B)=1))*2 = (0 + 8)*2 = 16"},
+      {"name":"OP_BOOLOR success (both empty)","initial stack":["",""],"opcodes":["9b"],"final stack":[""],"varops cost":0,"description":"COMPARINGZERO: (W(len(A)=0) + W(len(B)=0))*2 = (0 + 0)*2 = 0"},
+      {"name":"OP_BOOLOR success (both multi-byte zero)","initial stack":["00{4000000}","00{4000000}"],"opcodes":["9b"],"final stack":[""],"varops cost":16000000,"description":"COMPARINGZERO: (W(len(A)=4000000) + W(len(B)=4000000))*2 = (4000000 + 4000000)*2 = 16000000"},
+      {"name":"OP_BOOLOR success (one long non-zero)","initial stack":["00{3999999}01","00{4000000}"],"opcodes":["9b"],"final stack":["01"],"varops cost":16000000,"description":"COMPARINGZERO: (W(len(A)=4000000) + W(len(B)=4000000))*2 = (4000000 + 4000000)*2 = 16000000"}
+    ]
+  },
+  {
+    "category": "OP_NUMEQUAL tests",
+    "tests": [
+      {"name":"OP_NUMEQUAL success (equal one-byte numbers)","initial stack":["01","01"],"opcodes":["9c"],"final stack":["01"],"varops cost":16,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=1), W(len(B)=1))*2 = max(8, 8)*2 = 16"},
+      {"name":"OP_NUMEQUAL success (equal numbers, padded)","initial stack":["01","010000"],"opcodes":["9c"],"final stack":["01"],"varops cost":16,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=1), W(len(B)=3))*2 = max(8, 8)*2 = 16"},
+      {"name":"OP_NUMEQUAL success (both zero)","initial stack":["00",""],"opcodes":["9c"],"final stack":["01"],"varops cost":16,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=1), W(len(B)=0))*2 = max(8, 0)*2 = 16"},
+      {"name":"OP_NUMEQUAL fail (different values)","initial stack":["01","02"],"opcodes":["9c"],"final stack":[""],"varops cost":16,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=1), W(len(B)=1))*2 = max(8, 8)*2 = 16"},
+      {"name":"OP_NUMEQUAL success (equal long values with trailing zeros)","initial stack":["ff{3999999}01","ff{3999999}01"],"opcodes":["9c"],"final stack":["01"],"varops cost":8000000,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=4000000), W(len(B)=4000000))*2 = max(4000000, 4000000)*2 = 8000000"},
+      {"name":"OP_NUMEQUAL fail (different lengths, same prefix)","initial stack":["01","0101"],"opcodes":["9c"],"final stack":[""],"varops cost":16,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=1), W(len(B)=2))*2 = max(8, 8)*2 = 16"}
+    ]
+  },
+  {
+    "category": "OP_NUMEQUALVERIFY tests",
+    "tests": [
+      {"name":"OP_NUMEQUALVERIFY success (equal one-byte)","initial stack":["01","01"],"opcodes":["9d"],"final stack":[],"varops cost":16,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=1), W(len(B)=1))*2 = max(8, 8)*2 = 16"},
+      {"name":"OP_NUMEQUALVERIFY success (equal with trailing zeros)","initial stack":["01","010000"],"opcodes":["9d"],"final stack":[],"varops cost":16,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=1), W(len(B)=3))*2 = max(8, 8)*2 = 16"},
+      {"name":"OP_NUMEQUALVERIFY success (both zero)","initial stack":["","00"],"opcodes":["9d"],"final stack":[],"varops cost":16,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=0), W(len(B)=1))*2 = max(0, 8)*2 = 16"},
+      {"name":"OP_NUMEQUALVERIFY success (long equal with trailing zeros)","initial stack":["ff{3999999}01","ff{3999999}01"],"opcodes":["9d"],"final stack":[],"varops cost":8000000,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=4000000), W(len(B)=4000000))*2 = max(4000000, 4000000)*2 = 8000000"}
+    ]
+  },
+  {
+    "category": "OP_NUMNOTEQUAL tests",
+    "tests": [
+      {"name":"OP_NUMNOTEQUAL success (different one-byte values)","initial stack":["01","02"],"opcodes":["9e"],"final stack":["01"],"varops cost":16,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=1), W(len(B)=1))*2 = max(8, 8)*2 = 16"},
+      {"name":"OP_NUMNOTEQUAL success (equal with padding)","initial stack":["01","010000"],"opcodes":["9e"],"final stack":[""],"varops cost":16,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=1), W(len(B)=3))*2 = max(8, 8)*2 = 16"},
+      {"name":"OP_NUMNOTEQUAL success (both empty = equal)","initial stack":["",""],"opcodes":["9e"],"final stack":[""],"varops cost":0,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=0), W(len(B)=0))*2 = max(0, 0)*2 = 0"},
+      {"name":"OP_NUMNOTEQUAL success (one empty, one padded zero = equal)","initial stack":["","000000"],"opcodes":["9e"],"final stack":[""],"varops cost":16,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=0), W(len(B)=3))*2 = max(0, 8)*2 = 16"},
+      {"name":"OP_NUMNOTEQUAL success (long unequal values)","initial stack":["ff{3999999}01","ff{3999999}02"],"opcodes":["9e"],"final stack":["01"],"varops cost":8000000,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=4000000), W(len(B)=4000000))*2 = max(4000000, 4000000)*2 = 8000000"}
+    ]
+  },
+  {
+    "category": "OP_LESSTHAN tests",
+    "tests": [
+      {"name":"OP_LESSTHAN success (1 < 2)","initial stack":["01","02"],"opcodes":["9f"],"final stack":["01"],"varops cost":16,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=1), W(len(B)=1))*2 = max(8, 8)*2 = 16"},
+      {"name":"OP_LESSTHAN success (2 < 1 is false)","initial stack":["02","01"],"opcodes":["9f"],"final stack":[""],"varops cost":16,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=1), W(len(B)=1))*2 = max(8, 8)*2 = 16"},
+      {"name":"OP_LESSTHAN success (trailing zeros ignored)","initial stack":["01","01000000"],"opcodes":["9f"],"final stack":[""],"varops cost":16,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=1), W(len(B)=4))*2 = max(8, 8)*2 = 16"},
+      {"name":"OP_LESSTHAN success (empty < 01)","initial stack":["","01"],"opcodes":["9f"],"final stack":["01"],"varops cost":16,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=0), W(len(B)=1))*2 = max(0, 8)*2 = 16"},
+      {"name":"OP_LESSTHAN success (01 < empty is false)","initial stack":["01",""],"opcodes":["9f"],"final stack":[""],"varops cost":16,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=1), W(len(B)=0))*2 = max(8, 0)*2 = 16"}
+    ]
+  },
+  {
+    "category": "OP_GREATERTHAN tests",
+    "tests": [
+      {"name":"OP_GREATERTHAN success (2 > 1)","initial stack":["02","01"],"opcodes":["a0"],"final stack":["01"],"varops cost":16,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=1), W(len(B)=1))*2 = max(8, 8)*2 = 16"},
+      {"name":"OP_GREATERTHAN success (1 > 2 is false)","initial stack":["01","02"],"opcodes":["a0"],"final stack":[""],"varops cost":16,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=1), W(len(B)=1))*2 = max(8, 8)*2 = 16"},
+      {"name":"OP_GREATERTHAN success (trailing zeros ignored)","initial stack":["010000","01"],"opcodes":["a0"],"final stack":[""],"varops cost":16,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=3), W(len(B)=1))*2 = max(8, 8)*2 = 16"}
+    ]
+  },
+  {
+    "category": "OP_LESSTHANOREQUAL tests",
+    "tests": [
+      {"name":"OP_LESSTHANOREQUAL success (1 <= 2)","initial stack":["01","02"],"opcodes":["a1"],"final stack":["01"],"varops cost":16,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=1), W(len(B)=1))*2 = max(8, 8)*2 = 16"},
+      {"name":"OP_LESSTHANOREQUAL success (2 <= 2)","initial stack":["02","02"],"opcodes":["a1"],"final stack":["01"],"varops cost":16,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=1), W(len(B)=1))*2 = max(8, 8)*2 = 16"},
+      {"name":"OP_LESSTHANOREQUAL success (3 <= 2 is false)","initial stack":["03","02"],"opcodes":["a1"],"final stack":[""],"varops cost":16,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=1), W(len(B)=1))*2 = max(8, 8)*2 = 16"}
+    ]
+  },
+  {
+    "category": "OP_GREATERTHANOREQUAL tests",
+    "tests": [
+      {"name":"OP_GREATERTHANOREQUAL success (3 >= 2)","initial stack":["03","02"],"opcodes":["a2"],"final stack":["01"],"varops cost":16,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=1), W(len(B)=1))*2 = max(8, 8)*2 = 16"},
+      {"name":"OP_GREATERTHANOREQUAL success (2 >= 2)","initial stack":["02","02"],"opcodes":["a2"],"final stack":["01"],"varops cost":16,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=1), W(len(B)=1))*2 = max(8, 8)*2 = 16"},
+      {"name":"OP_GREATERTHANOREQUAL success (1 >= 2 is false)","initial stack":["01","02"],"opcodes":["a2"],"final stack":[""],"varops cost":16,"description":"COMPARING + COMPARINGZERO: max(W(len(A)=1), W(len(B)=1))*2 = max(8, 8)*2 = 16"}
+    ]
+  },
+  {
+    "category": "OP_MIN tests",
+    "tests": [
+      {"name":"OP_MIN success (1 vs 2)","initial stack":["01","02"],"opcodes":["a3"],"final stack":["01"],"varops cost":32,"description":"OTHER: max(W(len(A)=1), W(len(B)=1))*4 = max(8, 8)*4 = 32"},
+      {"name":"OP_MIN success (3 vs 2)","initial stack":["03","02"],"opcodes":["a3"],"final stack":["02"],"varops cost":32,"description":"OTHER: max(W(len(A)=1), W(len(B)=1))*4 = max(8, 8)*4 = 32"},
+      {"name":"OP_MIN success (equal values)","initial stack":["05","050000"],"opcodes":["a3"],"final stack":["05"],"varops cost":32,"description":"OTHER: max(W(len(A)=1), W(len(B)=3))*4 = max(8, 8)*4 = 32"},
+      {"name":"OP_MIN success (empty and 01)","initial stack":["","01"],"opcodes":["a3"],"final stack":[""],"varops cost":32,"description":"OTHER: max(W(len(A)=0), W(len(B)=1))*4 = max(0, 8)*4 = 32"},
+      {"name":"OP_MIN success (empty and empty)","initial stack":["",""],"opcodes":["a3"],"final stack":[""],"varops cost":0,"description":"OTHER: max(W(len(A)=0), W(len(B)=0))*4 = max(0, 0)*4 = 0"},
+      {"name":"OP_MIN success (normalizes selected result)","initial stack":["020000","01"],"opcodes":["a3"],"final stack":["01"],"varops cost":32,"description":"OTHER: max(W(len(A)=3), W(len(B)=1))*4 = max(8, 8)*4 = 32"}
+    ]
+  },
+  {
+    "category": "OP_MAX tests",
+    "tests": [
+      {"name":"OP_MAX success (1 vs 2)","initial stack":["01","02"],"opcodes":["a4"],"final stack":["02"],"varops cost":32,"description":"OTHER: max(W(len(A)=1), W(len(B)=1))*4 = max(8, 8)*4 = 32"},
+      {"name":"OP_MAX success (3 vs 2)","initial stack":["03","02"],"opcodes":["a4"],"final stack":["03"],"varops cost":32,"description":"OTHER: max(W(len(A)=1), W(len(B)=1))*4 = max(8, 8)*4 = 32"},
+      {"name":"OP_MAX success (equal values)","initial stack":["050000","05"],"opcodes":["a4"],"final stack":["05"],"varops cost":32,"description":"OTHER: max(W(len(A)=3), W(len(B)=1))*4 = max(8, 8)*4 = 32"},
+      {"name":"OP_MAX success (empty and 01)","initial stack":["","01"],"opcodes":["a4"],"final stack":["01"],"varops cost":32,"description":"OTHER: max(W(len(A)=0), W(len(B)=1))*4 = max(0, 8)*4 = 32"},
+      {"name":"OP_MAX success (empty and empty)","initial stack":["",""],"opcodes":["a4"],"final stack":[""],"varops cost":0,"description":"OTHER: max(W(len(A)=0), W(len(B)=0))*4 = max(0, 0)*4 = 0"},
+      {"name":"OP_MAX success (normalizes selected result)","initial stack":["01","020000"],"opcodes":["a4"],"final stack":["02"],"varops cost":32,"description":"OTHER: max(W(len(A)=1), W(len(B)=3))*4 = max(8, 8)*4 = 32"}
+    ]
+  },
+  {
+    "category": "OP_WITHIN tests",
+    "tests": [
+      {"name":"OP_WITHIN success (2 in [1, 3))","initial stack":["02","01","03"],"opcodes":["a5"],"final stack":["01"],"varops cost":32,"description":"COMPARING + COMPARINGZERO: (max(W(len(x)=1), W(len(min)=1)) + max(W(len(x)=1), W(len(max)=1)))*2 = (8 + 8)*2 = 32"},
+      {"name":"OP_WITHIN success (1 in [1, 3))","initial stack":["01","01","03"],"opcodes":["a5"],"final stack":["01"],"varops cost":32,"description":"COMPARING + COMPARINGZERO: (max(W(len(x)=1), W(len(min)=1)) + max(W(len(x)=1), W(len(max)=1)))*2 = (8 + 8)*2 = 32"},
+      {"name":"OP_WITHIN success (3 not in [1, 3))","initial stack":["03","01","03"],"opcodes":["a5"],"final stack":[""],"varops cost":32,"description":"COMPARING + COMPARINGZERO: (max(W(len(x)=1), W(len(min)=1)) + max(W(len(x)=1), W(len(max)=1)))*2 = (8 + 8)*2 = 32"},
+      {"name":"OP_WITHIN success (0 not in [1, 3))","initial stack":["00","01","03"],"opcodes":["a5"],"final stack":[""],"varops cost":32,"description":"COMPARING + COMPARINGZERO: (max(W(len(x)=1), W(len(min)=1)) + max(W(len(x)=1), W(len(max)=1)))*2 = (8 + 8)*2 = 32"},
+      {"name":"OP_WITHIN success (trailing zeros ignored)","initial stack":["01","01000000","0300"],"opcodes":["a5"],"final stack":["01"],"varops cost":32,"description":"COMPARING + COMPARINGZERO: (max(W(len(x)=1), W(len(min)=4)) + max(W(len(x)=1), W(len(max)=2)))*2 = (8 + 8)*2 = 32"},
+      {"name":"OP_WITHIN success (empty values treated as 0)","initial stack":["","","01"],"opcodes":["a5"],"final stack":["01"],"varops cost":16,"description":"COMPARING + COMPARINGZERO: (max(W(len(x)=0), W(len(min)=0)) + max(W(len(x)=0), W(len(max)=1)))*2 = (0 + 8)*2 = 16"}
+    ]
+  },
+  {
+    "category": "OP_SHA256 tests",
+    "tests": [
+      {"name":"OP_SHA256 success (empty string)","initial stack":[""],"opcodes":["a8"],"final stack":["e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"],"varops cost":0,"description":"HASH: len(operand) * 50 = 0 * 50 = 0"},
+      {"name":"OP_SHA256 success (short string)","initial stack":["61"],"opcodes":["a8"],"final stack":["ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb"],"varops cost":50,"description":"HASH: len(operand) * 50 = 1 * 50 = 50"},
+      {"name":"OP_SHA256 success (long input)","initial stack":["ff{4000000}"],"opcodes":["a8"],"final stack":["1627b4013371d63d947eb27740be7cf32aad311c0116e854bbe6ec89e7185e09"],"varops cost":200000000,"description":"HASH: len(operand) * 50 = 4000000 * 50 = 200000000"}
+    ]
+  },
+  {
+    "category": "OP_HASH160 tests",
+    "tests": [
+      {"name":"OP_HASH160 success (empty string)","initial stack":[""],"opcodes":["a9"],"final stack":["b472a266d0bd89c13706a4132ccfb16f7c3b9fcb"],"varops cost":0,"description":"HASH: len(operand) * 50 = 0 * 50 = 0"},
+      {"name":"OP_HASH160 success (short string)","initial stack":["61"],"opcodes":["a9"],"final stack":["994355199e516ff76c4fa4aab39337b9d84cf12b"],"varops cost":50,"description":"HASH: len(operand) * 50 = 1 * 50 = 50"},
+      {"name":"OP_HASH160 success (long input)","initial stack":["ff{4000000}"],"opcodes":["a9"],"final stack":["3eb2aeb1e4836781864294138e5592505ca08d70"],"varops cost":200000000,"description":"HASH: len(operand) * 50 = 4000000 * 50 = 200000000"}
+    ]
+  },
+  {
+    "category": "OP_HASH256 tests",
+    "tests": [
+      {"name":"OP_HASH256 success (empty string)","initial stack":[""],"opcodes":["aa"],"final stack":["5df6e0e2761359d30a8275058e299fcc0381534545f55cf43e41983f5d4c9456"],"varops cost":0,"description":"HASH: len(operand) * 50 = 0 * 50 = 0"},
+      {"name":"OP_HASH256 success (short string)","initial stack":["61"],"opcodes":["aa"],"final stack":["bf5d3affb73efd2ec6c36ad3112dd933efed63c4e1cbffcfa88e2759c144f2d8"],"varops cost":50,"description":"HASH: len(operand) * 50 = 1 * 50 = 50"},
+      {"name":"OP_HASH256 success (long input)","initial stack":["ff{4000000}"],"opcodes":["aa"],"final stack":["2c410c77ea4a4d13d84cdd813370d9ab4fd9dcdc5397b40b5531e792d4ad504e"],"varops cost":200000000,"description":"HASH: len(operand) * 50 = 4000000 * 50 = 200000000"}
+    ]
+  }
+]
diff --git a/src/test/data/val64_conversion.json b/src/test/data/val64_conversion.json
new file mode 100644
index 000000000000..69e1cb9d954c
--- /dev/null
+++ b/src/test/data/val64_conversion.json
@@ -0,0 +1,29 @@
+[
+    ["Empty test",
+     [], []
+    ],
+    ["Single zero unit (final 0)",
+     [0], [0]
+    ],
+    ["Single unit",
+     [1], [1]
+    ],
+    ["Little endian",
+     [1, 2], [513]
+    ],
+    ["Little endian, redundant zeroes",
+     [1, 2, 0], [513]
+    ],
+    ["Little endian 8 chars",
+     [1, 0, 0, 0, 0, 0, 0, 2], [144115188075855873]
+    ],
+    ["Little endian becomes little-wordian",
+     [1, 0, 0, 0, 0, 0, 0, 2, 7], [144115188075855873, 7]
+    ],
+    ["Don't trim zeroes on conversion to 64",
+     [1, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0], [144115188075855873, 0]
+    ],
+    ["Two full words",
+     [1, 0, 0, 0, 0, 0, 0, 2, 3, 0, 0, 0, 0, 0, 0, 2], [144115188075855873, 144115188075855875]
+    ]
+]
diff --git a/src/test/fuzz/CMakeLists.txt b/src/test/fuzz/CMakeLists.txt
index 69b7c9c2e567..e3ae6579e5f5 100644
--- a/src/test/fuzz/CMakeLists.txt
+++ b/src/test/fuzz/CMakeLists.txt
@@ -119,6 +119,11 @@ add_executable(fuzz
   string.cpp
   strprintf.cpp
   system.cpp
+  tapscript_v2_budget_accounting.cpp
+  tapscript_v2_eval_invariants.cpp
+  tapscript_v2_signature_timelock.cpp
+  tapscript_v2_stack_programs.cpp
+  tapscript_v2_stack_resource_limits.cpp
   templatehash.cpp
   timeoffsets.cpp
   torcontrol.cpp
@@ -129,6 +134,7 @@ add_executable(fuzz
   tx_pool.cpp
   txorphan.cpp
   txrequest.cpp
+  val64_ops.cpp
   # Visual Studio 2022 version 17.12 introduced a bug
   # that causes an internal compiler error.
   # See: https://github.com/bitcoin/bitcoin/issues/31303
diff --git a/src/test/fuzz/tapscript_v2_budget_accounting.cpp b/src/test/fuzz/tapscript_v2_budget_accounting.cpp
new file mode 100644
index 000000000000..ff972ef77ab8
--- /dev/null
+++ b/src/test/fuzz/tapscript_v2_budget_accounting.cpp
@@ -0,0 +1,171 @@
+// Copyright (c) 2026 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or https://opensource.org/license/mit/.
+
+// Exercises shared varops budgets, conditional charging, partial failures, and
+// final stack truthiness at exact and insufficient budget boundaries.
+
+#include <script/script.h>
+#include <script/script_error.h>
+#include <script/varops.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/tapscript_v2_fuzz_util.h>
+#include <util/check.h>
+
+#include <cstdint>
+
+namespace {
+using namespace test::tapscript_v2;
+using namespace test::tapscript_v2::fuzz;
+
+void VerifyPair(const LeafSpend& first, uint64_t first_cost, const LeafSpend& second, uint64_t second_cost)
+{
+    const BaseSignatureChecker checker;
+    {
+        varops::Budget budget{first_cost + second_cost};
+        ScriptError error{SCRIPT_ERR_UNKNOWN_ERROR};
+        Assert(VerifySpend(first, TAPSCRIPT_V2_SCRIPT_VERIFY_FLAGS, checker, budget, error));
+        Assert(error == SCRIPT_ERR_OK);
+        Assert(*budget.Remaining() == second_cost);
+        Assert(VerifySpend(second, TAPSCRIPT_V2_SCRIPT_VERIFY_FLAGS, checker, budget, error));
+        Assert(error == SCRIPT_ERR_OK);
+        Assert(*budget.Remaining() == 0);
+    }
+    {
+        varops::Budget budget{first_cost + second_cost - 1};
+        ScriptError error{SCRIPT_ERR_UNKNOWN_ERROR};
+        Assert(VerifySpend(first, TAPSCRIPT_V2_SCRIPT_VERIFY_FLAGS, checker, budget, error));
+        Assert(error == SCRIPT_ERR_OK);
+        Assert(*budget.Remaining() == second_cost - 1);
+        Assert(!VerifySpend(second, TAPSCRIPT_V2_SCRIPT_VERIFY_FLAGS, checker, budget, error));
+        Assert(error == SCRIPT_ERR_VAROP_COUNT);
+    }
+}
+
+void CheckSharedBudget(FuzzedDataProvider& provider)
+{
+    Bytes a{ConsumeElement(provider)};
+    Bytes b{ConsumeElement(provider)};
+    if (a.empty()) a.push_back(1);
+    if (b.empty()) b.push_back(2);
+
+    CScript script;
+    script << OP_DUP << OP_EQUAL;
+    const LeafSpend spend_a{BuildLeafSpend(script, {a})};
+    const LeafSpend spend_b{BuildLeafSpend(script, {b})};
+    const uint64_t cost_a{CopyCost(a.size()) + EqualCost(a.size(), a.size()) + CompareZeroCost(1)};
+    const uint64_t cost_b{CopyCost(b.size()) + EqualCost(b.size(), b.size()) + CompareZeroCost(1)};
+    VerifyPair(spend_a, cost_a, spend_b, cost_b);
+    VerifyPair(spend_b, cost_b, spend_a, cost_a);
+}
+
+void CheckConditionalBudget(FuzzedDataProvider& provider)
+{
+    const Bytes element{ConsumeElement(provider)};
+    const bool condition{provider.ConsumeBool()};
+    const opcodetype conditional{provider.ConsumeBool() ? OP_IF : OP_NOTIF};
+    const bool first_branch_executes{condition == (conditional == OP_IF)};
+    const bool costed_first{provider.ConsumeBool()};
+    const bool nested{provider.ConsumeBool()};
+
+    CScript script;
+    script << (condition ? OP_1 : OP_0) << conditional;
+    const auto append_branch = [&](bool costed) {
+        if (!costed) {
+            script << OP_NOP;
+        } else if (nested) {
+            script << OP_1 << OP_IF << OP_DUP << OP_ENDIF;
+        } else {
+            script << OP_DUP;
+        }
+    };
+    append_branch(costed_first);
+    script << OP_ELSE;
+    append_branch(!costed_first);
+    script << OP_ENDIF;
+
+    const bool duplicates{first_branch_executes == costed_first};
+    const Stack expected{duplicates ? Stack{element, element} : Stack{element}};
+    CheckExactEval(script, {element}, expected, duplicates ? CopyCost(element.size()) : 0);
+}
+
+void CheckPartialFailure(FuzzedDataProvider& provider)
+{
+    switch (provider.ConsumeIntegralInRange<uint8_t>(0, 2)) {
+    case 0: {
+        Bytes element{ConsumeElement(provider)};
+        if (element.empty()) element.push_back(1);
+        CScript script;
+        script << OP_DUP << OP_FROMALTSTACK;
+        const uint64_t copy_cost{CopyCost(element.size())};
+        const uint64_t extra{provider.ConsumeIntegralInRange<uint64_t>(0, 1'000'000)};
+        CheckEvalErrorBudget(script, {element}, copy_cost + extra, SCRIPT_ERR_INVALID_ALTSTACK_OPERATION, extra);
+        CheckEvalErrorBudget(script, {element}, copy_cost - 1, SCRIPT_ERR_VAROP_COUNT, copy_cost - 1);
+        break;
+    }
+    case 1: {
+        const Bytes a{ConsumeElement(provider)};
+        Bytes b{ConsumeElement(provider)};
+        if (b.empty()) b.push_back(1);
+        CScript script;
+        script << OP_DUP << OP_CAT;
+        const uint64_t dup_cost{CopyCost(b.size())};
+        const uint64_t cat_cost{CopyCost(2 * b.size())};
+        CheckEvalErrorBudget(script, {a, b}, dup_cost + cat_cost - 1, SCRIPT_ERR_VAROP_COUNT, cat_cost - 1);
+        break;
+    }
+    case 2: {
+        const uint64_t budget{provider.ConsumeIntegralInRange<uint64_t>(0, 1'000'000)};
+        const opcodetype opcode{provider.PickValueInArray<opcodetype>({OP_DUP, OP_CAT, OP_FROMALTSTACK})};
+        CheckEvalErrorBudget(
+            OneOp(opcode),
+            {},
+            budget,
+            opcode == OP_FROMALTSTACK ? SCRIPT_ERR_INVALID_ALTSTACK_OPERATION : SCRIPT_ERR_INVALID_STACK_OPERATION,
+            budget);
+        break;
+    }
+    }
+}
+
+void CheckFinalSuccess(FuzzedDataProvider& provider)
+{
+    Stack stack;
+    const size_t count{provider.ConsumeIntegralInRange<size_t>(0, 2)};
+    for (size_t i{0}; i < count; ++i)
+        stack.push_back(ConsumeElement(provider));
+
+    const LeafSpend spend{BuildLeafSpend(CScript{}, stack)};
+    const BaseSignatureChecker checker;
+    if (stack.size() != 1) {
+        const VerifyOutcome outcome{VerifySpend(spend, TAPSCRIPT_V2_SCRIPT_VERIFY_FLAGS, checker, 1'000'000)};
+        Assert(!outcome.ok);
+        Assert(outcome.error == SCRIPT_ERR_CLEANSTACK);
+        Assert(outcome.remaining_budget == 1'000'000);
+        return;
+    }
+
+    const uint64_t cost{CompareZeroCost(stack.back().size())};
+    const VerifyOutcome exact{VerifySpend(spend, TAPSCRIPT_V2_SCRIPT_VERIFY_FLAGS, checker, cost)};
+    Assert(exact.ok == ContainsNonZero(stack.back()));
+    Assert(exact.error == (exact.ok ? SCRIPT_ERR_OK : SCRIPT_ERR_EVAL_FALSE));
+    Assert(exact.remaining_budget == 0);
+    if (cost > 0) {
+        const VerifyOutcome low{VerifySpend(spend, TAPSCRIPT_V2_SCRIPT_VERIFY_FLAGS, checker, cost - 1)};
+        Assert(!low.ok);
+        Assert(low.error == SCRIPT_ERR_VAROP_COUNT);
+    }
+}
+} // namespace
+
+FUZZ_TARGET(tapscript_v2_budget_accounting)
+{
+    FuzzedDataProvider provider{buffer.data(), buffer.size()};
+    switch (provider.ConsumeIntegralInRange<uint8_t>(0, 3)) {
+    case 0: CheckSharedBudget(provider); break;
+    case 1: CheckConditionalBudget(provider); break;
+    case 2: CheckPartialFailure(provider); break;
+    case 3: CheckFinalSuccess(provider); break;
+    }
+}
diff --git a/src/test/fuzz/tapscript_v2_eval_invariants.cpp b/src/test/fuzz/tapscript_v2_eval_invariants.cpp
new file mode 100644
index 000000000000..439ff215af1b
--- /dev/null
+++ b/src/test/fuzz/tapscript_v2_eval_invariants.cpp
@@ -0,0 +1,242 @@
+// Copyright (c) 2026 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or https://opensource.org/license/mit/.
+
+// Checks Tapscript-v2 budget monotonicity, script-restoration flag gating, and
+// successful stack-resource invariants.
+
+#include <key.h>
+#include <script/interpreter.h>
+#include <script/script.h>
+#include <script/valtype_stack.h>
+#include <script/varops.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/tapscript_v2_fuzz_util.h>
+#include <test/fuzz/util.h>
+#include <util/check.h>
+
+#include <algorithm>
+#include <cstdint>
+#include <limits>
+#include <vector>
+
+namespace {
+using namespace test::tapscript_v2;
+using namespace test::tapscript_v2::fuzz;
+
+class StableChecker final : public BaseSignatureChecker
+{
+    bool m_signature_result;
+    bool m_locktime_result;
+    bool m_sequence_result;
+    bool m_template_result;
+
+public:
+    explicit StableChecker(FuzzedDataProvider& provider) : m_signature_result{provider.ConsumeBool()},
+                                                           m_locktime_result{provider.ConsumeBool()},
+                                                           m_sequence_result{provider.ConsumeBool()},
+                                                           m_template_result{provider.ConsumeBool()}
+    {
+    }
+
+    bool CheckSchnorrSignature(Span<const unsigned char>,
+                               KeyVersion,
+                               Span<const unsigned char>,
+                               SigVersion,
+                               ScriptExecutionData&,
+                               ScriptError*) const override
+    {
+        return m_signature_result;
+    }
+
+    bool CheckLockTime(const CScriptNum&) const override
+    {
+        return m_locktime_result;
+    }
+
+    bool CheckSequence(const CScriptNum&) const override
+    {
+        return m_sequence_result;
+    }
+
+    bool CheckDefaultCheckTemplateVerifyHash(const Span<const unsigned char>&) const override
+    {
+        return m_template_result;
+    }
+};
+
+struct RawEvalOutcome {
+    bool ok{false};
+    ScriptError error{SCRIPT_ERR_UNKNOWN_ERROR};
+    uint64_t remaining_budget{0};
+    Stack stack;
+    size_t total_stack_size{0};
+    size_t max_element_size{0};
+};
+
+std::vector<unsigned char> ConsumeStackElement(FuzzedDataProvider& provider)
+{
+    if (provider.ConsumeIntegralInRange<uint8_t>(0, 31) == 0) {
+        const size_t size{provider.ConsumeIntegralInRange<size_t>(0, 64 * 1024)};
+        std::vector<unsigned char> elem(size);
+        const std::vector<unsigned char> seed{
+            provider.ConsumeBytes<unsigned char>(std::min<size_t>(provider.remaining_bytes(), 16))};
+        if (seed.empty()) return elem;
+        for (size_t i{0}; i < elem.size(); ++i) {
+            elem[i] = static_cast<unsigned char>(seed[i % seed.size()] + i);
+        }
+        return elem;
+    }
+    return ConsumeRandomLengthByteVector(provider, 128);
+}
+
+Stack ConsumeStack(FuzzedDataProvider& provider)
+{
+    const size_t max_stack_size{provider.ConsumeIntegralInRange<uint8_t>(0, 15) == 0 ? size_t{64} : size_t{16}};
+    const size_t stack_size{provider.ConsumeIntegralInRange<size_t>(0, max_stack_size)};
+    Stack stack;
+    stack.reserve(stack_size);
+    for (size_t i{0}; i < stack_size; ++i) {
+        stack.push_back(ConsumeStackElement(provider));
+    }
+    return stack;
+}
+
+opcodetype ConsumeUsefulOpcode(FuzzedDataProvider& provider)
+{
+    return provider.PickValueInArray<opcodetype>({
+        OP_0, OP_1, OP_2, OP_3, OP_NOP, OP_IF, OP_NOTIF, OP_ELSE, OP_ENDIF,
+        OP_VERIFY, OP_TOALTSTACK, OP_FROMALTSTACK, OP_DROP, OP_DUP, OP_NIP,
+        OP_OVER, OP_PICK, OP_ROLL, OP_ROT, OP_SWAP, OP_TUCK, OP_SIZE, OP_EQUAL,
+        OP_EQUALVERIFY, OP_1ADD, OP_1SUB, OP_2MUL, OP_2DIV, OP_INVERT, OP_AND,
+        OP_OR, OP_XOR, OP_ADD, OP_SUB, OP_BOOLAND, OP_BOOLOR, OP_NUMEQUAL,
+        OP_NUMEQUALVERIFY, OP_NUMNOTEQUAL, OP_LESSTHAN, OP_GREATERTHAN,
+        OP_LESSTHANOREQUAL, OP_GREATERTHANOREQUAL, OP_MIN, OP_MAX, OP_WITHIN,
+        OP_MUL, OP_DIV, OP_MOD, OP_LSHIFT, OP_RSHIFT, OP_CAT, OP_SUBSTR, OP_LEFT,
+        OP_RIGHT, OP_RIPEMD160, OP_SHA1, OP_SHA256, OP_HASH160, OP_HASH256,
+        OP_CHECKLOCKTIMEVERIFY, OP_CHECKSEQUENCEVERIFY, OP_CHECKSIG,
+        OP_CHECKSIGVERIFY, OP_CHECKSIGADD, OP_INTERNALKEY, OP_CHECKSIGFROMSTACK,
+        OP_TEMPLATEHASH, OP_CODESEPARATOR,
+    });
+}
+
+CScript ConsumeTapscriptV2Script(FuzzedDataProvider& provider)
+{
+    if (provider.ConsumeBool()) {
+        const std::vector<unsigned char> bytes{ConsumeRandomLengthByteVector(provider, 1024)};
+        return CScript{bytes.begin(), bytes.end()};
+    }
+
+    CScript script;
+    const size_t ops{provider.ConsumeIntegralInRange<size_t>(0, 64)};
+    for (size_t i{0}; i < ops; ++i) {
+        if (provider.ConsumeIntegralInRange<uint8_t>(0, 3) == 0) {
+            script << ConsumeRandomLengthByteVector(provider, 128);
+        } else {
+            script << ConsumeUsefulOpcode(provider);
+        }
+    }
+    return script;
+}
+
+uint64_t ConsumeBudget(FuzzedDataProvider& provider)
+{
+    if (provider.ConsumeIntegralInRange<uint8_t>(0, 15) == 0) {
+        return provider.ConsumeIntegralInRange<uint64_t>(0, 500'000'000);
+    }
+    return provider.ConsumeIntegralInRange<uint64_t>(0, 1'000'000);
+}
+
+RawEvalOutcome EvalWithBudget(const CScript& script,
+                              const Stack& initial_stack,
+                              script_verify_flags flags,
+                              const BaseSignatureChecker& checker,
+                              uint64_t budget)
+{
+    ValtypeStack stack{initial_stack};
+    ScriptExecutionData execdata;
+    execdata.m_internal_key = XOnlyPubKey::NUMS_H;
+    execdata.m_annex_present = false;
+    execdata.m_annex_init = true;
+
+    ScriptError error{SCRIPT_ERR_UNKNOWN_ERROR};
+    varops::Budget varops_budget{budget};
+    const bool ok{EvalTapscriptV2(stack, script, flags, checker, execdata, varops_budget, &error)};
+    return {
+        ok,
+        error,
+        *varops_budget.Remaining(),
+        stack.GetStack(),
+        stack.GetTotalSize(),
+        stack.GetMaxElementSize(),
+    };
+}
+
+void AssertSuccessfulStackLimits(const RawEvalOutcome& outcome)
+{
+    if (!outcome.ok) return;
+    size_t actual_total_size{0};
+    for (const auto& element : outcome.stack) {
+        actual_total_size += element.size();
+        Assert(element.size() <= MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE);
+    }
+    Assert(actual_total_size == outcome.total_stack_size);
+    Assert(outcome.stack.size() <= MAX_TAPSCRIPT_V2_STACK_SIZE);
+    Assert(outcome.total_stack_size <= MAX_TAPSCRIPT_V2_TOTAL_STACK_SIZE);
+    Assert(outcome.max_element_size <= MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE);
+}
+
+void CheckScriptRestorationFlagGate(const CScript& leaf_script,
+                                    const Stack& initial_stack,
+                                    const BaseSignatureChecker& checker,
+                                    uint64_t budget)
+{
+    const LeafSpend spend{BuildLeafSpend(leaf_script, initial_stack)};
+    const VerifyOutcome loose{VerifySpend(spend, TAPROOT_SCRIPT_VERIFY_FLAGS, checker, budget)};
+    Assert(loose.ok);
+    Assert(loose.error == SCRIPT_ERR_OK);
+    Assert(loose.remaining_budget == budget);
+
+    const VerifyOutcome discouraged{VerifySpend(
+        spend,
+        TAPROOT_SCRIPT_VERIFY_FLAGS | SCRIPT_VERIFY_DISCOURAGE_SCRIPT_RESTORATION,
+        checker, budget)};
+    Assert(!discouraged.ok);
+    Assert(discouraged.error == SCRIPT_ERR_DISCOURAGE_SCRIPT_RESTORATION);
+    Assert(discouraged.remaining_budget == budget);
+
+    const VerifyOutcome strict{VerifySpend(spend, TAPSCRIPT_V2_SCRIPT_VERIFY_FLAGS, checker, budget)};
+    Assert(strict.error != SCRIPT_ERR_DISCOURAGE_SCRIPT_RESTORATION);
+    Assert(strict.remaining_budget <= budget);
+}
+} // namespace
+
+FUZZ_TARGET(tapscript_v2_eval_invariants)
+{
+    FuzzedDataProvider provider{buffer.data(), buffer.size()};
+    const CScript script{ConsumeTapscriptV2Script(provider)};
+    const Stack stack{ConsumeStack(provider)};
+    const script_verify_flags flags{
+        script_verify_flags::from_int(provider.ConsumeIntegral<script_verify_flags::value_type>())};
+    const uint64_t budget{ConsumeBudget(provider)};
+    const StableChecker checker{provider};
+
+    const RawEvalOutcome outcome{EvalWithBudget(script, stack, flags, checker, budget)};
+    AssertSuccessfulStackLimits(outcome);
+    Assert(outcome.remaining_budget <= budget);
+
+    if (outcome.ok && budget < std::numeric_limits<uint64_t>::max()) {
+        constexpr uint64_t budget_increment{1'000'000};
+        const uint64_t higher_budget{budget > std::numeric_limits<uint64_t>::max() - budget_increment ?
+                                         std::numeric_limits<uint64_t>::max() :
+                                         budget + budget_increment};
+        const RawEvalOutcome higher_budget_outcome{EvalWithBudget(script, stack, flags, checker, higher_budget)};
+        Assert(higher_budget_outcome.ok);
+        Assert(higher_budget_outcome.stack == outcome.stack);
+        Assert(higher_budget - higher_budget_outcome.remaining_budget == budget - outcome.remaining_budget);
+        AssertSuccessfulStackLimits(higher_budget_outcome);
+    }
+
+    CheckScriptRestorationFlagGate(script, stack, checker, budget);
+}
diff --git a/src/test/fuzz/tapscript_v2_fuzz_util.h b/src/test/fuzz/tapscript_v2_fuzz_util.h
new file mode 100644
index 000000000000..3057a6bc87e1
--- /dev/null
+++ b/src/test/fuzz/tapscript_v2_fuzz_util.h
@@ -0,0 +1,207 @@
+// Copyright (c) 2026 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or https://opensource.org/license/mit/.
+
+#ifndef BITCOIN_TEST_FUZZ_TAPSCRIPT_V2_FUZZ_UTIL_H
+#define BITCOIN_TEST_FUZZ_TAPSCRIPT_V2_FUZZ_UTIL_H
+
+#include <script/interpreter.h>
+#include <script/script.h>
+#include <script/script_error.h>
+#include <script/varops.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/util.h>
+#include <test/util/tapscript_v2_test_utils.h>
+#include <util/check.h>
+
+#include <algorithm>
+#include <cstdint>
+#include <limits>
+#include <utility>
+#include <vector>
+
+namespace test::tapscript_v2::fuzz {
+
+using Bytes = std::vector<unsigned char>;
+
+// These BIP 440 coefficients intentionally do not use production varops
+// helpers, keeping expected costs independent from the code under test.
+inline constexpr uint64_t COST_FAST{2};
+inline constexpr uint64_t COST_COPYING{3};
+inline constexpr uint64_t COST_ARITH{6};
+inline constexpr uint64_t COST_ROLL{48};
+inline constexpr uint64_t COST_PER_SIGOP{500'000};
+
+inline uint64_t W(size_t size)
+{
+    const uint64_t size_u64{size};
+    Assert(size_u64 <= std::numeric_limits<uint64_t>::max() - 7);
+    return (size_u64 + 7) / 8 * 8;
+}
+
+inline uint64_t CopyCost(size_t size) { return static_cast<uint64_t>(size) * COST_COPYING; }
+inline uint64_t CompareZeroCost(size_t size) { return W(size) * COST_FAST; }
+inline uint64_t LengthCost(size_t size) { return W(size) * COST_FAST; }
+inline uint64_t EqualCost(size_t a, size_t b) { return a == b ? static_cast<uint64_t>(a) * COST_FAST : 0; }
+inline uint64_t RollCost(size_t encoded_size, uint64_t depth) { return LengthCost(encoded_size) + depth * COST_ROLL; }
+inline uint64_t ChecksigAddCost(size_t size) { return std::max(W(1), W(size)) * (COST_ARITH + COST_COPYING); }
+
+inline bool ContainsNonZero(const Bytes& bytes)
+{
+    return std::ranges::any_of(bytes, [](unsigned char byte) { return byte != 0; });
+}
+
+inline Bytes Normalize(Bytes bytes)
+{
+    while (!bytes.empty() && bytes.back() == 0)
+        bytes.pop_back();
+    return bytes;
+}
+
+inline Bytes Increment(Bytes bytes)
+{
+    bytes = Normalize(std::move(bytes));
+    for (unsigned char& byte : bytes) {
+        if (byte != 0xff) {
+            ++byte;
+            return bytes;
+        }
+        byte = 0;
+    }
+    bytes.push_back(1);
+    return bytes;
+}
+
+inline Bytes ToLittleEndian(uint64_t value)
+{
+    Bytes bytes;
+    while (value != 0) {
+        bytes.push_back(static_cast<unsigned char>(value));
+        value >>= 8;
+    }
+    return bytes;
+}
+
+inline uint64_t ToU64Ceil(const Bytes& bytes, uint64_t maximum)
+{
+    if (bytes.size() > 8 &&
+        std::ranges::any_of(bytes.begin() + 8, bytes.end(), [](unsigned char byte) { return byte != 0; })) {
+        return maximum;
+    }
+    uint64_t value{0};
+    for (size_t i{std::min<size_t>(bytes.size(), 8)}; i > 0; --i) {
+        value = (value << 8) | bytes[i - 1];
+    }
+    return std::min(value, maximum);
+}
+
+inline Bytes ConsumeElement(FuzzedDataProvider& provider, size_t maximum = 256)
+{
+    std::vector<size_t> sizes{0, 1, 2, 7, 8, 9, 31, 32, 63, 64, 127, 128, 255, 256};
+    std::erase_if(sizes, [&](size_t size) { return size > maximum; });
+    if (sizes.empty() || sizes.back() != maximum) sizes.push_back(maximum);
+    if (!provider.ConsumeBool()) return ConsumeRandomLengthByteVector(provider, maximum);
+
+    Bytes bytes(sizes.at(provider.ConsumeIntegralInRange<size_t>(0, sizes.size() - 1)));
+    const uint8_t mode{provider.ConsumeIntegralInRange<uint8_t>(0, 3)};
+    if (bytes.empty()) return bytes;
+    switch (mode) {
+    case 0:
+        break;
+    case 1:
+        std::ranges::fill(bytes, 0xff);
+        break;
+    case 2:
+        bytes.back() = 1;
+        break;
+    case 3: {
+        const Bytes input{provider.ConsumeBytes<unsigned char>(std::min(bytes.size(), provider.remaining_bytes()))};
+        std::ranges::copy(input, bytes.begin());
+        break;
+    }
+    }
+    return bytes;
+}
+
+inline void AssertStackEqual(const Stack& actual, const Stack& expected)
+{
+    Assert(actual == expected);
+}
+
+inline void CheckExactEval(const CScript& script,
+                           const Stack& initial_stack,
+                           const Stack& expected_stack,
+                           uint64_t expected_cost)
+{
+    const BaseSignatureChecker checker;
+    const EvalOutcome exact{
+        EvalTapscriptV2WithFlagsAndChecker(script, initial_stack, SCRIPT_VERIFY_NONE, checker, expected_cost)};
+    Assert(exact.ok);
+    Assert(exact.error == SCRIPT_ERR_OK);
+    Assert(exact.remaining_budget == 0);
+    AssertStackEqual(exact.stack, expected_stack);
+
+    if (expected_cost > 0) {
+        const EvalOutcome low{
+            EvalTapscriptV2WithFlagsAndChecker(script, initial_stack, SCRIPT_VERIFY_NONE, checker, expected_cost - 1)};
+        Assert(!low.ok);
+        Assert(low.error == SCRIPT_ERR_VAROP_COUNT);
+    }
+}
+
+inline void CheckEvalErrorBudget(const CScript& script,
+                                 const Stack& initial_stack,
+                                 uint64_t budget,
+                                 ScriptError expected_error,
+                                 uint64_t expected_remaining)
+{
+    const BaseSignatureChecker checker;
+    const EvalOutcome outcome{
+        EvalTapscriptV2WithFlagsAndChecker(script, initial_stack, SCRIPT_VERIFY_NONE, checker, budget)};
+    Assert(!outcome.ok);
+    Assert(outcome.error == expected_error);
+    Assert(outcome.remaining_budget == expected_remaining);
+}
+
+struct LeafSpend {
+    CScript script_pub_key;
+    CScriptWitness witness;
+};
+
+inline LeafSpend BuildLeafSpend(const CScript& script, const Stack& stack)
+{
+    CScript script_pub_key;
+    CScriptWitness witness{BuildTapscriptV2Witness(script, stack, script_pub_key)};
+    return {std::move(script_pub_key), std::move(witness)};
+}
+
+inline bool VerifySpend(const LeafSpend& spend,
+                        script_verify_flags flags,
+                        const BaseSignatureChecker& checker,
+                        varops::Budget& budget,
+                        ScriptError& error)
+{
+    error = SCRIPT_ERR_UNKNOWN_ERROR;
+    return VerifyScript(CScript{}, spend.script_pub_key, &spend.witness, flags, checker, &error, budget);
+}
+
+struct VerifyOutcome {
+    bool ok{false};
+    ScriptError error{SCRIPT_ERR_UNKNOWN_ERROR};
+    uint64_t remaining_budget{0};
+};
+
+inline VerifyOutcome VerifySpend(const LeafSpend& spend,
+                                 script_verify_flags flags,
+                                 const BaseSignatureChecker& checker,
+                                 uint64_t budget)
+{
+    varops::Budget varops_budget{budget};
+    ScriptError error{SCRIPT_ERR_UNKNOWN_ERROR};
+    const bool ok{VerifySpend(spend, flags, checker, varops_budget, error)};
+    return {ok, error, *varops_budget.Remaining()};
+}
+
+} // namespace test::tapscript_v2::fuzz
+
+#endif // BITCOIN_TEST_FUZZ_TAPSCRIPT_V2_FUZZ_UTIL_H
diff --git a/src/test/fuzz/tapscript_v2_signature_timelock.cpp b/src/test/fuzz/tapscript_v2_signature_timelock.cpp
new file mode 100644
index 000000000000..fd2eecd693dc
--- /dev/null
+++ b/src/test/fuzz/tapscript_v2_signature_timelock.cpp
@@ -0,0 +1,270 @@
+// Copyright (c) 2026 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or https://opensource.org/license/mit/.
+
+// Exercises Tapscript-v2 signature, locktime, sequence, internal-key, and
+// template-hash behavior across checker results and malformed operands.
+
+#include <primitives/transaction.h>
+#include <script/interpreter.h>
+#include <script/script.h>
+#include <script/signingprovider.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/tapscript_v2_fuzz_util.h>
+#include <test/util/tapscript_v2_test_utils.h>
+#include <util/check.h>
+
+#include <cstdint>
+
+namespace {
+using namespace test::tapscript_v2;
+using namespace test::tapscript_v2::fuzz;
+
+void CheckSignatureOpcode(FuzzedDataProvider& provider)
+{
+    const opcodetype opcode{provider.PickValueInArray<opcodetype>({OP_CHECKSIG, OP_CHECKSIGVERIFY, OP_CHECKSIGADD})};
+    const bool checksigadd{opcode == OP_CHECKSIGADD};
+    const bool nonempty_sig{provider.ConsumeBool()};
+    const Bytes signature{nonempty_sig ? Bytes(64, 0x01) : Bytes{}};
+
+    Bytes pubkey;
+    switch (provider.ConsumeIntegralInRange<uint8_t>(0, 5)) {
+    case 0: break;
+    case 1: pubkey.assign(32, 0x02); break;
+    case 2: pubkey = {BIP118_PUBKEY_PREFIX}; break;
+    case 3:
+        pubkey.assign(33, 0x02);
+        pubkey.front() = BIP118_PUBKEY_PREFIX;
+        break;
+    case 4: pubkey.assign(33, 0x03); break;
+    case 5: pubkey.assign(65, 0x04); break;
+    }
+
+    const Bytes number{checksigadd ? ConsumeElement(provider) : Bytes{}};
+    const Stack initial{checksigadd ? Stack{signature, number, pubkey} : Stack{signature, pubkey}};
+    const uint64_t cost{(nonempty_sig ? COST_PER_SIGOP : 0) + (checksigadd ? ChecksigAddCost(number.size()) : 0)};
+    const bool xonly{pubkey.size() == 32};
+    const bool upgradable{!pubkey.empty() && !xonly};
+    const bool anyprevout{
+        upgradable && (pubkey.size() == 1 || pubkey.size() == 33) &&
+        pubkey.front() == BIP118_PUBKEY_PREFIX};
+
+    RecordingChecker checker;
+    const EvalOutcome exact{
+        EvalTapscriptV2WithFlagsAndChecker(OneOp(opcode), initial, SCRIPT_VERIFY_NONE, checker, cost)};
+    if (pubkey.empty()) {
+        Assert(!exact.ok);
+        Assert(exact.error == SCRIPT_ERR_PUBKEYTYPE);
+    } else if (opcode == OP_CHECKSIGVERIFY && !nonempty_sig) {
+        Assert(!exact.ok);
+        Assert(exact.error == SCRIPT_ERR_CHECKSIGVERIFY);
+    } else {
+        Assert(exact.ok);
+        Assert(exact.error == SCRIPT_ERR_OK);
