diff --git a/doc/release-notes-dead-branch-data.md b/doc/release-notes-dead-branch-data.md
new file mode 100644
index 000000000000..b96b71fa8138
--- /dev/null
+++ b/doc/release-notes-dead-branch-data.md
@@ -0,0 +1,12 @@
+Policy
+------
+
+- Data in a conditional part that constants make unreachable now counts as
+  data carrier bytes, so under the default settings a transaction carrying it
+  is rejected with `txn-datacarrier-nonstandard`. This already applied to the
+  `OP_FALSE OP_IF ... OP_ENDIF` inscription envelope; it now also covers
+  `OP_1 OP_NOTIF ... OP_ENDIF`, guards computed from constants, and the dead
+  part of an `OP_ELSE`. Scripts that branch on witness data or a signature
+  check, which is how spendable scripts branch, are unaffected. The new
+  `-rejectdeadbranches` option (default: 1, reset by `-corepolicy`) turns the
+  wider rule off and leaves only the envelope counted.
diff --git a/src/init.cpp b/src/init.cpp
index 1d75c41925b5..048d0cf1ec77 100644
--- a/src/init.cpp
+++ b/src/init.cpp
@@ -721,6 +721,7 @@ void SetupServerArgs(ArgsManager& argsman, bool can_listen_ipc)
     argsman.AddArg("-bytespersigopstrict", strprintf("Minimum bytes per sigop in transactions we relay and mine (default: %u)", DEFAULT_BYTES_PER_SIGOP_STRICT), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
     argsman.AddArg("-datacarrier", strprintf("Relay and mine data carrier transactions (default: %u)", DEFAULT_ACCEPT_DATACARRIER), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
     argsman.AddArg("-datacarriercost", strprintf("Treat extra data in transactions as at least N vbytes per actual byte (default: %s)", DEFAULT_WEIGHT_PER_DATA_BYTE / 4.0), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
+    argsman.AddArg("-rejectdeadbranches", strprintf("Count data in a conditional branch that a pushed constant makes unreachable as data carrier bytes; the OP_FALSE OP_IF envelope is counted either way (default: %u)", DEFAULT_REJECT_DEAD_BRANCHES), ArgsManager::ALLOW_ANY, OptionsCategory::NODE_RELAY);
     argsman.AddArg("-datacarrierfullcount", strprintf("Apply datacarriersize limit to all known datacarrier methods (default: %u)", DEFAULT_DATACARRIER_FULLCOUNT), ArgsManager::ALLOW_ANY | (DEFAULT_DATACARRIER_FULLCOUNT ? uint32_t{ArgsManager::DEBUG_ONLY} : 0), OptionsCategory::NODE_RELAY);
     argsman.AddArg("-datacarriersize",
                    strprintf("Maximum size of data in data carrier transactions we relay and mine, in bytes (default: %u)",
@@ -873,6 +874,7 @@ void InitParameterInteraction(ArgsManager& args)
         args.SoftSetArg("-subdustfeepenalty", "0");
         args.SoftSetArg("-datacarriercost", "0.25");
         args.SoftSetArg("-datacarrierfullcount", "0");
+        args.SoftSetArg("-rejectdeadbranches", "0");
         args.SoftSetArg("-maxtxlegacysigops", strprintf("%s", std::numeric_limits<unsigned int>::max()));
         args.SoftSetArg("-maxscriptsize", strprintf("%s", std::numeric_limits<unsigned int>::max()));
         args.SoftSetArg("-mempooltruc", "enforce");
@@ -1213,6 +1215,8 @@ bool AppInitParameterInteraction(const ArgsManager& args)
 
     g_script_size_policy_limit = args.GetIntArg("-maxscriptsize", g_script_size_policy_limit);
 
+    g_reject_dead_branches = args.GetBoolArg("-rejectdeadbranches", g_reject_dead_branches);
+
     nBytesPerSigOp = args.GetIntArg("-bytespersigop", nBytesPerSigOp);
     nBytesPerSigOpStrict = args.GetIntArg("-bytespersigopstrict", nBytesPerSigOpStrict);
 
diff --git a/src/policy/policy.cpp b/src/policy/policy.cpp
index 679c0c967a1f..8efcde9bf4ef 100644
--- a/src/policy/policy.cpp
+++ b/src/policy/policy.cpp
@@ -33,6 +33,7 @@
 #include <vector>
 
 unsigned int g_script_size_policy_limit{DEFAULT_SCRIPT_SIZE_POLICY_LIMIT};
+bool g_reject_dead_branches{DEFAULT_REJECT_DEAD_BRANCHES};
 
 CAmount GetDustThreshold(const CTxOut& txout, const CFeeRate& dustRelayFeeIn)
 {
@@ -633,6 +634,16 @@ std::pair<CScript, unsigned int> GetScriptForTransactionInput(CScript prevScript
     return std::make_pair(CScript(), 0);
 }
 
+/**
+ * Whether to look for dead branches in this input. A witness over the script size
+ * limit fails IsWitnessStandard right after, so following its constants would be
+ * work spent on a transaction that is rejected anyway.
+ */
+static bool FollowDeadBranches(const CTxIn& txin)
+{
+    return ::g_reject_dead_branches && GetSerializeSize(txin.scriptWitness.stack) <= g_script_size_policy_limit;
+}
+
 std::pair<size_t, size_t> DatacarrierBytes(const CTransaction& tx, const CCoinsViewCache& view)
 {
     std::pair<size_t, size_t> ret{0, 0};
@@ -640,7 +651,7 @@ std::pair<size_t, size_t> DatacarrierBytes(const CTransaction& tx, const CCoinsV
     for (const CTxIn& txin : tx.vin) {
         const CTxOut &utxo = view.AccessCoin(txin.prevout).out;
         auto[script, consensus_weight_per_byte] = GetScriptForTransactionInput(utxo.scriptPubKey, txin);
-        const auto dcb = script.DatacarrierBytes(0, &txin.scriptWitness);
+        const auto dcb = script.DatacarrierBytes(0, &txin.scriptWitness, FollowDeadBranches(txin));
         ret.first += dcb.first;
         ret.second += dcb.second;
     }
@@ -664,7 +675,7 @@ int32_t CalculateExtraTxWeight(const CTransaction& tx, const CCoinsViewCache& vi
             const CTxOut &utxo = view.AccessCoin(txin.prevout).out;
             auto[script, consensus_weight_per_byte] = GetScriptForTransactionInput(utxo.scriptPubKey, txin);
             if (weight_per_data_byte > consensus_weight_per_byte) {
-                const auto dcb = script.DatacarrierBytes(0, &txin.scriptWitness);
+                const auto dcb = script.DatacarrierBytes(0, &txin.scriptWitness, FollowDeadBranches(txin));
                 mod_weight += int64_t(dcb.first + dcb.second) * (weight_per_data_byte - consensus_weight_per_byte);
             }
         }
diff --git a/src/policy/policy.h b/src/policy/policy.h
index 6c52b6aebff2..e5e5be158fae 100644
--- a/src/policy/policy.h
+++ b/src/policy/policy.h
@@ -64,6 +64,8 @@ static constexpr unsigned int DEFAULT_BYTES_PER_SIGOP{20};
 static constexpr unsigned int DEFAULT_BYTES_PER_SIGOP_STRICT{20};
 /** Default for -datacarriercost (multiplied by WITNESS_SCALE_FACTOR) */
 static constexpr unsigned int DEFAULT_WEIGHT_PER_DATA_BYTE{4};
+/** Default for -rejectdeadbranches */
+static constexpr bool DEFAULT_REJECT_DEAD_BRANCHES{true};
 /** Default for -rejecttokens */
 static constexpr bool DEFAULT_REJECT_TOKENS{true};
 /** Default for -subdustfeepenalty */
diff --git a/src/policy/settings.h b/src/policy/settings.h
index 03cfc3775da1..6c60e3ecef64 100644
--- a/src/policy/settings.h
+++ b/src/policy/settings.h
@@ -10,5 +10,6 @@ extern unsigned int g_script_size_policy_limit;
 extern unsigned int nBytesPerSigOp;
 extern unsigned int nBytesPerSigOpStrict;
 extern unsigned int g_weight_per_data_byte;
+extern bool g_reject_dead_branches;
 
 #endif // BITCOIN_POLICY_SETTINGS_H
diff --git a/src/script/script.cpp b/src/script/script.cpp
index fbb52fee7f9b..0fbb8f4ea7a0 100644
--- a/src/script/script.cpp
+++ b/src/script/script.cpp
@@ -8,10 +8,12 @@
 #include <crypto/common.h>
 #include <crypto/hex_base.h>
 #include <hash.h>
+#include <pubkey.h>
 #include <script/interpreter.h>
 #include <uint256.h>
 #include <util/hash_type.h>
 
+#include <algorithm>
 #include <string>
 
 CScriptID::CScriptID(const CScript& in) : BaseHash(Hash160(in)) {}
@@ -304,6 +306,378 @@ bool CScript::HasValidOps() const
     return true;
 }
 
