diff --git a/doc/release-notes-data-outputs.md b/doc/release-notes-data-outputs.md
new file mode 100644
index 000000000000..9dae5d7a6282
--- /dev/null
+++ b/doc/release-notes-data-outputs.md
@@ -0,0 +1,13 @@
+Policy
+------
+
+- Outputs whose hash or key field is data rather than a hash or key now count
+  as data carrier bytes, so under the default settings a transaction carrying
+  them is rejected with `txn-datacarrier-nonstandard`. This covers payloads
+  spread over three or more distinct P2WSH outputs that share one value of
+  546 sat or less (the OLGA layout, whatever magic it uses), taproot outputs
+  whose key is not on the curve, and any hash with one byte value repeated
+  eight times or six times in a row. Lightning anchor outputs, ordinals
+  postage and outputs to the all-zero burn hash are unaffected. The new
+  `-rejectfakeoutputs` option (default: 1, reset by `-corepolicy`) turns the
+  detection off without accepting other non-standard data carriers.
diff --git a/doc/release-notes-dead-branch-data.md b/doc/release-notes-dead-branch-data.md
new file mode 100644
index 000000000000..b96b71fa8138
--- /dev/null
+++ b/doc/release-notes-dead-branch-data.md
@@ -0,0 +1,12 @@
+Policy
+------
+
+- Data in a conditional part that constants make unreachable now counts as
+  data carrier bytes, so under the default settings a transaction carrying it
+  is rejected with `txn-datacarrier-nonstandard`. This already applied to the
+  `OP_FALSE OP_IF ... OP_ENDIF` inscription envelope; it now also covers
+  `OP_1 OP_NOTIF ... OP_ENDIF`, guards computed from constants, and the dead
+  part of an `OP_ELSE`. Scripts that branch on witness data or a signature
+  check, which is how spendable scripts branch, are unaffected. The new
+  `-rejectdeadbranches` option (default: 1, reset by `-corepolicy`) turns the
+  wider rule off and leaves only the envelope counted.
diff --git a/src/init.cpp b/src/init.cpp
index 1d75c41925b5..fced0af4ad1a 100644
--- a/src/init.cpp
+++ b/src/init.cpp
@@ -721,7 +721,9 @@ void SetupServerArgs(ArgsManager& argsman, bool can_listen_ipc)
     argsman.AddArg("-bytespersigopstrict", strprintf("Minimum bytes per sigop in transactions we relay and mine (default: %u)", DEFAULT_BYTES_PER_SIGOP_STRICT), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
     argsman.AddArg("-datacarrier", strprintf("Relay and mine data carrier transactions (default: %u)", DEFAULT_ACCEPT_DATACARRIER), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
     argsman.AddArg("-datacarriercost", strprintf("Treat extra data in transactions as at least N vbytes per actual byte (default: %s)", DEFAULT_WEIGHT_PER_DATA_BYTE / 4.0), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
+    argsman.AddArg("-rejectdeadbranches", strprintf("Count data in a conditional branch that a pushed constant makes unreachable as data carrier bytes; the OP_FALSE OP_IF envelope is counted either way (default: %u)", DEFAULT_REJECT_DEAD_BRANCHES), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
     argsman.AddArg("-datacarrierfullcount", strprintf("Apply datacarriersize limit to all known datacarrier methods (default: %u)", DEFAULT_DATACARRIER_FULLCOUNT), ArgsManager::ALLOW_ANY | (DEFAULT_DATACARRIER_FULLCOUNT ? uint32_t{ArgsManager::DEBUG_ONLY} : 0), OptionsCategory::NODE_RELAY);
+    argsman.AddArg("-rejectfakeoutputs", strprintf("Count outputs whose hash or key is data as data carrier bytes (default: %u)", DEFAULT_REJECT_FAKE_OUTPUTS), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
     argsman.AddArg("-datacarriersize",
                    strprintf("Maximum size of data in data carrier transactions we relay and mine, in bytes (default: %u)",
                              MAX_OP_RETURN_RELAY),
@@ -870,9 +872,11 @@ void InitParameterInteraction(ArgsManager& args)
         args.SoftSetArg("-permitbaremultisig", "1");
         args.SoftSetArg("-rejectparasites", "0");
         args.SoftSetArg("-rejecttokens", "0");
+        args.SoftSetArg("-rejectfakeoutputs", "0");
         args.SoftSetArg("-subdustfeepenalty", "0");
         args.SoftSetArg("-datacarriercost", "0.25");
         args.SoftSetArg("-datacarrierfullcount", "0");
+        args.SoftSetArg("-rejectdeadbranches", "0");
         args.SoftSetArg("-maxtxlegacysigops", strprintf("%s", std::numeric_limits<unsigned int>::max()));
         args.SoftSetArg("-maxscriptsize", strprintf("%s", std::numeric_limits<unsigned int>::max()));
         args.SoftSetArg("-mempooltruc", "enforce");
@@ -1213,6 +1217,8 @@ bool AppInitParameterInteraction(const ArgsManager& args)
 
     g_script_size_policy_limit = args.GetIntArg("-maxscriptsize", g_script_size_policy_limit);
 
+    g_reject_dead_branches = args.GetBoolArg("-rejectdeadbranches", g_reject_dead_branches);
+
     nBytesPerSigOp = args.GetIntArg("-bytespersigop", nBytesPerSigOp);
     nBytesPerSigOpStrict = args.GetIntArg("-bytespersigopstrict", nBytesPerSigOpStrict);
 
diff --git a/src/kernel/mempool_options.h b/src/kernel/mempool_options.h
index 0ce9ac96b1e5..4191612b4e0c 100644
--- a/src/kernel/mempool_options.h
+++ b/src/kernel/mempool_options.h
@@ -80,6 +80,7 @@ struct MemPoolOptions {
      */
     std::optional<unsigned> max_datacarrier_bytes{DEFAULT_ACCEPT_DATACARRIER ? std::optional{MAX_OP_RETURN_RELAY} : std::nullopt};
     bool datacarrier_fullcount{DEFAULT_DATACARRIER_FULLCOUNT};
+    bool reject_fake_outputs{DEFAULT_REJECT_FAKE_OUTPUTS};
     bool permitbaredatacarrier{DEFAULT_PERMITBAREDATACARRIER};
     bool permitbareanchor{DEFAULT_PERMITBAREANCHOR};
     bool permit_bare_pubkey{DEFAULT_PERMIT_BAREPUBKEY};
diff --git a/src/node/mempool_args.cpp b/src/node/mempool_args.cpp
index 76afdd23c32a..b0c6d6408990 100644
--- a/src/node/mempool_args.cpp
+++ b/src/node/mempool_args.cpp
@@ -205,6 +205,8 @@ util::Result<void> ApplyArgsManOptions(const ArgsManager& argsman, const CChainP
 
     mempool_opts.reject_tokens = argsman.GetBoolArg("-rejecttokens", DEFAULT_REJECT_TOKENS);
 
+    mempool_opts.reject_fake_outputs = argsman.GetBoolArg("-rejectfakeoutputs", DEFAULT_REJECT_FAKE_OUTPUTS);
+
     mempool_opts.subdustfeepenalty = argsman.GetBoolArg("-subdustfeepenalty", DEFAULT_SUBDUSTFEEPENALTY);
 
     if (argsman.GetBoolArg("-datacarrier", DEFAULT_ACCEPT_DATACARRIER)) {
diff --git a/src/node/psbt.cpp b/src/node/psbt.cpp
index 37b8bd02ccdb..c6c05c0af67e 100644
--- a/src/node/psbt.cpp
+++ b/src/node/psbt.cpp
@@ -138,7 +138,7 @@ PSBTAnalysis AnalyzePSBT(PartiallySignedTransaction psbtx)
 
         if (success) {
             CTransaction ctx = CTransaction(mtx);
-            size_t size(GetVirtualTransactionSize(GetTransactionWeight(ctx) + CalculateExtraTxWeight(ctx, view, ::g_weight_per_data_byte), GetTransactionSigOpCost(ctx, view, STANDARD_SCRIPT_VERIFY_FLAGS), ::nBytesPerSigOp));
+            size_t size(GetVirtualTransactionSize(GetTransactionWeight(ctx) + CalculateExtraTxWeight(ctx, view, ::g_weight_per_data_byte, DataOutputBytes(ctx, &view)), GetTransactionSigOpCost(ctx, view, STANDARD_SCRIPT_VERIFY_FLAGS), ::nBytesPerSigOp));
             result.estimated_vsize = size;
             // Estimate fee rate
             CFeeRate feerate(fee, size);
diff --git a/src/policy/policy.cpp b/src/policy/policy.cpp
index 679c0c967a1f..d27ae10cc012 100644
--- a/src/policy/policy.cpp
+++ b/src/policy/policy.cpp
@@ -15,6 +15,7 @@
 #include <policy/feerate.h>
 #include <policy/settings.h>
 #include <primitives/transaction.h>
+#include <pubkey.h>
 #include <script/interpreter.h>
 #include <script/script.h>
 #include <script/solver.h>
@@ -27,12 +28,16 @@
 #include <array>
 #include <cstddef>
 #include <limits>
+#include <map>
+#include <numeric>
 #include <optional>
+#include <set>
 #include <string_view>
 #include <utility>
 #include <vector>
 
 unsigned int g_script_size_policy_limit{DEFAULT_SCRIPT_SIZE_POLICY_LIMIT};
+bool g_reject_dead_branches{DEFAULT_REJECT_DEAD_BRANCHES};
 
 CAmount GetDustThreshold(const CTxOut& txout, const CFeeRate& dustRelayFeeIn)
 {
@@ -633,14 +638,152 @@ std::pair<CScript, unsigned int> GetScriptForTransactionInput(CScript prevScript
     return std::make_pair(CScript(), 0);
 }
 
-std::pair<size_t, size_t> DatacarrierBytes(const CTransaction& tx, const CCoinsViewCache& view)
+namespace {
+
+/** The hash or x-only key of a single-hash output type; empty for any other script. */
+std::vector<unsigned char> OutputProgram(const CScript& script, TxoutType& type)
+{
+    std::vector<std::vector<unsigned char>> solutions;
+    type = Solver(script, solutions);
+    switch (type) {
+    case TxoutType::PUBKEYHASH:
+    case TxoutType::SCRIPTHASH:
+    case TxoutType::WITNESS_V0_KEYHASH:
+    case TxoutType::WITNESS_V0_SCRIPTHASH:
+    case TxoutType::WITNESS_V1_TAPROOT:
+        return solutions[0];
+    default:
+        return {};
+    }
+}
+
+/**
+ * A hash or x-only key is uniformly random. One byte value turning up
+ * DATA_OUTPUT_BYTE_MULTIPLICITY times has probability 1.3e-10 in 32 random
+ * bytes and 1.7e-12 in 20; a run of DATA_OUTPUT_BYTE_RUN identical bytes
+ * 2.5e-11 and 1.4e-11. Length prefixes, headers, padding and plain text all
+ * trip one or the other. The all-zero hash is the conventional burn address
+ * and carries no payload, so it is left alone.
+ */
+bool ProgramLooksLikeData(const std::vector<unsigned char>& program)
+{
+    if (std::all_of(program.begin(), program.end(), [](unsigned char b) { return b == 0; })) return false;
+    unsigned int counts[256]{};
+    unsigned int run{0};
+    unsigned char last{0};
+    for (const unsigned char b : program) {
+        if (++counts[b] >= DATA_OUTPUT_BYTE_MULTIPLICITY) return true;
+        run = (run && b == last) ? run + 1 : 1;
+        if (run >= DATA_OUTPUT_BYTE_RUN) return true;
+        last = b;
+    }
+    return false;
+}
+
+} // namespace
+
+std::vector<size_t> DataOutputBytes(const CTransaction& tx, const CCoinsViewCache* view)
+{
+    const size_t n{tx.vout.size()};
+    // Outputs that pay the script of a coin this transaction spends, such as change
+    // back to a vanity address; looked up by script without copying any
+    std::vector<bool> spent(n, false);
+    if (view && n) {
+        std::vector<size_t> by_script(n);
+        std::iota(by_script.begin(), by_script.end(), 0);
+        const auto script_order = [&tx](size_t a, size_t b) { return tx.vout[a].scriptPubKey < tx.vout[b].scriptPubKey; };
+        std::sort(by_script.begin(), by_script.end(), script_order);
+        for (const CTxIn& txin : tx.vin) {
+            const Coin& coin{view->AccessCoin(txin.prevout)};
+            if (coin.IsSpent()) continue;
+            const CScript& script{coin.out.scriptPubKey};
+            auto it{std::lower_bound(by_script.begin(), by_script.end(), script, [&tx](size_t a, const CScript& s) { return tx.vout[a].scriptPubKey < s; })};
+            // The outputs paying one script sit together and are marked together, so
+            // a script already seen is skipped: each output is visited at most once
+            if (it == by_script.end() || spent[*it]) continue;
+            for (; it != by_script.end() && tx.vout[*it].scriptPubKey == script; ++it) spent[*it] = true;
+        }
+    }
+    std::vector<size_t> program_size(n, 0);
+    std::vector<TxoutType> types(n, TxoutType::NONSTANDARD);
+    std::vector<bool> in_run(n, false);
+    std::vector<bool> data(n, false);
+    std::vector<bool> covered(n, false);
+    std::map<CAmount, std::set<std::vector<unsigned char>>> run_programs;
+    unsigned int curve_checks{0};
+
+    for (size_t i{0}; i < n; ++i) {
+        const CTxOut& txout{tx.vout[i]};
+        if (covered[i]) continue;
+        if (const size_t olga_bytes{txout.scriptPubKey.IsOLGA(n - i)}; olga_bytes) {
+            // The OLGA detector counts this header and its chunks already
+            const size_t olga_outputs{olga_bytes / (WITNESS_V0_SCRIPTHASH_SIZE + /* script length */ 1 + /* amount */ 8)};
+            for (size_t j{i}; j < std::min(n, i + olga_outputs); ++j) covered[j] = true;
+            continue;
+        }
+        const auto program{OutputProgram(txout.scriptPubKey, types[i])};
+        if (program.empty()) continue;
+        program_size[i] = program.size();
+        if (spent[i]) {
+            // A real hash or key, whatever it looks like
+        } else if (ProgramLooksLikeData(program)) {
+            data[i] = true;
+        } else if (types[i] == TxoutType::WITNESS_V1_TAPROOT && curve_checks < DATA_OUTPUT_CURVE_CHECKS) {
+            // Not a point on the curve: nobody can ever spend this. The check
+            // costs a field square root, so only the first
+            // DATA_OUTPUT_CURVE_CHECKS taproot outputs get it. A whitened
+            // chunk is off the curve half the time, so a payload among them
+            // trips this and the sibling rule marks the rest of its chunks.
+            ++curve_checks;
+            if (!XOnlyPubKey{program}.IsFullyValid()) data[i] = true;
+        }
+        if (types[i] == TxoutType::WITNESS_V0_SCRIPTHASH && txout.nValue <= DATA_OUTPUT_RUN_MAX_VALUE) {
+            in_run[i] = true;
+            run_programs[txout.nValue].insert(program);
+        }
+    }
+
+    // A payload is spread over several outputs, and its other chunks may be
+    // whitened, so anything caught marks its siblings of the same type and
+    // value. Separately, DATA_OUTPUT_DUST_RUN or more distinct P2WSH outputs
+    // sharing one small value are data on their own: encoders pay every chunk
+    // the same, Lightning anchors come in pairs and HTLC amounts differ, and
+    // padding repeats one script. Taproot is left to the curve check, since a
+    // run of small taproot outputs is ordinals postage, not a payload.
+    std::set<std::pair<TxoutType, CAmount>> data_groups;
+    for (size_t i{0}; i < n; ++i) {
+        if (data[i]) data_groups.emplace(types[i], tx.vout[i].nValue);
+    }
+    std::vector<size_t> ret(n, 0);
+    for (size_t i{0}; i < n; ++i) {
+        if (!program_size[i] || spent[i]) continue;
+        const bool sibling{data_groups.count({types[i], tx.vout[i].nValue}) > 0};
+        const bool dust_run{in_run[i] && run_programs[tx.vout[i].nValue].size() >= DATA_OUTPUT_DUST_RUN};
+        if (data[i] || sibling || dust_run) {
+            ret[i] = program_size[i] + /* script length */ 1 + /* amount */ 8;
+        }
+    }
+    return ret;
+}
+
+/**
+ * Whether to look for dead branches in this input. A witness over the script size
+ * limit fails IsWitnessStandard right after, so following its constants would be
+ * work spent on a transaction that is rejected anyway.
+ */
+static bool FollowDeadBranches(const CTxIn& txin)
+{
+    return ::g_reject_dead_branches && GetSerializeSize(txin.scriptWitness.stack) <= g_script_size_policy_limit;
+}
+
+std::pair<size_t, size_t> DatacarrierBytes(const CTransaction& tx, const CCoinsViewCache& view, const std::vector<size_t>& data_outputs)
 {
     std::pair<size_t, size_t> ret{0, 0};
 
     for (const CTxIn& txin : tx.vin) {
         const CTxOut &utxo = view.AccessCoin(txin.prevout).out;
         auto[script, consensus_weight_per_byte] = GetScriptForTransactionInput(utxo.scriptPubKey, txin);
-        const auto dcb = script.DatacarrierBytes(0, &txin.scriptWitness);
+        const auto dcb = script.DatacarrierBytes(0, &txin.scriptWitness, FollowDeadBranches(txin));
         ret.first += dcb.first;
         ret.second += dcb.second;
     }
@@ -648,13 +791,14 @@ std::pair<size_t, size_t> DatacarrierBytes(const CTransaction& tx, const CCoinsV
         const CTxOut& txout = tx.vout[--i];
         const auto dcb = txout.scriptPubKey.DatacarrierBytes(tx.vout.size() - i);
         ret.first += dcb.first;
-        ret.second += dcb.second;
+        // An OLGA header counts its whole payload, so keep the larger figure
+        ret.second += std::max(dcb.second, data_outputs[i]);
     }
 
     return ret;
 }
 
-int32_t CalculateExtraTxWeight(const CTransaction& tx, const CCoinsViewCache& view, const unsigned int weight_per_data_byte)
+int32_t CalculateExtraTxWeight(const CTransaction& tx, const CCoinsViewCache& view, const unsigned int weight_per_data_byte, const std::vector<size_t>& data_outputs)
 {
     int64_t mod_weight{0};
 