+        if (opcode == OP_CHECKSIG) {
+            AssertStackEqual(exact.stack, {nonempty_sig ? Bytes{1} : Bytes{}});
+        } else if (opcode == OP_CHECKSIGVERIFY) {
+            Assert(exact.stack.empty());
+        } else {
+            AssertStackEqual(exact.stack, {nonempty_sig ? Increment(number) : Normalize(number)});
+        }
+    }
+    Assert(exact.remaining_budget == 0);
+    Assert(checker.schnorr_calls == (xonly && nonempty_sig ? 1 : 0));
+    if (checker.schnorr_calls == 1) {
+        Assert(checker.last_sigversion == SigVersion::TAPSCRIPT_V2);
+        Assert(checker.last_keyversion == KeyVersion::TAPROOT);
+        Assert(checker.last_codeseparator_pos == 0xFFFFFFFFUL);
+    }
+
+    if (cost > 0) {
+        RecordingChecker low_checker;
+        const EvalOutcome low{
+            EvalTapscriptV2WithFlagsAndChecker(OneOp(opcode), initial, SCRIPT_VERIFY_NONE, low_checker, cost - 1)};
+        Assert(!low.ok);
+        Assert(low.error == SCRIPT_ERR_VAROP_COUNT);
+        Assert(low.remaining_budget == cost - 1);
+        Assert(low_checker.schnorr_calls == 0);
+    }
+
+    if (anyprevout) {
+        RecordingChecker anyprevout_checker;
+        const EvalOutcome with_flags{EvalTapscriptV2WithFlagsAndChecker(
+            OneOp(opcode),
+            initial,
+            SCRIPT_VERIFY_ANYPREVOUT | SCRIPT_VERIFY_DISCOURAGE_ANYPREVOUT,
+            anyprevout_checker,
+            cost)};
+        Assert(with_flags.ok == exact.ok);
+        Assert(with_flags.error == exact.error);
+        Assert(with_flags.remaining_budget == exact.remaining_budget);
+        Assert(with_flags.stack == exact.stack);
+        Assert(anyprevout_checker.schnorr_calls == 0);
+    }
+
+    if (upgradable) {
+        RecordingChecker discouraged_checker;
+        const EvalOutcome discouraged{EvalTapscriptV2WithFlagsAndChecker(
+            OneOp(opcode), initial, SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_PUBKEYTYPE, discouraged_checker, cost)};
+        Assert(!discouraged.ok);
+        Assert(discouraged.error == SCRIPT_ERR_DISCOURAGE_UPGRADABLE_PUBKEYTYPE);
+        Assert(discouraged.remaining_budget == 0);
+        Assert(discouraged_checker.schnorr_calls == 0);
+    }
+}
+
+void CheckCodeseparator(FuzzedDataProvider& provider)
+{
+    const opcodetype opcode{provider.ConsumeBool() ? OP_CHECKSIG : OP_CHECKSIGVERIFY};
+    CScript script;
+    uint32_t position{0};
+    uint32_t expected{0xFFFFFFFFUL};
+    const auto append = [&](opcodetype op) {
+        script << op;
+        return position++;
+    };
+
+    const size_t segments{provider.ConsumeIntegralInRange<size_t>(0, 6)};
+    for (size_t i{0}; i < segments; ++i) {
+        switch (provider.ConsumeIntegralInRange<uint8_t>(0, 3)) {
+        case 0: expected = append(OP_CODESEPARATOR); break;
+        case 1:
+            append(OP_0);
+            append(OP_IF);
+            append(OP_CODESEPARATOR);
+            append(OP_ENDIF);
+            break;
+        case 2:
+            append(OP_1);
+            append(OP_IF);
+            expected = append(OP_CODESEPARATOR);
+            append(OP_ENDIF);
+            break;
+        case 3: append(OP_NOP); break;
+        }
+    }
+    append(opcode);
+
+    const Stack stack{Bytes(64, 0x01), Bytes(32, 0x02)};
+    RecordingChecker checker;
+    const EvalOutcome exact{
+        EvalTapscriptV2WithFlagsAndChecker(script, stack, SCRIPT_VERIFY_NONE, checker, COST_PER_SIGOP)};
+    Assert(exact.ok);
+    Assert(exact.error == SCRIPT_ERR_OK);
+    Assert(exact.remaining_budget == 0);
+    AssertStackEqual(exact.stack, opcode == OP_CHECKSIG ? Stack{Bytes{1}} : Stack{});
+    Assert(checker.schnorr_calls == 1);
+    Assert(checker.last_codeseparator_pos == expected);
+
+    RecordingChecker low_checker;
+    const EvalOutcome low{
+        EvalTapscriptV2WithFlagsAndChecker(script, stack, SCRIPT_VERIFY_NONE, low_checker, COST_PER_SIGOP - 1)};
+    Assert(!low.ok);
+    Assert(low.error == SCRIPT_ERR_VAROP_COUNT);
+    Assert(low_checker.schnorr_calls == 0);
+}
+
+void CheckRepeatedSigops(FuzzedDataProvider& provider)
+{
+    const uint8_t checks{provider.ConsumeIntegralInRange<uint8_t>(1, 8)};
+    CScript script;
+    for (uint8_t i{1}; i < checks; ++i)
+        script << OP_CHECKSIGVERIFY;
+    script << OP_CHECKSIG;
+
+    Stack stack;
+    for (uint8_t i{0}; i < checks; ++i) {
+        stack.insert(stack.begin(), Bytes(32, static_cast<unsigned char>(0x02 + i)));
+        stack.insert(stack.begin(), Bytes(64, static_cast<unsigned char>(0x11 + i)));
+    }
+
+    RecordingChecker checker;
+    const uint64_t exact_cost{static_cast<uint64_t>(checks) * COST_PER_SIGOP};
+    const EvalOutcome exact{EvalTapscriptV2WithFlagsAndChecker(script, stack, SCRIPT_VERIFY_NONE, checker, exact_cost)};
+    Assert(exact.ok);
+    AssertStackEqual(exact.stack, {Bytes{1}});
+    Assert(checker.schnorr_calls == checks);
+
+    const uint8_t completed{provider.ConsumeIntegralInRange<uint8_t>(0, checks - 1)};
+    RecordingChecker low_checker;
+    const uint64_t low_budget{static_cast<uint64_t>(completed) * COST_PER_SIGOP + COST_PER_SIGOP - 1};
+    const EvalOutcome low{
+        EvalTapscriptV2WithFlagsAndChecker(script, stack, SCRIPT_VERIFY_NONE, low_checker, low_budget)};
+    Assert(!low.ok);
+    Assert(low.error == SCRIPT_ERR_VAROP_COUNT);
+    Assert(low.remaining_budget == COST_PER_SIGOP - 1);
+    Assert(low_checker.schnorr_calls == completed);
+}
+
+Bytes ConsumeTimelockOperand(FuzzedDataProvider& provider)
+{
+    Bytes operand;
+    switch (provider.ConsumeIntegralInRange<uint8_t>(0, 7)) {
+    case 0: break;
+    case 1: operand = {1}; break;
+    case 2: operand = {0xff, 0xff, 0xff, 0xff}; break;
+    case 3: operand = {0x00, 0x00, 0x00, 0x00, 0x01}; break;
+    case 4: operand = {0x00, 0x00, 0x00, 0x80}; break;
+    case 5: operand = {0x00, 0x00, 0x00, 0x80, 0x01}; break;
+    case 6: operand = ToLittleEndian(provider.ConsumeIntegral<uint32_t>()); break;
+    case 7: operand = ConsumeElement(provider, 32); break;
+    }
+    if (provider.ConsumeBool()) {
+        operand.resize(provider.ConsumeIntegralInRange<size_t>(operand.size(), operand.size() + 8));
+    }
+    return operand;
+}
+
+void CheckTimelock(FuzzedDataProvider& provider)
+{
+    const bool sequence{provider.ConsumeBool()};
+    const Bytes operand{ConsumeTimelockOperand(provider)};
+    const uint64_t value{ToU64Ceil(operand, UINT64_C(0x100000000))};
+    const uint64_t cost{LengthCost(operand.size())};
+    const bool checker_result{provider.ConsumeBool()};
+    RecordingChecker checker{checker_result, checker_result};
+    const opcodetype opcode{sequence ? OP_CHECKSEQUENCEVERIFY : OP_CHECKLOCKTIMEVERIFY};
+    const script_verify_flags flags{sequence ? SCRIPT_VERIFY_CHECKSEQUENCEVERIFY : SCRIPT_VERIFY_CHECKLOCKTIMEVERIFY};
+    const EvalOutcome outcome{EvalTapscriptV2WithFlagsAndChecker(OneOp(opcode), {operand}, flags, checker, cost)};
+
+    if (value == UINT64_C(0x100000000)) {
+        Assert(!outcome.ok);
+        Assert(outcome.error == SCRIPT_ERR_UNSATISFIED_LOCKTIME);
+        Assert(outcome.remaining_budget == cost);
+        Assert(checker.locktime_calls == 0 && checker.sequence_calls == 0);
+        return;
+    }
+
+    const bool disabled{sequence && (value & CTxIn::SEQUENCE_LOCKTIME_DISABLE_FLAG) != 0};
+    if (disabled || checker_result) {
+        Assert(outcome.ok);
+        Assert(outcome.error == SCRIPT_ERR_OK);
+        Assert(outcome.remaining_budget == 0);
+        if (cost > 0) {
+            RecordingChecker low_checker;
+            const EvalOutcome low{
+                EvalTapscriptV2WithFlagsAndChecker(OneOp(opcode), {operand}, flags, low_checker, cost - 1)};
+            Assert(!low.ok);
+            Assert(low.error == SCRIPT_ERR_VAROP_COUNT);
+        }
+    } else {
+        Assert(!outcome.ok);
+        Assert(outcome.error == SCRIPT_ERR_UNSATISFIED_LOCKTIME);
+        Assert(outcome.remaining_budget == cost);
+    }
+    Assert(checker.locktime_calls == (sequence ? 0 : 1));
+    Assert(checker.sequence_calls == (sequence && !disabled ? 1 : 0));
+}
+} // namespace
+
+FUZZ_TARGET(tapscript_v2_signature_timelock)
+{
+    FuzzedDataProvider provider{buffer.data(), buffer.size()};
+    switch (provider.ConsumeIntegralInRange<uint8_t>(0, 3)) {
+    case 0: CheckSignatureOpcode(provider); break;
+    case 1: CheckCodeseparator(provider); break;
+    case 2: CheckRepeatedSigops(provider); break;
+    case 3: CheckTimelock(provider); break;
+    }
+}
diff --git a/src/test/fuzz/tapscript_v2_stack_programs.cpp b/src/test/fuzz/tapscript_v2_stack_programs.cpp
new file mode 100644
index 000000000000..61d32c720aeb
--- /dev/null
+++ b/src/test/fuzz/tapscript_v2_stack_programs.cpp
@@ -0,0 +1,229 @@
+// Copyright (c) 2026 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or https://opensource.org/license/mit/.
+
+// Generates short stack-manipulation programs and compares their evaluation
+// against an independently maintained expected stack and budget.
+
+#include <script/script.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/tapscript_v2_fuzz_util.h>
+
+#include <algorithm>
+#include <cstdint>
+#include <utility>
+
+namespace {
+using namespace test::tapscript_v2;
+using namespace test::tapscript_v2::fuzz;
+
+void RunStackProgram(FuzzedDataProvider& provider)
+{
+    Stack initial_stack;
+    const size_t initial_size{provider.ConsumeIntegralInRange<size_t>(0, 8)};
+    for (size_t i{0}; i < initial_size; ++i)
+        initial_stack.push_back(ConsumeElement(provider, 64));
+
+    Stack stack{initial_stack};
+    Stack altstack;
+    CScript script;
+    uint64_t cost{0};
+    const size_t steps{provider.ConsumeIntegralInRange<size_t>(1, 64)};
+
+    for (size_t step{0}; step < steps && stack.size() + altstack.size() <= 128; ++step) {
+        const uint8_t choice{provider.ConsumeIntegralInRange<uint8_t>(0, 22)};
+        switch (choice) {
+        case 0: {
+            const Bytes value{ConsumeElement(provider, 64)};
+            script << value;
+            stack.push_back(value);
+            break;
+        }
+        case 1:
+            if (!stack.empty()) {
+                script << OP_DROP;
+                stack.pop_back();
+            }
+            break;
+        case 2:
+            if (stack.size() >= 2) {
+                script << OP_2DROP;
+                stack.resize(stack.size() - 2);
+            }
+            break;
+        case 3:
+            if (!stack.empty()) {
+                script << OP_DUP;
+                cost += CopyCost(stack.back().size());
+                stack.push_back(stack.back());
+            }
+            break;
+        case 4:
+            if (stack.size() >= 2) {
+                script << OP_OVER;
+                const Bytes value{stack[stack.size() - 2]};
+                cost += CopyCost(value.size());
+                stack.push_back(value);
+            }
+            break;
+        case 5:
+            if (stack.size() >= 2) {
+                script << OP_TUCK;
+                const Bytes a{stack[stack.size() - 2]};
+                const Bytes b{stack.back()};
+                cost += CopyCost(b.size());
+                stack.resize(stack.size() - 2);
+                stack.insert(stack.end(), {b, a, b});
+            }
+            break;
+        case 6:
+            if (stack.size() >= 2) {
+                script << OP_2DUP;
+                const Bytes a{stack[stack.size() - 2]};
+                const Bytes b{stack.back()};
+                cost += CopyCost(a.size()) + CopyCost(b.size());
+                stack.insert(stack.end(), {a, b});
+            }
+            break;
+        case 7:
+            if (stack.size() >= 3) {
+                script << OP_3DUP;
+                const Bytes a{stack[stack.size() - 3]};
+                const Bytes b{stack[stack.size() - 2]};
+                const Bytes c{stack.back()};
+                cost += CopyCost(a.size()) + CopyCost(b.size()) + CopyCost(c.size());
+                stack.insert(stack.end(), {a, b, c});
+            }
+            break;
+        case 8:
+            if (stack.size() >= 4) {
+                script << OP_2OVER;
+                const Bytes a{stack[stack.size() - 4]};
+                const Bytes b{stack[stack.size() - 3]};
+                cost += CopyCost(a.size()) + CopyCost(b.size());
+                stack.insert(stack.end(), {a, b});
+            }
+            break;
+        case 9:
+            if (stack.size() >= 2) {
+                script << OP_NIP;
+                stack.erase(stack.end() - 2);
+            }
+            break;
+        case 10:
+            if (stack.size() >= 3) {
+                script << OP_ROT;
+                std::rotate(stack.end() - 3, stack.end() - 2, stack.end());
+            }
+            break;
+        case 11:
+            if (stack.size() >= 2) {
+                script << OP_SWAP;
+                std::swap(stack[stack.size() - 2], stack.back());
+            }
+            break;
+        case 12:
+            if (stack.size() >= 6) {
+                script << OP_2ROT;
+                std::rotate(stack.end() - 6, stack.end() - 4, stack.end());
+            }
+            break;
+        case 13:
+            if (stack.size() >= 4) {
+                script << OP_2SWAP;
+                std::rotate(stack.end() - 4, stack.end() - 2, stack.end());
+            }
+            break;
+        case 14:
+            if (!stack.empty()) {
+                script << OP_TOALTSTACK;
+                altstack.push_back(std::move(stack.back()));
+                stack.pop_back();
+            }
+            break;
+        case 15:
+            if (!altstack.empty()) {
+                script << OP_FROMALTSTACK;
+                stack.push_back(std::move(altstack.back()));
+                altstack.pop_back();
+            }
+            break;
+        case 16:
+            if (!stack.empty()) {
+                script << OP_SIZE;
+                stack.push_back(ToLittleEndian(stack.back().size()));
+            }
+            break;
+        case 17:
+            script << OP_DEPTH;
+            stack.push_back(ToLittleEndian(stack.size()));
+            break;
+        case 18:
+            if (stack.size() >= 2) {
+                script << OP_EQUAL;
+                const Bytes b{std::move(stack.back())};
+                stack.pop_back();
+                const Bytes a{std::move(stack.back())};
+                stack.pop_back();
+                cost += EqualCost(a.size(), b.size());
+                stack.push_back(a == b ? Bytes{1} : Bytes{});
+            }
+            break;
+        case 19:
+            if (!stack.empty()) {
+                const opcodetype opcode{provider.ConsumeBool() ? OP_NOT : OP_0NOTEQUAL};
+                script << opcode;
+                const bool nonzero{ContainsNonZero(stack.back())};
+                cost += CompareZeroCost(stack.back().size());
+                stack.back() = (opcode == OP_NOT ? !nonzero : nonzero) ? Bytes{1} : Bytes{};
+            }
+            break;
+        case 20:
+            if (!stack.empty()) {
+                script << OP_IFDUP;
+                const Bytes value{stack.back()};
+                cost += CompareZeroCost(value.size()) + CopyCost(value.size());
+                if (ContainsNonZero(value)) stack.push_back(value);
+            }
+            break;
+        case 21:
+        case 22:
+            if (!stack.empty()) {
+                const size_t depth{provider.ConsumeIntegralInRange<size_t>(0, std::min<size_t>(stack.size() - 1, 16))};
+                Bytes encoded{ToLittleEndian(depth)};
+                if (provider.ConsumeBool()) {
+                    encoded.resize(provider.ConsumeIntegralInRange<size_t>(encoded.size(), encoded.size() + 8));
+                }
+                const opcodetype opcode{choice == 21 ? OP_PICK : OP_ROLL};
+                script << encoded << opcode;
+                const size_t index{stack.size() - 1 - depth};
+                const Bytes value{stack[index]};
+                cost += LengthCost(encoded.size());
+                if (opcode == OP_PICK) {
+                    cost += CopyCost(value.size());
+                    stack.push_back(value);
+                } else {
+                    cost += depth * COST_ROLL;
+                    stack.erase(stack.begin() + index);
+                    stack.push_back(value);
+                }
+            }
+            break;
+        }
+    }
+
+    while (!altstack.empty()) {
+        script << OP_FROMALTSTACK;
+        stack.push_back(std::move(altstack.back()));
+        altstack.pop_back();
+    }
+    CheckExactEval(script, initial_stack, stack, cost);
+}
+} // namespace
+
+FUZZ_TARGET(tapscript_v2_stack_programs)
+{
+    FuzzedDataProvider provider{buffer.data(), buffer.size()};
+    RunStackProgram(provider);
+}
diff --git a/src/test/fuzz/tapscript_v2_stack_resource_limits.cpp b/src/test/fuzz/tapscript_v2_stack_resource_limits.cpp
new file mode 100644
index 000000000000..88190626a7c3
--- /dev/null
+++ b/src/test/fuzz/tapscript_v2_stack_resource_limits.cpp
@@ -0,0 +1,115 @@
+// Copyright (c) 2026 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or https://opensource.org/license/mit/.
+
+// Probes runtime stack-count and total-size boundaries, including altstack
+// copying and deep rolls, for Tapscript-v2 spends.
+
+#include <script/interpreter.h>
+#include <script/script.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/tapscript_v2_fuzz_util.h>
+#include <util/check.h>
+
+#include <algorithm>
+#include <cstdint>
+
+namespace {
+using namespace test::tapscript_v2;
+using namespace test::tapscript_v2::fuzz;
+
+void CheckAltstackCopyLimit(FuzzedDataProvider& provider)
+{
+    const size_t value_size{provider.PickValueInArray<size_t>({1, 2, 7, 8, 9, 64, 128, 256})};
+    const int64_t offset{provider.PickValueInArray<int64_t>({-1, 0, 1})};
+    const size_t final_total{static_cast<size_t>(static_cast<int64_t>(MAX_TAPSCRIPT_V2_TOTAL_STACK_SIZE) + offset)};
+    const size_t filler_total{final_total - 2 * value_size};
+    const size_t first_size{std::min<size_t>(filler_total, MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE)};
+    const size_t second_size{filler_total - first_size};
+    Assert(second_size <= MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE);
+
+    const Bytes value(value_size, 0x11);
+    Stack stack{value, Bytes(first_size, 0x22), Bytes(second_size, 0x33)};
+    CScript script;
+    script << OP_TOALTSTACK << OP_TOALTSTACK << OP_DUP;
+    const uint64_t cost{CopyCost(value_size)};
+
+    if (final_total <= MAX_TAPSCRIPT_V2_TOTAL_STACK_SIZE) {
+        CheckExactEval(script, stack, {value, value}, cost);
+    } else {
+        CheckEvalErrorBudget(script, stack, cost, SCRIPT_ERR_TOTAL_STACK_SIZE, cost);
+    }
+}
+
+void CheckDeepRoll(FuzzedDataProvider& provider)
+{
+    const size_t depth{provider.PickValueInArray<size_t>({0, 1, 16, 63, 255, 1'023, 4'095, 8'191,
+                                                          MAX_TAPSCRIPT_V2_STACK_SIZE - 2})};
+    Stack stack(depth + 1);
+    for (size_t i{0}; i < stack.size(); ++i) {
+        stack[i] = {static_cast<unsigned char>(i), static_cast<unsigned char>(i >> 8)};
+    }
+
+    Bytes encoded{ToLittleEndian(depth)};
+    if (provider.ConsumeBool()) {
+        encoded.resize(provider.ConsumeIntegralInRange<size_t>(encoded.size(), encoded.size() + 16));
+    }
+    CScript script;
+    script << encoded << OP_ROLL;
+
+    Stack expected{stack};
+    const Bytes selected{expected.front()};
+    expected.erase(expected.begin());
+    expected.push_back(selected);
+    CheckExactEval(script, stack, expected, RollCost(encoded.size(), depth));
+}
+
+void CheckCombinedElementCount(FuzzedDataProvider& provider)
+{
+    const size_t initial_count{provider.PickValueInArray<size_t>({MAX_TAPSCRIPT_V2_STACK_SIZE - 3,
+                                                                  MAX_TAPSCRIPT_V2_STACK_SIZE - 2,
+                                                                  MAX_TAPSCRIPT_V2_STACK_SIZE - 1,
+                                                                  MAX_TAPSCRIPT_V2_STACK_SIZE})};
+    const size_t moved_count{provider.ConsumeIntegralInRange<size_t>(1, 3)};
+    const size_t growth{provider.ConsumeIntegralInRange<size_t>(0, 3)};
+
+    Stack stack(initial_count);
+    for (size_t i{0}; i < moved_count; ++i) {
+        stack[initial_count - moved_count + i] = {static_cast<unsigned char>(0x80 + i)};
+    }
+
+    CScript script;
+    for (size_t i{0}; i < moved_count; ++i)
+        script << OP_TOALTSTACK;
+    switch (growth) {
+    case 0: script << OP_NOP; break;
+    case 1: script << OP_DUP; break;
+    case 2: script << OP_2DUP; break;
+    case 3: script << OP_3DUP; break;
+    }
+    for (size_t i{0}; i < moved_count; ++i)
+        script << OP_FROMALTSTACK;
+
+    if (initial_count + growth > MAX_TAPSCRIPT_V2_STACK_SIZE) {
+        CheckEvalErrorBudget(script, stack, 0, SCRIPT_ERR_STACK_SIZE, 0);
+        return;
+    }
+
+    const Stack::iterator moved_begin{stack.begin() + initial_count - moved_count};
+    Stack expected{stack.begin(), moved_begin};
+    expected.insert(expected.end(), growth, Bytes{});
+    expected.insert(expected.end(), moved_begin, stack.end());
+    CheckExactEval(script, stack, expected, 0);
+}
+} // namespace
+
+FUZZ_TARGET(tapscript_v2_stack_resource_limits)
+{
+    FuzzedDataProvider provider{buffer.data(), buffer.size()};
+    switch (provider.ConsumeIntegralInRange<uint8_t>(0, 2)) {
+    case 0: CheckAltstackCopyLimit(provider); break;
+    case 1: CheckDeepRoll(provider); break;
+    case 2: CheckCombinedElementCount(provider); break;
+    }
+}
diff --git a/src/test/fuzz/val64_ops.cpp b/src/test/fuzz/val64_ops.cpp
new file mode 100644
index 000000000000..880b8ed11609
--- /dev/null
+++ b/src/test/fuzz/val64_ops.cpp
@@ -0,0 +1,635 @@
+// Copyright (c) 2026 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or https://opensource.org/license/mit/.
+
+// Checks Val64 arithmetic, bitwise shifts, predicates, and large multiply,
+// divide, and modulo operations against independent integer properties.
+
+#include <script/script.h>
+#include <script/val64.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <util/check.h>
+
+#include <boost/multiprecision/cpp_int.hpp>
+
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <iterator>
+#include <limits>
+#include <optional>
+#include <utility>
+#include <vector>
+
+namespace {
+using boost::multiprecision::cpp_int;
+using Bytes = std::vector<unsigned char>;
+using OptionalBytes = std::optional<Bytes>;
+
+constexpr size_t MAX_NORMAL_OPERAND_SIZE{256};
+constexpr size_t MIN_LARGE_OPERAND_SIZE{257};
+constexpr size_t MAX_LARGE_OPERAND_SIZE{4 * 1024};
+
+// BIP 440 cost coefficients. These intentionally do not use the production
+// varops helpers so the fuzz target remains an independent cost oracle.
+constexpr uint64_t COST_FAST{2};
+constexpr uint64_t COST_COPYING{3};
+constexpr uint64_t COST_OTHER{4};
+constexpr uint64_t COST_ARITH{6};
+
+enum class ArithmeticOp : uint8_t {
+    ADD,
+    SUB,
+    ONE_ADD,
+    ONE_SUB,
+    TWO_MUL,
+    TWO_DIV,
+    MIN,
+    MAX,
+    MUL,
+    DIV,
+    MOD,
+};
+
+enum class BitwiseShiftOp : uint8_t {
+    INVERT,
+    AND,
+    OR,
+    XOR,
+    UPSHIFT,
+    DOWNSHIFT,
+};
+
+class Val64Fuzz final : public Val64
+{
+public:
+    explicit Val64Fuzz(Bytes bytes) : Val64(std::move(bytes)) {}
+
+    static void SetForcePortableMath(bool value) { Val64::m_force_portable_math = value; }
+};
+
+class ScopedPortableMath final
+{
+public:
+    explicit ScopedPortableMath(bool portable) { Val64Fuzz::SetForcePortableMath(portable); }
+    ~ScopedPortableMath() { Val64Fuzz::SetForcePortableMath(false); }
+
+    ScopedPortableMath(const ScopedPortableMath&) = delete;
+    ScopedPortableMath& operator=(const ScopedPortableMath&) = delete;
+};
+
+struct ActualResult {
+    OptionalBytes value;
+    std::optional<uint64_t> cost;
+};
+
+cpp_int FromLittleEndian(const Bytes& bytes)
+{
+    if (bytes.empty()) return 0;
+
+    cpp_int value{0};
+    boost::multiprecision::import_bits(value, bytes.begin(), bytes.end(), 8, /*msv_first=*/false);
+    return value;
+}
+
+Bytes ToMinimalLittleEndian(cpp_int value)
+{
+    Assert(value >= 0);
+    if (value == 0) return {};
+
+    Bytes bytes;
+    boost::multiprecision::export_bits(value, std::back_inserter(bytes), 8, /*msv_first=*/false);
+    return bytes;
+}
+
+uint64_t ToU64Ceil(const Bytes& bytes, uint64_t max)
+{
+    const cpp_int value{FromLittleEndian(bytes)};
+    if (value > max) return max;
+    return value.convert_to<uint64_t>();
+}
+
+uint64_t W(size_t size)
+{
+    const uint64_t bytes{static_cast<uint64_t>(size)};
+    return (bytes + 7) / 8 * 8;
+}
+
+uint64_t LengthConversionCost(size_t size)
+{
+    return W(size) * COST_FAST;
+}
+
+OptionalBytes ReferenceArithmetic(ArithmeticOp op, const Bytes& a, const Bytes& b)
+{
+    const cpp_int av{FromLittleEndian(a)};
+
+    switch (op) {
+    case ArithmeticOp::ADD:
+        return ToMinimalLittleEndian(av + FromLittleEndian(b));
+    case ArithmeticOp::SUB: {
+        const cpp_int bv{FromLittleEndian(b)};
+        if (av < bv) return std::nullopt;
+        return ToMinimalLittleEndian(av - bv);
+    }
+    case ArithmeticOp::ONE_ADD:
+        return ToMinimalLittleEndian(av + 1);
+    case ArithmeticOp::ONE_SUB:
+        if (av == 0) return std::nullopt;
+        return ToMinimalLittleEndian(av - 1);
+    case ArithmeticOp::TWO_MUL:
+        return ToMinimalLittleEndian(av * 2);
+    case ArithmeticOp::TWO_DIV:
+        return ToMinimalLittleEndian(av / 2);
+    case ArithmeticOp::MIN: {
+        const cpp_int bv{FromLittleEndian(b)};
+        return ToMinimalLittleEndian(std::min(av, bv));
+    }
+    case ArithmeticOp::MAX: {
+        const cpp_int bv{FromLittleEndian(b)};
+        return ToMinimalLittleEndian(std::max(av, bv));
+    }
+    case ArithmeticOp::MUL:
+        return ToMinimalLittleEndian(av * FromLittleEndian(b));
+    case ArithmeticOp::DIV: {
+        const cpp_int bv{FromLittleEndian(b)};
+        if (bv == 0) return std::nullopt;
+        return ToMinimalLittleEndian(av / bv);
+    }
+    case ArithmeticOp::MOD: {
+        const cpp_int bv{FromLittleEndian(b)};
+        if (bv == 0) return std::nullopt;
+        return ToMinimalLittleEndian(av % bv);
+    }
+    }
+    Assert(false);
+    return std::nullopt;
+}
+
+std::optional<uint64_t> ReferenceArithmeticCost(ArithmeticOp op, size_t a_size, size_t b_size)
+{
+    const uint64_t max_word_size{std::max(W(a_size), W(b_size))};
+
+    switch (op) {
+    case ArithmeticOp::ADD:
+        return max_word_size * (COST_ARITH + COST_COPYING);
+    case ArithmeticOp::SUB:
+        return max_word_size * COST_ARITH;
+    case ArithmeticOp::ONE_ADD:
+        return std::max(W(a_size), W(1)) * (COST_ARITH + COST_COPYING);
+    case ArithmeticOp::ONE_SUB:
+        return std::max(W(a_size), W(1)) * COST_ARITH;
+    case ArithmeticOp::TWO_MUL:
+        return W(a_size) * (COST_COPYING + COST_OTHER);
+    case ArithmeticOp::TWO_DIV:
+        return W(a_size) * COST_OTHER;
+    case ArithmeticOp::MIN:
+    case ArithmeticOp::MAX:
+        return max_word_size * COST_OTHER;
+    case ArithmeticOp::MUL:
+    case ArithmeticOp::DIV:
+    case ArithmeticOp::MOD:
+        return std::nullopt;
+    }
+    Assert(false);
+    return std::nullopt;
+}
+
+ActualResult ExecuteArithmetic(ArithmeticOp op, const Bytes& a, const Bytes& b, bool portable_math)
+{
+    const ScopedPortableMath scoped_portable_math{portable_math};
+    Val64Fuzz va{a};
+    Val64Fuzz vb{b};
+    uint64_t cost{0};
+
+    switch (op) {
+    case ArithmeticOp::ADD:
+        Val64::OpAdd(va, vb, cost);
+        return {va.MoveToValtype(), cost};
+    case ArithmeticOp::SUB:
+        if (!Val64::OpSub(va, vb, cost)) return {std::nullopt, cost};
+        return {va.MoveToValtype(), cost};
+    case ArithmeticOp::ONE_ADD:
+        Val64::Op1Add(va, cost);
+        return {va.MoveToValtype(), cost};
+    case ArithmeticOp::ONE_SUB:
+        if (!Val64::Op1Sub(va, cost)) return {std::nullopt, cost};
+        return {va.MoveToValtype(), cost};
+    case ArithmeticOp::TWO_MUL:
+        Val64::Op2Mul(va, cost);
+        return {va.MoveToValtype(), cost};
+    case ArithmeticOp::TWO_DIV:
+        Val64::Op2Div(va, cost);
+        return {va.MoveToValtype(), cost};
+    case ArithmeticOp::MIN:
+        Val64::OpMin(va, vb, cost);
+        return {va.MoveToValtype(), cost};
+    case ArithmeticOp::MAX:
+        Val64::OpMax(va, vb, cost);
+        return {va.MoveToValtype(), cost};
+    case ArithmeticOp::MUL: {
+        Val64 result{Val64::OpMul(va, vb)};
+        return {result.MoveToValtype(), std::nullopt};
+    }
+    case ArithmeticOp::DIV:
+        if (!Val64::OpDiv(va, vb)) return {std::nullopt, std::nullopt};
+        return {va.MoveToValtype(), std::nullopt};
+    case ArithmeticOp::MOD:
+        if (!Val64::OpMod(va, vb)) return {std::nullopt, std::nullopt};
+        return {va.MoveToValtype(), std::nullopt};
+    }
+    Assert(false);
+    return {};
+}
+
+bool UsesPortableMath(ArithmeticOp op)
+{
+    return op == ArithmeticOp::MUL || op == ArithmeticOp::DIV || op == ArithmeticOp::MOD;
+}
+
+bool IsUnary(ArithmeticOp op)
+{
+    return op == ArithmeticOp::ONE_ADD || op == ArithmeticOp::ONE_SUB ||
+           op == ArithmeticOp::TWO_MUL || op == ArithmeticOp::TWO_DIV;
+}
+
+void CheckArithmeticBackend(ArithmeticOp op,
+                            const Bytes& a,
+                            const Bytes& b,
+                            bool portable_math,
+                            const OptionalBytes& expected,
+                            std::optional<uint64_t> expected_cost)
+{
+    const ActualResult actual{ExecuteArithmetic(op, a, b, portable_math)};
+    Assert(actual.value == expected);
+    Assert(actual.cost == expected_cost);
+}
+
+void CheckArithmetic(ArithmeticOp op, const Bytes& a, const Bytes& b)
+{
+    const OptionalBytes expected{ReferenceArithmetic(op, a, b)};
+    const std::optional<uint64_t> expected_cost{ReferenceArithmeticCost(op, a.size(), b.size())};
+
+    CheckArithmeticBackend(op, a, b, /*portable_math=*/false, expected, expected_cost);
+    if (UsesPortableMath(op)) {
+        CheckArithmeticBackend(op, a, b, /*portable_math=*/true, expected, expected_cost);
+    }
+}
+
+Bytes ReferenceBitwise(BitwiseShiftOp op, const Bytes& a, const Bytes& b)
+{
+    Assert(op == BitwiseShiftOp::AND || op == BitwiseShiftOp::OR || op == BitwiseShiftOp::XOR);
+    Bytes result(std::max(a.size(), b.size()));
+    for (size_t i{0}; i < result.size(); ++i) {
+        const unsigned char av{i < a.size() ? a[i] : static_cast<unsigned char>(0)};
+        const unsigned char bv{i < b.size() ? b[i] : static_cast<unsigned char>(0)};
+        if (op == BitwiseShiftOp::AND) result[i] = av & bv;
+        if (op == BitwiseShiftOp::OR) result[i] = av | bv;
+        if (op == BitwiseShiftOp::XOR) result[i] = av ^ bv;
+    }
+    return result;
+}
+
+Bytes ShiftLeftFixed(const Bytes& value, uint64_t bits, size_t result_size)
+{
+    Bytes result(result_size, 0);
+    const size_t byte_shift{static_cast<size_t>(bits / 8)};
+    const unsigned int bit_shift{static_cast<unsigned int>(bits % 8)};
+    for (size_t i{0}; i < value.size() && i + byte_shift < result.size(); ++i) {
+        const uint16_t shifted{static_cast<uint16_t>(static_cast<uint16_t>(value[i]) << bit_shift)};
+        result[i + byte_shift] |= static_cast<unsigned char>(shifted);
+        if (bit_shift != 0 && i + byte_shift + 1 < result.size()) {
+            result[i + byte_shift + 1] |= static_cast<unsigned char>(shifted >> 8);
+        }
+    }
+    return result;
+}
+
+Bytes ShiftRightFixed(const Bytes& value, uint64_t bits, size_t result_size)
+{
+    Bytes result(result_size, 0);
+    const size_t byte_shift{static_cast<size_t>(bits / 8)};
+    const unsigned int bit_shift{static_cast<unsigned int>(bits % 8)};
+    for (size_t i{0}; i < result.size(); ++i) {
+        const size_t source{i + byte_shift};
+        uint16_t shifted{static_cast<uint16_t>(static_cast<uint16_t>(value[source]) >> bit_shift)};
+        if (bit_shift != 0 && source + 1 < value.size()) {
+            shifted |= static_cast<uint16_t>(value[source + 1]) << (8 - bit_shift);
+        }
+        result[i] = static_cast<unsigned char>(shifted);
+    }
+    return result;
+}
+
+OptionalBytes ReferenceBitwiseShift(BitwiseShiftOp op, const Bytes& a, const Bytes& b)
+{
+    switch (op) {
+    case BitwiseShiftOp::INVERT: {
+        Bytes result{a};
+        for (unsigned char& byte : result)
+            byte ^= 0xff;
+        return result;
+    }
+    case BitwiseShiftOp::AND:
+    case BitwiseShiftOp::OR:
+    case BitwiseShiftOp::XOR:
+        return ReferenceBitwise(op, a, b);
+    case BitwiseShiftOp::UPSHIFT: {
+        constexpr uint64_t max_bits{uint64_t{MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE} * 8};
+        const uint64_t bits{ToU64Ceil(b, max_bits + 1)};
+        const uint64_t a_bits{static_cast<uint64_t>(a.size()) * 8};
+        if (bits > max_bits - a_bits) return std::nullopt;
+
+        const size_t prebytes{static_cast<size_t>(bits / 8)};
+        const size_t result_size{a.size() + prebytes + (bits % 8 == 0 ? 0 : 1)};
+        return ShiftLeftFixed(a, bits, result_size);
+    }
+    case BitwiseShiftOp::DOWNSHIFT: {
+        const uint64_t a_bits{static_cast<uint64_t>(a.size()) * 8};
+        const uint64_t bits{ToU64Ceil(b, a_bits)};
+        const size_t bytes{static_cast<size_t>(bits / 8)};
+        if (bytes >= a.size()) return Bytes{};
+        return ShiftRightFixed(a, bits, a.size() - bytes);
+    }
+    }
+    Assert(false);
+    return std::nullopt;
+}
+
+uint64_t ReferenceBitwiseShiftCost(BitwiseShiftOp op, const Bytes& a, const Bytes& b)
+{
+    switch (op) {
+    case BitwiseShiftOp::INVERT:
+        return W(a.size()) * COST_OTHER;
+    case BitwiseShiftOp::AND:
+        return (W(a.size()) + W(b.size())) * COST_FAST;
+    case BitwiseShiftOp::OR:
+    case BitwiseShiftOp::XOR:
+        return std::min(W(a.size()), W(b.size())) * COST_OTHER;
+    case BitwiseShiftOp::UPSHIFT: {
+        constexpr uint64_t max_bits{uint64_t{MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE} * 8};
+        const uint64_t bits{ToU64Ceil(b, max_bits + 1)};
+        const uint64_t a_bits{static_cast<uint64_t>(a.size()) * 8};
+        uint64_t cost{LengthConversionCost(b.size())};
+        if (bits > max_bits - a_bits) return cost;
+
+        const size_t prebytes{static_cast<size_t>(bits / 8)};
+        cost += prebytes * COST_FAST + a.size() * COST_COPYING;
+        if (bits % 8 != 0) cost += W(a.size() + prebytes) * COST_OTHER;
+        return cost;
+    }
+    case BitwiseShiftOp::DOWNSHIFT: {
+        const uint64_t bits{ToU64Ceil(b, static_cast<uint64_t>(a.size()) * 8)};
+        const size_t bytes{static_cast<size_t>(bits / 8)};
+        uint64_t cost{LengthConversionCost(b.size())};
+        if (bytes < a.size()) cost += (a.size() - bytes) * COST_COPYING;
+        return cost;
+    }
+    }
+    Assert(false);
+    return 0;
+}
+
+ActualResult ExecuteBitwiseShift(BitwiseShiftOp op, const Bytes& a, const Bytes& b)
+{
+    Val64Fuzz va{a};
+    Val64Fuzz vb{b};
+    uint64_t cost{0};
+
+    switch (op) {
+    case BitwiseShiftOp::INVERT:
+        Val64::OpInvert(va, cost);
+        break;
+    case BitwiseShiftOp::AND:
+        Val64::OpAnd(va, vb, cost);
+        break;
+    case BitwiseShiftOp::OR:
+        Val64::OpOr(va, vb, cost);
+        break;
+    case BitwiseShiftOp::XOR:
+        Val64::OpXor(va, vb, cost);
+        break;
+    case BitwiseShiftOp::UPSHIFT:
+        if (!Val64::OpUpShift(va, vb, MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE, cost)) {
+            return {std::nullopt, cost};
+        }
+        break;
+    case BitwiseShiftOp::DOWNSHIFT:
+        Val64::OpDownShift(va, vb, cost);
+        break;
+    }
+    return {va.MoveToValtype(), cost};
+}
+
+void CheckBitwiseShift(BitwiseShiftOp op, const Bytes& a, const Bytes& b)
+{
+    const OptionalBytes expected{ReferenceBitwiseShift(op, a, b)};
+    const uint64_t expected_cost{ReferenceBitwiseShiftCost(op, a, b)};
+    const ActualResult actual{ExecuteBitwiseShift(op, a, b)};
+    Assert(actual.value == expected);
+    Assert(actual.cost == expected_cost);
+}
+
+template <size_t N>
+size_t ConsumeSize(FuzzedDataProvider& provider,
+                   const std::array<size_t, N>& boundaries,
+                   size_t min,
+                   size_t max)
+{
+    if (provider.ConsumeBool()) return provider.PickValueInArray(boundaries);
+    return provider.ConsumeIntegralInRange<size_t>(min, max);
+}
+
+Bytes ConsumeBytesWithSize(FuzzedDataProvider& provider, size_t size)
+{
+    const uint8_t mode{provider.ConsumeIntegralInRange<uint8_t>(0, 3)};
+    if (mode == 1) return Bytes(size, 0x00);
+    if (mode == 2) return Bytes(size, 0xff);
+
+    const unsigned char fill{provider.ConsumeIntegral<unsigned char>()};
+    Bytes bytes{provider.ConsumeBytes<unsigned char>(size)};
+    bytes.resize(size, fill);
+    if (mode == 3 && !bytes.empty()) {
+        const size_t zero_tail{provider.ConsumeIntegralInRange<size_t>(1, std::min<size_t>(8, bytes.size()))};
+        std::fill(bytes.end() - zero_tail, bytes.end(), 0x00);
+    }
+    return bytes;
+}
+
+Bytes ConsumeNormalOperand(FuzzedDataProvider& provider)
+{
+    static constexpr std::array<size_t, 20> boundaries{
+        0,
+        1,
+        2,
+        7,
+        8,
+        9,
+        15,
+        16,
+        17,
+        31,
+        32,
+        33,
+        63,
+        64,
+        65,
+        127,
+        128,
+        129,
+        255,
+        256,
+    };
+    return ConsumeBytesWithSize(provider, ConsumeSize(provider, boundaries, 0, MAX_NORMAL_OPERAND_SIZE));
+}
+
+Bytes ConsumeLargeOperand(FuzzedDataProvider& provider)
+{
+    static constexpr std::array<size_t, 12> boundaries{
+        257,
+        511,
+        512,
+        513,
+        1023,
+        1024,
+        1025,
+        2047,
+        2048,
+        2049,
+        4095,
+        4096,
+    };
+    return ConsumeBytesWithSize(
+        provider,
+        ConsumeSize(provider, boundaries, MIN_LARGE_OPERAND_SIZE, MAX_LARGE_OPERAND_SIZE));
+}
+
+void AddNear(std::vector<uint64_t>& values, uint64_t value)
+{
+    if (value > 0) values.push_back(value - 1);
+    values.push_back(value);
+    if (value < std::numeric_limits<uint64_t>::max()) values.push_back(value + 1);
+}
+
+Bytes PadNumericOperand(FuzzedDataProvider& provider, Bytes bytes)
+{
+    if (provider.ConsumeBool()) {
+        bytes.resize(bytes.size() + provider.ConsumeIntegralInRange<size_t>(0, 8), 0x00);
+    }
+    return bytes;
+}
+
+Bytes ConsumeShiftOperand(FuzzedDataProvider& provider, BitwiseShiftOp op, size_t a_size)
+{
+    constexpr uint64_t max_bits{uint64_t{MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE} * 8};
+    const uint64_t a_bits{static_cast<uint64_t>(a_size) * 8};
+    std::vector<uint64_t> candidates{0, 1, 7, 8, 9, 15, 16, 63, 64, 65};
+    AddNear(candidates, a_bits);
+    AddNear(candidates, (a_bits / 64) * 64);
+
+    if (op == BitwiseShiftOp::UPSHIFT) {
+        candidates.push_back(max_bits + 1);
+        candidates.push_back(provider.ConsumeIntegralInRange<uint64_t>(0, a_bits + 1024));
+    } else {
+        AddNear(candidates, a_bits + 64);
+        candidates.push_back(provider.ConsumeIntegralInRange<uint64_t>(0, a_bits + 128));
+    }
+
+    const uint64_t value{candidates.at(provider.ConsumeIntegralInRange<size_t>(0, candidates.size() - 1))};
+    return PadNumericOperand(provider, ToMinimalLittleEndian(cpp_int{value}));
+}
+
+int ReferenceCompare(const Bytes& a, const Bytes& b)
+{
+    const cpp_int av{FromLittleEndian(a)};
+    const cpp_int bv{FromLittleEndian(b)};
+    if (av < bv) return -1;
+    if (av > bv) return 1;
+    return 0;
+}
+
+void CheckPredicates(FuzzedDataProvider& provider, const Bytes& a, const Bytes& b)
+{
+    uint64_t max;
+    if (provider.ConsumeBool()) {
+        max = provider.ConsumeIntegral<uint64_t>();
+    } else {
+        max = provider.PickValueInArray<uint64_t>({0, 1, 255, 256, 4096,
+                                                   std::numeric_limits<uint32_t>::max(),
+                                                   std::numeric_limits<uint64_t>::max()});
+    }
+    const uint64_t expected_ceil{ToU64Ceil(a, max)};
+    const bool expected_zero{FromLittleEndian(a) == 0};
+    const int expected_cmp{ReferenceCompare(a, b)};
+
+    {
+        Val64Fuzz va{a};
+        uint64_t cost{0};
+        Assert(va.ToU64Ceil(max, cost) == expected_ceil);
+        Assert(cost == LengthConversionCost(a.size()));
+    }
+    {
+        Val64Fuzz va{a};
+        uint64_t cost{0};
+        Assert(va.IsZero() == expected_zero);
+        Assert(va.IsZero(cost) == expected_zero);
+        Assert(cost == W(a.size()) * COST_FAST);
+    }
+    {
+        Val64Fuzz va{a};
+        Val64Fuzz vb{b};
+        uint64_t cost{0};
+        Assert(va.Compare(vb) == expected_cmp);
+        Assert(va.Compare(vb, cost) == expected_cmp);
+        Assert(cost == std::max(W(a.size()), W(b.size())) * COST_FAST);
+    }
+}
+} // namespace
+
+FUZZ_TARGET(val64_arithmetic)
+{
+    FuzzedDataProvider provider{buffer.data(), buffer.size()};
+    const ArithmeticOp op{static_cast<ArithmeticOp>(provider.ConsumeIntegralInRange<int>(
+        0, static_cast<int>(ArithmeticOp::MOD)))};
+    const Bytes a{ConsumeNormalOperand(provider)};
+    const Bytes b{IsUnary(op) ? Bytes{} : ConsumeNormalOperand(provider)};
+    CheckArithmetic(op, a, b);
+}
+
+FUZZ_TARGET(val64_bitwise_shift)
+{
+    FuzzedDataProvider provider{buffer.data(), buffer.size()};
+    const BitwiseShiftOp op{static_cast<BitwiseShiftOp>(provider.ConsumeIntegralInRange<int>(
+        0, static_cast<int>(BitwiseShiftOp::DOWNSHIFT)))};
+    const Bytes a{ConsumeNormalOperand(provider)};
+    Bytes b;
+    if (op == BitwiseShiftOp::UPSHIFT || op == BitwiseShiftOp::DOWNSHIFT) {
+        b = ConsumeShiftOperand(provider, op, a.size());
+    } else if (op != BitwiseShiftOp::INVERT) {
+        b = ConsumeNormalOperand(provider);
+    }
+    CheckBitwiseShift(op, a, b);
+}
+
+FUZZ_TARGET(val64_predicates)
+{
+    FuzzedDataProvider provider{buffer.data(), buffer.size()};
+    const Bytes a{ConsumeNormalOperand(provider)};
+    const Bytes b{ConsumeNormalOperand(provider)};
+    CheckPredicates(provider, a, b);
+}
+
+FUZZ_TARGET(val64_large_mul_divmod)
+{
+    FuzzedDataProvider provider{buffer.data(), buffer.size()};
+    const ArithmeticOp op{provider.PickValueInArray<ArithmeticOp>({
+        ArithmeticOp::MUL,
+        ArithmeticOp::DIV,
+        ArithmeticOp::MOD,
+    })};
+    const Bytes a{ConsumeLargeOperand(provider)};
+    const Bytes b{ConsumeLargeOperand(provider)};
+    const OptionalBytes expected{ReferenceArithmetic(op, a, b)};
+    CheckArithmeticBackend(op, a, b, provider.ConsumeBool(), expected, std::nullopt);
+}
diff --git a/src/test/script_p2sh_tests.cpp b/src/test/script_p2sh_tests.cpp
index b46411185cdf..1bde502ec2d3 100644
--- a/src/test/script_p2sh_tests.cpp
+++ b/src/test/script_p2sh_tests.cpp
@@ -10,10 +10,12 @@
 #include <script/script_error.h>
 #include <script/sign.h>
 #include <script/signingprovider.h>
+#include <script/varops.h>
 #include <test/util/setup_common.h>
 #include <test/util/transaction_utils.h>
 #include <validation.h>
 