+// Static truthiness of a byte vector, matching CastToBool in the interpreter:
+// any nonzero byte is true, except a lone trailing sign bit (negative zero).
+static bool DataCarrierCastToBool(const std::vector<unsigned char>& vch)
+{
+    for (size_t i = 0; i < vch.size(); ++i) {
+        if (vch[i] != 0) {
+            if (i == vch.size() - 1 && vch[i] == 0x80) return false;
+            return true;
+        }
+    }
+    return false;
+}
+
+namespace {
+/** A value on the stack that follows from constants alone, as an index into KnownValues; 0 if it depends on the witness or a signature */
+using KnownValue = size_t;
+constexpr KnownValue UNKNOWN{0};
+
+/** The values FindDeadParts has seen; the stacks hold indexes, so copying a value costs nothing */
+class KnownValues
+{
+    std::vector<std::vector<unsigned char>> m_values{{}};
+
+public:
+    KnownValue Add(std::vector<unsigned char> v)
+    {
+        m_values.push_back(std::move(v));
+        return m_values.size() - 1;
+    }
+    KnownValue AddNum(int64_t n) { return Add(CScriptNum{n}.getvch()); }
+    const std::vector<unsigned char>& Get(KnownValue v) const { return m_values[v]; }
+    /** The value as a script number, if it is known and a valid one */
+    bool Num(KnownValue v, int64_t& out) const
+    {
+        if (v == UNKNOWN) return false;
+        try {
+            out = CScriptNum{m_values[v], /*fRequireMinimal=*/true}.GetInt64();
+            return true;
+        } catch (const scriptnum_error&) {
+            return false;
+        }
+    }
+};
+
+/** The top of the stack as far as constants determine it; below it nothing is known */
+class KnownStack
+{
+    std::vector<KnownValue> m_items;
+
+public:
+    size_t size() const { return m_items.size(); }
+    void Push(KnownValue v)
+    {
+        m_items.push_back(std::move(v));
+        if (m_items.size() > MAX_STACK_SIZE) Forget(); // the script fails here anyway
+    }
+    KnownValue Pop()
+    {
+        if (m_items.empty()) return UNKNOWN;
+        KnownValue v{std::move(m_items.back())};
+        m_items.pop_back();
+        return v;
+    }
+    KnownValue Peek(size_t depth) const { return depth < m_items.size() ? m_items[m_items.size() - 1 - depth] : UNKNOWN; }
+    KnownValue& At(size_t depth) { return m_items[m_items.size() - 1 - depth]; }
+    void Forget() { m_items.clear(); }
+};
+
+} // namespace
+
+DeadParts FindDeadParts(const CScript& script)
+{
+    DeadParts dead{std::vector<bool>(script.size()), std::vector<bool>(script.size())};
+    // Per open conditional: whether constants decide it, and whether its current part runs
+    struct Frame { bool known; bool running; };
+    std::vector<Frame> frames;
+    size_t not_running{0}; // open frames whose current part does not run
+    KnownValues values;
+    KnownStack stack, alt;
+    opcodetype opcode;
+    std::vector<unsigned char> push;
+    // Each opcode costs one step, and OP_ROLL also costs its depth, the one move
+    // that is not constant time. Stop, marking nothing more, after a few steps per
+    // byte: no spendable script rolls deep over and over, and one built to do so
+    // gets the plain scan instead of costing the node more than its size.
+    size_t steps_left{4 * size_t{script.size()}};
+
+    for (CScript::const_iterator it{script.begin()}; it < script.end();) {
+        const size_t offset{size_t(it - script.begin())};
+        if (!script.GetOp(it, opcode, push)) break;
+        if (steps_left == 0) break;
+        --steps_left;
+
+        if (opcode == OP_IF || opcode == OP_NOTIF) {
+            if (not_running) {
+                frames.push_back({true, false});
+                ++not_running;
+                continue;
+            }
+            const KnownValue cond{stack.Pop()};
+            if (cond != UNKNOWN) {
+                const bool runs{DataCarrierCastToBool(values.Get(cond)) == (opcode == OP_IF)};
+                if (!runs) {
+                    dead.at_if[offset] = true;
+                    ++not_running;
+                }
+                frames.push_back({true, runs});
+            } else {
+                frames.push_back({false, true});
+            }
+            continue;
+        }
+        if (opcode == OP_ELSE || opcode == OP_ENDIF) {
+            if (frames.empty()) break; // unbalanced: the script cannot run
+            Frame& frame{frames.back()};
+            const bool outer_running{not_running == (frame.running ? 0 : 1)};
+            if (opcode == OP_ELSE) {
+                if (frame.known && outer_running) {
+                    frame.running = !frame.running;
+                    if (frame.running) {
+                        --not_running;
+                    } else {
+                        ++not_running;
+                        dead.at_else[offset] = true;
+                    }
+                } else if (!frame.known) {
+                    // The else part starts from the state before the OP_IF, which is not kept
+                    stack.Forget();
+                    alt.Forget();
+                }
+            } else {
+                if (!frame.running) --not_running;
+                if (!frame.known && not_running == 0) {
+                    stack.Forget();
+                    alt.Forget();
+                }
+                frames.pop_back();
+            }
+            continue;
+        }
+        if (not_running) continue;
+
+        if (opcode <= OP_PUSHDATA4) {
+            stack.Push(values.Add(push));
+            continue;
+        }
+        if (opcode == OP_1NEGATE || (opcode >= OP_1 && opcode <= OP_16)) {
+            stack.Push(values.AddNum(opcode == OP_1NEGATE ? -1 : CScript::DecodeOP_N(opcode)));
+            continue;
+        }
+        switch (opcode) {
+        case OP_NOP: case OP_NOP1: case OP_CHECKLOCKTIMEVERIFY: case OP_CHECKSEQUENCEVERIFY:
+        case OP_NOP4: case OP_NOP5: case OP_NOP6: case OP_NOP7: case OP_NOP8: case OP_NOP9: case OP_NOP10:
+        case OP_CODESEPARATOR:
+            break;
+        case OP_VERIFY: case OP_DROP:
+            stack.Pop();
+            break;
+        case OP_2DROP:
+            stack.Pop();
+            stack.Pop();
+            break;
+        case OP_TOALTSTACK:
+            alt.Push(stack.Pop());
+            break;
+        case OP_FROMALTSTACK:
+            stack.Push(alt.Pop());
+            break;
+        case OP_DUP:
+            stack.Push(stack.Peek(0));
+            break;
+        case OP_OVER:
+            stack.Push(stack.Peek(1));
+            break;
+        case OP_2DUP: {
+            const KnownValue a{stack.Peek(1)}, b{stack.Peek(0)};
+            stack.Push(a);
+            stack.Push(b);
+            break;
+        }
+        case OP_3DUP: {
+            const KnownValue a{stack.Peek(2)}, b{stack.Peek(1)}, c{stack.Peek(0)};
+            stack.Push(a);
+            stack.Push(b);
+            stack.Push(c);
+            break;
+        }
+        case OP_2OVER: {
+            const KnownValue a{stack.Peek(3)}, b{stack.Peek(2)};
+            stack.Push(a);
+            stack.Push(b);
+            break;
+        }
+        case OP_IFDUP: {
+            const KnownValue top{stack.Peek(0)};
+            if (top == UNKNOWN) {
+                stack.Forget(); // whether it duplicates is not known, so neither is the depth
+            } else if (DataCarrierCastToBool(values.Get(top))) {
+                stack.Push(top);
+            }
+            break;
+        }
+        case OP_SIZE: {
+            const KnownValue top{stack.Peek(0)};
+            stack.Push(top == UNKNOWN ? UNKNOWN : values.AddNum(values.Get(top).size()));
+            break;
+        }
+        case OP_DEPTH:
+            stack.Push(UNKNOWN);
+            break;
+        case OP_NIP: case OP_SWAP: case OP_TUCK: case OP_ROT: case OP_2SWAP: case OP_2ROT: {
+            const size_t need{opcode == OP_2ROT ? 6u : opcode == OP_2SWAP ? 4u : opcode == OP_ROT ? 3u : 2u};
+            if (stack.size() < need) {
+                stack.Forget();
+                break;
+            }
+            if (opcode == OP_NIP) {
+                const KnownValue top{stack.Pop()};
+                stack.Pop();
+                stack.Push(top);
+            } else if (opcode == OP_SWAP) {
+                std::swap(stack.At(0), stack.At(1));
+            } else if (opcode == OP_TUCK) {
+                const KnownValue top{stack.Pop()}, second{stack.Pop()};
+                stack.Push(top);
+                stack.Push(second);
+                stack.Push(top);
+            } else if (opcode == OP_ROT) {
+                std::swap(stack.At(2), stack.At(1));
+                std::swap(stack.At(1), stack.At(0));
+            } else if (opcode == OP_2SWAP) {
+                std::swap(stack.At(3), stack.At(1));
+                std::swap(stack.At(2), stack.At(0));
+            } else {
+                std::vector<KnownValue> six;
+                for (int i{0}; i < 6; ++i) six.push_back(stack.Pop());
+                // six[5] and six[4] were deepest; they move to the top
+                for (int i{3}; i >= 0; --i) stack.Push(six[i]);
+                stack.Push(six[5]);
+                stack.Push(six[4]);
+            }
+            break;
+        }
+        case OP_PICK: case OP_ROLL: {
+            int64_t n{0};
+            const bool known{values.Num(stack.Pop(), n)};
+            if (!known || n < 0 || size_t(n) >= stack.size()) {
+                // Reaches below what is known, or the depth itself is unknown
+                if (opcode == OP_ROLL || !known) stack.Forget();
+                stack.Push(UNKNOWN);
+                break;
+            }
+            const KnownValue v{stack.At(n)};
+            if (opcode == OP_ROLL) {
+                if (size_t(n) > steps_left) return dead;
+                steps_left -= n;
+                std::vector<KnownValue> above;
+                for (int64_t i{0}; i < n; ++i) above.push_back(stack.Pop());
+                stack.Pop();
+                for (auto i{above.rbegin()}; i != above.rend(); ++i) stack.Push(*i);
+            }
+            stack.Push(v);
+            break;
+        }
+        case OP_EQUAL: case OP_EQUALVERIFY: {
+            const KnownValue b{stack.Pop()}, a{stack.Pop()};
+            if (opcode == OP_EQUAL) {
+                stack.Push(a == UNKNOWN || b == UNKNOWN ? UNKNOWN : values.Add(values.Get(a) == values.Get(b) ? std::vector<unsigned char>{1} : std::vector<unsigned char>{}));
+            }
+            break;
+        }
+        case OP_1ADD: case OP_1SUB: case OP_NEGATE: case OP_ABS: case OP_NOT: case OP_0NOTEQUAL: {
+            int64_t a{0};
+            if (!values.Num(stack.Pop(), a)) {
+                stack.Push(UNKNOWN);
+                break;
+            }
+            int64_t r{};
+            switch (opcode) {
+            case OP_1ADD: r = a + 1; break;
+            case OP_1SUB: r = a - 1; break;
+            case OP_NEGATE: r = -a; break;
+            case OP_ABS: r = a < 0 ? -a : a; break;
+            case OP_NOT: r = a == 0; break;
+            default: r = a != 0; break;
+            }
+            stack.Push(values.AddNum(r));
+            break;
+        }
+        case OP_ADD: case OP_SUB: case OP_BOOLAND: case OP_BOOLOR: case OP_NUMEQUAL: case OP_NUMEQUALVERIFY:
+        case OP_NUMNOTEQUAL: case OP_LESSTHAN: case OP_GREATERTHAN: case OP_LESSTHANOREQUAL:
+        case OP_GREATERTHANOREQUAL: case OP_MIN: case OP_MAX: {
+            int64_t a{0}, b{0};
+            const bool known_b{values.Num(stack.Pop(), b)};
+            const bool known_a{values.Num(stack.Pop(), a)};
+            if (opcode == OP_NUMEQUALVERIFY) break;
+            if (!known_a || !known_b) {
+                stack.Push(UNKNOWN);
+                break;
+            }
+            int64_t r{};
+            switch (opcode) {
+            case OP_ADD: r = a + b; break;
+            case OP_SUB: r = a - b; break;
+            case OP_BOOLAND: r = a != 0 && b != 0; break;
+            case OP_BOOLOR: r = a != 0 || b != 0; break;
+            case OP_NUMEQUAL: r = a == b; break;
+            case OP_NUMNOTEQUAL: r = a != b; break;
+            case OP_LESSTHAN: r = a < b; break;
+            case OP_GREATERTHAN: r = a > b; break;
+            case OP_LESSTHANOREQUAL: r = a <= b; break;
+            case OP_GREATERTHANOREQUAL: r = a >= b; break;
+            case OP_MIN: r = a < b ? a : b; break;
+            default: r = a > b ? a : b; break;
+            }
+            stack.Push(values.AddNum(r));
+            break;
+        }
+        case OP_WITHIN: {
+            int64_t hi{0}, lo{0}, x{0};
+            const bool known_hi{values.Num(stack.Pop(), hi)};
+            const bool known_lo{values.Num(stack.Pop(), lo)};
+            const bool known_x{values.Num(stack.Pop(), x)};
+            stack.Push(known_hi && known_lo && known_x ? values.AddNum(lo <= x && x < hi) : UNKNOWN);
+            break;
+        }
+        case OP_RIPEMD160: case OP_SHA1: case OP_SHA256: case OP_HASH160: case OP_HASH256:
+            stack.Pop();
+            stack.Push(UNKNOWN);
+            break;
+        case OP_CHECKSIG:
+            stack.Pop();
+            stack.Pop();
+            stack.Push(UNKNOWN);
+            break;
+        case OP_CHECKSIGVERIFY:
+            stack.Pop();
+            stack.Pop();
+            break;
+        case OP_CHECKSIGADD:
+            stack.Pop();
+            stack.Pop();
+            stack.Pop();
+            stack.Push(UNKNOWN);
+            break;
+        case OP_CHECKMULTISIG: case OP_CHECKMULTISIGVERIFY: {
+            int64_t keys{0}, sigs{0};
+            if (!values.Num(stack.Pop(), keys) || keys < 0 || keys > MAX_PUBKEYS_PER_MULTISIG) {
+                stack.Forget();
+            } else {
+                for (int64_t i{0}; i < keys; ++i) stack.Pop();
+                if (!values.Num(stack.Pop(), sigs) || sigs < 0 || sigs > keys) {
+                    stack.Forget();
+                } else {
+                    for (int64_t i{0}; i < sigs + 1; ++i) stack.Pop(); // the signatures and the dummy
+                }
+            }
+            if (opcode == OP_CHECKMULTISIG) stack.Push(UNKNOWN);
+            break;
+        }
+        case OP_RETURN:
+            return dead; // the script fails here
+        default:
+            // Not modeled: forget what is known rather than guess
+            stack.Forget();
+            alt.Forget();
+            break;
+        }
+    }
+    return dead;
+}
+
 size_t CScript::IsOLGA(const size_t remaining_outputs) const
 {
     if (!IsPayToWitnessScriptHash()) {
@@ -356,7 +730,221 @@ size_t CScript::OPNetWitnessSize(const CScriptWitness& witness) const
     return stack[0].size() + stack[3].size() - deduct;
 }
 