@@ -664,7 +808,7 @@ int32_t CalculateExtraTxWeight(const CTransaction& tx, const CCoinsViewCache& vi
             const CTxOut &utxo = view.AccessCoin(txin.prevout).out;
             auto[script, consensus_weight_per_byte] = GetScriptForTransactionInput(utxo.scriptPubKey, txin);
             if (weight_per_data_byte > consensus_weight_per_byte) {
-                const auto dcb = script.DatacarrierBytes(0, &txin.scriptWitness);
+                const auto dcb = script.DatacarrierBytes(0, &txin.scriptWitness, FollowDeadBranches(txin));
                 mod_weight += int64_t(dcb.first + dcb.second) * (weight_per_data_byte - consensus_weight_per_byte);
             }
         }
@@ -672,7 +816,7 @@ int32_t CalculateExtraTxWeight(const CTransaction& tx, const CCoinsViewCache& vi
             for (size_t i{tx.vout.size()}; i; ) {
                 const CTxOut& txout = tx.vout[--i];
                 const auto dcb = txout.scriptPubKey.DatacarrierBytes(tx.vout.size() - i);
-                mod_weight += int64_t(dcb.first + dcb.second) * (weight_per_data_byte - WITNESS_SCALE_FACTOR);
+                mod_weight += int64_t(std::max(dcb.first + dcb.second, data_outputs[i])) * (weight_per_data_byte - WITNESS_SCALE_FACTOR);
             }
         }
     }
diff --git a/src/policy/policy.h b/src/policy/policy.h
index 6c52b6aebff2..0f016c592181 100644
--- a/src/policy/policy.h
+++ b/src/policy/policy.h
@@ -64,8 +64,12 @@ static constexpr unsigned int DEFAULT_BYTES_PER_SIGOP{20};
 static constexpr unsigned int DEFAULT_BYTES_PER_SIGOP_STRICT{20};
 /** Default for -datacarriercost (multiplied by WITNESS_SCALE_FACTOR) */
 static constexpr unsigned int DEFAULT_WEIGHT_PER_DATA_BYTE{4};
+/** Default for -rejectdeadbranches */
+static constexpr bool DEFAULT_REJECT_DEAD_BRANCHES{true};
 /** Default for -rejecttokens */
 static constexpr bool DEFAULT_REJECT_TOKENS{true};
+/** Default for -rejectfakeoutputs */
+static constexpr bool DEFAULT_REJECT_FAKE_OUTPUTS{true};
 /** Default for -subdustfeepenalty */
 static constexpr bool DEFAULT_SUBDUSTFEEPENALTY{true};
 
@@ -240,8 +244,31 @@ static inline int64_t GetVirtualTransactionInputSize(const CTxIn& tx)
 
 std::pair<CScript, unsigned int> GetScriptForTransactionInput(CScript prevScript, const CTxIn&);
 
-std::pair<size_t, size_t> DatacarrierBytes(const CTransaction& tx, const CCoinsViewCache& view);
+/** A byte value seen this many times in one hash or key marks the output as data */
+static constexpr unsigned int DATA_OUTPUT_BYTE_MULTIPLICITY{8};
+/** A run of identical bytes this long in one hash or key marks the output as data */
+static constexpr unsigned int DATA_OUTPUT_BYTE_RUN{6};
+/** Distinct P2WSH outputs sharing one value of at most DATA_OUTPUT_RUN_MAX_VALUE are data from this many up */
+static constexpr unsigned int DATA_OUTPUT_DUST_RUN{3};
+/** Highest output value a data run is looked for at; batch payouts appear from 600 sat up */
+static constexpr CAmount DATA_OUTPUT_RUN_MAX_VALUE{546};
+/** Taproot outputs per transaction whose key is checked to be on the curve */
+static constexpr unsigned int DATA_OUTPUT_CURVE_CHECKS{64};
 
-int32_t CalculateExtraTxWeight(const CTransaction& tx, const CCoinsViewCache& view, const unsigned int weight_per_data_byte);
+/**
+ * Find outputs whose hash or key field carries data rather than a hash or key.
+ * Returns, per output, the bytes it spends on that data (program, script
+ * length and amount, as counted for OLGA), or 0 for a real output or one the
+ * OLGA detector already counts. With a view, an output whose script is the
+ * script of a coin the transaction spends is real and never counted: the
+ * spender can spend that coin, and a chosen hash or key costs at least 2^128
+ * work (a taproot key's discrete log), so the most it can carry is a ground
+ * prefix such as a vanity address.
+ */
+std::vector<size_t> DataOutputBytes(const CTransaction& tx, const CCoinsViewCache* view = nullptr);
+
+std::pair<size_t, size_t> DatacarrierBytes(const CTransaction& tx, const CCoinsViewCache& view, const std::vector<size_t>& data_outputs);
+
+int32_t CalculateExtraTxWeight(const CTransaction& tx, const CCoinsViewCache& view, const unsigned int weight_per_data_byte, const std::vector<size_t>& data_outputs);
 
 #endif // BITCOIN_POLICY_POLICY_H
diff --git a/src/policy/settings.h b/src/policy/settings.h
index 03cfc3775da1..6c60e3ecef64 100644
--- a/src/policy/settings.h
+++ b/src/policy/settings.h
@@ -10,5 +10,6 @@ extern unsigned int g_script_size_policy_limit;
 extern unsigned int nBytesPerSigOp;
 extern unsigned int nBytesPerSigOpStrict;
 extern unsigned int g_weight_per_data_byte;
+extern bool g_reject_dead_branches;
 
 #endif // BITCOIN_POLICY_SETTINGS_H
diff --git a/src/script/script.cpp b/src/script/script.cpp
index fbb52fee7f9b..caba9af5b8c1 100644
--- a/src/script/script.cpp
+++ b/src/script/script.cpp
@@ -8,10 +8,12 @@
 #include <crypto/common.h>
 #include <crypto/hex_base.h>
 #include <hash.h>
+#include <pubkey.h>
 #include <script/interpreter.h>
 #include <uint256.h>
 #include <util/hash_type.h>
 
+#include <algorithm>
 #include <string>
 
 CScriptID::CScriptID(const CScript& in) : BaseHash(Hash160(in)) {}
@@ -304,6 +306,388 @@ bool CScript::HasValidOps() const
     return true;
 }
 
+// Static truthiness of a byte vector, matching CastToBool in the interpreter:
+// any nonzero byte is true, except a lone trailing sign bit (negative zero).
+static bool DataCarrierCastToBool(const std::vector<unsigned char>& vch)
+{
+    for (size_t i = 0; i < vch.size(); ++i) {
+        if (vch[i] != 0) {
+            if (i == vch.size() - 1 && vch[i] == 0x80) return false;
+            return true;
+        }
+    }
+    return false;
+}
+
+namespace {
+/** A value on the stack that follows from constants alone, as an index into KnownValues; 0 if it depends on the witness or a signature */
+using KnownValue = size_t;
+constexpr KnownValue UNKNOWN{0};
+
+/** The values FindDeadParts has seen; the stacks hold indexes, so copying a value costs nothing */
+class KnownValues
+{
+    std::vector<std::vector<unsigned char>> m_values{{}};
+
+public:
+    KnownValue Add(std::vector<unsigned char> v)
+    {
+        m_values.push_back(std::move(v));
+        return m_values.size() - 1;
+    }
+    KnownValue AddNum(int64_t n) { return Add(CScriptNum{n}.getvch()); }
+    const std::vector<unsigned char>& Get(KnownValue v) const { return m_values[v]; }
+    /** The value as a script number, if it is known and a valid one */
+    bool Num(KnownValue v, int64_t& out) const
+    {
+        if (v == UNKNOWN) return false;
+        try {
+            out = CScriptNum{m_values[v], /*fRequireMinimal=*/true}.GetInt64();
+            return true;
+        } catch (const scriptnum_error&) {
+            return false;
+        }
+    }
+};
+
+/** Byte offsets of the OP_IF/OP_NOTIF whose first part, and the OP_ELSE whose part, a constant guard makes unreachable */
+struct DeadParts {
+    std::vector<bool> at_if, at_else;
+};
+
+/** The top of the stack as far as constants determine it; below it nothing is known */
+class KnownStack
+{
+    std::vector<KnownValue> m_items;
+
+public:
+    size_t size() const { return m_items.size(); }
+    void Push(KnownValue v)
+    {
+        m_items.push_back(std::move(v));
+        if (m_items.size() > MAX_STACK_SIZE) Forget(); // the script fails here anyway
+    }
+    KnownValue Pop()
+    {
+        if (m_items.empty()) return UNKNOWN;
+        KnownValue v{std::move(m_items.back())};
+        m_items.pop_back();
+        return v;
+    }
+    KnownValue Peek(size_t depth) const { return depth < m_items.size() ? m_items[m_items.size() - 1 - depth] : UNKNOWN; }
+    KnownValue& At(size_t depth) { return m_items[m_items.size() - 1 - depth]; }
+    void Forget() { m_items.clear(); }
+};
+
+/**
+ * Follow the script as far as constants determine it and mark the conditional
+ * parts that can never run. Anything read from the witness, a signature check,
+ * a hash or an opcode not modeled here is unknown, and an unknown condition
+ * marks nothing, so a spendable script is never read as dead.
+ */
+DeadParts FindDeadParts(const CScript& script)
+{
+    DeadParts dead{std::vector<bool>(script.size()), std::vector<bool>(script.size())};
+    // Per open conditional: whether constants decide it, and whether its current part runs
+    struct Frame { bool known; bool running; };
+    std::vector<Frame> frames;
+    size_t not_running{0}; // open frames whose current part does not run
+    KnownValues values;
+    KnownStack stack, alt;
+    opcodetype opcode;
+    std::vector<unsigned char> push;
+    // Each opcode costs one step, and OP_ROLL also costs its depth, the one move
+    // that is not constant time. Stop, marking nothing more, after a few steps per
+    // byte: no spendable script rolls deep over and over, and one built to do so
+    // gets the plain scan instead of costing the node more than its size.
+    size_t steps_left{4 * size_t{script.size()}};
+
+    for (CScript::const_iterator it{script.begin()}; it < script.end();) {
+        const size_t offset{size_t(it - script.begin())};
+        if (!script.GetOp(it, opcode, push)) break;
+        if (steps_left == 0) break;
+        --steps_left;
+
+        if (opcode == OP_IF || opcode == OP_NOTIF) {
+            if (not_running) {
+                frames.push_back({true, false});
+                ++not_running;
+                continue;
+            }
+            const KnownValue cond{stack.Pop()};
+            if (cond != UNKNOWN) {
+                const bool runs{DataCarrierCastToBool(values.Get(cond)) == (opcode == OP_IF)};
+                if (!runs) {
+                    dead.at_if[offset] = true;
+                    ++not_running;
+                }
+                frames.push_back({true, runs});
+            } else {
+                frames.push_back({false, true});
+            }
+            continue;
+        }
+        if (opcode == OP_ELSE || opcode == OP_ENDIF) {
+            if (frames.empty()) break; // unbalanced: the script cannot run
+            Frame& frame{frames.back()};
+            const bool outer_running{not_running == (frame.running ? 0 : 1)};
+            if (opcode == OP_ELSE) {
+                if (frame.known && outer_running) {
+                    frame.running = !frame.running;
+                    if (frame.running) {
+                        --not_running;
+                    } else {
+                        ++not_running;
+                        dead.at_else[offset] = true;
+                    }
+                } else if (!frame.known) {
+                    // The else part starts from the state before the OP_IF, which is not kept
+                    stack.Forget();
+                    alt.Forget();
+                }
+            } else {
+                if (!frame.running) --not_running;
+                if (!frame.known && not_running == 0) {
+                    stack.Forget();
+                    alt.Forget();
+                }
+                frames.pop_back();
+            }
+            continue;
+        }
+        if (not_running) continue;
+
+        if (opcode <= OP_PUSHDATA4) {
+            stack.Push(values.Add(push));
+            continue;
+        }
+        if (opcode == OP_1NEGATE || (opcode >= OP_1 && opcode <= OP_16)) {
+            stack.Push(values.AddNum(opcode == OP_1NEGATE ? -1 : CScript::DecodeOP_N(opcode)));
+            continue;
+        }
+        switch (opcode) {
+        case OP_NOP: case OP_NOP1: case OP_CHECKLOCKTIMEVERIFY: case OP_CHECKSEQUENCEVERIFY:
+        case OP_NOP4: case OP_NOP5: case OP_NOP6: case OP_NOP7: case OP_NOP8: case OP_NOP9: case OP_NOP10:
+        case OP_CODESEPARATOR:
+            break;
+        case OP_VERIFY: case OP_DROP:
+            stack.Pop();
+            break;
+        case OP_2DROP:
+            stack.Pop();
+            stack.Pop();
+            break;
+        case OP_TOALTSTACK:
+            alt.Push(stack.Pop());
+            break;
+        case OP_FROMALTSTACK:
+            stack.Push(alt.Pop());
+            break;
+        case OP_DUP:
+            stack.Push(stack.Peek(0));
+            break;
+        case OP_OVER:
+            stack.Push(stack.Peek(1));
+            break;
+        case OP_2DUP: {
+            const KnownValue a{stack.Peek(1)}, b{stack.Peek(0)};
+            stack.Push(a);
+            stack.Push(b);
+            break;
+        }
+        case OP_3DUP: {
+            const KnownValue a{stack.Peek(2)}, b{stack.Peek(1)}, c{stack.Peek(0)};
+            stack.Push(a);
+            stack.Push(b);
+            stack.Push(c);
+            break;
+        }
+        case OP_2OVER: {
+            const KnownValue a{stack.Peek(3)}, b{stack.Peek(2)};
+            stack.Push(a);
+            stack.Push(b);
+            break;
+        }
+        case OP_IFDUP: {
+            const KnownValue top{stack.Peek(0)};
+            if (top == UNKNOWN) {
+                stack.Forget(); // whether it duplicates is not known, so neither is the depth
+            } else if (DataCarrierCastToBool(values.Get(top))) {
+                stack.Push(top);
+            }
+            break;
+        }
+        case OP_SIZE: {
+            const KnownValue top{stack.Peek(0)};
+            stack.Push(top == UNKNOWN ? UNKNOWN : values.AddNum(values.Get(top).size()));
+            break;
+        }
+        case OP_DEPTH:
+            stack.Push(UNKNOWN);
+            break;
+        case OP_NIP: case OP_SWAP: case OP_TUCK: case OP_ROT: case OP_2SWAP: case OP_2ROT: {
+            const size_t need{opcode == OP_2ROT ? 6u : opcode == OP_2SWAP ? 4u : opcode == OP_ROT ? 3u : 2u};
+            if (stack.size() < need) {
+                stack.Forget();
+                break;
+            }
+            if (opcode == OP_NIP) {
+                const KnownValue top{stack.Pop()};
+                stack.Pop();
+                stack.Push(top);
+            } else if (opcode == OP_SWAP) {
+                std::swap(stack.At(0), stack.At(1));
+            } else if (opcode == OP_TUCK) {
+                const KnownValue top{stack.Pop()}, second{stack.Pop()};
+                stack.Push(top);
+                stack.Push(second);
+                stack.Push(top);
+            } else if (opcode == OP_ROT) {
+                std::swap(stack.At(2), stack.At(1));
+                std::swap(stack.At(1), stack.At(0));
+            } else if (opcode == OP_2SWAP) {
+                std::swap(stack.At(3), stack.At(1));
+                std::swap(stack.At(2), stack.At(0));
+            } else {
+                std::vector<KnownValue> six;
+                for (int i{0}; i < 6; ++i) six.push_back(stack.Pop());
+                // six[5] and six[4] were deepest; they move to the top
+                for (int i{3}; i >= 0; --i) stack.Push(six[i]);
+                stack.Push(six[5]);
+                stack.Push(six[4]);
+            }
+            break;
+        }
+        case OP_PICK: case OP_ROLL: {
+            int64_t n{0};
+            const bool known{values.Num(stack.Pop(), n)};
+            if (!known || n < 0 || size_t(n) >= stack.size()) {
+                // Reaches below what is known, or the depth itself is unknown
+                if (opcode == OP_ROLL || !known) stack.Forget();
+                stack.Push(UNKNOWN);
+                break;
+            }
+            const KnownValue v{stack.At(n)};
+            if (opcode == OP_ROLL) {
+                if (size_t(n) > steps_left) return dead;
+                steps_left -= n;
+                std::vector<KnownValue> above;
+                for (int64_t i{0}; i < n; ++i) above.push_back(stack.Pop());
+                stack.Pop();
+                for (auto i{above.rbegin()}; i != above.rend(); ++i) stack.Push(*i);
+            }
+            stack.Push(v);
+            break;
+        }
+        case OP_EQUAL: case OP_EQUALVERIFY: {
+            const KnownValue b{stack.Pop()}, a{stack.Pop()};
+            if (opcode == OP_EQUAL) {
+                stack.Push(a == UNKNOWN || b == UNKNOWN ? UNKNOWN : values.Add(values.Get(a) == values.Get(b) ? std::vector<unsigned char>{1} : std::vector<unsigned char>{}));
+            }
+            break;
+        }
+        case OP_1ADD: case OP_1SUB: case OP_NEGATE: case OP_ABS: case OP_NOT: case OP_0NOTEQUAL: {
+            int64_t a{0};
+            if (!values.Num(stack.Pop(), a)) {
+                stack.Push(UNKNOWN);
+                break;
+            }
+            int64_t r{};
+            switch (opcode) {
+            case OP_1ADD: r = a + 1; break;
+            case OP_1SUB: r = a - 1; break;
+            case OP_NEGATE: r = -a; break;
+            case OP_ABS: r = a < 0 ? -a : a; break;
+            case OP_NOT: r = a == 0; break;
+            default: r = a != 0; break;
+            }
+            stack.Push(values.AddNum(r));
+            break;
+        }
+        case OP_ADD: case OP_SUB: case OP_BOOLAND: case OP_BOOLOR: case OP_NUMEQUAL: case OP_NUMEQUALVERIFY:
+        case OP_NUMNOTEQUAL: case OP_LESSTHAN: case OP_GREATERTHAN: case OP_LESSTHANOREQUAL:
+        case OP_GREATERTHANOREQUAL: case OP_MIN: case OP_MAX: {
+            int64_t a{0}, b{0};
+            const bool known_b{values.Num(stack.Pop(), b)};
+            const bool known_a{values.Num(stack.Pop(), a)};
+            if (opcode == OP_NUMEQUALVERIFY) break;
+            if (!known_a || !known_b) {
+                stack.Push(UNKNOWN);
+                break;
+            }
+            int64_t r{};
+            switch (opcode) {
+            case OP_ADD: r = a + b; break;
+            case OP_SUB: r = a - b; break;
+            case OP_BOOLAND: r = a != 0 && b != 0; break;
+            case OP_BOOLOR: r = a != 0 || b != 0; break;
+            case OP_NUMEQUAL: r = a == b; break;
+            case OP_NUMNOTEQUAL: r = a != b; break;
+            case OP_LESSTHAN: r = a < b; break;
+            case OP_GREATERTHAN: r = a > b; break;
+            case OP_LESSTHANOREQUAL: r = a <= b; break;
+            case OP_GREATERTHANOREQUAL: r = a >= b; break;
+            case OP_MIN: r = a < b ? a : b; break;
+            default: r = a > b ? a : b; break;
+            }
+            stack.Push(values.AddNum(r));
+            break;
+        }
+        case OP_WITHIN: {
+            int64_t hi{0}, lo{0}, x{0};
+            const bool known_hi{values.Num(stack.Pop(), hi)};
+            const bool known_lo{values.Num(stack.Pop(), lo)};
+            const bool known_x{values.Num(stack.Pop(), x)};
+            stack.Push(known_hi && known_lo && known_x ? values.AddNum(lo <= x && x < hi) : UNKNOWN);
+            break;
+        }
+        case OP_RIPEMD160: case OP_SHA1: case OP_SHA256: case OP_HASH160: case OP_HASH256:
+            stack.Pop();
+            stack.Push(UNKNOWN);
+            break;
+        case OP_CHECKSIG:
+            stack.Pop();
+            stack.Pop();
+            stack.Push(UNKNOWN);
+            break;
+        case OP_CHECKSIGVERIFY:
+            stack.Pop();
+            stack.Pop();
+            break;
+        case OP_CHECKSIGADD:
+            stack.Pop();
+            stack.Pop();
+            stack.Pop();
+            stack.Push(UNKNOWN);
+            break;
+        case OP_CHECKMULTISIG: case OP_CHECKMULTISIGVERIFY: {
+            int64_t keys{0}, sigs{0};
+            if (!values.Num(stack.Pop(), keys) || keys < 0 || keys > MAX_PUBKEYS_PER_MULTISIG) {
+                stack.Forget();
+            } else {
+                for (int64_t i{0}; i < keys; ++i) stack.Pop();
+                if (!values.Num(stack.Pop(), sigs) || sigs < 0 || sigs > keys) {
+                    stack.Forget();
+                } else {
+                    for (int64_t i{0}; i < sigs + 1; ++i) stack.Pop(); // the signatures and the dummy
+                }
+            }
+            if (opcode == OP_CHECKMULTISIG) stack.Push(UNKNOWN);
+            break;
+        }
+        case OP_RETURN:
+            return dead; // the script fails here
+        default:
+            // Not modeled: forget what is known rather than guess
+            stack.Forget();
+            alt.Forget();
+            break;
+        }
+    }
+    return dead;
+}
+} // namespace
+
 size_t CScript::IsOLGA(const size_t remaining_outputs) const
 {
     if (!IsPayToWitnessScriptHash()) {
@@ -356,7 +740,221 @@ size_t CScript::OPNetWitnessSize(const CScriptWitness& witness) const
     return stack[0].size() + stack[3].size() - deduct;
 }
 