+#include <memory>
 #include <vector>
 
 #include <boost/test/unit_test.hpp>
@@ -121,7 +123,11 @@ BOOST_AUTO_TEST_CASE(sign)
         {
             CScript sigSave = txTo[i].vin[0].scriptSig;
             txTo[i].vin[0].scriptSig = txTo[j].vin[0].scriptSig;
-            bool sigOK = !CScriptCheck(txFrom.vout[txTo[i].vin[0].prevout.n], CTransaction(txTo[i]), signature_cache, 0, SCRIPT_VERIFY_P2SH | SCRIPT_VERIFY_STRICTENC, false, &txdata)().has_value();
+            const CTransaction tx_to{txTo[i]};
+            auto varops_budget{std::make_shared<varops::Budget>(varops::TxBudget(GetTransactionWeight(tx_to)))};
+            bool sigOK = !CScriptCheck(txFrom.vout[txTo[i].vin[0].prevout.n], tx_to, signature_cache, 0,
+                                       SCRIPT_VERIFY_P2SH | SCRIPT_VERIFY_STRICTENC, false, &txdata, varops_budget)()
+                              .has_value();
             if (i == j)
                 BOOST_CHECK_MESSAGE(sigOK, strprintf("VerifySignature %d %d", i, j));
             else
diff --git a/src/test/script_tests.cpp b/src/test/script_tests.cpp
index e1b910a0170e..9f6e87b32170 100644
--- a/src/test/script_tests.cpp
+++ b/src/test/script_tests.cpp
@@ -97,6 +97,11 @@ static ScriptErrorDesc script_errors[]={
     {SCRIPT_ERR_OP_CODESEPARATOR, "OP_CODESEPARATOR"},
     {SCRIPT_ERR_SIG_FINDANDDELETE, "SIG_FINDANDDELETE"},
     INQ_SCRIPTERR_TEST_NAMES
+    {SCRIPT_ERR_DIVIDE_BY_ZERO, "DIVIDE_BY_ZERO"},
+    {SCRIPT_ERR_SUB_UNDERFLOW, "SUB_UNDERFLOW"},
+    {SCRIPT_ERR_VAROP_COUNT, "VAROP_COUNT"},
+    {SCRIPT_ERR_TOTAL_STACK_SIZE, "TOTAL_STACK_SIZE"},
+    {SCRIPT_ERR_STACK_ELEMENT_SIZE, "STACK_ELEMENT_SIZE"},
 };
 
 static std::string FormatScriptFlags(script_verify_flags flags)
diff --git a/src/test/sighash_tests.cpp b/src/test/sighash_tests.cpp
index 2c65afd3b17d..8c60ca7a500d 100644
--- a/src/test/sighash_tests.cpp
+++ b/src/test/sighash_tests.cpp
@@ -595,6 +595,29 @@ BOOST_AUTO_TEST_CASE(sighash_anyprevout_taproot)
     #endif
 }
 