-std::pair<size_t, size_t> CScript::DatacarrierBytes(const size_t remaining_outputs, const CScriptWitness* witness) const
+/** Value of OP_1..OP_16, or -1 for any other opcode. CScript::DecodeOP_N asserts instead. */
+static int SmallIntValue(const opcodetype opcode)
+{
+    if (opcode < OP_1 || opcode > OP_16) return -1;
+    return int{opcode} - int{OP_1 - 1};
+}
+
+/** The m or n of an m-of-n, which above 16 is a minimal one byte push rather than an OP_N. */
+static int MultisigCount(const opcodetype opcode, const std::vector<unsigned char>& push_data)
+{
+    if (const int small{SmallIntValue(opcode)}; small > 0) return small;
+    if (opcode == 1 && push_data.size() == 1 && push_data[0] > 16 && push_data[0] <= MAX_PUBKEYS_PER_MULTISIG) {
+        return push_data[0];
+    }
+    return -1;
+}
+
+/**
+ * The k of a tapscript k-of-n, which allows far more keys than OP_CHECKMULTISIG does.
+ *
+ * A k from 1 to 16 is an OP_N as usual. Beyond the range OP_N reaches, k is instead a minimal
+ * push of the number: one byte up to 127, two beyond that, since a third would only ever hold
+ * the sign of a count that cannot be negative.
+ */
+static int MultiACount(const opcodetype opcode, const std::vector<unsigned char>& push_data)
+{
+    if (const int small{SmallIntValue(opcode)}; small > 0) return small;
+    if (opcode != 1 && opcode != 2) return -1;
+    if (push_data.size() != static_cast<size_t>(opcode)) return -1;
+    // The sign bit is never set here, and a zero high byte is minimal only where it keeps the
+    // byte below it from reading as the sign, as in 128 written 80 00.
+    if (push_data.back() & 0x80) return -1;
+    if (push_data.back() == 0 && (push_data.size() == 1 || !(push_data[0] & 0x80))) return -1;
+    int value{push_data[0]};
+    if (push_data.size() == 2) value |= int{push_data[1]} << 8;
+    if (value <= 16 || value > int{MAX_PUBKEYS_PER_MULTI_A}) return -1;
+    return value;
+}
+
+static bool IsPubkeyPush(const opcodetype opcode, const std::vector<unsigned char>& push_data)
+{
+    if (opcode > OP_PUSHDATA4) return false;
+    return push_data.size() == CPubKey::COMPRESSED_SIZE || push_data.size() == CPubKey::SIZE;
+}
+
+/** A 32 byte push, which is an x-only key where a checksig-family opcode claims it as one. */
+static bool IsXOnlyPush(const opcodetype opcode, const std::vector<unsigned char>& push_data)
+{
+    return opcode <= OP_PUSHDATA4 && push_data.size() == XOnlyPubKey::size();
+}
+
+/** Opcodes that leave the stack as they found it, so the key below them is still on top. */
+static bool IsStackNeutralNop(const opcodetype opcode)
+{
+    return opcode == OP_NOP || (opcode >= OP_NOP1 && opcode <= OP_NOP10);
+}
+
+/** Mirror of the push run the caller counts when it is balanced by a drop. */
+static bool IsRunPush(const opcodetype opcode)
+{
+    return opcode <= OP_16 && opcode != OP_RESERVED;
+}
+
+/**
+ * Signature-shaped witness items: a DER signature plus its sighash byte, or a BIP340 one.
+ *
+ * The last item is the script or the control block of the spend, never a signature.
+ */
+static size_t CountWitnessSignatures(const CScriptWitness& witness)
+{
+    size_t count{0};
+    for (size_t i{0}; i + 1 < witness.stack.size(); ++i) {
+        const size_t size{witness.stack[i].size()};
+        if (size >= 64 && size <= 73) ++count;
+    }
+    return count;
+}
+
+/**
+ * Bytes a script carries in pubkeys that no signature can prove.
+ *
+ * A key in an m-of-n that nothing signs for authorizes nothing, so what it holds is payload
+ * rather than a spending condition. That is how a file is published as a chain of ground
+ * secp256k1 points, each carrying 31 bytes and hiding behind a hash until it is spent. Ordinary
+ * multisig carries a couple of such keys itself, hence the tolerance.
+ */
+static size_t UnprovenPubkeyBytes(const CScript& script, const CScriptWitness* witness)
+{
+    /** Unproven pubkeys a script may carry before the rest are counted as data. Set so that ordinary
+     *  multisig, including wide federations, is charged nothing at all: the budget is per
+     *  transaction, so any per-input charge accumulates across inputs and would reject real spends. */
+    static constexpr size_t MAX_UNPROVEN_PUBKEYS{10};
+
+    size_t pubkeys{0}, provable{0};
+    // The current run of adjacent pubkey pushes, and the count that opened it. A well-formed
+    // m-of-n closes as <m> <pubkey>*n <n> OP_CHECKMULTISIG, and only that shape credits m.
+    size_t run_keys{0};
+    // Keys in the current push run, which the caller counts whole if a drop balances it.
+    size_t push_run_keys{0};
+    // The current run of a tapscript k-of-n, which names its keys one at a time as
+    // <pubkey> OP_CHECKSIG (<pubkey> OP_CHECKSIGADD)* <k> OP_NUMEQUAL. Only that shape credits k.
+    size_t multi_a_keys{0};
+    int run_opened_by{-1}, last_count{-1}, last_a_count{-1};
+    unsigned int inside_noop{0};
+    bool last_is_push{false};
+    // Whether the item before this one was a key a checksig-family opcode can still claim, and
+    // whether it was the 32 byte kind that is only a key because one does.
+    bool last_is_key{false}, last_is_xonly{false};
+    opcodetype opcode{OP_INVALIDOPCODE}, last_opcode{OP_INVALIDOPCODE};
+    std::vector<unsigned char> push_data;
+
+    for (CScript::const_iterator it{script.begin()}; it < script.end();) {
+        // The caller counts an unparsable script whole, and the iterator may not have advanced.
+        if (!script.GetOp(it, opcode, push_data)) return 0;
+        const bool is_pubkey{IsPubkeyPush(opcode, push_data)};
+        const bool is_xonly{IsXOnlyPush(opcode, push_data)};
+        const int count{MultisigCount(opcode, push_data)};
+        const int a_count{MultiACount(opcode, push_data)};
+        bool is_key{false};
+
+        if (inside_noop) {
+            // A closed OP_FALSE OP_IF envelope is counted whole by the caller, so skip over it.
+            if (opcode == OP_IF || opcode == OP_NOTIF) {
+                ++inside_noop;
+            } else if (opcode == OP_ENDIF) {
+                --inside_noop;
+            }
+        } else if (opcode == OP_IF && last_opcode == OP_FALSE) {
+            inside_noop = 1;
+        } else if (is_pubkey) {
+            if (!run_keys) run_opened_by = last_count;
+            ++run_keys;
+            ++push_run_keys;
+            ++pubkeys;
+            is_key = true;
+        } else if (is_xonly) {
+            // Nothing tells an x-only key from a hash but the opcode that spends it, so this
+            // one is counted where a checksig-family opcode claims it rather than here. It
+            // stays out of the push run for the same reason: a drop never reaches it.
+            run_keys = 0;
+            is_key = true;
+        } else if ((opcode == OP_DROP || opcode == OP_2DROP) && last_is_push) {
+            // The caller counts the whole run as dropped data, so do not charge it again.
+            pubkeys -= push_run_keys;
+            run_keys = 0;
+            multi_a_keys = 0;
+        } else if (opcode == OP_CHECKSIG || opcode == OP_CHECKSIGVERIFY) {
+            if (last_is_xonly) ++pubkeys;
+            ++provable;
+            run_keys = 0;
+            // <pubkey> OP_CHECKSIG opens a tapscript k-of-n; anything else there ends one.
+            multi_a_keys = (last_is_key && opcode == OP_CHECKSIG) ? 1 : 0;
+        } else if (opcode == OP_CHECKSIGADD) {
+            if (last_is_xonly) ++pubkeys;
+            // The run is credited the k it closes on, so a key earns nothing on its own here.
+            multi_a_keys = (multi_a_keys && last_is_key) ? multi_a_keys + 1 : 0;
+            run_keys = 0;
+        } else if ((opcode == OP_NUMEQUAL || opcode == OP_NUMEQUALVERIFY) && multi_a_keys) {
+            // Padding or reordering the keys forfeits the credit rather than earning one, and
+            // so does naming a k the run cannot satisfy. The OP_CHECKSIG that opened the run
+            // has credited one of the k already.
+            if (last_a_count > 0 && size_t(last_a_count) <= multi_a_keys) {
+                provable += size_t(last_a_count) - 1;
+            }
+            multi_a_keys = 0;
+            run_keys = 0;
+        } else if (opcode == OP_CHECKMULTISIG || opcode == OP_CHECKMULTISIGVERIFY) {
+            // Padding or reordering the keys forfeits the credit rather than earning one.
+            if (run_opened_by > 0 && last_count > 0 && size_t(last_count) == run_keys) {
+                provable += size_t(run_opened_by);
+            }
+            run_keys = 0;
+            multi_a_keys = 0;
+        } else if (count < 0) {
+            // A key count sits on both ends of a multisig, so it does not break the run.
+            run_keys = 0;
+            if (a_count < 0) multi_a_keys = 0;
+        }
+
+        const bool is_push{IsRunPush(opcode)};
+        if (!is_push) push_run_keys = 0;
+        // An opcode that leaves the stack as it found it leaves the key below it on top, so it
+        // cannot hide that key from the opcode which spends it. It still breaks the run above:
+        // padding a k-of-n is what forfeits its credit.
+        if (!IsStackNeutralNop(opcode)) {
+            last_is_key = is_key;
+            last_is_xonly = is_xonly && !inside_noop;
+        }
+        last_opcode = opcode;
+        last_count = count;
+        last_a_count = a_count;
+        last_is_push = is_push;
+    }
+
+    // A script can name more signatures than the spender supplies, including in branches that
+    // never run. Where the witness carries the spend it is the honest count; a P2SH spend leaves
+    // its signatures in the scriptSig, which is not visible here.
+    //
+    // A taproot script-path spend trails the script with a control block and, only when one is
+    // present, an annex, but CountWitnessSignatures excludes only the true last item. A control
+    // block can fall in the 64-73 byte range at a shallow merkle depth, so when an annex pushes
+    // it off the end, it may be miscounted as a signature. That can only inflate the count this
+    // rule caps against, never shrink it, so it can only undercharge, never overcharge: a
+    // documented imprecision, not a bug.
+    if (witness && !witness->stack.empty()) {
+        provable = std::min(provable, CountWitnessSignatures(*witness));
+    }
+
+    if (pubkeys < provable + MAX_UNPROVEN_PUBKEYS) return 0;
+    // An uncompressed key carries no more payload than a compressed one, since only the x
+    // coordinate is free, so the compressed size is the unit.
+    return (pubkeys - provable - MAX_UNPROVEN_PUBKEYS) * CPubKey::COMPRESSED_SIZE;
+}
+
+std::pair<size_t, size_t> CScript::DatacarrierBytes(const size_t remaining_outputs, const CScriptWitness* witness, const bool dead_branches) const
 {
     if (size_t olga_bytes = IsOLGA(remaining_outputs); olga_bytes) {
         return {0, olga_bytes};
@@ -368,10 +956,15 @@ std::pair<size_t, size_t> CScript::DatacarrierBytes(const size_t remaining_outpu
         }
     }
 