-std::pair<size_t, size_t> CScript::DatacarrierBytes(const size_t remaining_outputs, const CScriptWitness* witness) const
+/** Value of OP_1..OP_16, or -1 for any other opcode. CScript::DecodeOP_N asserts instead. */
+static int SmallIntValue(const opcodetype opcode)
+{
+    if (opcode < OP_1 || opcode > OP_16) return -1;
+    return int{opcode} - int{OP_1 - 1};
+}
+
+/** The m or n of an m-of-n, which above 16 is a minimal one byte push rather than an OP_N. */
+static int MultisigCount(const opcodetype opcode, const std::vector<unsigned char>& push_data)
+{
+    if (const int small{SmallIntValue(opcode)}; small > 0) return small;
+    if (opcode == 1 && push_data.size() == 1 && push_data[0] > 16 && push_data[0] <= MAX_PUBKEYS_PER_MULTISIG) {
+        return push_data[0];
+    }
+    return -1;
+}
+
+/**
+ * The k of a tapscript k-of-n, which allows far more keys than OP_CHECKMULTISIG does.
+ *
+ * A k from 1 to 16 is an OP_N as usual. Beyond the range OP_N reaches, k is instead a minimal
+ * push of the number: one byte up to 127, two beyond that, since a third would only ever hold
+ * the sign of a count that cannot be negative.
+ */
+static int MultiACount(const opcodetype opcode, const std::vector<unsigned char>& push_data)
+{
+    if (const int small{SmallIntValue(opcode)}; small > 0) return small;
+    if (opcode != 1 && opcode != 2) return -1;
+    if (push_data.size() != static_cast<size_t>(opcode)) return -1;
+    // The sign bit is never set here, and a zero high byte is minimal only where it keeps the
+    // byte below it from reading as the sign, as in 128 written 80 00.
+    if (push_data.back() & 0x80) return -1;
+    if (push_data.back() == 0 && (push_data.size() == 1 || !(push_data[0] & 0x80))) return -1;
+    int value{push_data[0]};
+    if (push_data.size() == 2) value |= int{push_data[1]} << 8;
+    if (value <= 16 || value > int{MAX_PUBKEYS_PER_MULTI_A}) return -1;
+    return value;
+}
+
+static bool IsPubkeyPush(const opcodetype opcode, const std::vector<unsigned char>& push_data)
+{
+    if (opcode > OP_PUSHDATA4) return false;
+    return push_data.size() == CPubKey::COMPRESSED_SIZE || push_data.size() == CPubKey::SIZE;
+}
+
+/** A 32 byte push, which is an x-only key where a checksig-family opcode claims it as one. */
+static bool IsXOnlyPush(const opcodetype opcode, const std::vector<unsigned char>& push_data)
+{
+    return opcode <= OP_PUSHDATA4 && push_data.size() == XOnlyPubKey::size();
+}
+
+/** Opcodes that leave the stack as they found it, so the key below them is still on top. */
+static bool IsStackNeutralNop(const opcodetype opcode)
+{
+    return opcode == OP_NOP || (opcode >= OP_NOP1 && opcode <= OP_NOP10);
+}
+
+/** Mirror of the push run the caller counts when it is balanced by a drop. */
+static bool IsRunPush(const opcodetype opcode)
+{
+    return opcode <= OP_16 && opcode != OP_RESERVED;
+}
+
+/**
+ * Signature-shaped witness items: a DER signature plus its sighash byte, or a BIP340 one.
+ *
+ * The last item is the script or the control block of the spend, never a signature.
+ */
+static size_t CountWitnessSignatures(const CScriptWitness& witness)
+{
+    size_t count{0};
+    for (size_t i{0}; i + 1 < witness.stack.size(); ++i) {
+        const size_t size{witness.stack[i].size()};
+        if (size >= 64 && size <= 73) ++count;
+    }
+    return count;
+}
+
+/**
+ * Bytes a script carries in pubkeys that no signature can prove.
+ *
+ * A key in an m-of-n that nothing signs for authorizes nothing, so what it holds is payload
+ * rather than a spending condition. That is how a file is published as a chain of ground
+ * secp256k1 points, each carrying 31 bytes and hiding behind a hash until it is spent. Ordinary
+ * multisig carries a couple of such keys itself, hence the tolerance.
+ */
+static size_t UnprovenPubkeyBytes(const CScript& script, const CScriptWitness* witness)
+{
+    /** Unproven pubkeys a script may carry before the rest are counted as data. Set so that ordinary
+     *  multisig, including wide federations, is charged nothing at all: the budget is per
+     *  transaction, so any per-input charge accumulates across inputs and would reject real spends. */
+    static constexpr size_t MAX_UNPROVEN_PUBKEYS{10};
+
+    size_t pubkeys{0}, provable{0};
+    // The current run of adjacent pubkey pushes, and the count that opened it. A well-formed
+    // m-of-n closes as <m> <pubkey>*n <n> OP_CHECKMULTISIG, and only that shape credits m.
+    size_t run_keys{0};
+    // Keys in the current push run, which the caller counts whole if a drop balances it.
+    size_t push_run_keys{0};
+    // The current run of a tapscript k-of-n, which names its keys one at a time as
+    // <pubkey> OP_CHECKSIG (<pubkey> OP_CHECKSIGADD)* <k> OP_NUMEQUAL. Only that shape credits k.
+    size_t multi_a_keys{0};
+    int run_opened_by{-1}, last_count{-1}, last_a_count{-1};
+    unsigned int inside_noop{0};
+    bool last_is_push{false};
+    // Whether the item before this one was a key a checksig-family opcode can still claim, and
+    // whether it was the 32 byte kind that is only a key because one does.
+    bool last_is_key{false}, last_is_xonly{false};
+    opcodetype opcode{OP_INVALIDOPCODE}, last_opcode{OP_INVALIDOPCODE};
+    std::vector<unsigned char> push_data;
+
+    for (CScript::const_iterator it{script.begin()}; it < script.end();) {
+        // The caller counts an unparsable script whole, and the iterator may not have advanced.
+        if (!script.GetOp(it, opcode, push_data)) return 0;
+        const bool is_pubkey{IsPubkeyPush(opcode, push_data)};
+        const bool is_xonly{IsXOnlyPush(opcode, push_data)};
+        const int count{MultisigCount(opcode, push_data)};
+        const int a_count{MultiACount(opcode, push_data)};
+        bool is_key{false};
+
+        if (inside_noop) {
+            // A closed OP_FALSE OP_IF envelope is counted whole by the caller, so skip over it.
+            if (opcode == OP_IF || opcode == OP_NOTIF) {
+                ++inside_noop;
+            } else if (opcode == OP_ENDIF) {
+                --inside_noop;
+            }
+        } else if (opcode == OP_IF && last_opcode == OP_FALSE) {
+            inside_noop = 1;
+        } else if (is_pubkey) {
+            if (!run_keys) run_opened_by = last_count;
+            ++run_keys;
+            ++push_run_keys;
+            ++pubkeys;
+            is_key = true;
+        } else if (is_xonly) {
+            // Nothing tells an x-only key from a hash but the opcode that spends it, so this
+            // one is counted where a checksig-family opcode claims it rather than here. It
+            // stays out of the push run for the same reason: a drop never reaches it.
+            run_keys = 0;
+            is_key = true;
+        } else if ((opcode == OP_DROP || opcode == OP_2DROP) && last_is_push) {
+            // The caller counts the whole run as dropped data, so do not charge it again.
+            pubkeys -= push_run_keys;
+            run_keys = 0;
+            multi_a_keys = 0;
+        } else if (opcode == OP_CHECKSIG || opcode == OP_CHECKSIGVERIFY) {
+            if (last_is_xonly) ++pubkeys;
+            ++provable;
+            run_keys = 0;
+            // <pubkey> OP_CHECKSIG opens a tapscript k-of-n; anything else there ends one.
+            multi_a_keys = (last_is_key && opcode == OP_CHECKSIG) ? 1 : 0;
+        } else if (opcode == OP_CHECKSIGADD) {
+            if (last_is_xonly) ++pubkeys;
+            // The run is credited the k it closes on, so a key earns nothing on its own here.
+            multi_a_keys = (multi_a_keys && last_is_key) ? multi_a_keys + 1 : 0;
+            run_keys = 0;
+        } else if ((opcode == OP_NUMEQUAL || opcode == OP_NUMEQUALVERIFY) && multi_a_keys) {
+            // Padding or reordering the keys forfeits the credit rather than earning one, and
+            // so does naming a k the run cannot satisfy. The OP_CHECKSIG that opened the run
+            // has credited one of the k already.
+            if (last_a_count > 0 && size_t(last_a_count) <= multi_a_keys) {
+                provable += size_t(last_a_count) - 1;
+            }
+            multi_a_keys = 0;
+            run_keys = 0;
+        } else if (opcode == OP_CHECKMULTISIG || opcode == OP_CHECKMULTISIGVERIFY) {
+            // Padding or reordering the keys forfeits the credit rather than earning one.
+            if (run_opened_by > 0 && last_count > 0 && size_t(last_count) == run_keys) {
+                provable += size_t(run_opened_by);
+            }
+            run_keys = 0;
+            multi_a_keys = 0;
+        } else if (count < 0) {
+            // A key count sits on both ends of a multisig, so it does not break the run.
+            run_keys = 0;
+            if (a_count < 0) multi_a_keys = 0;
+        }
+
+        const bool is_push{IsRunPush(opcode)};
+        if (!is_push) push_run_keys = 0;
+        // An opcode that leaves the stack as it found it leaves the key below it on top, so it
+        // cannot hide that key from the opcode which spends it. It still breaks the run above:
+        // padding a k-of-n is what forfeits its credit.
+        if (!IsStackNeutralNop(opcode)) {
+            last_is_key = is_key;
+            last_is_xonly = is_xonly && !inside_noop;
+        }
+        last_opcode = opcode;
+        last_count = count;
+        last_a_count = a_count;
+        last_is_push = is_push;
+    }
+
+    // A script can name more signatures than the spender supplies, including in branches that
+    // never run. Where the witness carries the spend it is the honest count; a P2SH spend leaves
+    // its signatures in the scriptSig, which is not visible here.
+    //
+    // A taproot script-path spend trails the script with a control block and, only when one is
+    // present, an annex, but CountWitnessSignatures excludes only the true last item. A control
+    // block can fall in the 64-73 byte range at a shallow merkle depth, so when an annex pushes
+    // it off the end, it may be miscounted as a signature. That can only inflate the count this
+    // rule caps against, never shrink it, so it can only undercharge, never overcharge: a
+    // documented imprecision, not a bug.
+    if (witness && !witness->stack.empty()) {
+        provable = std::min(provable, CountWitnessSignatures(*witness));
+    }
+
+    if (pubkeys < provable + MAX_UNPROVEN_PUBKEYS) return 0;
+    // An uncompressed key carries no more payload than a compressed one, since only the x
+    // coordinate is free, so the compressed size is the unit.
+    return (pubkeys - provable - MAX_UNPROVEN_PUBKEYS) * CPubKey::COMPRESSED_SIZE;
+}
+
+std::pair<size_t, size_t> CScript::DatacarrierBytes(const size_t remaining_outputs, const CScriptWitness* witness, const bool dead_branches) const
 {
     if (size_t olga_bytes = IsOLGA(remaining_outputs); olga_bytes) {
         return {0, olga_bytes};
@@ -368,10 +966,15 @@ std::pair<size_t, size_t> CScript::DatacarrierBytes(const size_t remaining_outpu
         }
     }
 