+BOOST_AUTO_TEST_CASE(sighash_anyprevout_is_not_tapscript_v2)
+{
+    CMutableTransaction tx;
+    RandomTransaction(tx, /*fSingle=*/false);
+    std::for_each(tx.vin.begin(), tx.vin.end(), [](CTxIn& vin){ vin.scriptWitness.stack.push_back({OP_TRUE}); });
+    PrecomputedTransactionData txdata(tx);
+    txdata.Init(tx, MutateSpentOutputs(tx.vin.size(), false, false));
+    const uint32_t nIn{static_cast<uint32_t>(m_rng.randrange(tx.vin.size()))};
+
+    ScriptExecutionData execdata;
+    execdata.m_annex_init = true;
+    execdata.m_annex_present = false;
+    execdata.m_tapleaf_hash_init = true;
+    execdata.m_tapleaf_hash = m_rng.rand256();
+    execdata.m_codeseparator_pos_init = true;
+    execdata.m_codeseparator_pos = 0xFFFFFFFF;
+
+    const uint8_t hash_type{uint8_t{SIGHASH_ANYPREVOUT | SIGHASH_ALL}};
+    uint256 hash;
+    BOOST_CHECK(SignatureHashSchnorr(hash, execdata, tx, nIn, hash_type, SigVersion::TAPSCRIPT, KeyVersion::ANYPREVOUT, txdata, MissingDataBehavior::ASSERT_FAIL));
+    BOOST_CHECK(!SignatureHashSchnorr(hash, execdata, tx, nIn, hash_type, SigVersion::TAPSCRIPT_V2, KeyVersion::ANYPREVOUT, txdata, MissingDataBehavior::ASSERT_FAIL));
+}
+
 BOOST_AUTO_TEST_CASE(sighash_caching)
 {
     // Get a script, transaction and parameters as inputs to the sighash function.
diff --git a/src/test/tapscript_v2_json_tests.cpp b/src/test/tapscript_v2_json_tests.cpp
new file mode 100644
index 000000000000..b454ee47d610
--- /dev/null
+++ b/src/test/tapscript_v2_json_tests.cpp
@@ -0,0 +1,212 @@
+// Copyright (c) 2025 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <script/interpreter.h>
+#include <script/script.h>
+#include <script/script_error.h>
+#include <script/valtype_stack.h>
+#include <script/varops.h>
+#include <span.h>
+#include <test/data/tapscript_v2_restored_ops.json.h>
+#include <test/data/tapscript_v2_varops.json.h>
+#include <test/util/json.h>
+#include <test/util/setup_common.h>
+#include <util/strencodings.h>
+
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <iostream>
+#include <optional>
+#include <ranges>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+#include <vector>
+
+#include <boost/test/unit_test.hpp>
+
+#include <univalue.h>
+
+BOOST_FIXTURE_TEST_SUITE(tapscript_v2_json_tests, BasicTestingSetup)
+
+static void PrintStackElement(std::string_view label, const std::vector<unsigned char>& element)
+{
+    static constexpr size_t MAX_PRINTED_BYTES{32};
+    const size_t printed_bytes{std::min(element.size(), MAX_PRINTED_BYTES)};
+    std::cerr << label << HexStr(Span{element}.first(printed_bytes));
+    if (printed_bytes < element.size()) {
+        std::cerr << "... (" << element.size() << " bytes total)";
+    }
+}
+
+static void PrintStackComparison(
+    const std::string& test_name,
+    const std::vector<std::vector<unsigned char>>& actual_stack,
+    const std::vector<std::vector<unsigned char>>& expected_stack)
+{
+    std::cerr << "Test '" << test_name << "' failed final stack check. Final stack:\n";
+    for (size_t i = 0; i < std::max(actual_stack.size(), expected_stack.size()); ++i) {
+        std::cerr << "  [" << i << "] ";
+        if (i < expected_stack.size()) {
+            PrintStackElement("Expected: ", expected_stack[i]);
+        } else {
+            std::cerr << "Expected: No element";
+        }
+
+        std::cerr << ", ";
+        if (i < actual_stack.size()) {
+            PrintStackElement("Actual: ", actual_stack[i]);
+        } else {
+            std::cerr << "Actual: No element";
+        }
+        std::cerr << '\n';
+    }
+}
+
+static std::vector<unsigned char> ParseExpandedHex(std::string_view input)
+{
+    if (input.starts_with("0x") || input.starts_with("0X")) input.remove_prefix(2);
+
+    std::vector<unsigned char> result;
+    while (!input.empty()) {
+        const size_t open_brace{input.find('{')};
+        const std::string_view literal{input.substr(0, open_brace)};
+        if (!literal.empty()) {
+            if (!IsHex(literal)) throw std::invalid_argument("Invalid hex string");
+            const std::vector<unsigned char> bytes{::ParseHex(literal)};
+            result.insert(result.end(), bytes.begin(), bytes.end());
+        }
+
+        if (open_brace == std::string_view::npos) break;
+        const size_t close_brace{input.find('}', open_brace + 1)};
+        if (close_brace == std::string_view::npos) throw std::invalid_argument("Unclosed brace in hex string");
+        if (result.empty()) throw std::invalid_argument("No previous byte to repeat");
+
+        const std::optional<uint64_t> count{ToIntegral<uint64_t>(input.substr(open_brace + 1, close_brace - open_brace - 1))};
+        if (!count || *count == 0) throw std::invalid_argument("Invalid repeat count");
+        if (*count - 1 > result.max_size() - result.size()) throw std::length_error("Expanded hex string too large");
+        const unsigned char repeated_byte{result.back()};
+        result.insert(result.end(), static_cast<size_t>(*count - 1), repeated_byte);
+        input.remove_prefix(close_brace + 1);
+    }
+    return result;
+}
+
+static std::optional<opcodetype> FindOpcode(std::string_view name)
+{
+    for (unsigned int code{0}; code <= 0xff; ++code) {
+        const opcodetype opcode{static_cast<opcodetype>(code)};
+        const std::string canonical{GetOpName(opcode)};
+        const std::string_view canonical_view{canonical};
+        if (canonical_view == "OP_UNKNOWN") continue;
+        if (canonical_view == name || (canonical_view.starts_with("OP_") && canonical_view.substr(3) == name)) return opcode;
+    }
+    return std::nullopt;
+}
+
+static std::vector<unsigned char> ParseHexOrOpcode(const std::string& input)
+{
+    if (const std::optional<opcodetype> opcode{FindOpcode(input)}) return {static_cast<unsigned char>(*opcode)};
+    return ParseExpandedHex(input);
+}
+
+static std::vector<std::vector<unsigned char>> ParseStack(const UniValue& values)
+{
+    std::vector<std::vector<unsigned char>> stack;
+    stack.reserve(values.size());
+    for (const UniValue& value : values.getValues()) {
+        stack.push_back(ParseExpandedHex(value.get_str()));
+    }
+    return stack;
+}
+
+static constexpr std::array<std::string_view, 6> ALLOWED_SUCCESS_TEST_FIELDS{
+    "description",
+    "final stack",
+    "initial stack",
+    "name",
+    "opcodes",
+    "varops cost",
+};
+
+static void CheckSuccessTestFields(const UniValue& test)
+{
+    for (const std::string& key : test.getKeys()) {
+        if (std::ranges::find(ALLOWED_SUCCESS_TEST_FIELDS, key) == ALLOWED_SUCCESS_TEST_FIELDS.end()) {
+            throw std::invalid_argument("Unknown success-vector field: " + key);
+        }
+    }
+}
+
+static void RunJsonSuccessTests(const UniValue& tests, const std::string& suite_name)
+{
+    for (const UniValue& category : tests.getValues()) {
+        const std::string category_name{category["category"].get_str()};
+        for (const UniValue& test : category["tests"].getValues()) {
+            const std::string test_name{test["name"].get_str()};
+            const std::string full_test_name{suite_name + "::" + test_name};
+
+            BOOST_TEST_CONTEXT("category " << category_name << ", test " << full_test_name) {
+                try {
+                    CheckSuccessTestFields(test);
+
+                    if (!test.exists("opcodes") || !test.exists("final stack") || !test.exists("varops cost")) {
+                        throw std::invalid_argument("Missing required success-vector field");
+                    }
+
+                    CScript script;
+                    for (const UniValue& opcode_input : test["opcodes"].getValues()) {
+                        const std::vector<unsigned char> parsed{ParseHexOrOpcode(opcode_input.get_str())};
+                        script.insert(script.end(), parsed.begin(), parsed.end());
+                    }
+
+                    const std::vector<std::vector<unsigned char>> initial_stack{
+                        test.exists("initial stack") ? ParseStack(test["initial stack"])
+                                                     : std::vector<std::vector<unsigned char>>{}};
+                    const std::vector<std::vector<unsigned char>> expected_stack{ParseStack(test["final stack"])};
+                    const uint64_t expected_cost{test["varops cost"].getInt<uint64_t>()};
+
+                    ScriptExecutionData execdata;
+                    ScriptError error{SCRIPT_ERR_UNKNOWN_ERROR};
+                    BaseSignatureChecker checker;
+                    constexpr uint64_t budget{250'000'000};
+                    varops::Budget varops_budget{budget};
+                    ValtypeStack stack{initial_stack};
+
+                    const bool success{EvalTapscriptV2(stack, script, 0, checker, execdata, varops_budget, &error)};
+                    BOOST_CHECK_MESSAGE(success,
+                                        "Test '" << full_test_name << "' failed with " << ScriptErrorString(error));
+                    if (success) {
+                        BOOST_CHECK_EQUAL(error, SCRIPT_ERR_OK);
+                        if (stack.GetStack() != expected_stack) {
+                            PrintStackComparison(full_test_name, stack.GetStack(), expected_stack);
+                        }
+                        BOOST_CHECK_MESSAGE(stack.GetStack() == expected_stack,
+                                            "Test '" << full_test_name << "' failed final stack check");
+                        const uint64_t consumed{budget - *varops_budget.Remaining()};
+                        BOOST_CHECK_MESSAGE(consumed == expected_cost,
+                                            "Test '" << full_test_name << "' consumed " << consumed
+                                                     << " varops units, expected " << expected_cost);
+                    }
+                } catch (const std::exception& e) {
+                    std::cerr << "Exception in test '" << full_test_name << "': " << e.what() << std::endl;
+                    throw;
+                }
+            }
+        }
+    }
+}
+
+BOOST_AUTO_TEST_CASE(tapscript_v2_varops_json_tests)
+{
+    RunJsonSuccessTests(read_json(json_tests::tapscript_v2_varops), "tapscript_v2_varops");
+}
+
+BOOST_AUTO_TEST_CASE(tapscript_v2_restored_ops_json_tests)
+{
+    RunJsonSuccessTests(read_json(json_tests::tapscript_v2_restored_ops), "tapscript_v2_restored_ops");
+}
+
+BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/test/tapscript_v2_tests.cpp b/src/test/tapscript_v2_tests.cpp
new file mode 100644
index 000000000000..74816ed90c59
--- /dev/null
+++ b/src/test/tapscript_v2_tests.cpp
@@ -0,0 +1,1314 @@
+// Copyright (c) 2026 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or https://opensource.org/license/mit/.
+
+#include <coins.h>
+#include <consensus/validation.h>
+#include <key.h>
+#include <policy/policy.h>
+#include <psbt.h>
+#include <script/interpreter.h>
+#include <script/script.h>
+#include <script/script_error.h>
+#include <script/sign.h>
+#include <script/signingprovider.h>
+#include <script/solver.h>
+#include <script/val64.h>
+#include <script/valtype_stack.h>
+#include <script/varops.h>
+#include <test/util/tapscript_v2_test_utils.h>
+#include <test/util/setup_common.h>
+#include <util/translation.h>
+
+#include <boost/test/unit_test.hpp>
+
+#include <array>
+#include <cstdint>
+#include <map>
+#include <optional>
+#include <ranges>
+#include <string>
+#include <utility>
+#include <vector>
+
+using valtype = std::vector<unsigned char>;
+using namespace test::tapscript_v2;
+
+static valtype Bytes(std::string_view text)
+{
+    return valtype{text.begin(), text.end()};
+}
+
+static valtype Bytes(std::initializer_list<unsigned char> bytes)
+{
+    return valtype{bytes};
+}
+
+static valtype Num(uint64_t value)
+{
+    Val64 num{value};
+    return num.MoveToValtype();
+}
+
+static valtype LargerThanU64()
+{
+    return Bytes({0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01});
+}
+
+static constexpr script_verify_flags TAPSCRIPT_V2_ACTIVE_INQUISITION_OPCODE_FLAGS{
+    TAPSCRIPT_V2_SCRIPT_VERIFY_FLAGS | SCRIPT_VERIFY_CHECKSIGFROMSTACK | SCRIPT_VERIFY_INTERNALKEY};
+
+static uint64_t FinalSuccessCost(size_t size)
+{
+    return varops::CompareZeroCost(size);
+}
+
+class RecordingSignatureCreator final : public BaseSignatureCreator
+{
+public:
+    mutable std::vector<SigVersion> schnorr_sigversions;
+
+    const BaseSignatureChecker& Checker() const override { return DUMMY_CHECKER; }
+
+    bool CreateSig(const SigningProvider&, std::vector<unsigned char>&, const CKeyID&, const CScript&, SigVersion) const override
+    {
+        return false;
+    }
+
+    bool CreateSchnorrSig(const SigningProvider&, std::vector<unsigned char>& sig, const XOnlyPubKey&, const uint256* leaf_hash, const uint256*, SigVersion sigversion) const override
+    {
+        if (leaf_hash == nullptr) return false;
+        schnorr_sigversions.push_back(sigversion);
+        sig.assign(64, 0x01);
+        return true;
+    }
+};
+
+static void CheckEval(const CScript& script, const Stack& initial_stack, const Stack& expected_stack, uint64_t budget)
+{
+    const EvalOutcome outcome{EvalTapscriptV2(script, initial_stack, budget)};
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_OK);
+    BOOST_CHECK(outcome.ok);
+    if (!outcome.ok) return;
+    BOOST_CHECK_EQUAL(outcome.remaining_budget, 0);
+    BOOST_CHECK_EQUAL(outcome.stack.size(), expected_stack.size());
+    if (outcome.stack.size() != expected_stack.size()) return;
+    for (size_t i{0}; i < expected_stack.size(); ++i) {
+        BOOST_TEST_CONTEXT("stack index " << i) {
+            BOOST_CHECK(outcome.stack[i] == expected_stack[i]);
+        }
+    }
+}
+
+static void CheckError(const CScript& script, const Stack& initial_stack, uint64_t budget, ScriptError expected_error)
+{
+    const EvalOutcome outcome{EvalTapscriptV2(script, initial_stack, budget)};
+    BOOST_CHECK(!outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, expected_error);
+}
+
+struct FinalizedTapscriptV2Spend {
+    CTxOut spent_output;
+    CMutableTransaction tx;
+};
+
+static FinalizedTapscriptV2Spend BuildFinalizedTapscriptV2Spend(const CScript& leaf_script, const Stack& initial_stack)
+{
+    CScript script_pub_key;
+    CScriptWitness witness{BuildTapscriptV2Witness(leaf_script, initial_stack, script_pub_key)};
+
+    CMutableTransaction tx;
+    tx.version = 2;
+    tx.vin.emplace_back(COutPoint{Txid::FromUint256(uint256::ONE), 0});
+    tx.vin[0].scriptWitness = std::move(witness);
+    tx.vout.emplace_back(500, CScript{} << OP_TRUE);
+
+    return {CTxOut{1000, script_pub_key}, std::move(tx)};
+}
+
+static EvalOutcome VerifyTaprootLeafWithFlags(const CScript& leaf_script, const Stack& initial_stack, uint8_t leaf_version, script_verify_flags flags, uint64_t budget)
+{
+    TaprootBuilder builder;
+    builder.Add(0, leaf_script, leaf_version, /*track=*/true);
+    builder.Finalize(XOnlyPubKey::NUMS_H);
+
+    CScriptWitness witness;
+    witness.stack = initial_stack;
+    const std::vector<unsigned char> serialized_script{leaf_script.begin(), leaf_script.end()};
+    witness.stack.push_back(serialized_script);
+    const auto control_blocks{builder.GetSpendData().scripts.at({serialized_script, leaf_version})};
+    witness.stack.push_back(*control_blocks.begin());
+    const CScript script_pub_key{GetScriptForDestination(builder.GetOutput())};
+
+    ScriptError error{SCRIPT_ERR_UNKNOWN_ERROR};
+    varops::Budget varops_budget{budget};
+    const bool ok{VerifyScript(CScript{}, script_pub_key, &witness, flags, BaseSignatureChecker{}, &error, varops_budget)};
+    return EvalOutcome{ok, error, *varops_budget.Remaining(), {}};
+}
+
+static EvalOutcome VerifyTapscriptV2WithFlags(const CScript& leaf_script, const Stack& initial_stack, script_verify_flags flags, uint64_t budget)
+{
+    return VerifyTaprootLeafWithFlags(leaf_script, initial_stack, TAPROOT_LEAF_TAPSCRIPT_V2, flags, budget);
+}
+
+static EvalOutcome VerifyTapscriptV2(const CScript& leaf_script, const Stack& initial_stack, uint64_t budget)
+{
+    return VerifyTapscriptV2WithFlags(leaf_script, initial_stack, TAPSCRIPT_V2_SCRIPT_VERIFY_FLAGS, budget);
+}
+
+BOOST_FIXTURE_TEST_SUITE(tapscript_v2_tests, BasicTestingSetup)
+
+BOOST_AUTO_TEST_CASE(op_success_classification)
+{
+    constexpr auto tapscript_op_success = std::to_array<uint8_t>({
+        80, 98,
+        126, 127, 128, 129,
+        131, 132, 133, 134,
+        137, 138,
+        141, 142,
+        149, 150, 151, 152, 153,
+        187, 188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198, 199,
+        200, 201, 202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212,
+        213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224, 225,
+        226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238,
+        239, 240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251,
+        252, 253, 254,
+    });
+    constexpr auto tapscript_v2_op_success = std::to_array<uint8_t>({
+        79, 80, 98, 137, 138, 143, 144,
+        187, 188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198, 199,
+        200, 201, 202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212,
+        213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224, 225,
+        226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238,
+        239, 240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251,
+        252, 253, 254,
+    });
+
+    const auto check_all_opcodes = [](SigVersion sigversion, const auto& expected_op_success) {
+        for (unsigned int opcode_value{0}; opcode_value <= 0xff; ++opcode_value) {
+            const opcodetype opcode{static_cast<opcodetype>(opcode_value)};
+            const bool expected{std::ranges::find(expected_op_success, static_cast<uint8_t>(opcode_value)) != expected_op_success.end()};
+            BOOST_TEST_CONTEXT("opcode " << opcode_value) {
+                BOOST_CHECK_EQUAL(IsOpSuccess(opcode, sigversion), expected);
+            }
+        }
+    };
+
+    check_all_opcodes(SigVersion::TAPSCRIPT, tapscript_op_success);
+    check_all_opcodes(SigVersion::TAPSCRIPT_V2, tapscript_v2_op_success);
+}
+
+BOOST_AUTO_TEST_CASE(base_evalscript_rejects_tapscript_v2)
+{
+    Stack stack;
+    CScript script;
+    script << OP_TRUE;
+    ScriptExecutionData execdata;
+    ScriptError error{SCRIPT_ERR_OK};
+
+    BOOST_CHECK(!::EvalScript(stack, script, SCRIPT_VERIFY_NONE, BaseSignatureChecker{}, SigVersion::TAPSCRIPT_V2, execdata, &error));
+    BOOST_CHECK_EQUAL(error, SCRIPT_ERR_UNKNOWN_ERROR);
+    BOOST_CHECK(stack.empty());
+}
+
+BOOST_AUTO_TEST_CASE(tapscript_v2_leaf_requires_script_restoration_flag)
+{
+    CScript false_script;
+    false_script << OP_0;
+
+    EvalOutcome outcome{VerifyTapscriptV2WithFlags(false_script, {}, TAPROOT_SCRIPT_VERIFY_FLAGS, 0)};
+    BOOST_CHECK(outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_OK);
+
+    outcome = VerifyTapscriptV2WithFlags(false_script, {},
+                                         TAPROOT_SCRIPT_VERIFY_FLAGS | SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_TAPROOT_VERSION,
+                                         0);
+    BOOST_CHECK(!outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_DISCOURAGE_UPGRADABLE_TAPROOT_VERSION);
+
+    outcome = VerifyTapscriptV2WithFlags(false_script, {},
+                                         TAPROOT_SCRIPT_VERIFY_FLAGS | SCRIPT_VERIFY_DISCOURAGE_SCRIPT_RESTORATION,
+                                         0);
+    BOOST_CHECK(!outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_DISCOURAGE_SCRIPT_RESTORATION);
+
+    outcome = VerifyTapscriptV2WithFlags(false_script, {},
+                                         TAPROOT_SCRIPT_VERIFY_FLAGS | SCRIPT_VERIFY_SCRIPT_RESTORATION,
+                                         0);
+    BOOST_CHECK(!outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_EVAL_FALSE);
+
+    CScript true_script;
+    true_script << OP_1;
+    outcome = VerifyTapscriptV2WithFlags(true_script, {}, TAPSCRIPT_V2_SCRIPT_VERIFY_FLAGS, FinalSuccessCost(1));
+    BOOST_CHECK(outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_OK);
+}
+
+BOOST_AUTO_TEST_CASE(tapleaf_versions_isolate_restored_opcodes)
+{
+    const CScript restored_script{OneOp(OP_MUL)};
+
+    EvalOutcome outcome{VerifyTaprootLeafWithFlags(restored_script, {}, TAPROOT_LEAF_TAPSCRIPT,
+                                            TAPROOT_SCRIPT_VERIFY_FLAGS, 0)};
+    BOOST_CHECK(outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_OK);
+
+    outcome = VerifyTaprootLeafWithFlags(restored_script, {}, TAPROOT_LEAF_TAPSCRIPT_V2,
+                                         TAPROOT_SCRIPT_VERIFY_FLAGS, 0);
+    BOOST_CHECK(outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_OK);
+
+    outcome = VerifyTaprootLeafWithFlags(restored_script, {}, TAPROOT_LEAF_TAPSCRIPT_V2,
+                                         TAPSCRIPT_V2_SCRIPT_VERIFY_FLAGS, 0);
+    BOOST_CHECK(!outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_INVALID_STACK_OPERATION);
+
+    const CScript cat_script{OneOp(OP_CAT)};
+    outcome = VerifyTaprootLeafWithFlags(cat_script, {}, TAPROOT_LEAF_TAPSCRIPT,
+                                         TAPROOT_SCRIPT_VERIFY_FLAGS | SCRIPT_VERIFY_DISCOURAGE_OP_CAT, 0);
+    BOOST_CHECK(!outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_DISCOURAGE_OP_CAT);
+
+    outcome = VerifyTaprootLeafWithFlags(cat_script, {}, TAPROOT_LEAF_TAPSCRIPT,
+                                         TAPROOT_SCRIPT_VERIFY_FLAGS | SCRIPT_VERIFY_OP_CAT, 0);
+    BOOST_CHECK(!outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_INVALID_STACK_OPERATION);
+}
+
+BOOST_AUTO_TEST_CASE(splice_opcodes_follow_bip441_byte_ranges)
+{
+    CheckEval(OneOp(OP_CAT), {Bytes("ab"), Bytes("cde")}, {Bytes("abcde")}, (2 + 3) * varops::COST_COPYING);
+
+    CScript substr;
+    substr << OP_SUBSTR;
+    CheckEval(substr, {Bytes("abcdef"), Num(2), Num(3)}, {Bytes("cde")},
+              varops::LengthConversionCost(1) + varops::LengthConversionCost(1) + 3 * varops::COST_COPYING);
+    CheckError(substr, {Bytes("abcdef"), Num(2), Num(3)},
+               varops::LengthConversionCost(1) + varops::LengthConversionCost(1) + 3 * varops::COST_COPYING - 1,
+               SCRIPT_ERR_VAROP_COUNT);
+    CheckEval(substr, {Bytes("abcdef"), Num(9), Num(3)}, {Bytes({})},
+              varops::LengthConversionCost(1) + varops::LengthConversionCost(1));
+    CheckEval(substr, {Bytes("abcdef"), Num(6), Num(3)}, {Bytes({})},
+              varops::LengthConversionCost(1) + varops::LengthConversionCost(1));
+    CheckEval(substr, {Bytes("abcdef"), Num(4), Num(9)}, {Bytes("ef")},
+              varops::LengthConversionCost(1) + varops::LengthConversionCost(1) + 2 * varops::COST_COPYING);
+    CheckEval(substr, {Bytes("abcdef"), Num(2), LargerThanU64()}, {Bytes("cdef")},
+              varops::LengthConversionCost(1) + varops::LengthConversionCost(9) + 4 * varops::COST_COPYING);
+    CheckEval(substr, {Bytes("abcdef"), LargerThanU64(), LargerThanU64()}, {Bytes({})},
+              varops::LengthConversionCost(9) + varops::LengthConversionCost(9));
+
+    CheckEval(OneOp(OP_LEFT), {Bytes("abcdef"), Num(0)}, {Bytes({})}, 0);
+    CheckEval(OneOp(OP_LEFT), {Bytes("abcdef"), Num(2)}, {Bytes("ab")}, varops::LengthConversionCost(1));
+    CheckError(OneOp(OP_LEFT), {Bytes("abcdef"), Num(2)}, varops::LengthConversionCost(1) - 1,
+               SCRIPT_ERR_VAROP_COUNT);
+    CheckEval(OneOp(OP_LEFT), {Bytes("abcdef"), Num(9)}, {Bytes("abcdef")}, varops::LengthConversionCost(1));
+    CheckEval(OneOp(OP_LEFT), {Bytes("abcdef"), LargerThanU64()}, {Bytes("abcdef")}, varops::LengthConversionCost(9));
+    CheckEval(OneOp(OP_LEFT), {Bytes("abcdef"), Bytes({0x02, 0x00, 0x00})}, {Bytes("ab")},
+              varops::LengthConversionCost(3));
+
+    CheckEval(OneOp(OP_RIGHT), {Bytes("abcdef"), Num(0)}, {Bytes({})}, 0);
+    CheckEval(OneOp(OP_RIGHT), {Bytes("abcdef"), Num(2)}, {Bytes("ef")},
+              varops::LengthConversionCost(1) + 2 * varops::COST_COPYING);
+    CheckError(OneOp(OP_RIGHT), {Bytes("abcdef"), Num(2)},
+               varops::LengthConversionCost(1) + 2 * varops::COST_COPYING - 1,
+               SCRIPT_ERR_VAROP_COUNT);
+    CheckEval(OneOp(OP_RIGHT), {Bytes("abcdef"), Num(9)}, {Bytes("abcdef")},
+              varops::LengthConversionCost(1) + 6 * varops::COST_COPYING);
+    CheckEval(OneOp(OP_RIGHT), {Bytes("abcdef"), LargerThanU64()}, {Bytes("abcdef")},
+              varops::LengthConversionCost(9) + 6 * varops::COST_COPYING);
+    CheckEval(OneOp(OP_RIGHT), {Bytes("abcdef"), Bytes({0x02, 0x00, 0x00})}, {Bytes("ef")},
+              varops::LengthConversionCost(3) + 2 * varops::COST_COPYING);
+}
+
+BOOST_AUTO_TEST_CASE(length_operands_charge_encoded_width_even_when_value_is_zero)
+{
+    const valtype padded_zero{Bytes({0x00, 0x00, 0x00})};
+    const uint64_t padded_zero_cost{varops::LengthConversionCost(padded_zero.size())};
+
+    CheckEval(OneOp(OP_SUBSTR), {Bytes("abcdef"), padded_zero, padded_zero}, {Bytes({})},
+              padded_zero_cost + padded_zero_cost);
+    CheckError(OneOp(OP_SUBSTR), {Bytes("abcdef"), padded_zero, padded_zero},
+               padded_zero_cost + padded_zero_cost - 1, SCRIPT_ERR_VAROP_COUNT);
+
+    CheckEval(OneOp(OP_LEFT), {Bytes("abcdef"), padded_zero}, {Bytes({})}, padded_zero_cost);
+    CheckError(OneOp(OP_LEFT), {Bytes("abcdef"), padded_zero}, padded_zero_cost - 1,
+               SCRIPT_ERR_VAROP_COUNT);
+
+    CheckEval(OneOp(OP_RIGHT), {Bytes("abcdef"), padded_zero}, {Bytes({})}, padded_zero_cost);
+    CheckError(OneOp(OP_RIGHT), {Bytes("abcdef"), padded_zero}, padded_zero_cost - 1,
+               SCRIPT_ERR_VAROP_COUNT);
+
+    CheckEval(OneOp(OP_LSHIFT), {Bytes({0x12, 0x34}), padded_zero}, {Bytes({0x12, 0x34})},
+              padded_zero_cost + 2 * varops::COST_COPYING);
+    CheckError(OneOp(OP_LSHIFT), {Bytes({0x12, 0x34}), padded_zero},
+               padded_zero_cost + 2 * varops::COST_COPYING - 1, SCRIPT_ERR_VAROP_COUNT);
+
+    CheckEval(OneOp(OP_RSHIFT), {Bytes({0x12, 0x34}), padded_zero}, {Bytes({0x12, 0x34})},
+              padded_zero_cost + 2 * varops::COST_COPYING);
+    CheckError(OneOp(OP_RSHIFT), {Bytes({0x12, 0x34}), padded_zero},
+               padded_zero_cost + 2 * varops::COST_COPYING - 1, SCRIPT_ERR_VAROP_COUNT);
+}
+
+BOOST_AUTO_TEST_CASE(restored_bit_opcodes_preserve_non_arithmetic_width)
+{
+    CheckEval(OneOp(OP_INVERT), {Bytes({0x00, 0xff})}, {Bytes({0xff, 0x00})}, varops::InvertCost(2));
+    CheckEval(OneOp(OP_AND), {Bytes({0xff, 0xff}), Bytes({0x0f})}, {Bytes({0x0f, 0x00})}, varops::AndCost(2, 1));
+    CheckEval(OneOp(OP_OR), {Bytes({0x00, 0x00}), Bytes({0x00})}, {Bytes({0x00, 0x00})}, varops::OrCost(2, 1));
+    CheckEval(OneOp(OP_XOR), {Bytes({0x01, 0x00}), Bytes({0x01})}, {Bytes({0x00, 0x00})}, varops::XorCost(2, 1));
+
+    CScript invert_then_add;
+    invert_then_add << OP_INVERT << OP_1ADD;
+    CheckEval(invert_then_add, {Bytes({0x00})}, {Bytes({0x00, 0x01})},
+              varops::InvertCost(1) + varops::AddCost(1, 1));
+}
+
+BOOST_AUTO_TEST_CASE(restored_shift_opcodes_are_raw_bitshifts)
+{
+    CheckEval(OneOp(OP_LSHIFT), {Bytes({0x12, 0x34}), Num(0)}, {Bytes({0x12, 0x34})},
+              2 * varops::COST_COPYING);
+    CheckEval(OneOp(OP_LSHIFT), {Bytes({0x01}), Num(1)}, {Bytes({0x02, 0x00})},
+              varops::LengthConversionCost(1) + 1 * varops::COST_COPYING + varops::UnalignedUpShiftCost(1, 0));
+    CheckError(OneOp(OP_LSHIFT), {Bytes({0x01}), Num(1)},
+               varops::LengthConversionCost(1) + 1 * varops::COST_COPYING + varops::UnalignedUpShiftCost(1, 0) - 1,
+               SCRIPT_ERR_VAROP_COUNT);
+    CheckEval(OneOp(OP_LSHIFT), {Bytes({}), Num(1)}, {Bytes({0x00})}, varops::LengthConversionCost(1));
+    CheckEval(OneOp(OP_LSHIFT), {Bytes({0x01}), Num(8)}, {Bytes({0x00, 0x01})},
+              varops::LengthConversionCost(1) + 1 * varops::COST_FAST + 1 * varops::COST_COPYING);
+    CheckError(OneOp(OP_LSHIFT), {Bytes({0x01}), Num(8)},
+               varops::LengthConversionCost(1) + 1 * varops::COST_FAST + 1 * varops::COST_COPYING - 1,
+               SCRIPT_ERR_VAROP_COUNT);
+    CheckEval(OneOp(OP_RSHIFT), {Bytes({0x12, 0x34}), Num(0)}, {Bytes({0x12, 0x34})},
+              2 * varops::COST_COPYING);
+    CheckEval(OneOp(OP_RSHIFT), {Bytes({0x02, 0x00}), Num(1)}, {Bytes({0x01, 0x00})},
+              varops::LengthConversionCost(1) + 2 * varops::COST_COPYING);
+    CheckError(OneOp(OP_RSHIFT), {Bytes({0x02, 0x00}), Num(1)},
+               varops::LengthConversionCost(1) + 2 * varops::COST_COPYING - 1,
+               SCRIPT_ERR_VAROP_COUNT);
+    CheckEval(OneOp(OP_RSHIFT), {Bytes({}), Num(1)}, {Bytes({})}, varops::LengthConversionCost(1));
+    CheckEval(OneOp(OP_RSHIFT), {Bytes({0xff}), Num(8)}, {Bytes({})}, varops::LengthConversionCost(1));
+    CheckEval(OneOp(OP_RSHIFT), {Bytes({0x12, 0x34}), LargerThanU64()}, {Bytes({})},
+              varops::LengthConversionCost(9));
+    CheckError(OneOp(OP_LSHIFT), {Bytes({0x01}), LargerThanU64()}, 0, SCRIPT_ERR_STACK_ELEMENT_SIZE);
+}
+
+BOOST_AUTO_TEST_CASE(tapscript_v2_costed_opcodes_reject_missing_stack_elements)
+{
+    for (const auto& [opcode, stack] : {
+             std::pair{OP_VERIFY, Stack{}},
+             std::pair{OP_2DUP, Stack{Bytes("a")}},
+             std::pair{OP_3DUP, Stack{Bytes("a"), Bytes("b")}},
+             std::pair{OP_2OVER, Stack{Bytes("a"), Bytes("b"), Bytes("c")}},
+             std::pair{OP_IFDUP, Stack{}},
+             std::pair{OP_DUP, Stack{}},
+             std::pair{OP_OVER, Stack{Bytes("a")}},
+             std::pair{OP_PICK, Stack{Num(0)}},
+             std::pair{OP_ROLL, Stack{Num(0)}},
+             std::pair{OP_ROT, Stack{Bytes("a"), Bytes("b")}},
+             std::pair{OP_SWAP, Stack{Bytes("a")}},
+             std::pair{OP_TUCK, Stack{Bytes("a")}},
+             std::pair{OP_SIZE, Stack{}},
+             std::pair{OP_EQUAL, Stack{Bytes("a")}},
+             std::pair{OP_EQUALVERIFY, Stack{Bytes("a")}},
+             std::pair{OP_NOT, Stack{}},
+             std::pair{OP_0NOTEQUAL, Stack{}},
+             std::pair{OP_BOOLAND, Stack{Bytes("a")}},
+             std::pair{OP_BOOLOR, Stack{Bytes("a")}},
+             std::pair{OP_NUMEQUAL, Stack{Bytes("a")}},
+             std::pair{OP_NUMEQUALVERIFY, Stack{Bytes("a")}},
+             std::pair{OP_NUMNOTEQUAL, Stack{Bytes("a")}},
+             std::pair{OP_LESSTHAN, Stack{Bytes("a")}},
+             std::pair{OP_GREATERTHAN, Stack{Bytes("a")}},
+             std::pair{OP_LESSTHANOREQUAL, Stack{Bytes("a")}},
+             std::pair{OP_GREATERTHANOREQUAL, Stack{Bytes("a")}},
+             std::pair{OP_WITHIN, Stack{Bytes("a"), Bytes("b")}},
+             std::pair{OP_RIPEMD160, Stack{}},
+             std::pair{OP_SHA1, Stack{}},
+             std::pair{OP_SHA256, Stack{}},
+             std::pair{OP_HASH160, Stack{}},
+             std::pair{OP_HASH256, Stack{}},
+             std::pair{OP_CAT, Stack{Bytes("a")}},
+             std::pair{OP_SUBSTR, Stack{Bytes("a"), Num(0)}},
+             std::pair{OP_LEFT, Stack{Bytes("a")}},
+             std::pair{OP_RIGHT, Stack{Bytes("a")}},
+             std::pair{OP_INVERT, Stack{}},
+             std::pair{OP_AND, Stack{Bytes("a")}},
+             std::pair{OP_OR, Stack{Bytes("a")}},
+             std::pair{OP_XOR, Stack{Bytes("a")}},
+             std::pair{OP_1ADD, Stack{}},
+             std::pair{OP_1SUB, Stack{}},
+             std::pair{OP_2MUL, Stack{}},
+             std::pair{OP_2DIV, Stack{}},
+             std::pair{OP_ADD, Stack{Bytes("a")}},
+             std::pair{OP_SUB, Stack{Bytes("a")}},
+             std::pair{OP_MUL, Stack{Bytes("a")}},
+             std::pair{OP_DIV, Stack{Bytes("a")}},
+             std::pair{OP_MOD, Stack{Bytes("a")}},
+             std::pair{OP_MIN, Stack{Bytes("a")}},
+             std::pair{OP_MAX, Stack{Bytes("a")}},
+             std::pair{OP_LSHIFT, Stack{Bytes("a")}},
+             std::pair{OP_RSHIFT, Stack{Bytes("a")}},
+         }) {
+        BOOST_TEST_CONTEXT("opcode " << static_cast<int>(opcode)) {
+            CheckError(OneOp(opcode), stack, 0, SCRIPT_ERR_INVALID_STACK_OPERATION);
+        }
+    }
+}
+
+BOOST_AUTO_TEST_CASE(bip342_restricted_opcodes_remain_restricted_in_tapscript_v2)
+{
+    CheckError(OneOp(OP_RETURN), {}, 0, SCRIPT_ERR_OP_RETURN);
+    CheckError(OneOp(OP_CHECKMULTISIG), {}, 0, SCRIPT_ERR_TAPSCRIPT_CHECKMULTISIG);
+    CheckError(OneOp(OP_CHECKMULTISIGVERIFY), {}, 0, SCRIPT_ERR_TAPSCRIPT_CHECKMULTISIG);
+}
+
+BOOST_AUTO_TEST_CASE(restored_multiply_divide_and_modulo_opcodes)
+{
+    CheckEval(OneOp(OP_2MUL), {Bytes({0x80})}, {Bytes({0x00, 0x01})}, varops::TwoMulCost(1));
+    CheckEval(OneOp(OP_2DIV), {Bytes({0x01})}, {Bytes({})}, varops::TwoDivCost(1));
+
+    CheckEval(OneOp(OP_MUL), {Bytes({0xff, 0xff}), Bytes({0x02})}, {Bytes({0xfe, 0xff, 0x01})}, varops::MulCost(2, 1));
+    CheckEval(OneOp(OP_DIV), {Bytes({0x39, 0x30}), Bytes({0x64})}, {Bytes({0x7b})}, varops::DivCost(2, 1));
+    CheckEval(OneOp(OP_MOD), {Bytes({0x39, 0x30}), Bytes({0x64})}, {Bytes({0x2d})}, varops::ModCost(2, 1));
+
+    for (const valtype& divisor : {Bytes({}), Bytes({0x00, 0x00})}) {
+        CheckError(OneOp(OP_DIV), {Bytes({0x01}), divisor}, varops::DivCost(1, divisor.size()), SCRIPT_ERR_DIVIDE_BY_ZERO);
+        CheckError(OneOp(OP_MOD), {Bytes({0x01}), divisor}, varops::ModCost(1, divisor.size()), SCRIPT_ERR_DIVIDE_BY_ZERO);
+    }
+}
+
+BOOST_AUTO_TEST_CASE(extended_arithmetic_is_unsigned_and_normalized)
+{
+    CheckEval(OneOp(OP_1ADD), {Bytes({0xff})}, {Bytes({0x00, 0x01})}, varops::AddCost(1, 1));
+    CheckEval(OneOp(OP_1SUB), {Bytes({0x01})}, {Bytes({})}, varops::SubCost(1, 1));
+    CheckEval(OneOp(OP_ADD), {Bytes({0x01, 0x00, 0x00}), Bytes({})}, {Bytes({0x01})}, varops::AddCost(3, 0));
+    CheckEval(OneOp(OP_SUB), {Bytes({0x00, 0x01}), Bytes({0x01})}, {Bytes({0xff})}, varops::SubCost(2, 1));
+
+    CheckError(OneOp(OP_1SUB), {Bytes({})}, varops::SubCost(0, 1), SCRIPT_ERR_SUB_UNDERFLOW);
+    CheckError(OneOp(OP_1SUB), {Bytes({0x00})}, varops::SubCost(1, 1), SCRIPT_ERR_SUB_UNDERFLOW);
+    CheckError(OneOp(OP_SUB), {Bytes({0x01}), Bytes({0x02})}, varops::SubCost(1, 1), SCRIPT_ERR_SUB_UNDERFLOW);
+    CheckError(OneOp(OP_SUB), {Bytes({0x00}), Bytes({0x01})}, varops::SubCost(1, 1), SCRIPT_ERR_SUB_UNDERFLOW);
+
+    CheckEval(OneOp(OP_MIN), {Bytes({0x01, 0x00}), Bytes({0x02})}, {Bytes({0x01})}, varops::MinMaxCost(2, 1));
+    CheckEval(OneOp(OP_MAX), {Bytes({0x01, 0x00}), Bytes({0x02})}, {Bytes({0x02})}, varops::MinMaxCost(2, 1));
+}
+
+BOOST_AUTO_TEST_CASE(checksigadd_failure_normalizes_numeric_operand)
+{
+    const valtype empty_sig{};
+    const valtype nonminimal_one{Bytes({0x01, 0x00})};
+    const valtype minimal_one{Bytes({0x01})};
+    const valtype xonly_pubkey(32, 0x02);
+
+    CScript script;
+    script << OP_CHECKSIGADD << minimal_one << OP_EQUAL;
+
+    const uint64_t cost{varops::ChecksigAddIncrementCost(nonminimal_one.size()) +
+                        minimal_one.size() * varops::COST_FAST + FinalSuccessCost(1)};
+    const EvalOutcome outcome{VerifyTapscriptV2(script, {empty_sig, nonminimal_one, xonly_pubkey}, cost)};
+    BOOST_CHECK(outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_OK);
+}
+
+BOOST_AUTO_TEST_CASE(checksigadd_enforces_numeric_result_boundaries)
+{
+    const valtype empty_sig{};
+    const valtype nonempty_sig(64, 0x01);
+    const valtype xonly_pubkey(32, 0x02);
+    const valtype all_zero(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE, 0x00);
+    const valtype all_ff(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE, 0xff);
+    const CScript script{OneOp(OP_CHECKSIGADD)};
+
+    {
+        RecordingChecker checker;
+        const uint64_t cost{varops::COST_PER_SIGOP + varops::ChecksigAddIncrementCost(all_ff.size())};
+        const EvalOutcome outcome{EvalTapscriptV2WithFlagsAndChecker(script, {nonempty_sig, all_ff, xonly_pubkey},
+                                                              SCRIPT_VERIFY_NONE, checker, cost)};
+        BOOST_CHECK(!outcome.ok);
+        BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_STACK_ELEMENT_SIZE);
+        BOOST_CHECK_EQUAL(outcome.remaining_budget, 0);
+        BOOST_CHECK_EQUAL(checker.schnorr_calls, 1);
+    }
+
+    {
+        RecordingChecker checker;
+        const uint64_t cost{varops::COST_PER_SIGOP + varops::ChecksigAddIncrementCost(all_zero.size())};
+        const EvalOutcome outcome{EvalTapscriptV2WithFlagsAndChecker(script, {nonempty_sig, all_zero, xonly_pubkey},
+                                                              SCRIPT_VERIFY_NONE, checker, cost)};
+        BOOST_REQUIRE(outcome.ok);
+        BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_OK);
+        BOOST_CHECK(outcome.stack == Stack{{0x01}});
+    }
+
+    {
+        RecordingChecker checker;
+        const uint64_t cost{varops::ChecksigAddIncrementCost(all_zero.size())};
+        const EvalOutcome outcome{EvalTapscriptV2WithFlagsAndChecker(script, {empty_sig, all_zero, xonly_pubkey},
+                                                              SCRIPT_VERIFY_NONE, checker, cost)};
+        BOOST_REQUIRE(outcome.ok);
+        BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_OK);
+        BOOST_CHECK(outcome.stack == Stack{{}});
+        BOOST_CHECK_EQUAL(checker.schnorr_calls, 0);
+    }
+
+    {
+        RecordingChecker checker;
+        const valtype empty_pubkey{};
+        const valtype number{0xff};
+        const uint64_t cost{varops::COST_PER_SIGOP + varops::ChecksigAddIncrementCost(number.size())};
+        const EvalOutcome outcome{EvalTapscriptV2WithFlagsAndChecker(script, {nonempty_sig, number, empty_pubkey},
+                                                              SCRIPT_VERIFY_NONE, checker, cost)};
+        BOOST_CHECK(!outcome.ok);
+        BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_PUBKEYTYPE);
+        BOOST_CHECK_EQUAL(outcome.remaining_budget, 0);
+        BOOST_CHECK_EQUAL(checker.schnorr_calls, 0);
+    }
+}
+
+BOOST_AUTO_TEST_CASE(bip440_costed_legacy_ops_use_unsigned_values)
+{
+    CheckEval(OneOp(OP_EQUAL), {Bytes("same"), Bytes("same")}, {Bytes({0x01})}, 4 * varops::COST_FAST);
+    CheckEval(OneOp(OP_EQUAL), {Bytes("a"), Bytes("bb")}, {Bytes({})}, 0);
+    CheckEval(OneOp(OP_VERIFY), {Bytes({0x00, 0x01})}, {}, varops::LengthConversionCost(2));
+    CheckError(OneOp(OP_VERIFY), {Bytes({})}, 0, SCRIPT_ERR_VERIFY);
+    CheckError(OneOp(OP_VERIFY), {Bytes({0x00, 0x00})}, varops::CompareZeroCost(2), SCRIPT_ERR_VERIFY);
+
+    CheckEval(OneOp(OP_NOT), {Bytes({0x00, 0x00})}, {Bytes({0x01})}, varops::CompareZeroCost(2));
+    CheckEval(OneOp(OP_0NOTEQUAL), {Bytes({0x00, 0x01})}, {Bytes({0x01})}, varops::CompareZeroCost(2));
+    CheckEval(OneOp(OP_NUMEQUAL), {Bytes({0x01}), Bytes({0x01, 0x00, 0x00})}, {Bytes({0x01})}, varops::ComparisonCost(1, 3));
+    CheckEval(OneOp(OP_BOOLAND), {Bytes({0x01, 0x00}), Bytes({})}, {Bytes({})}, varops::BoolAndCost(2, 0));
+
+    CheckEval(OneOp(OP_PICK), {Bytes("bottom"), Bytes("top"), Bytes({0x01, 0x00, 0x00})}, {Bytes("bottom"), Bytes("top"), Bytes("bottom")},
+              varops::LengthConversionCost(3) + 6 * varops::COST_COPYING);
+    CheckEval(OneOp(OP_ROLL), {Bytes("bottom"), Bytes("top"), Bytes({0x01, 0x00, 0x00})}, {Bytes("top"), Bytes("bottom")},
+              varops::LengthConversionCost(3) + 1 * varops::COST_ROLL);
+}
+
+BOOST_AUTO_TEST_CASE(costed_legacy_ops_report_exact_semantic_failures)
+{
+    CheckError(OneOp(OP_EQUALVERIFY), {Bytes("ab"), Bytes("ac")},
+               2 * varops::COST_FAST, SCRIPT_ERR_EQUALVERIFY);
+    CheckError(OneOp(OP_NUMEQUALVERIFY), {Bytes({0x01}), Bytes({0x02})},
+               varops::ComparisonCost(1, 1), SCRIPT_ERR_NUMEQUALVERIFY);
+
+    CheckError(OneOp(OP_PICK), {Bytes("only"), Num(1)},
+               varops::LengthConversionCost(1), SCRIPT_ERR_INVALID_STACK_OPERATION);
+    CheckError(OneOp(OP_ROLL), {Bytes("only"), Bytes({0xff})},
+               varops::LengthConversionCost(1), SCRIPT_ERR_INVALID_STACK_OPERATION);
+}
+
+BOOST_AUTO_TEST_CASE(locktime_sequence_operands_must_fit_transaction_fields)
+{
+    const CScript cltv_script{OneOp(OP_CHECKLOCKTIMEVERIFY)};
+    const CScript csv_script{OneOp(OP_CHECKSEQUENCEVERIFY)};
+    const valtype padded_uint32_max{Bytes({0xff, 0xff, 0xff, 0xff, 0x00})};
+    const valtype padded_one{Bytes({0x01, 0x00, 0x00, 0x00, 0x00})};
+    const valtype uint32_overflow{Bytes({0x00, 0x00, 0x00, 0x00, 0x01})};
+    const valtype overflow_with_csv_disable_flag{Bytes({0x00, 0x00, 0x00, 0x80, 0x01})};
+
+    {
+        RecordingChecker checker;
+        const EvalOutcome outcome{EvalTapscriptV2WithFlagsAndChecker(cltv_script, {padded_uint32_max},
+                                                      SCRIPT_VERIFY_CHECKLOCKTIMEVERIFY,
+                                                      checker, varops::LengthConversionCost(padded_uint32_max.size()))};
+        BOOST_CHECK(outcome.ok);
+        BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_OK);
+        BOOST_CHECK_EQUAL(outcome.remaining_budget, 0);
+        BOOST_CHECK_EQUAL(checker.locktime_calls, 1);
+        BOOST_CHECK_EQUAL(checker.last_locktime, 0xffffffff);
+        BOOST_REQUIRE_EQUAL(outcome.stack.size(), 1);
+        BOOST_CHECK(outcome.stack.back() == padded_uint32_max);
+    }
+
+    {
+        RecordingChecker checker;
+        const EvalOutcome outcome{EvalTapscriptV2WithFlagsAndChecker(cltv_script, {uint32_overflow},
+                                                      SCRIPT_VERIFY_CHECKLOCKTIMEVERIFY,
+                                                      checker, varops::LengthConversionCost(uint32_overflow.size()))};
+        BOOST_CHECK(!outcome.ok);
+        BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_UNSATISFIED_LOCKTIME);
+        BOOST_CHECK_EQUAL(checker.locktime_calls, 0);
+    }
+
+    {
+        RecordingChecker checker;
+        const EvalOutcome outcome{EvalTapscriptV2WithFlagsAndChecker(csv_script, {padded_one},
+                                                      SCRIPT_VERIFY_CHECKSEQUENCEVERIFY,
+                                                      checker, varops::LengthConversionCost(padded_one.size()))};
+        BOOST_CHECK(outcome.ok);
+        BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_OK);
+        BOOST_CHECK_EQUAL(outcome.remaining_budget, 0);
+        BOOST_CHECK_EQUAL(checker.sequence_calls, 1);
+        BOOST_CHECK_EQUAL(checker.last_sequence, 1);
+        BOOST_REQUIRE_EQUAL(outcome.stack.size(), 1);
+        BOOST_CHECK(outcome.stack.back() == padded_one);
+    }
+
+    {
+        RecordingChecker checker;
+        const EvalOutcome outcome{EvalTapscriptV2WithFlagsAndChecker(csv_script, {uint32_overflow},
+                                                      SCRIPT_VERIFY_CHECKSEQUENCEVERIFY,
+                                                      checker, varops::LengthConversionCost(uint32_overflow.size()))};
+        BOOST_CHECK(!outcome.ok);
+        BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_UNSATISFIED_LOCKTIME);
+        BOOST_CHECK_EQUAL(checker.sequence_calls, 0);
+    }
+
+    {
+        RecordingChecker checker;
+        const EvalOutcome outcome{EvalTapscriptV2WithFlagsAndChecker(csv_script, {overflow_with_csv_disable_flag},
+                                                      SCRIPT_VERIFY_CHECKSEQUENCEVERIFY,
+                                                      checker, varops::LengthConversionCost(overflow_with_csv_disable_flag.size()))};
+        BOOST_CHECK(!outcome.ok);
+        BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_UNSATISFIED_LOCKTIME);
+        BOOST_CHECK_EQUAL(checker.sequence_calls, 0);
+    }
+}
+
+BOOST_AUTO_TEST_CASE(hash_opcodes_follow_bip441_limits)
+{
+    const valtype large(MAX_SCRIPT_ELEMENT_SIZE + 1, 0x42);
+
+    CheckError(OneOp(OP_SHA1), {large}, 0, SCRIPT_ERR_HASH_OPERAND_SIZE);
+    CheckError(OneOp(OP_RIPEMD160), {large}, 0, SCRIPT_ERR_HASH_OPERAND_SIZE);
+
+    const EvalOutcome sha256_out{EvalTapscriptV2(OneOp(OP_SHA256), {large}, large.size() * varops::COST_HASH)};
+    BOOST_REQUIRE(sha256_out.ok);
+    BOOST_CHECK_EQUAL(sha256_out.error, SCRIPT_ERR_OK);
+    BOOST_CHECK_EQUAL(sha256_out.remaining_budget, 0);
+    BOOST_REQUIRE_EQUAL(sha256_out.stack.size(), 1);
+    BOOST_CHECK_EQUAL(sha256_out.stack[0].size(), 32);
+}
+
+BOOST_AUTO_TEST_CASE(tapscript_v2_stack_limits_are_enforced)
+{
+    Stack max_count_stack(MAX_TAPSCRIPT_V2_STACK_SIZE, Bytes({}));
+    CheckEval(OneOp(OP_NOP), max_count_stack, max_count_stack, 0);
+    CheckError(OneOp(OP_1), max_count_stack, 0, SCRIPT_ERR_STACK_SIZE);
+    CheckError(OneOp(OP_DUP), max_count_stack, 0, SCRIPT_ERR_STACK_SIZE);
+    CheckError(OneOp(OP_DEPTH), max_count_stack, 0, SCRIPT_ERR_STACK_SIZE);
+
+    Stack one_below_max_count(MAX_TAPSCRIPT_V2_STACK_SIZE - 1, Bytes({}));
+    CheckError(OneOp(OP_2DUP), one_below_max_count, 0, SCRIPT_ERR_STACK_SIZE);
+    CheckError(OneOp(OP_2OVER), one_below_max_count, 0, SCRIPT_ERR_STACK_SIZE);
+
+    Stack two_below_max_count(MAX_TAPSCRIPT_V2_STACK_SIZE - 2, Bytes({}));
+    CheckError(OneOp(OP_3DUP), two_below_max_count, 0, SCRIPT_ERR_STACK_SIZE);
+
+    const EvalOutcome one_below_depth{EvalTapscriptV2(OneOp(OP_DEPTH), one_below_max_count, 0)};
+    BOOST_REQUIRE(one_below_depth.ok);
+    BOOST_CHECK_EQUAL(one_below_depth.error, SCRIPT_ERR_OK);
+    BOOST_CHECK_EQUAL(one_below_depth.remaining_budget, 0);
+    BOOST_REQUIRE_EQUAL(one_below_depth.stack.size(), MAX_TAPSCRIPT_V2_STACK_SIZE);
+    BOOST_CHECK(one_below_depth.stack.back() == Bytes({0xff, 0x7f}));
+
+    Stack max_count_true_top(MAX_TAPSCRIPT_V2_STACK_SIZE, Bytes({}));
+    max_count_true_top.back() = Bytes({0x01});
+    CheckError(OneOp(OP_IFDUP), max_count_true_top,
+               varops::CompareZeroCost(1) + varops::COST_COPYING,
+               SCRIPT_ERR_STACK_SIZE);
+
+    const valtype max_element(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE, 0x01);
+    CheckEval(OneOp(OP_NOP), {max_element}, {max_element}, 0);
+
+    const EvalOutcome max_element_size{EvalTapscriptV2(OneOp(OP_SIZE), {max_element}, 0)};
+    BOOST_REQUIRE(max_element_size.ok);
+    BOOST_CHECK_EQUAL(max_element_size.error, SCRIPT_ERR_OK);
+    BOOST_CHECK_EQUAL(max_element_size.remaining_budget, 0);
+    BOOST_REQUIRE_EQUAL(max_element_size.stack.size(), 2);
+    BOOST_CHECK(max_element_size.stack.back() == Bytes({0x00, 0x09, 0x3d}));
+
+    const valtype too_large_element(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE + 1, 0x01);
+    CheckError(OneOp(OP_NOP), {too_large_element}, 0, SCRIPT_ERR_STACK_ELEMENT_SIZE);
+
+    const valtype four_mb(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE, 0x02);
+    CheckEval(OneOp(OP_NOP), {four_mb, four_mb}, {four_mb, four_mb}, 0);
+    CheckError(OneOp(OP_NOP), {four_mb, four_mb, Bytes({0x01})}, 0, SCRIPT_ERR_TOTAL_STACK_SIZE);
+    CheckEval(OneOp(OP_DUP), {four_mb}, {four_mb, four_mb}, four_mb.size() * varops::COST_COPYING);
+    CheckError(OneOp(OP_DUP), {Bytes({0x01}), four_mb}, four_mb.size() * varops::COST_COPYING,
+               SCRIPT_ERR_TOTAL_STACK_SIZE);
+}
+
+BOOST_AUTO_TEST_CASE(copying_opcodes_enforce_total_stack_size_with_altstack)
+{
+    constexpr uint64_t budget{250'000'000};
+    const valtype one_byte(1, 0x01);
+    const valtype almost_max(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE - 1, 0x01);
+    const valtype almost_max_minus_one(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE - 2, 0x01);
+    const valtype almost_max_minus_two(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE - 3, 0x01);
+
+    const auto check_boundary = [&](opcodetype opcode, const Stack& main_stack,
+                                    size_t success_altstack_size, size_t failure_altstack_size) {
+        CScript script;
+        script << OP_TOALTSTACK << opcode;
+
+        const auto evaluate = [&](size_t altstack_size) {
+            Stack initial_stack{main_stack};
+            initial_stack.emplace_back(altstack_size, 0x01);
+            return EvalTapscriptV2(script, initial_stack, budget);
+        };
+
+        BOOST_TEST_CONTEXT("opcode " << static_cast<int>(opcode)) {
+            const EvalOutcome success{evaluate(success_altstack_size)};
+            BOOST_CHECK(success.ok);
+            BOOST_CHECK_EQUAL(success.error, SCRIPT_ERR_OK);
+
+            const EvalOutcome failure{evaluate(failure_altstack_size)};
+            BOOST_CHECK(!failure.ok);
+            BOOST_CHECK_EQUAL(failure.error, SCRIPT_ERR_TOTAL_STACK_SIZE);
+        }
+    };
+
+    // Each successful execution ends with exactly 8,000,000 bytes across the
+    // main and alt stacks. Increasing only the altstack element by one byte
+    // makes the same opcode fail at 8,000,001 bytes.
+    check_boundary(OP_2DUP, {one_byte, almost_max_minus_one}, 2, 3);
+    check_boundary(OP_3DUP, {one_byte, one_byte, almost_max_minus_two}, 2, 3);
+    check_boundary(OP_2OVER, {one_byte, almost_max_minus_one, Bytes({}), Bytes({})}, 2, 3);
+    check_boundary(OP_IFDUP, {almost_max}, 2, 3);
+    check_boundary(OP_DUP, {almost_max}, 2, 3);
+    check_boundary(OP_OVER, {almost_max, one_byte}, 1, 2);
+    check_boundary(OP_TUCK, {one_byte, almost_max}, 1, 2);
+    check_boundary(OP_PICK, {almost_max, one_byte, Num(1)}, 1, 2);
+}
+
+BOOST_AUTO_TEST_CASE(tapscript_v2_witness_initial_stack_limits_are_enforced)
+{
+    CScript true_script;
+    true_script << OP_1;
+
+    Stack too_many_stack(MAX_TAPSCRIPT_V2_STACK_SIZE + 1, valtype{});
+    EvalOutcome outcome{VerifyTapscriptV2(true_script, too_many_stack, 1'000)};
+    BOOST_CHECK(!outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_STACK_SIZE);
+
+    CScript nop_true_script;
+    nop_true_script << OP_NOP << OP_1;
+    const valtype too_large_element(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE + 1, 0x01);
+    outcome = VerifyTapscriptV2(nop_true_script, {too_large_element}, 1'000);
+    BOOST_CHECK(!outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_STACK_ELEMENT_SIZE);
+
+    const valtype four_mb(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE, 0x01);
+    outcome = VerifyTapscriptV2(nop_true_script, {four_mb, four_mb, Bytes({0x01})}, 1'000);
+    BOOST_CHECK(!outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_TOTAL_STACK_SIZE);
+}
+
+BOOST_AUTO_TEST_CASE(tapscript_v2_pushes_use_the_expanded_stack_element_limit)
+{
+    const valtype max_element(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE, 0x01);
+    CScript max_push;
+    max_push << max_element;
+    EvalOutcome outcome{VerifyTapscriptV2(max_push, {}, FinalSuccessCost(max_element.size()))};
+    BOOST_CHECK(outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_OK);
+
+    const valtype too_large_element(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE + 1, 0x01);
+    CScript too_large_push;
+    too_large_push << too_large_element;
+    outcome = VerifyTapscriptV2(too_large_push, {}, 0);
+    BOOST_CHECK(!outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_PUSH_SIZE);
+}
+
+BOOST_AUTO_TEST_CASE(tapscript_v2_skipped_branches_validate_pushes)
+{
+    const valtype max_element(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE, 0x01);
+    CScript max_skipped_push;
+    max_skipped_push << OP_0 << OP_IF << max_element << OP_ENDIF;
+    CheckEval(max_skipped_push, {}, {}, 0);
+
+    const valtype too_large_element(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE + 1, 0x01);
+    CScript oversized_skipped_push;
+    oversized_skipped_push << OP_0 << OP_IF << too_large_element << OP_ENDIF;
+    CheckError(oversized_skipped_push, {}, 0, SCRIPT_ERR_PUSH_SIZE);
+
+    CScript truncated_skipped_push;
+    truncated_skipped_push << OP_0 << OP_IF;
+    truncated_skipped_push.push_back(static_cast<unsigned char>(OP_PUSHDATA4));
+    CheckError(truncated_skipped_push, {}, 0, SCRIPT_ERR_BAD_OPCODE);
+}
+
+BOOST_AUTO_TEST_CASE(restored_ops_enforce_stack_element_limit_edges)
+{
+    const valtype max_element(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE, 0x01);
+    const valtype half_element(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE / 2, 0x01);
+
+    CheckEval(OneOp(OP_CAT), {half_element, half_element}, {max_element},
+              MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE * varops::COST_COPYING);
+
+    CheckError(OneOp(OP_CAT), {max_element, Bytes({0x01})},
+               (max_element.size() + 1) * varops::COST_COPYING,
+               SCRIPT_ERR_STACK_ELEMENT_SIZE);
+
+    const valtype one_byte_below_max(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE - 1, 0x01);
+    valtype byte_shifted_to_max(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE, 0x01);
+    byte_shifted_to_max.front() = 0x00;
+    CheckEval(OneOp(OP_LSHIFT), {one_byte_below_max, Num(8)}, {byte_shifted_to_max},
+              varops::LengthConversionCost(1) + varops::COST_FAST +
+                  one_byte_below_max.size() * varops::COST_COPYING);
+
+    CheckError(OneOp(OP_LSHIFT), {max_element, Num(1)}, 0, SCRIPT_ERR_STACK_ELEMENT_SIZE);
+
+    const valtype max_ff_element(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE, 0xff);
+    CheckError(OneOp(OP_1ADD), {max_ff_element}, varops::AddCost(max_ff_element.size(), 1),
+               SCRIPT_ERR_STACK_ELEMENT_SIZE);
+    CheckError(OneOp(OP_2MUL), {max_ff_element}, varops::TwoMulCost(max_ff_element.size()),
+               SCRIPT_ERR_STACK_ELEMENT_SIZE);
+}
+
+BOOST_AUTO_TEST_CASE(varops_budget_must_cover_exact_bip_cost)
+{
+    CheckEval(OneOp(OP_CAT), {Bytes("a"), Bytes("b")}, {Bytes("ab")}, 2 * varops::COST_COPYING);
+    CheckError(OneOp(OP_CAT), {Bytes("a"), Bytes("b")}, 2 * varops::COST_COPYING - 1, SCRIPT_ERR_VAROP_COUNT);
+
+    CheckEval(OneOp(OP_MUL), {Bytes({0xff}), Bytes({0xff})}, {Bytes({0x01, 0xfe})}, varops::MulCost(1, 1));
+    CheckError(OneOp(OP_MUL), {Bytes({0xff}), Bytes({0xff})}, varops::MulCost(1, 1) - 1, SCRIPT_ERR_VAROP_COUNT);
+
+    CheckEval(OneOp(OP_DIV), {Bytes({0x39, 0x30}), Bytes({0x64})}, {Bytes({0x7b})}, varops::DivCost(2, 1));
+    CheckError(OneOp(OP_DIV), {Bytes({0x39, 0x30}), Bytes({0x64})}, varops::DivCost(2, 1) - 1, SCRIPT_ERR_VAROP_COUNT);
+
+    CheckEval(OneOp(OP_MOD), {Bytes({0x39, 0x30}), Bytes({0x64})}, {Bytes({0x2d})}, varops::ModCost(2, 1));
+    CheckError(OneOp(OP_MOD), {Bytes({0x39, 0x30}), Bytes({0x64})}, varops::ModCost(2, 1) - 1, SCRIPT_ERR_VAROP_COUNT);
+    CheckError(OneOp(OP_MOD), {Bytes({0x01}), Bytes({})}, varops::ModCost(1, 0) - 1, SCRIPT_ERR_VAROP_COUNT);
+
+    const valtype empty_sig{};
+    const valtype nonempty_sig{Bytes({0x01})};
+    const valtype nonminimal_one{Bytes({0x01, 0x00})};
+    const valtype xonly_pubkey(32, 0x02);
+    const valtype unknown_pubkey(33, 0x02);
+    const uint64_t empty_checksigadd_cost{varops::ChecksigAddIncrementCost(nonminimal_one.size())};
+    CheckEval(OneOp(OP_CHECKSIGADD), {empty_sig, nonminimal_one, xonly_pubkey}, {Bytes({0x01})}, empty_checksigadd_cost);
+    CheckError(OneOp(OP_CHECKSIGADD), {empty_sig, nonminimal_one, xonly_pubkey}, empty_checksigadd_cost - 1, SCRIPT_ERR_VAROP_COUNT);
+
+    const uint64_t nonempty_checksigadd_cost{varops::COST_PER_SIGOP + varops::ChecksigAddIncrementCost(nonminimal_one.size())};
+    CheckEval(OneOp(OP_CHECKSIGADD), {nonempty_sig, nonminimal_one, unknown_pubkey}, {Bytes({0x02})}, nonempty_checksigadd_cost);
+    CheckError(OneOp(OP_CHECKSIGADD), {nonempty_sig, nonminimal_one, unknown_pubkey}, nonempty_checksigadd_cost - 1, SCRIPT_ERR_VAROP_COUNT);
+}
+
+BOOST_AUTO_TEST_CASE(signature_varops_charge_depends_on_nonempty_signature)
+{
+    const valtype empty_sig{};
+    const valtype nonempty_sig{Bytes({0x01})};
+    const valtype zero{};
+    const valtype xonly_pubkey(32, 0x02);
+    const valtype unknown_pubkey(33, 0x02);
+
+    CScript empty_checksig_script;
+    empty_checksig_script << xonly_pubkey << OP_CHECKSIG << OP_NOT;
+    EvalOutcome outcome{VerifyTapscriptV2(empty_checksig_script, {empty_sig}, FinalSuccessCost(1))};
+    BOOST_CHECK(outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_OK);
+    BOOST_CHECK_EQUAL(outcome.remaining_budget, 0);
+
+    CScript nonempty_checksig_script;
+    nonempty_checksig_script << unknown_pubkey << OP_CHECKSIG;
+    outcome = VerifyTapscriptV2(nonempty_checksig_script, {nonempty_sig}, varops::COST_PER_SIGOP - 1);
+    BOOST_CHECK(!outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_VAROP_COUNT);
+
+    outcome = VerifyTapscriptV2(nonempty_checksig_script, {nonempty_sig}, varops::COST_PER_SIGOP + FinalSuccessCost(1));
+    BOOST_CHECK(outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_OK);
+    BOOST_CHECK_EQUAL(outcome.remaining_budget, 0);
+
+    CScript empty_checksigverify_script;
+    empty_checksigverify_script << xonly_pubkey << OP_CHECKSIGVERIFY << OP_1;
+    outcome = VerifyTapscriptV2(empty_checksigverify_script, {empty_sig}, 0);
+    BOOST_CHECK(!outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_CHECKSIGVERIFY);
+    BOOST_CHECK_EQUAL(outcome.remaining_budget, 0);
+
+    CScript nonempty_checksigverify_script;
+    nonempty_checksigverify_script << unknown_pubkey << OP_CHECKSIGVERIFY << OP_1;
+    outcome = VerifyTapscriptV2(nonempty_checksigverify_script, {nonempty_sig}, varops::COST_PER_SIGOP - 1);
+    BOOST_CHECK(!outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_VAROP_COUNT);
+
+    outcome = VerifyTapscriptV2(nonempty_checksigverify_script, {nonempty_sig}, varops::COST_PER_SIGOP + FinalSuccessCost(1));
+    BOOST_CHECK(outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_OK);
+    BOOST_CHECK_EQUAL(outcome.remaining_budget, 0);
+
+    CScript empty_checksigadd_script;
+    empty_checksigadd_script << xonly_pubkey << OP_CHECKSIGADD << OP_NOT;
+
+    const uint64_t checksigadd_cost{varops::ChecksigAddIncrementCost(zero.size())};
+    outcome = VerifyTapscriptV2(empty_checksigadd_script, {empty_sig, zero}, checksigadd_cost - 1);
+    BOOST_CHECK(!outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_VAROP_COUNT);
+
+    outcome = VerifyTapscriptV2(empty_checksigadd_script, {empty_sig, zero}, checksigadd_cost + FinalSuccessCost(1));
+    BOOST_CHECK(outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_OK);
+    BOOST_CHECK_EQUAL(outcome.remaining_budget, 0);
+
+    CScript nonempty_checksigadd_script;
+    nonempty_checksigadd_script << unknown_pubkey << OP_CHECKSIGADD;
+    const uint64_t nonempty_checksigadd_cost{varops::COST_PER_SIGOP + varops::ChecksigAddIncrementCost(zero.size())};
+    outcome = VerifyTapscriptV2(nonempty_checksigadd_script, {nonempty_sig, zero}, nonempty_checksigadd_cost - 1);
+    BOOST_CHECK(!outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_VAROP_COUNT);
+
+    outcome = VerifyTapscriptV2(nonempty_checksigadd_script, {nonempty_sig, zero}, nonempty_checksigadd_cost + FinalSuccessCost(1));
+    BOOST_CHECK(outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_OK);
+    BOOST_CHECK_EQUAL(outcome.remaining_budget, 0);
+}
+
+BOOST_AUTO_TEST_CASE(op_success_redefinitions_are_checked_before_execution)
+{
+    for (const opcodetype opcode : {OP_1NEGATE, OP_NEGATE, OP_ABS}) {
+        CScript script;
+        script << opcode << OP_RETURN;
+        ScriptError error{SCRIPT_ERR_UNKNOWN_ERROR};
+        const std::optional<bool> result{CheckTapscriptOpSuccess(script, SCRIPT_VERIFY_NONE, SigVersion::TAPSCRIPT_V2, &error)};
+        BOOST_REQUIRE(result.has_value());
+        BOOST_CHECK(*result);
+        BOOST_CHECK_EQUAL(error, SCRIPT_ERR_OK);
+
+        error = SCRIPT_ERR_UNKNOWN_ERROR;
+        const std::optional<bool> discouraged{CheckTapscriptOpSuccess(script, SCRIPT_VERIFY_DISCOURAGE_OP_SUCCESS, SigVersion::TAPSCRIPT_V2, &error)};
+        BOOST_REQUIRE(discouraged.has_value());
+        BOOST_CHECK(!*discouraged);
+        BOOST_CHECK_EQUAL(error, SCRIPT_ERR_DISCOURAGE_OP_SUCCESS);
+
+        CScript malformed_after;
+        malformed_after << opcode;
+        malformed_after.push_back(static_cast<unsigned char>(OP_PUSHDATA4));
+        error = SCRIPT_ERR_UNKNOWN_ERROR;
+        const std::optional<bool> after_result{CheckTapscriptOpSuccess(malformed_after, SCRIPT_VERIFY_NONE, SigVersion::TAPSCRIPT_V2, &error)};
+        BOOST_REQUIRE(after_result.has_value());
+        BOOST_CHECK(*after_result);
+        BOOST_CHECK_EQUAL(error, SCRIPT_ERR_OK);
+
+        CScript malformed_before;
+        malformed_before.push_back(static_cast<unsigned char>(OP_PUSHDATA4));
+        malformed_before << opcode;
+        error = SCRIPT_ERR_UNKNOWN_ERROR;
+        const std::optional<bool> before_result{CheckTapscriptOpSuccess(malformed_before, SCRIPT_VERIFY_NONE, SigVersion::TAPSCRIPT_V2, &error)};
+        BOOST_REQUIRE(before_result.has_value());
+        BOOST_CHECK(!*before_result);
+        BOOST_CHECK_EQUAL(error, SCRIPT_ERR_BAD_OPCODE);
+    }
+
+    for (const opcodetype opcode : {OP_INTERNALKEY, OP_CHECKSIGFROMSTACK}) {
+        CScript script;
+        script << opcode << OP_RETURN;
+        ScriptError error{SCRIPT_ERR_UNKNOWN_ERROR};
+        const std::optional<bool> result{CheckTapscriptOpSuccess(script, TAPSCRIPT_V2_ACTIVE_INQUISITION_OPCODE_FLAGS, SigVersion::TAPSCRIPT_V2, &error)};
+        BOOST_REQUIRE(result.has_value());
+        BOOST_CHECK(*result);
+        BOOST_CHECK_EQUAL(error, SCRIPT_ERR_OK);
+
+        error = SCRIPT_ERR_UNKNOWN_ERROR;
+        const std::optional<bool> discouraged{CheckTapscriptOpSuccess(script, TAPSCRIPT_V2_ACTIVE_INQUISITION_OPCODE_FLAGS | SCRIPT_VERIFY_DISCOURAGE_OP_SUCCESS,
+                                                       SigVersion::TAPSCRIPT_V2, &error)};
+        BOOST_REQUIRE(discouraged.has_value());
+        BOOST_CHECK(!*discouraged);
+        BOOST_CHECK_EQUAL(error, SCRIPT_ERR_DISCOURAGE_OP_SUCCESS);
+
+        EvalOutcome outcome{VerifyTapscriptV2WithFlags(script, {}, TAPSCRIPT_V2_ACTIVE_INQUISITION_OPCODE_FLAGS, 0)};
+        BOOST_CHECK(outcome.ok);
+        BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_OK);
+    }
+
+    EvalOutcome discouraged_witness{VerifyTapscriptV2WithFlags(OneOp(OP_1NEGATE), {},
+                                                        TAPSCRIPT_V2_SCRIPT_VERIFY_FLAGS | SCRIPT_VERIFY_DISCOURAGE_OP_SUCCESS,
+                                                        0)};
+    BOOST_CHECK(!discouraged_witness.ok);
+    BOOST_CHECK_EQUAL(discouraged_witness.error, SCRIPT_ERR_DISCOURAGE_OP_SUCCESS);
+
+    CScript unexecuted_success;
+    unexecuted_success << OP_0 << OP_IF << OP_1NEGATE << OP_ENDIF << OP_RETURN;
+    ScriptError error{SCRIPT_ERR_UNKNOWN_ERROR};
+    const std::optional<bool> result{CheckTapscriptOpSuccess(unexecuted_success, SCRIPT_VERIFY_NONE, SigVersion::TAPSCRIPT_V2, &error)};
+    BOOST_REQUIRE(result.has_value());
+    BOOST_CHECK(*result);
+    BOOST_CHECK_EQUAL(error, SCRIPT_ERR_OK);
+
+    Stack too_many_stack(MAX_TAPSCRIPT_V2_STACK_SIZE + 1, valtype{});
+    EvalOutcome outcome{VerifyTapscriptV2(OneOp(OP_1NEGATE), too_many_stack, 0)};
+    BOOST_CHECK(outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_OK);
+
+    const valtype too_large_element(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE + 1, 0x01);
+    outcome = VerifyTapscriptV2(OneOp(OP_1NEGATE), {too_large_element}, 0);
+    BOOST_CHECK(outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_OK);
+
+    const valtype four_mb(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE, 0x01);
+    outcome = VerifyTapscriptV2(OneOp(OP_1NEGATE), {four_mb, four_mb, Bytes({0x01})}, 0);
+    BOOST_CHECK(outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_OK);
+}
+
+BOOST_AUTO_TEST_CASE(checktemplateverify_is_upgradable_nop_in_tapscript_v2)
+{
+    const valtype ctv_hash(32, 0x01);
+    CScript script;
+    script << ctv_hash << OP_CHECKTEMPLATEVERIFY;
+
+    const script_verify_flags flags{TAPSCRIPT_V2_SCRIPT_VERIFY_FLAGS | SCRIPT_VERIFY_CHECKTEMPLATEVERIFY};
+    EvalOutcome outcome{VerifyTapscriptV2WithFlags(script, {}, flags, FinalSuccessCost(ctv_hash.size()))};
+    BOOST_CHECK(outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_OK);
+
+    outcome = VerifyTapscriptV2WithFlags(script, {}, flags | SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_NOPS, 0);
+    BOOST_CHECK(!outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_DISCOURAGE_UPGRADABLE_NOPS);
+}
+
+BOOST_AUTO_TEST_CASE(tapscript_v2_treats_anyprevout_pubkeys_as_unknown_pubkey_type)
+{
+    valtype anyprevout_xonly_pubkey(33, 0x02);
+    anyprevout_xonly_pubkey.front() = BIP118_PUBKEY_PREFIX;
+    const valtype invalid_signature(64, 0x01);
+    const script_verify_flags flags{
+        TAPSCRIPT_V2_SCRIPT_VERIFY_FLAGS |
+        SCRIPT_VERIFY_ANYPREVOUT |
+        SCRIPT_VERIFY_DISCOURAGE_ANYPREVOUT};
+    const uint64_t cost{varops::COST_PER_SIGOP + FinalSuccessCost(1)};
+
+    for (const valtype& pubkey : {Bytes({BIP118_PUBKEY_PREFIX}), anyprevout_xonly_pubkey}) {
+        CScript script;
+        script << pubkey << OP_CHECKSIG;
+
+        EvalOutcome outcome{VerifyTapscriptV2WithFlags(script, {invalid_signature}, flags, cost)};
+        BOOST_CHECK(outcome.ok);
+        BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_OK);
+        BOOST_CHECK_EQUAL(outcome.remaining_budget, 0);
+
+        outcome = VerifyTapscriptV2WithFlags(script, {invalid_signature},
+                                             flags | SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_PUBKEYTYPE,
+                                             cost);
+        BOOST_CHECK(!outcome.ok);
+        BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_DISCOURAGE_UPGRADABLE_PUBKEYTYPE);
+    }
+}
+
+BOOST_AUTO_TEST_CASE(tapscript_v2_conditionals_require_minimal_inputs)
+{
+    CScript if_script;
+    if_script << OP_IF << OP_2 << OP_ELSE << OP_3 << OP_ENDIF;
+    CheckEval(if_script, {Bytes({0x01})}, {Bytes({0x02})}, 0);
+    CheckEval(if_script, {Bytes({})}, {Bytes({0x03})}, 0);
+    CheckError(if_script, {Bytes({0x02})}, 0, SCRIPT_ERR_TAPSCRIPT_MINIMALIF);
+    CheckError(if_script, {Bytes({0x00, 0x00})}, 0, SCRIPT_ERR_TAPSCRIPT_MINIMALIF);
+
+    CScript notif_script;
+    notif_script << OP_NOTIF << OP_2 << OP_ELSE << OP_3 << OP_ENDIF;
+    CheckEval(notif_script, {Bytes({})}, {Bytes({0x02})}, 0);
+    CheckEval(notif_script, {Bytes({0x01})}, {Bytes({0x03})}, 0);
+}
+
+BOOST_AUTO_TEST_CASE(unexecuted_branches_do_not_charge_or_execute_costed_ops)
+{
+    CScript skipped_then_else;
+    skipped_then_else << OP_0 << OP_IF << OP_CAT << OP_MUL << OP_SHA256 << OP_ELSE << OP_2 << OP_ENDIF;
+    CheckEval(skipped_then_else, {}, {Bytes({0x02})}, 0);
+}
+
+BOOST_AUTO_TEST_CASE(tapscript_v2_standard_verify_uses_unmetered_overload)
+{
+    CScript normal_script;
+    normal_script << OP_1;
+
+    CScript script_pub_key;
+    const CScriptWitness witness{BuildTapscriptV2Witness(normal_script, {}, script_pub_key)};
+    ScriptError error{SCRIPT_ERR_UNKNOWN_ERROR};
+    const bool ok{VerifyScript(CScript{}, script_pub_key, &witness, STANDARD_SCRIPT_VERIFY_FLAGS, BaseSignatureChecker{}, &error)};
+    BOOST_CHECK(ok);
+    BOOST_CHECK_EQUAL(error, SCRIPT_ERR_OK);
+}
+
+BOOST_AUTO_TEST_CASE(taproot_script_signing_propagates_leaf_sigversion)
+{
+    const CScript leaf_script{CScript{} << ToByteVector(XOnlyPubKey::NUMS_H) << OP_CHECKSIG};
+
+    for (const auto& [leaf_version, expected_sigversion] : {
+             std::pair{int{TAPROOT_LEAF_TAPSCRIPT}, SigVersion::TAPSCRIPT},
+             std::pair{int{TAPROOT_LEAF_TAPSCRIPT_V2}, SigVersion::TAPSCRIPT_V2},
+         }) {
+        TaprootBuilder builder;
+        builder.Add(0, leaf_script, leaf_version, /*track=*/true);
+        builder.Finalize(XOnlyPubKey::NUMS_H);
+
+        const WitnessV1Taproot output{builder.GetOutput()};
+        FlatSigningProvider provider;
+        provider.tr_trees.emplace(output, builder);
+
+        RecordingSignatureCreator creator;
+        SignatureData sigdata;
+        BOOST_REQUIRE(ProduceSignature(provider, creator, GetScriptForDestination(output), sigdata));
+        BOOST_REQUIRE(!creator.schnorr_sigversions.empty());
+        for (const SigVersion sigversion : creator.schnorr_sigversions) {
+            BOOST_CHECK(sigversion == expected_sigversion);
+        }
+    }
+}
+
+BOOST_AUTO_TEST_CASE(tapscript_v2_psbt_finalized_witness_is_signed_and_verified)
+{
+    CScript normal_script;
+    normal_script << OP_1;
+    FinalizedTapscriptV2Spend spend{BuildFinalizedTapscriptV2Spend(normal_script, {})};
+
+    CMutableTransaction unsigned_tx{spend.tx};
+    unsigned_tx.vin[0].scriptWitness.SetNull();
+    PartiallySignedTransaction psbt{unsigned_tx};
+    psbt.inputs[0].witness_utxo = spend.spent_output;
+    psbt.inputs[0].final_script_witness = spend.tx.vin[0].scriptWitness;
+
+    PrecomputedTransactionData txdata;
+    txdata.Init(CTransaction{spend.tx}, std::vector<CTxOut>{spend.spent_output});
+
+    BOOST_CHECK(PSBTInputSignedAndVerified(psbt, 0, &txdata));
+    BOOST_CHECK(PSBTInputSignedAndVerified(psbt, 0, nullptr));
+    BOOST_CHECK(PSBTInputsSignedAndVerified(psbt, txdata));
+    BOOST_CHECK(FinalizePSBT(psbt));
+}
+
+BOOST_AUTO_TEST_CASE(tapscript_v2_psbt_and_signtransaction_use_transaction_wide_varops_budget)
+{
+    const size_t operand_size{7'000};
+    const valtype operand(operand_size, 0xff);
+
+    CScript costly_script;
+    costly_script << OP_MUL << OP_DROP << OP_1;
+
+    CScript script_pub_key;
+    const CScriptWitness witness{BuildTapscriptV2Witness(costly_script, {operand, operand}, script_pub_key)};
+    const CTxOut spent_output{100'000'000, script_pub_key};
+
+    CMutableTransaction tx;
+    tx.version = 2;
+    tx.vin.emplace_back(COutPoint{Txid::FromUint256(uint256::ONE), 0});
+    tx.vin.emplace_back(COutPoint{Txid::FromUint256(uint256::ONE), 1});
+    tx.vin[0].scriptWitness = witness;
+    tx.vin[1].scriptWitness = witness;
+    tx.vout.emplace_back(50'000, CScript{} << OP_TRUE);
+
+    const CTransaction tx_const{tx};
+    const uint64_t per_input_cost{varops::MulCost(operand_size, operand_size)};
+    const uint64_t tx_budget{varops::TxBudget(GetTransactionWeight(tx_const))};
+    BOOST_REQUIRE_LT(per_input_cost, tx_budget);
+    BOOST_REQUIRE_LT(tx_budget, 2 * per_input_cost);
+
+    // Final witnesses are stored in the PSBT inputs, not its unsigned transaction.
+    CMutableTransaction unsigned_tx{tx};
+    for (CTxIn& in : unsigned_tx.vin) in.scriptWitness.SetNull();
+    PartiallySignedTransaction psbt{unsigned_tx};
+    for (size_t i{0}; i < psbt.inputs.size(); ++i) {
+        psbt.inputs[i].witness_utxo = spent_output;
+        psbt.inputs[i].final_script_witness = tx.vin[i].scriptWitness;
+    }
+
+    PrecomputedTransactionData txdata;
+    txdata.Init(tx_const, std::vector<CTxOut>{spent_output, spent_output});
+
+    BOOST_CHECK(PSBTInputSignedAndVerified(psbt, 0, &txdata));
+    BOOST_CHECK(PSBTInputSignedAndVerified(psbt, 1, &txdata));
+    BOOST_CHECK(!PSBTInputsSignedAndVerified(psbt, txdata));
+    BOOST_CHECK(!FinalizePSBT(psbt));
+
+    std::map<COutPoint, Coin> coins;
+    coins.emplace(tx.vin[0].prevout, Coin{spent_output, 1, /*fCoinBaseIn=*/false});
+    coins.emplace(tx.vin[1].prevout, Coin{spent_output, 1, /*fCoinBaseIn=*/false});
+
+    std::map<int, bilingual_str> input_errors;
+    BOOST_CHECK(!SignTransaction(tx, &DUMMY_SIGNING_PROVIDER, coins, SIGHASH_DEFAULT, input_errors));
+    BOOST_REQUIRE_EQUAL(input_errors.size(), 1);
+    BOOST_CHECK_EQUAL(input_errors.begin()->second.original, ScriptErrorString(SCRIPT_ERR_VAROP_COUNT));
+}
+
+BOOST_AUTO_TEST_CASE(tapscript_v2_psbt_single_input_over_finalized_budget_is_rejected)
+{
+    const size_t operand_size{20'000};
+    const valtype operand(operand_size, 0xff);
+
+    CScript costly_script;
+    costly_script << OP_MUL << OP_DROP << OP_1;
+
+    CScript script_pub_key;
+    const CScriptWitness witness{BuildTapscriptV2Witness(costly_script, {operand, operand}, script_pub_key)};
+    const CTxOut spent_output{100'000'000, script_pub_key};
+
+    CMutableTransaction tx;
+    tx.version = 2;
+    tx.vin.emplace_back(COutPoint{Txid::FromUint256(uint256::ONE), 0});
+    tx.vin[0].scriptWitness = witness;
+    tx.vout.emplace_back(50'000, CScript{} << OP_TRUE);
+
+    const uint64_t input_cost{varops::MulCost(operand_size, operand_size)};
+    const uint64_t finalized_budget{varops::TxBudget(GetTransactionWeight(CTransaction{tx}))};
+    BOOST_REQUIRE_GT(input_cost, finalized_budget);
+
+    CMutableTransaction unsigned_tx{tx};
+    for (CTxIn& in : unsigned_tx.vin) in.scriptWitness.SetNull();
+    PartiallySignedTransaction psbt{unsigned_tx};
+    psbt.inputs[0].witness_utxo = spent_output;
+    psbt.inputs[0].final_script_witness = tx.vin[0].scriptWitness;
+
+    PrecomputedTransactionData txdata;
+    txdata.Init(CTransaction{tx}, std::vector<CTxOut>{spent_output});
+
+    BOOST_CHECK(!PSBTInputSignedAndVerified(psbt, 0, &txdata));
+    BOOST_CHECK(!PSBTInputSignedAndVerified(psbt, 0, nullptr));
+    BOOST_CHECK(!PSBTInputsSignedAndVerified(psbt, txdata));
+    BOOST_CHECK(!FinalizePSBT(psbt));
+}
+
+BOOST_AUTO_TEST_CASE(tapscript_v2_signtransaction_accepts_finalized_witness)
+{
+    CScript normal_script;
+    normal_script << OP_1;
+    FinalizedTapscriptV2Spend spend{BuildFinalizedTapscriptV2Spend(normal_script, {})};
+
+    std::map<COutPoint, Coin> coins;
+    coins.emplace(spend.tx.vin[0].prevout, Coin{spend.spent_output, 1, /*fCoinBaseIn=*/false});
+
+    std::map<int, bilingual_str> input_errors;
+    BOOST_CHECK(SignTransaction(spend.tx, &DUMMY_SIGNING_PROVIDER, coins, SIGHASH_DEFAULT, input_errors));
+    BOOST_CHECK(input_errors.empty());
+}
+
+BOOST_AUTO_TEST_CASE(witness_path_uses_tapscript_v2_final_success_rule)
+{
+    CScript negative_zero_like;
+    negative_zero_like << Bytes({0x80});
+    EvalOutcome outcome{VerifyTapscriptV2(negative_zero_like, {}, 1'000)};
+    BOOST_CHECK(outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_OK);
+
+    outcome = VerifyTapscriptV2(negative_zero_like, {}, FinalSuccessCost(1) - 1);
+    BOOST_CHECK(!outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_VAROP_COUNT);
+
+    CScript false_result;
+    false_result << Bytes({});
+    outcome = VerifyTapscriptV2(false_result, {}, 1'000);
+    BOOST_CHECK(!outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_EVAL_FALSE);
+
+    CScript all_zero_result;
+    all_zero_result << Bytes({0x00, 0x00});
+    outcome = VerifyTapscriptV2(all_zero_result, {}, 1'000);
+    BOOST_CHECK(!outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_EVAL_FALSE);
+
+    CScript high_byte_nonzero_result;
+    high_byte_nonzero_result << Bytes({0x00, 0x01});
+    outcome = VerifyTapscriptV2(high_byte_nonzero_result, {}, 1'000);
+    BOOST_CHECK(outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_OK);
+
+    CScript dirty_stack;
+    dirty_stack << OP_1 << OP_1;
+    outcome = VerifyTapscriptV2(dirty_stack, {}, 1'000);
+    BOOST_CHECK(!outcome.ok);
+    BOOST_CHECK_EQUAL(outcome.error, SCRIPT_ERR_CLEANSTACK);
+}
+
+BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/test/transaction_tests.cpp b/src/test/transaction_tests.cpp
index 8b22f7570bdc..4d8f86a7eccc 100644
--- a/src/test/transaction_tests.cpp
+++ b/src/test/transaction_tests.cpp
@@ -23,10 +23,12 @@
 #include <script/sign.h>
 #include <script/signingprovider.h>
 #include <script/solver.h>
+#include <script/varops.h>
 #include <streams.h>
 #include <test/util/json.h>
 #include <test/util/random.h>
 #include <test/util/script.h>
+#include <test/util/tapscript_v2_test_utils.h>
 #include <test/util/transaction_utils.h>
 #include <util/strencodings.h>
 #include <util/string.h>
@@ -35,6 +37,7 @@
 