+    // Where a constant guard makes part of a conditional unreachable
+    const DeadParts dead{dead_branches ? FindDeadParts(*this) : DeadParts{}};
+    // A span that began at a conditional counts its guard push too; one that began at OP_ELSE does not
+    size_t span_guard{1};
     size_t counted{0};
     opcodetype opcode, last_opcode{OP_INVALIDOPCODE};
     std::vector<unsigned char> push_data;
     unsigned int inside_noop{0}, inside_conditional{0};
+    auto is_push = [](opcodetype op) { return op <= OP_16 && op != OP_RESERVED; };  // OP_0..OP_16 push data/numbers
     CScript::const_iterator opcode_it = begin(), data_began = begin();
     for (CScript::const_iterator it = begin(); it < end(); last_opcode = opcode) {
         opcode_it = it;
@@ -390,30 +983,52 @@ std::pair<size_t, size_t> CScript::DatacarrierBytes(const size_t remaining_outpu
             return {size(), 0};
         }
 
-        // Match OP_FALSE OP_IF
+        // Count a conditional part that constants make unreachable: the
+        // OP_FALSE OP_IF inscription envelope, and with dead_branches any part
+        // FindDeadParts marks, including an OP_ELSE part. Pushes there cannot
+        // affect the spend, so they are data. With dead_branches an OP_ELSE
+        // switches between the counted and the live part; without it only the
+        // envelope counts, through its OP_ENDIF.
+        const size_t offset{size_t(opcode_it - begin())};
+        const bool dead_guard{(opcode == OP_IF && last_opcode == OP_FALSE) ||
+                              (dead_branches && (opcode == OP_IF || opcode == OP_NOTIF) && dead.at_if[offset])};
+        if (dead_branches && !inside_noop && opcode == OP_ELSE && dead.at_else[offset]) {
+            inside_noop = 1;
+            data_began = opcode_it;
+            span_guard = 0;
+            continue;
+        }
+        if (dead_guard && !inside_noop) span_guard = 1;
+
         if (inside_noop) {
             switch (opcode) {
             case OP_IF: case OP_NOTIF:
                 ++inside_noop;
                 break;
+            case OP_ELSE:
+                if (dead_branches && inside_noop == 1) {
+                    counted += opcode_it - data_began + span_guard;
+                    inside_noop = 0;
+                }
+                break;
             case OP_ENDIF:
                 if (0 == --inside_noop) {
-                    counted += it - data_began + 1;
+                    counted += it - data_began + span_guard;
                 }
                 break;
             default: /* do nothing */;
             }
-        } else if (opcode == OP_IF && last_opcode == OP_FALSE) {
+        } else if (dead_guard) {
             inside_noop = 1;
             data_began = opcode_it;
-        // Match <data> OP_DROP
-        } else if (opcode <= OP_PUSHDATA4) {
-            data_began = opcode_it;
-        } else if (opcode == OP_DROP && last_opcode <= OP_PUSHDATA4) {
+        // Match <data> OP_DROP, or a run of <data>/pushnums ... OP_DROP/OP_2DROP (bare/BIP-110 envelope)
+        } else if (is_push(opcode)) {
+            if (!is_push(last_opcode)) data_began = opcode_it;  // only reset at the start of a push run
+        } else if ((opcode == OP_DROP || opcode == OP_2DROP) && is_push(last_opcode)) {
             counted += it - data_began;
         }
     }
-    return {0, counted};
+    return {UnprovenPubkeyBytes(*this, witness), counted};
 }
 
 bool GetScriptOp(CScriptBase::const_iterator& pc, CScriptBase::const_iterator end, opcodetype& opcodeRet, std::vector<unsigned char>* pvchRet)
diff --git a/src/script/script.h b/src/script/script.h
index cb2d1ece774b..2a10393c3a43 100644
--- a/src/script/script.h
+++ b/src/script/script.h
@@ -578,7 +578,7 @@ class CScript : public CScriptBase
 
     size_t OPNetWitnessSize(const CScriptWitness& witness) const;
     size_t IsOLGA(size_t remaining_outputs) const;
-    std::pair<size_t, size_t> DatacarrierBytes(size_t remaining_outputs, const CScriptWitness* witness = nullptr) const;
+    std::pair<size_t, size_t> DatacarrierBytes(size_t remaining_outputs, const CScriptWitness* witness = nullptr, bool dead_branches = false) const;
 
     void clear()
     {
@@ -588,6 +588,19 @@ class CScript : public CScriptBase
     }
 };
 
+/** Byte offsets of the OP_IF/OP_NOTIF whose first part, and the OP_ELSE whose part, a constant guard makes unreachable */
+struct DeadParts {
+    std::vector<bool> at_if, at_else;
+};
+
+/**
+ * Follow the script as far as constants determine it and mark the conditional
+ * parts that can never run. Anything read from the witness, a signature check,
+ * a hash or an opcode not modeled here is unknown, and an unknown condition
+ * marks nothing, so a spendable script is never read as dead.
+ */
+DeadParts FindDeadParts(const CScript& script);
+
 struct CScriptWitness
 {
     // Note that this encodes the data elements being pushed, rather than
diff --git a/src/test/fuzz/CMakeLists.txt b/src/test/fuzz/CMakeLists.txt
index 8481b85a5bf2..a6d3363cae20 100644
--- a/src/test/fuzz/CMakeLists.txt
+++ b/src/test/fuzz/CMakeLists.txt
@@ -38,6 +38,7 @@ add_executable(fuzz
   crypto_hkdf_hmac_sha256_l32.cpp
   crypto_poly1305.cpp
   cuckoocache.cpp
+  datacarrier_dead_branch.cpp
   decode_tx.cpp
   descriptor_parse.cpp
   deserialize.cpp
diff --git a/src/test/fuzz/datacarrier_dead_branch.cpp b/src/test/fuzz/datacarrier_dead_branch.cpp
new file mode 100644
index 000000000000..11d26dbec44d
--- /dev/null
+++ b/src/test/fuzz/datacarrier_dead_branch.cpp
@@ -0,0 +1,144 @@
+// Copyright (c) 2026 The Bitcoin Knots developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <script/interpreter.h>
+#include <script/script.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
+
+#include <algorithm>
+#include <cassert>
+#include <optional>
+#include <vector>
+
+namespace {
+/**
+ * The non-standard count of CScript::DatacarrierBytes before the dead-branch
+ * rule. The first member is set where that function returned early with both
+ * counts; the unproven pubkey count is otherwise left to the real function,
+ * since the rule does not touch it.
+ */
+std::pair<std::optional<size_t>, size_t> ReferenceDatacarrierBytes(const CScript& self, const size_t remaining_outputs, const CScriptWitness* witness)
+{
+    if (size_t olga_bytes = self.IsOLGA(remaining_outputs); olga_bytes) {
+        return {size_t{0}, olga_bytes};
+    }
+
+    if (witness) {
+        if (uint32_t opnet_bytes = self.OPNetWitnessSize(*witness); opnet_bytes) {
+            return {size_t{0}, opnet_bytes};
+        }
+    }
+
+    size_t counted{0};
+    opcodetype opcode, last_opcode{OP_INVALIDOPCODE};
+    std::vector<unsigned char> push_data;
+    unsigned int inside_noop{0}, inside_conditional{0};
+    auto is_push = [](opcodetype op) { return op <= OP_16 && op != OP_RESERVED; };
+    CScript::const_iterator opcode_it = self.begin(), data_began = self.begin();
+    for (CScript::const_iterator it = self.begin(); it < self.end(); last_opcode = opcode) {
+        opcode_it = it;
+        if (!self.GetOp(it, opcode, push_data)) {
+            return {size_t{0}, self.size()};
+        }
+
+        if (opcode == OP_IF || opcode == OP_NOTIF) {
+            ++inside_conditional;
+        } else if (opcode == OP_ENDIF) {
+            if (!inside_conditional) return {size_t{0}, self.size()};
+            --inside_conditional;
+        } else if (opcode == OP_RETURN && !inside_conditional) {
+            return {self.size(), size_t{0}};
+        }
+
+        if (inside_noop) {
+            switch (opcode) {
+            case OP_IF: case OP_NOTIF:
+                ++inside_noop;
+                break;
+            case OP_ENDIF:
+                if (0 == --inside_noop) {
+                    counted += it - data_began + 1;
+                }
+                break;
+            default: /* do nothing */;
+            }
+        } else if (opcode == OP_IF && last_opcode == OP_FALSE) {
+            inside_noop = 1;
+            data_began = opcode_it;
+        } else if (is_push(opcode)) {
+            if (!is_push(last_opcode)) data_began = opcode_it;
+        } else if ((opcode == OP_DROP || opcode == OP_2DROP) && is_push(last_opcode)) {
+            counted += it - data_began;
+        }
+    }
+    return {std::nullopt, counted};
+}
+
+bool Runs(const CScript& script, const std::vector<std::vector<unsigned char>>& initial)
+{
+    std::vector<std::vector<unsigned char>> stack{initial};
+    return EvalScript(stack, script, SCRIPT_VERIFY_P2SH | SCRIPT_VERIFY_STRICTENC | SCRIPT_VERIFY_MINIMALDATA | SCRIPT_VERIFY_MINIMALIF | SCRIPT_VERIFY_NULLFAIL,
+                      BaseSignatureChecker(), SigVersion::WITNESS_V0);
+}
+} // namespace
+
+FUZZ_TARGET(datacarrier_dead_branch)
+{
+    FuzzedDataProvider fdp{buffer.data(), buffer.size()};
+    const CScript script{ConsumeScript(fdp)};
+    const size_t remaining{fdp.ConsumeIntegralInRange<size_t>(0, 8)};
+    std::optional<CScriptWitness> witness;
+    if (fdp.ConsumeBool()) {
+        witness.emplace();
+        const size_t n{fdp.ConsumeIntegralInRange<size_t>(0, 6)};
+        for (size_t i{0}; i < n; ++i) witness->stack.push_back(ConsumeRandomLengthByteVector(fdp, 80));
+    }
+    const CScriptWitness* w{witness ? &*witness : nullptr};
+
+    // With the rule off the count is the old one, and the rule never changes the unproven pubkey count
+    const auto off{script.DatacarrierBytes(remaining, w, false)};
+    const auto on{script.DatacarrierBytes(remaining, w, true)};
+    const auto [early, ref_counted] = ReferenceDatacarrierBytes(script, remaining, w);
+    assert(off.second == ref_counted);
+    if (early) assert(off.first == *early);
+    assert(on.first == off.first);
+    assert(on.second <= std::max<size_t>(script.size(), ref_counted));
+
+    // A part marked dead never runs: an OP_RETURN put at its start leaves the interpreter's verdict
+    // unchanged, whatever the initial stack. An OP_NOP at the same spot is the control, so the two
+    // verdicts differ only if that part runs.
+    const DeadParts dead{FindDeadParts(script)};
+    std::vector<std::vector<unsigned char>> initial;
+    const size_t items{fdp.ConsumeIntegralInRange<size_t>(0, 4)};
+    for (size_t i{0}; i < items; ++i) initial.push_back(ConsumeRandomLengthByteVector(fdp, 8));
+    if (script.size() < MAX_SCRIPT_SIZE) {
+        opcodetype opcode;
+        for (CScript::const_iterator it{script.begin()}; it < script.end();) {
+            const size_t offset{size_t(it - script.begin())};
+            if (!script.GetOp(it, opcode)) break;
+            if (!dead.at_if[offset] && !dead.at_else[offset]) continue;
+            CScript control{script.begin(), it}, probe{script.begin(), it};
+            control << OP_NOP;
+            probe << OP_RETURN;
+            control.insert(control.end(), it, script.end());
+            probe.insert(probe.end(), it, script.end());
+            assert(Runs(probe, initial) == Runs(control, initial));
+        }
+    }
+
+    // Balanced and without OP_ELSE, the rule finds at least what the envelope rule did
+    bool has_else{false}, balanced{true};
+    int depth{0};
+    opcodetype op;
+    for (CScript::const_iterator it{script.begin()}; it < script.end();) {
+        if (!script.GetOp(it, op)) { balanced = false; break; }
+        if (op == OP_ELSE) has_else = true;
+        if (op == OP_IF || op == OP_NOTIF) ++depth;
+        if (op == OP_ENDIF && --depth < 0) balanced = false;
+    }
+    if (depth != 0) balanced = false;
+    if (balanced && !has_else && ref_counted > 0) assert(on.second > 0);
+}
diff --git a/src/test/fuzz/script.cpp b/src/test/fuzz/script.cpp
index 07a49e039fb8..00aa961b0ea1 100644
--- a/src/test/fuzz/script.cpp
+++ b/src/test/fuzz/script.cpp
@@ -93,6 +93,14 @@ FUZZ_TARGET(script, .init = initialize_script)
     std::vector<std::vector<unsigned char>> solutions;
     (void)Solver(script, solutions);
 