+    // Where a constant guard makes part of a conditional unreachable
+    const DeadParts dead{dead_branches ? FindDeadParts(*this) : DeadParts{}};
+    // A span that began at a conditional counts its guard push too; one that began at OP_ELSE does not
+    size_t span_guard{1};
     size_t counted{0};
     opcodetype opcode, last_opcode{OP_INVALIDOPCODE};
     std::vector<unsigned char> push_data;
     unsigned int inside_noop{0}, inside_conditional{0};
+    auto is_push = [](opcodetype op) { return op <= OP_16 && op != OP_RESERVED; };  // OP_0..OP_16 push data/numbers
     CScript::const_iterator opcode_it = begin(), data_began = begin();
     for (CScript::const_iterator it = begin(); it < end(); last_opcode = opcode) {
         opcode_it = it;
@@ -390,30 +993,52 @@ std::pair<size_t, size_t> CScript::DatacarrierBytes(const size_t remaining_outpu
             return {size(), 0};
         }
 
-        // Match OP_FALSE OP_IF
+        // Count a conditional part that constants make unreachable: the
+        // OP_FALSE OP_IF inscription envelope, and with dead_branches any part
+        // FindDeadParts marks, including an OP_ELSE part. Pushes there cannot
+        // affect the spend, so they are data. With dead_branches an OP_ELSE
+        // switches between the counted and the live part; without it only the
+        // envelope counts, through its OP_ENDIF.
+        const size_t offset{size_t(opcode_it - begin())};
+        const bool dead_guard{(opcode == OP_IF && last_opcode == OP_FALSE) ||
+                              (dead_branches && (opcode == OP_IF || opcode == OP_NOTIF) && dead.at_if[offset])};
+        if (dead_branches && !inside_noop && opcode == OP_ELSE && dead.at_else[offset]) {
+            inside_noop = 1;
+            data_began = opcode_it;
+            span_guard = 0;
+            continue;
+        }
+        if (dead_guard && !inside_noop) span_guard = 1;
+
         if (inside_noop) {
             switch (opcode) {
             case OP_IF: case OP_NOTIF:
                 ++inside_noop;
                 break;
+            case OP_ELSE:
+                if (dead_branches && inside_noop == 1) {
+                    counted += opcode_it - data_began + span_guard;
+                    inside_noop = 0;
+                }
+                break;
             case OP_ENDIF:
                 if (0 == --inside_noop) {
-                    counted += it - data_began + 1;
+                    counted += it - data_began + span_guard;
                 }
                 break;
             default: /* do nothing */;
             }
-        } else if (opcode == OP_IF && last_opcode == OP_FALSE) {
+        } else if (dead_guard) {
             inside_noop = 1;
             data_began = opcode_it;
-        // Match <data> OP_DROP
-        } else if (opcode <= OP_PUSHDATA4) {
-            data_began = opcode_it;
-        } else if (opcode == OP_DROP && last_opcode <= OP_PUSHDATA4) {
+        // Match <data> OP_DROP, or a run of <data>/pushnums ... OP_DROP/OP_2DROP (bare/BIP-110 envelope)
+        } else if (is_push(opcode)) {
+            if (!is_push(last_opcode)) data_began = opcode_it;  // only reset at the start of a push run
+        } else if ((opcode == OP_DROP || opcode == OP_2DROP) && is_push(last_opcode)) {
             counted += it - data_began;
         }
     }
-    return {0, counted};
+    return {UnprovenPubkeyBytes(*this, witness), counted};
 }
 
 bool GetScriptOp(CScriptBase::const_iterator& pc, CScriptBase::const_iterator end, opcodetype& opcodeRet, std::vector<unsigned char>* pvchRet)
diff --git a/src/script/script.h b/src/script/script.h
index cb2d1ece774b..8d507f61db60 100644
--- a/src/script/script.h
+++ b/src/script/script.h
@@ -578,7 +578,7 @@ class CScript : public CScriptBase
 
     size_t OPNetWitnessSize(const CScriptWitness& witness) const;
     size_t IsOLGA(size_t remaining_outputs) const;
-    std::pair<size_t, size_t> DatacarrierBytes(size_t remaining_outputs, const CScriptWitness* witness = nullptr) const;
+    std::pair<size_t, size_t> DatacarrierBytes(size_t remaining_outputs, const CScriptWitness* witness = nullptr, bool dead_branches = false) const;
 
     void clear()
     {
diff --git a/src/test/fuzz/script.cpp b/src/test/fuzz/script.cpp
index 07a49e039fb8..00aa961b0ea1 100644
--- a/src/test/fuzz/script.cpp
+++ b/src/test/fuzz/script.cpp
@@ -93,6 +93,14 @@ FUZZ_TARGET(script, .init = initialize_script)
     std::vector<std::vector<unsigned char>> solutions;
     (void)Solver(script, solutions);
 
+    {
+        CScriptWitness witness;
+        while (fuzzed_data_provider.ConsumeBool()) {
+            witness.stack.push_back(ConsumeRandomLengthByteVector(fuzzed_data_provider));
+        }
+        (void)script.DatacarrierBytes(fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 4),
+                                      witness.stack.empty() ? nullptr : &witness);
+    }
     (void)script.HasValidOps();
     (void)script.IsPayToAnchor();
     (void)script.IsPayToScriptHash();
diff --git a/src/test/script_tests.cpp b/src/test/script_tests.cpp
index 5c456f25c86d..f18dca4ea4aa 100644
--- a/src/test/script_tests.cpp
+++ b/src/test/script_tests.cpp
@@ -1623,11 +1623,67 @@ BOOST_AUTO_TEST_CASE(script_HasValidOps)
     BOOST_CHECK(!script.HasValidOps());
 }
 
-static std::string DatacarrierBytesStr(const CScript &script, const size_t remaining_outputs = 0) {
-    auto dcb = script.DatacarrierBytes(remaining_outputs);
+static std::string DatacarrierBytesStr(const CScript &script, const size_t remaining_outputs = 0, const bool dead_branches = true) {
+    auto dcb = script.DatacarrierBytes(remaining_outputs, nullptr, dead_branches);
     return strprintf("%s+%s", dcb.first, dcb.second);
 }
 