 #include <functional>
 #include <map>
+#include <memory>
 #include <string>
 
 #include <boost/test/unit_test.hpp>
@@ -52,6 +55,14 @@ static bool g_bare_multi{DEFAULT_PERMIT_BAREMULTISIG};
 
 static const std::map<std::string, script_verify_flag_name>& mapFlagNames = g_verify_flag_names;
 
+static varops::Budget TestVaropsBudget(script_verify_flags flags, const CTransaction& tx)
+{
+    if (flags & SCRIPT_VERIFY_SCRIPT_RESTORATION) {
+        return varops::Budget{varops::TxBudget(GetTransactionWeight(tx))};
+    }
+    return varops::Budget::Unmetered();
+}
+
 script_verify_flags ParseScriptFlags(std::string strFlags)
 {
     script_verify_flags flags = SCRIPT_VERIFY_NONE;
@@ -88,12 +99,13 @@ bool CheckTxScripts(const CTransaction& tx, const std::map<COutPoint, CScript>&
 {
     bool tx_valid = true;
     ScriptError err = expect_valid ? SCRIPT_ERR_UNKNOWN_ERROR : SCRIPT_ERR_OK;
+    auto varops_budget{TestVaropsBudget(flags, tx)};
     for (unsigned int i = 0; i < tx.vin.size() && tx_valid; ++i) {
         const CTxIn input = tx.vin[i];
         const CAmount amount = map_prevout_values.count(input.prevout) ? map_prevout_values.at(input.prevout) : 0;
         try {
             tx_valid = VerifyScript(input.scriptSig, map_prevout_scriptPubKeys.at(input.prevout),
-                &input.scriptWitness, flags, TransactionSignatureChecker(&tx, i, amount, txdata, MissingDataBehavior::ASSERT_FAIL), &err);
+                                    &input.scriptWitness, flags, TransactionSignatureChecker(&tx, i, amount, txdata, MissingDataBehavior::ASSERT_FAIL), &err, varops_budget);
         } catch (...) {
             BOOST_ERROR("Bad test: " << strTest);
             return true; // The test format is bad and an error is thrown. Return true to silence further error.
@@ -157,6 +169,48 @@ std::set<script_verify_flags> ExcludeIndividualFlags(script_verify_flags flags)
 
 BOOST_FIXTURE_TEST_SUITE(transaction_tests, BasicTestingSetup)
 
+BOOST_AUTO_TEST_CASE(tapscript_v2_budget_is_shared_across_inputs)
+{
+    constexpr size_t operand_size{7'000};
+    const valtype operand(operand_size, 0xff);
+
+    CScript leaf_script;
+    leaf_script << OP_MUL << OP_DROP << OP_1;
+
+    CScript script_pub_key;
+    const CScriptWitness witness{test::tapscript_v2::BuildTapscriptV2Witness(leaf_script, {operand, operand}, script_pub_key)};
+
+    CMutableTransaction mutable_tx;
+    mutable_tx.version = 2;
+    mutable_tx.vin.emplace_back(COutPoint{Txid::FromUint256(uint256::ONE), 0});
+    mutable_tx.vin.emplace_back(COutPoint{Txid::FromUint256(uint256::ONE), 1});
+    mutable_tx.vin[0].scriptWitness = witness;
+    mutable_tx.vin[1].scriptWitness = witness;
+    mutable_tx.vout.emplace_back(50'000, CScript{} << OP_TRUE);
+
+    const CTransaction tx{mutable_tx};
+    const uint64_t per_input_cost{varops::MulCost(operand_size, operand_size)};
+    const uint64_t tx_budget{varops::TxBudget(GetTransactionWeight(tx))};
+    BOOST_REQUIRE_LT(per_input_cost, tx_budget);
+    BOOST_REQUIRE_LT(tx_budget, 2 * per_input_cost);
+
+    std::map<COutPoint, CScript> prevout_scripts;
+    std::map<COutPoint, int64_t> prevout_values;
+    for (const CTxIn& input : tx.vin) {
+        prevout_scripts.emplace(input.prevout, script_pub_key);
+        prevout_values.emplace(input.prevout, 100'000'000);
+    }
+
+    const script_verify_flags flags{
+        SCRIPT_VERIFY_P2SH |
+        SCRIPT_VERIFY_WITNESS |
+        SCRIPT_VERIFY_TAPROOT |
+        SCRIPT_VERIFY_SCRIPT_RESTORATION};
+    const PrecomputedTransactionData txdata{tx};
+    BOOST_CHECK(CheckTxScripts(tx, prevout_scripts, prevout_values, flags, txdata,
+                               "Tapscript v2 transaction-wide varops budget", /*expect_valid=*/false));
+}
+
 BOOST_AUTO_TEST_CASE(tx_valid)
 {
     BOOST_CHECK_MESSAGE(CheckMapFlagNames(), "mapFlagNames is missing a script verification flag");
@@ -547,10 +601,12 @@ BOOST_AUTO_TEST_CASE(test_big_witness_transaction)
     }
 
     SignatureCache signature_cache{DEFAULT_SIGNATURE_CACHE_BYTES};
+    auto varops_budget{std::make_shared<varops::Budget>(varops::TxBudget(GetTransactionWeight(tx)))};
 
     for(uint32_t i = 0; i < mtx.vin.size(); i++) {
         std::vector<CScriptCheck> vChecks;
-        vChecks.emplace_back(coins[tx.vin[i].prevout.n].out, tx, signature_cache, i, SCRIPT_VERIFY_P2SH | SCRIPT_VERIFY_WITNESS, false, &txdata);
+        vChecks.emplace_back(coins[tx.vin[i].prevout.n].out, tx, signature_cache, i,
+                             SCRIPT_VERIFY_P2SH | SCRIPT_VERIFY_WITNESS, false, &txdata, varops_budget);
         control.Add(std::move(vChecks));
     }
 