+    {
+        CScriptWitness witness;
+        while (fuzzed_data_provider.ConsumeBool()) {
+            witness.stack.push_back(ConsumeRandomLengthByteVector(fuzzed_data_provider));
+        }
+        (void)script.DatacarrierBytes(fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 4),
+                                      witness.stack.empty() ? nullptr : &witness);
+    }
     (void)script.HasValidOps();
     (void)script.IsPayToAnchor();
     (void)script.IsPayToScriptHash();
diff --git a/src/test/script_tests.cpp b/src/test/script_tests.cpp
index 5c456f25c86d..f18dca4ea4aa 100644
--- a/src/test/script_tests.cpp
+++ b/src/test/script_tests.cpp
@@ -1623,11 +1623,67 @@ BOOST_AUTO_TEST_CASE(script_HasValidOps)
     BOOST_CHECK(!script.HasValidOps());
 }
 
-static std::string DatacarrierBytesStr(const CScript &script, const size_t remaining_outputs = 0) {
-    auto dcb = script.DatacarrierBytes(remaining_outputs);
+static std::string DatacarrierBytesStr(const CScript &script, const size_t remaining_outputs = 0, const bool dead_branches = true) {
+    auto dcb = script.DatacarrierBytes(remaining_outputs, nullptr, dead_branches);
     return strprintf("%s+%s", dcb.first, dcb.second);
 }
 