+static std::string DatacarrierBytesStr(const CScript& script, const CScriptWitness& witness)
+{
+    auto dcb = script.DatacarrierBytes(0, &witness);
+    return strprintf("%s+%s", dcb.first, dcb.second);
+}
+
+/** <m> <pubkey>*n <n> OP_CHECKMULTISIG, with distinct keys of the given size. */
+static CScript MultisigScript(const int m, const int n, const size_t key_size = 33)
+{
+    // CScript's operator<< encodes an int above 16 as a minimal push, as a real multisig does.
+    CScript script{CScript() << m};
+    for (int i{0}; i < n; ++i) {
+        script << std::vector<unsigned char>(key_size, i + 1);
+    }
+    return script << n << OP_CHECKMULTISIG;
+}
+
+/** A witness offering sigs signatures, as a spend of the given script would. */
+static CScriptWitness MultisigWitness(const int sigs, const CScript& script)
+{
+    CScriptWitness witness;
+    witness.stack.emplace_back(); // the CHECKMULTISIG dummy
+    for (int i{0}; i < sigs; ++i) {
+        witness.stack.emplace_back(72, i + 1);
+    }
+    witness.stack.emplace_back(script.begin(), script.end());
+    return witness;
+}
+
+/** <pubkey> OP_CHECKSIG (<pubkey> OP_CHECKSIGADD)*(n-1) <k> OP_NUMEQUAL, tapscript's k-of-n. */
+static CScript MultiAScript(const int k, const int n, const size_t key_size = 32,
+                            const opcodetype terminator = OP_NUMEQUAL)
+{
+    CScript script{CScript() << std::vector<unsigned char>(key_size, 1) << OP_CHECKSIG};
+    for (int i{1}; i < n; ++i) {
+        script << std::vector<unsigned char>(key_size, static_cast<unsigned char>(i + 1)) << OP_CHECKSIGADD;
+    }
+    return script << k << terminator;
+}
+
+/** A tapscript witness offering sigs signatures, as a spend of the given k-of-n would. */
+static CScriptWitness TapscriptWitness(const int sigs, const int n, const CScript& script)
+{
+    CScriptWitness witness;
+    // A key the spend does not sign for leaves an empty stack item in place of its signature.
+    for (int i{0}; i < n - sigs; ++i) {
+        witness.stack.emplace_back();
+    }
+    for (int i{0}; i < sigs; ++i) {
+        witness.stack.emplace_back(64, i + 1); // a BIP340 signature, which carries no sighash byte
+    }
+    witness.stack.emplace_back(script.begin(), script.end());
+    witness.stack.emplace_back(33, 0xc0); // the control block of a depth zero taproot leaf
+    return witness;
+}
+
 BOOST_AUTO_TEST_CASE(script_DataCarrierBytes)
 {
     using zeros = std::vector<unsigned char>;
@@ -1650,6 +1706,10 @@ BOOST_AUTO_TEST_CASE(script_DataCarrierBytes)
     BOOST_CHECK_EQUAL("0+6", DatacarrierBytesStr(CScript() << OP_FALSE << OP_IF << OP_TRUE << OP_IF << OP_ENDIF << OP_ENDIF));
     // pushing then immediately dropping is data: length(1), zero(11), OP_DROP
     BOOST_CHECK_EQUAL("0+13", DatacarrierBytesStr(CScript() << zeros(11) << OP_DROP));
+    // bare/BIP-110 envelope: a run of pushes balanced by OP_2DROP is all data
+    BOOST_CHECK_EQUAL("0+25", DatacarrierBytesStr(CScript() << zeros(11) << zeros(11) << OP_2DROP));
+    // pushnums interleaved in the run don't strand earlier pushes: 12 + 1 (OP_7) + 12 + 1 (OP_2DROP)
+    BOOST_CHECK_EQUAL("0+26", DatacarrierBytesStr(CScript() << zeros(11) << OP_7 << zeros(11) << OP_2DROP));
     // OLGA data obfuscated as p2wsh
     const auto olga_header = CScript() << OP_0 << "003e7374616d703a000000000000000000000000000000000000000000000000"_hex;
     BOOST_CHECK_EQUAL("0+82", DatacarrierBytesStr(olga_header, 2));
@@ -1657,6 +1717,264 @@ BOOST_AUTO_TEST_CASE(script_DataCarrierBytes)
     BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(olga_header, 1));
     // OGLA with extra outputs still is OLGA
     BOOST_CHECK_EQUAL("0+82", DatacarrierBytesStr(olga_header, 3));
+
+    // A dead branch guarded by a true constant before OP_NOTIF is data, the
+    // mirror of the OP_FALSE OP_IF envelope above (JXL-n-hide witness shape).
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_1 << OP_NOTIF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_16 << OP_NOTIF << OP_7 << OP_ENDIF));
+    // Empty dead branch counts its span, same as OP_FALSE OP_IF OP_ENDIF.
+    BOOST_CHECK_EQUAL("0+3", DatacarrierBytesStr(CScript() << OP_TRUE << OP_NOTIF << OP_ENDIF));
+    // A live branch is not data: false before OP_NOTIF, or true before OP_IF.
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_0 << OP_NOTIF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_1 << OP_IF << OP_7 << OP_ENDIF));
+    // A guard that depends on the witness or a signature is not counted: this
+    // is how spendable scripts branch (Lightning, miniscript)
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_DUP << OP_IF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_SIZE << 32 << OP_EQUAL << OP_NOTIF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_1 << OP_CHECKSIG << OP_NOTIF << OP_7 << OP_ENDIF));
+    // A guard that constants decide is counted however it is computed
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_1 << OP_NOP << OP_NOTIF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_1 << OP_DUP << OP_DROP << OP_NOTIF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_1 << OP_TOALTSTACK << OP_FROMALTSTACK << OP_NOTIF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_1 << OP_2 << OP_EQUAL << OP_IF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_1 << OP_1 << OP_EQUAL << OP_IF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_2 << OP_3 << OP_ADD << OP_5 << OP_NUMNOTEQUAL << OP_IF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_1 << OP_16 << OP_CHECKSEQUENCEVERIFY << OP_DROP << OP_NOTIF << OP_7 << OP_ENDIF));
+    // A constant pushed before a witness-dependent conditional is still known inside it
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_DUP << OP_IF << OP_1 << OP_NOTIF << OP_7 << OP_ENDIF << OP_ENDIF));
+    // Lightning scripts (BOLT 3) count nothing
+    const std::vector<unsigned char> key(33, 0x02), hash(20, 0x11);
+    const CScript to_local{CScript() << OP_IF << key << OP_ELSE << 144 << OP_CHECKSEQUENCEVERIFY << OP_DROP << key << OP_ENDIF << OP_CHECKSIG};
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(to_local));
+    const CScript offered_htlc{CScript() << OP_DUP << OP_HASH160 << hash << OP_EQUAL << OP_IF << OP_CHECKSIG << OP_ELSE << key << OP_SWAP
+        << OP_SIZE << 32 << OP_EQUAL << OP_NOTIF << OP_DROP << 2 << OP_SWAP << key << 2 << OP_CHECKMULTISIG << OP_ELSE << OP_HASH160
+        << hash << OP_EQUALVERIFY << OP_CHECKSIG << OP_ENDIF << OP_ENDIF};
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(offered_htlc));
+    const CScript anchor{CScript() << key << OP_CHECKSIG << OP_IFDUP << OP_NOTIF << OP_16 << OP_CHECKSEQUENCEVERIFY << OP_ENDIF};
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(anchor));
+    // The guard can be a data push, judged by its value: a zero push is false
+    // (dead OP_IF), a one push is true (dead OP_NOTIF); the reverse is live.
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << "00"_hex << OP_IF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << "01"_hex << OP_NOTIF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << "01"_hex << OP_IF << OP_7 << OP_ENDIF));
+    // The witness script shape from JXL-n-hide tx 23e8f946...: OP_1 OP_NOTIF,
+    // six 255-byte pushes, OP_ENDIF OP_1. The whole dead branch is counted.
+    CScript jxl_witness = CScript() << OP_1 << OP_NOTIF;
+    for (int i = 0; i < 6; ++i) jxl_witness << std::vector<unsigned char>(255, 0xab);
+    jxl_witness << OP_ENDIF << OP_1;
+    BOOST_CHECK_EQUAL("0+1545", DatacarrierBytesStr(jxl_witness));
+
+    // OP_ELSE switches between the counted and the live part: the live else of
+    // a dead branch is not data, and the dead else of a live one is
+    BOOST_CHECK_EQUAL("0+3", DatacarrierBytesStr(CScript() << OP_0 << OP_IF << OP_7 << OP_ELSE << OP_8 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+3", DatacarrierBytesStr(CScript() << OP_1 << OP_IF << OP_7 << OP_ELSE << OP_8 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+13", DatacarrierBytesStr(CScript() << OP_1 << OP_IF << OP_ELSE << zeros(10) << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+13", DatacarrierBytesStr(CScript() << OP_0 << OP_NOTIF << OP_ELSE << zeros(10) << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_DUP << OP_IF << OP_7 << OP_ELSE << OP_8 << OP_ENDIF));
+    // Repeated OP_ELSE keeps toggling, as the interpreter does
+    BOOST_CHECK_EQUAL("0+6", DatacarrierBytesStr(CScript() << OP_0 << OP_IF << OP_7 << OP_ELSE << OP_8 << OP_ELSE << OP_9 << OP_ENDIF));
+    // A dead branch nested in a live else is found
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_DUP << OP_IF << OP_ELSE << OP_0 << OP_IF << OP_7 << OP_ENDIF << OP_ENDIF));
+
+    // With -rejectdeadbranches=0 only the OP_FALSE OP_IF envelope counts, as before, through its OP_ENDIF
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(jxl_witness, 0, false));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_1 << OP_NOTIF << OP_7 << OP_ENDIF, 0, false));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << "00"_hex << OP_IF << OP_7 << OP_ENDIF, 0, false));
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_FALSE << OP_IF << OP_7 << OP_ENDIF, 0, false));
+    BOOST_CHECK_EQUAL("0+13", DatacarrierBytesStr(CScript() << zeros(11) << OP_DROP, 0, false));
+    BOOST_CHECK_EQUAL("0+6", DatacarrierBytesStr(CScript() << OP_0 << OP_IF << OP_7 << OP_ELSE << OP_8 << OP_ENDIF, 0, false));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_1 << OP_IF << OP_ELSE << zeros(10) << OP_ENDIF, 0, false));
+
+    // Following constants costs one step per opcode plus each OP_ROLL's depth, at most
+    // four per byte: one deep roll before the guard is followed, a string of them is not
+    const CScript dead_tail = CScript() << OP_1 << OP_NOTIF << OP_7 << OP_ENDIF;
+    const auto deep_rolls = [&](int rolls) {
+        CScript s;
+        for (int i{0}; i < 999; ++i) s << OP_1;
+        for (int i{0}; i < rolls; ++i) s << CScriptNum{998} << OP_ROLL;
+        s.insert(s.end(), dead_tail.begin(), dead_tail.end());
+        return s;
+    };
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(deep_rolls(1)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(deep_rolls(10)));
+}
+
+BOOST_AUTO_TEST_CASE(script_DataCarrierBytes_unproven_pubkeys)
+{
+    using zeros = std::vector<unsigned char>;
+
+    // A key a signature is offered for is a spending condition, not data
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << zeros(33) << OP_CHECKSIG));
+    // Ordinary multisig is charged nothing, however wide, because the budget is per transaction
+    // and any per-input charge would accumulate across the inputs of a real spend
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(2, 3)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(3, 5)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(1, 3)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(2, 5)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(2, 6)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(3, 9)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(11, 15)));
+    // Above 16 the key count is a minimal one byte push rather than an OP_N, and still counts
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(17, 20)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(20, 20)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(19, 20)));
+    // The boundary: eleven keys behind one signature is free, twelve starts paying
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(1, 11)));
+    BOOST_CHECK_EQUAL("33+0", DatacarrierBytesStr(MultisigScript(1, 12)));
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(MultisigScript(1, 15)));
+    // Uncompressed keys carry no more payload, so they are charged the same
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(MultisigScript(1, 15, 65)));
+
+    // Naming signatures the spend does not offer earns nothing: OP_CHECKSIG in a branch that
+    // never runs would otherwise buy off the whole count for one byte each
+    CScript evasion{MultisigScript(1, 15)};
+    evasion << OP_IF << OP_1 << OP_ELSE;
+    for (int i{0}; i < 15; ++i) {
+        evasion << OP_CHECKSIG;
+    }
+    evasion << OP_ENDIF;
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(evasion));
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(evasion, MultisigWitness(1, evasion)));
+    // A real 11-of-15 spend is charged nothing whether or not the witness is seen
+    const CScript multisig{MultisigScript(11, 15)};
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(multisig, MultisigWitness(11, multisig)));
+    // An empty witness means the signatures are elsewhere (P2SH), so the script is believed
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(multisig, CScriptWitness()));
+    // The witnessScript itself is not a signature, however close to one in size
+    BOOST_CHECK_EQUAL("165+0", DatacarrierBytesStr(MultisigScript(1, 15), MultisigWitness(0, MultisigScript(1, 15))));
+    // ... whereas offering one signature for the same script leaves fourteen keys unproven
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(multisig, MultisigWitness(1, multisig)));
+
+    // Breaking the key run forfeits the m credit rather than earning one
+    CScript padded{CScript() << OP_1};
+    for (int i{0}; i < 15; ++i) {
+        padded << zeros(33) << OP_NOP;
+    }
+    padded << CScript::EncodeOP_N(15) << OP_CHECKMULTISIG;
+    BOOST_CHECK_EQUAL("165+0", DatacarrierBytesStr(padded));
+
+    // A dropped key is already counted as dropped data; it is not charged twice
+    BOOST_CHECK_EQUAL("0+35", DatacarrierBytesStr(CScript() << zeros(33) << OP_DROP));
+    // A drop balancing the run discounts every key in it, whatever sits at the end of the run
+    BOOST_CHECK_EQUAL("0+105", DatacarrierBytesStr(CScript() << zeros(33) << zeros(33) << zeros(33) << 20 << OP_DROP));
+    BOOST_CHECK_EQUAL("0+36", DatacarrierBytesStr(CScript() << zeros(33) << OP_1 << OP_DROP));
+    // Keys inside an OP_FALSE OP_IF envelope are counted with the envelope, once
+    BOOST_CHECK_EQUAL("0+37", DatacarrierBytesStr(CScript() << OP_FALSE << OP_IF << zeros(33) << OP_ENDIF));
+    // An envelope that never closes is counted by neither rule. It cannot execute, so it is
+    // unspendable as a witness or redeem script and nonstandard as a scriptPubKey.
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_FALSE << OP_IF << zeros(33)
+                                                           << zeros(33) << zeros(33)));
+    // A bare envelope carries no pubkeys at all, so this rule must charge nothing for it
+    BOOST_CHECK_EQUAL("0+90", DatacarrierBytesStr(CScript() << std::vector<unsigned char>{'o', 'r', 'd'}
+                                                            << zeros(83) << OP_2DROP << OP_1));
+    // A run of keys balanced by drops is counted as dropped data, so it is not charged again
+    BOOST_CHECK_EQUAL("0+171", DatacarrierBytesStr(CScript() << zeros(33) << zeros(33) << zeros(33)
+                                                             << zeros(33) << zeros(33)
+                                                             << OP_2DROP << OP_2DROP << OP_DROP));
+}
+
+BOOST_AUTO_TEST_CASE(script_DataCarrierBytes_tapscript_unproven_pubkeys)
+{
+    using zeros = std::vector<unsigned char>;
+
+    // The same payload costs the same whichever way it is written. A 1-of-15 under P2WSH and
+    // the taproot leaf that says the same thing are charged alike, where once the leaf was free
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(MultisigScript(1, 15), MultisigWitness(1, MultisigScript(1, 15))));
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(MultiAScript(1, 15), TapscriptWitness(1, 15, MultiAScript(1, 15))));
+
+    // An x-only key a signature is offered for is a spending condition, not data
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << zeros(32) << OP_CHECKSIG));
+    // Ordinary tapscript multisig keeps its spare keys, exactly as OP_CHECKMULTISIG does
+    for (const auto& [k, n] : {std::pair{2, 3}, std::pair{3, 5}, std::pair{1, 2}, std::pair{1, 3},
+                               std::pair{3, 3}, std::pair{5, 5}, std::pair{11, 15}, std::pair{20, 20}}) {
+        const CScript script{MultiAScript(k, n)};
+        BOOST_CHECK_EQUAL(DatacarrierBytesStr(MultisigScript(k, n)),
+                          DatacarrierBytesStr(script, TapscriptWitness(k, n, script)));
+    }
+    // Eleven keys behind one signature are free, as under OP_CHECKMULTISIG; past the tolerance
+    // every further key is payload, however honest the spend that offers it
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultiAScript(1, 11), TapscriptWitness(1, 11, MultiAScript(1, 11))));
+    BOOST_CHECK_EQUAL("33+0", DatacarrierBytesStr(MultiAScript(1, 12), TapscriptWitness(1, 12, MultiAScript(1, 12))));
+    BOOST_CHECK_EQUAL("66+0", DatacarrierBytesStr(MultiAScript(1, 13), TapscriptWitness(1, 13, MultiAScript(1, 13))));
+    BOOST_CHECK_EQUAL("33+0", DatacarrierBytesStr(MultiAScript(5, 16), TapscriptWitness(5, 16, MultiAScript(5, 16))));
+    for (const auto& [k, n] : {std::pair{1, 11}, std::pair{1, 12}, std::pair{1, 13}, std::pair{5, 16}}) {
+        const CScript script{MultiAScript(k, n)};
+        BOOST_CHECK_EQUAL(DatacarrierBytesStr(MultisigScript(k, n), MultisigWitness(k, MultisigScript(k, n))),
+                          DatacarrierBytesStr(script, TapscriptWitness(k, n, script)));
+    }
+    // Above 16 the key count is a minimal push rather than an OP_N, and still counts. A leaf may
+    // hold far more keys than OP_CHECKMULTISIG, so it is read up to MAX_PUBKEYS_PER_MULTI_A
+    BOOST_CHECK_EQUAL("33+0", DatacarrierBytesStr(MultiAScript(17, 28), TapscriptWitness(17, 28, MultiAScript(17, 28))));
+    // From 128 the minimal push carries a zero high byte to keep the sign clear, as in 80 00
+    for (const int k : {127, 128, 255, 256}) {
+        const CScript script{MultiAScript(k, k + 2)};
+        BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(script, TapscriptWitness(k, k + 2, script)));
+    }
+    // ... while a zero high byte nothing needs is not minimal, and forfeits the credit
+    CScript non_minimal{CScript() << zeros(32) << OP_CHECKSIG};
+    for (int i{1}; i < 28; ++i) {
+        non_minimal << zeros(32) << OP_CHECKSIGADD;
+    }
+    non_minimal << std::vector<unsigned char>{17, 0} << OP_NUMEQUAL;
+    BOOST_CHECK_EQUAL("561+0", DatacarrierBytesStr(non_minimal, TapscriptWitness(17, 28, non_minimal)));
+    // The credit is the shape of the run, not the size of its keys: a leaf may hold either
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultiAScript(3, 5, 33), TapscriptWitness(3, 5, MultiAScript(3, 5, 33))));
+    // A run closed by OP_NUMEQUALVERIFY says the same thing as one closed by OP_NUMEQUAL
+    const CScript verify{MultiAScript(3, 5, 32, OP_NUMEQUALVERIFY)};
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(verify, TapscriptWitness(3, 5, verify)));
+
+    // A 32 byte push is only a key where something spends it. The preimage of a hashlock and
+    // the hash it is checked against are neither of them keys, in a leaf or anywhere else
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_SHA256 << zeros(32) << OP_EQUALVERIFY
+                                                           << zeros(33) << OP_CHECKSIG));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << zeros(32) << OP_SHA256 << zeros(32)
+                                                           << OP_EQUALVERIFY << zeros(32) << OP_CHECKSIG));
+
+    // Padding the run forfeits the credit rather than earning one, so an 11-of-15 written the
+    // long way round is charged as though it proved nothing but the key it opens on
+    CScript padded{CScript() << zeros(32) << OP_CHECKSIG};
+    for (int i{1}; i < 15; ++i) {
+        padded << zeros(32) << OP_NOP << OP_CHECKSIGADD;
+    }
+    padded << 11 << OP_NUMEQUAL;
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(padded, TapscriptWitness(11, 15, padded)));
+    // ... while an OP_NOP does not hide the key beneath it from the opcode that spends it
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << zeros(32) << OP_NOP << OP_CHECKSIG));
+
+    // Naming a k the run cannot satisfy forfeits the credit too
+    CScript inflated{CScript() << zeros(32) << OP_CHECKSIG};
+    for (int i{1}; i < 15; ++i) {
+        inflated << zeros(32) << OP_CHECKSIGADD;
+    }
+    inflated << 20 << OP_NUMEQUAL;
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(inflated, TapscriptWitness(11, 15, inflated)));
+
+    // The OP_CHECKSIG a run opens on credits one of the k already, so a 1-of-n is credited once
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultiAScript(1, 3), TapscriptWitness(1, 3, MultiAScript(1, 3))));
+    // Naming more signatures than the spend offers earns nothing here as it does elsewhere
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(MultiAScript(11, 15), TapscriptWitness(1, 15, MultiAScript(11, 15))));
+
+    // A key inside an OP_FALSE OP_IF envelope is counted with the envelope, once
+    BOOST_CHECK_EQUAL("0+37", DatacarrierBytesStr(CScript() << OP_FALSE << OP_IF << zeros(32)
+                                                            << OP_CHECKSIG << OP_ENDIF));
+    // A dropped key is already counted as dropped data; it is not charged twice, and no credit
+    // drives the count below zero
+    BOOST_CHECK_EQUAL("0+35", DatacarrierBytesStr(CScript() << zeros(32) << OP_CHECKSIG << zeros(33) << OP_DROP));
+    CScript over_credited{MultiAScript(3, 3)};
+    over_credited << OP_3 << OP_NUMEQUAL << OP_3 << OP_NUMEQUAL;
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(over_credited));
+
+    // A 32 byte push nothing spends and no drop balances is reached by neither rule. It is
+    // stranded on the stack, which leaves the leaf unspendable, so it buys nothing.
+    CScript stranded;
+    for (int i{0}; i < 15; ++i) {
+        stranded << zeros(32);
+    }
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(stranded));
+    // Balance the same pushes with drops and the run rule charges them whole
+    BOOST_CHECK_EQUAL("0+496", DatacarrierBytesStr(CScript{stranded} << OP_2DROP << OP_2DROP << OP_2DROP
+                                                                     << OP_2DROP << OP_2DROP << OP_2DROP
+                                                                     << OP_2DROP << OP_DROP));
 }
 
 BOOST_AUTO_TEST_CASE(script_GetScriptForTransactionInput)
diff --git a/src/test/transaction_tests.cpp b/src/test/transaction_tests.cpp
index b8a49fb04a0b..9908f64edd75 100644
--- a/src/test/transaction_tests.cpp
+++ b/src/test/transaction_tests.cpp
@@ -1417,4 +1417,231 @@ BOOST_AUTO_TEST_CASE(spends_witness_prog)
     }
 }
 