diff --git a/src/test/util/tapscript_v2_test_utils.h b/src/test/util/tapscript_v2_test_utils.h
new file mode 100644
index 000000000000..833e300f02fe
--- /dev/null
+++ b/src/test/util/tapscript_v2_test_utils.h
@@ -0,0 +1,123 @@
+// Copyright (c) 2026 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or https://opensource.org/license/mit/.
+
+#ifndef BITCOIN_TEST_UTIL_TAPSCRIPT_V2_TEST_UTILS_H
+#define BITCOIN_TEST_UTIL_TAPSCRIPT_V2_TEST_UTILS_H
+
+#include <addresstype.h>
+#include <key.h>
+#include <script/interpreter.h>
+#include <script/script.h>
+#include <script/signingprovider.h>
+#include <script/valtype_stack.h>
+#include <script/varops.h>
+#include <util/check.h>
+
+#include <cstdint>
+#include <vector>
+
+namespace test::tapscript_v2 {
+
+using Stack = std::vector<std::vector<unsigned char>>;
+
+inline constexpr script_verify_flags TAPROOT_SCRIPT_VERIFY_FLAGS{SCRIPT_VERIFY_P2SH | SCRIPT_VERIFY_WITNESS | SCRIPT_VERIFY_TAPROOT};
+inline constexpr script_verify_flags TAPSCRIPT_V2_SCRIPT_VERIFY_FLAGS{TAPROOT_SCRIPT_VERIFY_FLAGS | SCRIPT_VERIFY_SCRIPT_RESTORATION};
+
+struct EvalOutcome {
+    bool ok{false};
+    ScriptError error{SCRIPT_ERR_UNKNOWN_ERROR};
+    uint64_t remaining_budget{0};
+    Stack stack;
+};
+
+class RecordingChecker final : public BaseSignatureChecker
+{
+public:
+    bool locktime_result{true};
+    bool sequence_result{true};
+    mutable int locktime_calls{0};
+    mutable int sequence_calls{0};
+    mutable int schnorr_calls{0};
+    mutable int64_t last_locktime{-1};
+    mutable int64_t last_sequence{-1};
+    mutable KeyVersion last_keyversion{KeyVersion::TAPROOT};
+    mutable SigVersion last_sigversion{SigVersion::BASE};
+    mutable uint32_t last_codeseparator_pos{0};
+
+    RecordingChecker() = default;
+    RecordingChecker(bool locktime_result, bool sequence_result)
+        : locktime_result{locktime_result}, sequence_result{sequence_result}
+    {
+    }
+
+    bool CheckSchnorrSignature(Span<const unsigned char>, KeyVersion keyversion, Span<const unsigned char>, SigVersion sigversion, ScriptExecutionData& execdata, ScriptError*) const override
+    {
+        ++schnorr_calls;
+        last_keyversion = keyversion;
+        last_sigversion = sigversion;
+        Assert(execdata.m_codeseparator_pos_init);
+        last_codeseparator_pos = execdata.m_codeseparator_pos;
+        return true;
+    }
+
+    bool CheckLockTime(const CScriptNum& locktime) const override
+    {
+        ++locktime_calls;
+        last_locktime = locktime.GetInt64();
+        return locktime_result;
+    }
+
+    bool CheckSequence(const CScriptNum& sequence) const override
+    {
+        ++sequence_calls;
+        last_sequence = sequence.GetInt64();
+        return sequence_result;
+    }
+};
+
+inline CScript OneOp(opcodetype opcode)
+{
+    CScript script;
+    script << opcode;
+    return script;
+}
+
+inline CScriptWitness BuildTapscriptV2Witness(const CScript& leaf_script, const Stack& initial_stack, CScript& script_pub_key)
+{
+    TaprootBuilder builder;
+    builder.Add(0, leaf_script, TAPROOT_LEAF_TAPSCRIPT_V2, /*track=*/true);
+    builder.Finalize(XOnlyPubKey::NUMS_H);
+
+    CScriptWitness witness;
+    witness.stack = initial_stack;
+    const std::vector<unsigned char> serialized_script{leaf_script.begin(), leaf_script.end()};
+    witness.stack.push_back(serialized_script);
+    const auto control_blocks{builder.GetSpendData().scripts.at({serialized_script, TAPROOT_LEAF_TAPSCRIPT_V2})};
+    witness.stack.push_back(*control_blocks.begin());
+
+    script_pub_key = GetScriptForDestination(builder.GetOutput());
+    return witness;
+}
+
+inline EvalOutcome EvalTapscriptV2WithFlagsAndChecker(const CScript& script, const Stack& initial_stack, script_verify_flags flags, const BaseSignatureChecker& checker, uint64_t budget)
+{
+    ScriptExecutionData execdata;
+    execdata.m_internal_key = XOnlyPubKey::NUMS_H;
+    execdata.m_annex_present = false;
+    execdata.m_annex_init = true;
+    ScriptError error{SCRIPT_ERR_UNKNOWN_ERROR};
+    varops::Budget varops_budget{budget};
+    ValtypeStack stack{initial_stack};
+    const bool ok{::EvalTapscriptV2(stack, script, flags, checker, execdata, varops_budget, &error)};
+    return {ok, error, *varops_budget.Remaining(), stack.GetStack()};
+}
+
+inline EvalOutcome EvalTapscriptV2(const CScript& script, const Stack& initial_stack, uint64_t budget)
+{
+    return EvalTapscriptV2WithFlagsAndChecker(script, initial_stack, SCRIPT_VERIFY_NONE, BaseSignatureChecker{}, budget);
+}
+
+} // namespace test::tapscript_v2
+
+#endif // BITCOIN_TEST_UTIL_TAPSCRIPT_V2_TEST_UTILS_H
diff --git a/src/test/val64_internal_tests.cpp b/src/test/val64_internal_tests.cpp
new file mode 100644
index 000000000000..31f69db58ee5
--- /dev/null
+++ b/src/test/val64_internal_tests.cpp
@@ -0,0 +1,1414 @@
+// Copyright (c) 2011-2022 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <script/val64.h>
+#include <script/varops.h>
+#include <test/data/val64_conversion.json.h>
+#include <test/util/json.h>
+#include <test/util/random.h>
+#include <test/util/setup_common.h>
+#include <util/vector.h>
+
+#include <univalue.h>
+
+#include <boost/multiprecision/cpp_int.hpp>
+#include <boost/test/unit_test.hpp>
+
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <span>
+#include <utility>
+#include <vector>
+
+BOOST_FIXTURE_TEST_SUITE(val64_internal_tests, BasicTestingSetup)
+
+using boost::multiprecision::cpp_int;
+
+// Resize/create vector so this bit will fit
+static std::vector<unsigned char> vec_sized_for_bit(size_t bit,
+                                                    const std::vector<unsigned char> in = std::vector<unsigned char>())
+{
+    std::vector<unsigned char> v = in;
+    if (v.size() < (bit + 8) / 8)
+        v.resize((bit + 8) / 8);
+    return v;
+}
+
+// Set bit or create vector with this bit set.
+static std::vector<unsigned char> vec_setbit(size_t bit,
+                                             const std::vector<unsigned char> in = std::vector<unsigned char>())
+{
+    std::vector<unsigned char> v = vec_sized_for_bit(bit, in);
+    v[bit / 8] |= (1 << (bit % 8));
+    return v;
+}
+
+// Expose Val64 internals for focused unit tests.
+class Val64Test : public Val64
+{
+public:
+    // Unlike Val64, this makes a copy.
+    explicit Val64Test(std::vector<unsigned char> bytes) : Val64(std::move(bytes)) {}
+    Val64Test(const Val64Test&) = default;
+    Val64Test(Val64Test&&) noexcept = default;
+    explicit Val64Test(uint64_t value) : Val64(value) {}
+    Val64Test() = default;
+
+    std::span<le64_t> Limbs() const { return Val64::m_limbs; }
+    size_t LimbCount() const { return Val64::m_limbs.size(); }
+    uint64_t Get(size_t index) const { return Val64::Get(index); }
+    static void SetForceOffsetSpan(bool value) { Val64::m_force_offset_span = value; }
+    static void SetForcePortableMath(bool value) { Val64::m_force_portable_math = value; }
+
+    void Set(size_t index, uint64_t value) { Val64::Set(index, value); }
+    static void MultiplySpan(std::span<le64_t> result, std::span<const le64_t> source, uint64_t multiplier)
+    {
+        Val64::MultiplySpan(result, source, multiplier);
+    }
+    static bool AddSpans(std::span<le64_t> v1, std::span<const le64_t> v2, size_t& nonzero_len)
+    {
+        return Val64::AddSpans(v1, v2, nonzero_len);
+    }
+    static bool SubtractSpans(std::span<le64_t> v1, std::span<const le64_t> v2, size_t& nonzero_len)
+    {
+        return Val64::SubtractSpans(v1, v2, nonzero_len);
+    }
+    std::vector<uint64_t> CopyVector()
+    {
+        std::vector<uint64_t> v;
+        v.reserve(LimbCount());
+        for (size_t i = 0; i < LimbCount(); ++i) {
+            v.push_back(Get(i));
+        }
+        return v;
+    }
+};
+
+static Val64Test val64_singleton(uint64_t val)
+{
+    std::vector<unsigned char> bitvec(8);
+    Val64Test v(bitvec);
+    v.Set(0, val);
+
+    return v;
+}
+
+static cpp_int vector_to_cpp_int(const std::vector<unsigned char>& vec)
+{
+    cpp_int num{0};
+    for (auto it = vec.rbegin(); it != vec.rend(); ++it) {
+        num *= 256;
+        num += *it;
+    }
+    return num;
+}
+
+static std::vector<unsigned char> cpp_int_to_vector(cpp_int num)
+{
+    BOOST_REQUIRE(num >= 0);
+
+    std::vector<unsigned char> vec;
+    while (num != 0) {
+        vec.push_back(static_cast<unsigned char>((num % 256).convert_to<unsigned int>()));
+        num /= 256;
+    }
+    return vec;
+}
+
+static std::vector<unsigned char> cpp_int_to_fixed_vector(cpp_int num, size_t len)
+{
+    std::vector<unsigned char> vec = cpp_int_to_vector(num);
+    BOOST_REQUIRE_LE(vec.size(), len);
+    vec.resize(len);
+    return vec;
+}
+
+static std::vector<unsigned char> shift_left_fixed(const std::vector<unsigned char>& value, size_t bits, size_t result_size)
+{
+    std::vector<unsigned char> result(result_size, 0);
+    const size_t byte_shift{bits / 8};
+    const unsigned int bit_shift{static_cast<unsigned int>(bits % 8)};
+    for (size_t i{0}; i < value.size() && i + byte_shift < result.size(); ++i) {
+        const uint16_t shifted{static_cast<uint16_t>(static_cast<uint16_t>(value[i]) << bit_shift)};
+        result[i + byte_shift] |= static_cast<unsigned char>(shifted);
+        if (bit_shift != 0 && i + byte_shift + 1 < result.size()) {
+            result[i + byte_shift + 1] |= static_cast<unsigned char>(shifted >> 8);
+        }
+    }
+    return result;
+}
+
+static std::vector<unsigned char> shift_right_fixed(const std::vector<unsigned char>& value, size_t bits, size_t result_size)
+{
+    std::vector<unsigned char> result(result_size, 0);
+    const size_t byte_shift{bits / 8};
+    const unsigned int bit_shift{static_cast<unsigned int>(bits % 8)};
+    for (size_t i{0}; i < result.size(); ++i) {
+        const size_t source{i + byte_shift};
+        uint16_t shifted{static_cast<uint16_t>(static_cast<uint16_t>(value[source]) >> bit_shift)};
+        if (bit_shift != 0 && source + 1 < value.size()) {
+            shifted |= static_cast<uint16_t>(value[source + 1]) << (8 - bit_shift);
+        }
+        result[i] = static_cast<unsigned char>(shifted);
+    }
+    return result;
+}
+
+static std::vector<unsigned char> TrimTrailingZeros(std::vector<unsigned char> value)
+{
+    while (!value.empty() && value.back() == 0) value.pop_back();
+    return value;
+}
+
+template <typename T>
+static std::vector<T> ParseVec(const UniValue& arr)
+{
+    std::vector<T> values;
+    values.reserve(arr.size());
+    for (size_t i = 0; i < arr.size(); i++) {
+        values.push_back(arr[i].getInt<T>());
+    }
+    return values;
+}
+
+BOOST_AUTO_TEST_CASE(val64_valtype_conversion)
+{
+    UniValue tests = read_json(json_tests::val64_conversion);
+
+    for (unsigned int idx = 0; idx < tests.size(); idx++) {
+        const UniValue& test = tests[idx];
+
+        for (bool offset_span: {false, true}) {
+            Val64Test::SetForceOffsetSpan(offset_span);
+
+            // JSON: COMMENT, u8-arr, u64-arr
+            const std::vector<unsigned char> v_in = ParseVec<unsigned char>(test[1].get_array());
+            std::vector<uint64_t> v_out = ParseVec<uint64_t>(test[2].get_array());
+
+            // Check that we get expected u64 vector (make a copy, we mangle it!)
+            Val64Test test_v64(v_in);
+            std::vector<uint64_t> v64 = test_v64.CopyVector();
+            BOOST_CHECK(v64 == v_out);
+
+            // We should get vector back!
+            std::vector<unsigned char> v_ret = test_v64.MoveToValtype();
+            BOOST_CHECK(v_ret == v_in);
+        }
+    }
+    Val64Test::SetForceOffsetSpan(false);
+}
+
+BOOST_AUTO_TEST_CASE(val64_offset_span)
+{
+    Val64Test::SetForceOffsetSpan(true);
+
+    std::vector<unsigned char> v_in_empty;
+    std::vector<unsigned char> v_in_small = {1,2,3};
+    std::vector<unsigned char> v_in_word = {1,2,3,4,5,6,7,8};
+    std::vector<unsigned char> v_in_large = {1,2,3,4,5,6,7,8,9};
+
+    // We don't mess with empty vectors (they're always "aligned")
+    Val64Test v1(v_in_empty);
+    BOOST_CHECK(v1.LimbCount() == 0);
+
+    Val64Test v2(v_in_small);
+    BOOST_CHECK(v2.LimbCount() == 1);
+
+    BOOST_CHECK(v2.Get(0) == 0x0000000000030201);
+
+    Val64Test v3(v_in_word);
+    BOOST_CHECK(v3.LimbCount() == 1);
+
+    BOOST_CHECK(v3.Get(0) == 0x0807060504030201);
+
+    Val64Test v4(v_in_large);
+    BOOST_CHECK(v4.LimbCount() == 2);
+
+    BOOST_CHECK(v4.Get(0) == 0x0807060504030201);
+    BOOST_CHECK(v4.Get(1) == 0x0000000000000009);
+
+    Val64Test::SetForceOffsetSpan(false);
+}
+
+BOOST_AUTO_TEST_CASE(val64_offset_span_copy_constructor_preserves_valtype)
+{
+    Val64Test::SetForceOffsetSpan(true);
+
+    const std::vector<unsigned char> v_in = {1,2,3,4,5,6,7,8,9};
+    Val64Test v(v_in);
+    Val64Test copy(v);
+
+    BOOST_CHECK(copy.MoveToValtype() == v_in);
+
+    Val64Test::SetForceOffsetSpan(false);
+}
+
+BOOST_AUTO_TEST_CASE(val64_offset_span_move_constructor_preserves_valtype)
+{
+    Val64Test::SetForceOffsetSpan(true);
+
+    const std::vector<unsigned char> v_in = {1,2,3,4,5,6,7,8,9};
+    Val64Test v(v_in);
+    Val64Test moved(std::move(v));
+
+    BOOST_CHECK(moved.MoveToValtype() == v_in);
+
+    Val64Test::SetForceOffsetSpan(false);
+}
+
+BOOST_AUTO_TEST_CASE(val64_and_or_xor)
+{
+    uint64_t varcost = 0;
+    for (bool offset_span: {false, true}) {
+        Val64Test::SetForceOffsetSpan(offset_span);
+
+        for (size_t i = 0; i < 128; i++) {
+            for (size_t j = 0; j < 128; j++) {
+                std::vector<unsigned char> expected_and, expected_or, expected_xor;
+
+                expected_or = vec_setbit(j, vec_setbit(i, expected_or));
+                if (i != j) {
+                    expected_and = vec_sized_for_bit(i, vec_sized_for_bit(j));
+                    expected_xor = expected_or;
+                } else {
+                    expected_and = vec_setbit(i);
+                    expected_xor = vec_sized_for_bit(i);
+                }
+
+                // AND test
+                {
+                    Val64Test v64a(vec_setbit(i));
+                    Val64Test v64b(vec_setbit(j));
+                    Val64::OpAnd(v64a, v64b, varcost);
+                    BOOST_CHECK(v64a.MoveToValtype() == expected_and);
+                }
+
+                // OR test
+                {
+                    Val64Test v64a(vec_setbit(i));
+                    Val64Test v64b(vec_setbit(j));
+                    Val64::OpOr(v64a, v64b, varcost);
+                    BOOST_CHECK(v64a.MoveToValtype() == expected_or);
+                }
+
+                // XOR test
+                {
+                    Val64Test v64a(vec_setbit(i));
+                    Val64Test v64b(vec_setbit(j));
+                    Val64::OpXor(v64a, v64b, varcost);
+                    BOOST_CHECK(v64a.MoveToValtype() == expected_xor);
+                }
+            }
+        }
+
+        for (size_t i = 0; i < 1000; i++) {
+            size_t len1 = m_rng.randrange(50);
+            size_t len2 = m_rng.randrange(50);
+
+            std::vector<unsigned char> v1 =    m_rng.randbytes(len1);
+            std::vector<unsigned char> v2 =    m_rng.randbytes(len2);
+
+            const cpp_int cpp1 = vector_to_cpp_int(v1);
+            const cpp_int cpp2 = vector_to_cpp_int(v2);
+
+            // We preserve length.
+            const size_t expected_len = std::max(len1, len2);
+            std::vector<unsigned char> expect_and = cpp_int_to_fixed_vector(cpp1 & cpp2, expected_len);
+            std::vector<unsigned char> expect_or = cpp_int_to_fixed_vector(cpp1 | cpp2, expected_len);
+            std::vector<unsigned char> expect_xor = cpp_int_to_fixed_vector(cpp1 ^ cpp2, expected_len);
+
+            // AND
+            {
+                Val64Test v64a(v1);
+                Val64Test v64b(v2);
+                Val64::OpAnd(v64a, v64b, varcost);
+                BOOST_CHECK(v64a.MoveToValtype() == expect_and);
+            }
+
+            // OR
+            {
+                Val64Test v64a(v1);
+                Val64Test v64b(v2);
+                Val64::OpOr(v64a, v64b, varcost);
+                BOOST_CHECK(v64a.MoveToValtype() == expect_or);
+            }
+
+            // XOR
+            {
+                Val64Test v64a(v1);
+                Val64Test v64b(v2);
+                Val64::OpXor(v64a, v64b, varcost);
+                BOOST_CHECK(v64a.MoveToValtype() == expect_xor);
+            }
+        }
+    }
+}
+
+BOOST_AUTO_TEST_CASE(val64_invert_clears_word_padding)
+{
+    for (bool offset_span : {false, true}) {
+        Val64Test::SetForceOffsetSpan(offset_span);
+
+        for (size_t width{1}; width < sizeof(uint64_t); ++width) {
+            std::vector<unsigned char> input(width);
+            std::vector<unsigned char> expected(width);
+            for (size_t i{0}; i < width; ++i) {
+                input[i] = static_cast<unsigned char>(width * 17 + i);
+                expected[i] = static_cast<unsigned char>(~input[i]);
+            }
+
+            Val64Test value(input);
+            uint64_t varcost{0};
+            Val64::OpInvert(value, varcost);
+
+            BOOST_CHECK_EQUAL(varcost, varops::InvertCost(width));
+            BOOST_CHECK_EQUAL(value.size(), width);
+            const Val64 expected_value{std::move(expected)};
+            BOOST_CHECK_EQUAL(value.Compare(expected_value), 0);
+
+            const std::span<const uint64_t> words{value.Limbs()};
+            const auto* bytes{reinterpret_cast<const unsigned char*>(words.data())};
+            for (size_t i{width}; i < words.size_bytes(); ++i) {
+                BOOST_CHECK_EQUAL(bytes[i], 0);
+            }
+        }
+    }
+    Val64Test::SetForceOffsetSpan(false);
+}
+
+BOOST_AUTO_TEST_CASE(val64_add)
+{
+    uint64_t varcost = 0;
+    for (bool offset_span: {false, true}) {
+        Val64Test::SetForceOffsetSpan(offset_span);
+
+        // Add two bits, check result.
+        for (size_t i = 0; i < 128; i++) {
+            for (size_t j = 0; j < 128; j++) {
+                Val64Test v64a(vec_setbit(i));
+                Val64Test v64b(vec_setbit(j));
+                Val64::OpAdd(v64a, v64b, varcost);
+
+                // Check against expected vector.
+                std::vector<unsigned char> expected;
+                if (i != j) {
+                    expected = vec_setbit(i);
+                    expected = vec_setbit(j, expected);
+                } else {
+                    expected = vec_setbit(i + 1);
+                }
+                BOOST_CHECK(v64a.MoveToValtype() == expected);
+            }
+        }
+
+        // Overflow tests.
+        for (size_t i = 1; i < 24; i++) {
+            std::vector<unsigned char> almost(i, 0xff);
+            std::vector<unsigned char> one{1};
+
+            Val64 v64a(std::move(almost));
+            Val64 v64b(std::move(one));
+            Val64::OpAdd(v64a, v64b, varcost);
+            std::vector<unsigned char> res = v64a.MoveToValtype();
+
+            std::vector<unsigned char> expect(i, 0);
+            expect.push_back(1);
+
+            BOOST_CHECK(res == expect);
+        }
+        for (size_t i = 0; i < 1000; i++) {
+            size_t len1 = m_rng.randrange(50);
+            size_t len2 = m_rng.randrange(50);
+
+            std::vector<unsigned char> v1 =    m_rng.randbytes(len1);
+            std::vector<unsigned char> v2 =    m_rng.randbytes(len2);
+
+            const std::vector<unsigned char> expect = cpp_int_to_vector(vector_to_cpp_int(v1) + vector_to_cpp_int(v2));
+
+            // Val64 version
+            Val64 v64_1(std::move(v1)), v64_2(std::move(v2));
+
+            Val64::OpAdd(v64_1, v64_2, varcost);
+            std::vector<unsigned char> res = v64_1.MoveToValtype();
+
+            BOOST_CHECK(res == expect);
+        }
+    }
+}
+
+BOOST_AUTO_TEST_CASE(val64_sub)
+{
+    uint64_t varcost = 0;
+    for (bool offset_span: {false, true}) {
+        Val64Test::SetForceOffsetSpan(offset_span);
+
+        // Underflow must not leave nonzero bytes in Val64's word padding.
+        {
+            Val64Test smaller{{0xb2, 0x89}};
+            const Val64Test larger{{0x16, 0xaa, 0x73, 0x3d}};
+            BOOST_CHECK(!Val64::OpSub(smaller, larger, varcost));
+            BOOST_CHECK_EQUAL(smaller.Get(0) >> 16, 0U);
+        }
+
+        // Sub zero (unchanged).
+        for (size_t i = 0; i < 128; i++) {
+            const std::vector<unsigned char> zero;
+
+            // Subtract 0, should not change.
+            Val64Test v64a(vec_setbit(i));
+            Val64Test v64zero(zero);
+
+            bool res = Val64::OpSub(v64a, v64zero, varcost);
+            BOOST_CHECK(res);
+
+            BOOST_CHECK(v64a.MoveToValtype() == vec_setbit(i));
+        }
+
+        // Sub one.
+        for (size_t i = 63; i < 128; i++) {
+            const std::vector<unsigned char> one{1};
+
+            Val64Test v64a(vec_setbit(i));
+            Val64Test v64one(one);
+
+            bool res = Val64::OpSub(v64a, v64one, varcost);
+            BOOST_CHECK(res);
+
+            std::vector<unsigned char> expected;
+            for (size_t j = 0; j < i; j++)
+                expected = vec_setbit(j, expected);
+
+            std::vector<unsigned char> va = v64a.MoveToValtype();
+            BOOST_CHECK(va == expected);
+        }
+        for (size_t i = 0; i < 1000; i++) {
+            size_t len1 = m_rng.randrange(50);
+            size_t len2 = m_rng.randrange(50);
+
+            std::vector<unsigned char> v1 =    m_rng.randbytes(len1);
+            std::vector<unsigned char> v2 =    m_rng.randbytes(len2);
+
+            const cpp_int cpp1 = vector_to_cpp_int(v1);
+            const cpp_int cpp2 = vector_to_cpp_int(v2);
+            const bool expect_neg = cpp1 < cpp2;
+            std::vector<unsigned char> expect;
+            if (!expect_neg) {
+                expect = cpp_int_to_vector(cpp1 - cpp2);
+            }
+
+            // Val64 version
+            Val64 v64_1(std::move(v1)), v64_2(std::move(v2));
+
+            bool neg = !Val64::OpSub(v64_1, v64_2, varcost);
+            std::vector<unsigned char> res = v64_1.MoveToValtype();
+
+            if (expect_neg) {
+                BOOST_CHECK(neg == true);
+            } else {
+                BOOST_CHECK(neg == false);
+                BOOST_CHECK(res == expect);
+            }
+        }
+    }
+}
+
+BOOST_AUTO_TEST_CASE(val64_cmp)
+{
+    uint64_t varcost = 0;
+    for (bool offset_span: {false, true}) {
+        Val64Test::SetForceOffsetSpan(offset_span);
+
+        for (size_t i = 0; i < 128; i++) {
+            for (size_t j = 0; j < 128; j++) {
+                std::vector<unsigned char> va = vec_setbit(i);
+                std::vector<unsigned char> vb = vec_setbit(j);
+                Val64 v64a(std::move(va));
+                Val64 v64b(std::move(vb));
+                int res = v64a.Compare(v64b, varcost);
+
+                int expected;
+                if (i == j)
+                    expected = 0;
+                else if (i > j)
+                    expected = 1;
+                else
+                    expected = -1;
+
+                BOOST_CHECK(res == expected);
+            }
+        }
+
+        for (size_t i = 0; i < 1000; i++) {
+            size_t len1 = m_rng.randrange(50);
+            size_t len2 = m_rng.randrange(50);
+
+            std::vector<unsigned char> v1 =    m_rng.randbytes(len1);
+            std::vector<unsigned char> v2 =    m_rng.randbytes(len2);
+
+            const cpp_int cpp1 = vector_to_cpp_int(v1);
+            const cpp_int cpp2 = vector_to_cpp_int(v2);
+            int expected;
+            if (cpp1 == cpp2)
+                expected = 0;
+            else if (cpp1 > cpp2)
+                expected = 1;
+            else
+                expected = -1;
+
+            // Val64 version
+            Val64Test v64_1(v1), v64_2(v2);
+
+            int res = v64_1.Compare(v64_2, varcost);
+
+            BOOST_CHECK(res == expected);
+        }
+    }
+}
+
+BOOST_AUTO_TEST_CASE(val64_upshift)
+{
+    uint64_t varcost = 0;
+    for (bool offset_span: {false, true}) {
+        Val64Test::SetForceOffsetSpan(offset_span);
+
+        for (size_t i = 0; i < 128; i++) {
+            for (size_t j = 0; j < 128; j++) {
+                std::vector<unsigned char> va = vec_setbit(i);
+                Val64 v64a(std::move(va));
+                bool ok = Val64::OpUpShift(v64a, val64_singleton(j), 1000, varcost);
+                BOOST_CHECK(ok);
+                va = v64a.MoveToValtype();
+
+                std::vector<unsigned char> expected = vec_setbit(i + j);
+                // Definitionally, upshift inserts an extra (j + 7) / 8 bytes.
+                expected.resize(1 + i / 8 + (j + 7) / 8);
+
+                BOOST_CHECK(va == expected);
+            }
+        }
+
+        for (size_t i = 0; i < 1000; i++) {
+            size_t len1 = m_rng.randrange(500);
+            size_t sbits = m_rng.randrange(500 * 8);
+
+            std::vector<unsigned char> v1 =    m_rng.randbytes(len1);
+
+            // Always leaves trailing zeroes
+            const size_t expected_len = len1 + sbits / 8 + (sbits % 8 ? 1 : 0);
+            const std::vector<unsigned char> expect = shift_left_fixed(v1, sbits, expected_len);
+
+            // Val64 version
+            Val64 v64(std::move(v1));
+            bool ok = Val64::OpUpShift(v64, val64_singleton(sbits), 5000, varcost);
+            BOOST_CHECK(ok);
+            v1 = v64.MoveToValtype();
+
+            BOOST_CHECK(v1 == expect);
+        }
+    }
+}
+
+BOOST_AUTO_TEST_CASE(val64_downshift)
+{
+    uint64_t varcost = 0;
+    for (bool offset_span: {false, true}) {
+        Val64Test::SetForceOffsetSpan(offset_span);
+
+        for (size_t i = 0; i < 128; i++) {
+            for (size_t j = 0; j < 128; j++) {
+                std::vector<unsigned char> va = vec_setbit(i);
+                BOOST_CHECK(va.size() == (i + 8) / 8);
+                Val64 v64a(std::move(va));
+                Val64::OpDownShift(v64a, val64_singleton(j), varcost);
+                va = v64a.MoveToValtype();
+
+                std::vector<unsigned char> expected;
+                if (j <= i)
+                    expected = vec_setbit(i - j);
+
+                // Definitionally, downshift only removes one byte for every 8 bits shifted.
+                if (j / 8 <= (i + 8) / 8)
+                    expected.resize((i + 8) / 8 - j / 8);
+
+                BOOST_CHECK(va == expected);
+            }
+        }
+
+        for (size_t i = 0; i < 1000; i++) {
+            size_t len1 = m_rng.randrange(500);
+            size_t sbits = m_rng.randrange(500 * 8);
+
+            std::vector<unsigned char> v1 =    m_rng.randbytes(len1);
+
+            // We subtract only whole bytes from length.
+            const size_t expected_len = v1.size() > sbits / 8 ? v1.size() - sbits / 8 : 0;
+            const std::vector<unsigned char> expect = shift_right_fixed(v1, sbits, expected_len);
+
+            // Val64 version
+            Val64 v64(std::move(v1));
+            Val64::OpDownShift(v64, val64_singleton(sbits), varcost);
+            v1 = v64.MoveToValtype();
+
+            BOOST_CHECK(v1 == expect);
+        }
+    }
+}
+
+BOOST_AUTO_TEST_CASE(val64_add_span)
+{
+    Val64Test res(std::vector<unsigned char>(sizeof(uint64_t) * 2));
+
+    // 0xFFFFFFFFFFFFFFFF
+    const Val64Test u64_max(std::vector<unsigned char>(sizeof(uint64_t), 0xff));
+    const Val64Test u64_zero(std::vector<unsigned char>(sizeof(uint64_t), 0));
+    bool carry;
+    size_t nonzero_len;
+
+    // Add empty at offset 0.
+    carry = Val64Test::AddSpans(res.Limbs(), u64_zero.Limbs(), nonzero_len);
+    BOOST_CHECK(res.Get(0) == 0);
+    BOOST_CHECK(res.Get(1) == 0);
+    BOOST_CHECK(nonzero_len == 0);
+    BOOST_CHECK(!carry);
+
+    // Add at offset 0.
+    carry = Val64Test::AddSpans(res.Limbs(), u64_max.Limbs(), nonzero_len);
+    BOOST_CHECK(res.Get(0) == 0xFFFFFFFFFFFFFFFFULL);
+    BOOST_CHECK(res.Get(1) == 0);
+    BOOST_CHECK(nonzero_len == 1);
+    BOOST_CHECK(!carry);
+
+    // Add at offset 1.
+    carry = Val64Test::AddSpans(res.Limbs().subspan(1), u64_max.Limbs(), nonzero_len);
+    BOOST_CHECK(res.Get(0) == 0xFFFFFFFFFFFFFFFFULL);
+    BOOST_CHECK(res.Get(1) == 0xFFFFFFFFFFFFFFFFULL);
+    // Relative to subspan!
+    BOOST_CHECK(nonzero_len == 1);
+    BOOST_CHECK(!carry);
+
+    // Add one more, should carry.
+    carry = Val64Test::AddSpans(res.Limbs().subspan(1), Val64Test(1).Limbs(), nonzero_len);
+    BOOST_CHECK(res.Get(0) == 0xFFFFFFFFFFFFFFFFULL);
+    BOOST_CHECK(res.Get(1) == 0);
+    BOOST_CHECK(carry);
+}
+
+BOOST_AUTO_TEST_CASE(val64_sub_span)
+{
+    Val64Test res(std::vector<unsigned char>(sizeof(uint64_t) * 2, 0xFF));
+
+    // 0xFFFFFFFFFFFFFFFF
+    const Val64Test u64_max(std::vector<unsigned char>(sizeof(uint64_t), 0xff));
+    const Val64Test u64_zero(std::vector<unsigned char>(sizeof(uint64_t), 0));
+    bool underflow;
+    size_t nonzero_len;
+
+    // Sub empty at offset 0.
+    underflow = Val64Test::SubtractSpans(res.Limbs(), u64_zero.Limbs(),
+                                    nonzero_len);
+    BOOST_CHECK(res.Get(0) == 0xFFFFFFFFFFFFFFFFULL);
+    BOOST_CHECK(res.Get(1) == 0xFFFFFFFFFFFFFFFFULL);
+    BOOST_CHECK(nonzero_len == 2);
+    BOOST_CHECK(!underflow);
+
+    // Sub at offset 1.
+    underflow = Val64Test::SubtractSpans(res.Limbs().subspan(1), u64_max.Limbs(),
+                                    nonzero_len);
+    BOOST_CHECK(res.Get(0) == 0xFFFFFFFFFFFFFFFFULL);
+    BOOST_CHECK(res.Get(1) == 0);
+    BOOST_CHECK(nonzero_len == 0);
+    BOOST_CHECK(!underflow);
+
+    // Sub at offset 0.
+    underflow = Val64Test::SubtractSpans(res.Limbs(), u64_max.Limbs(), nonzero_len);
+    BOOST_CHECK(res.Get(0) == 0);
+    BOOST_CHECK(res.Get(1) == 0);
+    BOOST_CHECK(nonzero_len == 0);
+    BOOST_CHECK(!underflow);
+
+    // Sub one more, should underflow.
+    underflow = Val64Test::SubtractSpans(res.Limbs().subspan(1), Val64Test(1).Limbs(),
+                                    nonzero_len);
+    BOOST_CHECK(res.Get(0) == 0);
+    BOOST_CHECK(res.Get(1) == 0xFFFFFFFFFFFFFFFFULL);
+    BOOST_CHECK(underflow);
+}
+
+BOOST_AUTO_TEST_CASE(val64_mul_span)
+{
+    Val64Test::SetForceOffsetSpan(false);
+
+    for (bool portable_math : {false, true}) {
+        Val64Test::SetForcePortableMath(portable_math);
+
+    // Multiply this by mul, place into res.
+    for (size_t i = 0; i < 128; i++) {
+        for (size_t j = 0; j < 65; j++) {
+            Val64Test v64a(vec_setbit(i));
+
+            // Initial contents shouldn't matter, but size needs to match.
+            size_t vecsize = (v64a.LimbCount() + 1) * sizeof(uint64_t);
+            std::vector<unsigned char> dummy(vecsize, 1|j);
+            Val64Test res64(dummy);
+
+            if (j == 64) {
+                // Test multiply by 0
+                Val64Test::MultiplySpan(res64.Limbs(), v64a.Limbs(), 0);
+            } else {
+                Val64Test::MultiplySpan(res64.Limbs(), v64a.Limbs(), (uint64_t)1 << j);
+            }
+
+            // mul_vector does not trim zeros.
+            std::vector<unsigned char> expected(vecsize);
+            if (j != 64)
+                expected = vec_setbit(i + j, expected);
+            BOOST_CHECK(res64.MoveToValtype() == expected);
+        }
+    }
+
+    } // end for portable_math
+    Val64Test::SetForcePortableMath(false);
+}
+
+BOOST_AUTO_TEST_CASE(val64_mul)
+{
+    constexpr size_t POWER_OF_TWO_BITS{128};
+    constexpr size_t RHS_BOUNDARY_BITS{129};
+    constexpr size_t RANDOM_CASES{1000};
+    constexpr size_t RANDOM_OPERAND_BYTES{50};
+
+    for (bool portable_math : {false, true}) {
+        Val64Test::SetForcePortableMath(portable_math);
+    for (bool offset_span: {false, true}) {
+        Val64Test::SetForceOffsetSpan(offset_span);
+
+        // Test 2^lhs_bit * 2^rhs_bit = 2^(lhs_bit + rhs_bit).
+        for (size_t lhs_bit = 0; lhs_bit < POWER_OF_TWO_BITS; lhs_bit++) {
+            for (size_t rhs_bit = 0; rhs_bit < RHS_BOUNDARY_BITS; rhs_bit++) {
+                std::vector<unsigned char> va = vec_setbit(lhs_bit), vb = vec_setbit(rhs_bit);
+
+                Val64 v64a(std::move(va));
+                Val64 v64b(std::move(vb));
+                Val64 ret = Val64::OpMul(v64a, v64b);
+                std::vector<unsigned char> retvec = ret.MoveToValtype();
+
+                std::vector<unsigned char> expected = vec_setbit(lhs_bit + rhs_bit);
+                BOOST_CHECK(retvec == expected);
+            }
+
+            {
+                std::vector<unsigned char> va = vec_setbit(lhs_bit);
+                std::vector<unsigned char> vb;
+
+                Val64 v64a(std::move(va));
+                Val64 v64b(std::move(vb));
+                Val64 ret = Val64::OpMul(v64a, v64b);
+                std::vector<unsigned char> retvec = ret.MoveToValtype();
+
+                BOOST_CHECK(retvec == std::vector<unsigned char>{});
+            }
+        }
+
+        // Test (2^bits - 1) * 2^shift.
+        for (size_t bits = 1; bits < POWER_OF_TWO_BITS; bits++) {
+            for (size_t shift = 0; shift < POWER_OF_TWO_BITS; shift++) {
+                std::vector<unsigned char> va((bits + 7) / 8, 0xff);
+                const size_t high_byte_bits = bits % 8;
+                if (high_byte_bits != 0) {
+                    va.back() = static_cast<unsigned char>((1U << high_byte_bits) - 1);
+                }
+                std::vector<unsigned char> vb = vec_setbit(shift);
+                const std::vector<unsigned char> expected{
+                    TrimTrailingZeros(shift_left_fixed(va, shift, (bits + shift + 7) / 8))};
+
+                Val64 v64a(std::move(va));
+                Val64 v64b(std::move(vb));
+                Val64 ret = Val64::OpMul(v64a, v64b);
+                std::vector<unsigned char> retvec = ret.MoveToValtype();
+
+                BOOST_CHECK(retvec == expected);
+            }
+        }
+        for (size_t case_idx = 0; case_idx < RANDOM_CASES; case_idx++) {
+            size_t lhs_len = m_rng.randrange(RANDOM_OPERAND_BYTES);
+            size_t rhs_len = m_rng.randrange(RANDOM_OPERAND_BYTES);
+
+            std::vector<unsigned char> lhs = m_rng.randbytes(lhs_len);
+            std::vector<unsigned char> rhs = m_rng.randbytes(rhs_len);
+
+            const std::vector<unsigned char> expect = cpp_int_to_vector(vector_to_cpp_int(lhs) * vector_to_cpp_int(rhs));
+
+            // Val64 version
+            Val64 v64a(std::move(lhs));
+            Val64 v64b(std::move(rhs));
+            Val64 ret64 = Val64::OpMul(v64a, v64b);
+            std::vector<unsigned char> ret = ret64.MoveToValtype();
+
+            BOOST_CHECK(ret == expect);
+        }
+    }
+    } // end for portable_math
+    Val64Test::SetForcePortableMath(false);
+}
+
+BOOST_AUTO_TEST_CASE(val64_2mul)
+{
+    uint64_t varcost = 0;
+    for (bool offset_span: {false, true}) {
+        Val64Test::SetForceOffsetSpan(offset_span);
+
+        for (size_t i = 0; i < 129; i++) {
+            for (size_t j = 0; j < 16; j++) {
+                std::vector<unsigned char> va;
+
+                // Test zero case
+                if (i != 128)
+                    va = vec_setbit(i);
+
+                // Append empty bytes (shouldn't make a difference)
+                va.insert(va.end(), j, 0);
+
+                Val64 v64a(std::move(va));
+                Val64::Op2Mul(v64a, varcost);
+                va = v64a.MoveToValtype();
+
+                std::vector<unsigned char> expected;
+
+                if (i != 128)
+                    expected = vec_setbit(i + 1);
+                BOOST_CHECK(va == expected);
+            }
+        }
+
+        for (size_t i = 0; i < 1000; i++) {
+            size_t len1 = m_rng.randrange(500);
+            std::vector<unsigned char> v1 =    m_rng.randbytes(len1);
+
+            const std::vector<unsigned char> expect{
+                TrimTrailingZeros(shift_left_fixed(v1, 1, v1.size() + 1))};
+
+            // Val64 version
+            Val64 v64(std::move(v1));
+            Val64::Op2Mul(v64, varcost);
+            v1 = v64.MoveToValtype();
+
+            BOOST_CHECK(v1 == expect);
+        }
+    }
+}
+
+BOOST_AUTO_TEST_CASE(val64_2div)
+{
+    uint64_t varcost = 0;
+    for (bool offset_span: {false, true}) {
+        Val64Test::SetForceOffsetSpan(offset_span);
+
+        {
+            constexpr size_t padded_size{64 * 1024};
+            std::vector<unsigned char> padded_one(padded_size, 0);
+            padded_one.front() = 1;
+            uint64_t padded_cost{0};
+            Val64 padded_value(std::move(padded_one));
+            Val64::Op2Div(padded_value, padded_cost);
+            BOOST_CHECK(padded_value.MoveToValtype().empty());
+            BOOST_CHECK_EQUAL(padded_cost, varops::TwoDivCost(padded_size));
+        }
+
+        for (size_t i = 0; i < 129; i++) {
+            for (size_t j = 0; j < 16; j++) {
+                std::vector<unsigned char> va;
+
+                // Test zero case
+                if (i != 128)
+                    va = vec_setbit(i);
+
+                // Append empty bytes (shouldn't make a difference)
+                va.insert(va.end(), j, 0);
+
+                Val64 v64a(std::move(va));
+                Val64::Op2Div(v64a, varcost);
+                va = v64a.MoveToValtype();
+
+                std::vector<unsigned char> expected;
+                if (i > 0 && i != 128)
+                    expected = vec_setbit(i - 1);
+                BOOST_CHECK(va == expected);
+            }
+        }
+
+        for (size_t i = 0; i < 1000; i++) {
+            size_t len1 = m_rng.randrange(500);
+            std::vector<unsigned char> v1 =    m_rng.randbytes(len1);
+
+            const std::vector<unsigned char> expect{
+                TrimTrailingZeros(shift_right_fixed(v1, 1, v1.size()))};
+
+            // Val64 version
+            Val64 v64(std::move(v1));
+            Val64::Op2Div(v64, varcost);
+            v1 = v64.MoveToValtype();
+
+            BOOST_CHECK(v1 == expect);
+        }
+    }
+}
+
+BOOST_AUTO_TEST_CASE(val64_trim_tail_word_padding)
+{
+    for (bool offset_span : {false, true}) {
+        Val64Test::SetForceOffsetSpan(offset_span);
+
+        for (size_t size : {size_t{8}, size_t{9}, size_t{16}, size_t{17}, size_t{4096}}) {
+            std::vector<unsigned char> zeroes(size, 0);
+            Val64 zero_value(std::move(zeroes));
+            zero_value.TrimTrailingZeros();
+            BOOST_CHECK(zero_value.MoveToValtype().empty());
+
+            std::vector<unsigned char> padded_one(size, 0);
+            padded_one.front() = 1;
+            Val64 one_value(std::move(padded_one));
+            one_value.TrimTrailingZeros();
+            BOOST_CHECK(one_value.MoveToValtype() == std::vector<unsigned char>{1});
+        }
+
+        std::vector<unsigned char> later_limb(4096, 0);
+        later_limb[8] = 1;
+        Val64 later_limb_value(std::move(later_limb));
+        later_limb_value.TrimTrailingZeros();
+        std::vector<unsigned char> expected(9, 0);
+        expected.back() = 1;
+        BOOST_CHECK(later_limb_value.MoveToValtype() == expected);
+    }
+    Val64Test::SetForceOffsetSpan(false);
+}
+
+BOOST_AUTO_TEST_CASE(val64_div_mod)
+{
+    for (bool portable_math : {false, true}) {
+        Val64Test::SetForcePortableMath(portable_math);
+    for (bool offset_span: {false, true}) {
+        Val64Test::SetForceOffsetSpan(offset_span);
+
+        for (size_t i = 0; i < 128; i++) {
+            for (size_t j = 0; j < 129; j++) {
+                std::vector<unsigned char> va = vec_setbit(i), vb = vec_setbit(j);
+
+                Val64Test v64a_div(va), v64a_mod(va);
+                Val64Test v64b_div(vb), v64b_mod(vb);
+                bool div_ret = Val64Test::OpDiv(v64a_div, v64b_div);
+                bool mod_ret = Val64Test::OpMod(v64a_mod, v64b_mod);
+                std::vector<unsigned char> div_vec = v64a_div.MoveToValtype();
+                std::vector<unsigned char> mod_vec = v64a_mod.MoveToValtype();
+
+                std::vector<unsigned char> expected_div, expected_remainder;
+                BOOST_CHECK(div_ret == true);
+                BOOST_CHECK(mod_ret == true);
+                if (i >= j)
+                    expected_div = vec_setbit(i - j);
+                else
+                    expected_remainder = vec_setbit(i);
+
+
+                BOOST_CHECK(div_vec == expected_div);
+                BOOST_CHECK(mod_vec == expected_remainder);
+            }
+
+            {
+                const std::vector<unsigned char> va = vec_setbit(i);
+                const std::vector<unsigned char> vb;
+
+                Val64Test v64a_div(va), v64a_mod(va);
+                Val64Test v64b_div(vb), v64b_mod(vb);
+                BOOST_CHECK(Val64Test::OpDiv(v64a_div, v64b_div) == false);
+                BOOST_CHECK(Val64Test::OpMod(v64a_mod, v64b_mod) == false);
+            }
+        }
+
+        for (size_t i = 0; i < 1000; i++) {
+            size_t len1 = m_rng.randrange(50);
+            size_t len2 = m_rng.randrange(50);
+
+            std::vector<unsigned char> v1 =    m_rng.randbytes(len1);
+            std::vector<unsigned char> v2 =    m_rng.randbytes(len2);
+
+            const cpp_int cpp1 = vector_to_cpp_int(v1);
+            const cpp_int cpp2 = vector_to_cpp_int(v2);
+            const bool expect_success = cpp2 != 0;
+            std::vector<unsigned char> expect_res;
+            std::vector<unsigned char> expect_rem;
+            if (expect_success) {
+                expect_res = cpp_int_to_vector(cpp1 / cpp2);
+                expect_rem = cpp_int_to_vector(cpp1 % cpp2);
+            }
+
+            // Val64 version
+            Val64Test v64a_div(v1), v64a_mod(v1);
+            Val64Test v64b_div(v2), v64b_mod(v2);
+            bool div_ret = Val64Test::OpDiv(v64a_div, v64b_div);
+            bool mod_ret = Val64Test::OpMod(v64a_mod, v64b_mod);
+            std::vector<unsigned char> div_vec = v64a_div.MoveToValtype();
+            std::vector<unsigned char> mod_vec = v64a_mod.MoveToValtype();
+
+            BOOST_CHECK(div_ret == expect_success);
+            BOOST_CHECK(mod_ret == expect_success);
+            if (expect_success) {
+                BOOST_CHECK(div_vec == expect_res);
+                BOOST_CHECK(mod_vec == expect_rem);
+            }
+        }
+
+        for (uint16_t a = 0; a <= 255; ++a) {
+            for (uint16_t b = 0; b <= 255; ++b) {
+                const std::vector<unsigned char> va{static_cast<unsigned char>(a)};
+                const std::vector<unsigned char> vb{static_cast<unsigned char>(b)};
+
+                Val64Test v64a_div(va), v64a_mod(va);
+                Val64Test v64b_div(vb), v64b_mod(vb);
+                const bool div_ret = Val64Test::OpDiv(v64a_div, v64b_div);
+                const bool mod_ret = Val64Test::OpMod(v64a_mod, v64b_mod);
+
+                if (b == 0) {
+                    BOOST_CHECK(div_ret == false);
+                    BOOST_CHECK(mod_ret == false);
+                    continue;
+                }
+
+                BOOST_CHECK(div_ret == true);
+                BOOST_CHECK(mod_ret == true);
+                BOOST_CHECK(v64a_div.MoveToValtype() == cpp_int_to_vector(cpp_int{a} / b));
+                BOOST_CHECK(v64a_mod.MoveToValtype() == cpp_int_to_vector(cpp_int{a} % b));
+            }
+        }
+    }
+    } // end for portable_math
+    Val64Test::SetForcePortableMath(false);
+}
+
+BOOST_AUTO_TEST_CASE(val64_div_mod_normalizes_clear_top_bit_divisor)
+{
+    for (bool portable_math : {false, true}) {
+        Val64Test::SetForcePortableMath(portable_math);
+        for (bool offset_span : {false, true}) {
+            Val64Test::SetForceOffsetSpan(offset_span);
+
+            // The divisor's top bit is clear, so DivMod() normalizes through OpUpShift().
+            const std::vector<unsigned char> dividend{0x0a};
+            const std::vector<unsigned char> divisor{0x03};
+
+            Val64Test quotient{dividend};
+            Val64Test quotient_divisor{divisor};
+            BOOST_CHECK(Val64Test::OpDiv(quotient, quotient_divisor));
+            BOOST_CHECK(quotient.MoveToValtype() == std::vector<unsigned char>{0x03});
+
+            Val64Test remainder{dividend};
+            Val64Test remainder_divisor{divisor};
+            BOOST_CHECK(Val64Test::OpMod(remainder, remainder_divisor));
+            BOOST_CHECK(remainder.MoveToValtype() == std::vector<unsigned char>{0x01});
+        }
+    }
+
+    Val64Test::SetForcePortableMath(false);
+    Val64Test::SetForceOffsetSpan(false);
+}
+
+BOOST_AUTO_TEST_CASE(val64_div_mod_knuth_d6_add_back)
+{
+    const std::vector<unsigned char> dividend = {
+        0x71, 0x0a, 0x7f, 0x30, 0x34, 0x4d, 0x13, 0x98,
+        0xb1, 0x15, 0xd5, 0x64, 0xac, 0xc8, 0x9d, 0x56,
+        0x5a, 0x64, 0xdc, 0x11, 0x21, 0xf7, 0x22, 0x7c,
+        0xf9, 0x7f, 0x16, 0xbc, 0xeb, 0xe8, 0x95, 0x85,
+    };
+    const std::vector<unsigned char> divisor = {
+        0xcd, 0x07, 0x2c, 0xd8, 0xbe, 0x6f, 0x9f, 0x62,
+        0xac, 0x4c, 0x09, 0xc2, 0x82, 0x06, 0xe7, 0xe3,
+        0x55, 0x94, 0xaa, 0x6b, 0x34, 0x2f, 0x5d, 0x8a,
+    };
+    const std::vector<unsigned char> expected_quotient = {
+        0x39, 0x5e, 0x48, 0x42, 0xfa, 0xb4, 0x28, 0xf7,
+    };
+    const std::vector<unsigned char> expected_remainder = {
+        0xcc, 0x07, 0x2c, 0xd8, 0xbe, 0x6f, 0x9f, 0x62,
+        0xac, 0x4c, 0x09, 0xc2, 0x82, 0x06, 0xe7, 0xe3,
+        0x55, 0x94, 0xaa, 0x6b, 0x34, 0x2f, 0x5d, 0x8a,
+    };
+
+    for (bool portable_math : {false, true}) {
+        Val64Test::SetForcePortableMath(portable_math);
+        for (bool offset_span : {false, true}) {
+            Val64Test::SetForceOffsetSpan(offset_span);
+
+            Val64Test quotient{dividend};
+            Val64Test quotient_divisor{divisor};
+            BOOST_CHECK(Val64Test::OpDiv(quotient, quotient_divisor));
+            BOOST_CHECK(quotient.MoveToValtype() == expected_quotient);
+
+            Val64Test remainder{dividend};
+            Val64Test remainder_divisor{divisor};
+            BOOST_CHECK(Val64Test::OpMod(remainder, remainder_divisor));
+            BOOST_CHECK(remainder.MoveToValtype() == expected_remainder);
+        }
+    }
+
+    Val64Test::SetForcePortableMath(false);
+    Val64Test::SetForceOffsetSpan(false);
+}
+
+BOOST_AUTO_TEST_CASE(val64_div_mod_fuzz_regression_normalized_divisor)
+{
+    const std::vector<unsigned char> dividend = {
+        0x2b, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xf6, 0x88,
+    };
+    const std::vector<unsigned char> divisor = {
+        0x2a, 0x01, 0x48, 0x2f, 0xff, 0xff, 0xff, 0x4e, 0x01, 0x00, 0x00,
+    };
+    const std::vector<unsigned char> expected_quotient = {
+        0x68,
+    };
+    const std::vector<unsigned char> expected_remainder = {
+        0x1b, 0x86, 0xbf, 0xca, 0x54, 0x00, 0x00, 0xdf,
+    };
+
+    for (bool portable_math : {false, true}) {
+        Val64Test::SetForcePortableMath(portable_math);
+        for (bool offset_span : {false, true}) {
+            Val64Test::SetForceOffsetSpan(offset_span);
+
+            Val64Test quotient{dividend};
+            Val64Test quotient_divisor{divisor};
+            BOOST_CHECK(Val64Test::OpDiv(quotient, quotient_divisor));
+            BOOST_CHECK(quotient.MoveToValtype() == expected_quotient);
+
+            Val64Test remainder{dividend};
+            Val64Test remainder_divisor{divisor};
+            BOOST_CHECK(Val64Test::OpMod(remainder, remainder_divisor));
+            BOOST_CHECK(remainder.MoveToValtype() == expected_remainder);
+        }
+    }
+
+    Val64Test::SetForcePortableMath(false);
+    Val64Test::SetForceOffsetSpan(false);
+}
+
+BOOST_AUTO_TEST_CASE(val64_div_mod_trial_quotient_beta)
+{
+    // The high dividend word equals the high divisor word after normalization.
+    // Knuth D3 first estimates qhat as β, then corrects it to β - 1.
+    const std::vector<unsigned char> dividend = {
+        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x01,
+        0x00, 0x01, 0x00, 0x00, 0x00, 0x1d, 0x00, 0x00,
+        0x01, 0x00, 0x00, 0x00, 0x1d, 0x00, 0x00, 0x3b,
+        0x00,
+    };
+    const std::vector<unsigned char> divisor = {
+        0xe7, 0x26, 0xff, 0xff, 0xff, 0xff, 0x01, 0x00,
+        0x01, 0x00, 0x00, 0x00, 0x1d, 0x00, 0x00, 0x3b,
+        0x00,
+    };
+    const std::vector<unsigned char> expected_quotient = {
+        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    };
+    const std::vector<unsigned char> expected_remainder = {
+        0xe6, 0x26, 0xff, 0xff, 0xff, 0xff, 0x01, 0x02,
+        0x1a, 0xda, 0x00, 0x00, 0x1d, 0x1d, 0xfe, 0x3a,
+    };
+
+    for (bool portable_math : {false, true}) {
+        Val64Test::SetForcePortableMath(portable_math);
+        for (bool offset_span : {false, true}) {
+            Val64Test::SetForceOffsetSpan(offset_span);
+
+            Val64Test quotient{dividend};
+            Val64Test quotient_divisor{divisor};
+            BOOST_CHECK(Val64Test::OpDiv(quotient, quotient_divisor));
+            BOOST_CHECK(quotient.MoveToValtype() == expected_quotient);
+
+            Val64Test remainder{dividend};
+            Val64Test remainder_divisor{divisor};
+            BOOST_CHECK(Val64Test::OpMod(remainder, remainder_divisor));
+            BOOST_CHECK(remainder.MoveToValtype() == expected_remainder);
+        }
+    }
+
+    Val64Test::SetForcePortableMath(false);
+    Val64Test::SetForceOffsetSpan(false);
+}
+
+BOOST_AUTO_TEST_CASE(val64_div_mod_trial_quotient_beta_raw_division_overflow)
+{
+    // Same qhat == β boundary as above, but the raw 128-bit division would
+    // compute β + 1 if it were not capped to Algorithm D's trial quotient.
+    const std::vector<unsigned char> dividend = {
+        0x50, 0x00, 0x30, 0x9d, 0x2c, 0x3f, 0xfe, 0xff,
+        0x00, 0x00, 0x00, 0x00, 0x27, 0xb1, 0xff, 0xff,
+        0xff, 0xff, 0xff, 0xff, 0xcf, 0xf3, 0x3b,
+    };
+    const std::vector<unsigned char> divisor = {
+        0x3e, 0x03, 0x00, 0x00, 0x27, 0xb1, 0xff, 0xff,
+        0xff, 0xff, 0xff, 0xff, 0xcf, 0xf3, 0x3b,
+    };
+    const std::vector<unsigned char> expected_quotient = {
+        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    };
+    const std::vector<unsigned char> expected_remainder = {
+        0x8e, 0x03, 0x30, 0x9d, 0x53, 0xf0, 0xfd, 0xff,
+        0xc2, 0xfc, 0xff, 0xff, 0xcf, 0xf3, 0x3b,
+    };
+
+    for (bool portable_math : {false, true}) {
+        Val64Test::SetForcePortableMath(portable_math);
+        for (bool offset_span : {false, true}) {
+            Val64Test::SetForceOffsetSpan(offset_span);
+
+            Val64Test quotient{dividend};
+            Val64Test quotient_divisor{divisor};
+            BOOST_CHECK(Val64Test::OpDiv(quotient, quotient_divisor));
+            BOOST_CHECK(quotient.MoveToValtype() == expected_quotient);
+
+            Val64Test remainder{dividend};
+            Val64Test remainder_divisor{divisor};
+            BOOST_CHECK(Val64Test::OpMod(remainder, remainder_divisor));
+            BOOST_CHECK(remainder.MoveToValtype() == expected_remainder);
+        }
+    }
+
+    Val64Test::SetForcePortableMath(false);
+    Val64Test::SetForceOffsetSpan(false);
+}
+
+// Test edge cases for the portable 64-bit math implementation (used on Windows/MSVC).
+// These tests specifically target edge cases that could trigger overflow bugs in
+// the 128-bit arithmetic emulation.
+BOOST_AUTO_TEST_CASE(val64_portable_math_edge_cases)
+{
+    for (bool portable_math : {false, true}) {
+        Val64Test::SetForcePortableMath(portable_math);
+
+    // Test multiplication edge case: (2^64-1) * (2^64-1)
+    // This tests the MultiplySpan portable implementation
+    {
+        std::vector<unsigned char> max_u64(8, 0xFF);
+        Val64Test v64a(max_u64);
+        Val64Test v64b(max_u64);
+        Val64 ret = Val64::OpMul(v64a, v64b);
+        std::vector<unsigned char> retvec = ret.MoveToValtype();
+
+        // (2^64-1)^2 = 2^128 - 2^65 + 1
+        // In little-endian bytes: 0x01, 0x00, ..., 0x00, 0xFE, 0xFF, ..., 0xFF
+        std::vector<unsigned char> expected = {
+            0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  // low word
+            0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF   // high word
+        };
+        BOOST_CHECK(retvec == expected);
+    }
+
+    // Test division edge case that exercises the Knuth refinement loop
+    // We need a dividend and divisor that produce a large qstar estimate
+    // and where v2[n-2] is also large, triggering the cross overflow.
+    {
+        // Dividend: a large number with multiple 64-bit words
+        // 0xFFFFFFFFFFFFFFFF_FFFFFFFFFFFFFFFF (two words of all 1s)
+        std::vector<unsigned char> dividend(16, 0xFF);
+
+        // Divisor: 0x8000000000000001 (normalized, with second word considerations)
+        // This divisor has the top bit set (normalized) and will produce
+        // a quotient estimate that exercises the refinement.
+        std::vector<unsigned char> divisor = {
+            0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80
+        };
+
+        Val64Test v64a_div(dividend);
+        Val64Test v64b_div(divisor);
+        bool div_ret = Val64Test::OpDiv(v64a_div, v64b_div);
+        BOOST_CHECK(div_ret == true);
+
+        std::vector<unsigned char> div_vec = v64a_div.MoveToValtype();
+        std::vector<unsigned char> expected_div = {
+            0xFC, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01
+        };
+        BOOST_CHECK(div_vec == expected_div);
+    }
+
+    // Test another division edge case: dividend that produces qstar close to 2^64
+    {
+        std::vector<unsigned char> dividend = {
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
+        };
+        std::vector<unsigned char> divisor(8, 0xFF);
+
+        Val64Test v64a_div(dividend);
+        Val64Test v64b_div(divisor);
+        bool div_ret = Val64Test::OpDiv(v64a_div, v64b_div);
+        BOOST_CHECK(div_ret == true);
+
+        std::vector<unsigned char> div_vec = v64a_div.MoveToValtype();
+        std::vector<unsigned char> expected_div(8, 0xFF);
+        expected_div[0] = 0xFE;
+        BOOST_CHECK(div_vec == expected_div);
+    }
+
+    // Test mod with the same edge case
+    {
+        std::vector<unsigned char> dividend = {
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
+        };
+        std::vector<unsigned char> divisor(8, 0xFF);
+
+        Val64Test v64a_mod(dividend);
+        Val64Test v64b_mod(divisor);
+        bool mod_ret = Val64Test::OpMod(v64a_mod, v64b_mod);
+        BOOST_CHECK(mod_ret == true);
+
+        std::vector<unsigned char> mod_vec = v64a_mod.MoveToValtype();
+        std::vector<unsigned char> expected_mod = {
+            0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
+        };
+        BOOST_CHECK(mod_vec == expected_mod);
+    }
+
+    // Test case specifically designed to trigger cross overflow in Knuth refinement.
+    // We need: qstar close to 2^64 and v2[n-2] close to 2^64.
+    // This happens when the dividend's top two words form a value just under
+    // (divisor[n-1] * 2^64), and divisor[n-2] is large.
+    {
+        // Create a 3-word dividend and 2-word divisor to exercise the refinement.
+        // Dividend: 0x7FFFFFFFFFFFFFFF_FFFFFFFFFFFFFFFF_FFFFFFFFFFFFFFFF
+        std::vector<unsigned char> dividend = {
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x7F
+        };
+
+        // Divisor: 0x8000000000000000_FFFFFFFFFFFFFFFF
+        // This has a normalized high word and a large second word.
+        std::vector<unsigned char> divisor = {
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80
+        };
+
+        Val64Test v64a_div(dividend);
+        Val64Test v64b_div(divisor);
+        bool div_ret = Val64Test::OpDiv(v64a_div, v64b_div);
+        BOOST_CHECK(div_ret == true);
+
+        const cpp_int dividend_int = vector_to_cpp_int(dividend);
+        const cpp_int divisor_int = vector_to_cpp_int(divisor);
+        BOOST_CHECK(v64a_div.MoveToValtype() == cpp_int_to_vector(dividend_int / divisor_int));
+
+        Val64Test v64a_mod(dividend);
+        Val64Test v64b_mod(divisor);
+        bool mod_ret = Val64Test::OpMod(v64a_mod, v64b_mod);
+        BOOST_CHECK(mod_ret == true);
+        BOOST_CHECK(v64a_mod.MoveToValtype() == cpp_int_to_vector(dividend_int % divisor_int));
+    }
+
+    }
+
+    Val64Test::SetForcePortableMath(false);
+}
+
+BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/test/val64_semantics_tests.cpp b/src/test/val64_semantics_tests.cpp
new file mode 100644
index 000000000000..56c6cc31140c
--- /dev/null
+++ b/src/test/val64_semantics_tests.cpp
@@ -0,0 +1,263 @@
+// Copyright (c) 2026 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or https://opensource.org/license/mit/.
+
+#include <script/val64.h>
+#include <script/varops.h>
+#include <test/util/setup_common.h>
+
+#include <boost/test/unit_test.hpp>
+
+#include <cstdint>
+#include <utility>
+#include <vector>
+
+using valtype = std::vector<unsigned char>;
+
+static valtype Bytes(std::initializer_list<unsigned char> bytes)
+{
+    return valtype{bytes};
+}
+
+static Val64 ValFromBytes(const valtype& bytes)
+{
+    valtype copy{bytes};
+    return Val64{std::move(copy)};
+}
+
+static valtype Num(uint64_t value)
+{
+    Val64 num{value};
+    return num.MoveToValtype();
+}
+
+static valtype MoveOut(Val64& value)
+{
+    return value.MoveToValtype();
+}
+
+BOOST_FIXTURE_TEST_SUITE(val64_semantics_tests, BasicTestingSetup)
+
+BOOST_AUTO_TEST_CASE(unsigned_minimal_encoding)
+{
+    BOOST_CHECK(Num(0) == Bytes({}));
+    BOOST_CHECK(Num(1) == Bytes({0x01}));
+    BOOST_CHECK(Num(0xff) == Bytes({0xff}));
+    BOOST_CHECK(Num(0x100) == Bytes({0x00, 0x01}));
+    BOOST_CHECK(Num(0x8000000000000000ULL) == Bytes({0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80}));
+}
+
+BOOST_AUTO_TEST_CASE(length_conversion_reads_full_little_endian_value)
+{
+    uint64_t cost{0};
+
+    Val64 with_trailing_zeroes{ValFromBytes(Bytes({0xff, 0x00, 0x00}))};
+    BOOST_CHECK_EQUAL(with_trailing_zeroes.ToU64Ceil(300, cost), 255);
+    BOOST_CHECK_EQUAL(cost, varops::LengthConversionCost(3));
+
+    cost = 0;
+    Val64 capped_by_max{ValFromBytes(Bytes({0x05}))};
+    BOOST_CHECK_EQUAL(capped_by_max.ToU64Ceil(4, cost), 4);
+    BOOST_CHECK_EQUAL(cost, varops::LengthConversionCost(1));
+
+    cost = 0;
+    Val64 larger_than_u64{ValFromBytes(Bytes({0, 0, 0, 0, 0, 0, 0, 0, 1}))};
+    BOOST_CHECK_EQUAL(larger_than_u64.ToU64Ceil(1000, cost), 1000);
+    BOOST_CHECK_EQUAL(cost, varops::LengthConversionCost(9));
+
+    cost = 0;
+    Val64 padded_u64_max{ValFromBytes(Bytes({0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00}))};
+    BOOST_CHECK_EQUAL(padded_u64_max.ToU64Ceil(UINT64_MAX, cost), UINT64_MAX);
+    BOOST_CHECK_EQUAL(cost, varops::LengthConversionCost(9));
+}
+
+BOOST_AUTO_TEST_CASE(arithmetic_operations_normalize_results)
+{
+    uint64_t cost{0};
+
+    Val64 add_a{ValFromBytes(Bytes({0xff}))};
+    Val64 add_b{ValFromBytes(Bytes({0x01}))};
+    Val64::OpAdd(add_a, add_b, cost);
+    BOOST_CHECK(MoveOut(add_a) == Bytes({0x00, 0x01}));
+    BOOST_CHECK_EQUAL(cost, varops::AddCost(1, 1));
+
+    cost = 0;
+    Val64 add_with_zeroes{ValFromBytes(Bytes({0x01, 0x00, 0x00}))};
+    Val64 zero{ValFromBytes(Bytes({}))};
+    Val64::OpAdd(add_with_zeroes, zero, cost);
+    BOOST_CHECK(MoveOut(add_with_zeroes) == Bytes({0x01}));
+    BOOST_CHECK_EQUAL(cost, varops::AddCost(3, 0));
+
+    cost = 0;
+    Val64 sub_a{ValFromBytes(Bytes({0x00, 0x01}))};
+    Val64 sub_b{ValFromBytes(Bytes({0x01}))};
+    BOOST_CHECK(Val64::OpSub(sub_a, sub_b, cost));
+    BOOST_CHECK(MoveOut(sub_a) == Bytes({0xff}));
+    BOOST_CHECK_EQUAL(cost, varops::SubCost(2, 1));
+
+    cost = 0;
+    Val64 sub_to_zero{ValFromBytes(Bytes({0x01}))};
+    Val64 one{ValFromBytes(Bytes({0x01}))};
+    BOOST_CHECK(Val64::OpSub(sub_to_zero, one, cost));
+    BOOST_CHECK(MoveOut(sub_to_zero) == Bytes({}));
+
+    cost = 0;
+    Val64 underflow{ValFromBytes(Bytes({}))};
+    BOOST_CHECK(!Val64::Op1Sub(underflow, cost));
+    BOOST_CHECK_EQUAL(cost, varops::SubCost(0, 1));
+}
+
+BOOST_AUTO_TEST_CASE(one_add_and_one_sub_cross_word_boundaries)
+{
+    uint64_t cost{0};
+
+    Val64 carry_from_full_word{ValFromBytes(Bytes({0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}))};
+    Val64::Op1Add(carry_from_full_word, cost);
+    BOOST_CHECK(MoveOut(carry_from_full_word) == Bytes({0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01}));
+    BOOST_CHECK_EQUAL(cost, varops::AddCost(8, 1));
+
+    cost = 0;
+    Val64 borrow_from_next_word{ValFromBytes(Bytes({0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01}))};
+    BOOST_CHECK(Val64::Op1Sub(borrow_from_next_word, cost));
+    BOOST_CHECK(MoveOut(borrow_from_next_word) == Bytes({0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}));
+    BOOST_CHECK_EQUAL(cost, varops::SubCost(9, 1));
+}
+
+BOOST_AUTO_TEST_CASE(bit_operations_preserve_operand_width)
+{
+    uint64_t cost{0};
+
+    Val64 inverted{ValFromBytes(Bytes({0x00, 0xff}))};
+    Val64::OpInvert(inverted, cost);
+    BOOST_CHECK(MoveOut(inverted) == Bytes({0xff, 0x00}));
+    BOOST_CHECK_EQUAL(cost, varops::InvertCost(2));
+
+    cost = 0;
+    Val64 and_a{ValFromBytes(Bytes({0xff, 0xff}))};
+    Val64 and_b{ValFromBytes(Bytes({0x0f}))};
+    Val64::OpAnd(and_a, and_b, cost);
+    BOOST_CHECK(MoveOut(and_a) == Bytes({0x0f, 0x00}));
+    BOOST_CHECK_EQUAL(cost, varops::AndCost(2, 1));
+
+    cost = 0;
+    Val64 or_a{ValFromBytes(Bytes({0x00, 0x00}))};
+    Val64 or_b{ValFromBytes(Bytes({0x00}))};
+    Val64::OpOr(or_a, or_b, cost);
+    BOOST_CHECK(MoveOut(or_a) == Bytes({0x00, 0x00}));
+    BOOST_CHECK_EQUAL(cost, varops::OrCost(2, 1));
+
+    cost = 0;
+    Val64 xor_a{ValFromBytes(Bytes({0x01, 0x00}))};
+    Val64 xor_b{ValFromBytes(Bytes({0x01}))};
+    Val64::OpXor(xor_a, xor_b, cost);
+    BOOST_CHECK(MoveOut(xor_a) == Bytes({0x00, 0x00}));
+    BOOST_CHECK_EQUAL(cost, varops::XorCost(2, 1));
+}
+
+BOOST_AUTO_TEST_CASE(bitshift_operations_preserve_width)
+{
+    uint64_t cost{0};
+
+    Val64 upshift_one_bit{ValFromBytes(Bytes({0x01}))};
+    Val64 one_bit{ValFromBytes(Bytes({0x01}))};
+    BOOST_CHECK(Val64::OpUpShift(upshift_one_bit, one_bit, 10, cost));
+    BOOST_CHECK(MoveOut(upshift_one_bit) == Bytes({0x02, 0x00}));
+    BOOST_CHECK_EQUAL(cost, varops::LengthConversionCost(1) + 1 * varops::COST_COPYING + varops::UnalignedUpShiftCost(1, 0));
+
+    cost = 0;
+    Val64 upshift_one_byte{ValFromBytes(Bytes({0x01}))};
+    Val64 eight_bits{ValFromBytes(Bytes({0x08}))};
+    BOOST_CHECK(Val64::OpUpShift(upshift_one_byte, eight_bits, 10, cost));
+    BOOST_CHECK(MoveOut(upshift_one_byte) == Bytes({0x00, 0x01}));
+    BOOST_CHECK_EQUAL(cost, varops::LengthConversionCost(1) + 1 * varops::COST_FAST + 1 * varops::COST_COPYING);
+
+    cost = 0;
+    Val64 downshift_one_bit{ValFromBytes(Bytes({0x02, 0x00}))};
+    Val64 one_bit_down{ValFromBytes(Bytes({0x01}))};
+    Val64::OpDownShift(downshift_one_bit, one_bit_down, cost);
+    BOOST_CHECK(MoveOut(downshift_one_bit) == Bytes({0x01, 0x00}));
+    BOOST_CHECK_EQUAL(cost, varops::LengthConversionCost(1) + 2 * varops::COST_COPYING);
+
+    cost = 0;
+    Val64 downshift_past_end{ValFromBytes(Bytes({0xff}))};
+    Val64 many_bits{ValFromBytes(Bytes({0x08}))};
+    Val64::OpDownShift(downshift_past_end, many_bits, cost);
+    BOOST_CHECK(MoveOut(downshift_past_end) == Bytes({}));
+    BOOST_CHECK_EQUAL(cost, varops::LengthConversionCost(1));
+}
+
+BOOST_AUTO_TEST_CASE(multiply_divide_and_modulo_are_unsigned_and_normalized)
+{
+    Val64 mul_a{ValFromBytes(Bytes({0xff, 0xff}))};
+    Val64 mul_b{ValFromBytes(Bytes({0x02}))};
+    Val64 product{Val64::OpMul(mul_a, mul_b)};
+    BOOST_CHECK(MoveOut(product) == Bytes({0xfe, 0xff, 0x01}));
+
+    Val64 zero_a{ValFromBytes(Bytes({0x00, 0x00}))};
+    Val64 zero_b{ValFromBytes(Bytes({0x42}))};
+    Val64 zero_product{Val64::OpMul(zero_a, zero_b)};
+    BOOST_CHECK(MoveOut(zero_product) == Bytes({}));
+
+    Val64 div_a{ValFromBytes(Bytes({0x39, 0x30}))}; // 12345
+    Val64 div_b{ValFromBytes(Bytes({0x64}))};       // 100
+    BOOST_CHECK(Val64::OpDiv(div_a, div_b));
+    BOOST_CHECK(MoveOut(div_a) == Bytes({0x7b}));  // 123
+
+    Val64 mod_a{ValFromBytes(Bytes({0x39, 0x30}))};
+    Val64 mod_b{ValFromBytes(Bytes({0x64}))};
+    BOOST_CHECK(Val64::OpMod(mod_a, mod_b));
+    BOOST_CHECK(MoveOut(mod_a) == Bytes({0x2d}));  // 45
+
+    Val64 divide_by_zero_a{ValFromBytes(Bytes({0x01}))};
+    Val64 divide_by_zero_b{ValFromBytes(Bytes({0x00, 0x00}))};
+    BOOST_CHECK(!Val64::OpDiv(divide_by_zero_a, divide_by_zero_b));
+}
+
+BOOST_AUTO_TEST_CASE(numeric_comparison_treats_trailing_zeroes_as_equal)
+{
+    uint64_t cost{0};
+    Val64 one_minimal{ValFromBytes(Bytes({0x01}))};
+    Val64 one_wide{ValFromBytes(Bytes({0x01, 0x00, 0x00}))};
+    BOOST_CHECK_EQUAL(one_minimal.Compare(one_wide, cost), 0);
+    BOOST_CHECK_EQUAL(cost, varops::ComparisonCost(1, 3));
+
+    cost = 0;
+    Val64 high_bit{ValFromBytes(Bytes({0x00, 0x80}))};
+    Val64 smaller{ValFromBytes(Bytes({0xff, 0x7f}))};
+    BOOST_CHECK_EQUAL(high_bit.Compare(smaller, cost), 1);
+    BOOST_CHECK_EQUAL(cost, varops::ComparisonCost(2, 2));
+}
+
+BOOST_AUTO_TEST_CASE(min_and_max_normalize_equal_numeric_values)
+{
+    uint64_t cost{0};
+
+    Val64 min_a{ValFromBytes(Bytes({0x01, 0x00, 0x00}))};
+    Val64 min_b{ValFromBytes(Bytes({0x01}))};
+    Val64::OpMin(min_a, min_b, cost);
+    BOOST_CHECK(MoveOut(min_a) == Bytes({0x01}));
+    BOOST_CHECK_EQUAL(cost, varops::MinMaxCost(3, 1));
+
+    cost = 0;
+    Val64 max_a{ValFromBytes(Bytes({0x01, 0x00, 0x00}))};
+    Val64 max_b{ValFromBytes(Bytes({0x01}))};
+    Val64::OpMax(max_a, max_b, cost);
+    BOOST_CHECK(MoveOut(max_a) == Bytes({0x01}));
+    BOOST_CHECK_EQUAL(cost, varops::MinMaxCost(3, 1));
+
+    cost = 0;
+    Val64 min_selects_second{ValFromBytes(Bytes({0x05}))};
+    Val64 smaller_second{ValFromBytes(Bytes({0x03, 0x00}))};
+    Val64::OpMin(min_selects_second, smaller_second, cost);
+    BOOST_CHECK(MoveOut(min_selects_second) == Bytes({0x03}));
+    BOOST_CHECK_EQUAL(cost, varops::MinMaxCost(1, 2));
+
+    cost = 0;
+    Val64 max_selects_second{ValFromBytes(Bytes({0x03}))};
+    Val64 larger_second{ValFromBytes(Bytes({0x05, 0x00}))};
+    Val64::OpMax(max_selects_second, larger_second, cost);
+    BOOST_CHECK(MoveOut(max_selects_second) == Bytes({0x05}));
+    BOOST_CHECK_EQUAL(cost, varops::MinMaxCost(1, 2));
+}
+
+BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/test/valtype_stack_tests.cpp b/src/test/valtype_stack_tests.cpp
new file mode 100644
index 000000000000..64d35ce22ece
--- /dev/null
+++ b/src/test/valtype_stack_tests.cpp
@@ -0,0 +1,172 @@
+// Copyright (c) 2024-present The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <script/val64.h>
+#include <script/valtype_stack.h>
+#include <test/util/setup_common.h>
+
+#include <cstddef>
+#include <stdexcept>
+#include <utility>
+#include <vector>
+
+#include <boost/test/unit_test.hpp>
+
+static void CheckAccounting(const ValtypeStack& stack, size_t total_size, size_t max_element_size)
+{
+    BOOST_CHECK_EQUAL(stack.GetTotalSize(), total_size);
+    BOOST_CHECK_EQUAL(stack.GetMaxElementSize(), max_element_size);
+}
+
+BOOST_FIXTURE_TEST_SUITE(valtype_stack_tests, BasicTestingSetup)
+
+BOOST_AUTO_TEST_CASE(valtype_stack_mutation_accounting)
+{
+    ValtypeStack stack;
+    const valtype ten_bytes(10, 0x11);
+
+    stack.push_back(ten_bytes);
+    stack.push_back(valtype(20, 0x22));
+    stack.push_back(valtype(30, 0x33));
+    CheckAccounting(stack, 60, 30);
+
+    stack.erase(1);
+    CheckAccounting(stack, 40, 30);
+
+    const valtype popped{stack.PopBackValue()};
+    BOOST_CHECK(popped == valtype(30, 0x33));
+    CheckAccounting(stack, 10, 30);
+
+    stack.push_back(valtype(50, 0x44));
+    CheckAccounting(stack, 60, 50);
+    stack.pop_back();
+    CheckAccounting(stack, 10, 50);
+
+    stack.push_back(valtype{0x01, 0x02});
+    Val64 value;
+    BOOST_REQUIRE(stack.PopVal64(value));
+    BOOST_CHECK(value.MoveToValtype() == valtype({0x01, 0x02}));
+    CheckAccounting(stack, 10, 50);
+
+    stack.pop_back();
+    CheckAccounting(stack, 0, 50);
+}
+
+BOOST_AUTO_TEST_CASE(valtype_stack_const_copy_word_capacity)
+{
+    constexpr size_t WORD_BYTES{sizeof(uint64_t)};
+    for (size_t size : {size_t{0}, size_t{1}, size_t{7}, size_t{8}, size_t{9}, size_t{15}, size_t{16}}) {
+        const valtype original(size, 0x11);
+        const size_t expected_capacity{size + (WORD_BYTES - size % WORD_BYTES) % WORD_BYTES};
+        ValtypeStack stack;
+
+        stack.push_back(original);
+        BOOST_CHECK(stack.back() == original);
+        BOOST_CHECK_EQUAL(stack.back().size(), size);
+        BOOST_CHECK_GE(stack.back().capacity(), expected_capacity);
+        CheckAccounting(stack, size, size);
+
+        Val64 value;
+        BOOST_REQUIRE(stack.PopVal64(value));
+        BOOST_CHECK(value.MoveToValtype() == original);
+        CheckAccounting(stack, 0, size);
+    }
+}
+
+BOOST_AUTO_TEST_CASE(valtype_stack_erase_boundaries)
+{
+    ValtypeStack stack{std::vector<valtype>{
+        valtype(10, 0xaa),
+        valtype(20, 0xbb),
+        valtype(30, 0xcc),
+    }};
+    CheckAccounting(stack, 60, 30);
+
+    stack.erase(2);
+    CheckAccounting(stack, 30, 30);
+    stack.erase(0);
+    CheckAccounting(stack, 20, 30);
+    stack.erase(0);
+    CheckAccounting(stack, 0, 30);
+}
+
+BOOST_AUTO_TEST_CASE(valtype_stack_empty_elements_and_failures)
+{
+    ValtypeStack stack;
+    stack.push_back(valtype{});
+    CheckAccounting(stack, 0, 0);
+    stack.push_back(valtype(1, 0x42));
+    CheckAccounting(stack, 1, 1);
+    stack.push_back(valtype(50, 0x43));
+    CheckAccounting(stack, 51, 50);
+    stack.push_back(valtype{});
+    CheckAccounting(stack, 51, 50);
+
+    stack.erase(2);
+    CheckAccounting(stack, 1, 50);
+
+    ValtypeStack empty;
+    Val64 value;
+    BOOST_CHECK(!empty.PopVal64(value));
+    BOOST_CHECK_THROW(empty.pop_back(), std::runtime_error);
+    BOOST_CHECK_THROW(empty.PopBackValue(), std::runtime_error);
+}
+
+BOOST_AUTO_TEST_CASE(valtype_stack_move_preserves_accounting)
+{
+    const std::vector<valtype> elements{
+        valtype(25, 0x11),
+        valtype(75, 0x22),
+        valtype(125, 0x33),
+    };
+
+    ValtypeStack move_source{elements};
+    ValtypeStack moved{std::move(move_source)};
+    CheckAccounting(moved, 225, 125);
+    // NOLINTBEGIN(bugprone-use-after-move) -- moved-from stacks are specified to be empty and reusable.
+    BOOST_CHECK_EQUAL(move_source.size(), 0);
+    CheckAccounting(move_source, 0, 0);
+    move_source.push_back(valtype(10, 0x44));
+    CheckAccounting(move_source, 10, 10);
+    // NOLINTEND(bugprone-use-after-move)
+
+    ValtypeStack move_assign_source{elements};
+    ValtypeStack move_assigned{std::vector<valtype>{valtype(200, 0x44)}};
+    move_assigned = std::move(move_assign_source);
+    CheckAccounting(move_assigned, 225, 125);
+    // NOLINTBEGIN(bugprone-use-after-move) -- moved-from stacks are specified to be empty and reusable.
+    BOOST_CHECK_EQUAL(move_assign_source.size(), 0);
+    CheckAccounting(move_assign_source, 0, 0);
+    move_assign_source.push_back(valtype(10, 0x55));
+    CheckAccounting(move_assign_source, 10, 10);
+    // NOLINTEND(bugprone-use-after-move)
+}
+
+BOOST_AUTO_TEST_CASE(valtype_stack_reordering_preserves_accounting)
+{
+    const std::vector<valtype> elements{
+        valtype(1, 0x11),
+        valtype(2, 0x22),
+        valtype(3, 0x33),
+    };
+    const std::vector<valtype> rotated{elements[1], elements[2], elements[0]};
+    const std::vector<valtype> swapped{elements[2], elements[1], elements[0]};
+
+    ValtypeStack rotate_stack{elements};
+    rotate_stack.Rotate(-3, -2);
+    BOOST_CHECK(rotate_stack.GetStack() == rotated);
+    CheckAccounting(rotate_stack, 6, 3);
+
+    ValtypeStack roll_stack{elements};
+    roll_stack.Roll(2);
+    BOOST_CHECK(roll_stack.GetStack() == rotated);
+    CheckAccounting(roll_stack, 6, 3);
+
+    ValtypeStack swap_stack{elements};
+    swap_stack.Swap(-3, -1);
+    BOOST_CHECK(swap_stack.GetStack() == swapped);
+    CheckAccounting(swap_stack, 6, 3);
+}
+
+BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/test/varops_tests.cpp b/src/test/varops_tests.cpp
new file mode 100644
index 000000000000..2a6dc94af2a6
--- /dev/null
+++ b/src/test/varops_tests.cpp
@@ -0,0 +1,181 @@
+// Copyright (c) 2026 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or https://opensource.org/license/mit/.
+
+#include <script/varops.h>
+
+#include <boost/test/unit_test.hpp>
+
+#include <atomic>
+#include <cstddef>
+#include <cstdint>
+#include <limits>
+#include <thread>
+#include <type_traits>
+#include <utility>
+#include <vector>
+
+BOOST_AUTO_TEST_SUITE(varops_tests)
+
+BOOST_AUTO_TEST_CASE(bip440_cost_constants)
+{
+    BOOST_CHECK_EQUAL(varops::BUDGET_PER_WEIGHT_UNIT, 10'000);
+    BOOST_CHECK_EQUAL(varops::TxBudget(4), 40'000);
+    BOOST_CHECK_EQUAL(varops::COST_PER_SIGOP, 500'000);
+    BOOST_CHECK_EQUAL(varops::COST_HASH, 50);
+    BOOST_CHECK_EQUAL(varops::COST_ROLL, 48);
+    BOOST_CHECK_EQUAL(varops::COST_FAST, 2);
+    BOOST_CHECK_EQUAL(varops::COST_COPYING, 3);
+    BOOST_CHECK_EQUAL(varops::COST_OTHER, 4);
+    BOOST_CHECK_EQUAL(varops::COST_ARITH, 6);
+    BOOST_CHECK_EQUAL(varops::COST_MUL_QUAD, 27);
+}
+
+static uint64_t ExpectedMulCost(size_t size_a, size_t size_b)
+{
+    const uint64_t a{static_cast<uint64_t>(size_a)};
+    const uint64_t b{static_cast<uint64_t>(size_b)};
+    const uint64_t wa{(a + 7) / 8 * 8};
+    const uint64_t wb{(b + 7) / 8 * 8};
+    return (a + b) * 3 + wa / 8 * wb * 27;
+}
+
+static uint64_t ExpectedDivModCost(size_t size_a, size_t size_b)
+{
+    const uint64_t a{(static_cast<uint64_t>(size_a) + 7) / 8 * 8};
+    const uint64_t b{(static_cast<uint64_t>(size_b) + 7) / 8 * 8};
+    return a * 18 + b * 4 + a * a * 2 / 3;
+}
+
+BOOST_AUTO_TEST_CASE(bip441_multiply_and_divide_costs_are_64_bit)
+{
+    static_assert(std::is_same_v<decltype(varops::MulCost(size_t{0}, size_t{0})), uint64_t>);
+
+    BOOST_CHECK_EQUAL(varops::detail::WordSize(0), 0);
+    BOOST_CHECK_EQUAL(varops::detail::WordSize(1), 8);
+    BOOST_CHECK_EQUAL(varops::detail::WordSize(8), 8);
+    BOOST_CHECK_EQUAL(varops::detail::WordSize(9), 16);
+
+    for (const auto& [size_a, size_b] : {
+             std::pair<size_t, size_t>{0, 0},
+             std::pair<size_t, size_t>{1, 1},
+             std::pair<size_t, size_t>{7, 1},
+             std::pair<size_t, size_t>{8, 8},
+             std::pair<size_t, size_t>{9, 9},
+             std::pair<size_t, size_t>{4'000'000, 4'000'000},
+         }) {
+        BOOST_TEST_CONTEXT("sizes " << size_a << ", " << size_b)
+        {
+            BOOST_CHECK_EQUAL(varops::MulCost(size_a, size_b), ExpectedMulCost(size_a, size_b));
+            BOOST_CHECK_EQUAL(varops::DivCost(size_a, size_b), ExpectedDivModCost(size_a, size_b));
+            BOOST_CHECK_EQUAL(varops::ModCost(size_a, size_b), ExpectedDivModCost(size_a, size_b));
+        }
+    }
+
+    BOOST_CHECK_GT(varops::MulCost(4'000'000, 4'000'000), uint64_t{std::numeric_limits<uint32_t>::max()});
+    BOOST_CHECK_GT(varops::DivCost(4'000'000, 4'000'000), uint64_t{std::numeric_limits<uint32_t>::max()});
+}
+
+BOOST_AUTO_TEST_CASE(bip440_and_bip441_word_granular_cost_helpers)
+{
+    BOOST_CHECK_EQUAL(varops::LengthConversionCost(1), 8 * varops::COST_FAST);
+    BOOST_CHECK_EQUAL(varops::LengthConversionCost(8), 8 * varops::COST_FAST);
+    BOOST_CHECK_EQUAL(varops::LengthConversionCost(9), 16 * varops::COST_FAST);
+
+    BOOST_CHECK_EQUAL(varops::CompareZeroCost(3), 8 * varops::COST_FAST);
+    BOOST_CHECK_EQUAL(varops::ComparisonCost(1, 9), 16 * varops::COST_FAST);
+    BOOST_CHECK_EQUAL(varops::BoolAndCost(1, 9), (8 + 16) * varops::COST_FAST);
+    BOOST_CHECK_EQUAL(varops::BoolOrCost(9, 1), (16 + 8) * varops::COST_FAST);
+    BOOST_CHECK_EQUAL(varops::WithinCost(1, 9, 17), (16 + 24) * varops::COST_FAST);
+
+    BOOST_CHECK_EQUAL(varops::AddCost(1, 9), 16 * (varops::COST_ARITH + varops::COST_COPYING));
+    BOOST_CHECK_EQUAL(varops::SubCost(9, 1), 16 * varops::COST_ARITH);
+    BOOST_CHECK_EQUAL(varops::MinMaxCost(1, 9), 16 * varops::COST_OTHER);
+
+    BOOST_CHECK_EQUAL(varops::InvertCost(9), 16 * varops::COST_OTHER);
+    BOOST_CHECK_EQUAL(varops::AndCost(1, 9), (8 + 16) * varops::COST_FAST);
+    BOOST_CHECK_EQUAL(varops::OrCost(1, 9), 8 * varops::COST_OTHER);
+    BOOST_CHECK_EQUAL(varops::XorCost(9, 1), 8 * varops::COST_OTHER);
+
+    BOOST_CHECK_EQUAL(varops::TwoMulCost(9), 16 * (varops::COST_COPYING + varops::COST_OTHER));
+    BOOST_CHECK_EQUAL(varops::TwoDivCost(9), 16 * varops::COST_OTHER);
+    BOOST_CHECK_EQUAL(varops::UnalignedUpShiftCost(9, 0), 16 * varops::COST_OTHER);
+    BOOST_CHECK_EQUAL(varops::UnalignedUpShiftCost(1, 9), 16 * varops::COST_OTHER);
+    BOOST_CHECK_EQUAL(varops::ChecksigAddIncrementCost(0), 8 * (varops::COST_ARITH + varops::COST_COPYING));
+    BOOST_CHECK_EQUAL(varops::ChecksigAddIncrementCost(9), 16 * (varops::COST_ARITH + varops::COST_COPYING));
+}
+
+BOOST_AUTO_TEST_CASE(budget_does_not_overspend)
+{
+    varops::Budget budget{10};
+
+    BOOST_CHECK(budget.Spend(0));
+    BOOST_CHECK_EQUAL(*budget.Remaining(), 10);
+
+    BOOST_CHECK(budget.Spend(4));
+    BOOST_CHECK_EQUAL(*budget.Remaining(), 6);
+
+    BOOST_CHECK(!budget.Spend(7));
+    BOOST_CHECK_EQUAL(*budget.Remaining(), 6);
+
+    BOOST_CHECK(budget.Spend(6));
+    BOOST_CHECK_EQUAL(*budget.Remaining(), 0);
+
+    BOOST_CHECK(!budget.Spend(1));
+    BOOST_CHECK_EQUAL(*budget.Remaining(), 0);
+
+    BOOST_CHECK(budget.Spend(0));
+    BOOST_CHECK_EQUAL(*budget.Remaining(), 0);
+}
+
+BOOST_AUTO_TEST_CASE(budget_can_be_unmetered)
+{
+    auto budget{varops::Budget::Unmetered()};
+
+    BOOST_CHECK(!budget.Remaining());
+    BOOST_CHECK(budget.Spend(std::numeric_limits<uint64_t>::max()));
+    BOOST_CHECK(!budget.Remaining());
+}
+
+BOOST_AUTO_TEST_CASE(budget_is_transaction_wide_and_thread_safe)
+{
+    static constexpr int thread_count{32};
+    static constexpr int spends_per_thread{4096};
+    static constexpr uint64_t budget_amount{thread_count * spends_per_thread / 2};
+
+    varops::Budget budget{budget_amount};
+    std::atomic<uint64_t> successful_spends{0};
+    std::atomic<int> ready_threads{0};
+    std::atomic<bool> start{false};
+    std::vector<std::thread> threads;
+
+    threads.reserve(thread_count);
+    for (int i{0}; i < thread_count; ++i) {
+        threads.emplace_back([&] {
+            ready_threads.fetch_add(1, std::memory_order_acq_rel);
+            while (!start.load(std::memory_order_acquire)) {
+                std::this_thread::yield();
+            }
+
+            for (int spend{0}; spend < spends_per_thread; ++spend) {
+                if (budget.Spend(1)) {
+                    successful_spends.fetch_add(1, std::memory_order_relaxed);
+                }
+            }
+        });
+    }
+
+    while (ready_threads.load(std::memory_order_acquire) != thread_count) {
+        std::this_thread::yield();
+    }
+    start.store(true, std::memory_order_release);
+
+    for (std::thread& thread : threads) {
+        thread.join();
+    }
+
+    BOOST_CHECK_EQUAL(successful_spends.load(std::memory_order_relaxed), budget_amount);
+    BOOST_CHECK(!budget.Spend(1));
+}
+
+BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/validation.cpp b/src/validation.cpp
index d631eb04ef05..904e63d77596 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -44,6 +44,7 @@
 #include <random.h>
 #include <script/script.h>
 #include <script/sigcache.h>
+#include <script/varops.h>
 #include <signet.h>
 #include <tinyformat.h>
 #include <txdb.h>
@@ -2134,7 +2135,9 @@ std::optional<std::pair<ScriptError, std::string>> CScriptCheck::operator()() {
     const CScript &scriptSig = ptxTo->vin[nIn].scriptSig;
     const CScriptWitness *witness = &ptxTo->vin[nIn].scriptWitness;
     ScriptError error{SCRIPT_ERR_UNKNOWN_ERROR};
-    if (VerifyScript(scriptSig, m_tx_out.scriptPubKey, witness, m_flags, CachingTransactionSignatureChecker(ptxTo, nIn, m_tx_out.nValue, cacheStore, *m_signature_cache, *txdata), &error)) {
+    if (VerifyScript(scriptSig, m_tx_out.scriptPubKey, witness, m_flags,
+                     CachingTransactionSignatureChecker(ptxTo, nIn, m_tx_out.nValue, cacheStore, *m_signature_cache, *txdata),
+                     &error, *m_varops_budget)) {
         return std::nullopt;
     } else {
         auto debug_str = strprintf("input %i of %s (wtxid %s), spending %s:%i", nIn, ptxTo->GetHash().ToString(), ptxTo->GetWitnessHash().ToString(), ptxTo->vin[nIn].prevout.hash.ToString(), ptxTo->vin[nIn].prevout.n);
@@ -2219,6 +2222,8 @@ bool CheckInputScripts(const CTransaction& tx, TxValidationState& state,
     }
     assert(txdata.m_spent_outputs.size() == tx.vin.size());
 