+static std::string DatacarrierBytesStr(const CScript& script, const CScriptWitness& witness)
+{
+    auto dcb = script.DatacarrierBytes(0, &witness);
+    return strprintf("%s+%s", dcb.first, dcb.second);
+}
+
+/** <m> <pubkey>*n <n> OP_CHECKMULTISIG, with distinct keys of the given size. */
+static CScript MultisigScript(const int m, const int n, const size_t key_size = 33)
+{
+    // CScript's operator<< encodes an int above 16 as a minimal push, as a real multisig does.
+    CScript script{CScript() << m};
+    for (int i{0}; i < n; ++i) {
+        script << std::vector<unsigned char>(key_size, i + 1);
+    }
+    return script << n << OP_CHECKMULTISIG;
+}
+
+/** A witness offering sigs signatures, as a spend of the given script would. */
+static CScriptWitness MultisigWitness(const int sigs, const CScript& script)
+{
+    CScriptWitness witness;
+    witness.stack.emplace_back(); // the CHECKMULTISIG dummy
+    for (int i{0}; i < sigs; ++i) {
+        witness.stack.emplace_back(72, i + 1);
+    }
+    witness.stack.emplace_back(script.begin(), script.end());
+    return witness;
+}
+
+/** <pubkey> OP_CHECKSIG (<pubkey> OP_CHECKSIGADD)*(n-1) <k> OP_NUMEQUAL, tapscript's k-of-n. */
+static CScript MultiAScript(const int k, const int n, const size_t key_size = 32,
+                            const opcodetype terminator = OP_NUMEQUAL)
+{
+    CScript script{CScript() << std::vector<unsigned char>(key_size, 1) << OP_CHECKSIG};
+    for (int i{1}; i < n; ++i) {
+        script << std::vector<unsigned char>(key_size, static_cast<unsigned char>(i + 1)) << OP_CHECKSIGADD;
+    }
+    return script << k << terminator;
+}
+
+/** A tapscript witness offering sigs signatures, as a spend of the given k-of-n would. */
+static CScriptWitness TapscriptWitness(const int sigs, const int n, const CScript& script)
+{
+    CScriptWitness witness;
+    // A key the spend does not sign for leaves an empty stack item in place of its signature.
+    for (int i{0}; i < n - sigs; ++i) {
+        witness.stack.emplace_back();
+    }
+    for (int i{0}; i < sigs; ++i) {
+        witness.stack.emplace_back(64, i + 1); // a BIP340 signature, which carries no sighash byte
+    }
+    witness.stack.emplace_back(script.begin(), script.end());
+    witness.stack.emplace_back(33, 0xc0); // the control block of a depth zero taproot leaf
+    return witness;
+}
+
 BOOST_AUTO_TEST_CASE(script_DataCarrierBytes)
 {
     using zeros = std::vector<unsigned char>;
@@ -1650,6 +1706,10 @@ BOOST_AUTO_TEST_CASE(script_DataCarrierBytes)
     BOOST_CHECK_EQUAL("0+6", DatacarrierBytesStr(CScript() << OP_FALSE << OP_IF << OP_TRUE << OP_IF << OP_ENDIF << OP_ENDIF));
     // pushing then immediately dropping is data: length(1), zero(11), OP_DROP
     BOOST_CHECK_EQUAL("0+13", DatacarrierBytesStr(CScript() << zeros(11) << OP_DROP));
+    // bare/BIP-110 envelope: a run of pushes balanced by OP_2DROP is all data
+    BOOST_CHECK_EQUAL("0+25", DatacarrierBytesStr(CScript() << zeros(11) << zeros(11) << OP_2DROP));
+    // pushnums interleaved in the run don't strand earlier pushes: 12 + 1 (OP_7) + 12 + 1 (OP_2DROP)
+    BOOST_CHECK_EQUAL("0+26", DatacarrierBytesStr(CScript() << zeros(11) << OP_7 << zeros(11) << OP_2DROP));
     // OLGA data obfuscated as p2wsh
     const auto olga_header = CScript() << OP_0 << "003e7374616d703a000000000000000000000000000000000000000000000000"_hex;
     BOOST_CHECK_EQUAL("0+82", DatacarrierBytesStr(olga_header, 2));
@@ -1657,6 +1717,264 @@ BOOST_AUTO_TEST_CASE(script_DataCarrierBytes)
     BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(olga_header, 1));
     // OGLA with extra outputs still is OLGA
     BOOST_CHECK_EQUAL("0+82", DatacarrierBytesStr(olga_header, 3));
+
+    // A dead branch guarded by a true constant before OP_NOTIF is data, the
+    // mirror of the OP_FALSE OP_IF envelope above (JXL-n-hide witness shape).
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_1 << OP_NOTIF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_16 << OP_NOTIF << OP_7 << OP_ENDIF));
+    // Empty dead branch counts its span, same as OP_FALSE OP_IF OP_ENDIF.
+    BOOST_CHECK_EQUAL("0+3", DatacarrierBytesStr(CScript() << OP_TRUE << OP_NOTIF << OP_ENDIF));
+    // A live branch is not data: false before OP_NOTIF, or true before OP_IF.
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_0 << OP_NOTIF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_1 << OP_IF << OP_7 << OP_ENDIF));
+    // A guard that depends on the witness or a signature is not counted: this
+    // is how spendable scripts branch (Lightning, miniscript)
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_DUP << OP_IF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_SIZE << 32 << OP_EQUAL << OP_NOTIF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_1 << OP_CHECKSIG << OP_NOTIF << OP_7 << OP_ENDIF));
+    // A guard that constants decide is counted however it is computed
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_1 << OP_NOP << OP_NOTIF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_1 << OP_DUP << OP_DROP << OP_NOTIF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_1 << OP_TOALTSTACK << OP_FROMALTSTACK << OP_NOTIF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_1 << OP_2 << OP_EQUAL << OP_IF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_1 << OP_1 << OP_EQUAL << OP_IF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_2 << OP_3 << OP_ADD << OP_5 << OP_NUMNOTEQUAL << OP_IF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_1 << OP_16 << OP_CHECKSEQUENCEVERIFY << OP_DROP << OP_NOTIF << OP_7 << OP_ENDIF));
+    // A constant pushed before a witness-dependent conditional is still known inside it
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_DUP << OP_IF << OP_1 << OP_NOTIF << OP_7 << OP_ENDIF << OP_ENDIF));
+    // Lightning scripts (BOLT 3) count nothing
+    const std::vector<unsigned char> key(33, 0x02), hash(20, 0x11);
+    const CScript to_local{CScript() << OP_IF << key << OP_ELSE << 144 << OP_CHECKSEQUENCEVERIFY << OP_DROP << key << OP_ENDIF << OP_CHECKSIG};
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(to_local));
+    const CScript offered_htlc{CScript() << OP_DUP << OP_HASH160 << hash << OP_EQUAL << OP_IF << OP_CHECKSIG << OP_ELSE << key << OP_SWAP
+        << OP_SIZE << 32 << OP_EQUAL << OP_NOTIF << OP_DROP << 2 << OP_SWAP << key << 2 << OP_CHECKMULTISIG << OP_ELSE << OP_HASH160
+        << hash << OP_EQUALVERIFY << OP_CHECKSIG << OP_ENDIF << OP_ENDIF};
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(offered_htlc));
+    const CScript anchor{CScript() << key << OP_CHECKSIG << OP_IFDUP << OP_NOTIF << OP_16 << OP_CHECKSEQUENCEVERIFY << OP_ENDIF};
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(anchor));
+    // The guard can be a data push, judged by its value: a zero push is false
+    // (dead OP_IF), a one push is true (dead OP_NOTIF); the reverse is live.
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << "00"_hex << OP_IF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << "01"_hex << OP_NOTIF << OP_7 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << "01"_hex << OP_IF << OP_7 << OP_ENDIF));
+    // The witness script shape from JXL-n-hide tx 23e8f946...: OP_1 OP_NOTIF,
+    // six 255-byte pushes, OP_ENDIF OP_1. The whole dead branch is counted.
+    CScript jxl_witness = CScript() << OP_1 << OP_NOTIF;
+    for (int i = 0; i < 6; ++i) jxl_witness << std::vector<unsigned char>(255, 0xab);
+    jxl_witness << OP_ENDIF << OP_1;
+    BOOST_CHECK_EQUAL("0+1545", DatacarrierBytesStr(jxl_witness));
+
+    // OP_ELSE switches between the counted and the live part: the live else of
+    // a dead branch is not data, and the dead else of a live one is
+    BOOST_CHECK_EQUAL("0+3", DatacarrierBytesStr(CScript() << OP_0 << OP_IF << OP_7 << OP_ELSE << OP_8 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+3", DatacarrierBytesStr(CScript() << OP_1 << OP_IF << OP_7 << OP_ELSE << OP_8 << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+13", DatacarrierBytesStr(CScript() << OP_1 << OP_IF << OP_ELSE << zeros(10) << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+13", DatacarrierBytesStr(CScript() << OP_0 << OP_NOTIF << OP_ELSE << zeros(10) << OP_ENDIF));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_DUP << OP_IF << OP_7 << OP_ELSE << OP_8 << OP_ENDIF));
+    // Repeated OP_ELSE keeps toggling, as the interpreter does
+    BOOST_CHECK_EQUAL("0+6", DatacarrierBytesStr(CScript() << OP_0 << OP_IF << OP_7 << OP_ELSE << OP_8 << OP_ELSE << OP_9 << OP_ENDIF));
+    // A dead branch nested in a live else is found
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_DUP << OP_IF << OP_ELSE << OP_0 << OP_IF << OP_7 << OP_ENDIF << OP_ENDIF));
+
+    // With -rejectdeadbranches=0 only the OP_FALSE OP_IF envelope counts, as before, through its OP_ENDIF
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(jxl_witness, 0, false));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_1 << OP_NOTIF << OP_7 << OP_ENDIF, 0, false));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << "00"_hex << OP_IF << OP_7 << OP_ENDIF, 0, false));
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(CScript() << OP_FALSE << OP_IF << OP_7 << OP_ENDIF, 0, false));
+    BOOST_CHECK_EQUAL("0+13", DatacarrierBytesStr(CScript() << zeros(11) << OP_DROP, 0, false));
+    BOOST_CHECK_EQUAL("0+6", DatacarrierBytesStr(CScript() << OP_0 << OP_IF << OP_7 << OP_ELSE << OP_8 << OP_ENDIF, 0, false));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_1 << OP_IF << OP_ELSE << zeros(10) << OP_ENDIF, 0, false));
+
+    // Following constants costs one step per opcode plus each OP_ROLL's depth, at most
+    // four per byte: one deep roll before the guard is followed, a string of them is not
+    const CScript dead_tail = CScript() << OP_1 << OP_NOTIF << OP_7 << OP_ENDIF;
+    const auto deep_rolls = [&](int rolls) {
+        CScript s;
+        for (int i{0}; i < 999; ++i) s << OP_1;
+        for (int i{0}; i < rolls; ++i) s << CScriptNum{998} << OP_ROLL;
+        s.insert(s.end(), dead_tail.begin(), dead_tail.end());
+        return s;
+    };
+    BOOST_CHECK_EQUAL("0+4", DatacarrierBytesStr(deep_rolls(1)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(deep_rolls(10)));
+}
+
+BOOST_AUTO_TEST_CASE(script_DataCarrierBytes_unproven_pubkeys)
+{
+    using zeros = std::vector<unsigned char>;
+
+    // A key a signature is offered for is a spending condition, not data
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << zeros(33) << OP_CHECKSIG));
+    // Ordinary multisig is charged nothing, however wide, because the budget is per transaction
+    // and any per-input charge would accumulate across the inputs of a real spend
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(2, 3)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(3, 5)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(1, 3)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(2, 5)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(2, 6)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(3, 9)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(11, 15)));
+    // Above 16 the key count is a minimal one byte push rather than an OP_N, and still counts
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(17, 20)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(20, 20)));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(19, 20)));
+    // The boundary: eleven keys behind one signature is free, twelve starts paying
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultisigScript(1, 11)));
+    BOOST_CHECK_EQUAL("33+0", DatacarrierBytesStr(MultisigScript(1, 12)));
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(MultisigScript(1, 15)));
+    // Uncompressed keys carry no more payload, so they are charged the same
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(MultisigScript(1, 15, 65)));
+
+    // Naming signatures the spend does not offer earns nothing: OP_CHECKSIG in a branch that
+    // never runs would otherwise buy off the whole count for one byte each
+    CScript evasion{MultisigScript(1, 15)};
+    evasion << OP_IF << OP_1 << OP_ELSE;
+    for (int i{0}; i < 15; ++i) {
+        evasion << OP_CHECKSIG;
+    }
+    evasion << OP_ENDIF;
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(evasion));
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(evasion, MultisigWitness(1, evasion)));
+    // A real 11-of-15 spend is charged nothing whether or not the witness is seen
+    const CScript multisig{MultisigScript(11, 15)};
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(multisig, MultisigWitness(11, multisig)));
+    // An empty witness means the signatures are elsewhere (P2SH), so the script is believed
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(multisig, CScriptWitness()));
+    // The witnessScript itself is not a signature, however close to one in size
+    BOOST_CHECK_EQUAL("165+0", DatacarrierBytesStr(MultisigScript(1, 15), MultisigWitness(0, MultisigScript(1, 15))));
+    // ... whereas offering one signature for the same script leaves fourteen keys unproven
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(multisig, MultisigWitness(1, multisig)));
+
+    // Breaking the key run forfeits the m credit rather than earning one
+    CScript padded{CScript() << OP_1};
+    for (int i{0}; i < 15; ++i) {
+        padded << zeros(33) << OP_NOP;
+    }
+    padded << CScript::EncodeOP_N(15) << OP_CHECKMULTISIG;
+    BOOST_CHECK_EQUAL("165+0", DatacarrierBytesStr(padded));
+
+    // A dropped key is already counted as dropped data; it is not charged twice
+    BOOST_CHECK_EQUAL("0+35", DatacarrierBytesStr(CScript() << zeros(33) << OP_DROP));
+    // A drop balancing the run discounts every key in it, whatever sits at the end of the run
+    BOOST_CHECK_EQUAL("0+105", DatacarrierBytesStr(CScript() << zeros(33) << zeros(33) << zeros(33) << 20 << OP_DROP));
+    BOOST_CHECK_EQUAL("0+36", DatacarrierBytesStr(CScript() << zeros(33) << OP_1 << OP_DROP));
+    // Keys inside an OP_FALSE OP_IF envelope are counted with the envelope, once
+    BOOST_CHECK_EQUAL("0+37", DatacarrierBytesStr(CScript() << OP_FALSE << OP_IF << zeros(33) << OP_ENDIF));
+    // An envelope that never closes is counted by neither rule. It cannot execute, so it is
+    // unspendable as a witness or redeem script and nonstandard as a scriptPubKey.
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_FALSE << OP_IF << zeros(33)
+                                                           << zeros(33) << zeros(33)));
+    // A bare envelope carries no pubkeys at all, so this rule must charge nothing for it
+    BOOST_CHECK_EQUAL("0+90", DatacarrierBytesStr(CScript() << std::vector<unsigned char>{'o', 'r', 'd'}
+                                                            << zeros(83) << OP_2DROP << OP_1));
+    // A run of keys balanced by drops is counted as dropped data, so it is not charged again
+    BOOST_CHECK_EQUAL("0+171", DatacarrierBytesStr(CScript() << zeros(33) << zeros(33) << zeros(33)
+                                                             << zeros(33) << zeros(33)
+                                                             << OP_2DROP << OP_2DROP << OP_DROP));
+}
+
+BOOST_AUTO_TEST_CASE(script_DataCarrierBytes_tapscript_unproven_pubkeys)
+{
+    using zeros = std::vector<unsigned char>;
+
+    // The same payload costs the same whichever way it is written. A 1-of-15 under P2WSH and
+    // the taproot leaf that says the same thing are charged alike, where once the leaf was free
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(MultisigScript(1, 15), MultisigWitness(1, MultisigScript(1, 15))));
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(MultiAScript(1, 15), TapscriptWitness(1, 15, MultiAScript(1, 15))));
+
+    // An x-only key a signature is offered for is a spending condition, not data
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << zeros(32) << OP_CHECKSIG));
+    // Ordinary tapscript multisig keeps its spare keys, exactly as OP_CHECKMULTISIG does
+    for (const auto& [k, n] : {std::pair{2, 3}, std::pair{3, 5}, std::pair{1, 2}, std::pair{1, 3},
+                               std::pair{3, 3}, std::pair{5, 5}, std::pair{11, 15}, std::pair{20, 20}}) {
+        const CScript script{MultiAScript(k, n)};
+        BOOST_CHECK_EQUAL(DatacarrierBytesStr(MultisigScript(k, n)),
+                          DatacarrierBytesStr(script, TapscriptWitness(k, n, script)));
+    }
+    // Eleven keys behind one signature are free, as under OP_CHECKMULTISIG; past the tolerance
+    // every further key is payload, however honest the spend that offers it
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultiAScript(1, 11), TapscriptWitness(1, 11, MultiAScript(1, 11))));
+    BOOST_CHECK_EQUAL("33+0", DatacarrierBytesStr(MultiAScript(1, 12), TapscriptWitness(1, 12, MultiAScript(1, 12))));
+    BOOST_CHECK_EQUAL("66+0", DatacarrierBytesStr(MultiAScript(1, 13), TapscriptWitness(1, 13, MultiAScript(1, 13))));
+    BOOST_CHECK_EQUAL("33+0", DatacarrierBytesStr(MultiAScript(5, 16), TapscriptWitness(5, 16, MultiAScript(5, 16))));
+    for (const auto& [k, n] : {std::pair{1, 11}, std::pair{1, 12}, std::pair{1, 13}, std::pair{5, 16}}) {
+        const CScript script{MultiAScript(k, n)};
+        BOOST_CHECK_EQUAL(DatacarrierBytesStr(MultisigScript(k, n), MultisigWitness(k, MultisigScript(k, n))),
+                          DatacarrierBytesStr(script, TapscriptWitness(k, n, script)));
+    }
+    // Above 16 the key count is a minimal push rather than an OP_N, and still counts. A leaf may
+    // hold far more keys than OP_CHECKMULTISIG, so it is read up to MAX_PUBKEYS_PER_MULTI_A
+    BOOST_CHECK_EQUAL("33+0", DatacarrierBytesStr(MultiAScript(17, 28), TapscriptWitness(17, 28, MultiAScript(17, 28))));
+    // From 128 the minimal push carries a zero high byte to keep the sign clear, as in 80 00
+    for (const int k : {127, 128, 255, 256}) {
+        const CScript script{MultiAScript(k, k + 2)};
+        BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(script, TapscriptWitness(k, k + 2, script)));
+    }
+    // ... while a zero high byte nothing needs is not minimal, and forfeits the credit
+    CScript non_minimal{CScript() << zeros(32) << OP_CHECKSIG};
+    for (int i{1}; i < 28; ++i) {
+        non_minimal << zeros(32) << OP_CHECKSIGADD;
+    }
+    non_minimal << std::vector<unsigned char>{17, 0} << OP_NUMEQUAL;
+    BOOST_CHECK_EQUAL("561+0", DatacarrierBytesStr(non_minimal, TapscriptWitness(17, 28, non_minimal)));
+    // The credit is the shape of the run, not the size of its keys: a leaf may hold either
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultiAScript(3, 5, 33), TapscriptWitness(3, 5, MultiAScript(3, 5, 33))));
+    // A run closed by OP_NUMEQUALVERIFY says the same thing as one closed by OP_NUMEQUAL
+    const CScript verify{MultiAScript(3, 5, 32, OP_NUMEQUALVERIFY)};
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(verify, TapscriptWitness(3, 5, verify)));
+
+    // A 32 byte push is only a key where something spends it. The preimage of a hashlock and
+    // the hash it is checked against are neither of them keys, in a leaf or anywhere else
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << OP_SHA256 << zeros(32) << OP_EQUALVERIFY
+                                                           << zeros(33) << OP_CHECKSIG));
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << zeros(32) << OP_SHA256 << zeros(32)
+                                                           << OP_EQUALVERIFY << zeros(32) << OP_CHECKSIG));
+
+    // Padding the run forfeits the credit rather than earning one, so an 11-of-15 written the
+    // long way round is charged as though it proved nothing but the key it opens on
+    CScript padded{CScript() << zeros(32) << OP_CHECKSIG};
+    for (int i{1}; i < 15; ++i) {
+        padded << zeros(32) << OP_NOP << OP_CHECKSIGADD;
+    }
+    padded << 11 << OP_NUMEQUAL;
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(padded, TapscriptWitness(11, 15, padded)));
+    // ... while an OP_NOP does not hide the key beneath it from the opcode that spends it
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(CScript() << zeros(32) << OP_NOP << OP_CHECKSIG));
+
+    // Naming a k the run cannot satisfy forfeits the credit too
+    CScript inflated{CScript() << zeros(32) << OP_CHECKSIG};
+    for (int i{1}; i < 15; ++i) {
+        inflated << zeros(32) << OP_CHECKSIGADD;
+    }
+    inflated << 20 << OP_NUMEQUAL;
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(inflated, TapscriptWitness(11, 15, inflated)));
+
+    // The OP_CHECKSIG a run opens on credits one of the k already, so a 1-of-n is credited once
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(MultiAScript(1, 3), TapscriptWitness(1, 3, MultiAScript(1, 3))));
+    // Naming more signatures than the spend offers earns nothing here as it does elsewhere
+    BOOST_CHECK_EQUAL("132+0", DatacarrierBytesStr(MultiAScript(11, 15), TapscriptWitness(1, 15, MultiAScript(11, 15))));
+
+    // A key inside an OP_FALSE OP_IF envelope is counted with the envelope, once
+    BOOST_CHECK_EQUAL("0+37", DatacarrierBytesStr(CScript() << OP_FALSE << OP_IF << zeros(32)
+                                                            << OP_CHECKSIG << OP_ENDIF));
+    // A dropped key is already counted as dropped data; it is not charged twice, and no credit
+    // drives the count below zero
+    BOOST_CHECK_EQUAL("0+35", DatacarrierBytesStr(CScript() << zeros(32) << OP_CHECKSIG << zeros(33) << OP_DROP));
+    CScript over_credited{MultiAScript(3, 3)};
+    over_credited << OP_3 << OP_NUMEQUAL << OP_3 << OP_NUMEQUAL;
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(over_credited));
+
+    // A 32 byte push nothing spends and no drop balances is reached by neither rule. It is
+    // stranded on the stack, which leaves the leaf unspendable, so it buys nothing.
+    CScript stranded;
+    for (int i{0}; i < 15; ++i) {
+        stranded << zeros(32);
+    }
+    BOOST_CHECK_EQUAL("0+0", DatacarrierBytesStr(stranded));
+    // Balance the same pushes with drops and the run rule charges them whole
+    BOOST_CHECK_EQUAL("0+496", DatacarrierBytesStr(CScript{stranded} << OP_2DROP << OP_2DROP << OP_2DROP
+                                                                     << OP_2DROP << OP_2DROP << OP_2DROP
+                                                                     << OP_2DROP << OP_DROP));
 }
 