+BOOST_AUTO_TEST_CASE(tx_DataOutputBytes)
+{
+    // Block 965,224, tx f93ee9d2a8d6fc0dce7889732d8e288ca64dacfe4c94c6cd76eb85037daea09c:
+    // an "ACME" payload in four P2WSH outputs at 330 sat (OLGA framing with a
+    // different magic), then a taproot and two P2WPKH change outputs.
+    CMutableTransaction acme_mtx;
+    BOOST_REQUIRE(DecodeHexTx(acme_mtx, "02000000000104478044ee1b430fea5cb8ff1671b670ef9c5b9ae32eea5baef589514ec0a899e60800000000fdffffffbfc7b0134900db70018a0df2fad0f1e5e142213697e8117900f3a8c5937961eb0200000000fdffffffa5296edb74af3c092e4242f47ebb49e6935b84b5ff8b555dc1df205342a17f570200000000fdffffffb37dc44d0fda93e76e10a567b6e30ff16bc0dd84795210b5de9c70ce61026d3a0000000000fdffffff074a01000000000000220020007741434d4501001400789c0160009fff0110000c464f524745544d454b4e4f4a0100000000000022002054020400080000000000000001030800010004100000050800010006080001004a0100000000000022002007100009746578742f68746d6c08110020780f09eb3c8c53dc0a91ed8777c5194a01000000000000220020d06576f8bfe44a149acd6a56bcc81dca9ef91f18abe4cf51a6000000000000001e24000000000000225120f76c46bc64b22b4643971b7b6f93a552bd99b62ed2903fe7903ba74c8a9938df7803000000000000160014b9034eaf3a6cadd9b8687bdc95fa4e2e696ad349d403000000000000160014f05ca0933738059e830756042263a8d8182b9f24024830450221008bc36479a37702f5abc206931f39efcde9d1f98561ebe3733e97478205c4168a022032a6ba41e4609d7be2dd6120a2f24a10160c7caab3a7721b80b13c1e008e453401210273756d05687e8d9a4002940e915bf699c587553859e88a5b5870c5dce6f87f2f0247304402203a2c81569bef2606deccc47c5968b5f07c3a69fa2e6a060098f78be002d96f3702206a10ffda52252ba0c05c3d9ae92181e3d7806e3de5eb390c9bd6c2e508584c8b01210273756d05687e8d9a4002940e915bf699c587553859e88a5b5870c5dce6f87f2f02483045022100edd2b635984b47243124c6aa4bb30b25940f1bfba3d80af0207574a70911a69902206907be25d22a94746bf49d72f61c17a154cce0beb46f13e2e920da028cfeef2601210273756d05687e8d9a4002940e915bf699c587553859e88a5b5870c5dce6f87f2f02473044022018898be34c777e2b8618fde94260a239085a60fe43b82a2e7d46f7f4476f43e50220373634c96189ee47fa639a134599fd31d8872c421f0f75532caec035e07eb6ff01210273756d05687e8d9a4002940e915bf699c587553859e88a5b5870c5dce6f87f2f00000000"));
+    const CTransaction acme{acme_mtx};
+    const std::vector<size_t> acme_expect{41, 41, 41, 41, 0, 0, 0};
+    const auto acme_bytes{DataOutputBytes(acme)};
+    BOOST_CHECK_EQUAL_COLLECTIONS(acme_bytes.begin(), acme_bytes.end(), acme_expect.begin(), acme_expect.end());
+
+    // The whole-transaction count sees the same 164 bytes; the P2WPKH inputs add nothing.
+    CCoinsView coins_dummy;
+    CCoinsViewCache coins(&coins_dummy);
+    const CScript acme_prevout_spk{CScript() << OP_0 << "f05ca0933738059e830756042263a8d8182b9f24"_hex};
+    for (const CTxIn& txin : acme.vin) {
+        coins.AddCoin(txin.prevout, Coin{CTxOut{1000, acme_prevout_spk}, 1, false}, false);
+    }
+    const auto acme_dcb{DatacarrierBytes(acme, coins, acme_bytes)};
+    BOOST_CHECK_EQUAL(acme_dcb.first, 0U);
+    BOOST_CHECK_EQUAL(acme_dcb.second, 164U);
+    BOOST_CHECK_EQUAL(CalculateExtraTxWeight(acme, coins, 2 * WITNESS_SCALE_FACTOR, acme_bytes), 164 * WITNESS_SCALE_FACTOR);
+
+    // An OLGA header that also trips a byte tell still counts its whole
+    // payload (0x64 = 100 bytes, so four outputs), once: the detector covers
+    // header and chunks, so DataOutputBytes leaves them all to it
+    std::vector<unsigned char> stamp_header{0x00, 0x64, 's', 't', 'a', 'm', 'p', ':'};
+    stamp_header.resize(32, 0);
+    CMutableTransaction olga_mtx;
+    for (const auto& program : {stamp_header, "e9f85819906b6bc0b5f5d902c68cd2298679883ce2b3f8552b029f462c0a0d17"_hex_v_u8, "becb6d3c0662dca214c45cde70e4ce022ade14bac12bfed3aa4811b5b3bde49f"_hex_v_u8, "e2c8d6303cf2cad3a00e0ec1b61aa1355c32dca119c357f5e7ad499781052e3f"_hex_v_u8}) {
+        olga_mtx.vout.emplace_back(olga_mtx.vout.empty() ? 330 : 1000, CScript() << OP_0 << program);
+    }
+    const CTransaction olga{olga_mtx};
+    const std::vector<size_t> olga_expect{0, 0, 0, 0};
+    const auto olga_bytes{DataOutputBytes(olga)};
+    BOOST_CHECK_EQUAL_COLLECTIONS(olga_bytes.begin(), olga_bytes.end(), olga_expect.begin(), olga_expect.end());
+    BOOST_CHECK_EQUAL(DatacarrierBytes(olga, coins, olga_bytes).second, 164U);
+    BOOST_CHECK_EQUAL(CalculateExtraTxWeight(olga, coins, 2 * WITNESS_SCALE_FACTOR, olga_bytes), 164 * WITNESS_SCALE_FACTOR);
+    // The same stamp with its chunks at the threshold, the real layout: still
+    // 164, not 164 plus three chunks caught by the dust run
+    for (CTxOut& txout : olga_mtx.vout) txout.nValue = 330;
+    const CTransaction olga_dust{olga_mtx};
+    const auto olga_dust_bytes{DataOutputBytes(olga_dust)};
+    BOOST_CHECK_EQUAL_COLLECTIONS(olga_dust_bytes.begin(), olga_dust_bytes.end(), olga_expect.begin(), olga_expect.end());
+    BOOST_CHECK_EQUAL(DatacarrierBytes(olga_dust, coins, olga_dust_bytes).second, 164U);
+
+    // Random 32-byte hashes and x-only keys (on and off the curve)
+    const std::vector<unsigned char> hash_a{"e9f85819906b6bc0b5f5d902c68cd2298679883ce2b3f8552b029f462c0a0d17"_hex_v_u8};
+    const std::vector<unsigned char> hash_b{"becb6d3c0662dca214c45cde70e4ce022ade14bac12bfed3aa4811b5b3bde49f"_hex_v_u8};
+    const std::vector<unsigned char> hash_c{"e2c8d6303cf2cad3a00e0ec1b61aa1355c32dca119c357f5e7ad499781052e3f"_hex_v_u8};
+    const std::vector<unsigned char> hash_d{"af6adc4480e64dd58e59424f43b6144267d1c4347a58ad0f09013fb9053b307b"_hex_v_u8};
+    const std::vector<unsigned char> hash_e{"02c7539d864d18c81557338387d5300f60cb8cc75054c2cfc985ddc401269122"_hex_v_u8};
+    const std::vector<unsigned char> key_on_a{"9f537de0a7f7403067880d3d62d3f8d20889c4f77b74b612406d7d5ce0a9b206"_hex_v_u8};
+    const std::vector<unsigned char> key_on_b{"4d6abe64a78cd5dcb98a719490753a84a061274cc6f7ecefea0aedad967676ba"_hex_v_u8};
+    const std::vector<unsigned char> key_on_c{"44d8f2d6c1d5f3d2b53fda185d92462adf0ec0f4a66a6e31680b731ddbca111d"_hex_v_u8};
+    const std::vector<unsigned char> key_off{"4420f4cd273fe68ccc6df6aaf1bd40d6f879884882386754e2c2e55cfad0b0bb"_hex_v_u8};
+    const auto p2wsh = [](const std::vector<unsigned char>& program) { return CScript() << OP_0 << program; };
+    const auto p2tr = [](const std::vector<unsigned char>& key) { return CScript() << OP_1 << key; };
+    const auto check = [](const CMutableTransaction& mtx, const std::vector<size_t>& expect) {
+        const auto got{DataOutputBytes(CTransaction{mtx})};
+        BOOST_CHECK_EQUAL_COLLECTIONS(got.begin(), got.end(), expect.begin(), expect.end());
+    };
+    CMutableTransaction t;
+
+    // A Lightning commitment: two 330-sat anchors, to_local, to_remote, a small HTLC
+    t.vout = {CTxOut{330, p2wsh(hash_a)}, CTxOut{330, p2wsh(hash_b)}, CTxOut{50000, p2wsh(hash_c)}, CTxOut{70000, p2wsh(hash_d)}, CTxOut{400, p2wsh(hash_e)}};
+    check(t, {0, 0, 0, 0, 0});
+
+    // A third P2WSH output at the same small value makes a data run
+    t.vout = {CTxOut{330, p2wsh(hash_a)}, CTxOut{330, p2wsh(hash_b)}, CTxOut{330, p2wsh(hash_c)}, CTxOut{100000, p2wsh(hash_d)}};
+    check(t, {41, 41, 41, 0});
+    // Different values do not add up
+    t.vout[2].nValue = 331;
+    check(t, {0, 0, 0, 0});
+    // Up to DATA_OUTPUT_RUN_MAX_VALUE, as the fake-key encoder pays 546 sat per chunk
+    for (auto& txout : t.vout) txout.nValue = DATA_OUTPUT_RUN_MAX_VALUE;
+    t.vout[3].nValue = 100000;
+    check(t, {41, 41, 41, 0});
+    for (auto& txout : t.vout) txout.nValue = DATA_OUTPUT_RUN_MAX_VALUE + 1;
+    check(t, {0, 0, 0, 0});
+    // A Lightning commitment with two anchors and two small HTLCs of different amounts
+    t.vout = {CTxOut{330, p2wsh(hash_a)}, CTxOut{330, p2wsh(hash_b)}, CTxOut{400, p2wsh(hash_c)}, CTxOut{450, p2wsh(hash_d)}};
+    check(t, {0, 0, 0, 0});
+    // The run counts distinct scripts: padding or consolidation that repeats
+    // one script at the threshold is not a spread payload
+    t.vout = {CTxOut{330, p2wsh(hash_a)}, CTxOut{330, p2wsh(hash_a)}, CTxOut{330, p2wsh(hash_a)}, CTxOut{330, p2wsh(hash_b)}};
+    check(t, {0, 0, 0, 0});
+    t.vout.emplace_back(330, p2wsh(hash_c));
+    check(t, {41, 41, 41, 41, 41});
+    // Small taproot runs are ordinals postage and are left to the curve check, and mixed types do not add up
+    t.vout = {CTxOut{330, p2tr(key_on_a)}, CTxOut{330, p2tr(key_on_b)}, CTxOut{330, p2tr(key_on_c)}};
+    check(t, {0, 0, 0});
+    t.vout = {CTxOut{330, p2wsh(hash_a)}, CTxOut{330, p2wsh(hash_b)}, CTxOut{330, p2tr(key_on_a)}};
+    check(t, {0, 0, 0});
+
+    // A taproot key that is not on the curve can never be spent
+    t.vout = {CTxOut{100000, p2tr(key_off)}};
+    check(t, {41});
+    t.vout = {CTxOut{100000, p2tr(key_on_a)}};
+    check(t, {0});
+    // Only the first DATA_OUTPUT_CURVE_CHECKS taproot outputs are checked
+    t.vout.assign(DATA_OUTPUT_CURVE_CHECKS - 1, CTxOut{1000, p2tr(key_on_a)});
+    t.vout.emplace_back(2000, p2tr(key_off));
+    std::vector<size_t> capped(DATA_OUTPUT_CURVE_CHECKS, 0);
+    capped.back() = 41;
+    check(t, capped);
+    t.vout.insert(t.vout.begin(), CTxOut{1000, p2tr(key_on_b)});
+    capped.assign(DATA_OUTPUT_CURVE_CHECKS + 1, 0);
+    check(t, capped);
+
+    // Eight of one byte value trips the multiplicity tell, seven do not
+    std::vector<unsigned char> program{hash_a};
+    for (size_t k{0}; k < 8; ++k) program[4 * k] = 0x5a;
+    t.vout = {CTxOut{100000, p2wsh(program)}};
+    check(t, {41});
+    program = hash_a;
+    for (size_t k{0}; k < 7; ++k) program[4 * k] = 0x5a;
+    t.vout = {CTxOut{100000, p2wsh(program)}};
+    check(t, {0});
+
+    // Six identical bytes in a row trip the run tell, five do not
+    std::vector<unsigned char> run6{hash_b};
+    std::fill(run6.begin() + 10, run6.begin() + 16, 0x77);
+    t.vout = {CTxOut{100000, p2wsh(run6)}};
+    check(t, {41});
+    program = hash_b;
+    std::fill(program.begin() + 10, program.begin() + 15, 0x77);
+    t.vout = {CTxOut{100000, p2wsh(program)}};
+    check(t, {0});
+
+    // A caught chunk marks its siblings of the same type and value, nothing else
+    t.vout = {CTxOut{1000, p2wsh(hash_c)}, CTxOut{1000, p2wsh(run6)}, CTxOut{1000, p2wsh(hash_d)}, CTxOut{2000, p2wsh(hash_e)}, CTxOut{1000, p2tr(key_on_a)}};
+    check(t, {41, 41, 41, 0, 0});
+
+    // 20-byte hashes get the same tells, and a random hash at the same value is
+    // marked as its sibling, at another value not
+    std::vector<unsigned char> padded20(hash_a.begin(), hash_a.begin() + 20);
+    std::fill(padded20.begin() + 11, padded20.end(), 0xff);
+    const CScript padded_p2wpkh{CScript() << OP_0 << padded20};
+    const CScript p2wpkh{CScript() << OP_0 << std::vector<unsigned char>(hash_a.begin(), hash_a.begin() + 20)};
+    t.vout = {CTxOut{294, padded_p2wpkh}, CTxOut{294, p2wpkh}};
+    check(t, {29, 29});
+    t.vout = {CTxOut{294, padded_p2wpkh}, CTxOut{500, p2wpkh}};
+    check(t, {29, 0});
+    // The all-zero hash is the conventional burn address, not a payload, and marks no siblings
+    const CScript burn{CScript() << OP_0 << std::vector<unsigned char>(20, 0)};
+    const CScript burn_p2pkh{CScript() << OP_DUP << OP_HASH160 << std::vector<unsigned char>(20, 0) << OP_EQUALVERIFY << OP_CHECKSIG};
+    t.vout = {CTxOut{294, burn}, CTxOut{294, p2wpkh}, CTxOut{20000, burn_p2pkh}};
+    check(t, {0, 0, 0});
+
+    // Block 976,048, tx e2031ff1826b019dd59ece1bf1b20cb2ab43c63c2de674f5d8275b246d5319d0:
+    // spends from the vanity address 11111119536NnU2vPAvoQhvkheQ8ejYJ, whose hash
+    // starts with six zero bytes, and pays change back to it. Without the coins
+    // the run tell counts the change; with them it is a script the spender holds.
+    CMutableTransaction vanity_mtx;
+    BOOST_REQUIRE(DecodeHexTx(vanity_mtx, "02000000010387f422907c82855e4e53f8684610ed1ce82a989fa6d7220ca264fc79e9c24d010000006a47304402206d1b0c9185144d8265912f6604286e5c00b55a5f7c6212af53580ad7b20bf9cb0220589565b65bd13413ea639f7e357469c8abee7584c780974c4dcf5033c80643ec012102256dc642d51313476a3d419ae000f711761e72588f0427a3d48a1b3ff81eb0a9fdffffff02ec660000000000001976a914007e89662caa492338b6de553ba80de8b24c435388ac75dc0200000000001976a914000000000000c28e3cf80c3f84064ab17a0593b588ac2ece0e00"));
+    const CTransaction vanity{vanity_mtx};
+    const auto vanity_spk_bytes{"76a914000000000000c28e3cf80c3f84064ab17a0593b588ac"_hex_v_u8};
+    const CScript vanity_spk(vanity_spk_bytes.begin(), vanity_spk_bytes.end());
+    BOOST_CHECK(vanity.vout[1].scriptPubKey == vanity_spk);
+    const std::vector<size_t> vanity_counted{0, 29};
+    const std::vector<size_t> vanity_real{0, 0};
+    const auto vanity_no_view{DataOutputBytes(vanity)};
+    BOOST_CHECK_EQUAL_COLLECTIONS(vanity_no_view.begin(), vanity_no_view.end(), vanity_counted.begin(), vanity_counted.end());
+    CCoinsViewCache vanity_coins(&coins_dummy);
+    vanity_coins.AddCoin(vanity.vin[0].prevout, Coin{CTxOut{214264, vanity_spk}, 1, false}, false);
+    const auto vanity_bytes{DataOutputBytes(vanity, &vanity_coins)};
+    BOOST_CHECK_EQUAL_COLLECTIONS(vanity_bytes.begin(), vanity_bytes.end(), vanity_real.begin(), vanity_real.end());
+    BOOST_CHECK_EQUAL(DatacarrierBytes(vanity, vanity_coins, vanity_bytes).second, 0U);
+    // The same output spending a coin of another script is still counted
+    CCoinsViewCache other_coins(&coins_dummy);
+    other_coins.AddCoin(vanity.vin[0].prevout, Coin{CTxOut{214264, burn_p2pkh}, 1, false}, false);
+    const auto other_bytes{DataOutputBytes(vanity, &other_coins)};
+    BOOST_CHECK_EQUAL_COLLECTIONS(other_bytes.begin(), other_bytes.end(), vanity_counted.begin(), vanity_counted.end());
+
+    // Paying the spent script exempts that output only: a data output beside it
+    // still counts, and the exempt output is not marked as a sibling of one
+    t = vanity_mtx;
+    t.vout = {CTxOut{294, vanity_spk}, CTxOut{294, padded_p2wpkh}};
+    std::vector<size_t> got{DataOutputBytes(CTransaction{t}, &vanity_coins)};
+    std::vector<size_t> expect{0, 29};
+    BOOST_CHECK_EQUAL_COLLECTIONS(got.begin(), got.end(), expect.begin(), expect.end());
+    const CScript zeros_p2pkh{CScript() << OP_DUP << OP_HASH160 << "000000000000aa8e3cf80c3f84064ab17a0593b5"_hex_v_u8 << OP_EQUALVERIFY << OP_CHECKSIG};
+    t.vout = {CTxOut{5000, zeros_p2pkh}, CTxOut{5000, vanity_spk}};
+    got = DataOutputBytes(CTransaction{t}, &vanity_coins);
+    expect = {29, 0};
+    BOOST_CHECK_EQUAL_COLLECTIONS(got.begin(), got.end(), expect.begin(), expect.end());
+    // A spent script still counts toward a dust run, so it cannot break one up
+    CCoinsViewCache run_coins(&coins_dummy);
+    run_coins.AddCoin(vanity.vin[0].prevout, Coin{CTxOut{330, p2wsh(hash_a)}, 1, false}, false);
+    t.vout = {CTxOut{330, p2wsh(hash_a)}, CTxOut{330, p2wsh(hash_b)}, CTxOut{330, p2wsh(hash_c)}};
+    got = DataOutputBytes(CTransaction{t}, &run_coins);
+    expect = {0, 41, 41};
+    BOOST_CHECK_EQUAL_COLLECTIONS(got.begin(), got.end(), expect.begin(), expect.end());
+    // Two inputs spending one script and one spending another exempt every output
+    // that pays either script, and nothing else; the third input's script looks
+    // like data, so it is only exempt if that input is still looked up
+    const COutPoint second{vanity.vin[0].prevout.hash, vanity.vin[0].prevout.n + 1};
+    const COutPoint third{vanity.vin[0].prevout.hash, vanity.vin[0].prevout.n + 2};
+    CCoinsViewCache many_coins(&coins_dummy);
+    many_coins.AddCoin(vanity.vin[0].prevout, Coin{CTxOut{1000, vanity_spk}, 1, false}, false);
+    many_coins.AddCoin(second, Coin{CTxOut{1000, vanity_spk}, 1, false}, false);
+    many_coins.AddCoin(third, Coin{CTxOut{1000, p2wsh(run6)}, 1, false}, false);
+    t.vin = {vanity.vin[0], CTxIn{second}, CTxIn{third}};
+    t.vout = {CTxOut{5000, vanity_spk}, CTxOut{5000, zeros_p2pkh}, CTxOut{5000, vanity_spk}, CTxOut{5000, p2wsh(run6)}};
+    got = DataOutputBytes(CTransaction{t}, &many_coins);
+    expect = {0, 29, 0, 0};
+    BOOST_CHECK_EQUAL_COLLECTIONS(got.begin(), got.end(), expect.begin(), expect.end());
+    t.vin = {vanity.vin[0]};
+    // Only hash and key outputs are looked at, so a bare script that repeats a
+    // spent coin's, such as bare multisig with data keys, counts as before
+    std::vector<unsigned char> real_key{0x02}, data_key{0x03};
+    real_key.insert(real_key.end(), hash_e.begin(), hash_e.end());
+    data_key.insert(data_key.end(), 32, 'A');
+    const CScript bare_multisig{CScript() << OP_1 << real_key << data_key << OP_2 << OP_CHECKMULTISIG};
+    std::vector<std::vector<unsigned char>> bare_solutions;
+    BOOST_CHECK(Solver(bare_multisig, bare_solutions) == TxoutType::MULTISIG);
+    CCoinsViewCache bare_coins(&coins_dummy);
+    bare_coins.AddCoin(vanity.vin[0].prevout, Coin{CTxOut{1000, bare_multisig}, 1, false}, false);
+    t.vout = {CTxOut{1000, bare_multisig}};
+    const auto bare_no_view{DataOutputBytes(CTransaction{t})};
+    const auto bare_view{DataOutputBytes(CTransaction{t}, &bare_coins)};
+    BOOST_CHECK_EQUAL_COLLECTIONS(bare_view.begin(), bare_view.end(), bare_no_view.begin(), bare_no_view.end());
+    BOOST_CHECK(DatacarrierBytes(CTransaction{t}, bare_coins, bare_view) == DatacarrierBytes(CTransaction{t}, bare_coins, bare_no_view));
+}
+
 BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/validation.cpp b/src/validation.cpp
index 3451d736a211..c5386fbb8131 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -1033,8 +1033,13 @@ bool MemPoolAccept::PreChecks(ATMPArgs& args, Workspace& ws)
         return state.Invalid(TxValidationResult::TX_INPUTS_NOT_STANDARD, reason);
     }
 