+    auto varops_budget{std::make_shared<varops::Budget>(varops::TxBudget(GetTransactionWeight(tx)))};
+
     for (unsigned int i = 0; i < tx.vin.size(); i++) {
 
         // We very carefully only pass in things to CScriptCheck which
@@ -2228,7 +2233,8 @@ bool CheckInputScripts(const CTransaction& tx, TxValidationState& state,
         // spent being checked as a part of CScriptCheck.
 
         // Verify signature
-        CScriptCheck check(txdata.m_spent_outputs[i], tx, validation_cache.m_signature_cache, i, flags, cacheSigStore, &txdata);
+        CScriptCheck check(txdata.m_spent_outputs[i], tx, validation_cache.m_signature_cache, i,
+                           flags, cacheSigStore, &txdata, varops_budget);
         if (pvChecks) {
             pvChecks->emplace_back(std::move(check));
         } else if (auto result = check(); result.has_value()) {
diff --git a/src/validation.h b/src/validation.h
index e04d340660f5..ba109ebbb21e 100644
--- a/src/validation.h
+++ b/src/validation.h
@@ -64,6 +64,9 @@ struct Params;
 namespace util {
 class SignalInterrupt;
 } // namespace util
+namespace varops {
+class Budget;
+} // namespace varops
 
 /** Block files containing a block-height within MIN_BLOCKS_TO_KEEP of ActiveChain().Tip() will not be pruned. */
 static const unsigned int MIN_BLOCKS_TO_KEEP = 288;
@@ -338,10 +341,16 @@ class CScriptCheck
     bool cacheStore;
     PrecomputedTransactionData *txdata;
     SignatureCache* m_signature_cache;
+    std::shared_ptr<varops::Budget> m_varops_budget;
 
 public:
-    CScriptCheck(const CTxOut& outIn, const CTransaction& txToIn, SignatureCache& signature_cache, unsigned int nInIn, script_verify_flags flags, bool cacheIn, PrecomputedTransactionData* txdataIn) :
-        m_tx_out(outIn), ptxTo(&txToIn), nIn(nInIn), m_flags(flags), cacheStore(cacheIn), txdata(txdataIn), m_signature_cache(&signature_cache) { }
+    CScriptCheck(const CTxOut& outIn, const CTransaction& txToIn, SignatureCache& signature_cache, unsigned int nInIn, script_verify_flags flags,
+                 bool cacheIn, PrecomputedTransactionData* txdataIn, std::shared_ptr<varops::Budget> varops_budget)
+        : m_tx_out(outIn), ptxTo(&txToIn), nIn(nInIn), m_flags(flags), cacheStore(cacheIn), txdata(txdataIn), m_signature_cache(&signature_cache),
+          m_varops_budget(std::move(varops_budget))
+    {
+        Assert(m_varops_budget);
+    }
 
     CScriptCheck(const CScriptCheck&) = delete;
     CScriptCheck& operator=(const CScriptCheck&) = delete;
diff --git a/src/wallet/feebumper.h b/src/wallet/feebumper.h
index d3d43861efcb..d27fc09c9a76 100644
--- a/src/wallet/feebumper.h
+++ b/src/wallet/feebumper.h
@@ -92,6 +92,7 @@ struct SignatureWeights
             break;
         case SigVersion::TAPROOT:
         case SigVersion::TAPSCRIPT:
+        case SigVersion::TAPSCRIPT_V2:
             assert(false);
         }
     }
diff --git a/src/wallet/wallet.cpp b/src/wallet/wallet.cpp
index 45adda65ead9..cc66fae24023 100644
--- a/src/wallet/wallet.cpp
+++ b/src/wallet/wallet.cpp
@@ -2291,11 +2291,9 @@ std::optional<PSBTError> CWallet::FillPSBT(PartiallySignedTransaction& psbtx, bo
 
     RemoveUnnecessaryTransactions(psbtx, sighash_type);
 
-    // Complete if every input is now signed
-    complete = true;
-    for (size_t i = 0; i < psbtx.inputs.size(); ++i) {
-        complete &= PSBTInputSignedAndVerified(psbtx, i, &txdata);
-    }
+    // Complete if every input is now signed and the transaction-wide varops
+    // budget covers the finalized witnesses.
+    complete = PSBTInputsSignedAndVerified(psbtx, txdata);
 
     return {};
 }
diff --git a/test/functional/feature_signet.py b/test/functional/feature_signet.py
index 02e37f0fdd3c..d30ba628c37e 100755
--- a/test/functional/feature_signet.py
+++ b/test/functional/feature_signet.py
@@ -61,7 +61,23 @@ def setup_network(self):
         self.connect_nodes(2, 3)
         self.connect_nodes(4, 5)
 
+    def check_script_restoration_deployment(self):
+        for node_idx in (0, 2, 4):
+            deployment = self.nodes[node_idx].getdeploymentinfo()["deployments"]["script_restoration"]
+            assert_equal(deployment["type"], "heretical")
+            assert_equal(deployment["active"], False)
+
+            heretical = deployment["heretical"]
+            assert_equal(heretical["binana-id"], "BIN-2026-0441-000")
+            assert_equal(heretical["start_time"], 1767225600)
+            assert_equal(heretical["timeout"], 2082758400)
+            assert_equal(heretical["period"], 432)
+            assert_equal(heretical["status"], "defined")
+
     def run_test(self):
+        self.log.info("SCRIPT_RESTORATION signet deployment parameters")
+        self.check_script_restoration_deployment()
+
         self.log.info("basic tests using OP_TRUE challenge")
 
         self.log.info('getblockchaininfo')
diff --git a/test/functional/feature_taproot.py b/test/functional/feature_taproot.py
index bd103aad09f4..3c1072e6737e 100755
--- a/test/functional/feature_taproot.py
+++ b/test/functional/feature_taproot.py
@@ -34,6 +34,7 @@
     CScriptOp,
     hash256,
     LEAF_VERSION_TAPSCRIPT,
+    LEAF_VERSION_TAPSCRIPT_V2,
     LegacySignatureMsg,
     LOCKTIME_THRESHOLD,
     MAX_SCRIPT_ELEMENT_SIZE,
@@ -1221,8 +1222,8 @@ def predict_sigops_ratio(n, dummy_size):
 