 BOOST_AUTO_TEST_CASE(script_GetScriptForTransactionInput)
diff --git a/test/functional/feature_taproot.py b/test/functional/feature_taproot.py
index 1f91fe1743b6..1915a3689514 100755
--- a/test/functional/feature_taproot.py
+++ b/test/functional/feature_taproot.py
@@ -1065,8 +1065,10 @@ def big_spend_inputs(ctx):
     add_spender(spenders, "tapscript/emptysigs/checksig", leaf="t12", **common, inputs=[b'', getter("sign")], failure={"leaf": "t13"}, **ERR_UNKNOWN_PUBKEY)
     add_spender(spenders, "tapscript/emptysigs/nochecksigverify", leaf="t12", **common, inputs=[b'', getter("sign")], failure={"leaf": "t20"}, **ERR_UNKNOWN_PUBKEY)
     add_spender(spenders, "tapscript/emptysigs/checksigadd", leaf="t14", **common, inputs=[b'', getter("sign")], failure={"leaf": "t15"}, **ERR_UNKNOWN_PUBKEY)
-    # Test that scripts over 10000 bytes (and over 201 non-push ops) are acceptable.
-    add_spender(spenders, "tapscript/no10000limit", leaf="t19", **SINGLE_SIG, **common)
+    # Test that scripts over 10000 bytes (and over 201 non-push ops) are acceptable by consensus.
+    # The leaf opens with 10001 repeats of OP_0 OP_0 OP_2DROP, which datacarrier policy counts as
+    # a data envelope, so it is only spendable in a block rather than through the mempool.
+    add_spender(spenders, "tapscript/no10000limit", leaf="t19", standard=False, **SINGLE_SIG, **common)
     # Test that a stack size of 1000 elements is permitted, but 1001 isn't.
     add_spender(spenders, "tapscript/1000stack", leaf="t21", **SINGLE_SIG, **common, failure={"leaf": "t22"}, **ERR_STACK_SIZE)
     # Test that an input stack size of 1000 elements is permitted, but 1001 isn't.
@@ -1089,7 +1091,7 @@ def big_spend_inputs(ctx):
         # n OP_CHECKSIGVERIFYs and 1 OP_CHECKSIGADD, but also one unexecuted OP_CHECKSIGVERIFY.
         lambda n, pk: (CScript([OP_DROP, pk, OP_0, OP_IF, OP_2DUP, OP_CHECKSIGVERIFY, OP_ENDIF] + [OP_2DUP, OP_CHECKSIGVERIFY] * n + [OP_2, OP_SWAP, OP_CHECKSIGADD, OP_3, OP_EQUAL]), n + 1),
         # n OP_CHECKSIGVERIFYs and 1 OP_CHECKSIGADD, but also one unexecuted OP_CHECKSIG.
-        lambda n, pk: (CScript([random.randbytes(220), OP_2DROP, pk, OP_1, OP_NOTIF, OP_2DUP, OP_CHECKSIG, OP_VERIFY, OP_ENDIF] + [OP_2DUP, OP_CHECKSIGVERIFY] * n + [OP_4, OP_SWAP, OP_CHECKSIGADD, OP_5, OP_EQUAL]), n + 1),
+        lambda n, pk: (CScript([random.randbytes(75), OP_2DROP, pk, OP_1, OP_NOTIF, OP_2DUP, OP_CHECKSIG, OP_VERIFY, OP_ENDIF] + [OP_2DUP, OP_CHECKSIGVERIFY] * n + [OP_4, OP_SWAP, OP_CHECKSIGADD, OP_5, OP_EQUAL]), n + 1),
         # n OP_CHECKSIGVERIFYs and 1 OP_CHECKSIGADD, but also one unexecuted OP_CHECKSIGADD.
         lambda n, pk: (CScript([OP_DROP, pk, OP_1, OP_IF, OP_ELSE, OP_2DUP, OP_6, OP_SWAP, OP_CHECKSIGADD, OP_7, OP_EQUALVERIFY, OP_ENDIF] + [OP_2DUP, OP_CHECKSIGVERIFY] * n + [OP_8, OP_SWAP, OP_CHECKSIGADD, OP_9, OP_EQUAL]), n + 1),
         # n+1 OP_CHECKSIGs, but also one OP_CHECKSIG with an empty signature.
diff --git a/test/functional/mempool_datacarrier.py b/test/functional/mempool_datacarrier.py
index 540597199994..3b945f693528 100755
--- a/test/functional/mempool_datacarrier.py
+++ b/test/functional/mempool_datacarrier.py
@@ -3,6 +3,7 @@
 # Distributed under the MIT software license, see the accompanying
 # file COPYING or http://www.opensource.org/licenses/mit-license.php.
 """Test datacarrier functionality"""
+from test_framework.key import ECKey
 from test_framework.messages import (
     COutPoint,
     CTransaction,
@@ -15,10 +16,15 @@
     CScript,
     OP_1,
     OP_2DROP,
+    OP_7,
+    OP_CHECKMULTISIG,
     OP_DROP,
     OP_RETURN,
+    SIGHASH_ALL,
+    SegwitV0SignatureHash,
     taproot_construct,
 )
+from test_framework.script_util import script_to_p2wsh_script
 from test_framework.test_framework import BitcoinTestFramework
 from test_framework.test_node import TestNode
 from test_framework.util import assert_raises_rpc_error
@@ -91,6 +97,90 @@ def test_opnet_transaction(self, node: TestNode, success: bool) -> None:
             assert_raises_rpc_error(-26, "txn-datacarrier-exceeded",
                                     self.wallet.sendrawtransaction, from_node=node, tx_hex=tx_hex)
 