+    // Outputs whose hash or key is data, for the datacarrier checks and the extra weight
+    std::vector<size_t> data_outputs(tx.vout.size(), 0);
+    if (m_pool.m_opts.reject_fake_outputs && (m_pool.m_opts.datacarrier_fullcount || !m_pool.m_opts.accept_non_std_datacarrier || ::g_weight_per_data_byte > WITNESS_SCALE_FACTOR)) {
+        data_outputs = DataOutputBytes(tx, &m_view);
+    }
     if (m_pool.m_opts.datacarrier_fullcount || !m_pool.m_opts.accept_non_std_datacarrier) {
-        const auto dcb = DatacarrierBytes(tx, m_view);
+        const auto dcb = DatacarrierBytes(tx, m_view, data_outputs);
         if (dcb.second > 0 && !(m_pool.m_opts.accept_non_std_datacarrier || ignore_rejects.count("txn-datacarrier-nonstandard"))) {
             return state.Invalid(TxValidationResult::TX_INPUTS_NOT_STANDARD, "txn-datacarrier-nonstandard");
         }
@@ -1071,7 +1076,7 @@ bool MemPoolAccept::PreChecks(ATMPArgs& args, Workspace& ws)
     // Set entry_sequence to 0 when rejectmsg_zero_mempool_entry_seq is used; this allows txs from a block
     // reorg to be marked earlier than any child txs that were already in the mempool.
     const uint64_t entry_sequence = args.m_ignore_rejects.count(rejectmsg_zero_mempool_entry_seq) ? 0 : m_pool.GetSequence();
-    int32_t extra_weight = CalculateExtraTxWeight(*ptx, m_view, ::g_weight_per_data_byte);
+    int32_t extra_weight = CalculateExtraTxWeight(*ptx, m_view, ::g_weight_per_data_byte, data_outputs);
     if (!m_subpackage.m_changeset) {
         m_subpackage.m_changeset = m_pool.GetChangeSet();
     }
diff --git a/test/functional/feature_taproot.py b/test/functional/feature_taproot.py
index 1f91fe1743b6..1915a3689514 100755
--- a/test/functional/feature_taproot.py
+++ b/test/functional/feature_taproot.py
@@ -1065,8 +1065,10 @@ def big_spend_inputs(ctx):
     add_spender(spenders, "tapscript/emptysigs/checksig", leaf="t12", **common, inputs=[b'', getter("sign")], failure={"leaf": "t13"}, **ERR_UNKNOWN_PUBKEY)
     add_spender(spenders, "tapscript/emptysigs/nochecksigverify", leaf="t12", **common, inputs=[b'', getter("sign")], failure={"leaf": "t20"}, **ERR_UNKNOWN_PUBKEY)
     add_spender(spenders, "tapscript/emptysigs/checksigadd", leaf="t14", **common, inputs=[b'', getter("sign")], failure={"leaf": "t15"}, **ERR_UNKNOWN_PUBKEY)
-    # Test that scripts over 10000 bytes (and over 201 non-push ops) are acceptable.
-    add_spender(spenders, "tapscript/no10000limit", leaf="t19", **SINGLE_SIG, **common)
+    # Test that scripts over 10000 bytes (and over 201 non-push ops) are acceptable by consensus.
+    # The leaf opens with 10001 repeats of OP_0 OP_0 OP_2DROP, which datacarrier policy counts as
+    # a data envelope, so it is only spendable in a block rather than through the mempool.
+    add_spender(spenders, "tapscript/no10000limit", leaf="t19", standard=False, **SINGLE_SIG, **common)
     # Test that a stack size of 1000 elements is permitted, but 1001 isn't.
     add_spender(spenders, "tapscript/1000stack", leaf="t21", **SINGLE_SIG, **common, failure={"leaf": "t22"}, **ERR_STACK_SIZE)
     # Test that an input stack size of 1000 elements is permitted, but 1001 isn't.
@@ -1089,7 +1091,7 @@ def big_spend_inputs(ctx):
         # n OP_CHECKSIGVERIFYs and 1 OP_CHECKSIGADD, but also one unexecuted OP_CHECKSIGVERIFY.
         lambda n, pk: (CScript([OP_DROP, pk, OP_0, OP_IF, OP_2DUP, OP_CHECKSIGVERIFY, OP_ENDIF] + [OP_2DUP, OP_CHECKSIGVERIFY] * n + [OP_2, OP_SWAP, OP_CHECKSIGADD, OP_3, OP_EQUAL]), n + 1),
         # n OP_CHECKSIGVERIFYs and 1 OP_CHECKSIGADD, but also one unexecuted OP_CHECKSIG.
-        lambda n, pk: (CScript([random.randbytes(220), OP_2DROP, pk, OP_1, OP_NOTIF, OP_2DUP, OP_CHECKSIG, OP_VERIFY, OP_ENDIF] + [OP_2DUP, OP_CHECKSIGVERIFY] * n + [OP_4, OP_SWAP, OP_CHECKSIGADD, OP_5, OP_EQUAL]), n + 1),
+        lambda n, pk: (CScript([random.randbytes(75), OP_2DROP, pk, OP_1, OP_NOTIF, OP_2DUP, OP_CHECKSIG, OP_VERIFY, OP_ENDIF] + [OP_2DUP, OP_CHECKSIGVERIFY] * n + [OP_4, OP_SWAP, OP_CHECKSIGADD, OP_5, OP_EQUAL]), n + 1),
         # n OP_CHECKSIGVERIFYs and 1 OP_CHECKSIGADD, but also one unexecuted OP_CHECKSIGADD.
         lambda n, pk: (CScript([OP_DROP, pk, OP_1, OP_IF, OP_ELSE, OP_2DUP, OP_6, OP_SWAP, OP_CHECKSIGADD, OP_7, OP_EQUALVERIFY, OP_ENDIF] + [OP_2DUP, OP_CHECKSIGVERIFY] * n + [OP_8, OP_SWAP, OP_CHECKSIGADD, OP_9, OP_EQUAL]), n + 1),
         # n+1 OP_CHECKSIGs, but also one OP_CHECKSIG with an empty signature.
diff --git a/test/functional/mempool_data_outputs.py b/test/functional/mempool_data_outputs.py
new file mode 100755
index 000000000000..d9a0f0e0b3be
--- /dev/null
+++ b/test/functional/mempool_data_outputs.py
@@ -0,0 +1,119 @@
+#!/usr/bin/env python3
+# Copyright (c) 2026 The Bitcoin Knots developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+"""Test outputs whose hash or key is data, and -rejectfakeoutputs"""
+from test_framework.messages import COutPoint, CTransaction, CTxIn, CTxInWitness, CTxOut
+from test_framework.script import CScript, OP_2, OP_3, OP_TRUE
+from test_framework.script_util import program_to_witness_script, script_to_p2wsh_script
+from test_framework.test_framework import BitcoinTestFramework
+from test_framework.test_node import TestNode
+from test_framework.util import assert_raises_rpc_error
+from test_framework.wallet import MiniWallet
+
+from random import randbytes
+
+
+class DataOutputsTest(BitcoinTestFramework):
+    def set_test_params(self):
+        self.num_nodes = 5
+        # The framework passes -corepolicy to every node, which turns -rejectfakeoutputs off
+        self.extra_args = [
+            ["-acceptnonstddatacarrier=1", "-datacarrierfullcount", "-rejectfakeoutputs=1"],
+            ["-datacarrier=1", "-datacarriersize=2", "-acceptnonstddatacarrier=1", "-datacarrierfullcount", "-rejectfakeoutputs=1"],
+            ["-corepolicy=0"],  # Knots defaults: non-OP_RETURN data carriers are rejected outright
+            ["-corepolicy=0", "-rejectfakeoutputs=0"],
+            ["-datacarrierfullcount"],  # -corepolicy alone turns -rejectfakeoutputs off
+        ]
+
+    def test_data_output_transaction(self, node: TestNode, outputs, reject_reason) -> None:
+        """Send a self-transfer with extra (value, scriptPubKey) outputs; reject_reason None means it must be accepted."""
+        tx = self.wallet.create_self_transfer(fee_rate=0, confirmed_only=True)["tx"]
+        for value, script in outputs:
+            tx.vout.append(CTxOut(nValue=value, scriptPubKey=script))
+        tx.vout[0].nValue -= sum(value for value, _ in outputs) + tx.get_vsize()  # 1 sat/vbyte
+        tx_hex = tx.serialize().hex()
+
+        if reject_reason is None:
+            self.wallet.sendrawtransaction(from_node=node, tx_hex=tx_hex)
+            assert tx.rehash() in node.getrawmempool(True), f'{tx_hex} not in mempool'
+        else:
+            assert_raises_rpc_error(-26, reject_reason, self.wallet.sendrawtransaction, from_node=node, tx_hex=tx_hex)
+
+    def run_test(self):
+        self.wallet = MiniWallet(self.nodes[0])
+        counted, tight, default, disabled, corepolicy = self.nodes
+
+        def p2wsh(program):
+            return program_to_witness_script(0, program)
+
+        self.log.info("Testing three P2WSH outputs at the dust threshold (an OLGA-style payload, whatever its magic).")
+        dust_run = [(330, p2wsh(randbytes(32))) for _ in range(3)]
+        self.test_data_output_transaction(node=default, outputs=dust_run, reject_reason="txn-datacarrier-nonstandard")
+        # Counted as 3 * 41 bytes where non-standard carriers are accepted
+        self.test_data_output_transaction(node=counted, outputs=dust_run, reject_reason="txn-datacarrier-exceeded")
+        # Not counted at all with -rejectfakeoutputs=0, or under -corepolicy
+        self.test_data_output_transaction(node=disabled, outputs=dust_run, reject_reason=None)
+        self.test_data_output_transaction(node=corepolicy, outputs=dust_run, reject_reason=None)
+
+        self.log.info("Testing a run at 546 sat, what the fake-key encoder pays per chunk.")
+        self.test_data_output_transaction(node=default, outputs=[(546, p2wsh(randbytes(32))) for _ in range(3)], reject_reason="txn-datacarrier-nonstandard")
+
+        self.log.info("Testing that small P2WSH outputs of different values, or 330-sat taproot outputs, are still standard.")
+        self.test_data_output_transaction(node=default, outputs=[(330, p2wsh(randbytes(32))), (330, p2wsh(randbytes(32))), (400, p2wsh(randbytes(32))), (450, p2wsh(randbytes(32)))], reject_reason=None)
+        on_curve = [bytes.fromhex(k) for k in ("9f537de0a7f7403067880d3d62d3f8d20889c4f77b74b612406d7d5ce0a9b206", "4d6abe64a78cd5dcb98a719490753a84a061274cc6f7ecefea0aedad967676ba", "44d8f2d6c1d5f3d2b53fda185d92462adf0ec0f4a66a6e31680b731ddbca111d")]
+        self.test_data_output_transaction(node=default, outputs=[(330, program_to_witness_script(1, k)) for k in on_curve], reject_reason=None)
+
+        self.log.info("Testing that three outputs at the dust threshold to one script are still standard.")
+        same_script = p2wsh(randbytes(32))
+        self.test_data_output_transaction(node=default, outputs=[(330, same_script)] * 3, reject_reason=None)
+
+        self.log.info("Testing that a pair of anchor-sized P2WSH outputs is still standard.")
+        anchors = [(330, p2wsh(randbytes(32))) for _ in range(2)] + [(10000, p2wsh(randbytes(32)))]
+        self.test_data_output_transaction(node=default, outputs=anchors, reject_reason=None)
+
+        self.log.info("Testing a taproot output whose key is not on the curve.")
+        off_curve = bytes.fromhex("4420f4cd273fe68ccc6df6aaf1bd40d6f879884882386754e2c2e55cfad0b0bb")
+        self.test_data_output_transaction(node=default, outputs=[(10000, program_to_witness_script(1, off_curve))], reject_reason="txn-datacarrier-nonstandard")
+        self.test_data_output_transaction(node=disabled, outputs=[(10000, program_to_witness_script(1, off_curve))], reject_reason=None)
+
+        self.log.info("Testing P2WSH outputs whose hash is padded data.")
+        padded = [(10000, p2wsh(randbytes(24) + bytes(8))) for _ in range(2)]
+        self.test_data_output_transaction(node=default, outputs=padded[:1], reject_reason="txn-datacarrier-nonstandard")
+        # Two of them are 82 bytes, inside the default -datacarriersize where non-standard carriers are accepted
+        self.test_data_output_transaction(node=counted, outputs=padded, reject_reason=None)
+        self.test_data_output_transaction(node=tight, outputs=padded, reject_reason="txn-datacarrier-exceeded")
+
+        self.log.info("Testing that an output to the all-zero burn hash is not data.")
+        self.test_data_output_transaction(node=default, outputs=[(20000, program_to_witness_script(0, bytes(20)))], reject_reason=None)
+
+        self.log.info("Testing that outputs paying back the scripts of the coins spent are not data.")
+        # A run of three 330-sat P2WSH outputs is data unless each pays a script the
+        # transaction spends: then the spender holds those scripts and chose nothing in them.
+        scripts = [CScript([OP_TRUE]), CScript([OP_2]), CScript([OP_3])]
+        fund = self.wallet.create_self_transfer(fee_rate=0, confirmed_only=True)["tx"]
+        for script in scripts:
+            fund.vout.append(CTxOut(nValue=330, scriptPubKey=script_to_p2wsh_script(script)))
+        fund.vout[0].nValue -= 3 * 330 + fund.get_vsize()
+        self.wallet.sendrawtransaction(from_node=disabled, tx_hex=fund.serialize().hex())
+        # The other nodes refuse the funding run, so only the block can sync
+        self.generate(disabled, 1, sync_fun=self.no_op)
+        self.sync_blocks()
+        fund_txid = int(fund.rehash(), 16)
+        fee_utxo = self.wallet.get_utxo(confirmed_only=True)
+        spend = CTransaction()
+        spend.vin = [CTxIn(COutPoint(int(fee_utxo["txid"], 16), fee_utxo["vout"]))] + [CTxIn(COutPoint(fund_txid, i + 1)) for i in range(len(scripts))]
+        spend.vout = [CTxOut(nValue=330, scriptPubKey=script_to_p2wsh_script(script)) for script in scripts]
+        spend.vout.append(CTxOut(nValue=int(fee_utxo["value"] * 100_000_000) - 1000, scriptPubKey=self.wallet.get_output_script()))
+        self.wallet.sign_tx(spend)
+        wallet_stack = list(spend.wit.vtxinwit[0].scriptWitness.stack)
+        spend.wit.vtxinwit = [CTxInWitness() for _ in spend.vin]
+        spend.wit.vtxinwit[0].scriptWitness.stack = wallet_stack
+        for i, script in enumerate(scripts):
+            spend.wit.vtxinwit[i + 1].scriptWitness.stack = [script]
+        self.wallet.sendrawtransaction(from_node=default, tx_hex=spend.serialize().hex())
+        assert spend.rehash() in default.getrawmempool()
+
+
+if __name__ == '__main__':
+    DataOutputsTest(__file__).main()
diff --git a/test/functional/mempool_datacarrier.py b/test/functional/mempool_datacarrier.py
index 540597199994..3b945f693528 100755
--- a/test/functional/mempool_datacarrier.py
+++ b/test/functional/mempool_datacarrier.py
@@ -3,6 +3,7 @@
 # Distributed under the MIT software license, see the accompanying
 # file COPYING or http://www.opensource.org/licenses/mit-license.php.
 """Test datacarrier functionality"""
+from test_framework.key import ECKey
 from test_framework.messages import (
     COutPoint,
     CTransaction,
@@ -15,10 +16,15 @@
     CScript,
     OP_1,
     OP_2DROP,
+    OP_7,
+    OP_CHECKMULTISIG,
     OP_DROP,
     OP_RETURN,
+    SIGHASH_ALL,
+    SegwitV0SignatureHash,
     taproot_construct,
 )
+from test_framework.script_util import script_to_p2wsh_script
 from test_framework.test_framework import BitcoinTestFramework
 from test_framework.test_node import TestNode
 from test_framework.util import assert_raises_rpc_error
@@ -91,6 +97,90 @@ def test_opnet_transaction(self, node: TestNode, success: bool) -> None:
             assert_raises_rpc_error(-26, "txn-datacarrier-exceeded",
                                     self.wallet.sendrawtransaction, from_node=node, tx_hex=tx_hex)
 