     # Future leaf versions
     for leafver in range(0, 0x100, 2):
-        if leafver == LEAF_VERSION_TAPSCRIPT or leafver == ANNEX_TAG:
-            # Skip the defined LEAF_VERSION_TAPSCRIPT, and the ANNEX_TAG which is not usable as leaf version
+        if leafver in (LEAF_VERSION_TAPSCRIPT, LEAF_VERSION_TAPSCRIPT_V2, ANNEX_TAG):
+            # Skip defined leaf versions and ANNEX_TAG, which is not usable as a leaf version.
             continue
         scripts = [
             ("bare_c0", CScript([OP_NOP])),
@@ -1397,7 +1398,7 @@ def spenders_taproot_nonstandard():
     sec = generate_privkey()
     pub, _ = compute_xonly_pubkey(sec)
     scripts = [
-        ("future_leaf", CScript([pub, OP_CHECKSIG]), 0xc2),
+        ("future_leaf", CScript([pub, OP_CHECKSIG]), 0xc4),
         ("op_success", CScript([pub, OP_CHECKSIG, OP_0, OP_IF, CScriptOp(0x50), OP_ENDIF])),
     ]
     tap = taproot_construct(pub, scripts)
diff --git a/test/functional/feature_tapscript_v2.py b/test/functional/feature_tapscript_v2.py
new file mode 100755
index 000000000000..7805b6e11738
--- /dev/null
+++ b/test/functional/feature_tapscript_v2.py
@@ -0,0 +1,1244 @@
+#!/usr/bin/env python3
+# Copyright (c) 2026 The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+"""Test Tapscript v2 leaf version 0xc2 behavior."""
+
+import hashlib
+import random
+
+from feature_taproot import (
+    ERR_EQUALVERIFY,
+    ERR_EVAL_FALSE,
+    ERR_MINIMALIF,
+    ERR_OP_RETURN,
+    ERR_PUSH_LIMIT,
+    ERR_SIG_SCHNORR,
+    ERR_STACK_EMPTY,
+    ERR_STACK_SIZE,
+    ERR_WITNESS_PROGRAM_MISMATCH,
+    SINGLE_SIG,
+    TaprootTest,
+    add_spender,
+    bitflipper,
+    default_controlblock,
+    default_sighash,
+    getter,
+    make_spender,
+)
+
+from test_framework.blocktools import (
+    COINBASE_MATURITY,
+    MAX_BLOCK_SIGOPS_WEIGHT,
+    MAX_STANDARD_TX_WEIGHT,
+    create_block,
+)
+from test_framework.key import compute_xonly_pubkey, generate_privkey, sign_schnorr
+from test_framework.messages import (
+    COIN,
+    COutPoint,
+    CTransaction,
+    CTxIn,
+    CTxInWitness,
+    CTxOut,
+    MAX_BLOCK_WEIGHT,
+    SEQUENCE_FINAL,
+    tx_from_hex,
+)
+from test_framework.psbt import (
+    PSBT,
+    PSBTMap,
+    PSBT_GLOBAL_UNSIGNED_TX,
+    PSBT_IN_FINAL_SCRIPTWITNESS,
+    PSBT_IN_WITNESS_UTXO,
+)
+from test_framework.segwit_addr import encode_segwit_address
+from test_framework.script import (
+    CScript,
+    KEY_VERSION_ANYPREVOUT,
+    KEY_VERSION_TAPROOT,
+    LEAF_VERSION_TAPSCRIPT,
+    LEAF_VERSION_TAPSCRIPT_V2,
+    MAX_SCRIPT_ELEMENT_SIZE,
+    OP_0,
+    OP_1,
+    OP_1NEGATE,
+    OP_CAT,
+    OP_CHECKLOCKTIMEVERIFY,
+    OP_CHECKSEQUENCEVERIFY,
+    OP_CHECKSIG,
+    OP_CHECKSIGADD,
+    OP_CHECKSIGFROMSTACK,
+    OP_DEPTH,
+    OP_DROP,
+    OP_ENDIF,
+    OP_EQUAL,
+    OP_EQUALVERIFY,
+    OP_FROMALTSTACK,
+    OP_IF,
+    OP_INTERNALKEY,
+    OP_LSHIFT,
+    OP_MUL,
+    OP_PICK,
+    OP_PUSHDATA1,
+    OP_RETURN,
+    OP_RSHIFT,
+    OP_SHA1,
+    OP_SHA256,
+    OP_SIZE,
+    OP_TOALTSTACK,
+    SIGHASH_ALL,
+    SIGHASH_ANYPREVOUT,
+    SIGHASH_DEFAULT,
+    TaprootSignatureHash,
+    taproot_construct,
+)
+from test_framework.util import assert_equal, assert_greater_than, assert_raises_rpc_error
+
+
+ERR_LOCKTIME = {"err_msg": "Locktime requirement not satisfied"}
+ERR_VAROP_COUNT = {"err_msg": "Varops budget exceeded"}
+ERR_TOTAL_STACK_SIZE = {"err_msg": "Total stack size limit exceeded"}
+ERR_STACK_ELEMENT_SIZE = {"err_msg": "Stack element size limit exceeded"}
+ERR_HASH_OPERAND_SIZE = {"err_msg": "OP_RIPEMD160 or OP_SHA1 operand exceeds maximum permitted size"}
+
+MAX_TAPSCRIPT_V2_STACK_SIZE = 32_768
+MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE = 4_000_000
+MAX_TAPSCRIPT_V2_TOTAL_STACK_SIZE = 8_000_000
+
+VAROPS_BUDGET_PER_WEIGHT = 10_000
+VAROPS_COST_FAST = 2
+VAROPS_COST_COPYING = 3
+VAROPS_COST_MUL_QUAD = 27
+
+
+def v2_num(value):
+    """Return the minimal unsigned little-endian encoding used by Tapscript v2."""
+    assert value >= 0
+    if value == 0:
+        return b""
+    return value.to_bytes((value.bit_length() + 7) // 8, "little")
+
+
+def word_size(size):
+    return ((size + 7) // 8) * 8
+
+
+def mul_cost(size_a, size_b):
+    return (
+        (size_a + size_b) * VAROPS_COST_COPYING
+        + (word_size(size_a) // 8) * word_size(size_b) * VAROPS_COST_MUL_QUAD
+    )
+
+
+def lengthconv_cost(size):
+    return word_size(size) * VAROPS_COST_FAST
+
+
+def comparingzero_cost(size):
+    return word_size(size) * VAROPS_COST_FAST
+
+
+def upshift_cost(value_size, bits):
+    return (
+        lengthconv_cost(len(v2_num(bits)))
+        + (bits // 8) * VAROPS_COST_FAST
+        + value_size * VAROPS_COST_COPYING
+    )
+
+
+def flip_leaf_version(ctx):
+    control = bytearray(default_controlblock(ctx))
+    control[0] ^= 0x02
+    return bytes(control)
+
+
+def drop_all_then_true(count):
+    return CScript([OP_DROP] * count + [OP_1])
+
+
+def repeated_nonempty_unknown_pubkey_checksig_script(pubkey, checks):
+    script = []
+    unknown_pubkey = b"\x02" + pubkey
+    for _ in range(checks):
+        script += [b"\x01", unknown_pubkey, OP_CHECKSIG, OP_DROP]
+    script += [OP_1]
+    return CScript(script)
+
+
+def tapscript_v2_spenders():
+    secs = [generate_privkey() for _ in range(12)]
+    pubs = [compute_xonly_pubkey(sec)[0] for sec in secs]
+    spenders = []
+
+    # Leaf version 0xc2 is committed to the tapleaf hash and the script-path
+    # sighash. Both control-block and signature mismatches must fail.
+    sig_script = CScript([pubs[1], OP_CHECKSIG])
+    tap = taproot_construct(pubs[0], [("sig_v2", sig_script, LEAF_VERSION_TAPSCRIPT_V2)])
+    add_spender(
+        spenders,
+        "v2/leafversion_sighash",
+        tap=tap,
+        leaf="sig_v2",
+        key=secs[1],
+        **SINGLE_SIG,
+        failure={"sighash": bitflipper(default_sighash)},
+        **ERR_SIG_SCHNORR,
+    )
+    add_spender(
+        spenders,
+        "v2/leafversion_controlblock",
+        tap=tap,
+        leaf="sig_v2",
+        key=secs[1],
+        **SINGLE_SIG,
+        failure={"controlblock": flip_leaf_version},
+        **ERR_WITNESS_PROGRAM_MISMATCH,
+    )
+
+    # Initial witness elements can exceed 520 bytes in v2, but the same leaf
+    # body under 0xc0 still uses the BIP342 element limit.
+    big_item = b"a" * (MAX_SCRIPT_ELEMENT_SIZE + 80)
+    big_item_script = CScript([OP_SIZE, v2_num(len(big_item)), OP_EQUALVERIFY, OP_DROP, OP_1])
+    tap = taproot_construct(pubs[0], [
+        ("big_item_v2", big_item_script, LEAF_VERSION_TAPSCRIPT_V2),
+        ("big_item_c0", big_item_script, LEAF_VERSION_TAPSCRIPT),
+    ])
+    add_spender(
+        spenders,
+        "v2/witness_item_over_520",
+        tap=tap,
+        leaf="big_item_v2",
+        inputs=[big_item],
+        failure={"leaf": "big_item_c0"},
+        **ERR_PUSH_LIMIT,
+    )
+
+    # Tapscript v2 final success is unsigned/non-zero-byte based. A single
+    # 0x80 byte is false under CastToBool() in 0xc0, but true in 0xc2.
+    negzero_script = CScript([b"\x80"])
+    tap = taproot_construct(pubs[0], [
+        ("negzero_v2", negzero_script, LEAF_VERSION_TAPSCRIPT_V2),
+        ("negzero_c0", negzero_script, LEAF_VERSION_TAPSCRIPT),
+    ])
+    add_spender(
+        spenders,
+        "v2/final_success_unsigned",
+        tap=tap,
+        leaf="negzero_v2",
+        failure={"leaf": "negzero_c0"},
+        **ERR_EVAL_FALSE,
+    )
+
+    # OP_1NEGATE is OP_SUCCESSx in v2 and bypasses later failing opcodes.
+    tap = taproot_construct(pubs[0], [
+        ("1negate_success", CScript([OP_1NEGATE, OP_RETURN]), LEAF_VERSION_TAPSCRIPT_V2),
+        ("return", CScript([OP_RETURN]), LEAF_VERSION_TAPSCRIPT_V2),
+    ])
+    add_spender(
+        spenders,
+        "v2/opsuccess_1negate",
+        tap=tap,
+        leaf="1negate_success",
+        failure={"leaf": "return"},
+        standard=False,
+        **ERR_OP_RETURN,
+    )
+
+    # OP_SUCCESSx is detected before execution, including in unexecuted branches.
+    tap = taproot_construct(pubs[0], [
+        ("unexecuted_success", CScript([OP_0, OP_IF, OP_1NEGATE, OP_ENDIF, OP_RETURN]), LEAF_VERSION_TAPSCRIPT_V2),
+        ("return", CScript([OP_RETURN]), LEAF_VERSION_TAPSCRIPT_V2),
+    ])
+    add_spender(
+        spenders,
+        "v2/opsuccess_unexecuted_branch",
+        tap=tap,
+        leaf="unexecuted_success",
+        failure={"leaf": "return"},
+        standard=False,
+        **ERR_OP_RETURN,
+    )
+
+    # OP_SUCCESSx bypasses initial stack-count enforcement.
+    tap = taproot_construct(pubs[0], [("success_overstack", CScript([OP_1NEGATE]), LEAF_VERSION_TAPSCRIPT_V2)])
+    add_spender(
+        spenders,
+        "v2/opsuccess_bypasses_initial_stack_count",
+        tap=tap,
+        leaf="success_overstack",
+        inputs=[b""] * (MAX_TAPSCRIPT_V2_STACK_SIZE + 1),
+        standard=False,
+    )
+
+    # Non-OP_SUCCESS v2 scripts enforce the 32,768 initial stack-element limit.
+    tap = taproot_construct(pubs[0], [("drop16", drop_all_then_true(16), LEAF_VERSION_TAPSCRIPT_V2)])
+    add_spender(
+        spenders,
+        "v2/initial_stack_count_limit",
+        tap=tap,
+        leaf="drop16",
+        inputs=[b""] * 16,
+        failure={"inputs": [b""] * (MAX_TAPSCRIPT_V2_STACK_SIZE + 1)},
+        **ERR_STACK_SIZE,
+    )
+
+    # The exact 32,768-element initial stack is valid, but the combined
+    # stack+altstack count is enforced after each executed opcode.
+    tap = taproot_construct(pubs[0], [
+        ("exact_count_ok", drop_all_then_true(MAX_TAPSCRIPT_V2_STACK_SIZE), LEAF_VERSION_TAPSCRIPT_V2),
+        ("altstack_count_fail", CScript([OP_TOALTSTACK, OP_1]), LEAF_VERSION_TAPSCRIPT_V2),
+    ])
+    add_spender(
+        spenders,
+        "v2/initial_stack_exact_limit_and_altstack_count",
+        tap=tap,
+        leaf="exact_count_ok",
+        inputs=[b""] * MAX_TAPSCRIPT_V2_STACK_SIZE,
+        failure={"leaf": "altstack_count_fail"},
+        **ERR_STACK_SIZE,
+    )
+
+    # OP_DEPTH writes minimal unsigned values in v2.
+    depth_count = 130
+    depth_script = CScript([OP_DEPTH, v2_num(depth_count), OP_EQUALVERIFY] + [OP_DROP] * depth_count + [OP_1])
+    tap = taproot_construct(pubs[0], [
+        ("depth_v2", depth_script, LEAF_VERSION_TAPSCRIPT_V2),
+        ("depth_c0", depth_script, LEAF_VERSION_TAPSCRIPT),
+    ])
+    add_spender(
+        spenders,
+        "v2/depth_unsigned_minimal",
+        tap=tap,
+        leaf="depth_v2",
+        inputs=[b""] * depth_count,
+        failure={"leaf": "depth_c0"},
+        **ERR_EQUALVERIFY,
+    )
+
+    # OP_CAT is restored under 0xc2 and can produce elements over 520 bytes.
+    cat_a = b"x" * 400
+    cat_b = b"y" * 180
+    cat_script = CScript([OP_CAT, cat_a + cat_b, OP_EQUAL])
+    tap = taproot_construct(pubs[0], [
+        ("cat_v2", cat_script, LEAF_VERSION_TAPSCRIPT_V2),
+        ("cat_c0", cat_script, LEAF_VERSION_TAPSCRIPT),
+    ])
+    add_spender(
+        spenders,
+        "v2/cat_restored_over_520",
+        tap=tap,
+        leaf="cat_v2",
+        inputs=[cat_a, cat_b],
+        failure={"leaf": "cat_c0"},
+        **ERR_PUSH_LIMIT,
+    )
+
+    # Right shift preserves the byte-string width required by the v2 rules.
+    add_spender_for_script(
+        spenders,
+        pubs[0],
+        "v2/rshift_preserves_trailing_zero",
+        CScript([OP_RSHIFT, b"\x01\x00", OP_EQUAL]),
+        inputs=[b"\x02\x00", v2_num(1)],
+        failure_inputs=[b"\x02\x00", v2_num(8)],
+    )
+
+    # Multiplication represents unsigned arbitrary-length arithmetic.
+    add_spender_for_script(
+        spenders,
+        pubs[0],
+        "v2/mul",
+        CScript([OP_MUL, b"\x01\xfe", OP_EQUAL]),
+        inputs=[b"\xff", b"\xff"],
+        failure_inputs=[b"\xff", b"\xfe"],
+    )
+    # Preserve the BIP342 minimal-if rule under the new leaf version.
+    add_spender_for_script(
+        spenders,
+        pubs[0],
+        "v2/minimalif_still_required",
+        CScript([OP_IF, OP_1, OP_ENDIF]),
+        inputs=[b"\x01"],
+        failure_inputs=[b"\x01\x00"],
+        failure_err=ERR_MINIMALIF,
+    )
+    # OP_PICK represents v2's arbitrary-length stack indices.
+    add_spender_for_script(
+        spenders,
+        pubs[0],
+        "v2/pick_wide_index",
+        CScript([OP_PICK, b"bottom", OP_EQUALVERIFY, OP_DROP, OP_DROP, OP_1]),
+        inputs=[b"bottom", b"top", b"\x01\x00\x00\x00\x00"],
+        failure_inputs=[b"bottom", b"top", b"\x02\x00\x00\x00\x00"],
+        failure_err=ERR_STACK_EMPTY,
+    )
+    # SHA256 is no longer capped at 520 bytes, while SHA1 remains capped.
+    hash_data = b"h" * (MAX_SCRIPT_ELEMENT_SIZE + 17)
+    add_spender_for_script(
+        spenders,
+        pubs[0],
+        "v2/sha256_over_520",
+        CScript([OP_SHA256, hashlib.sha256(hash_data).digest(), OP_EQUAL]),
+        inputs=[hash_data],
+        failure_inputs=[hash_data[:-1]],
+    )
+    add_spender_for_script(
+        spenders,
+        pubs[0],
+        "v2/sha1_520_limit",
+        CScript([OP_SHA1, hashlib.sha1(b"s" * MAX_SCRIPT_ELEMENT_SIZE).digest(), OP_EQUAL]),
+        inputs=[b"s" * MAX_SCRIPT_ELEMENT_SIZE],
+        failure_inputs=[b"s" * (MAX_SCRIPT_ELEMENT_SIZE + 1)],
+        failure_err=ERR_HASH_OPERAND_SIZE,
+    )
+    # OP_CHECKSIGADD increments arbitrary-length unsigned numbers.
+    checksigadd_script = CScript([pubs[2], OP_CHECKSIGADD, v2_num(0x1_0000_0000), OP_EQUAL])
+    tap = taproot_construct(pubs[0], [("checksigadd", checksigadd_script, LEAF_VERSION_TAPSCRIPT_V2)])
+    add_spender(
+        spenders,
+        "v2/checksigadd_unsigned_increment",
+        tap=tap,
+        leaf="checksigadd",
+        key=secs[2],
+        inputs=[getter("sign"), b"\xff\xff\xff\xff"],
+        failure={"sighash": bitflipper(default_sighash)},
+        **ERR_SIG_SCHNORR,
+    )
+
+    # Empty signatures produce false without failing, and CHECKSIGADD still
+    # normalizes its unchanged numeric operand.
+    empty_checksigadd_script = CScript([pubs[2], OP_CHECKSIGADD, OP_1, OP_EQUAL])
+    tap = taproot_construct(pubs[0], [("checksigadd", empty_checksigadd_script, LEAF_VERSION_TAPSCRIPT_V2)])
+    add_spender(
+        spenders,
+        "v2/checksigadd_empty_signature_normalizes",
+        tap=tap,
+        leaf="checksigadd",
+        inputs=[b"", b"\x01\x00"],
+    )
+
+    # Reach exactly 8,000,000 stack+altstack bytes at runtime using two
+    # individually valid 4,000,000-byte elements, then fail by pushing one
+    # additional byte.
+    exact_element_shift = v2_num((MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE - 1) * 8)
+    exact_total_inputs = [
+        b"\x01",
+        exact_element_shift,
+        b"\x01",
+        exact_element_shift,
+        b"pad" * 1800,
+    ]
+    exact_total_script = CScript([
+        OP_DROP,
+        OP_LSHIFT,
+        OP_TOALTSTACK,
+        OP_LSHIFT,
+        OP_FROMALTSTACK,
+        OP_DROP,
+        OP_DROP,
+        OP_1,
+    ])
+    over_total_script = CScript([
+        OP_DROP,
+        OP_LSHIFT,
+        OP_TOALTSTACK,
+        OP_LSHIFT,
+        OP_1,
+        OP_DROP,
+        OP_DROP,
+        OP_1,
+    ])
+    assert_equal(len(exact_total_script), len(over_total_script))
+    tap = taproot_construct(pubs[0], [
+        ("total_exact", exact_total_script, LEAF_VERSION_TAPSCRIPT_V2),
+        ("total_over", over_total_script, LEAF_VERSION_TAPSCRIPT_V2),
+    ])
+    add_spender(
+        spenders,
+        "v2/runtime_total_stack_exact_limit",
+        tap=tap,
+        leaf="total_exact",
+        inputs=exact_total_inputs,
+        failure={"leaf": "total_over"},
+        **ERR_TOTAL_STACK_SIZE,
+    )
+
+    add_spender_for_script(
+        spenders,
+        pubs[0],
+        "v2/runtime_stack_element_exact_limit",
+        CScript([OP_DROP, OP_LSHIFT]),
+        inputs=[b"\x01", v2_num((MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE - 1) * 8), b"p" * 1000],
+        failure_inputs=[b"\x01", v2_num(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE * 8), b"p" * 1000],
+        failure_err=ERR_STACK_ELEMENT_SIZE,
+    )
+
+    # Non-empty signature opcodes spend from the same varops budget in v2,
+    # independent of the older BIP342 validation-weight-left accounting.
+    tap = taproot_construct(pubs[0], [
+        ("sig_budget_ok", CScript([OP_1]), LEAF_VERSION_TAPSCRIPT_V2),
+        ("sig_budget_fail", repeated_nonempty_unknown_pubkey_checksig_script(pubs[3], 250), LEAF_VERSION_TAPSCRIPT_V2),
+    ])
+    add_spender(
+        spenders,
+        "v2/checksig_varops_budget",
+        tap=tap,
+        leaf="sig_budget_ok",
+        failure={"leaf": "sig_budget_fail"},
+        **ERR_VAROP_COUNT,
+    )
+
+    return spenders
+
+
+def add_spender_for_script(
+    spenders,
+    internal_pubkey,
+    comment,
+    script,
+    *,
+    inputs,
+    failure_inputs,
+    failure_err=ERR_EVAL_FALSE,
+):
+    tap = taproot_construct(internal_pubkey, [("leaf", script, LEAF_VERSION_TAPSCRIPT_V2)])
+    add_spender(
+        spenders,
+        comment,
+        tap=tap,
+        leaf="leaf",
+        inputs=inputs,
+        failure={"inputs": failure_inputs},
+        **failure_err,
+    )
+
+
+class TapScriptV2Test(TaprootTest):
+    def set_test_params(self):
+        super().set_test_params()
+        self.extra_args[0].append("-vbparams=script_restoration:0:3999999999")
+
+    def run_test(self):
+        random.seed(441)
+
+        self.generate(self.nodes[0], COINBASE_MATURITY + 1)
+
+        self.log.info("Tapscript v2 pre-activation unknown leaf test")
+        self.test_tapscript_v2_leaf_before_activation()
+
+        self.log.info("Tapscript v2 activation rollback/reapply test")
+        self.test_script_restoration_activation_rollback_reapply()
+
+        self.log.info("Tapscript v2 spender tests")
+        self.test_spenders(self.nodes[0], tapscript_v2_spenders(), input_counts=[1, 2, 3])
+
+        self.log.info("Tapscript v2 locktime and sequence Val64 tests")
+        self.test_locktime_sequence_val64()
+
+        self.log.info("Tapscript v2 transaction-wide varops budget test")
+        self.test_transaction_wide_varops_budget()
+
+        self.log.info("Tapscript v2 final success varops budget test")
+        self.test_final_success_varops_budget()
+
+        self.log.info("Tapscript v2 standard transaction weight policy test")
+        self.test_standard_tx_weight_policy()
+
+        self.log.info("Tapscript v2 upgrade-semantics policy tests")
+        self.test_upgrade_semantics_policy()
+
+    def test_tapscript_v2_leaf_before_activation(self):
+        """Before SCRIPT_RESTORATION activation, 0xc2 has unknown-leaf consensus semantics."""
+        node = self.nodes[0]
+        host_addr = node.getnewaddress(address_type="bech32")
+        host_pubkey = bytes.fromhex(node.getaddressinfo(host_addr)["pubkey"])
+
+        cases = [
+            ("false", CScript([OP_0]), []),
+            ("return", CScript([OP_RETURN]), []),
+            ("malformed_push", CScript([OP_PUSHDATA1]), []),
+            ("oversized_initial_stack", CScript([OP_0]), [b""] * (MAX_TAPSCRIPT_V2_STACK_SIZE + 1)),
+        ]
+        funded = [
+            (name, self.fund_tapscript_v2(script, amount=50_000_000), witness_elements)
+            for name, script, witness_elements in cases
+        ]
+        assert not self.script_restoration_info()["active"]
+
+        spending_txs = []
+        for name, utxo, witness_elements in funded:
+            spending_tx = self.spending_tx(utxo, witness_elements=witness_elements)
+            spending_tx.rehash()
+            spending_txs.append(spending_tx)
+
+            result = node.testmempoolaccept([spending_tx.serialize().hex()], maxfeerate=0)[0]
+            assert not result["allowed"], f"{name}: {result}"
+            assert "SCRIPT_RESTORATION" in result.get("reject-reason", ""), f"{name}: {result}"
+            assert_raises_rpc_error(-26, None, node.sendrawtransaction, spending_tx.serialize().hex(), 0)
+
+        self.init_blockinfo(node)
+        self.block_submit(
+            node,
+            spending_txs,
+            "Tapscript v2 leaves before SCRIPT_RESTORATION activation",
+            err_msg=None,
+            cb_pubkey=host_pubkey,
+            fees=10_000 * len(spending_txs),
+            sigops_weight=MAX_BLOCK_SIGOPS_WEIGHT,
+            witness=True,
+            accept=True,
+        )
+
+    def script_restoration_info(self):
+        return self.nodes[0].getdeploymentinfo()["deployments"]["script_restoration"]
+
+    def script_restoration_state(self):
+        return self.script_restoration_info()["heretical"]
+
+    def advance_script_restoration_to_started(self):
+        node = self.nodes[0]
+
+        while self.script_restoration_state()["status"] != "started":
+            status = self.script_restoration_state()["status"]
+            assert_equal(status, "defined")
+            period = self.script_restoration_state()["period"]
+            blocks_to_next_period = period - (node.getblockcount() % period)
+            if blocks_to_next_period == 0:
+                blocks_to_next_period = period
+            self.generate(node, blocks_to_next_period)
+
+    def signal_script_restoration_activation(self):
+        node = self.nodes[0]
+        script_restoration_dep = self.script_restoration_state()
+        signal_activate = int(script_restoration_dep["signal_activate"], 16)
+        block = create_block(tmpl={
+            "previousblockhash": node.getbestblockhash(),
+            "height": node.getblockcount() + 1,
+            "version": signal_activate,
+        })
+        block.solve()
+        assert_equal(node.submitblock(block.serialize().hex()), None)
+        return block.hash
+
+    def submit_spend_block(self, spending_tx, comment, *, err_msg=None, accept=True, fee=10_000):
+        node = self.nodes[0]
+        host_addr = node.getnewaddress(address_type="bech32")
+        host_pubkey = bytes.fromhex(node.getaddressinfo(host_addr)["pubkey"])
+
+        spending_tx.rehash()
+        self.init_blockinfo(node)
+        self.block_submit(
+            node,
+            [spending_tx],
+            comment,
+            err_msg,
+            host_pubkey,
+            fee,
+            MAX_BLOCK_SIGOPS_WEIGHT,
+            True,
+            accept,
+        )
+        if accept:
+            return node.getbestblockhash()
+        return None
+
+    def test_script_restoration_activation_rollback_reapply(self):
+        node = self.nodes[0]
+
+        original_pre_active_utxo = self.fund_tapscript_v2(CScript([OP_0]), amount=50_000_000)
+        active_invalid_utxo = self.fund_tapscript_v2(CScript([OP_0]), amount=50_000_000)
+        active_valid_utxo = self.fund_tapscript_v2(CScript([OP_1]), amount=50_000_000)
+        alternate_pre_active_utxo = self.fund_tapscript_v2(CScript([OP_0]), amount=50_000_000)
+        reapplied_invalid_utxo = self.fund_tapscript_v2(CScript([OP_0]), amount=50_000_000)
+
+        self.advance_script_restoration_to_started()
+        assert_equal(self.script_restoration_state()["status"], "started")
+        started_height = node.getblockcount()
+        period = self.script_restoration_state()["period"]
+
+        self.signal_script_restoration_activation()
+        target_parent_height = started_height + 2 * period - 2
+        blocks_to_target_parent = target_parent_height - node.getblockcount()
+        assert blocks_to_target_parent >= 0
+        self.generate(node, blocks_to_target_parent)
+        assert_equal(node.getblockcount(), target_parent_height)
+        assert_equal(self.script_restoration_state()["status"], "locked_in")
+        assert_equal(self.script_restoration_state()["status_next"], "locked_in")
+
+        original_pre_active_tx = self.spending_tx(original_pre_active_utxo)
+        original_pre_active_hash = self.submit_spend_block(
+            original_pre_active_tx,
+            "Tapscript v2 0xc2 OP_0 spend in last pre-active block",
+        )
+        last_pre_active_height = node.getblockcount()
+        assert_equal(last_pre_active_height, started_height + 2 * period - 1)
+        assert_equal(self.script_restoration_state()["status"], "locked_in")
+        assert_equal(self.script_restoration_state()["status_next"], "active")
+
+        active_invalid_tx = self.spending_tx(active_invalid_utxo)
+        self.submit_spend_block(
+            active_invalid_tx,
+            "Tapscript v2 0xc2 OP_0 spend in first active block",
+            err_msg=ERR_EVAL_FALSE["err_msg"],
+            accept=False,
+        )
+
+        active_valid_tx = self.spending_tx(active_valid_utxo)
+        active_hash = self.submit_spend_block(
+            active_valid_tx,
+            "Tapscript v2 0xc2 OP_1 spend in first active block",
+        )
+        assert_equal(node.getblockcount(), last_pre_active_height + 1)
+        assert_equal(self.script_restoration_state()["status"], "active")
+
+        node.invalidateblock(original_pre_active_hash)
+        assert_equal(node.getblockcount(), last_pre_active_height - 1)
+        assert_equal(self.script_restoration_state()["status"], "locked_in")
+        assert_equal(self.script_restoration_state()["status_next"], "locked_in")
+        assert not self.script_restoration_info()["active"]
+
+        alternate_pre_active_tx = self.spending_tx(alternate_pre_active_utxo)
+        alternate_pre_active_hash = self.submit_spend_block(
+            alternate_pre_active_tx,
+            "Tapscript v2 0xc2 OP_0 spend in alternate last pre-active block",
+        )
+        assert alternate_pre_active_hash != original_pre_active_hash
+        assert_equal(node.getblockcount(), last_pre_active_height)
+        assert_equal(self.script_restoration_state()["status"], "locked_in")
+        assert_equal(self.script_restoration_state()["status_next"], "active")
+
+        node.reconsiderblock(original_pre_active_hash)
+        node.reconsiderblock(active_hash)
+        self.wait_until(lambda: node.getbestblockhash() == active_hash)
+        assert_equal(self.script_restoration_state()["status"], "active")
+
+        reapplied_invalid_tx = self.spending_tx(reapplied_invalid_utxo)
+        self.submit_spend_block(
+            reapplied_invalid_tx,
+            "Tapscript v2 0xc2 OP_0 spend after activation branch reapply",
+            err_msg=ERR_EVAL_FALSE["err_msg"],
+            accept=False,
+        )
+
+    def fund_spenders(self, spenders, amount=10_000_000):
+        node = self.nodes[0]
+        host_addr = node.getnewaddress(address_type="bech32")
+        host_info = node.getaddressinfo(host_addr)
+        host_spk = bytes.fromhex(host_info["scriptPubKey"])
+        host_pubkey = bytes.fromhex(host_info["pubkey"])
+
+        fund_tx = CTransaction()
+        unspents = node.listunspent()
+        unspents.sort(key=lambda x: int(x["amount"] * 100_000_000), reverse=True)
+        balance = 0
+        for unspent in unspents[:20]:
+            balance += int(unspent["amount"] * 100_000_000)
+            fund_tx.vin.append(CTxIn(COutPoint(int(unspent["txid"], 16), int(unspent["vout"])), CScript()))
+
+        for spender in spenders:
+            fund_tx.vout.append(CTxOut(amount, spender.script))
+            balance -= amount
+
+        assert balance > 100_000
+        fund_tx.vout.append(CTxOut(balance - 10_000, host_spk))
+        fund_tx = self.nodes[0].signrawtransactionwithwallet(fund_tx.serialize().hex())
+        fund_tx = tx_from_hex(fund_tx["hex"])
+        fund_tx.rehash()
+
+        self.init_blockinfo(node)
+        self.block_submit(
+            node,
+            [fund_tx],
+            "Tapscript v2 funding tx",
+            None,
+            host_pubkey,
+            10_000,
+            MAX_BLOCK_SIGOPS_WEIGHT,
+            True,
+            True,
+        )
+
+        return [
+            (COutPoint(fund_tx.sha256, i), fund_tx.vout[i], spender)
+            for i, spender in enumerate(spenders)
+        ], host_spk, host_pubkey
+
+    def fund_tapscript_v2(self, script, *, internal_key=None, amount=10_000_000, leaves=None, leaf_name="script"):
+        node = self.nodes[0]
+        if internal_key is None:
+            internal_key = generate_privkey()
+        internal_pubkey = compute_xonly_pubkey(internal_key)[0]
+
+        if leaves is None:
+            leaves = [(leaf_name, script, LEAF_VERSION_TAPSCRIPT_V2)]
+        tap = taproot_construct(internal_pubkey, leaves)
+        address = encode_segwit_address("bcrt", 1, tap.output_pubkey)
+        funding_txid = node.sendtoaddress(address, amount / COIN)
+        self.generate(node, 1)
+
+        funding_info = node.gettransaction(funding_txid)
+        funding_tx = node.decoderawtransaction(funding_info["hex"])
+        expected_spk = bytes(tap.scriptPubKey).hex()
+        for vout in funding_tx["vout"]:
+            if vout["scriptPubKey"]["hex"] == expected_spk:
+                return {
+                    "amount": int(vout["value"] * COIN),
+                    "internal_key": internal_key,
+                    "leaf": leaf_name,
+                    "script": tap.leaves[leaf_name].script,
+                    "tap": tap,
+                    "txid": funding_txid,
+                    "vout": vout["n"],
+                }
+
+        raise AssertionError("Could not find Tapscript v2 funding output")
+
+    def control_block(self, utxo):
+        tap = utxo["tap"]
+        leaf_info = tap.leaves[utxo["leaf"]]
+        return bytes([leaf_info.version + tap.negflag]) + tap.internal_pubkey + leaf_info.merklebranch
+
+    def spending_tx(self, utxo, *, witness_elements=(), fee=10_000, nlocktime=0, nsequence=SEQUENCE_FINAL):
+        node = self.nodes[0]
+        output_addr = node.getnewaddress(address_type="bech32")
+        output_spk = bytes.fromhex(node.getaddressinfo(output_addr)["scriptPubKey"])
+
+        spending_tx = CTransaction()
+        spending_tx.version = 2
+        spending_tx.nLockTime = nlocktime
+        spending_tx.vin = [CTxIn(COutPoint(int(utxo["txid"], 16), utxo["vout"]), CScript(), nsequence)]
+        spending_tx.vout = [CTxOut(utxo["amount"] - fee, output_spk)]
+        spending_tx.wit.vtxinwit = [CTxInWitness()]
+        spending_tx.wit.vtxinwit[0].scriptWitness.stack = [
+            *witness_elements,
+            bytes(utxo["script"]),
+            self.control_block(utxo),
+        ]
+        return spending_tx
+
+    def script_signature(
+        self,
+        utxo,
+        spending_tx,
+        private_key,
+        *,
+        hashtype=SIGHASH_DEFAULT,
+        key_version=None,
+    ):
+        spent_output = CTxOut(utxo["amount"], utxo["tap"].scriptPubKey)
+        if key_version is None:
+            key_version = KEY_VERSION_ANYPREVOUT if hashtype & SIGHASH_ANYPREVOUT else KEY_VERSION_TAPROOT
+        sighash = TaprootSignatureHash(
+            spending_tx,
+            [spent_output],
+            hashtype,
+            0,
+            scriptpath=True,
+            leaf_script=utxo["script"],
+            codeseparator_pos=-1,
+            leaf_ver=LEAF_VERSION_TAPSCRIPT_V2,
+            key_ver=key_version,
+        )
+        signature = sign_schnorr(private_key, sighash)
+        if hashtype != SIGHASH_DEFAULT:
+            signature += bytes([hashtype])
+        return signature
+
+    def submit_and_mine(self, spending_tx, comment):
+        node = self.nodes[0]
+        spending_tx.rehash()
+        result = node.testmempoolaccept([spending_tx.serialize().hex()], maxfeerate=0)[0]
+        assert result["allowed"], f"{comment}: {result.get('reject-reason', 'unknown reject reason')}"
+        node.sendrawtransaction(spending_tx.serialize().hex(), 0)
+        self.generate(node, 1)
+
+    def submit_nonstandard_and_mine(self, spending_tx, comment, fee=10_000):
+        node = self.nodes[0]
+        host_addr = node.getnewaddress(address_type="bech32")
+        host_pubkey = bytes.fromhex(node.getaddressinfo(host_addr)["pubkey"])
+
+        spending_tx.rehash()
+        result = node.testmempoolaccept([spending_tx.serialize().hex()], maxfeerate=0)[0]
+        assert not result["allowed"], f"{comment}: unexpectedly accepted into mempool"
+        assert "OP_SUCCESS" in result.get("reject-reason", ""), result
+
+        self.init_blockinfo(node)
+        self.block_submit(
+            node,
+            [spending_tx],
+            comment,
+            None,
+            host_pubkey,
+            fee,
+            MAX_BLOCK_SIGOPS_WEIGHT,
+            True,
+            True,
+        )
+
+    def test_standard_tx_weight_policy(self):
+        node = self.nodes[0]
+        fee = 200_000
+        large_witness_script = CScript([OP_DROP, OP_1])
+
+        def tx_with_padding(utxo, padding_len):
+            return self.spending_tx(utxo, witness_elements=[b"\x00" * padding_len], fee=fee)
+
+        def tx_at_weight_boundary(utxo, weight_limit, *, over):
+            def weight_at(padding_len):
+                return tx_with_padding(utxo, padding_len).get_weight()
+
+            high = weight_limit
+            while weight_at(high) <= weight_limit:
+                high *= 2
+
+            low = 0
+            selected_padding_len = high if over else 0
+            while low <= high:
+                mid = (low + high) // 2
+                weight = weight_at(mid)
+                if weight > weight_limit:
+                    if over:
+                        selected_padding_len = mid
+                    high = mid - 1
+                else:
+                    if not over:
+                        selected_padding_len = mid
+                    low = mid + 1
+
+            tx = tx_with_padding(utxo, selected_padding_len)
+            tx.rehash()
+            padding = tx.wit.vtxinwit[0].scriptWitness.stack[0]
+            assert_equal(len(padding), selected_padding_len)
+            assert_greater_than(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE, len(padding))
+
+            if over:
+                assert_greater_than(tx.get_weight(), weight_limit)
+                assert weight_at(selected_padding_len - 1) <= weight_limit
+            else:
+                assert tx.get_weight() <= weight_limit
+                assert_greater_than(weight_at(selected_padding_len + 1), weight_limit)
+            return tx
+
+        standard_utxo = self.fund_tapscript_v2(large_witness_script)
+        standard_tx = tx_at_weight_boundary(standard_utxo, MAX_STANDARD_TX_WEIGHT, over=False)
+        assert standard_tx.get_weight() <= MAX_STANDARD_TX_WEIGHT
+        self.submit_and_mine(standard_tx, "v2 large witness item at standard tx weight")
+
+        oversized_utxo = self.fund_tapscript_v2(large_witness_script)
+        oversized_tx = tx_at_weight_boundary(oversized_utxo, MAX_STANDARD_TX_WEIGHT, over=True)
+        assert_greater_than(oversized_tx.get_weight(), MAX_STANDARD_TX_WEIGHT)
+        assert_greater_than(MAX_BLOCK_WEIGHT, oversized_tx.get_weight())
+
+        result = node.testmempoolaccept([oversized_tx.serialize().hex()], maxfeerate=0)[0]
+        assert not result["allowed"], result
+        assert_equal(result["reject-reason"], "tx-size")
+
+        self.submit_spend_block(
+            oversized_tx,
+            "v2 large witness item above standard tx weight",
+            fee=fee,
+        )
+
+    def test_upgrade_semantics_policy(self):
+        node = self.nodes[0]
+
+        # In 0xc2, 0x01-prefixed pubkeys are still upgradable pubkey types, not
+        # APO keys. A well-formed APO-shaped signature is therefore policy-
+        # discouraged, but consensus-valid through unknown-pubkey semantics.
+        key = generate_privkey()
+        apo_prefixed_pubkey = bytes([KEY_VERSION_ANYPREVOUT]) + compute_xonly_pubkey(key)[0]
+        apo_prefixed_script = CScript([apo_prefixed_pubkey, OP_CHECKSIG])
+        utxo = self.fund_tapscript_v2(apo_prefixed_script)
+        spending_tx = self.spending_tx(utxo)
+        signature = self.script_signature(
+            utxo,
+            spending_tx,
+            key,
+            hashtype=SIGHASH_ANYPREVOUT | SIGHASH_ALL,
+            key_version=KEY_VERSION_ANYPREVOUT,
+        )
+        spending_tx.wit.vtxinwit[0].scriptWitness.stack.insert(0, signature)
+        spending_tx.rehash()
+        result = node.testmempoolaccept([spending_tx.serialize().hex()], maxfeerate=0)[0]
+        assert not result["allowed"], result
+        assert "Public key version reserved for soft-fork upgrades" in result.get("reject-reason", ""), result
+        self.submit_spend_block(
+            spending_tx,
+            "v2 APO-prefixed pubkey is upgradable, not APO",
+        )
+
+        for name, success_op in (("OP_INTERNALKEY", OP_INTERNALKEY), ("OP_CHECKSIGFROMSTACK", OP_CHECKSIGFROMSTACK)):
+            utxo = self.fund_tapscript_v2(CScript([success_op, OP_RETURN]))
+            spending_tx = self.spending_tx(utxo)
+            self.submit_nonstandard_and_mine(spending_tx, f"{name} as v2 OP_SUCCESS leaf")
+
+    def test_locktime_sequence_val64(self):
+        node = self.nodes[0]
+        sec = generate_privkey()
+        pub = compute_xonly_pubkey(sec)[0]
+
+        def make_lock_spender(name, script, inputs):
+            tap = taproot_construct(pub, [(name, script, LEAF_VERSION_TAPSCRIPT_V2)])
+            return make_spender(name, tap=tap, leaf=name, inputs=inputs)
+
+        spenders = [
+            make_lock_spender(
+                "v2/cltv_five_byte_zero",
+                CScript([OP_CHECKLOCKTIMEVERIFY, OP_DROP, OP_1]),
+                [b"\x00" * 5],
+            ),
+            make_lock_spender(
+                "v2/cltv_too_large",
+                CScript([OP_CHECKLOCKTIMEVERIFY, OP_DROP, OP_1]),
+                [b"\x00\x00\x00\x00\x01"],
+            ),
+            make_lock_spender("v2/csv_five_byte_zero", CScript([OP_CHECKSEQUENCEVERIFY, OP_DROP, OP_1]), [b"\x00" * 5]),
+            make_lock_spender(
+                "v2/csv_unsatisfied_wide",
+                CScript([OP_CHECKSEQUENCEVERIFY, OP_DROP, OP_1]),
+                [b"\x02\x00\x00\x00\x00"],
+            ),
+            make_lock_spender(
+                "v2/csv_uint32_max_disable",
+                CScript([OP_CHECKSEQUENCEVERIFY, OP_DROP, OP_1]),
+                [v2_num((1 << 32) - 1)],
+            ),
+            make_lock_spender(
+                "v2/csv_overflow_disable",
+                CScript([OP_CHECKSEQUENCEVERIFY, OP_DROP, OP_1]),
+                [v2_num((1 << 32) | (1 << 31))],
+            ),
+        ]
+        funded, host_spk, host_pubkey = self.fund_spenders(spenders)
+
+        def spend_one(index, *, nlocktime, nsequence, accept, err_msg=None):
+            outpoint, output, spender = funded[index]
+            fee = 10_000
+            spend_tx = CTransaction()
+            spend_tx.version = 2
+            spend_tx.nLockTime = nlocktime
+            spend_tx.vin = [CTxIn(outpoint, CScript(), nsequence)]
+            spend_tx.vout = [CTxOut(output.nValue - fee, host_spk)]
+            spend_tx.wit.vtxinwit = [CTxInWitness()]
+            script_sig, witness_stack = spender.sat_function(spend_tx, 0, [output], True)
+            spend_tx.vin[0].scriptSig = script_sig
+            spend_tx.wit.vtxinwit[0].scriptWitness.stack = witness_stack
+            spend_tx.rehash()
+
+            if accept:
+                node.sendrawtransaction(spend_tx.serialize().hex(), 0)
+                assert node.getmempoolentry(spend_tx.hash) is not None
+            else:
+                assert_raises_rpc_error(-26, None, node.sendrawtransaction, spend_tx.serialize().hex(), 0)
+
+            self.block_submit(
+                node,
+                [spend_tx],
+                spender.comment,
+                witness=True,
+                accept=accept,
+                cb_pubkey=host_pubkey,
+                fees=fee,
+                sigops_weight=MAX_BLOCK_SIGOPS_WEIGHT,
+                err_msg=err_msg,
+            )
+
+        spend_one(0, nlocktime=0, nsequence=0, accept=True)
+        spend_one(1, nlocktime=0, nsequence=0, accept=False, **ERR_LOCKTIME)
+        spend_one(2, nlocktime=0, nsequence=0, accept=True)
+        spend_one(3, nlocktime=0, nsequence=1, accept=False, **ERR_LOCKTIME)
+        spend_one(4, nlocktime=0, nsequence=0, accept=True)
+        spend_one(5, nlocktime=0, nsequence=0, accept=False, **ERR_LOCKTIME)
+
+    def test_transaction_wide_varops_budget(self):
+        node = self.nodes[0]
+        sec = generate_privkey()
+        pub = compute_xonly_pubkey(sec)[0]
+
+        operand_size = 12_000
+        padding_size = 10
+        operand = b"\xff" * operand_size
+        padding = b"\x00" * padding_size
+        expensive_script = CScript([OP_MUL, OP_DROP, OP_DROP, OP_1])
+        cheap_script = CScript([OP_DROP, OP_DROP, OP_DROP, OP_1])
+        threshold_script = CScript([OP_DROP, OP_CAT, OP_DROP, OP_1])
+        assert_equal(len(expensive_script), len(cheap_script))
+        assert_equal(len(expensive_script), len(threshold_script))
+
+        def make_budget_spender(name, script):
+            tap = taproot_construct(pub, [(name, script, LEAF_VERSION_TAPSCRIPT_V2)])
+            return make_spender(name, tap=tap, leaf=name, inputs=[padding, operand, operand])
+
+        spenders = [
+            make_budget_spender("v2/shared_budget_accepted_expensive", expensive_script),
+            make_budget_spender("v2/shared_budget_accepted_cheap", cheap_script),
+            make_budget_spender("v2/shared_budget_rejected_expensive", expensive_script),
+            make_budget_spender("v2/shared_budget_rejected_threshold", threshold_script),
+        ]
+        funded, host_spk, host_pubkey = self.fund_spenders(spenders)
+
+        def make_spend_tx(funded_inputs):
+            spend_tx = CTransaction()
+            spend_tx.version = 2
+            spend_tx.vin = [CTxIn(outpoint) for outpoint, _output, _spender in funded_inputs]
+            output_value = sum(output.nValue for _outpoint, output, _spender in funded_inputs) - 50_000
+            spend_tx.vout = [CTxOut(output_value, host_spk)]
+            spend_tx.wit.vtxinwit = [CTxInWitness() for _ in funded_inputs]
+
+            spent_outputs = [output for _outpoint, output, _spender in funded_inputs]
+            for index, (_outpoint, _output, spender) in enumerate(funded_inputs):
+                script_sig, witness_stack = spender.sat_function(spend_tx, index, spent_outputs, True)
+                spend_tx.vin[index].scriptSig = script_sig
+                spend_tx.wit.vtxinwit[index].scriptWitness.stack = witness_stack
+            spend_tx.rehash()
+            return spend_tx
+
+        accepted_funded = funded[:2]
+        rejected_funded = funded[2:]
+        accepted_tx = make_spend_tx(accepted_funded)
+        rejected_tx = make_spend_tx(rejected_funded)
+        assert_equal(accepted_tx.get_weight(), rejected_tx.get_weight())
+
+        final_check_cost = comparingzero_cost(1)
+        expensive_input_cost = mul_cost(operand_size, operand_size) + final_check_cost
+        cheap_input_cost = final_check_cost
+        threshold_input_cost = (padding_size + operand_size) * VAROPS_COST_COPYING + final_check_cost
+        accepted_cost = expensive_input_cost + cheap_input_cost
+        rejected_cost = expensive_input_cost + threshold_input_cost
+        tx_weight = accepted_tx.get_weight()
+        tx_budget = tx_weight * VAROPS_BUDGET_PER_WEIGHT
+
+        assert expensive_input_cost < tx_budget
+        assert expensive_input_cost > tx_budget // 2
+        assert accepted_cost <= tx_budget < rejected_cost
+        assert accepted_cost > tx_weight * (VAROPS_BUDGET_PER_WEIGHT - 1)
+        assert rejected_cost <= tx_weight * (VAROPS_BUDGET_PER_WEIGHT + 1)
+
+        result = node.testmempoolaccept([accepted_tx.serialize().hex()], maxfeerate=0)[0]
+        assert result["allowed"], result
+        node.sendrawtransaction(accepted_tx.serialize().hex(), 0)
+        assert node.getmempoolentry(accepted_tx.hash) is not None
+        self.block_submit(
+            node,
+            [accepted_tx],
+            "two v2 inputs share the exact transaction-wide varops budget",
+            err_msg=None,
+            witness=True,
+            accept=True,
+            cb_pubkey=host_pubkey,
+            fees=50_000,
+            sigops_weight=MAX_BLOCK_SIGOPS_WEIGHT,
+        )
+
+        finalized_psbt = PSBT(
+            g=PSBTMap({PSBT_GLOBAL_UNSIGNED_TX: rejected_tx.serialize_without_witness()}),
+            i=[
+                PSBTMap({
+                    PSBT_IN_WITNESS_UTXO: output.serialize(),
+                    PSBT_IN_FINAL_SCRIPTWITNESS: rejected_tx.wit.vtxinwit[index].serialize(),
+                })
+                for index, (_outpoint, output, _spender) in enumerate(rejected_funded)
+            ],
+            o=[PSBTMap() for _ in rejected_tx.vout],
+        ).to_base64()
+
+        analysis = node.analyzepsbt(finalized_psbt)
+        assert_equal(analysis["next"], "creator")
+        assert_equal(analysis["error"], "PSBT is not valid. Finalized transaction failed script verification")
+
+        processed = node.descriptorprocesspsbt(finalized_psbt, [])
+        assert_equal(processed["complete"], False)
+        assert "hex" not in processed
+
+        assert_raises_rpc_error(-26, None, node.sendrawtransaction, rejected_tx.serialize().hex(), 0)
+        self.block_submit(
+            node,
+            [rejected_tx],
+            "two v2 inputs exceed the exact transaction-wide varops budget",
+            witness=True,
+            accept=False,
+            cb_pubkey=host_pubkey,
+            fees=50_000,
+            sigops_weight=MAX_BLOCK_SIGOPS_WEIGHT,
+            err_msg=ERR_VAROP_COUNT["err_msg"],
+        )
+
+    def test_final_success_varops_budget(self):
+        node = self.nodes[0]
+        sec = generate_privkey()
+        pub = compute_xonly_pubkey(sec)[0]
+
+        final_size = MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE
+        final_shift_bits = (final_size - 1) * 8
+        final_shift = v2_num(final_shift_bits)
+        final_check_cost = comparingzero_cost(final_size)
+        final_value = b"\x01"
+        costly_script = CScript([OP_MUL, OP_DROP, OP_LSHIFT])
+        host_spk = bytes.fromhex(node.getaddressinfo(node.getnewaddress(address_type="bech32"))["scriptPubKey"])
+
+        def make_costly_spender(operand_size):
+            operand = b"\xff" * operand_size
+            tap = taproot_construct(pub, [("costly", costly_script, LEAF_VERSION_TAPSCRIPT_V2)])
+            return make_spender(
+                f"v2/final_success_budget_{operand_size}",
+                tap=tap,
+                leaf="costly",
+                inputs=[final_value, final_shift, operand, operand],
+            )
+
+        def make_spend_tx(outpoint, output, spender, fee):
+            spend_tx = CTransaction()
+            spend_tx.version = 2
+            spend_tx.vin = [CTxIn(outpoint)]
+            spend_tx.vout = [CTxOut(output.nValue - fee, host_spk)]
+            spend_tx.wit.vtxinwit = [CTxInWitness()]
+            script_sig, witness_stack = spender.sat_function(spend_tx, 0, [output], True)
+            spend_tx.vin[0].scriptSig = script_sig
+            spend_tx.wit.vtxinwit[0].scriptWitness.stack = witness_stack
+            spend_tx.rehash()
+            return spend_tx
+
+        dummy_output = CTxOut(10_000_000, host_spk)
+        selected_operand_size = None
+        for operand_size in range(4_500, 6_500):
+            spender = make_costly_spender(operand_size)
+            spend_tx = make_spend_tx(COutPoint(0, 0), dummy_output, spender, fee=50_000)
+            script_cost = mul_cost(operand_size, operand_size) + upshift_cost(len(final_value), final_shift_bits)
+            tx_budget = spend_tx.get_weight() * VAROPS_BUDGET_PER_WEIGHT
+            if script_cost < tx_budget < script_cost + final_check_cost:
+                selected_operand_size = operand_size
+                break
+        assert selected_operand_size is not None
+
+        spender = make_costly_spender(selected_operand_size)
+        funded, host_spk, host_pubkey = self.fund_spenders([spender])
+        outpoint, output, funded_spender = funded[0]
+        spend_tx = make_spend_tx(outpoint, output, funded_spender, fee=50_000)
+        script_cost = mul_cost(selected_operand_size, selected_operand_size) + upshift_cost(
+            len(final_value),
+            final_shift_bits,
+        )
+        tx_budget = spend_tx.get_weight() * VAROPS_BUDGET_PER_WEIGHT
+        assert script_cost < tx_budget < script_cost + final_check_cost
+
+        result = node.testmempoolaccept([spend_tx.serialize().hex()], maxfeerate=0)[0]
+        assert not result["allowed"], result
+        assert ERR_VAROP_COUNT["err_msg"] in result.get("reject-reason", ""), result
+        assert_raises_rpc_error(-26, None, node.sendrawtransaction, spend_tx.serialize().hex(), 0)
+
+        self.block_submit(
+            node,
+            [spend_tx],
+            "v2 final success scan overspends varops budget",
+            witness=True,
+            accept=False,
+            cb_pubkey=host_pubkey,
+            fees=50_000,
+            sigops_weight=MAX_BLOCK_SIGOPS_WEIGHT,
+            err_msg=ERR_VAROP_COUNT["err_msg"],
+        )
+
+
+if __name__ == "__main__":
+    TapScriptV2Test(__file__).main()
diff --git a/test/functional/feature_tapscript_v2_taproot.py b/test/functional/feature_tapscript_v2_taproot.py
new file mode 100755
index 000000000000..67469540f0b3
--- /dev/null
+++ b/test/functional/feature_tapscript_v2_taproot.py
@@ -0,0 +1,155 @@
+#!/usr/bin/env python3
+# Copyright (c) 2026 The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+"""Replay Taproot script-path coverage with Tapscript v2 leaves."""
+
+import random
+
+import feature_taproot as taproot
+
+from test_framework.blocktools import COINBASE_MATURITY, create_block
+from test_framework.script import (
+    CScript,
+    LEAF_VERSION_TAPSCRIPT,
+    LEAF_VERSION_TAPSCRIPT_V2,
+    OP_1,
+    OP_CHECKSIG,
+    OP_CHECKSIGVERIFY,
+)
+from test_framework.util import assert_equal
+
+
+_ORIGINAL_TAPROOT_CONSTRUCT = taproot.taproot_construct
+
+
+def _script_tree_to_v2(scripts):
+    if scripts is None or callable(scripts):
+        return scripts
+
+    if isinstance(scripts, tuple):
+        if len(scripts) == 2:
+            return (scripts[0], scripts[1], LEAF_VERSION_TAPSCRIPT_V2)
+        if len(scripts) == 3 and scripts[2] == LEAF_VERSION_TAPSCRIPT:
+            return (scripts[0], scripts[1], LEAF_VERSION_TAPSCRIPT_V2)
+        return scripts
+
+    if isinstance(scripts, list):
+        return [_script_tree_to_v2(script) for script in scripts]
+
+    return scripts
+
+
+def taproot_construct_v2(pubkey, scripts=None, **kwargs):
+    return _ORIGINAL_TAPROOT_CONSTRUCT(pubkey, _script_tree_to_v2(scripts), **kwargs)
+
+
+def random_checksig_style_v2(pubkey):
+    opcode = random.choice([OP_CHECKSIG, OP_CHECKSIGVERIFY])
+    if opcode == OP_CHECKSIGVERIFY:
+        return bytes(CScript([pubkey, opcode, OP_1]))
+    return bytes(CScript([pubkey, opcode]))
+
+
+def is_tapscript_v2_replay_spender(spender):
+    comment = spender.comment
+
+    # Replay only cases that exercise a script path converted to 0xc2. Key-path,
+    # legacy, witness-v0, sighash-cache, and unrelated unknown-leaf cases are
+    # already covered by feature_taproot.py without involving Tapscript v2.
+    if comment.startswith(("sig/", "legacy/", "compat/", "sighashcache/", "unkver/")):
+        return False
+    if "keypath" in comment or comment == "sighash/purepk":
+        return False
+
+    # These are not v2 leaf replay coverage: they validate future leaf versions
+    # and OP_SUCCESSx behavior, whose opcode set is deliberately different in v2.
+    if comment.startswith(("opsuccess/", "alwaysvalid/")):
+        return False
+
+    # The v2 semantic test covers the changed element, stack, numeric, and
+    # signature-budget rules directly. This file keeps the inherited Taproot
+    # matrix focused on behavior that should remain equivalent under 0xc2.
+    changed_v2_semantics = {
+        "sighash/leafver",
+        "tapscript/inputmaxlimit",
+        "tapscript/input81limit",
+        "tapscript/checksigaddresults",
+        "tapscript/checksigaddoversize",
+        "tapscript/1000stack",
+        "tapscript/1000inputs",
+        "tapscript/pushmaxlimit",
+        "tapscript/bigmulti",
+    }
+    if comment in changed_v2_semantics:
+        return False
+    if comment.startswith("tapscript/sigopsratio_"):
+        return False
+    if comment.startswith("tapscript/oldpk/"):
+        return False
+    if comment.startswith("apo/"):
+        return False
+
+    return True
+
+
+def tapscript_v2_taproot_spenders():
+    original_taproot_construct = taproot.taproot_construct
+    original_random_checksig_style = taproot.random_checksig_style
+    try:
+        taproot.taproot_construct = taproot_construct_v2
+        taproot.random_checksig_style = random_checksig_style_v2
+        return [
+            spender
+            for spender in taproot.spenders_taproot_active()
+            if is_tapscript_v2_replay_spender(spender)
+        ]
+    finally:
+        taproot.taproot_construct = original_taproot_construct
+        taproot.random_checksig_style = original_random_checksig_style
+
+
+class TapScriptV2TaprootTest(taproot.TaprootTest):
+    def set_test_params(self):
+        super().set_test_params()
+        self.extra_args[0].append("-vbparams=script_restoration:0:3999999999")
+
+    def run_test(self):
+        random.seed(442)
+
+        self.generate(self.nodes[0], COINBASE_MATURITY + 1)
+
+        self.log.info("Activating SCRIPT_RESTORATION")
+        self.activate_script_restoration()
+
+        self.log.info("Tapscript v2 Taproot replay tests")
+        self.test_spenders(self.nodes[0], tapscript_v2_taproot_spenders(), input_counts=[1, 2, 2, 2, 2, 3])
+
+    def activate_script_restoration(self):
+        node = self.nodes[0]
+
+        deployment = node.getdeploymentinfo()["deployments"]["script_restoration"]["heretical"]
+        period = deployment["period"]
+        while deployment["status"] != "started":
+            assert_equal(deployment["status"], "defined")
+            blocks_to_next_period = period - (node.getblockcount() % period)
+            if blocks_to_next_period == 0:
+                blocks_to_next_period = period
+            self.generate(node, blocks_to_next_period)
+            deployment = node.getdeploymentinfo()["deployments"]["script_restoration"]["heretical"]
+
+        signal_activate = int(deployment["signal_activate"], 16)
+        block = create_block(tmpl={
+            "previousblockhash": node.getbestblockhash(),
+            "height": node.getblockcount() + 1,
+            "version": signal_activate,
+        })
+        block.solve()
+        assert_equal(node.submitblock(block.serialize().hex()), None)
+
+        self.generate(node, 2 * period)
+        assert_equal(node.getdeploymentinfo()["deployments"]["script_restoration"]["heretical"]["status"], "active")
+
+
+if __name__ == "__main__":
+    TapScriptV2TaprootTest(__file__).main()
diff --git a/test/functional/rpc_psbt.py b/test/functional/rpc_psbt.py
index f1c83b869b14..216deaf84fd8 100755
--- a/test/functional/rpc_psbt.py
+++ b/test/functional/rpc_psbt.py
@@ -29,11 +29,12 @@
     PSBT_IN_SHA256,
     PSBT_IN_HASH160,
     PSBT_IN_HASH256,
+    PSBT_IN_FINAL_SCRIPTSIG,
     PSBT_IN_NON_WITNESS_UTXO,
     PSBT_IN_WITNESS_UTXO,
     PSBT_OUT_TAP_TREE,
 )
-from test_framework.script import CScript, OP_TRUE
+from test_framework.script import CScript, OP_CHECKTEMPLATEVERIFY, OP_DROP, OP_FALSE, OP_TRUE
 from test_framework.script_util import MIN_STANDARD_TX_NONWITNESS_SIZE
 from test_framework.test_framework import BitcoinTestFramework
 from test_framework.util import (
@@ -209,10 +210,73 @@ def assert_change_type(self, psbtx, expected_type):
         changepos = psbtx["changepos"]
         assert_equal(decoded_psbt["tx"]["vout"][changepos]["scriptPubKey"]["type"], expected_type)
 
+    def test_finalized_ctv_psbt_precomputation(self):
+        node = self.nodes[0]
+        final_script_sig = CScript([OP_FALSE])
+
+        def make_psbt(commit_final_script_sigs):
+            finalized_tx = CTransaction()
+            finalized_tx.version = 2
+            finalized_tx.vin = [CTxIn(scriptSig=final_script_sig)]
+            finalized_tx.vout = [CTxOut(nValue=150_000, scriptPubKey=CScript([OP_TRUE]))]
+
+            if commit_final_script_sigs:
+                template_hash = finalized_tx.get_standard_template_hash(0)
+            else:
+                finalized_tx.vin[0].scriptSig = b""
+                template_hash = finalized_tx.get_standard_template_hash(0)
+                finalized_tx.vin[0].scriptSig = final_script_sig
+
+            ctv_script = CScript([OP_DROP, template_hash, OP_CHECKTEMPLATEVERIFY])
+            prev_tx = CTransaction()
+            prev_tx.version = 2
+            prev_tx.vin = [CTxIn(COutPoint(hash=int("11" * 32, 16), n=0), CScript([OP_TRUE]))]
+            prev_tx.vout = [CTxOut(nValue=200_000, scriptPubKey=ctv_script)]
+            prev_tx.rehash()
+
+            finalized_tx.vin[0].prevout = COutPoint(hash=int(prev_tx.hash, 16), n=0)
+            finalized_tx.rehash()
+
+            unsigned_tx = CTransaction()
+            unsigned_tx.version = finalized_tx.version
+            unsigned_tx.vin = [CTxIn(COutPoint(hash=finalized_tx.vin[0].prevout.hash, n=0))]
+            unsigned_tx.vout = [CTxOut(nValue=txout.nValue, scriptPubKey=txout.scriptPubKey) for txout in finalized_tx.vout]
+
+            psbt = PSBT(
+                g=PSBTMap({PSBT_GLOBAL_UNSIGNED_TX: unsigned_tx.serialize_without_witness()}),
+                i=[PSBTMap({
+                    PSBT_IN_NON_WITNESS_UTXO: prev_tx.serialize_without_witness(),
+                    PSBT_IN_FINAL_SCRIPTSIG: final_script_sig,
+                })],
+                o=[PSBTMap() for _ in unsigned_tx.vout],
+            )
+            return psbt.to_base64(), finalized_tx.serialize_without_witness().hex()
+
+        valid_psbt, valid_hex = make_psbt(commit_final_script_sigs=True)
+        analysis = node.analyzepsbt(valid_psbt)
+        assert_equal(analysis["next"], "extractor")
+        assert "error" not in analysis
+
+        finalized = node.finalizepsbt(valid_psbt)
+        assert_equal(finalized["complete"], True)
+        assert_equal(finalized["hex"], valid_hex)
+
+        invalid_psbt, _ = make_psbt(commit_final_script_sigs=False)
+        analysis = node.analyzepsbt(invalid_psbt)
+        assert_equal(analysis["next"], "creator")
+        assert_equal(analysis["error"], "PSBT is not valid. Finalized transaction failed script verification")
+
+        finalized = node.finalizepsbt(invalid_psbt)
+        assert_equal(finalized["complete"], False)
+        assert "hex" not in finalized
+
     def run_test(self):
         # Create and fund a raw tx for sending 10 BTC
         psbtx1 = self.nodes[0].walletcreatefundedpsbt([], {self.nodes[2].getnewaddress():10})['psbt']
 
+        self.log.info("Test finalized PSBT precomputation with non-empty CTV scriptSigs")
+        self.test_finalized_ctv_psbt_precomputation()
+
         self.log.info("Test for invalid maximum transaction weights")
         dest_arg = [{self.nodes[0].getnewaddress(): 1}]
         min_tx_weight = MIN_STANDARD_TX_NONWITNESS_SIZE * WITNESS_SCALE_FACTOR
diff --git a/test/functional/test_framework/script.py b/test/functional/test_framework/script.py
index 3f078ea75d85..7d8e669fe526 100644
--- a/test/functional/test_framework/script.py
+++ b/test/functional/test_framework/script.py
@@ -33,6 +33,8 @@
 KEY_VERSION_TAPROOT = 0x00
 KEY_VERSION_ANYPREVOUT = 0x01
 
+LEAF_VERSION_TAPSCRIPT_V2 = 0xc2
+
 
 def hash160(s):
     return ripemd160(sha256(s))
diff --git a/test/functional/test_runner.py b/test/functional/test_runner.py
index 38cdd02f10dc..97fb7255479a 100755
--- a/test/functional/test_runner.py
+++ b/test/functional/test_runner.py
@@ -95,6 +95,8 @@
     # vv Tests less than 5m vv
     'feature_fee_estimation.py',
     'feature_taproot.py',
+    'feature_tapscript_v2.py',
+    'feature_tapscript_v2_taproot.py',
     'feature_block.py',
     'mempool_ephemeral_dust.py',
     'wallet_conflicts.py --legacy-wallet',
diff --git a/test/lint/lint-includes.py b/test/lint/lint-includes.py
index 05780c307467..cfe002ec80ef 100755
--- a/test/lint/lint-includes.py
+++ b/test/lint/lint-includes.py
@@ -29,6 +29,7 @@
                            "boost/multi_index/sequenced_index.hpp",
                            "boost/multi_index/tag.hpp",
                            "boost/multi_index_container.hpp",
+                           "boost/multiprecision/cpp_int.hpp",
                            "boost/operators.hpp",
                            "boost/signals2/connection.hpp",
                            "boost/signals2/optional_last_value.hpp",
diff --git a/test/sanitizer_suppressions/ubsan b/test/sanitizer_suppressions/ubsan
index 6e636b56b8e7..b2a607ce71bb 100644
--- a/test/sanitizer_suppressions/ubsan
+++ b/test/sanitizer_suppressions/ubsan
@@ -9,6 +9,7 @@
 # ------------
 # Suppressions in dependencies that are developed outside this repository.
 unsigned-integer-overflow:*/include/c++/
+unsigned-integer-overflow:*/include/boost/multiprecision/
 unsigned-integer-overflow:FuzzedDataProvider::ConsumeIntegralInRange
 unsigned-integer-overflow:leveldb/
 unsigned-integer-overflow:minisketch/
diff --git a/vcpkg.json b/vcpkg.json
index d5dfb05ebe04..e7aa86432bb3 100644
--- a/vcpkg.json
+++ b/vcpkg.json
@@ -4,6 +4,7 @@
   "builtin-baseline": "c82f74667287d3dc386bce81e44964370c91a289",
   "dependencies": [
     "boost-multi-index",
+    "boost-multiprecision",
     "boost-signals2",
     "libevent"
   ],