+    def test_unproven_pubkeys_transaction(self, node: TestNode, m: int, n: int, success: bool,
+                                          num_inputs: int = 1) -> None:
+        """Spend num_inputs m-of-n P2WSH multisig outputs, offering every signature each asks for.
+
+        The n - m keys left over are ones no signature can prove, and past a small tolerance
+        their bytes are payload rather than a spending condition. The tolerance is per script,
+        so several wide multisig inputs in one transaction do add up.
+        """
+        keys = []
+        for _ in range(n):
+            key = ECKey()
+            key.generate(compressed=True)
+            keys.append(key)
+        # Above 16 a key count is a minimal push rather than an OP_N, which CScript handles.
+        script = CScript([m] + [k.get_pubkey().get_bytes() for k in keys] + [n, OP_CHECKMULTISIG])
+        script_pubkey = script_to_p2wsh_script(script)
+
+        funding_value = 100_000
+        funding = [self.wallet.send_to(from_node=self.nodes[0], scriptPubKey=script_pubkey,
+                                       amount=funding_value) for _ in range(num_inputs)]
+        self.generate(self.wallet, 1, sync_fun=self.sync_blocks)
+
+        spend_tx = CTransaction()
+        spend_tx.version = 2
+        spend_tx.vin = [CTxIn(COutPoint(int(f['txid'], 16), f['sent_vout'])) for f in funding]
+        spend_tx.vout = [CTxOut(funding_value * num_inputs - 10000, script_pubkey)]
+        spend_tx.wit.vtxinwit = [CTxInWitness() for _ in funding]
+        for i in range(num_inputs):
+            sighash = SegwitV0SignatureHash(script, spend_tx, i, SIGHASH_ALL, funding_value)
+            sigs = [k.sign_ecdsa(sighash) + bytes([SIGHASH_ALL]) for k in keys[:m]]
+            # The leading empty item is the CHECKMULTISIG dummy.
+            spend_tx.wit.vtxinwit[i].scriptWitness.stack = [b''] + sigs + [bytes(script)]
+        tx_hex = spend_tx.serialize().hex()
+
+        if success:
+            self.wallet.sendrawtransaction(from_node=node, tx_hex=tx_hex)
+            assert spend_tx.rehash() in node.getrawmempool(True)
+        else:
+            assert_raises_rpc_error(-26, "txn-datacarrier-exceeded",
+                                    self.wallet.sendrawtransaction, from_node=node, tx_hex=tx_hex)
+
+    def test_bare_envelope(self, node: TestNode, data_len: int, success: bool, interleave_pushnum: bool = False) -> None:
+        # A bare inscription envelope: <marker> <data>... balanced by OP_2DROP,
+        # with no OP_IF wrapper (the shape ordinals/ord#4545 uses under BIP-110).
+        # A pushnum interleaved in the run (which ord's parser accepts as payload)
+        # must not strand the large push from datacarrier counting.
+        if interleave_pushnum:
+            envelope_script = CScript([randbytes(data_len), OP_7, randbytes(1), OP_2DROP, OP_DROP, OP_1])
+        else:
+            envelope_script = CScript([b'ord', randbytes(data_len), OP_2DROP, OP_1])
+        internal_key = b'\x01' * 32
+        tap = taproot_construct(internal_key, [("leaf", envelope_script), ("dummy", CScript([OP_1]))])
+        leaf = tap.leaves["leaf"]
+        control_block = bytes([leaf.version | tap.negflag]) + tap.internal_pubkey + leaf.merklebranch
+        assert len(control_block) == 65
+
+        utxo = self.wallet.get_utxo()
+        funding_tx = CTransaction()
+        funding_tx.vin = [CTxIn(COutPoint(int(utxo['txid'], 16), utxo['vout']))]
+        funding_value = int(utxo['value'] * 100_000_000) - 1000
+        funding_tx.vout = [CTxOut(funding_value, tap.scriptPubKey)]
+        funding_tx.version = 2
+        self.wallet.sign_tx(funding_tx)
+        funding_tx.rehash()
+        self.nodes[0].sendrawtransaction(funding_tx.serialize().hex())
+        self.generate(self.nodes[0], 1, sync_fun=self.sync_blocks)
+
+        spend_tx = CTransaction()
+        spend_tx.version = 2
+        spend_tx.vin = [CTxIn(COutPoint(int(funding_tx.hash, 16), 0))]
+        spend_tx.vout = [CTxOut(funding_value - 1000, tap.scriptPubKey)]
+        spend_tx.wit.vtxinwit = [CTxInWitness()]
+        spend_tx.wit.vtxinwit[0].scriptWitness.stack = [
+            bytes(envelope_script),  # tapscript
+            control_block,           # control block (65 bytes)
+        ]
+        tx_hex = spend_tx.serialize().hex()
+
+        if success:
+            self.wallet.sendrawtransaction(from_node=node, tx_hex=tx_hex)
+            assert spend_tx.rehash() in node.getrawmempool(True)
+        else:
+            assert_raises_rpc_error(-26, "txn-datacarrier-exceeded",
+                                    self.wallet.sendrawtransaction, from_node=node, tx_hex=tx_hex)
 
     def run_test(self):
         self.wallet = MiniWallet(self.nodes[0])
@@ -141,6 +231,40 @@ def run_test(self):
         self.log.info("Testing an OPNet transaction (just pushing 'op') with -datacarriersize=2.")
         self.test_opnet_transaction(node=self.nodes[3], success=False)
 
+        self.log.info("Testing a bare OP_2DROP envelope larger than the default -datacarriersize.")
+        self.test_bare_envelope(node=self.nodes[0], data_len=MAX_OP_RETURN_RELAY, success=False)
+
+        self.log.info("Testing a bare OP_2DROP envelope smaller than the default -datacarriersize.")
+        # data_len >= 2 keeps the payload a minimal push; a 1-byte push of 1..16 or 0x81 would be
+        # rejected by MINIMALDATA in script verification rather than accepted by the datacarrier check.
+        self.test_bare_envelope(node=self.nodes[0], data_len=2, success=True)
+
+        self.log.info("Testing a bare envelope with a pushnum interleaved in the push run.")
+        self.test_bare_envelope(node=self.nodes[0], data_len=MAX_OP_RETURN_RELAY, success=False, interleave_pushnum=True)
+
+        self.log.info("Testing ordinary multisig, which is charged nothing however wide.")
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=2, n=3, success=True)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=3, n=5, success=True)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=2, n=6, success=True)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=11, n=15, success=True)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=14, n=17, success=True)
+        # Several inputs of the same shape, since the budget is per transaction
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=2, n=5, success=True, num_inputs=3)
+
+        self.log.info("Testing a multisig padded out with keys no signature can prove.")
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=1, n=11, success=True)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=1, n=15, success=False)
+
+        self.log.info("Testing that -datacarriersize governs the spare keys, and that multisig "
+                      "with nothing to spare is unaffected by it.")
+        self.test_unproven_pubkeys_transaction(node=self.nodes[3], m=2, n=3, success=True)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[3], m=1, n=12, success=False)
+
+        self.log.info("Testing that what is charged is charged per script, so it adds up over "
+                      "the inputs of a transaction.")
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=1, n=12, success=True, num_inputs=2)
+        self.test_unproven_pubkeys_transaction(node=self.nodes[0], m=1, n=12, success=False, num_inputs=3)
+
 
 if __name__ == '__main__':
     DataCarrierTest(__file__).main()
diff --git a/test/functional/mempool_dead_branch.py b/test/functional/mempool_dead_branch.py
new file mode 100755
index 000000000000..93cffa9196ed
--- /dev/null
+++ b/test/functional/mempool_dead_branch.py
@@ -0,0 +1,99 @@
+#!/usr/bin/env python3
+# Copyright (c) 2026 The Bitcoin Knots developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+"""Test data in a dead conditional branch and -rejectdeadbranches"""
+from test_framework.messages import (
+    COutPoint,
+    CTransaction,
+    CTxIn,
+    CTxInWitness,
+    CTxOut,
+)
+from test_framework.script import (
+    CScript,
+    OP_0,
+    OP_1,
+    OP_ELSE,
+    OP_ENDIF,
+    OP_IF,
+    OP_NOP,
+    OP_NOTIF,
+)
+from test_framework.script_util import script_to_p2wsh_script
+from test_framework.test_framework import BitcoinTestFramework
+from test_framework.util import assert_equal, assert_greater_than
+from test_framework.wallet import MiniWallet
+
+
+class DeadBranchTest(BitcoinTestFramework):
+    def set_test_params(self):
+        self.num_nodes = 5
+        self.extra_args = [
+            [],  # the framework passes -corepolicy, which accepts non-standard carriers
+            ["-corepolicy=0"],  # the Knots default
+            ["-corepolicy=0", "-rejectdeadbranches=0"],
+            ["-corepolicy=0", "-acceptnonstddatacarrier=1"],
+            ["-corepolicy=0", "-acceptnonstddatacarrier=1", "-rejectdeadbranches=0"],
+        ]
+
+    def spend(self, witness_script):
+        """Fund a P2WSH output to witness_script and return its spend, which needs no signature"""
+        funding = self.wallet.send_to(from_node=self.nodes[0], scriptPubKey=script_to_p2wsh_script(witness_script), amount=100000)
+        self.generate(self.nodes[0], 1)
+        tx = CTransaction()
+        tx.version = 2
+        tx.vin = [CTxIn(COutPoint(int(funding["txid"], 16), funding["sent_vout"]))]
+        tx.vout = [CTxOut(99000, self.wallet.get_output_script())]
+        tx.wit.vtxinwit = [CTxInWitness()]
+        tx.wit.vtxinwit[0].scriptWitness.stack = [bytes(witness_script)]
+        return tx.serialize().hex()
+
+    def check(self, node, tx_hex, allowed, reason=None):
+        result = node.testmempoolaccept([tx_hex])[0]
+        assert_equal(result["allowed"], allowed)
+        if reason:
+            assert_equal(result["reject-reason"], reason)
+        return result
+
+    def run_test(self):
+        self.wallet = MiniWallet(self.nodes[0])
+        corepolicy, default, disabled, costed, costed_disabled = self.nodes
+
+        # OP_1 makes OP_NOTIF skip its branch, so the push cannot affect the
+        # spend. This is the JXL-n-hide witness shape; the OP_FALSE OP_IF
+        # inscription envelope is the same idea with the constant reversed.
+        self.log.info("Data in an OP_1 OP_NOTIF branch is rejected by default")
+        dead_notif = self.spend(CScript([OP_1, OP_NOTIF, b'\xab' * 10, OP_ENDIF, OP_1]))
+        self.check(default, dead_notif, False, "txn-datacarrier-nonstandard")
+
+        self.log.info("-rejectdeadbranches=0 and -corepolicy accept it")
+        self.check(disabled, dead_notif, True)
+        self.check(corepolicy, dead_notif, True)
+
+        self.log.info("Data in the else of a branch a constant always takes is rejected too")
+        dead_else = self.spend(CScript([OP_1, OP_IF, OP_1, OP_ELSE, b'\xab' * 10, OP_ENDIF]))
+        self.check(default, dead_else, False, "txn-datacarrier-nonstandard")
+        self.check(disabled, dead_else, True)
+
+        self.log.info("A guard that constants decide is counted however it is computed")
+        nop_guard = self.spend(CScript([OP_1, OP_NOP, OP_NOTIF, b'\xab' * 10, OP_ENDIF, OP_1]))
+        self.check(default, nop_guard, False, "txn-datacarrier-nonstandard")
+        self.check(disabled, nop_guard, True)
+
+        self.log.info("-rejectdeadbranches=0 still counts the OP_FALSE OP_IF envelope")
+        envelope = self.spend(CScript([OP_0, OP_IF, b'\xab' * 10, OP_ENDIF, OP_1]))
+        self.check(default, envelope, False, "txn-datacarrier-nonstandard")
+        self.check(disabled, envelope, False, "txn-datacarrier-nonstandard")
+
+        self.log.info("A branch the guard takes is not counted: its push is the spend's result")
+        self.check(default, self.spend(CScript([OP_0, OP_NOTIF, b'\xab' * 10, OP_ENDIF])), True)
+
+        self.log.info("The switch reaches -datacarriercost too")
+        counted = self.check(costed, dead_notif, True)
+        uncounted = self.check(costed_disabled, dead_notif, True)
+        assert_greater_than(counted["vsize"], uncounted["vsize"])
+
+
+if __name__ == '__main__':
+    DeadBranchTest(__file__).main()
diff --git a/test/functional/test_runner.py b/test/functional/test_runner.py
index 45a49f73a0ed..0acaa20ff8f6 100755
--- a/test/functional/test_runner.py
+++ b/test/functional/test_runner.py
@@ -296,6 +296,7 @@
     'feature_utxo_set_hash.py',
     'feature_rbf.py',
     'mempool_packages.py',
+    'mempool_dead_branch.py',
     'mempool_package_onemore.py',
     'mempool_package_limits.py',
     'mempool_package_rbf.py',