+    def test_unproven_pubkeys_transaction(self, node: TestNode, m: int, n: int, success: bool,
+                                          num_inputs: int = 1) -> None:
+        """Spend num_inputs m-of-n P2WSH multisig outputs, offering every signature each asks for.
+
+        The n - m keys left over are ones no signature can prove, and past a small tolerance
+        their bytes are payload rather than a spending condition. The tolerance is per script,
+        so several wide multisig inputs in one transaction do add up.
+        """
+        keys = []
+        for _ in range(n):
+            key = ECKey()
+            key.generate(compressed=True)
+            keys.append(key)
+        # Above 16 a key count is a minimal push rather than an OP_N, which CScript handles.
+        script = CScript([m] + [k.get_pubkey().get_bytes() for k in keys] + [n, OP_CHECKMULTISIG])
+        script_pubkey = script_to_p2wsh_script(script)
+
+        funding_value = 100_000
+        funding = [self.wallet.send_to(from_node=self.nodes[0], scriptPubKey=script_pubkey,
+                                       amount=funding_value) for _ in range(num_inputs)]
+        self.generate(self.wallet, 1, sync_fun=self.sync_blocks)
+
+        spend_tx = CTransaction()
+        spend_tx.version = 2
+        spend_tx.vin = [CTxIn(COutPoint(int(f['txid'], 16), f['sent_vout'])) for f in funding]
+        spend_tx.vout = [CTxOut(funding_value * num_inputs - 10000, script_pubkey)]
+        spend_tx.wit.vtxinwit = [CTxInWitness() for _ in funding]
+        for i in range(num_inputs):
+            sighash = SegwitV0SignatureHash(script, spend_tx, i, SIGHASH_ALL, funding_value)
+            sigs = [k.sign_ecdsa(sighash) + bytes([SIGHASH_ALL]) for k in keys[:m]]
+            # The leading empty item is the CHECKMULTISIG dummy.
+            spend_tx.wit.vtxinwit[i].scriptWitness.stack = [b''] + sigs + [bytes(script)]
+        tx_hex = spend_tx.serialize().hex()
+
+        if success:
+            self.wallet.sendrawtransaction(from_node=node, tx_hex=tx_hex)
+            assert spend_tx.rehash() in node.getrawmempool(True)
+        else:
+            assert_raises_rpc_error(-26, "txn-datacarrier-exceeded",
+                                    self.wallet.sendrawtransaction, from_node=node, tx_hex=tx_hex)
+
+    def test_bare_envelope(self, node: TestNode, data_len: int, success: bool, interleave_pushnum: bool = False) -> None:
+        # A bare inscription envelope: <marker> <data>... balanced by OP_2DROP,
+        # with no OP_IF wrapper (the shape ordinals/ord#4545 uses under BIP-110).
+        # A pushnum interleaved in the run (which ord's parser accepts as payload)
+        # must not strand the large push from datacarrier counting.
+        if interleave_pushnum:
+            envelope_script = CScript([randbytes(data_len), OP_7, randbytes(1), OP_2DROP, OP_DROP, OP_1])
+        else:
+            envelope_script = CScript([b'ord', randbytes(data_len), OP_2DROP, OP_1])
+        internal_key = b'\x01' * 32
+        tap = taproot_construct(internal_key, [("leaf", envelope_script), ("dummy", CScript([OP_1]))])
+        leaf = tap.leaves["leaf"]
+        control_block = bytes([leaf.version | tap.negflag]) + tap.internal_pubkey + leaf.merklebranch
+        assert len(control_block) == 65
+
+        utxo = self.wallet.get_utxo()
+        funding_tx = CTransaction()
+        funding_tx.vin = [CTxIn(COutPoint(int(utxo['txid'], 16), utxo['vout']))]
+        funding_value = int(utxo['value'] * 100_000_000) - 1000
+        funding_tx.vout = [CTxOut(funding_value, tap.scriptPubKey)]
+        funding_tx.version = 2
+        self.wallet.sign_tx(funding_tx)
+        funding_tx.rehash()
+        self.nodes[0].sendrawtransaction(funding_tx.serialize().hex())
+        self.generate(self.nodes[0], 1, sync_fun=self.sync_blocks)
+
+        spend_tx = CTransaction()
+        spend_tx.version = 2
+        spend_tx.vin = [CTxIn(COutPoint(int(funding_tx.hash, 16), 0))]
+        spend_tx.vout = [CTxOut(funding_value - 1000, tap.scriptPubKey)]
+        spend_tx.wit.vtxinwit = [CTxInWitness()]
+        spend_tx.wit.vtxinwit[0].scriptWitness.stack = [
+            bytes(envelope_script),  # tapscript
+            control_block,           # control block (65 bytes)
+        ]
+        tx_hex = spend_tx.serialize().hex()
+
+        if success:
+            self.wallet.sendrawtransaction(from_node=node, tx_hex=tx_hex)
+            assert spend_tx.rehash() in node.getrawmempool(True)
+        else:
+            assert_raises_rpc_error(-26, "txn-datacarrier-exceeded",
+                                    self.wallet.sendrawtransaction, from_node=node, tx_hex=tx_hex)
 
     def run_test(self):
         self.wallet = MiniWallet(self.nodes[0])
@@ -141,6 +231,40 @@ def run_test(self):
         self.log.info("Testing an OPNet transaction (just pushing 'op') with -datacarriersize=2.")
         self.test_opnet_transaction(node=self.nodes[3], success=False)
 
+        self.log.info("Testing a bare OP_2DROP envelope larger than the default -datacarriersize.")
+        self.test_bare_envelope(node=self.nodes[0], data_len=MAX_OP_RETURN_RELAY, success=False)
+
+        self.log.info("Testing a bare OP_2DROP envelope smaller than the default -datacarriersize.")
+        # data_len >= 2 keeps the payload a minimal push; a 1-byte push of 1..16 or 0x81 would be
+        # rejected by MINIMALDATA in script verification rather than accepted by the datacarrier check.
+        self.test_bare_envelope(node=self.nodes[0], data_len=2, success=True)
+
+        self.log.info("Testing a bare envelope with a pushnum interleaved in the push run.")
+        self.test_bare_envelope(node=self.nodes[0], data_len=MAX_OP_RETURN_RELAY, success=False, interleave_pushnum=True)
+
+        self.log.info("Testing ordinary multisig, which is charged nothing however wide.")
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=2, n=3, success=True)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=3, n=5, success=True)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=2, n=6, success=True)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=11, n=15, success=True)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=14, n=17, success=True)
+        # Several inputs of the same shape, since the budget is per transaction
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=2, n=5, success=True, num_inputs=3)
+
+        self.log.info("Testing a multisig padded out with keys no signature can prove.")
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=1, n=11, success=True)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=1, n=15, success=False)
+
+        self.log.info("Testing that -datacarriersize governs the spare keys, and that multisig "
+                      "with nothing to spare is unaffected by it.")
+        self.test_unproven_pubkeys_transaction(node=self.nodes[3], m=2, n=3, success=True)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[3], m=1, n=12, success=False)
+
+        self.log.info("Testing that what is charged is charged per script, so it adds up over "
+                      "the inputs of a transaction.")
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=1, n=12, success=True, num_inputs=2)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=1, n=12, success=False, num_inputs=3)
+
 
 if __name__ == '__main__':
     DataCarrierTest(__file__).main()
diff --git a/test/functional/mempool_dead_branch.py b/test/functional/mempool_dead_branch.py
new file mode 100755
index 000000000000..93cffa9196ed
--- /dev/null
+++ b/test/functional/mempool_dead_branch.py
@@ -0,0 +1,99 @@
+#!/usr/bin/env python3
+# Copyright (c) 2026 The Bitcoin Knots developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+"""Test data in a dead conditional branch and -rejectdeadbranches"""
+from test_framework.messages import (
+    COutPoint,
+    CTransaction,
+    CTxIn,
+    CTxInWitness,
+    CTxOut,
+)
+from test_framework.script import (
+    CScript,
+    OP_0,
+    OP_1,
+    OP_ELSE,
+    OP_ENDIF,
+    OP_IF,
+    OP_NOP,
+    OP_NOTIF,
+)
+from test_framework.script_util import script_to_p2wsh_script
+from test_framework.test_framework import BitcoinTestFramework
+from test_framework.util import assert_equal, assert_greater_than
+from test_framework.wallet import MiniWallet
+
+
+class DeadBranchTest(BitcoinTestFramework):
+    def set_test_params(self):
+        self.num_nodes = 5
+        self.extra_args = [
+            [],  # the framework passes -corepolicy, which accepts non-standard carriers
+            ["-corepolicy=0"],  # the Knots default
+            ["-corepolicy=0", "-rejectdeadbranches=0"],
+            ["-corepolicy=0", "-acceptnonstddatacarrier=1"],
+            ["-corepolicy=0", "-acceptnonstddatacarrier=1", "-rejectdeadbranches=0"],
+        ]
+
+    def spend(self, witness_script):
+        """Fund a P2WSH output to witness_script and return its spend, which needs no signature"""
+        funding = self.wallet.send_to(from_node=self.nodes[0], scriptPubKey=script_to_p2wsh_script(witness_script), amount=100000)
+        self.generate(self.nodes[0], 1)
+        tx = CTransaction()
+        tx.version = 2
+        tx.vin = [CTxIn(COutPoint(int(funding["txid"], 16), funding["sent_vout"]))]
+        tx.vout = [CTxOut(99000, self.wallet.get_output_script())]
+        tx.wit.vtxinwit = [CTxInWitness()]
+        tx.wit.vtxinwit[0].scriptWitness.stack = [bytes(witness_script)]
+        return tx.serialize().hex()
+
+    def check(self, node, tx_hex, allowed, reason=None):
+        result = node.testmempoolaccept([tx_hex])[0]
+        assert_equal(result["allowed"], allowed)
+        if reason:
+            assert_equal(result["reject-reason"], reason)
+        return result
+
+    def run_test(self):
+        self.wallet = MiniWallet(self.nodes[0])
+        corepolicy, default, disabled, costed, costed_disabled = self.nodes
+
+        # OP_1 makes OP_NOTIF skip its branch, so the push cannot affect the
+        # spend. This is the JXL-n-hide witness shape; the OP_FALSE OP_IF
+        # inscription envelope is the same idea with the constant reversed.
+        self.log.info("Data in an OP_1 OP_NOTIF branch is rejected by default")
+        dead_notif = self.spend(CScript([OP_1, OP_NOTIF, b'\xab' * 10, OP_ENDIF, OP_1]))
+        self.check(default, dead_notif, False, "txn-datacarrier-nonstandard")
+
+        self.log.info("-rejectdeadbranches=0 and -corepolicy accept it")
+        self.check(disabled, dead_notif, True)
+        self.check(corepolicy, dead_notif, True)
+
+        self.log.info("Data in the else of a branch a constant always takes is rejected too")
+        dead_else = self.spend(CScript([OP_1, OP_IF, OP_1, OP_ELSE, b'\xab' * 10, OP_ENDIF]))
+        self.check(default, dead_else, False, "txn-datacarrier-nonstandard")
+        self.check(disabled, dead_else, True)
+
+        self.log.info("A guard that constants decide is counted however it is computed")
+        nop_guard = self.spend(CScript([OP_1, OP_NOP, OP_NOTIF, b'\xab' * 10, OP_ENDIF, OP_1]))
+        self.check(default, nop_guard, False, "txn-datacarrier-nonstandard")
+        self.check(disabled, nop_guard, True)
+
+        self.log.info("-rejectdeadbranches=0 still counts the OP_FALSE OP_IF envelope")
+        envelope = self.spend(CScript([OP_0, OP_IF, b'\xab' * 10, OP_ENDIF, OP_1]))
+        self.check(default, envelope, False, "txn-datacarrier-nonstandard")
+        self.check(disabled, envelope, False, "txn-datacarrier-nonstandard")
+
+        self.log.info("A branch the guard takes is not counted: its push is the spend's result")
+        self.check(default, self.spend(CScript([OP_0, OP_NOTIF, b'\xab' * 10, OP_ENDIF])), True)
+
+        self.log.info("The switch reaches -datacarriercost too")
+        counted = self.check(costed, dead_notif, True)
+        uncounted = self.check(costed_disabled, dead_notif, True)
+        assert_greater_than(counted["vsize"], uncounted["vsize"])
+
+
+if __name__ == '__main__':
+    DeadBranchTest(__file__).main()
diff --git a/test/functional/test_runner.py b/test/functional/test_runner.py
index 45a49f73a0ed..a6b3738a2349 100755
--- a/test/functional/test_runner.py
+++ b/test/functional/test_runner.py
@@ -164,6 +164,7 @@
     'wallet_signer.py --descriptors',
     'wallet_importmulti.py --legacy-wallet',
     'mempool_limit.py',
+    'mempool_data_outputs.py',
     'rpc_txoutproof.py',
     'rpc_orphans.py',
     'wallet_listreceivedby.py --legacy-wallet',
@@ -296,6 +297,7 @@
     'feature_utxo_set_hash.py',
     'feature_rbf.py',
     'mempool_packages.py',
+    'mempool_dead_branch.py',
     'mempool_package_onemore.py',
     'mempool_package_limits.py',
     'mempool_package_rbf.py',